Edit tour

Windows Analysis Report
https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe

Overview

General Information

Sample URL:	https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe
Analysis ID:	1589827
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Drops large PE files

Infects executable files (exe, dll, sys, html)

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 6764 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe" > cmdline.out 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wget.exe (PID: 6912 cmdline: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe" MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)

CloudCompare_v2.14.alpha_setup_x64.exe (PID: 5016 cmdline: "C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe" MD5: 4FA9171C45161772572CB136422EA7FD)

CloudCompare_v2.14.alpha_setup_x64.tmp (PID: 6908 cmdline: "C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp" /SL5="$B01CE,353634964,780800,C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe" MD5: CA9D0BC1FC3C0AEBE22047A2DCBCD715)

vcredist_2013_x64.exe (PID: 4264 cmdline: "C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe" /install /quiet /norestart MD5: 49B1164F8E95EC6409EA83CDB352D8DA)

vcredist_2013_x64.exe (PID: 6120 cmdline: "C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe" /install /quiet /norestart -burn.unelevated BurnPipe.{1EB8EC4C-F5D1-4ECA-9DD0-7714AF65556E} {84117F68-D40E-4241-8A1A-B0F8298D254D} 4264 MD5: 49B1164F8E95EC6409EA83CDB352D8DA)

VC_redist.x64.exe (PID: 4592 cmdline: "C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe" /install /quiet /norestart MD5: 223A76CD5AB9E42A5C55731154B85627)

VC_redist.x64.exe (PID: 2492 cmdline: "C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe" -burn.filehandle.attached=680 -burn.filehandle.self=684 /install /quiet /norestart MD5: 3F32F1A9BD60AE065B89C2223676592E)

VC_redist.x64.exe (PID: 6552 cmdline: "C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5DEBEB27-EE90-4179-8801-9F2879D6FF33} {CFB915F2-7D0C-4BB0-A831-01B27FBD1688} 2492 MD5: 3F32F1A9BD60AE065B89C2223676592E)

VC_redist.x64.exe (PID: 2488 cmdline: "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{3CE290E6-406D-4F39-9839-02C576C54025} {EA2D85BC-101D-4701-8D4D-A4BF8B19AB71} 6552 MD5: 35E545DAC78234E4040A99CBB53000AC)

VC_redist.x64.exe (PID: 4280 cmdline: "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.filehandle.attached=508 -burn.filehandle.self=520 -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{3CE290E6-406D-4F39-9839-02C576C54025} {EA2D85BC-101D-4701-8D4D-A4BF8B19AB71} 6552 MD5: 35E545DAC78234E4040A99CBB53000AC)

VC_redist.x64.exe (PID: 2128 cmdline: "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5A86F4D1-A9EC-4B64-B083-BE7A62BB96B8} {9AF4D465-6A98-4E12-88F2-BC1C1719DF24} 4280 MD5: 35E545DAC78234E4040A99CBB53000AC)

SrTasks.exe (PID: 5668 cmdline: C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1 MD5: 2694D2D28C368B921686FE567BD319EB)

conhost.exe (PID: 4444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 6280 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

vcredist_x64.exe (PID: 2356 cmdline: "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /burn.runonce MD5: 3284088A2D414D65E865004FDB641936)

vcredist_x64.exe (PID: 6076 cmdline: "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" MD5: 3284088A2D414D65E865004FDB641936)

SrTasks.exe (PID: 824 cmdline: C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2 MD5: 2694D2D28C368B921686FE567BD319EB)

conhost.exe (PID: 5596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

VC_redist.x64.exe (PID: 6256 cmdline: "C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" /burn.runonce MD5: 3F32F1A9BD60AE065B89C2223676592E)

VC_redist.x64.exe (PID: 864 cmdline: "C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" MD5: 3F32F1A9BD60AE065B89C2223676592E)

VC_redist.x64.exe (PID: 4944 cmdline: "C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 MD5: 3F32F1A9BD60AE065B89C2223676592E)

LogonUI.exe (PID: 708 cmdline: "LogonUI.exe" /flags:0x4 /state0:0xa3f5a855 /state1:0x41c64e6d MD5: 893144FE49AA16124B5BD3034E79BBC6)

cleanup

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe" > cmdline.out 2>&1, CommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe" > cmdline.out 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 744, ProcessCommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe" > cmdline.out 2>&1, ProcessId: 6764, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe" > cmdline.out 2>&1, CommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe" > cmdline.out 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 744, ProcessCommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe" > cmdline.out 2>&1, ProcessId: 6764, ProcessName: cmd.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /burn.runonce, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe, ProcessId: 4264, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: 11_2_00FE7BC4 _memset,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,ReadFile,CryptHashData,ReadFile,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,GetLastError,CryptDestroyHash,CryptReleaseContext,	11_2_00FE7BC4
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: 11_2_00FC8566 CryptHashPublicKeyInfo,GetLastError,	11_2_00FC8566
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: 11_2_00FC86E7 DecryptFileW,	11_2_00FC86E7
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004BBD11 ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,DecryptFileW,LocalFree,	20_2_004BBD11
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004BBAF6 DecryptFileW,DecryptFileW,	20_2_004BBAF6
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004E4C0F CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	20_2_004E4C0F
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A5BD11 ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,DecryptFileW,LocalFree,	21_2_00A5BD11
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A5BAF6 DecryptFileW,DecryptFileW,	21_2_00A5BAF6
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A84C0F CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	21_2_00A84C0F
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E5BAF6 DecryptFileW,DecryptFileW,	22_2_00E5BAF6
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E84C0F CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	22_2_00E84C0F
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E5BD11 ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,DecryptFileW,LocalFree,	22_2_00E5BD11
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 24_2_005486E7 DecryptFileW,	24_2_005486E7
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 24_2_00567BC4 _memset,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,ReadFile,CryptHashData,ReadFile,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,GetLastError,CryptDestroyHash,CryptReleaseContext,	24_2_00567BC4
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 24_2_00548566 CryptHashPublicKeyInfo,GetLastError,	24_2_00548566
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003CF961 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	28_2_003CF961
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003A9C99 DecryptFileW,DecryptFileW,	28_2_003A9C99
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003A9EB7 DecryptFileW,	28_2_003A9EB7

Source: is-F27EN.tmp.10.dr

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_9a877de2-9

Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\unins000.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-E67D7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-RK2D7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-F0B2H.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-BU6NB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-78AIN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-5U5RQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-Q3UAG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-A4GQ6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-K8E7Q.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-T8E89.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-7AMNT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-KMJ88.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-MV458.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-0UCED.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-S20LH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-9Q3NC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-DMGNO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-5NEDU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-9MQ23.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-96G17.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-QLH03.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-0ETAJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-1D8GC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-CRC3K.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-DG0J0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-RKRC4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-TLF74.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-F8008.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-GBVP7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-V81UA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-7D511.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-QJLST.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-2BPFH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-Q8VGT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-3UACU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-4N83B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-GD96M.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-5LLNK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-1AVDH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-2NF19.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-6E13D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-VUNA7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-ULPPI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-8GF8G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-Q4FUF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-9564F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-LNQRQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-F27EN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-OU74J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-EHH64.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-JJ5J0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-5DUDN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-AJ0MH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-TJIIT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-LIKHT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-NKH37.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-1T592.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-TRDII.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-86FV8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-V60H0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-T6I4U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-ORCGS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-DE3LQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-OHVSP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-VQV6S.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-02UTJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-NUL4B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-192GB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-MF4VL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-82NCD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-GMPDH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-9V9PD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-VD2K0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-O99L5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-4FB87.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-FVJ9O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-OL3SL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-N98JH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-UP0V3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-Q06N3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\gamepads	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\gamepads\is-T476D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\iconengines	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\iconengines\is-2O479.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-VN2GT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-R83R7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-2F3I0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-AM7K6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-26VGE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-8LGJR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-H2EK5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-FFN20.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-G554D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\platforms	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\platforms\is-JL72O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-NO2LL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-A6DSE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-9UK7J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-5R3DL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-4H4J7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-EKSJ8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-EVN8N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-1BHUB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-K59TJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-UQ6Q7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-SFOAI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-H5T2H.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-HMUPJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-EV193.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-09N3S.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-SVRC0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-7SBVS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-23FRJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-51UVB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-S1TGF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-DDST8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-E63HF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-58SRQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-AKS9N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-U95IF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-VJOEG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-QQLBV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-DG6LF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-QP8K8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-RGJQE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-8BQMI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-MPFLG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-EJTBC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-8A210.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-232MC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-84SFH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-8RLKI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-C1KHU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-3FSQ4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-L6IDA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-MN40I.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-O1011.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\Bilateral	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\Bilateral\is-7E84J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\Bilateral\is-I54SL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\ColorRamp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\ColorRamp\is-QD1K5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\DrawNormals	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\DrawNormals\is-16Q60.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\DrawNormals\is-079CG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\DrawNormals\is-1T3F7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\EDL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\EDL\is-VLK83.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\EDL\is-CSNSK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\EDL\is-KV0SK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\EDL\is-V57QR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\SSAO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\SSAO\is-NGK93.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\SSAO\is-16B4L.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\styles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\styles\is-HV0JM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-443P6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-CGINU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-GP11Q.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-1E24F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-S6F83.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-9AV9B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-1CVRR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-A4SLN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-J6M97.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-ITE62.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-KN4UH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-PFR24.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-TL72C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-VNUAS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-2S2PK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-6DHOH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-THVTA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-TRV8H.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-UBV0R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-2QKRK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-F6T7O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-10N3O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-0NGBU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-OQE25.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-HJ7JF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-QC8LA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-7DSMM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-PCIMT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-5O1M6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-3HP9U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-GJN0R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-9VPOJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-8LM9M.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\unins000.msg	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SystemRestore SRInitDone

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4DE0A2C8-03F9-4B3F-BAFC-1D5F2141464B}_is1

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1028\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1029\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1031\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1036\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1040\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1041\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1042\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1045\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1046\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1049\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1055\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\2052\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\3082\license.rtf
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\license.rtf
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1028\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1029\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1031\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1036\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1040\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1041\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1042\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1045\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1046\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1049\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1055\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\2052\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\3082\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1028\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1029\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1031\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1036\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1040\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1041\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1042\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1045\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1046\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1049\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1055\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\2052\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\3082\license.rtf

Source:	Binary string: MFCM120U.amd64.pdb source: mfcm120u.dll.19.dr
Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: VC_redist.x64.exe, 0000001C.00000002.5094773956.00000000003DB000.00000002.00000001.01000000.00000014.sdmp, VC_redist.x64.exe, 0000001D.00000002.5086434755.00000000003DB000.00000002.00000001.01000000.00000014.sdmp, VC_redist.x64.exe, 0000001E.00000002.5082503451.00000000003DB000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb source: VC_redist.x64.exe, 00000014.00000000.4866316131.00000000004EE000.00000002.00000001.01000000.0000000E.sdmp, VC_redist.x64.exe, 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmp, VC_redist.x64.exe, 00000015.00000000.4867826152.0000000000A8E000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 00000015.00000002.5106004440.0000000000A8E000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 00000016.00000002.5102890508.0000000000E8E000.00000002.00000001.01000000.00000011.sdmp, VC_redist.x64.exe, 00000016.00000003.5002147253.0000000000980000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 00000016.00000000.4875152360.0000000000E8E000.00000002.00000001.01000000.00000011.sdmp, VC_redist.x64.exe, 0000001F.00000000.5129153010.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001F.00000002.5138174837.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000020.00000002.5484844134.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000020.00000000.5130814743.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000021.00000000.5133213302.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000021.00000002.5484898708.00000000009CE000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixStdBA.pdbH source: vcredist_x64.exe, 00000019.00000002.5497241555.000000006BA05000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb source: vcredist_2013_x64.exe, 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmp, vcredist_2013_x64.exe, 0000000B.00000000.4635010313.0000000000FEB000.00000002.00000001.01000000.00000008.sdmp, vcredist_2013_x64.exe, 0000000D.00000002.4862972062.0000000000FEB000.00000002.00000001.01000000.00000008.sdmp, vcredist_2013_x64.exe, 0000000D.00000000.4636956599.0000000000FEB000.00000002.00000001.01000000.00000008.sdmp, vcredist_x64.exe, 00000018.00000000.4892550754.000000000056B000.00000002.00000001.01000000.00000012.sdmp, vcredist_x64.exe, 00000018.00000002.4899692937.000000000056B000.00000002.00000001.01000000.00000012.sdmp, vcredist_x64.exe, 00000019.00000002.5485472293.000000000056B000.00000002.00000001.01000000.00000012.sdmp, vcredist_x64.exe, 00000019.00000000.4894071572.000000000056B000.00000002.00000001.01000000.00000012.sdmp, vcredist_x64.exe.13.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixDepCA.pdb source: vcredist_2013_x64.exe, 0000000B.00000003.4804245294.000000000088D000.00000004.00000020.00020000.00000000.sdmp, vcredist_2013_x64.exe, 0000000B.00000003.4806048727.00000000008C6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Network.pdb source: is-F27EN.tmp.10.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb`E source: vcredist_x64.exe.13.dr
Source:	Binary string: MFCM120U.amd64.pdb8@ source: mfcm120u.dll.19.dr
Source:	Binary string: C:\agent\_work\36\s\wix\build\ship\x86\WixStdBA.pdb source: VC_redist.x64.exe, 00000021.00000002.5497369648.000000006F853000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: E:\builds\xerces-c-3.1.4\Build\Win64\VC12\Release\xerces-c_3_1.pdb source: is-UP0V3.tmp.10.dr
Source:	Binary string: E:\builds\openssl-1.0.1h\x64\out32dll\libeay32.pdb source: is-DG0J0.tmp.10.dr
Source:	Binary string: C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb4 source: VC_redist.x64.exe, 00000014.00000000.4866316131.00000000004EE000.00000002.00000001.01000000.0000000E.sdmp, VC_redist.x64.exe, 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmp, VC_redist.x64.exe, 00000015.00000000.4867826152.0000000000A8E000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 00000015.00000002.5106004440.0000000000A8E000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 00000016.00000002.5102890508.0000000000E8E000.00000002.00000001.01000000.00000011.sdmp, VC_redist.x64.exe, 00000016.00000003.5002147253.0000000000980000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 00000016.00000000.4875152360.0000000000E8E000.00000002.00000001.01000000.00000011.sdmp, VC_redist.x64.exe, 0000001F.00000000.5129153010.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001F.00000002.5138174837.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000020.00000002.5484844134.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000020.00000000.5130814743.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000021.00000000.5133213302.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000021.00000002.5484898708.00000000009CE000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: E:\builds\xerces-c-3.1.4\Build\Win64\VC12\Release\xerces-c_3_1.pdb; source: is-UP0V3.tmp.10.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb`X source: vcredist_x64.exe, 00000018.00000000.4892550754.000000000056B000.00000002.00000001.01000000.00000012.sdmp, vcredist_x64.exe, 00000018.00000002.4899692937.000000000056B000.00000002.00000001.01000000.00000012.sdmp, vcredist_x64.exe, 00000019.00000002.5485472293.000000000056B000.00000002.00000001.01000000.00000012.sdmp, vcredist_x64.exe, 00000019.00000000.4894071572.000000000056B000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixStdBA.pdb source: vcredist_x64.exe, 00000019.00000002.5497241555.000000006BA05000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140ESN.amd64.pdb source: mfc140esn.dll.19.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb` source: vcredist_2013_x64.exe, 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmp, vcredist_2013_x64.exe, 0000000B.00000000.4635010313.0000000000FEB000.00000002.00000001.01000000.00000008.sdmp, vcredist_2013_x64.exe, 0000000D.00000002.4862972062.0000000000FEB000.00000002.00000001.01000000.00000008.sdmp, vcredist_2013_x64.exe, 0000000D.00000000.4636956599.0000000000FEB000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: E:\builds\openssl-1.0.1h\x64\out32dll\libeay32.pdbU source: is-DG0J0.tmp.10.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140jpn.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140esn.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140ita.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140deu.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140chs.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfcm140u.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140enu.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfcm120.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc120u.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\concrt140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140fra.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\vccorlib140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\msvcp140_atomic_wait.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\vcomp140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140cht.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140rus.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfcm140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfcm120u.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140kor.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\msvcp140_2.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140u.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\msvcp140_codecvt_ids.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\msvcr120.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\vcamp140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\msvcp120.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\vccorlib120.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\msvcp140_1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc120.dll	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: 11_2_00FC9065 _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	11_2_00FC9065
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: 11_2_00FE6CB2 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	11_2_00FE6CB2
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: 11_2_00FE5D1F _memset,FindFirstFileW,FindClose,	11_2_00FE5D1F
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004A1700 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,FindClose,	20_2_004A1700
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004A3B2C FindFirstFileW,FindClose,	20_2_004A3B2C
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004DC2AF FindFirstFileExW,FindNextFileW,FindClose,FindClose,	20_2_004DC2AF
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004BB79F FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	20_2_004BB79F
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A5B79F FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	21_2_00A5B79F
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A41700 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,FindClose,	21_2_00A41700
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A43B2C FindFirstFileW,FindClose,	21_2_00A43B2C
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A7C2AF FindFirstFileExW,FindNextFileW,FindClose,FindClose,	21_2_00A7C2AF
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E5B79F FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	22_2_00E5B79F
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E41700 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,FindClose,	22_2_00E41700
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E43B2C FindFirstFileW,FindClose,	22_2_00E43B2C
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E7C2AF FindFirstFileExW,FindNextFileW,FindClose,FindClose,	22_2_00E7C2AF
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 24_2_00566CB2 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	24_2_00566CB2
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 24_2_00549065 _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	24_2_00549065
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 24_2_00565D1F _memset,FindFirstFileW,FindClose,	24_2_00565D1F
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 25_2_6B9FA685 _memset,FindFirstFileW,FindClose,	25_2_6B9FA685
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_00393BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	28_2_00393BC3
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003D4315 FindFirstFileW,FindClose,	28_2_003D4315
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003A993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	28_2_003A993E

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\NULL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages\vcRuntimeAdditional_amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File opened: C:\ProgramData\Package Cache\NULL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages\NULL	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe

Code function: 11_2_00FD6FEC InternetReadFile,WriteFile,WriteFile,GetLastError,GetLastError,

11_2_00FD6FEC

Source: is-F27EN.tmp.10.dr

String found in binary or memory: 04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1email.google.comf5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06www.google.comd7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3login.yahoo.com39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:293e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47login.skype.com92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43addons.mozilla.orgb0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0login.live.comd8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0global trustee05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56*.google.com0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4cDigiNotar Root CAf1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49DigiNotar Services CA36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38DigiNotar Services 1024 CA0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3eDigiNotar Root CA G2a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21CertiID Enterprise Certificate Authority5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41DigiNotar Qualified CA46:9c:2c:b007:27:10:0dDigiNotar Cyber CA07:27:0f:f907:27:10:0301:31:69:b0DigiNotar PKIoverheid CA Overheid en Bedrijven01:31:34:bfDigiNotar PKIoverheid CA Organisatie - G2d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4DigiNotar Extended Validation CA1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04DigiNotar Public CA 202546:9c:2c:af46:9c:3c:c907:27:14:a9Digisign Server ID (Enrich)4c:0e:63:6aDigisign Server ID - (Enrich)72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0UTN-USERFirst-Hardware41MD5 Collisions Inc. (http://www.phreedom.org/md5)08:27*.EGO.GOV.TR08:64e-islem.kktcmerkezbankasi.org03:1d:a7AC DG Tr equals www.yahoo.com (Yahoo)

Source: is-UP0V3.tmp.10.dr	String found in binary or memory: http://apache.org/xml/UnknownNScdata-sectionsDOMMemoryManagerXML
Source: is-UP0V3.tmp.10.dr	String found in binary or memory: http://apache.org/xml/features/continue-after-fatal-errorlthttp://apache.org/xml/features/dom/byte-o
Source: is-UP0V3.tmp.10.dr	String found in binary or memory: http://apache.org/xml/features/dom-has-psvi-infoInvalidDatatypeFacetExceptionen_UShttp://apache.org/
Source: is-UP0V3.tmp.10.dr	String found in binary or memory: http://apache.org/xml/features/dom/user-adopts-DOMDocument-2147483648
Source: is-UP0V3.tmp.10.dr	String found in binary or memory: http://apache.org/xml/features/generate-synthetic-annotationsIDREFquotcanonical-formhttp://apache.or
Source: is-UP0V3.tmp.10.dr	String found in binary or memory: http://apache.org/xml/features/nonvalidating/load-external-dtd-9223372036854775808http://apache.org/
Source: is-UP0V3.tmp.10.dr	String found in binary or memory: http://apache.org/xml/features/pretty-print/space-first-level-elementsEMPTYDoXIhttp://xml.org/sax/fe
Source: is-UP0V3.tmp.10.dr	String found in binary or memory: http://apache.org/xml/features/validation/dynamic-1http://apache.org/xml/features/validation/identit
Source: is-UP0V3.tmp.10.dr	String found in binary or memory: http://apache.org/xml/features/validation/ignoreCachedDTDREFhttp://apache.org/xml/features/validatin
Source: is-UP0V3.tmp.10.dr	String found in binary or memory: http://apache.org/xml/features/validation/use-cachedGrammarInParsevalidationvalidate-if-schemaxmlwhi
Source: is-UP0V3.tmp.10.dr	String found in binary or memory: http://apache.org/xml/messages/XML4CErrorswell-formedhttp://apache.org/xml/parser-use-DOMDocument-fr
Source: is-UP0V3.tmp.10.dr	String found in binary or memory: http://apache.org/xml/messages/XMLValidityXMLXIncludeExceptionerror-handlernohttp://apache.org/xml/f
Source: is-UP0V3.tmp.10.dr	String found in binary or memory: http://apache.org/xml/properties/low-water-marksplit-cdata-sectionsSGXMLScanner
Source: VC_redist.x64.exe	String found in binary or memory: http://appsyndication.org/2006/appsyn
Source: VC_redist.x64.exe, 0000001C.00000002.5094773956.00000000003DB000.00000002.00000001.01000000.00000014.sdmp, VC_redist.x64.exe, 0000001D.00000002.5086434755.00000000003DB000.00000002.00000001.01000000.00000014.sdmp, VC_redist.x64.exe, 0000001E.00000002.5082503451.00000000003DB000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor
Source: VC_redist.x64.exe, 00000014.00000000.4866316131.00000000004EE000.00000002.00000001.01000000.0000000E.sdmp, VC_redist.x64.exe, 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmp, VC_redist.x64.exe, 00000015.00000000.4867826152.0000000000A8E000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 00000015.00000002.5106004440.0000000000A8E000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 00000016.00000002.5102890508.0000000000E8E000.00000002.00000001.01000000.00000011.sdmp, VC_redist.x64.exe, 00000016.00000003.5002147253.0000000000980000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 00000016.00000000.4875152360.0000000000E8E000.00000002.00000001.01000000.00000011.sdmp, VC_redist.x64.exe, 0000001F.00000000.5129153010.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001F.00000002.5138174837.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000020.00000002.5484844134.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000020.00000000.5130814743.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000021.00000000.5133213302.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000021.00000002.5484898708.00000000009CE000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationc:
Source: is-F27EN.tmp.10.dr	String found in binary or memory: http://bugreports.qt.io/
Source: is-F27EN.tmp.10.dr	String found in binary or memory: http://bugreports.qt.io/_q_receiveReplyensureClientPrefaceSentMicrosoft-IIS/4.Microsoft-IIS/5.Netsca
Source: is-FVJ9O.tmp.10.dr, is-F27EN.tmp.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: is-F27EN.tmp.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: is-FVJ9O.tmp.10.dr, is-F27EN.tmp.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: wget.exe, 00000002.00000002.4225716734.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ccsca2021.crl.certum.pl/ccsca2021.crl0s
Source: wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ccsca2021.ocsp-certum.com05
Source: wget.exe, 00000002.00000002.4225716734.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: is-FVJ9O.tmp.10.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: wget.exe, 00000002.00000002.4225716734.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/D7
Source: CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: is-F27EN.tmp.10.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: is-FVJ9O.tmp.10.dr, is-F27EN.tmp.10.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: wget.exe, 00000002.00000002.4225716734.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: is-F27EN.tmp.10.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: is-FVJ9O.tmp.10.dr, is-F27EN.tmp.10.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: is-FVJ9O.tmp.10.dr, is-F27EN.tmp.10.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: is-F27EN.tmp.10.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: is-FVJ9O.tmp.10.dr, is-F27EN.tmp.10.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: is-FVJ9O.tmp.10.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: wget.exe, 00000002.00000002.4225716734.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, is-FVJ9O.tmp.10.dr, is-F27EN.tmp.10.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: is-F27EN.tmp.10.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: is-FVJ9O.tmp.10.dr, is-F27EN.tmp.10.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: wget.exe, 00000002.00000002.4225716734.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: is-FVJ9O.tmp.10.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/ccsca2021.cer0
Source: wget.exe, 00000002.00000002.4225716734.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: wget.exe, 00000002.00000002.4225716734.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://subca.ocsp-certum.com02
Source: vcredist_2013_x64.exe, 0000000D.00000003.4855360186.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, vcredist_2013_x64.exe, 0000000D.00000003.4641577754.000000000157D000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 00000015.00000002.5108320544.0000000003810000.00000004.00000800.00020000.00000000.sdmp, VC_redist.x64.exe, 00000015.00000002.5108192968.00000000036A0000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64.exe, 00000018.00000003.4893735867.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64.exe, 00000019.00000003.4895186091.000000000097C000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64.exe, 00000019.00000002.5491628116.0000000002870000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 0000001D.00000002.5088805698.0000000003250000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 0000001D.00000002.5089033184.0000000003400000.00000004.00000800.00020000.00000000.sdmp, VC_redist.x64.exe, 00000021.00000002.5490078826.0000000003350000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 00000021.00000002.5494063209.0000000003870000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010
Source: vcredist_2013_x64.exe, 0000000D.00000003.4851447301.000000000371B000.00000004.00000800.00020000.00000000.sdmp, vcredist_x64.exe, 00000019.00000002.5494494333.0000000002C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010(
Source: VC_redist.x64.exe, 00000015.00000002.5108320544.0000000003810000.00000004.00000800.00020000.00000000.sdmp, VC_redist.x64.exe, 0000001D.00000002.5089033184.0000000003400000.00000004.00000800.00020000.00000000.sdmp, VC_redist.x64.exe, 00000021.00000002.5494063209.0000000003870000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010Hd
Source: vcredist_2013_x64.exe, 0000000D.00000003.4851447301.000000000371B000.00000004.00000800.00020000.00000000.sdmp, vcredist_x64.exe, 00000019.00000002.5494494333.0000000002C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010and
Source: vcredist_2013_x64.exe, 0000000D.00000003.4851447301.000000000371B000.00000004.00000800.00020000.00000000.sdmp, vcredist_x64.exe, 00000019.00000002.5494494333.0000000002C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010lureH
Source: wget.exe, 00000002.00000002.4225716734.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.5160966733.00000000022EA000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.tmp, 0000000A.00000003.5147495318.00000000024BD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cloudcompare.org/
Source: CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4271509144.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.tmp, 0000000A.00000003.4281307366.00000000035B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cloudcompare.org/8http://www.cloudcompare.org/8http://www.cloudcompare.org/.2.14.alpha
Source: CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.5160966733.00000000022EA000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.tmp, 0000000A.00000003.5147495318.00000000024BD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cloudcompare.org/q
Source: is-DG0J0.tmp.10.dr	String found in binary or memory: http://www.openssl.org/V
Source: is-DG0J0.tmp.10.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: is-DG0J0.tmp.10.dr	String found in binary or memory: http://www.openssl.org/support/faq.html.
Source: is-F27EN.tmp.10.dr	String found in binary or memory: http://www.phreedom.org/md5)
Source: is-F27EN.tmp.10.dr	String found in binary or memory: http://www.phreedom.org/md5)08:27
Source: CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000000.4271005670.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: is-FVJ9O.tmp.10.dr	String found in binary or memory: https://sectigo.com/CPS0C
Source: wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: wget.exe, 00000002.00000002.4225448124.0000000000D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe
Source: wget.exe, 00000002.00000002.4225320965.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe0r
Source: wget.exe, 00000002.00000002.4225320965.0000000000B70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exeOF_P
Source: wget.exe, 00000002.00000002.4225320965.0000000000B70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exeamDat
Source: is-FVJ9O.tmp.10.dr, is-F27EN.tmp.10.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.tmp, 0000000A.00000000.4279340551.0000000000401000.00000020.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.tmp, 0000000A.00000000.4279340551.0000000000401000.00000020.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.remobjects.com/ps

System Summary

Drops large PE files

Source: C:\Windows\SysWOW64\wget.exe

File dump: CloudCompare_v2.14.alpha_setup_x64.exe.2.dr 355083480

Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\52ca56.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{53CF6934-A98D-3D84-9146-FC4EDF3D5641}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICCC7.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\msvcp120.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\msvcr120.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\vcamp120.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\vccorlib120.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\vcomp120.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\52ca5c.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\52ca5c.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\52ca5d.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{010792BA-551A-3AC0-A7EF-0FAB4156C382}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID3DC.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120chs.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120cht.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120deu.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120enu.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120esn.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120fra.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120ita.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120jpn.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120kor.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120rus.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120u.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfcm120.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfcm120u.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\52ca64.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\52ca64.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\52ca65.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1B27.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{382F1166-A409-4C5B-9B1E-85ED538B8291}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1C70.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\concrt140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\msvcp140_1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\msvcp140_2.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\msvcp140_atomic_wait.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\msvcp140_codecvt_ids.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\vcamp140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\vccorlib140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\vcomp140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\vcruntime140_threads.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\52ca75.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\52ca75.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\52ca76.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2366.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{E1902FC6-C423-4719-AB8A-AC7B2694B367}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI258A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140chs.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140cht.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140deu.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140enu.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140esn.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140fra.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140ita.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140jpn.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140kor.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140rus.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc140u.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfcm140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfcm140u.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\52ca89.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\52ca89.msi	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\52ca5c.msi

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004E406A	20_2_004E406A
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004DF018	20_2_004DF018
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004D71EE	20_2_004D71EE
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004D2299	20_2_004D2299
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004D2560	20_2_004D2560
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004D757C	20_2_004D757C
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004DA7B3	20_2_004DA7B3
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004D281B	20_2_004D281B
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004DEB90	20_2_004DEB90
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004D1C7D	20_2_004D1C7D
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004C5D9B	20_2_004C5D9B
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004CDE46	20_2_004CDE46
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004D1FEF	20_2_004D1FEF
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004A7FA9	20_2_004A7FA9
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A7F018	21_2_00A7F018
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A8406A	21_2_00A8406A
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A771EE	21_2_00A771EE
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A72299	21_2_00A72299
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A72560	21_2_00A72560
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A7757C	21_2_00A7757C
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A7A7B3	21_2_00A7A7B3
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A7281B	21_2_00A7281B
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A7EB90	21_2_00A7EB90
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A71C7D	21_2_00A71C7D
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A65D9B	21_2_00A65D9B
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A6DE46	21_2_00A6DE46
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A47FA9	21_2_00A47FA9
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A71FEF	21_2_00A71FEF
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E65D9B	22_2_00E65D9B
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E8406A	22_2_00E8406A
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E7F018	22_2_00E7F018
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E771EE	22_2_00E771EE
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E72299	22_2_00E72299
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E72560	22_2_00E72560
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E7757C	22_2_00E7757C
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E7A7B3	22_2_00E7A7B3
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E7281B	22_2_00E7281B
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E7EB90	22_2_00E7EB90
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E71C7D	22_2_00E71C7D
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E6DE46	22_2_00E6DE46
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E71FEF	22_2_00E71FEF
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E47FA9	22_2_00E47FA9
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003BC0FA	28_2_003BC0FA
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_00396184	28_2_00396184
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003C022D	28_2_003C022D
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003CA3B0	28_2_003CA3B0
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003C0662	28_2_003C0662
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_0039A7EF	28_2_0039A7EF
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003CA85E	28_2_003CA85E
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003BF919	28_2_003BF919
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003A69CC	28_2_003A69CC
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003C0A97	28_2_003C0A97
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003C2B21	28_2_003C2B21
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003C2D50	28_2_003C2D50
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003CED4C	28_2_003CED4C
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003BFE15	28_2_003BFE15

Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: String function: 00561D32 appears 59 times
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: String function: 00565A1A appears 73 times
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: String function: 6B9F10E3 appears 70 times
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: String function: 00562F06 appears 462 times
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: String function: 0055FD42 appears 35 times
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: String function: 00560126 appears 655 times
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: String function: 6B9FAFD3 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: String function: 00FE2F06 appears 462 times
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: String function: 00FE5A1A appears 73 times
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: String function: 00FE1D32 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: String function: 00FDFD42 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: String function: 00FE0126 appears 655 times
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: String function: 00A429F6 appears 54 times
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: String function: 00A70B80 appears 33 times
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: String function: 00A87952 appears 79 times
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: String function: 00A413B3 appears 502 times
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: String function: 00A853E7 appears 684 times
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: String function: 00A858CE appears 34 times
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: String function: 00E70B80 appears 33 times
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: String function: 00E87952 appears 79 times
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: String function: 00E429F6 appears 54 times
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: String function: 00E853E7 appears 684 times
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: String function: 00E413B3 appears 502 times
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: String function: 00E858CE appears 34 times
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: String function: 004A13B3 appears 501 times
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: String function: 004E58CE appears 34 times
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: String function: 004A29F6 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: String function: 004D0B80 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: String function: 004E7952 appears 79 times
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: String function: 004E53E7 appears 684 times
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: String function: 003D012F appears 678 times
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: String function: 003D061A appears 34 times
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: String function: 003937D3 appears 496 times
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: String function: 00391F20 appears 54 times
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: String function: 003D31C7 appears 85 times

Source: CloudCompare_v2.14.alpha_setup_x64.tmp.9.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-E67D7.tmp.10.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-F8008.tmp.10.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79

Source: is-F0B2H.tmp.10.dr	Static PE information: Number of sections : 13 > 10
Source: is-TLF74.tmp.10.dr	Static PE information: Number of sections : 19 > 10
Source: is-BU6NB.tmp.10.dr	Static PE information: Number of sections : 12 > 10
Source: is-RKRC4.tmp.10.dr	Static PE information: Number of sections : 19 > 10
Source: is-78AIN.tmp.10.dr	Static PE information: Number of sections : 12 > 10

Source: classification engine

Classification label: mal56.spre.evad.win@37/669@0/1

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe

Code function: 11_2_00FDF9C6 FormatMessageW,GetLastError,LocalFree,

11_2_00FDF9C6

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: 11_2_00FB13BA GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	11_2_00FB13BA
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004A62C2 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	20_2_004A62C2
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A462C2 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	21_2_00A462C2
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E462C2 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	22_2_00E462C2
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 24_2_005313BA GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	24_2_005313BA
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003944E9 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	28_2_003944E9

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe

Code function: 11_2_00FE726D CLSIDFromProgID,CoCreateInstance,

11_2_00FE726D

Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe

Code function: 25_2_6B9FA6F8 FindResourceExA,GetLastError,LoadResource,GetLastError,SizeofResource,GetLastError,LockResource,GetLastError,

25_2_6B9FA6F8

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe

Code function: 11_2_00FCEDC2 ChangeServiceConfigW,GetLastError,

11_2_00FCEDC2

Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp

File created: C:\Program Files\CloudCompare

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\Desktop\cmdline.out

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6800:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4444:120:WilError_03

Source: C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe

File created: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Command line argument: `N	20_2_004A10E1
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Command line argument: xN	20_2_004A10E1
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Command line argument: version.dll	20_2_004A10E1
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Command line argument: wininet.dll	20_2_004A10E1
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Command line argument: comres.dll	20_2_004A10E1
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Command line argument: clbcatq.dll	20_2_004A10E1
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Command line argument: N	20_2_004A10E1
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Command line argument: crypt32.dll	20_2_004A10E1
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Command line argument: feclient.dll	20_2_004A10E1
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Command line argument: cabinet.dll	20_2_004A10E1
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Command line argument: cabinet.dll	21_2_00A410E1
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Command line argument: msi.dll	21_2_00A410E1
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Command line argument: version.dll	21_2_00A410E1
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Command line argument: wininet.dll	21_2_00A410E1
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Command line argument: comres.dll	21_2_00A410E1
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Command line argument: clbcatq.dll	21_2_00A410E1
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Command line argument: msasn1.dll	21_2_00A410E1
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Command line argument: crypt32.dll	21_2_00A410E1
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Command line argument: feclient.dll	21_2_00A410E1
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Command line argument: cabinet.dll	21_2_00A410E1
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Command line argument: `	22_2_00E410E1
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Command line argument: x	22_2_00E410E1
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Command line argument: version.dll	22_2_00E410E1
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Command line argument: wininet.dll	22_2_00E410E1
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Command line argument: comres.dll	22_2_00E410E1
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Command line argument: clbcatq.dll	22_2_00E410E1
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Command line argument: msasn1.dll	22_2_00E410E1
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Command line argument: crypt32.dll	22_2_00E410E1
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Command line argument: feclient.dll	22_2_00E410E1
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Command line argument: `	22_2_00E410E1
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Command line argument: `	22_2_00E410E1
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Command line argument: cabinet.dll	28_2_00391070
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Command line argument: msi.dll	28_2_00391070
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Command line argument: version.dll	28_2_00391070
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Command line argument: wininet.dll	28_2_00391070
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Command line argument: comres.dll	28_2_00391070
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Command line argument: clbcatq.dll	28_2_00391070
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Command line argument: msasn1.dll	28_2_00391070
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Command line argument: crypt32.dll	28_2_00391070
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Command line argument: feclient.dll	28_2_00391070

Source: C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp

File read: C:\Program Files\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\wget.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: vcredist_2013_x64.exe, 0000000B.00000003.4804245294.000000000088D000.00000004.00000020.00020000.00000000.sdmp, vcredist_2013_x64.exe, 0000000B.00000003.4806048727.00000000008C6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT `WixDependency`.`WixDependency`, `WixDependencyProvider`.`Component_`, `WixDependency`.`ProviderKey`, `WixDependency`.`MinVersion`, `WixDependency`.`MaxVersion`, `WixDependency`.`Attributes` FROM `WixDependencyProvider`, `WixDependency`, `WixDependencyRef` WHERE `WixDependency`.`WixDependency` = `WixDependencyRef`.`WixDependency_` AND `WixDependencyProvider`.`WixDependencyProvider` = `WixDependencyRef`.`WixDependencyProvider_`SELECT `WixDependencyProvider`.`WixDependencyProvider`, `WixDependencyProvider`.`Component_`, `WixDependencyProvider`.`ProviderKey`, `WixDependencyProvider`.`Attributes` FROM `WixDependencyProvider`Failed to ignored dependency "%ls" to the string dictionary.;Failed to create the string dictionary.Failed to get the string value of the IGNOREDEPENDENCIES property.IGNOREDEPENDENCIESUnknownFailed to set the dependency name "%ls" into the message record.Failed to set the dependency key "%ls" into the message record.The dependency "%ls" is missing or is not the required version.Found dependent "%ls", name: "%ls".Failed to set the number of dependencies into the message record.Failed to set the message identifier into the message record.Not enough memory to create the message record.wixdepca.cppUnexpected message response %d from user or bootstrapper application.Failed to create the dependency record for message %d.Failed to enumerate all of the rows in the dependency query view.Failed to get WixDependency.Attributes.Failed to get WixDependency.MaxVersion.Failed to get WixDependency.MinVersion.Failed to get WixDependency.ProviderKey.Failed to get WixDependencyProvider.Component_.Failed to get WixDependency.WixDependency.Failed dependency check for %ls.Skipping dependency check for %ls because the component %ls is not being (re)installed.Failed to open the query view for dependencies.Failed to initialize the unique dependency string list.Failed to check if the WixDependency table exists.Skipping the dependency check since no dependencies are authored.WixDependencyFailed to enumerate all of the rows in the dependency provider query view.Failed to get WixDependencyProvider.Attributes.Failed to get WixDependencyProvider.ProviderKey.Failed to get WixDependencyProvider.Component.Failed to get WixDependencyProvider.WixDependencyProvider.Failed dependents check for %ls.Skipping dependents check for %ls because the component %ls is not being uninstalled.Failed to open the query view for dependency providers.Failed to check if the WixDependencyProvider table exists.Skipping the dependents check since no dependency providers are authored.WixDependencyProviderSkipping the dependencies check since IGNOREDEPENDENCIES contains "ALL".Failed to check if "ALL" was set in IGNOREDEPENDENCIES.ALLFailed to get the ignored dependents.Failed to ensure required dependencies for (re)installing components.ALLUSERSFailed to initialize the registry functions.Failed to initialize.WixDependencyRequireFailed to ensure absent dependents for uninstalling com

Source: vcredist_2013_x64.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: VC_redist.x64.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: VC_redist.x64.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: VC_redist.x64.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: vcredist_x64.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: VC_redist.x64.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe"
Source: unknown	Process created: C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe "C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe"
Source: C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe	Process created: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp "C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp" /SL5="$B01CE,353634964,780800,C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe "C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe" /install /quiet /norestart
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Process created: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe "C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe" /install /quiet /norestart -burn.unelevated BurnPipe.{1EB8EC4C-F5D1-4ECA-9DD0-7714AF65556E} {84117F68-D40E-4241-8A1A-B0F8298D254D} 4264
Source: unknown	Process created: C:\Windows\System32\SrTasks.exe C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1
Source: C:\Windows\System32\SrTasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe "C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe" /install /quiet /norestart
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Process created: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe "C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe" -burn.filehandle.attached=680 -burn.filehandle.self=684 /install /quiet /norestart
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Process created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe "C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5DEBEB27-EE90-4179-8801-9F2879D6FF33} {CFB915F2-7D0C-4BB0-A831-01B27FBD1688} 2492
Source: unknown	Process created: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /burn.runonce
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Process created: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe"
Source: unknown	Process created: C:\Windows\System32\SrTasks.exe C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
Source: C:\Windows\System32\SrTasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{3CE290E6-406D-4F39-9839-02C576C54025} {EA2D85BC-101D-4701-8D4D-A4BF8B19AB71} 6552
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.filehandle.attached=508 -burn.filehandle.self=520 -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{3CE290E6-406D-4F39-9839-02C576C54025} {EA2D85BC-101D-4701-8D4D-A4BF8B19AB71} 6552
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5A86F4D1-A9EC-4B64-B083-BE7A62BB96B8} {9AF4D465-6A98-4E12-88F2-BC1C1719DF24} 4280
Source: unknown	Process created: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" /burn.runonce
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe"
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548
Source: unknown	Process created: C:\Windows\System32\LogonUI.exe "LogonUI.exe" /flags:0x4 /state0:0xa3f5a855 /state1:0x41c64e6d
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe"	Jump to behavior
Source: C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe	Process created: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp "C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp" /SL5="$B01CE,353634964,780800,C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe "C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe" /install /quiet /norestart	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe "C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe" /install /quiet /norestart	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Process created: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe "C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe" /install /quiet /norestart -burn.unelevated BurnPipe.{1EB8EC4C-F5D1-4ECA-9DD0-7714AF65556E} {84117F68-D40E-4241-8A1A-B0F8298D254D} 4264	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Process created: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe "C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe" -burn.filehandle.attached=680 -burn.filehandle.self=684 /install /quiet /norestart
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Process created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe "C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5DEBEB27-EE90-4179-8801-9F2879D6FF33} {CFB915F2-7D0C-4BB0-A831-01B27FBD1688} 2492
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{3CE290E6-406D-4F39-9839-02C576C54025} {EA2D85BC-101D-4701-8D4D-A4BF8B19AB71} 6552
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Process created: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe"
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.filehandle.attached=508 -burn.filehandle.self=520 -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{3CE290E6-406D-4F39-9839-02C576C54025} {EA2D85BC-101D-4701-8D4D-A4BF8B19AB71} 6552
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5A86F4D1-A9EC-4B64-B083-BE7A62BB96B8} {9AF4D465-6A98-4E12-88F2-BC1C1719DF24} 4280
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe"
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548

Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: usoapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: sxproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: srcore.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vss_ps.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Section loaded: msxml3.dll
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Section loaded: feclient.dll
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: msi.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: version.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: cabinet.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: msxml3.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: wldp.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: profapi.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: feclient.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: iertutil.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: textinputframework.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: coremessaging.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: coremessaging.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: wintypes.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: wintypes.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: wintypes.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: msimg32.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: explorerframe.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: riched20.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: usp10.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: msls31.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: textshaping.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: propsys.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: edputil.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: urlmon.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: srvcli.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: netutils.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: sspicli.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: appresolver.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: slc.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: sppc.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: userenv.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: msi.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: version.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: cabinet.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: msxml3.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: wldp.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: profapi.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: textinputframework.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: coremessaging.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: wintypes.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: wintypes.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: wintypes.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: srclient.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: spp.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: powrprof.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: vssapi.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: vsstrace.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: umpdc.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: usoapi.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: sxproxy.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: feclient.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: iertutil.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: srpapi.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: netapi32.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: wkscli.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: netutils.dll
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: feclient.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: feclient.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: textinputframework.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: coreuicomponents.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: windowscodecs.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: explorerframe.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: riched20.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: usp10.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: msls31.dll
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: spp.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: srclient.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: srcore.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: wer.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: msxml3.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vss_ps.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: feclient.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: textinputframework.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: coreuicomponents.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: msimg32.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: windowscodecs.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: explorerframe.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: riched20.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: usp10.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: msls31.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: textshaping.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: propsys.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: edputil.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: urlmon.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: srvcli.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: netutils.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: appresolver.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: bcp47langs.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: slc.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: userenv.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: sppc.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: textinputframework.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: coreuicomponents.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: srclient.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: spp.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: powrprof.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: vssapi.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: vsstrace.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: umpdc.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Section loaded: usoapi.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: feclient.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: textinputframework.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: coreuicomponents.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: msimg32.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: windowscodecs.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: explorerframe.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: riched20.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: usp10.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: msls31.dll
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: logoncontroller.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: slc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.logon.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wincorlib.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.xamlhost.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: languageoverlayutil.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.xaml.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.globalization.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: d2d1.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: directmanipulation.dll

Source: C:\Windows\SysWOW64\wget.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Jump to behavior

Source: CloudCompare.lnk.10.dr	LNK file: ..\..\..\..\..\..\Program Files\CloudCompare\CloudCompare.exe
Source: CloudCompare.lnk0.10.dr	LNK file: ..\..\..\Program Files\CloudCompare\CloudCompare.exe

Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Automated click: Next

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Window detected: Number of UI elements: 19
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Window detected: Number of UI elements: 23
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Window detected: Number of UI elements: 19
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Window detected: Number of UI elements: 23
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Window detected: Number of UI elements: 23

Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\unins000.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-E67D7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-RK2D7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-F0B2H.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-BU6NB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-78AIN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-5U5RQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-Q3UAG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-A4GQ6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-K8E7Q.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-T8E89.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-7AMNT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-KMJ88.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-MV458.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-0UCED.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-S20LH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-9Q3NC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-DMGNO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-5NEDU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-9MQ23.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-96G17.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-QLH03.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-0ETAJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-1D8GC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-CRC3K.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-DG0J0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-RKRC4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-TLF74.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-F8008.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-GBVP7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-V81UA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-7D511.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-QJLST.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-2BPFH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-Q8VGT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-3UACU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-4N83B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-GD96M.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-5LLNK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-1AVDH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-2NF19.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-6E13D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-VUNA7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-ULPPI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-8GF8G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-Q4FUF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-9564F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-LNQRQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-F27EN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-OU74J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-EHH64.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-JJ5J0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-5DUDN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-AJ0MH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-TJIIT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-LIKHT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-NKH37.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-1T592.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-TRDII.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-86FV8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-V60H0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-T6I4U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-ORCGS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-DE3LQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-OHVSP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-VQV6S.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-02UTJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-NUL4B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-192GB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-MF4VL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-82NCD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-GMPDH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-9V9PD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-VD2K0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-O99L5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-4FB87.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-FVJ9O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-OL3SL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-N98JH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-UP0V3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\is-Q06N3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\gamepads	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\gamepads\is-T476D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\iconengines	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\iconengines\is-2O479.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-VN2GT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-R83R7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-2F3I0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-AM7K6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-26VGE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-8LGJR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-H2EK5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-FFN20.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\imageformats\is-G554D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\platforms	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\platforms\is-JL72O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-NO2LL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-A6DSE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-9UK7J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-5R3DL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-4H4J7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-EKSJ8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-EVN8N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-1BHUB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-K59TJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-UQ6Q7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-SFOAI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-H5T2H.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-HMUPJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-EV193.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-09N3S.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-SVRC0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-7SBVS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-23FRJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-51UVB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-S1TGF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-DDST8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-E63HF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-58SRQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-AKS9N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-U95IF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-VJOEG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-QQLBV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-DG6LF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-QP8K8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-RGJQE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-8BQMI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-MPFLG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-EJTBC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-8A210.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-232MC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-84SFH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-8RLKI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-C1KHU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-3FSQ4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-L6IDA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-MN40I.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\plugins\is-O1011.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\Bilateral	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\Bilateral\is-7E84J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\Bilateral\is-I54SL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\ColorRamp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\ColorRamp\is-QD1K5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\DrawNormals	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\DrawNormals\is-16Q60.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\DrawNormals\is-079CG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\DrawNormals\is-1T3F7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\EDL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\EDL\is-VLK83.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\EDL\is-CSNSK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\EDL\is-KV0SK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\EDL\is-V57QR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\SSAO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\SSAO\is-NGK93.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\shaders\SSAO\is-16B4L.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\styles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\styles\is-HV0JM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-443P6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-CGINU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-GP11Q.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-1E24F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-S6F83.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-9AV9B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-1CVRR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-A4SLN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-J6M97.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-ITE62.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-KN4UH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-PFR24.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-TL72C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-VNUAS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-2S2PK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-6DHOH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-THVTA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-TRV8H.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-UBV0R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-2QKRK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-F6T7O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-10N3O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-0NGBU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-OQE25.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-HJ7JF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-QC8LA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-7DSMM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-PCIMT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-5O1M6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-3HP9U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-GJN0R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-9VPOJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\translations\is-8LM9M.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Directory created: C:\Program Files\CloudCompare\unins000.msg	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4DE0A2C8-03F9-4B3F-BAFC-1D5F2141464B}_is1

Jump to behavior

Source:	Binary string: MFCM120U.amd64.pdb source: mfcm120u.dll.19.dr
Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: VC_redist.x64.exe, 0000001C.00000002.5094773956.00000000003DB000.00000002.00000001.01000000.00000014.sdmp, VC_redist.x64.exe, 0000001D.00000002.5086434755.00000000003DB000.00000002.00000001.01000000.00000014.sdmp, VC_redist.x64.exe, 0000001E.00000002.5082503451.00000000003DB000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb source: VC_redist.x64.exe, 00000014.00000000.4866316131.00000000004EE000.00000002.00000001.01000000.0000000E.sdmp, VC_redist.x64.exe, 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmp, VC_redist.x64.exe, 00000015.00000000.4867826152.0000000000A8E000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 00000015.00000002.5106004440.0000000000A8E000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 00000016.00000002.5102890508.0000000000E8E000.00000002.00000001.01000000.00000011.sdmp, VC_redist.x64.exe, 00000016.00000003.5002147253.0000000000980000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 00000016.00000000.4875152360.0000000000E8E000.00000002.00000001.01000000.00000011.sdmp, VC_redist.x64.exe, 0000001F.00000000.5129153010.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001F.00000002.5138174837.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000020.00000002.5484844134.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000020.00000000.5130814743.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000021.00000000.5133213302.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000021.00000002.5484898708.00000000009CE000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixStdBA.pdbH source: vcredist_x64.exe, 00000019.00000002.5497241555.000000006BA05000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb source: vcredist_2013_x64.exe, 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmp, vcredist_2013_x64.exe, 0000000B.00000000.4635010313.0000000000FEB000.00000002.00000001.01000000.00000008.sdmp, vcredist_2013_x64.exe, 0000000D.00000002.4862972062.0000000000FEB000.00000002.00000001.01000000.00000008.sdmp, vcredist_2013_x64.exe, 0000000D.00000000.4636956599.0000000000FEB000.00000002.00000001.01000000.00000008.sdmp, vcredist_x64.exe, 00000018.00000000.4892550754.000000000056B000.00000002.00000001.01000000.00000012.sdmp, vcredist_x64.exe, 00000018.00000002.4899692937.000000000056B000.00000002.00000001.01000000.00000012.sdmp, vcredist_x64.exe, 00000019.00000002.5485472293.000000000056B000.00000002.00000001.01000000.00000012.sdmp, vcredist_x64.exe, 00000019.00000000.4894071572.000000000056B000.00000002.00000001.01000000.00000012.sdmp, vcredist_x64.exe.13.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixDepCA.pdb source: vcredist_2013_x64.exe, 0000000B.00000003.4804245294.000000000088D000.00000004.00000020.00020000.00000000.sdmp, vcredist_2013_x64.exe, 0000000B.00000003.4806048727.00000000008C6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Network.pdb source: is-F27EN.tmp.10.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb`E source: vcredist_x64.exe.13.dr
Source:	Binary string: MFCM120U.amd64.pdb8@ source: mfcm120u.dll.19.dr
Source:	Binary string: C:\agent\_work\36\s\wix\build\ship\x86\WixStdBA.pdb source: VC_redist.x64.exe, 00000021.00000002.5497369648.000000006F853000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: E:\builds\xerces-c-3.1.4\Build\Win64\VC12\Release\xerces-c_3_1.pdb source: is-UP0V3.tmp.10.dr
Source:	Binary string: E:\builds\openssl-1.0.1h\x64\out32dll\libeay32.pdb source: is-DG0J0.tmp.10.dr
Source:	Binary string: C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb4 source: VC_redist.x64.exe, 00000014.00000000.4866316131.00000000004EE000.00000002.00000001.01000000.0000000E.sdmp, VC_redist.x64.exe, 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmp, VC_redist.x64.exe, 00000015.00000000.4867826152.0000000000A8E000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 00000015.00000002.5106004440.0000000000A8E000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 00000016.00000002.5102890508.0000000000E8E000.00000002.00000001.01000000.00000011.sdmp, VC_redist.x64.exe, 00000016.00000003.5002147253.0000000000980000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 00000016.00000000.4875152360.0000000000E8E000.00000002.00000001.01000000.00000011.sdmp, VC_redist.x64.exe, 0000001F.00000000.5129153010.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001F.00000002.5138174837.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000020.00000002.5484844134.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000020.00000000.5130814743.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000021.00000000.5133213302.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000021.00000002.5484898708.00000000009CE000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: E:\builds\xerces-c-3.1.4\Build\Win64\VC12\Release\xerces-c_3_1.pdb; source: is-UP0V3.tmp.10.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb`X source: vcredist_x64.exe, 00000018.00000000.4892550754.000000000056B000.00000002.00000001.01000000.00000012.sdmp, vcredist_x64.exe, 00000018.00000002.4899692937.000000000056B000.00000002.00000001.01000000.00000012.sdmp, vcredist_x64.exe, 00000019.00000002.5485472293.000000000056B000.00000002.00000001.01000000.00000012.sdmp, vcredist_x64.exe, 00000019.00000000.4894071572.000000000056B000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixStdBA.pdb source: vcredist_x64.exe, 00000019.00000002.5497241555.000000006BA05000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140ESN.amd64.pdb source: mfc140esn.dll.19.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb` source: vcredist_2013_x64.exe, 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmp, vcredist_2013_x64.exe, 0000000B.00000000.4635010313.0000000000FEB000.00000002.00000001.01000000.00000008.sdmp, vcredist_2013_x64.exe, 0000000D.00000002.4862972062.0000000000FEB000.00000002.00000001.01000000.00000008.sdmp, vcredist_2013_x64.exe, 0000000D.00000000.4636956599.0000000000FEB000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: E:\builds\openssl-1.0.1h\x64\out32dll\libeay32.pdbU source: is-DG0J0.tmp.10.dr

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe

Code function: 11_2_00FDC2AB LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

11_2_00FDC2AB

Source: CloudCompare_v2.14.alpha_setup_x64.exe.2.dr	Static PE information: section name: .didata
Source: CloudCompare_v2.14.alpha_setup_x64.tmp.9.dr	Static PE information: section name: .didata
Source: is-E4N2C.tmp.10.dr	Static PE information: section name: .wixburn
Source: is-F2TE4.tmp.10.dr	Static PE information: section name: .wixburn
Source: is-T476D.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-2O479.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-VN2GT.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-R83R7.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-2F3I0.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-AM7K6.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-26VGE.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-8LGJR.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-H2EK5.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-FFN20.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-G554D.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-JL72O.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-NO2LL.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-A6DSE.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-9UK7J.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-5R3DL.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-4H4J7.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-EKSJ8.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-EVN8N.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-1BHUB.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-K59TJ.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-UQ6Q7.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-SFOAI.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-H5T2H.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-H5T2H.tmp.10.dr	Static PE information: section name: _RDATA
Source: is-HMUPJ.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-EV193.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-09N3S.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-SVRC0.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-SVRC0.tmp.10.dr	Static PE information: section name: _RDATA
Source: is-E67D7.tmp.10.dr	Static PE information: section name: .didata
Source: is-F0B2H.tmp.10.dr	Static PE information: section name: .rodata
Source: is-F0B2H.tmp.10.dr	Static PE information: section name: .xdata
Source: is-BU6NB.tmp.10.dr	Static PE information: section name: .xdata
Source: is-78AIN.tmp.10.dr	Static PE information: section name: .xdata
Source: is-7SBVS.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-23FRJ.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-51UVB.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-S1TGF.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-DDST8.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-E63HF.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-58SRQ.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-AKS9N.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-U95IF.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-VJOEG.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-9Q3NC.tmp.10.dr	Static PE information: section name: _RDATA
Source: is-QQLBV.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-DG6LF.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-QP8K8.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-RGJQE.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-8BQMI.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-MPFLG.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-EJTBC.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-8A210.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-232MC.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-84SFH.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-RKRC4.tmp.10.dr	Static PE information: section name: /4
Source: is-RKRC4.tmp.10.dr	Static PE information: section name: /19
Source: is-RKRC4.tmp.10.dr	Static PE information: section name: /35
Source: is-RKRC4.tmp.10.dr	Static PE information: section name: /47
Source: is-RKRC4.tmp.10.dr	Static PE information: section name: /61
Source: is-RKRC4.tmp.10.dr	Static PE information: section name: /73
Source: is-RKRC4.tmp.10.dr	Static PE information: section name: /86
Source: is-RKRC4.tmp.10.dr	Static PE information: section name: /97
Source: is-RKRC4.tmp.10.dr	Static PE information: section name: /108
Source: is-TLF74.tmp.10.dr	Static PE information: section name: /4
Source: is-TLF74.tmp.10.dr	Static PE information: section name: /19
Source: is-TLF74.tmp.10.dr	Static PE information: section name: /35
Source: is-TLF74.tmp.10.dr	Static PE information: section name: /47
Source: is-TLF74.tmp.10.dr	Static PE information: section name: /61
Source: is-TLF74.tmp.10.dr	Static PE information: section name: /73
Source: is-TLF74.tmp.10.dr	Static PE information: section name: /86
Source: is-TLF74.tmp.10.dr	Static PE information: section name: /97
Source: is-TLF74.tmp.10.dr	Static PE information: section name: /108
Source: is-8RLKI.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-C1KHU.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-3FSQ4.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-L6IDA.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-MN40I.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-O1011.tmp.10.dr	Static PE information: section name: .qtmetad
Source: is-QJLST.tmp.10.dr	Static PE information: section name: .didat

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: 11_2_00FDA225 push ecx; ret	11_2_00FDA238
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004D0BC6 push ecx; ret	20_2_004D0BD9
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004ECD63 push ecx; ret	20_2_004ECD76
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A70BC6 push ecx; ret	21_2_00A70BD9
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A8CD63 push ecx; ret	21_2_00A8CD76
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E70BC6 push ecx; ret	22_2_00E70BD9
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E8CD63 push ecx; ret	22_2_00E8CD76
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 24_2_0055A225 push ecx; ret	24_2_0055A238
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 25_2_6B9FC354 pushad ; ret	25_2_6B9FC355
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 25_2_6B9FEE85 push ecx; ret	25_2_6B9FEE98
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003BE876 push ecx; ret	28_2_003BE889

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140jpn.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140esn.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140ita.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140deu.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140chs.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfcm140u.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140enu.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfcm120.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc120u.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\concrt140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140fra.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\vccorlib140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\msvcp140_atomic_wait.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\vcomp140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140cht.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140rus.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfcm140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfcm120u.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140kor.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\msvcp140_2.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140u.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\msvcp140_codecvt_ids.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\msvcr120.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\vcamp140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\msvcp120.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\vccorlib120.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\msvcp140_1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	System file written: C:\Windows\System32\mfc120.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-OHVSP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\iconv.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\is-FFN20.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-JJ5J0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\TKShHealing.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca74.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\libgmp-10.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\netcdf.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QPHOTOSCAN_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\qtga.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-DDST8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\python310.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QEDL_GL_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QRDB_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140chs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QSRA_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-AKS9N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\libpq.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\concrt140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\Qt5Svg.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140fra.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QCOMPASS_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\qwebp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-VQV6S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QHPR_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca84.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-4N83B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-4FB87.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vccorlib140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\is-26VGE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-VJOEG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	File created: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-E67D7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-5DUDN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\is-G554D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120cht.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcomp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\proj.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QJSON_RPC_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QPCL_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\qicns.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\Qt5Core.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120esn.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-7SBVS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-Q06N3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140kor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-232MC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\gdal202.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QM3C2_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	File created: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File created: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\TKG2d.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\swscale-7.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\msvcp140_2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\TKG3d.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-RGJQE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-QJLST.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-FVJ9O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\msvcp140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-84SFH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\Qt5Concurrent.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120rus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca83.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\swresample-4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\qsvg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QPOISSON_RECON_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-TJIIT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-CRC3K.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca7f.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\geos_c.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-TLF74.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.be\vcredist_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QPCV_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\CC_FBO_LIB.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\Qt5Gui.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca6f.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QDRACO_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\CCAppCommon.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca85.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\qgif.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-DG6LF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-TRDII.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QCORK_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca7e.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-S20LH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\CCCoreLib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QTREEISO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120enu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca6e.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\CloudCompare.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-NUL4B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\TKSTEP209.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QMANUAL_SEG_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\wixstdba.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-LNQRQ.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120ita.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca7d.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\DotProduct_x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\Qt5WebSockets.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\TKGeomAlgo.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QAUTO_SEG_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140jpn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140esn.dll	Jump to dropped file
Source: C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe	File created: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140deu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\wixstdba.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfcm140u.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfcm120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-ORCGS.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QELLIPSER_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-EJTBC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\TKMath.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QCORE_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-82NCD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-UP0V3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca82.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-GMPDH.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca69.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-ULPPI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QRANSAC_SD_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\TKSTEPBase.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca62.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-MPFLG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\xerces-c_3_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-EKSJ8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca73.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-DE3LQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QDOT_PRODUCT_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-23FRJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-5NEDU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\is-AM7K6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-A6DSE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\iconengines\is-2O479.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\platforms\is-JL72O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-1AVDH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QRIEGL_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-H5T2H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\QCC_IO_LIB.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\tbbmalloc.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca60.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-NKH37.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-OL3SL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\vcruntime140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\TKTopAlgo.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\is-VN2GT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-GBVP7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\libxml2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QE57_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca80.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-AJ0MH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-OU74J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\expat.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\QCC_DB_LIB.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcamp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\libmysql.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\Qt5Gamepad.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\is-E4N2C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-MV458.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-9Q3NC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-3UACU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-N98JH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\avcodec-60.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-8A210.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-MF4VL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\platforms\qwindows.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\msvcp140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\msvcp140_2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\opencv_world340.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-7AMNT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QHOUGH_NORMALS_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-8RLKI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-K8E7Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-S1TGF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120deu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140ita.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\TKernel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-78AIN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-QQLBV.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca81.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca87.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140enu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\is-F2TE4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca71.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-HMUPJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-UQ6Q7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-L6IDA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca61.rbf (copy)	Jump to dropped file
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\gamepads\xinputgamepad.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-3FSQ4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-192GB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\avformat-60.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QBROOM_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-F27EN.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca7b.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-E63HF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\TKSTEPAttr.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QCANUPO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca5b.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-SFOAI.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca6b.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-51UVB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QANIMATION_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-K59TJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-0UCED.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\rdblib.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\msvcp140_atomic_wait.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\is-R83R7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140rus.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-A4GQ6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-Q3UAG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\qjpeg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-GD96M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QMPLANE_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\MeshIO.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfcm120u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-VD2K0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-F8008.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QCSF_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\python3.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\spatialite.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-9564F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-U95IF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-O1011.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-02UTJ.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca7c.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca6c.rbf (copy)	Jump to dropped file
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\wixstdba.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-96G17.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-6E13D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-8BQMI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\TKSTEP.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QLAS_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\msvcp140_codecvt_ids.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-MN40I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QPCL_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-4H4J7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-LIKHT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-EV193.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\msvcr120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-EVN8N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\laszip3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\geos.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\CCPluginAPI.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\styles\is-HV0JM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-BU6NB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\qtiff.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-O99L5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-5U5RQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\libmpfr-4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\Qt5Widgets.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-5LLNK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-EHH64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\TKMesh.dll (copy)	Jump to dropped file
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\wixstdba.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-2BPFH.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\QCC_GL_LIB.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca86.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-2NF19.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QMESH_BOOLEAN_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca6d.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\openjp2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-1D8GC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-RK2D7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-9UK7J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-86FV8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-58SRQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\iconengines\qsvgicon.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-DMGNO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\styles\qwindowsvistastyle.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-Q8VGT.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcamp120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-SVRC0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-RKRC4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\Q3DMASC_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-VUNA7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QFACETS_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QCOLORIMETRIC_SEGMENTER_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\tbb.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120chs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-V60H0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QCLOUDLAYERS_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\is-8LGJR.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca59.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca72.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\TKBRep.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-0ETAJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-Q4FUF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120fra.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\gamepads\is-T476D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QFBX_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-09N3S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-QLH03.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-8GF8G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QSSAO_GL_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca63.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca7a.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140cht.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-F0B2H.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfcm140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\freexl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\szip.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\Qt5Network.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca5a.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QSTEP_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QCSV_MATRIX_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcomp120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\is-2F3I0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\concrt140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QADDITIONAL_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\qwbmp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-V81UA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120kor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\TKXSBase.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\QVOXFALL_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-9V9PD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-NO2LL.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcruntime140_threads.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-QP8K8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-DG0J0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 52ca70.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-KMJ88.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\TKGeomBase.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\is-T6I4U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\hdf5.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\wget.exe	File created: C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\msvcp140_1.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\msvcp120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\is-H2EK5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-5R3DL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-1BHUB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120jpn.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\plugins\is-C1KHU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\hdf5_hl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\imageformats\qico.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\Program Files\CloudCompare\avutil-58.dll (copy)	Jump to dropped file

Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	File created: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File created: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe			Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120deu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120ita.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140jpn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140esn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140ita.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140deu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140chs.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfcm140u.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140enu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcamp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfcm120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120u.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\concrt140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140fra.dll	Jump to dropped file
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120chs.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vccorlib140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	File created: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120fra.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120cht.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcomp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\msvcp140_atomic_wait.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140cht.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140rus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfcm140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120esn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140kor.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfcm120u.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcomp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\msvcp140_2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120kor.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\msvcp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140u.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcruntime140_threads.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120rus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc140.dll	Jump to dropped file
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\wixstdba.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\msvcp140_codecvt_ids.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcamp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120enu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120jpn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\msvcp140_1.dll	Jump to dropped file
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\wixstdba.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1028\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1029\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1031\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1036\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1040\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1041\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1042\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1045\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1046\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1049\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1055\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\2052\license.rtf
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	File created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\3082\license.rtf
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\license.rtf
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1028\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1029\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1031\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1036\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1040\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1041\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1042\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1045\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1046\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1049\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1055\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\2052\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	File created: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\3082\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1028\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1029\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1031\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1036\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1040\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1041\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1042\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1045\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1046\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1049\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1055\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\2052\license.rtf
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\3082\license.rtf

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore

Jump to behavior

Source: C:\Windows\System32\SrTasks.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CloudCompare			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CloudCompare\CloudCompare.lnk			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {042d26ef-3dbe-4c25-95d3-4c1b11b235a7}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {042d26ef-3dbe-4c25-95d3-4c1b11b235a7}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {042d26ef-3dbe-4c25-95d3-4c1b11b235a7}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {042d26ef-3dbe-4c25-95d3-4c1b11b235a7}	Jump to behavior
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {804e7d66-ccc2-4c12-84ba-476da31d103d}
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {804e7d66-ccc2-4c12-84ba-476da31d103d}
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {804e7d66-ccc2-4c12-84ba-476da31d103d}
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {804e7d66-ccc2-4c12-84ba-476da31d103d}

Source: C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\LogonUI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\LogonUI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\LogonUI.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\iconv.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-OHVSP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\is-FFN20.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca74.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\TKShHealing.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-JJ5J0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\netcdf.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\libgmp-10.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QPHOTOSCAN_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\qtga.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-DDST8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QEDL_GL_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\python310.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QRDB_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140chs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QSRA_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-AKS9N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\libpq.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\concrt140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\Qt5Svg.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140fra.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QCOMPASS_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\qwebp.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca84.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-VQV6S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QHPR_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-4N83B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-4FB87.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\vccorlib140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\is-26VGE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-VJOEG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-5DUDN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\is-G554D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120cht.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\vcomp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\proj.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QPCL_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QJSON_RPC_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\qicns.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\Qt5Core.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120esn.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-7SBVS.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140kor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-Q06N3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QM3C2_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\gdal202.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-232MC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\TKG2d.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\swscale-7.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\msvcp140_2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\TKG3d.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-RGJQE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-QJLST.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-FVJ9O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\msvcp140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-84SFH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\Qt5Concurrent.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca83.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120rus.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\qsvg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\swresample-4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QPOISSON_RECON_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-TJIIT.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca7f.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-CRC3K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\geos_c.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-TLF74.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QPCV_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\CC_FBO_LIB.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\Qt5Gui.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca6f.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QDRACO_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\CCAppCommon.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca85.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\qgif.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-TRDII.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QCORK_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-DG6LF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca7e.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120enu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QTREEISO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-S20LH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\CCCoreLib.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca6e.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\CloudCompare.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-NUL4B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QMANUAL_SEG_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\TKSTEP209.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\wixstdba.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca7d.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-LNQRQ.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120ita.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\TKGeomAlgo.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\Qt5WebSockets.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\DotProduct_x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QAUTO_SEG_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140jpn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140esn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140deu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\wixstdba.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfcm140u.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfcm120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-ORCGS.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QELLIPSER_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-EJTBC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\TKMath.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QCORE_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-82NCD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-UP0V3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca82.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca69.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-GMPDH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QRANSAC_SD_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-ULPPI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\TKSTEPBase.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca62.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\xerces-c_3_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-MPFLG.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca73.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-EKSJ8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QDOT_PRODUCT_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-DE3LQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-23FRJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-5NEDU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\is-AM7K6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-A6DSE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\iconengines\is-2O479.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\platforms\is-JL72O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-1AVDH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QRIEGL_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-H5T2H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\QCC_IO_LIB.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\tbbmalloc.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca60.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-NKH37.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-OL3SL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\vcruntime140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\TKTopAlgo.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-GBVP7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\is-VN2GT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\libxml2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QE57_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca80.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-AJ0MH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\QCC_DB_LIB.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\expat.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-OU74J.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\vcamp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\Qt5Gamepad.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\libmysql.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-MV458.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-9Q3NC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\avcodec-60.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-3UACU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-N98JH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-MF4VL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-8A210.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\platforms\qwindows.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\msvcp140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\opencv_world340.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\msvcp140_2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-7AMNT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QHOUGH_NORMALS_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-8RLKI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-S1TGF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120deu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-K8E7Q.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140ita.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\TKernel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-78AIN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-QQLBV.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca81.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca87.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140enu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca71.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-UQ6Q7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-HMUPJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-L6IDA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca61.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\gamepads\xinputgamepad.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-3FSQ4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\avformat-60.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-192GB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QBROOM_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-F27EN.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca7b.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-E63HF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QCANUPO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\TKSTEPAttr.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca5b.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-SFOAI.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca6b.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QANIMATION_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-51UVB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-K59TJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-0UCED.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\msvcp140_atomic_wait.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\rdblib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\is-R83R7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140rus.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-A4GQ6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-Q3UAG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\qjpeg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QMPLANE_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-GD96M.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfcm120u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\MeshIO.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-VD2K0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-F8008.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QCSF_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\python3.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\spatialite.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-9564F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-U95IF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-O1011.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-02UTJ.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca7c.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca6c.rbf (copy)	Jump to dropped file
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Dropped PE file which has not been started: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\wixstdba.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-96G17.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-6E13D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-8BQMI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\TKSTEP.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\msvcp140_codecvt_ids.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QLAS_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-MN40I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QPCL_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-4H4J7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-LIKHT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-EV193.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\msvcr120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\laszip3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-EVN8N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\geos.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-BU6NB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\CCPluginAPI.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\styles\is-HV0JM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\qtiff.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-O99L5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-5U5RQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\libmpfr-4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\Qt5Widgets.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\TKMesh.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-EHH64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-5LLNK.tmp	Jump to dropped file
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Dropped PE file which has not been started: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\wixstdba.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-2BPFH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\QCC_GL_LIB.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca86.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-2NF19.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca6d.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QMESH_BOOLEAN_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\openjp2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-RK2D7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-1D8GC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-9UK7J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-86FV8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-58SRQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\iconengines\qsvgicon.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-DMGNO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\styles\qwindowsvistastyle.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-Q8VGT.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\vcamp120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-SVRC0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-RKRC4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\Q3DMASC_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QFACETS_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-VUNA7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QCOLORIMETRIC_SEGMENTER_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\tbb.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120chs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-V60H0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QCLOUDLAYERS_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\is-8LGJR.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca59.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca72.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\TKBRep.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-0ETAJ.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120fra.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-Q4FUF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\gamepads\is-T476D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QFBX_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-09N3S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-QLH03.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-8GF8G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QSSAO_GL_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca63.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca7a.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140cht.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-F0B2H.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfcm140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\szip.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\freexl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\Qt5Network.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca5a.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QSTEP_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QCSV_MATRIX_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\vcomp120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\is-2F3I0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QADDITIONAL_IO_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\concrt140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\qwbmp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-V81UA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120kor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\QVOXFALL_PLUGIN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\TKXSBase.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-9V9PD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\vcruntime140_threads.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-NO2LL.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-QP8K8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-DG0J0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 52ca70.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\TKGeomBase.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-KMJ88.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\is-T6I4U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\hdf5.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\msvcp140_1.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\msvcp120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\is-H2EK5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-5R3DL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-1BHUB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120jpn.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\hdf5_hl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\imageformats\qico.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\plugins\is-C1KHU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Dropped PE file which has not been started: C:\Program Files\CloudCompare\avutil-58.dll (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Evaded block: after key decision
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Evaded block: after key decision
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Evaded block: after key decision
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Evaded block: after key decision
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Evaded block: after key decision

Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe

Evasive API call chain: GetLocalTime,DecisionNodes

Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Windows\System32\SrTasks.exe TID: 4504	Thread sleep time: -280000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\SrTasks.exe TID: 940	Thread sleep time: -290000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: 11_2_00FDF835 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00FDF8D6h	11_2_00FDF835
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: 11_2_00FDF835 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00FDF8CFh	11_2_00FDF835
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004E506D GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 004E5108h	20_2_004E506D
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004E506D GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 004E5101h	20_2_004E506D
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A8506D GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00A85108h	21_2_00A8506D
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A8506D GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00A85101h	21_2_00A8506D
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E8506D GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00E85108h	22_2_00E8506D
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E8506D GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00E85101h	22_2_00E8506D
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 24_2_0055F835 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0055F8D6h	24_2_0055F835
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 24_2_0055F835 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0055F8CFh	24_2_0055F835
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003CFDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 003CFE5Dh	28_2_003CFDC2
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003CFDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 003CFE56h	28_2_003CFDC2

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File Volume queried: C:\Windows FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: 11_2_00FC9065 _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	11_2_00FC9065
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: 11_2_00FE6CB2 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	11_2_00FE6CB2
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: 11_2_00FE5D1F _memset,FindFirstFileW,FindClose,	11_2_00FE5D1F
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004A1700 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,FindClose,	20_2_004A1700
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004A3B2C FindFirstFileW,FindClose,	20_2_004A3B2C
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004DC2AF FindFirstFileExW,FindNextFileW,FindClose,FindClose,	20_2_004DC2AF
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004BB79F FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	20_2_004BB79F
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A5B79F FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	21_2_00A5B79F
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A41700 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,FindClose,	21_2_00A41700
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A43B2C FindFirstFileW,FindClose,	21_2_00A43B2C
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A7C2AF FindFirstFileExW,FindNextFileW,FindClose,FindClose,	21_2_00A7C2AF
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E5B79F FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	22_2_00E5B79F
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E41700 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,FindClose,	22_2_00E41700
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E43B2C FindFirstFileW,FindClose,	22_2_00E43B2C
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E7C2AF FindFirstFileExW,FindNextFileW,FindClose,FindClose,	22_2_00E7C2AF
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 24_2_00566CB2 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	24_2_00566CB2
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 24_2_00549065 _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	24_2_00549065
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 24_2_00565D1F _memset,FindFirstFileW,FindClose,	24_2_00565D1F
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 25_2_6B9FA685 _memset,FindFirstFileW,FindClose,	25_2_6B9FA685
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_00393BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	28_2_00393BC3
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003D4315 FindFirstFileW,FindClose,	28_2_003D4315
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003A993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	28_2_003A993E

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe

Code function: 20_2_004CFC6A VirtualQuery,GetSystemInfo,

20_2_004CFC6A

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\NULL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages\vcRuntimeAdditional_amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File opened: C:\ProgramData\Package Cache\NULL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages\NULL	Jump to behavior

Source: SrTasks.exe, 0000001A.00000003.5076633123.00000273EA68D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: SrTasks.exe, 0000001A.00000003.5138273492.00000273EA632000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963
Source: SrTasks.exe, 0000001A.00000003.5138273492.00000273EA632000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: CloudCompare_v2.14.alpha_setup_x64.tmp, 0000000A.00000002.5158627658.0000000000805000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: VC_redist.x64.exe, 0000001D.00000003.5084940424.0000000001012000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SrTasks.exe, 00000011.00000002.5053624908.0000021374422000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:##N
Source: VC_redist.x64.exe, 0000001D.00000003.5084940424.0000000001012000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: SrTasks.exe, 0000001A.00000003.5138273492.00000273EA632000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:II
Source: SrTasks.exe, 0000001A.00000003.5058459875.00000273EA6A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:<<
Source: SrTasks.exe, 0000001A.00000003.5076633123.00000273EA68D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c
Source: wget.exe, 00000002.00000002.4225448124.0000000000D68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe

Code function: 11_2_00FD854A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

11_2_00FD854A

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe

11_2_00FDC2AB

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004D98C7 mov ecx, dword ptr fs:[00000030h]	20_2_004D98C7
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004DCFDC mov eax, dword ptr fs:[00000030h]	20_2_004DCFDC
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A798C7 mov ecx, dword ptr fs:[00000030h]	21_2_00A798C7
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A7CFDC mov eax, dword ptr fs:[00000030h]	21_2_00A7CFDC
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E798C7 mov ecx, dword ptr fs:[00000030h]	22_2_00E798C7
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E7CFDC mov eax, dword ptr fs:[00000030h]	22_2_00E7CFDC
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003C4812 mov eax, dword ptr fs:[00000030h]	28_2_003C4812

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe

Code function: 11_2_00FE28F3 GetProcessHeap,RtlAllocateHeap,

11_2_00FE28F3

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: 11_2_00FD90E2 SetUnhandledExceptionFilter,	11_2_00FD90E2
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: 11_2_00FD854A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00FD854A
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Code function: 11_2_00FDA74C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00FDA74C
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004D0469 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_004D0469
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004D8567 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_004D8567
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004D0934 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_004D0934
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Code function: 20_2_004D0AC7 SetUnhandledExceptionFilter,	20_2_004D0AC7
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A70469 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_00A70469
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A78567 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00A78567
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A70934 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00A70934
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Code function: 21_2_00A70AC7 SetUnhandledExceptionFilter,	21_2_00A70AC7
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E70469 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_00E70469
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E78567 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_00E78567
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E70934 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_00E70934
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Code function: 22_2_00E70AC7 SetUnhandledExceptionFilter,	22_2_00E70AC7
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 24_2_005590E2 SetUnhandledExceptionFilter,	24_2_005590E2
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 24_2_0055854A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_0055854A
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 24_2_0055A74C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_0055A74C
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 25_2_6B9FC9C1 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_6B9FC9C1
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Code function: 25_2_6B9FB88C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	25_2_6B9FB88C
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003BE188 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_003BE188
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003BE625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_003BE625
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003BE773 SetUnhandledExceptionFilter,	28_2_003BE773
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Code function: 28_2_003C3BB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_003C3BB0

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe	Process created: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe "C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe" -burn.filehandle.attached=680 -burn.filehandle.self=684 /install /quiet /norestart
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Process created: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe "C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5DEBEB27-EE90-4179-8801-9F2879D6FF33} {CFB915F2-7D0C-4BB0-A831-01B27FBD1688} 2492
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{3CE290E6-406D-4F39-9839-02C576C54025} {EA2D85BC-101D-4701-8D4D-A4BF8B19AB71} 6552
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.filehandle.attached=508 -burn.filehandle.self=520 -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{3CE290E6-406D-4F39-9839-02C576C54025} {EA2D85BC-101D-4701-8D4D-A4BF8B19AB71} 6552
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5A86F4D1-A9EC-4B64-B083-BE7A62BB96B8} {9AF4D465-6A98-4E12-88F2-BC1C1719DF24} 4280
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://www.danielgm.net/cc/release/cloudcompare_v2.14.alpha_setup_x64.exe" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://www.danielgm.net/cc/release/cloudcompare_v2.14.alpha_setup_x64.exe"
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "c:\programdata\package cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\vc_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=1032 -burn.embedded burnpipe.{3ce290e6-406d-4f39-9839-02c576c54025} {ea2d85bc-101d-4701-8d4d-a4bf8b19ab71} 6552
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "c:\programdata\package cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\vc_redist.x64.exe" -burn.clean.room="c:\programdata\package cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\vc_redist.x64.exe" -burn.filehandle.attached=508 -burn.filehandle.self=520 -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=1032 -burn.embedded burnpipe.{3ce290e6-406d-4f39-9839-02c576c54025} {ea2d85bc-101d-4701-8d4d-a4bf8b19ab71} 6552
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://www.danielgm.net/cc/release/cloudcompare_v2.14.alpha_setup_x64.exe"	Jump to behavior
Source: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "c:\programdata\package cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\vc_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=1032 -burn.embedded burnpipe.{3ce290e6-406d-4f39-9839-02c576c54025} {ea2d85bc-101d-4701-8d4d-a4bf8b19ab71} 6552
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "c:\programdata\package cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\vc_redist.x64.exe" -burn.clean.room="c:\programdata\package cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\vc_redist.x64.exe" -burn.filehandle.attached=508 -burn.filehandle.self=520 -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=1032 -burn.embedded burnpipe.{3ce290e6-406d-4f39-9839-02c576c54025} {ea2d85bc-101d-4701-8d4d-a4bf8b19ab71} 6552

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe

Code function: 11_2_00FE3123 _memset,_memset,_memset,_memset,_memset,_memset,InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,

11_2_00FE3123

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe

Code function: 11_2_00FE0358 CheckTokenMembership,GetLastError,AllocateAndInitializeSid,GetLastError,FreeSid,

11_2_00FE0358

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe

Code function: 20_2_004D0CF7 cpuid

20_2_004D0CF7

Source: C:\Windows\SysWOW64\wget.exe	Queries volume information: C:\Users\user\Desktop\download VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\logo.png VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe	Queries volume information: C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\logo.png VolumeInformation
Source: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\logo.png VolumeInformation
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Queries volume information: C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\logo.png VolumeInformation
Source: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\logo.png VolumeInformation
Source: C:\Windows\System32\LogonUI.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\LogonUI.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
Source: C:\Windows\System32\LogonUI.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe

Code function: 11_2_00FB35AD ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,CreateNamedPipeW,GetLastError,

11_2_00FB35AD

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe

Code function: 11_2_00FDF835 EnterCriticalSection,GetCurrentProcessId,GetCurrentThreadId,GetLocalTime,LeaveCriticalSection,

11_2_00FDF835

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe

Code function: 11_2_00FE01CB LookupAccountNameW,LookupAccountNameW,GetLastError,GetLastError,GetLastError,LookupAccountNameW,GetLastError,

11_2_00FE01CB

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe

Code function: 11_2_00FE851E GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,

11_2_00FE851E

Source: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe

Code function: 11_2_00FB1B46 _memset,_memset,CoInitializeEx,GetModuleHandleW,GetVersionExW,GetLastError,CoUninitialize,

11_2_00FB1B46

Source: C:\Windows\SysWOW64\wget.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	5 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	12 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	13 Command and Scripting Interpreter	22 Windows Service	1 Access Token Manipulation	2 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	11 Registry Run Keys / Startup Folder	22 Windows Service	1 DLL Side-Loading	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Process Injection	1 File Deletion	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	23 Masquerading	LSA Secrets	26 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	1 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner
52ca59.rbf (copy)	0%	ReversingLabs
52ca5a.rbf (copy)	0%	ReversingLabs
52ca5b.rbf (copy)	0%	ReversingLabs
52ca60.rbf (copy)	0%	ReversingLabs
52ca61.rbf (copy)	0%	ReversingLabs
52ca62.rbf (copy)	0%	ReversingLabs
52ca63.rbf (copy)	0%	ReversingLabs
52ca69.rbf (copy)	0%	ReversingLabs
52ca6b.rbf (copy)	0%	ReversingLabs
52ca6c.rbf (copy)	0%	ReversingLabs
52ca6d.rbf (copy)	0%	ReversingLabs
52ca6e.rbf (copy)	0%	ReversingLabs
52ca6f.rbf (copy)	0%	ReversingLabs
52ca70.rbf (copy)	0%	ReversingLabs
52ca71.rbf (copy)	0%	ReversingLabs
52ca72.rbf (copy)	0%	ReversingLabs
52ca73.rbf (copy)	0%	ReversingLabs
52ca74.rbf (copy)	0%	ReversingLabs
52ca7a.rbf (copy)	0%	ReversingLabs
52ca7b.rbf (copy)	0%	ReversingLabs
52ca7c.rbf (copy)	0%	ReversingLabs
52ca7d.rbf (copy)	0%	ReversingLabs
52ca7e.rbf (copy)	0%	ReversingLabs
52ca7f.rbf (copy)	0%	ReversingLabs
52ca80.rbf (copy)	0%	ReversingLabs
52ca81.rbf (copy)	0%	ReversingLabs
52ca82.rbf (copy)	0%	ReversingLabs
52ca83.rbf (copy)	0%	ReversingLabs
52ca84.rbf (copy)	0%	ReversingLabs
52ca85.rbf (copy)	0%	ReversingLabs
52ca86.rbf (copy)	0%	ReversingLabs
52ca87.rbf (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\CC_FBO_LIB.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\DotProduct_x64.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\Qt5Concurrent.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\Qt5Core.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\Qt5Gamepad.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\Qt5Gui.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\Qt5Network.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\Qt5OpenGL.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\Qt5Svg.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\Qt5WebSockets.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\Qt5Widgets.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\TKBRep.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\TKG2d.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\TKG3d.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\TKGeomAlgo.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\TKGeomBase.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\TKMath.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\TKMesh.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\TKSTEP.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\TKSTEP209.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\TKSTEPAttr.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\TKSTEPBase.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\TKShHealing.dll (copy)	0%	ReversingLabs
C:\Program Files\CloudCompare\TKTopAlgo.dll (copy)	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.cloudcompare.org/8http://www.cloudcompare.org/8http://www.cloudcompare.org/.2.14.alpha	0%	Avira URL Cloud	safe
http://wixtoolset.org/schemas/thmutil/2010Hd	0%	Avira URL Cloud	safe
https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exeOF_P	0%	Avira URL Cloud	safe
http://www.cloudcompare.org/q	0%	Avira URL Cloud	safe
http://wixtoolset.org/schemas/thmutil/2010lureH	0%	Avira URL Cloud	safe
https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exeamDat	0%	Avira URL Cloud	safe
http://wixtoolset.org/schemas/thmutil/2010(	0%	Avira URL Cloud	safe
https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe0r	0%	Avira URL Cloud	safe
http://www.cloudcompare.org/	0%	Avira URL Cloud	safe
http://wixtoolset.org/schemas/thmutil/2010and	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://apache.org/xml/features/generate-synthetic-annotationsIDREFquotcanonical-formhttp://apache.or	is-UP0V3.tmp.10.dr	false		high
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000000.4271005670.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false		high
http://www.phreedom.org/md5)08:27	is-F27EN.tmp.10.dr	false		high
http://ocsp.sectigo.com0	is-FVJ9O.tmp.10.dr	false		high
https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe0r	wget.exe, 00000002.00000002.4225320965.0000000000B75000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wixtoolset.org/schemas/thmutil/2010	vcredist_2013_x64.exe, 0000000D.00000003.4855360186.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, vcredist_2013_x64.exe, 0000000D.00000003.4641577754.000000000157D000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 00000015.00000002.5108320544.0000000003810000.00000004.00000800.00020000.00000000.sdmp, VC_redist.x64.exe, 00000015.00000002.5108192968.00000000036A0000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64.exe, 00000018.00000003.4893735867.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64.exe, 00000019.00000003.4895186091.000000000097C000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64.exe, 00000019.00000002.5491628116.0000000002870000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 0000001D.00000002.5088805698.0000000003250000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 0000001D.00000002.5089033184.0000000003400000.00000004.00000800.00020000.00000000.sdmp, VC_redist.x64.exe, 00000021.00000002.5490078826.0000000003350000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 00000021.00000002.5494063209.0000000003870000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.openssl.org/V	is-DG0J0.tmp.10.dr	false		high
https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exeOF_P	wget.exe, 00000002.00000002.4225320965.0000000000B70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/features/validation/dynamic-1http://apache.org/xml/features/validation/identit	is-UP0V3.tmp.10.dr	false		high
http://apache.org/xml/features/validation/ignoreCachedDTDREFhttp://apache.org/xml/features/validatin	is-UP0V3.tmp.10.dr	false		high
http://ccsca2021.crl.certum.pl/ccsca2021.crl0s	wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/pretty-print/space-first-level-elementsEMPTYDoXIhttp://xml.org/sax/fe	is-UP0V3.tmp.10.dr	false		high
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	is-FVJ9O.tmp.10.dr	false		high
http://www.cloudcompare.org/8http://www.cloudcompare.org/8http://www.cloudcompare.org/.2.14.alpha	CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4271509144.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.tmp, 0000000A.00000003.4281307366.00000000035B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bugreports.qt.io/	is-F27EN.tmp.10.dr	false		high
http://www.openssl.org/support/faq.html.	is-DG0J0.tmp.10.dr	false		high
http://repository.certum.pl/ccsca2021.cer0	wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	is-DG0J0.tmp.10.dr	false		high
http://apache.org/xml/features/dom-has-psvi-infoInvalidDatatypeFacetExceptionen_UShttp://apache.org/	is-UP0V3.tmp.10.dr	false		high
http://apache.org/xml/UnknownNScdata-sectionsDOMMemoryManagerXML	is-UP0V3.tmp.10.dr	false		high
http://apache.org/xml/properties/low-water-marksplit-cdata-sectionsSGXMLScanner	is-UP0V3.tmp.10.dr	false		high
http://wixtoolset.org/schemas/thmutil/2010lureH	vcredist_2013_x64.exe, 0000000D.00000003.4851447301.000000000371B000.00000004.00000800.00020000.00000000.sdmp, vcredist_x64.exe, 00000019.00000002.5494494333.0000000002C90000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://appsyndication.org/2006/appsynapplicationc:	VC_redist.x64.exe, 00000014.00000000.4866316131.00000000004EE000.00000002.00000001.01000000.0000000E.sdmp, VC_redist.x64.exe, 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmp, VC_redist.x64.exe, 00000015.00000000.4867826152.0000000000A8E000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 00000015.00000002.5106004440.0000000000A8E000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 00000016.00000002.5102890508.0000000000E8E000.00000002.00000001.01000000.00000011.sdmp, VC_redist.x64.exe, 00000016.00000003.5002147253.0000000000980000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 00000016.00000000.4875152360.0000000000E8E000.00000002.00000001.01000000.00000011.sdmp, VC_redist.x64.exe, 0000001F.00000000.5129153010.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001F.00000002.5138174837.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000020.00000002.5484844134.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000020.00000000.5130814743.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000021.00000000.5133213302.00000000009CE000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000021.00000002.5484898708.00000000009CE000.00000002.00000001.01000000.00000015.sdmp	false		high
https://www.remobjects.com/ps	CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.tmp, 0000000A.00000000.4279340551.0000000000401000.00000020.00000001.01000000.00000005.sdmp	false		high
http://subca.ocsp-certum.com02	wget.exe, 00000002.00000002.4225716734.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.innosetup.com/	CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.tmp, 0000000A.00000000.4279340551.0000000000401000.00000020.00000001.01000000.00000005.sdmp	false		high
https://sectigo.com/CPS0C	is-FVJ9O.tmp.10.dr	false		high
http://crl.certum.pl/ctnca2.crl0l	wget.exe, 00000002.00000002.4225716734.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	false		high
http://repository.certum.pl/ctnca2.cer09	wget.exe, 00000002.00000002.4225716734.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ccsca2021.ocsp-certum.com05	wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe	wget.exe, 00000002.00000002.4225448124.0000000000D60000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.certum.pl/CPS0	wget.exe, 00000002.00000002.4225716734.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.phreedom.org/md5)	is-F27EN.tmp.10.dr	false		high
http://www.cloudcompare.org/q	CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.5160966733.00000000022EA000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.tmp, 0000000A.00000003.5147495318.00000000024BD000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/messages/XMLValidityXMLXIncludeExceptionerror-handlernohttp://apache.org/xml/f	is-UP0V3.tmp.10.dr	false		high
http://apache.org/xml/features/continue-after-fatal-errorlthttp://apache.org/xml/features/dom/byte-o	is-UP0V3.tmp.10.dr	false		high
http://apache.org/xml/messages/XML4CErrorswell-formedhttp://apache.org/xml/parser-use-DOMDocument-fr	is-UP0V3.tmp.10.dr	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	is-FVJ9O.tmp.10.dr	false		high
http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor	VC_redist.x64.exe, 0000001C.00000002.5094773956.00000000003DB000.00000002.00000001.01000000.00000014.sdmp, VC_redist.x64.exe, 0000001D.00000002.5086434755.00000000003DB000.00000002.00000001.01000000.00000014.sdmp, VC_redist.x64.exe, 0000001E.00000002.5082503451.00000000003DB000.00000002.00000001.01000000.00000014.sdmp	false		high
https://www.certum.pl/CPS0	wget.exe, 00000002.00000003.4224842312.0000000002BE6000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224842312.0000000002BEE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.4224908994.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4275062715.0000000002540000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.4277624515.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	false		high
http://apache.org/xml/features/dom/user-adopts-DOMDocument-2147483648	is-UP0V3.tmp.10.dr	false		high
http://wixtoolset.org/schemas/thmutil/2010(	vcredist_2013_x64.exe, 0000000D.00000003.4851447301.000000000371B000.00000004.00000800.00020000.00000000.sdmp, vcredist_x64.exe, 00000019.00000002.5494494333.0000000002C90000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cloudcompare.org/	CloudCompare_v2.14.alpha_setup_x64.exe, 00000009.00000003.5160966733.00000000022EA000.00000004.00001000.00020000.00000000.sdmp, CloudCompare_v2.14.alpha_setup_x64.tmp, 0000000A.00000003.5147495318.00000000024BD000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exeamDat	wget.exe, 00000002.00000002.4225320965.0000000000B70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wixtoolset.org/schemas/thmutil/2010and	vcredist_2013_x64.exe, 0000000D.00000003.4851447301.000000000371B000.00000004.00000800.00020000.00000000.sdmp, vcredist_x64.exe, 00000019.00000002.5494494333.0000000002C90000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wixtoolset.org/schemas/thmutil/2010Hd	VC_redist.x64.exe, 00000015.00000002.5108320544.0000000003810000.00000004.00000800.00020000.00000000.sdmp, VC_redist.x64.exe, 0000001D.00000002.5089033184.0000000003400000.00000004.00000800.00020000.00000000.sdmp, VC_redist.x64.exe, 00000021.00000002.5494063209.0000000003870000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bugreports.qt.io/_q_receiveReplyensureClientPrefaceSentMicrosoft-IIS/4.Microsoft-IIS/5.Netsca	is-F27EN.tmp.10.dr	false		high
http://apache.org/xml/features/validation/use-cachedGrammarInParsevalidationvalidate-if-schemaxmlwhi	is-UP0V3.tmp.10.dr	false		high
http://apache.org/xml/features/nonvalidating/load-external-dtd-9223372036854775808http://apache.org/	is-UP0V3.tmp.10.dr	false		high
http://appsyndication.org/2006/appsyn	VC_redist.x64.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.241.226.205	unknown	United States		46606	UNIFIEDLAYER-AS-1US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589827
Start date and time:	2025-01-13 08:12:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 17m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	urldownload.jbs
Sample URL:	https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.spre.evad.win@37/669@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 147 Number of non-executed functions: 259

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, VSSVC.exe, svchost.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtSetValueKey calls found.
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe

Simulations

Behavior and APIs

Time	Type	Description
02:18:15	API Interceptor	57x Sleep call for process: SrTasks.exe modified
07:18:16	Autostart	Run: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce {042d26ef-3dbe-4c25-95d3-4c1b11b235a7} "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /burn.runonce
07:18:39	Autostart	Run: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce {804e7d66-ccc2-4c12-84ba-476da31d103d} "C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" /burn.runonce

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	659624
Entropy (8bit):	6.34353451383787
Encrypted:	false
SSDEEP:	12288:FOB4p+q4N8d4l2ms4cTHN+m+gy/vEPYysExtvsIvXi1ZG2EKZm+GWodEEpvY/p:iAtvsIvL2EKZm+GWodEEpvYh
MD5:	C2028BA6C66363B36EA659CA8816265D
SHA1:	5E2BDA10AD417466290DC08FD6EE8BC5FCF0EBBD
SHA-256:	3B92E964404E3F94531E7D7C4C7419561D9ECA6ACCD98DC3979C9E3596DB444C
SHA-512:	28E87D7360C4BD2EB30152173DA6FDF30340B5FF0186A68F26514088DCC15758851AFD01A179E976A91A9A85F9C1EE0CFA40308ED9D42654739ACF6F6DD773F4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C..=...n...n...n..*n...n...n...n..<n...n.@&n...n..>n...n...n4..n...nJ..n...n...n..=n...n..:n...n..?n...nRich...n........................PE..d...0.&Y.........." .....>...................................................`.......>....`.........................................PU.. ...p2..<....@...........G.......>...P.......X..................................p............P...............................text....=.......>.................. ..`.rdata.......P.......B..............@..@.data........P...8...@..............@....pdata...G.......H...x..............@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

52ca5a.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	963240
Entropy (8bit):	6.63315431748134
Encrypted:	false
SSDEEP:	24576:Nj7dDxvo5outISmDa5HSueghSHkCvx44lmWymt+:NnLLSl1/Cp44h+
MD5:	B70474FE249402E251A94753B742788C
SHA1:	F53B3C21ADF75DC84977067869253E207F1B9795
SHA-256:	753AC30C30AAE62415CC225E3D057B8B6254AFE280696E0A43F1A7C3132632A6
SHA-512:	7776E05FE58CB3C12A4A020DEF9596ECFB6DC1B1F8CA010EC27A8AE027EADF1EEF901ACBAFE042E2F7B31D1920F62CE163342ACF37F96802EC27D68AC7BF972E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F=&^'Su^'Su^'Su..u]'Su^'Ru.'SuSu.u.%SuSu.uo'SuSu.uh'SuSu.u.'SuSu.u_'SuSu.u_'SuSu.u_'SuRich^'Su........PE..d...$.&Y.........." .....h...:.......)..............................................C.....`.................................................p...(............@..hs...t...>......<...p................................2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@.data...hu.......D..................@....pdata..hs...@...t..................@..@.rsrc................^..............@..@.reloc..<............b..............@..B........................................................................................................................................................................................................................................................................

52ca5b.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	356528
Entropy (8bit):	5.9171117722289335
Encrypted:	false
SSDEEP:	6144:Qg5dgFfqaKFJyHrByeoVRAHq0KzA9OAgfVgYCDlbYh4:QOdcoVRAHqyeX0bH
MD5:	6D62E7D709CAAB4A459EDE82366853C0
SHA1:	D6DE1FAC72BA254538F2C754928CC35B3AB103AC
SHA-256:	5A357A9F10D55B70E50A04B0B6716263E678E877E0934F536CC82AA1C3072C25
SHA-512:	0D478FC2C9C5E7CB6A331A0E11156D85A8ECA2B99B1108DC145680F511051D83547FA56073B377212597B5B94B9A77E661178D2549A59AB251700733ED156CF3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........]j.]j.]j.T.{.[j.P85.Yj.../.\j.P87._j.P8..Pj.P8..Uj..#.Zj.]j..j.P8..Lj.P84.\j.P83.\j.P86.\j.Rich]j.........PE..d.....&Y.........." .....n...........L....................................................`..............................................>...D.......P..........."...2...>...`......................................`...p............................................text....l.......n.................. ..`.rdata...............r..............@..@.data...x....`.......F..............@....pdata...".......$..................@..@minATL.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................

52ca60.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5608096
Entropy (8bit):	6.663647971077495
Encrypted:	false
SSDEEP:	98304:gs3D53V9oVyhsK/HFLOAkGkzdnEVomFHKnPj:gs3hV9oVyt/HFLOyomFHKnPj
MD5:	47999145F1B48D94E732420A5F3E405C
SHA1:	29A8A95C4F8824CCD7BC14CC4CADA0545A8DFEF1
SHA-256:	FB83E940B281947CC8659611EF6AFA75C21A6626B1E70565D0A573F22A48B55E
SHA-512:	F13A52E9444AEE274092BE544C8558ED1BDF58046C983AF49815C6D75C4FD41A361917F3CFC07B3FCAEA69A628D23E7684E4BE939904CE473FC9A4D771355733
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........o.d...7...7...7..67...7..)7...7..(7...7..77...7.\$7...7<.>7...7.\.7...7.\.7...7..27...7...7...7.\&7...7.\.77..7.\%7...7.\"7...7.\'7...7Rich...7........................PE..d....&Y.........." ........d+.......(...................................... V......:V...`..........................................%:.......;.......?.......<.l:...TU..>....T.pl..p...............................3.p....................:......................text............................. ..`.rdata..$.........................@..@.data...xj...`;......@;.............@....pdata..l:....<..<....<.............@..@.rsrc.........?......N>.............@..@.reloc..pl....T..n....S.............@..B........................................................................................................................................................................................................

52ca61.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5634720
Entropy (8bit):	6.648198427709692
Encrypted:	false
SSDEEP:	98304:gpUUemLg/t32Hf+/mm4FLOAkGkzdnEVomFHKnPF:gpAmLg/tcfu4FLOyomFHKnPF
MD5:	F7D3FC7C0ED92E2DE47F7F85B684A51A
SHA1:	1707DA9AA8460CB65AC7946805CEC12CCA6DB8B3
SHA-256:	D822EC4E09FDF5446E62C09CF5819146F09A4670F77AAA81E4133B912592F1F9
SHA-512:	FBCABF3B8CCE40A9829FB9894CDB751662CC3A3B41F962691075D7E5D18831AD8C43C697E7919B4B1E96288015BE3544637DED1AC0427844F810BE6C2F221A1D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w................6.......).......(.......7......D$.....<.>......D.......D........2.........Y....D&......D..7....D%......D"......D'.....Rich............PE..d....&Y.........." .........+.....@.).......................................V.....LlV...`...........................................:.,....d;......p?......0=..<....U..>....U..m.................................0.4.p...................s:......................text...L......................... ..`.rdata............................@..@.data...8m....;.......;.............@....pdata...<...0=..>...x<.............@..@.rsrc........p?.......>.............@..@.reloc...m....U..n...NT.............@..B........................................................................................................................................................................................................................

52ca62.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	91808
Entropy (8bit):	6.334619249503521
Encrypted:	false
SSDEEP:	1536:sHTxHw36oFacMvsFjFoTc+sgqv4G4DG/I8XJuE1ZwKfrEEeBL7OAvxsVuQbs0p:YTx2qvAD5I8XJuE1Zyv/OAvxsYQQ0p
MD5:	480F828BD5B34C59C288F55CB363CAD2
SHA1:	95499B7F1005666FB5D273C1B96E8FD239D95866
SHA-256:	431E7373DEE1EEE2AB86588DEA061394EDF14A364C026DD47582D982BEFB1D78
SHA-512:	C55021AC4B34F32B0C5BDDA842FC52756759723B57DA0F82407291EB928B90C71AA6F61C74B209DE14132530C4BD0DE838C64D34E6F746C76E10342001C67122
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8k..\|.zC\|.zC\|.zC...C~.zCbX.C~.zCqX.Cx.zC.C}.zCqX.C}.zCqX.Cw.zC...Cy.zC\|.{C..zCqX.Cj.zCqX.C}.zCqX.C}.zCqX.C}.zCRich\|.zC........................PE..d.....&Y.........." .....@...........I....................................................`..........................................).......*..x....`.......P.......(...>...p.......d..............................@h..p............`..(...........8e..H............text....:.......<.................. ..`.nep.........P.......@.............. ..`.rdata.......`.......D..............@..@.data........@......................@....pdata.......P....... ..............@..@.rsrc........`......."..............@..@.reloc.......p.......&..............@..B........................................................................................................................................................................................

52ca63.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	91816
Entropy (8bit):	6.335643438000401
Encrypted:	false
SSDEEP:	1536:XHTxEJCfkrRasNb3fvSpauyd/nbzLBinzG41ZwK4XEaZNFOAA6QEkbRx:3Tx1YH3XMapRBinzG41ZPwOAA6QEkFx
MD5:	D739C219492AEA851D4B71127B310E83
SHA1:	488401EC9413C025C5A7CE9AEDC0B7629579A4A6
SHA-256:	F0CFCC1A9CD9B246B53FE14FA2F77975763A6DE5FBB3A98CF5EA622BE0C62CEA
SHA-512:	A1DD96D1E3BD21382879C0B68B81B2740C14F5DAE9490800A9BD8534A7CF13030163D4149F56E602B903E4DF23A7F0B0B5B3F0F294E1C30B7BEBC4F89D971D7C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8k..\|.zC\|.zC\|.zC...C~.zCbX.C~.zCqX.Cx.zC.C}.zCqX.C}.zCqX.Cw.zC...Cy.zC\|.{C..zCqX.Cj.zCqX.C}.zCqX.C}.zCqX.C}.zCRich\|.zC........................PE..d.....&Y.........." .....@...........I....................................................`..........................................)......p*..x....`.......P.......(...>...p.......d..............................@h..p............`..(...........8e..H............text....:.......<.................. ..`.nep.........P.......@.............. ..`.rdata.......`.......D..............@..@.data........@......................@....pdata.......P....... ..............@..@.rsrc........`......."..............@..@.reloc.......p.......&..............@..B........................................................................................................................................................................................

52ca69.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	408656
Entropy (8bit):	6.395785800442683
Encrypted:	false
SSDEEP:	6144:SwuaGNPbmYpnAeJ/vxR8sqDF+/OAgDhvPsuye0axSXft7mA:Pu3NPblpn7J/vxisQ5Fyed+l7V
MD5:	406A784AAA43DC068BA5945119109012
SHA1:	85BAC30E041B6D85C0D7BA89FC8C05C69D264F88
SHA-256:	192E80290753E5A79C56367700A09181321C0984515F4C35E7EA8A0F245877BF
SHA-512:	56C4BA950BAFBB6F818BFF9E70EFE59546912A2B4F331C134C9D98B65C165A4251E7C6D60A58DDE9432E618EA9DEF07C57482AEA460B877C826BA5304E7248E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^.e....W...W...W...W...W.D.V...W.D.V...W.D.V...W.D.V...WQ..V...W...W...W.D.V...W.D.V...W.D.W...W..W...W.D.V...WRich...W........................PE..d................." ........F.......H.......................................0......&"....`A............................................,8...T..T........%.......5......PP... ..P....)..p......................(....(..@............................................text............................... ..`.rdata..j...........................@..@.data....4...p.......Z..............@....pdata...5.......6..................@..@.rsrc....%.......&..................@..@.reloc..P.... ......................@..B................................................................................................................................................................................................................................

52ca6b.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	322640
Entropy (8bit):	6.349528011750681
Encrypted:	false
SSDEEP:	6144:7uV4MxQCZKZ+dqA2xwNFMH5X9r69wB9RfRtOm+nWzgoH9e15Jl:CSaZKZLAYwNHwFR91zHmh
MD5:	8FC1C2F2EBB7E46DF30ECD772622B0BC
SHA1:	168BE3B4545DC617B99D0598565A03C0366820E4
SHA-256:	E2E4609C569C69F7B1686F6D0E81CE62187AC5DF05E0247954500053B3C3DE3F
SHA-512:	6F3EC746EC10334692E930B515A37F3D5BD342CA60A49C4298924BE933262D7D782DE8A11D4F865A30A5AA22C5515059E3E39A92A61AE5FAE53622CEAA7D5C4B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i.H...H...H.......J...A...B...Y\|..O...H.......Y\|..L...Y\|..@...Y\|......Y\|..I...Y\|..I...Y\|..I...RichH...........PE..d....i............" ...*.............................................................?....`A.............................................M...................p...5......PP......p...."..p...........................@!..@...............0............................text............................... ..`.rdata...H.......J..................@..@.data....?...0...:..................@....pdata...5...p...6...V..............@..@.rsrc...............................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................

52ca6c.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	575592
Entropy (8bit):	6.535312420736696
Encrypted:	false
SSDEEP:	12288:N9W8APqgSqvJP85TAv/kLRNKjxDJN7e12QEKZm+jWodEEVx7/:NPW9ILRwjxD62QEKZm+jWodEEb7/
MD5:	CFDF6EAF5328FECBDEC268B7F9E21F3A
SHA1:	100C8A08DE6544B8554A542AD55AF831F86565E7
SHA-256:	9057D39B36B6C7D054865EE2BF9CDE7A490FE3B01EC4E82514687E24F576269F
SHA-512:	A81FEB56AE3E4939ABB21597F4F60429B704E04E6C20FAC402A0518FE7B29606BF8824347A7570D98F3C44684C15BF6B520E350321BFC2A42EC5597989215782
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r..D...D...D....k..F...Mk!.R...D.......U...A...U...@...U...L...U.......U...E...U.M.E...U...E...RichD...................PE..d................." ...*.:...V...... $..............................................E.....`A........................................p2..h.......,............p...9...x..hP..............p...........................P...@............P..x............................text....9.......:.................. ..`.rdata..z....P.......>..............@..@.data...p8...0......................@....pdata...9...p...:...0..............@..@.rsrc................j..............@..@.reloc...............n..............@..B........................................................................................................................................................................................................................................................

52ca6d.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35944
Entropy (8bit):	6.653057193822569
Encrypted:	false
SSDEEP:	384:Hjh/2cARGLSxXvQ5m9/U09dSzWc15gWWjg1gSt+e3RxB+R9zPmDnzHRN7LSpR9zF:HlWRGF5mZU0PSVkg1HNRxw9z+3eD9zF
MD5:	6DD04C14A17CAAE50D068FC89D7D01F0
SHA1:	4D2D12D7A0139C8248F9F9266982562ED402B8DA
SHA-256:	A65249861238E1C18B84AE5D112617C438D83A76B67EDDC170AD82DBC2338665
SHA-512:	9C04F015728D0F57E7B91E888505A0A288064529BF72DFB1F2C5FC571DB40C2CC118782B8544BEBC4E26B8BD189667FE65D13289A4F347B2805FF5EC5B9646AE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.M...#...#...#.4.".}.#.v..{.#.n+ .}.#.n+'.x.#...".U.#.n+".z.#.n+&.k.#.n+#.~.#.n+.~.#.n+!.~.#.Rich..#.........PE..d....4.".........." ...*.....&............................................................`A.........................................@..L...LA..x....p.......`.......<..hP...........4..p...........................`3..@............0..8............................text............................... ..`.rdata..B....0......................@..@.data...P....P......................@....pdata.......`.......2..............@..@.rsrc........p.......6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................

52ca6e.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	267880
Entropy (8bit):	6.5200682286945115
Encrypted:	false
SSDEEP:	6144:LLgFc7g9tEmUoGARVA9+VXgtF+hwvWY/q:ul9tbVA9+uF+0WV
MD5:	DDC38BB34DE28E1F42B6DEA9770D4D65
SHA1:	6FC98E48F5E738C82279ED0F445AC1DD9C4D02A3
SHA-256:	89E2E9A163165E20C540F9ADEA081E927DDFE4A556547B0F45F11586D4CCE165
SHA-512:	F4B07D80BE1E64F132DBC1AB2F29E4CA6B2CC589B348328937857CE9B578118497D6F39AFEBE49DD19E3665A8BAB92E441721613D4EBE873254AD0BEAD6F446F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1U.zu4`)u4`)u4`)>La(w4`)\|L.)y4`)d.c(v4`)d.d(}4`)u4a).4`)d.a(r4`)d.e(`4`)d.`(t4`)d..)t4`)d.b(t4`)Richu4`)........PE..d....\w+.........." .....................................................................`A................................................h...........................hP......x....R..p...........................`Q..@...............h............................text............................... ..`.rdata..............................@..@.data...`.......&..................@....pdata..............................@..@.rsrc...............................@..@.reloc..x...........................@..B................................................................................................................................................................................................................................................................

52ca6f.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	50256
Entropy (8bit):	6.650307191256275
Encrypted:	false
SSDEEP:	768:iI39vdGFBtDsnyFf+7gcPXepKn/U9zS68rFT9zy:39vI2yigcPXepKnkzS68rTzy
MD5:	333727166AF151E95B05CB54550342CD
SHA1:	746504C9056B83D9AF6F800905B80E864AAEA5F4
SHA-256:	FBF41E4B53F51BBF73FEE37B6120103FEA6B7D5AE29916F8EF50C50CFDEDEEAD
SHA-512:	2D9FA95A068784A8E799362FAF97B42253DBD614DA504907ED01D1F7F3FDC56D1BB964B2009171EDA87149A595D84EC83D50DAFF30BE9BD6F7A3C76C75226C40
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#B..pB..pB..p...qF..pK.\|pD..pS\.qA..pS\.qJ..pB..p'..pS\.qE..pS\.q_..pS\.qC..pS\.pC..pS\.qC..pRichB..p........PE..d....w............" ...*.:...........>.......................................@............`A........................................0f..D...tk....... ..........8....t..PP...0..X...`X..p........................... W..@............P..H............................text....9.......:.................. ..`.rdata...$...P...&...>..............@..@.data...H............d..............@....pdata..8............f..............@..@.rsrc........ .......l..............@..@.reloc..X....0.......r..............@..B................................................................................................................................................................................................................................................................

52ca70.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31824
Entropy (8bit):	6.837226224621119
Encrypted:	false
SSDEEP:	384:q4Dgv27sdWirEW5St+eASR9zy4gq2OHRN7BR9z2A:BgvkwOGe9zfU6r9z
MD5:	208CD115A93175DB7A8EE80B97E0CC28
SHA1:	789E0DA53C321D7A64C1435F569FDBFB249DFACD
SHA-256:	0E1D3D76E899A89FB3893FB13ABAE232FF62AD4F573214DD2F02B8398166BCC6
SHA-512:	8E0BF76440D64D2331FA9988F81850F646A91335C02A2028877ADD6190CF4CAC533CF22825D2F0565B854075CF70FF86CD728E2114284F2321E52B1B47004DE6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w..(3{h{3{h{3{h{x.iz1{h{:..{1{h{".iz0{h{3{i{.{h{".kz1{h{".lz4{h{".mz?{h{".hz2{h{"..{2{h{".jz2{h{Rich3{h{........................PE..d...A..4.........." ...............@........................................p.......p....`A........................................p(..0....)..P....P.......@.......,..PP...`..,...."..p............................!..@............ ...............................text...x........................... ..`.rdata..B.... ......................@..@.data...p....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.....................@..B................................................................................................................................................................................................................................................

52ca71.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	351824
Entropy (8bit):	6.052949543661257
Encrypted:	false
SSDEEP:	6144:akHIL35SLayPmH24CX70uADWIVKTxWJchBBhWwZgpvCiNnMniWcNNTy:jwp4aEZGli
MD5:	164561905F701BC680D654232BB5C4D1
SHA1:	ACEF59F34D1245169A671C32D69EB204DC5897D3
SHA-256:	8903B5D88968791D2A93648A54A1AC3D1C708C579A72311FFE194F6D66903043
SHA-512:	5237F7A722100167A0291B215F151F502AE615160E58D2130FB693289D3C87415EDBA3F0A96B11118117A574F58B50A348D21CE4A32987FABB5D9B4BBBC83887
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."n..qn..qn..qg..q~..q.%.ph..q.%.pj..q.%.pf..q.%.pu..q%.pi..qn..q...q.%.p...q.%.po..q.%nqo..qn..qo..q.%.po..qRichn..q........................PE..d................" ...*.....................................................P............`A.............................................>..4 ..,.... ...........!......PP...0......p...p...........................0...@............................................text...F........................... ..`.rdata..............................@..@.data........@.......$..............@....pdata...!......."..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

52ca72.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	192104
Entropy (8bit):	6.460819297931624
Encrypted:	false
SSDEEP:	3072:q1+imylDoToQ9tZgCpybBqeMY3ov8cuNFmAEPPZsQ/JNT1nNQ:e93i8Q6IEBhMUoPOCpx/3DQ
MD5:	17CF948597BEFC68706E3121BB0ACDE6
SHA1:	D7F13076A2FBDE1F88127118EBD9BAA9C782BC71
SHA-256:	036B9B3F7ECE8DFD48AECCD77113721C5305043AAA9C64D1E72812252727AA7C
SHA-512:	28475DA6F70C355EC113CD41B2DB3CA0676B3F87495BEBFD76D916047D08B9F27DA7B7EC6F3EB9862BE1947DE163F68B96D12C6864EBD0036B997096728A8003
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........l.l.?.l.?.l.?...>.l.?...>.l.?...>.l.?..>.l.?..>.l.?...>.l.?.l.?.l.?..>.l.?..>.l.?..>.l.?..k?.l.?.l.?.l.?..>.l.?Rich.l.?........PE..d...&............." ...*..... .......g...............................................J....`A.........................................`......Hn..(.......................hP......4....C..p............................A..@............................................text.............................. ..`.rdata..............................@..@.data...d%...........`..............@....pdata...............l..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

52ca73.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120432
Entropy (8bit):	6.602841735473839
Encrypted:	false
SSDEEP:	1536:R9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaWEoecbdhUoTtHez9FazR:REnsvReGsWyxLizXFCecbd1Tt+i1
MD5:	943FC74C2E39FE803D828CCFA7E62409
SHA1:	4E55D591111316027AE4402DFDFCF8815D541727
SHA-256:	DA72E6677BD1BCD01C453C1998AAA19AEAF6659F4774CF6848409DA8232A95B2
SHA-512:	96E9F32E89AEE6FAEA6E5A3EDC411F467F13B35EE42DD6F071723DAEBA57F611DBD4FF2735BE26BB94223B5EC4EE1DFFEDF8DC744B936C32A27D17B471E37DCF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w..E3f..3f..3f..x...1f..:.].8f..3f...f..3f..2f.."...#f.."...,f.."...&f.."...2f..".1.2f.."...2f..Rich3f..................PE..d....<............" ...*.$...d......................................................k.....`A........................................0u..4...d}..........................pP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B........................................................................................................................................................................

52ca74.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	6.702924040492291
Encrypted:	false
SSDEEP:	768:qzzO6ujT3MbR3v0Cz6SKLq83yN+iRxw9zv6JmEpw9zF:3q/o1j3c+iIzv6JmEp4zF
MD5:	05052BE2C36166FF9646D7D00BB7413F
SHA1:	D8D7C4B322D76E3A7B591024C62F15934979FE40
SHA-256:	26E470B29BED3D873E0C328186E53F95E9EDBFE0B0FD0CDA44743A0B1A04A828
SHA-512:	0460CC66D06DF9A2941607473F3ECCFD909F2ADAB53A3328FADCEDD1B194B388ECA738C2C6C2E193DE33606925FBED1FE39EFA160015128E93F5E3A03C62170D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\..\..\...]..\...]..\..O\..\..\...\...]..\...]..\...]..\...]..\..#\..\...]..\Rich..\........PE..d...=............." ...*.<...8.......@..............................................U0....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

52ca7a.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5622864
Entropy (8bit):	6.7472704207598255
Encrypted:	false
SSDEEP:	49152:oAq8lW0qJev85e6u9Pq7ao/prvFl4DER1Oh9B3LGcttK5kFDvGtMuSwIbFLOAkGF:g/eENpIfDvFLOAkGkzdnEVomFHKnP
MD5:	277949968E022B74D4370E94AAA70D76
SHA1:	0902D716F2966DFBC8ED32237F00DB52FB1A9EA9
SHA-256:	3916D6406CBD63B81300989EFF24042FD16A1344EDD9904E6093A1619853B9B8
SHA-512:	3452E7DD91158AE1474DBD838C5AFB4F281F4A0F0D0C9F665506108555DC087C9086257D70643F7281200C19638D4059679E9D1E610F8E935A447428D32B38ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......7.qs.."s.."s.."8..#r.."8..#r.."8..#i.."z.u"g.."b3.#w.."b3.#{.."8..#`.."s.."a.."b3.#i.."b3.#.."b3.#u.."b3.#r.."b3."r.."b3.#r.."Richs.."........................PE..d......%.........." ...*..,...(......&,...................................... V......\V...`A.........................................C:.d...D.;.......?.`.....<..5...\|U.PP....T.,o...O5.p............................A..@.............-......0:......................text...\.,.......,................. ..`.rdata...u....-..v....,.............@..@.data....4....;......j;.............@....pdata...5....<..6...8<.............@..@.didat..H.....?......n>.............@....rsrc...`.....?......t>.............@..@.reloc..,o....T..p....T.............@..B........................................................................................................................................................................

52ca7b.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5658192
Entropy (8bit):	6.729941320562663
Encrypted:	false
SSDEEP:	49152:pokzXd4MY7BVr/PXbGtet2cC5AR2YM7F24LSN7iMN3yDFFxkhkOuSwIbFLOAkGyW:aMc3EbFuFLOAkGkzdnEVomFHKnP
MD5:	3D3FD261916A8327667BBD66C4C53C80
SHA1:	DCE287AD815A91C4F80EA05F565C47A605E0F07A
SHA-256:	DD502923934ED248EC3A1417142306542C8023536637B650AFD8930859A9B2AD
SHA-512:	9E7EFF71B829F24F65B5A4CE5DC429AEB4BC8F5F188F83B17FC8796B610B541E13849AD4A7B98CE11E0E6675F9016D7E6A9D81280D1F7AE054E8AA072B522F08
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.qo.."o.."o.."$..#n.."$..#n.."$..#u.."f.t"{.."~3.#k.."~3.#g.."$..#\|.."o.."o.."~3.#u.."~3.#..."~3.#i.."~3.#n.."~3."n.."~3.#n.."Richo.."................PE..d...g..q.........." ...*..-..P)......N,.......................................V......`V...`A........................................0.:......;.......?.`....@=. 8....V.PP...0U.<p....5.p............................q..@............0-.X.....:......................text.....-.......-................. ..`.rdata..V....0-.......-.............@..@.data....7....<.......;.............@....pdata.. 8...@=..:....<.............@..@.didat..H.....?.......>.............@....rsrc...`.....?.......>.............@..@.reloc..<p...0U..r....T.............@..B................................................................................................................................................................................

52ca7c.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	96416
Entropy (8bit):	6.387028558514212
Encrypted:	false
SSDEEP:	1536:Ffibqlvn7yWaoVe3EFZR0dhua0swuOcKiIzp/ISAHIEzfwzdB:gbampse3WR0dhua0s+ZDzp/xAd0n
MD5:	58B613899800EB4B690984E1C78BD31F
SHA1:	D827BA4A4E59C78D11C61B9C5BE78C8DDD5B74F4
SHA-256:	9B53E19B5F96DE66CD3992169009146AD08F2F042CC0AED4191E1F0B1068891F
SHA-512:	9767AD3BD377DF7E3818E98FDAC794F5147FAECA9680DB568E96BED173206B71FE59FFA2B031A182BACC37EA440D329BF03FE3EF30EA72CE655EEBE2DDC6B677
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f...f...f...-..d...x.s.d...w\.`...w\.e...w\.n...o.s.b...-..c...f......w\.A...w\..g...w\..g...w\.g...Richf...........................PE..d................." ...*.F...........P....................................................`A........................................./.......0.......p.......`.......(...P...........y..p...........................px..@............p..x............u..H............text....A.......B.................. ..`.nep.........`.......F.............. ..`.rdata.......p.......J..............@..@.data........@......................@....pdata.......`......................@..@.rsrc........p......."..............@..@.reloc...............&..............@..B........................................................................................................................................................................................

52ca7d.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	96384
Entropy (8bit):	6.3866070308269265
Encrypted:	false
SSDEEP:	1536:gfLGx5FuyPQoYdlu3eMOZRZBJG00swuYKtzyzVfMIJknzUizd6K/z4:UGtIlPRZBJG00sjZifMa6UilE
MD5:	76D7D08147A8F109A69C7A9871D3BED7
SHA1:	E7DC5E4AE364998A555875EC7AA1614CEE78D87C
SHA-256:	99328025DD44FBF310280E83CB0F17AA0D0420446A08768A8910D70B6D8C94F7
SHA-512:	BDED655AEFC386ECA685A0B47285CCBBB090DE4D654C88198C7CA87AF4FC9F7C7BDF3268D7E0414263100E03F6B7AD7CD087CDB9DBD6062613BE47AF5B23CF59
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f...f...f...-..d...x.s.d...w\.`...w\.e...w\.n...o.s.b...-..c...f......w\.A...w\..g...w\..g...w\.g...Richf...........................PE..d....o............" ...*.F...........P..............................................v.....`A........................................./.......0.......p.......`.......(...P...........y..p...........................px..@............p..x............u..H............text....A.......B.................. ..`.nep.........`.......F.............. ..`.rdata.......p.......J..............@..@.data........@......................@....pdata.......`......................@..@.rsrc........p......."..............@..@.reloc...............&..............@..B........................................................................................................................................................................................

52ca7e.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	51304
Entropy (8bit):	6.319038641792757
Encrypted:	false
SSDEEP:	768:fdzvsX5V9tLkr8yTby97DVLXg1HPV9zJWH14e9zfFn:lz0X5V9tLU8CbyBVLUHPnzJWKazNn
MD5:	9CBBA8B64FEB8167093BEF01055D4547
SHA1:	4E95E671E9D818764ED76F4AE5D9A4BEB1ED24EA
SHA-256:	1DDE587FEABACF34CE435DB596815563732F3E42E595EE5C0766115483FA22AB
SHA-512:	694BEA161CE3E0E6C17BD8A84E14FA83FFFE122F833808D586BB8D67546553A711B417433AA14D963DF6F82D52118428721F2C8932DE52E324E2CA27CEDFEB80
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d.....v.........." ...*.....v............................................................`A......................................................... ...s...........x..hP..............p............................................................................rdata..t...........................@..@.rsrc....s... ...t..................@..@......v........X.................v........l.................v........$...L...L.........v............p...p...........................RSDS.i}...W...r.......D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140CHS.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1...a...rsrc$02.... ....i}...W...r...S..&7........v........................................................................................................................

52ca7f.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	51280
Entropy (8bit):	6.3571761032627
Encrypted:	false
SSDEEP:	768:QLfucVI4r/7kYw4JUM3i/EhW8QkF9z6Y6X1Rxw9zlxo:SucVI4r/4YJUM3XhW8Q+z16lIz7o
MD5:	67AAD6CAC0716E4B9A2ED43319FF3BC4
SHA1:	EEF641F1E2601ADFEEE172F07A51D15FBE8DAA83
SHA-256:	97296F66478F3DDE87565A867F159E98C0B751C067491978D26987EC8609B334
SHA-512:	E0F034831D535DFECAAC8A98454F6A982FE89FE7B14B5F8FE35FF15EBFD4E64AA74830520654DC94CAD46BBFA13F5A32D756789720B564C3791212C6F74C41FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d...,/............" ...*.....v............................................................`A......................................................... ..8s...........x..PP..............p............................................................................rdata..t...........................@..@.rsrc...8s... ...t..................@..@....,/..........X...............,/..........l...............,/..........$...L...L.......,/..............p...p...........................RSDSJ.v....y..3.@+....D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140CHT.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1...a...rsrc$02.... ...J.v....y..3.@+...x..9CX...,/..........................................................................................................................

52ca80.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79976
Entropy (8bit):	4.994443234085317
Encrypted:	false
SSDEEP:	1536:3VPidQr0UZqnn0BDekPS6VFaGCWKZ+e0petNSaBhp0vcsjsr8gWb8C1dCuf9AH5b:3VidQr0UZqnnSekPS6VFaGCWKZX0Whpx
MD5:	D97E3D56F2ACBD54671CDC2496AA02B5
SHA1:	D5943EF3E74C98734B43630C9FD7F6B123FD2FA3
SHA-256:	F0D3A39951FCCF41429E087BF87523C261B292AEF2416BAD6C606C3A8EC3799B
SHA-512:	B2C33A9BC9B4D174804C14FE3DB71306149B36CE760C2939D8FB8FB4E6F34DFCB3629FA5CE7F6BADDD6BBA4297D7BE9B84FCA45B5F3BD70CE7893ADC7C05C868
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d...{............." ...*............................................................M.....`A......................................................... ..0...............hP..............p............................................................................rdata..t...........................@..@.rsrc...0.... ......................@..@....{...........X...............{...........l...............{...........$...L...L.......{...............p...p...........................RSDS:.lg..&.9...n....D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140DEU.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1.......rsrc$02.... ...:.lg..&.9...nu..j.[....{K{...........................................................................................................................

52ca81.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70256
Entropy (8bit):	5.150852428474578
Encrypted:	false
SSDEEP:	768:+VGijcBEhCgyDOAu1HLPLNqyf/nWHBNhdBU2fd5eg1HGK9zbBK9zk:+V9zfyDOAuhPLNXf/nWHNfdBHTzbczk
MD5:	D92BAFE14939B60093AAE336340D4CFD
SHA1:	8E017CF296BAF7D6EB9C47A7C688FC8C3FBB7FE7
SHA-256:	DC7BBA5E343A56E61BBC90DD497ED397339731FCD50F42B0D7825BC787EE16B0
SHA-512:	784FFFAE7A50F6991828C4113719426DE083D60B52490E9034FB29C5C32787C252456ADE1753D493367BBCC06039C620E220C2A4A278AA8057A239C25B7A5152
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d....N.7.........." ...*.............................................................U....`A......................................................... ..................pP..............p............................................................................rdata..t...........................@..@.rsrc........ ......................@..@.....N.7........X................N.7........l................N.7........$...L...L........N.7............p...p...........................RSDS...]n.j..5.K......D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140ENU.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1..0....rsrc$02.... ......]n.j..5.K....}.o.4...{..N.7........................................................................................................................

52ca82.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78952
Entropy (8bit):	4.971589823131607
Encrypted:	false
SSDEEP:	1536:Zwq6Nk6B/iKuFm3OKWxRZ/IWHypz0NEp4zGb:Zw5lB/+HIWSpUXab
MD5:	5110F40A05DBC4CCC02260ECC2A002CA
SHA1:	DF3B1EAC64186ECB08D7D11966037B879AB3112C
SHA-256:	F8C5517246DE29946CDCFD46EEEE6D021FF9271C2ED806BCD37572C8E44AC9FB
SHA-512:	65F1E857E4B2DEF041B423AA803AAAD6BA5543320085362EB9944ECC2ACEC08007081C5F068550FC3A610AA2B2D7592BF5F5F49BEE80091C7A704CE727460D92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d.....y..........." ...*..................................................................`A......................................................... ..................hP..............p............................................................................rdata..t...........................@..@.rsrc........ ......................@..@......y.........X.................y.........l.................y.........$...L...L.........y.............p...p...........................RSDSLsK....}...[.......D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140ESN.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1..`....rsrc$02.... ...LsK....}...[.......8..qn....y.........................................................................................................................

52ca83.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79976
Entropy (8bit):	4.975449677987261
Encrypted:	false
SSDEEP:	768:g26iNYajZELnDYFmNRYxAaTafCp5eQYZmZUjyyyyyyyyyyyyyyyUGQFUbWTVNeEa:gNuqLnD6A2SCHu0jjHCzlJzW
MD5:	D2A0439EBD5E8CFBFECFDA82C0EF2669
SHA1:	CD8E8639F8B0F8526A7297255FD97DD2CD22BF5C
SHA-256:	F5C53DDF07223DD3DC25276DE42FC3958EC1B9EE6EB4F385680159C056B6F22E
SHA-512:	57C12D3F1F4DA9177165F09477287826BE1C221BBCA18AEAE5D4CC840DE3AEA3CB0C6317A43714FB8DD13E1E186A654275EA62D7C286A8DC2E04A6D17332B7D5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d...f]............" ...*.............................................................T....`A......................................................... ..x...............hP..............p............................................................................rdata..t...........................@..@.rsrc...x.... ......................@..@....f]..........X...............f]..........l...............f]..........$...L...L.......f]..............p...p...........................RSDS.S8...4..C...+.....D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140FRA.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1.......rsrc$02.... ....S8...4..C...+..O......_...f]..........................................................................................................................

52ca84.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77936
Entropy (8bit):	4.979078290008832
Encrypted:	false
SSDEEP:	768:pRE6XaCyqbK15MRQwgDGxNIlW3jSCQQQjeqS1hDDg1UWTVwg1HpD9zcFB7K9zE:pnass5MRQwgSxNIlW3GoiTTHppzcrCzE
MD5:	C081990436336CD6A1FE8E6986FA004C
SHA1:	DCBF030AE874A24AA266C57E0676869ECA9739AE
SHA-256:	37BBAED22D80172C5BD8019DAF95B9C8C051E561AACF232E6C07A09E702B2273
SHA-512:	2C0CBDEF8F8BAF3969FC8FC0345B2E75737FB368AD6D31A030741EDC4168EAB450A6608F783C7CCE81AD77DE1BBF3520D44A1A062458090F02ABCEC08576A0B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d...<.wz.........." ...*..................................................................`A......................................................... ..X...............pP..............p............................................................................rdata..t...........................@..@.rsrc...X.... ......................@..@....<.wz........X...............<.wz........l...............<.wz........$...L...L.......<.wz............p...p...........................RSDS...}.....>#..L......D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140ITA.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1.......rsrc$02.... ......}.....>#..L..4...P...Z.H.<.wz........................................................................................................................

52ca85.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58960
Entropy (8bit):	6.151712284541509
Encrypted:	false
SSDEEP:	768:JanVn/y+fJxsr10/eu9RHreBNBXV9zJWDC635rF9zw:Unp/y6gunwfnzJ8C6JDzw
MD5:	D9B8C007A3B3D0CAB3B7CE95CD93B4ED
SHA1:	4509FF52489358475BC83D569F0011DB8CBF53A9
SHA-256:	0CFC2226385F2EE8FAC530B1DE72B87B3BCDD14732A23A545F989E38E965A822
SHA-512:	71755ACFD4031F9EAE868431A056C3E37F49926AB78EE7E2EDB956CB42F675A384D416DA6F48D107B0C5D8AD382618C1091E18A4AFF5DFCA757667D56E4C8DDB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d......_.........." ...*............................................................,.....`A......................................................... ..................PP..............p............................................................................rdata..t...........................@..@.rsrc........ ......................@..@......._........X.................._........l.................._........$...L...L.........._............p...p...........................RSDS.....~.x...!.@....D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140JPN.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1..p....rsrc$02.... ........~.x...!.@. .LL<........_........................................................................................................................

52ca86.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58472
Entropy (8bit):	6.272332121552409
Encrypted:	false
SSDEEP:	1536:tr51TNQRqNAx2I7CvqQHPnzJFbC4dezFO:tr2EAspvnNnIs
MD5:	E10B9371A0746AF285BD2C78931CAB4F
SHA1:	3FA036FB2882C5C9457DD436951CAC12AB6060A7
SHA-256:	3D3E43E6F2E305F7F2FC97E74E4CEF7037A56E075AB41FB359FA445AB5CBB786
SHA-512:	80717FC26B2438955770FED6EDAE0E2FB49AC8FAB57AF3B827275C2FFD1F8A563803983C1A2E206FD5940DF0705FF1EC1526F1C0C9A4E87D750CC8FE1D8F9385
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d..............." ...*..................................................................`A......................................................... ..................hP..............p............................................................................rdata..t...........................@..@.rsrc........ ......................@..@..............X.........................l.........................$...L...L.....................p...p...........................RSDSb)'.]E.r....5C\.....D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140KOR.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1...~...rsrc$02.... ...b)'.]E.r....5C\.4.......FfEB..........................................................................................................................

52ca87.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	75856
Entropy (8bit):	5.502784487678861
Encrypted:	false
SSDEEP:	768:JNv/gFXOvJWiqNWTMHVhtZgFckD906FT9zFH96f9zzCK:D6XOvJqhTWG6TzH6lzB
MD5:	FAAB772287C97342BE72B98443575F04
SHA1:	2296D3CF50C75DEB4DBEFDCE939D9EE1D0FE9E27
SHA-256:	577E3273049C6E4115030B3D2A1977AC4265C246697583CEB28A4E99457199A6
SHA-512:	960D7CACBA0D059E820D39DAFD245CF30203819634521D905B6EF001FDE43A3C9A7876BD95595FACB5F152F4042B1C80E16A04EE05BD41C65464E927569212C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d.....y..........." ...*.............................................................G....`A......................................................... ..................PP..............p............................................................................rdata..t...........................@..@.rsrc........ ......................@..@......y.........X.................y.........l.................y.........$...L...L.........y.............p...p...........................RSDSj.w....W.K...~.....D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140RUS.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1.. ....rsrc$02.... ...j.w....W.K...~.:..L...E.YL..y.........................................................................................................................

C:\Config.Msi\52ca58.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	15124
Entropy (8bit):	5.53325613356975
Encrypted:	false
SSDEEP:	192:R7JXuj2IYcwco0FSew1n9AkIqn9AkJpFEXENNepdG:R7tuj2IYcwde6eK5
MD5:	A3A51D6175F14E18463E028FBC897ECC
SHA1:	33831F7D81BD77A5D1B7E154C9C290F0AF7CC850
SHA-256:	9797B84061FA7EA4BF49FFBA1142B0D0CBD16B578E76092E08E802E635AA809A
SHA-512:	F22857639C693FE28F65EEA5DA5B199013176FA5C35D718E65AD5C1C4ED819CC41D7829ED9EBB986974F28CE2A04936DDC50203EF818EB4070C437DA64871F26
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@I.-Z.@.....@.....@.....@.....@.....@......&.{53CF6934-A98D-3D84-9146-FC4EDF3D5641}:.Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40664..vc_runtimeMinimum_x64.msi.@.....@....@.....@........&.{F8853551-4D30-4D6A-B36A-93EFAD4EEE03}.....@.....@.....@.....@.......@.....@.....@.......@....:.Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40664......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{BC1F4291-6F0A-38EB-984E-C2E555837FE1}&.{53CF6934-A98D-3D84-9146-FC4EDF3D5641}.@......&.{E5B92048-5859-4AF1-AEAD-B97EBF00B087}&.{53CF6934-A98D-3D84-9146-FC4EDF3D5641}.@......&.{570C624B-D57C-4CD1-9013-1B80C800093B}&.{53CF6934-A98D-3D84-9146-FC4EDF3D5641}.@......&.{14E8634F-8AEA-4CD1-AC48-BEBFDA18523A}&.{53CF6934-A98D-3D84-9146-FC4EDF3D5641}.@......&.{4C723A6F-9201-44D8-BE75-E08B5D104F85}&.{53CF6934-A98D-3D84-9146-FC4EDF3D5641}.@......&.{EFA0F8A1-F16D-4E44-8EE4-2CD86E1D12F4}&.{

C:\Config.Msi\52ca5f.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	21956
Entropy (8bit):	5.385900872990404
Encrypted:	false
SSDEEP:	384:otT8MgXEtmrnb0MM0IE+AfCuS588UBx/l6lBFXDcpO:otT8MgXEtmrnb0MM0I08xl
MD5:	5077E18C2751B5B5BBA80FC85ECCFA32
SHA1:	B9DE22EA897F8A143F05001B7DF45767E61768CB
SHA-256:	FA0FF978F90E554FE5FFC8A5D2F4DB6623DBC7275A27C13DA430E9C7B324C73C
SHA-512:	499DAF752F28832162855982BA1CD7CBD879A9DF24DBEF8DD1011444F2863F006ABFDCF7C839B0266F2A9727FCDD4AADF7C96D6A48836B97B068FF93E85DF4D0
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@J.-Z.@.....@.....@.....@.....@.....@......&.{010792BA-551A-3AC0-A7EF-0FAB4156C382}=.Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664..vc_runtimeAdditional_x64.msi.@.....@....@.....@........&.{A1135D47-2E01-4DE6-AB19-25679EC5D3CF}.....@.....@.....@.....@.......@.....@.....@.......@....=.Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{191E6DE4-E7B2-3CE9-B48B-25D0FFF3D88E}&.{010792BA-551A-3AC0-A7EF-0FAB4156C382}.@......&.{E70078E7-D25B-421C-A415-0AB472053F72}&.{010792BA-551A-3AC0-A7EF-0FAB4156C382}.@......&.{7D2EA505-A879-4E71-8632-F3DE9B679CE6}&.{010792BA-551A-3AC0-A7EF-0FAB4156C382}.@......&.{1F74928D-AA17-468C-A7D7-6A730A8DB25B}&.{010792BA-551A-3AC0-A7EF-0FAB4156C382}.@......&.{ECA05A2B-D2CC-43F5-B3B4-6501C6C75D8B}&.{010792BA-551A-3AC0-A7EF-0FAB4156C382}.@......&.{ABE93925-6BF3-4948-90FF-1E4DF15

C:\Config.Msi\52ca68.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	19481
Entropy (8bit):	5.417174304661584
Encrypted:	false
SSDEEP:	192:roNR9oyQlYLWR9+yQlY75+XGqGIara8R2OMyOW5WcvQgKxBFUHZu4KNWKQzh7q/m:ruRUlpRGlKFiA
MD5:	4263DE0950A032677C6E4759432C77CA
SHA1:	EDC19B5D7D2160C5D8E52665035359F44A803C02
SHA-256:	B2394EDC2B1150916CB34F9FDD56758E28339559D254FE684E37CAA3FBE3050A
SHA-512:	1ADCDDB08DFC936B646962454F634185C012AA34E7FE8314D5CE2E6275D9002A31B4D33A4B018B4E6EB519CEE674AAF6772C57E1AE53557D6BC5E9FCF7FB67F9
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@S.-Z.@.....@.....@.....@.....@.....@......&.{D5D19E2F-7189-42FE-8103-92CD1FA457C2};.Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532..vc_runtimeMinimum_x64.msi.@.....@..$..@.....@........&.{4E8C8C37-B448-4BB0-8A8B-F640B3239F71}.....@.....@.....@.....@.......@.....@.....@.......@....;.Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....InstallInitialize$..@....z.Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F2E91D5D9817EF24183029DCF14A752C\Transforms...@....(.$..@....@.Software\Microsoft\Windows\CurrentVersion\Installer\TempPackages...@....(.&...C:\Windows\Installer\8b6a7.msi..#0$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F2E91D5D9817EF24183029DCF14A752C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ......

C:\Config.Msi\52ca6a.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	22326
Entropy (8bit):	5.40843280287445
Encrypted:	false
SSDEEP:	384:r1Ipt1tdtgt+tQtHtMtOt0tftetltGt6tMMN4xA1ty6sBb3G/R0Aorje0AorXkRz:rmXfGY2N6oCF4HgMjRnj
MD5:	676F5F2291334F604593A109BFD847ED
SHA1:	B31633C4B332D719840FBD0AB3EBF2C037EFB2EF
SHA-256:	CC60FA25601EAD16F822CE9BAAB497D91DFBAB176CB2F6E6BA86DC9265F280C5
SHA-512:	C24BD9CC3506883DC3277686E8BA37A1A4CDB4A3F9C8B572DD3AE40FF1214F326C1AACCAF463C1A751329FD7400B4D9FCE6F82A5FC66E8DEE99FE7ECB7597EE5
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@S.-Z.@.....@.....@.....@.....@.....@......&.{382F1166-A409-4C5B-9B1E-85ED538B8291};.Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.42.34433..vc_runtimeMinimum_x64.msi.@.....@..*..@.....@........&.{A75B920C-55CD-4531-932F-CB4C539C41F8}.....@.....@.....@.....@.......@.....@.....@.......@....;.Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.42.34433......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{3639FCCA-5969-316D-AC18-E0C6B2B532E9}&.{382F1166-A409-4C5B-9B1E-85ED538B8291}.@......&.{D2959D22-4DB7-32AF-A1B0-8405C4221749}&.{382F1166-A409-4C5B-9B1E-85ED538B8291}.@......&.{B33258FD-750C-3B42-8BE4-535B48E97DB4}&.{382F1166-A409-4C5B-9B1E-85ED538B8291}.@......&.{4AF15CBB-F5C1-4468-A694-C5A03A2238D5}&.{382F1166-A409-4C5B-9B1E-85ED538B8291}.@......&.{2427B123-F132-4F0B-A958-50F7CDFCAA56}&.{382F1166-A409-4C5B-9B1E-85ED538B8291}.@......&.{22824972-0C4A-31B4-AEEF-9FC7596F1305}&

C:\Config.Msi\52ca79.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	22409
Entropy (8bit):	5.372882294799948
Encrypted:	false
SSDEEP:	384:qZRHl4R2lmVH3WLWsdfPjFuzYZWxlAmRG8e8v27lh1:qvH62cVH6axo
MD5:	C04FAC43177DEDEE2C4838228D130D23
SHA1:	5D13146DED83C5A477B26BFE047C6EF8FFA6FAAE
SHA-256:	5323ADB07516FE73370089867D5CDA1E7C0F89443BE3167355150D2B587E8B8A
SHA-512:	95AF7790B03E1B3B70EC89AB14AFE2641820A053444C59C4228003D1715061C8C2A4261B2F8ACC3AF5C02D7F6108BD13B418B84DE9F518B91D96D10923807264
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@T.-Z.@.....@.....@.....@.....@.....@......&.{0025DD72-A959-45B5-A0A3-7EFEB15A8050}>.Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532..vc_runtimeAdditional_x64.msi.@.....@..$..@.....@........&.{DD2B5EB1-E08E-45CD-8D47-2D0457D64BA3}.....@.....@.....@.....@.......@.....@.....@.......@....>.Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....InstallInitialize$..@....z.Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\27DD5200959A5B540A3AE7EF1BA50805\Transforms...@....(.$..@....@.Software\Microsoft\Windows\CurrentVersion\Installer\TempPackages...@....(.&...C:\Windows\Installer\8b6ab.msi..#0$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\27DD5200959A5B540A3AE7EF1BA50805\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... .

C:\Config.Msi\52ca88.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	21765
Entropy (8bit):	5.337184197728632
Encrypted:	false
SSDEEP:	384:qgPEsZBwNx7pxqUjy4O3JKsalckU72eC647vZSlwlwINIDYJBy:qgPEsZBwNx7pxqU2v3JE7hSlchNID4By
MD5:	33FBF1156573BDBCABA41E831A4EC54E
SHA1:	33B61BE808A093380DEC4DA596EA797A6D4AE535
SHA-256:	A015AA2C4A918048DAF8BC53F3AF249E2FD5273C5D945BA44A5F255A53D000E3
SHA-512:	B25EFEAFDB11B346FEF10485E7854E2347CD8E26897B2C9676949D7F313AAD3E46D55FB0D4B843C3E145777525D7A4E0582E632301CF328C14478BD6DA89F595
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@T.-Z.@.....@.....@.....@.....@.....@......&.{E1902FC6-C423-4719-AB8A-AC7B2694B367}>.Microsoft Visual C++ 2022 X64 Additional Runtime - 14.42.34433..vc_runtimeAdditional_x64.msi.@.....@..*..@.....@........&.{E04E511C-7D1F-4263-AB6A-F816392FD4D7}.....@.....@.....@.....@.......@.....@.....@.......@....>.Microsoft Visual C++ 2022 X64 Additional Runtime - 14.42.34433......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{3639FCCA-5969-316D-AC18-E0C6B2B532E9}&.{E1902FC6-C423-4719-AB8A-AC7B2694B367}.@......&.{D2959D22-4DB7-32AF-A1B0-8405C4221749}&.{E1902FC6-C423-4719-AB8A-AC7B2694B367}.@......&.{99A922E3-648F-3C37-8AE6-78232F317B1E}&.{E1902FC6-C423-4719-AB8A-AC7B2694B367}.@......&.{8924DA15-E863-388D-A06B-E7A3931AD77B}&.{E1902FC6-C423-4719-AB8A-AC7B2694B367}.@......&.{32252141-0BE5-3AFE-9849-D281CD954D43}&.{E1902FC6-C423-4719-AB8A-AC7B2694B367}.@......&.{AD221A2C-956B-3F16-8F64-FC938

C:\Program Files\CloudCompare\CCAppCommon.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	649728
Entropy (8bit):	7.039680213745585
Encrypted:	false
SSDEEP:	6144:MQOW+qYe7k6z8Mm6VKLjg1SL41q6iecU5PyAWIMWvh2MHg/sKuHNsEYhr/0p4D53:MQfi+r4w1SyqdexyHnMYsKutsEYR8pm
MD5:	31670756C84482C651BB895F9A6B87E5
SHA1:	A543B94A82DAD65923F4F2A666D5BB7020811BC8
SHA-256:	980069AFCB062404F1ACA91CACD514C28E55513244B44141D29359369EF950CB
SHA-512:	C1C1B5B88AB548A518CAF295954A3E833B0F7393ABF55011130707B76BF024034713313D8323026F2AD91D3ECB8635D7914AC336E3E627FEBB4C006657D509EE
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.....,...,...,.}i,...,.m.-...,.m.-...,.m.-...,.m.-...,.}.-...,.}y,...,#u.-...,.l.-...,...,...,.l.-...,.l.-...,.l.,...,.l.-...,Rich...,........PE..d...z..g.........." .....l..........,Z.......................................0............`..............................................?......@...............\............ ..H........................... ...(... ................................................text....j.......l.................. ..`.rdata..j=.......>...p..............@..@.data....%..........................@....pdata..\...........................@..@.rsrc...............................@..@.reloc..H.... ......................@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\CCCoreLib.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	722944
Entropy (8bit):	6.461841037101138
Encrypted:	false
SSDEEP:	12288:+DGOd2K9pFsPqEbVqbo16ITqX5PBxH4UdAWhZ5HXJKl:iddZ9pFViVqRIM5ZrZ5HX4l
MD5:	EA03FE27DF3672898090FE652DCAFDF1
SHA1:	A4C555ABE482DE8A409DE9CB2B04B39458A47B94
SHA-256:	B8D52C7B6F5407F8FBB89EDA8F0D09DBF13665324B1B48CE08602EB5CEB915BE
SHA-512:	BAE517ACA75A646596201B977A04D8B0F08AA01777B387700AF3E2D155958C0CECBC944AC2C856661223B1DFB1888EDD7DD6E4DA99891CDBE4D97467D79D987A
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............f...f...f.......f...c...f...b...f...e...f...g...f...g...f.......f.*.g...f...g...f...c...f...f...f.....f...d...f.Rich..f.........PE..d....{yg.........." .........V......`{.......................................`............`.........................................``.......e.......@...........U...........P.......<.......................=..(....<...............................................text...F........................... ..`.rdata.............................@..@.data...XB.......<...l..............@....pdata...U.......V..................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\CCPluginAPI.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	216064
Entropy (8bit):	6.0328472485055205
Encrypted:	false
SSDEEP:	6144:WxSpnOEgvfV8XO32ZHYHCct544Jd20dHUI/cGMnXOSIDOYvXUqiwrsAtj4hawtah:+jEo9t544Jd20dHUI/cGM6
MD5:	B23960264D44FC1F13250213106DC184
SHA1:	014D92C4DABA21E22D30435719477B6A146259AA
SHA-256:	7F7B6D425D87A7D8BBA1625CEDAAF0D9CC9B92AC9CA4ACA05B53820CD818A0D9
SHA-512:	45FA43135A66878B6E2B3352AF7DC13F9BC867F53067DBBCBB4A8AD6D7F7ED074EA60986F9E105C8896E8BF64C9089146124977CEF2AE5F6451FF562AD725A9B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i...`...a...;..~...;..a...;..k...;..m..."...k.......o......l...i.........a......h.....n.h......h...Richi...........PE..d......g.........." .....`...........O....................................................`.........................................0F...N...........p.......P..................................................(....................p...............................text...+_.......`.................. ..`.rdata.......p.......d..............@..@.data...p....0....... ..............@....pdata.......P.......*..............@..@.rsrc........p.......>..............@..@.reloc...............@..............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\CC_FBO_LIB.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.544702627865242
Encrypted:	false
SSDEEP:	768:TLAqRG/xoIUEVsaZ69deagBin87Z2c4AbGP:TK/xotEVtZ69kagBin87Z2cfGP
MD5:	C960C48DE097FD3C2BA3B43C095CE388
SHA1:	A4551EEF2EBA4A4EE4A6EC83A5953F63CE3BE0C6
SHA-256:	1D0F01ED76CE83AC277BF2260575FE47F3910E2CBA4C5A26F90F811E902962D9
SHA-512:	A3ACD232B28922C4C40A9BE09C002445E6384119A2937361E1C7ADA577924C6CB7B40053A06D9F433CE5660AFEFF5EC23853304C1102BAA45ED8B49583461183
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........G.............................................................................8......8......8.l.....8......Rich............PE..d....2Kg.........." .....4...R......L4....................................................`..........................................m......8x..................d...................0\..............................P\...............P..p............................text....2.......4.................. ..`.rdata..&<...P...>...8..............@..@.data...8............v..............@....pdata..d............z..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\CHANGELOG.md (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	235711
Entropy (8bit):	4.881009157481132
Encrypted:	false
SSDEEP:	3072:VinPJqOuT19YK0ooi4M5Np+FrqzDnBUMvGnkKbAeLqHjawFUPM8CVuH3H32p:L193ou8rqzDLvGxAeODacNTyG
MD5:	8FA735FC69E7AE5D70271BA457633099
SHA1:	5DFA18BA94398B07728443A951B9BE99857254AB
SHA-256:	00A8F881A71EB2B13E18C5D6B1795A7D0D0A1B7A8E7D93753BA843D0D859555F
SHA-512:	050228D412EFF4FED36F8EF7D972DEF23EB369139CAB692AEFC83E83A2654C7E5D5E737F8F2160C13E93C8782C9C5283BD4B5D05975BFBAA4684DA6123ED410F
Malicious:	false
Reputation:	low
Preview:	CloudCompare Version History..============================....v2.14.alpha (???) - (??/??/202?)..----------------------..New features:...- Edit > Color > Gaussian filter...- Edit > Color > Bilateral filter...- Edit > Color > Median filter...- Edit > Color > Mean filter....- to improve coloring by applying a color filter.....- New Command line options....- New command -FILTER -RGB -SF {-MEAN\|-MEDIAN\|GAUSSIAN\|BILATERAL} -SIGMA {sigma} -SIGMA_SF {sigma_sf} -BURNT_COLOR_THRESHOLD {burnt_color_threshold} -BLEND_GRAYSCALE {grayscale_threshold} {grayscale_percent}.....- command arguments with a dash can be in any order.....- -RGB runs the filter on color.....- -SF runs the filter on the active scalar field.....- -RGB and -SF can be used at the same time, otherwise at least one of the 2 options is required.....- -MEAN\|-MEDIAN\|GAUSSIAN\|BILATERAL......- specifies the filtering algorithm to use......- required......- only one should be set (However, if multiple are passed, only the first one will

C:\Program Files\CloudCompare\CloudCompare.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3778688
Entropy (8bit):	6.381493838760625
Encrypted:	false
SSDEEP:	49152:46SRSFneW0gGoV8tBB0pgRQBPMmS9BQRCSY0uKBY9zwaSNtASu58JfX/MkjX9F:XFFjByQET9iu8PXjT
MD5:	EB6EE54899E763C0C32625847735CB42
SHA1:	98DB0FC03A7BBD71901770F9637AA3EB57DC05D9
SHA-256:	0FA8364972240178560821D374BDA70A8A5E5B2AE05374E258C9599D8DF4A554
SHA-512:	E205199D0AE9A68BDD8E26809D5CC6C8360EA00D9C94A6B53F1B48A6EEC7DF7672062B4A9BF8A3A890D8053E66241464D099520841F647EFD98862AE3AE4AAFC
Malicious:	false
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......k../~../~../~..&./.#~..}...%~..}...+~..}....~..}...'~..d...+~......~..",a.-~.....%~....."~../~..Up.....u~......~...C..~......~..Rich/~..........................PE..d.....g..........".......!........... ........@..............................9.....D.9...`...........................................3.\X....3.......8.......7.......9..&...`9..i...+.......................+.(.....+...............". p...........................text.....!.......!................. ..`.rdata..b/...."..0....!.............@..@.data........@7..f....7.............@....pdata........7.......7.............@..@.rsrc.........8......x8.............@..@.reloc...i...`9..j....9.............@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\DotProduct_x64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2214912
Entropy (8bit):	6.384721005949699
Encrypted:	false
SSDEEP:	49152:ia4lRuO7XhnHmm4HjrbUABSEIS0Al2wIiXXo:vP8wbX
MD5:	DBF3283EE74FACA95837DF0499F2769E
SHA1:	A616D088099D914356AFACB1CAD9D7FD6577838A
SHA-256:	C1D5952D8C1D258866AD7AA8C4A34E98E3953492093E39B651A8EEEB7B3C2911
SHA-512:	A6F928A7C3DCE1F3EFD344ADB31F495E9ACEDAD2735329D9CD26705460F4A1150AFC05B457B7B9166CDB0C2A9F34850FF2FCEBB495A2879AA65D5354F3A7FD52
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......>.4.z.ZMz.ZMz.ZMs..Ml.ZM..My.ZM(.^Lr.ZM(.YL~.ZM(._Lg.ZM(.[L\|.ZM1.[L}.ZMz.[MN.ZM.._LZ.ZMz.ZMa.ZM..^LB.ZM..^Ll.ZM..RL{.ZM.._L6.ZM..ZL{.ZM..M{.ZM..XL{.ZMRichz.ZM........................PE..d...p.Uf.........." .................K........................................$.....Uj"...`.........................................0W...P.....@.....#......@"...............$.....h6..T....................8..(....6..8............ ..@............................text............................... ..`.rdata....... ......................@..@.data...@S.......~..................@....pdata.......@"......:..............@..@.rsrc.........#.....................@..@.reloc........$.......!.............@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\QCC_DB_LIB.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1405440
Entropy (8bit):	6.457300172251594
Encrypted:	false
SSDEEP:	24576:YF/mgRJ1GjiW1J/ZtHWTbFBy8L1OXerAKmj1l5+Fbya8q2eE:M2ZtHWPFByPP5+FbyFe
MD5:	9421DE1243DA93AC477AC5333AC04406
SHA1:	1098DFFC6F5955E00C2886E912FB17EC0C849A46
SHA-256:	7F6D8D720DE4720BDC0796D1AA1965E88CBA718BBEFF0C8ADA30987D6219C4A9
SHA-512:	0911FC373F6BBA0E0A5550A273C9D5125475C77E0983828EADE7C4A9358433884A07727E8EFA276F2423E83B652817F0379EA80F2852D8D9F706A75DB85827B3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V6.o.Wc<.Wc<.Wc<./.<.Wc<@?f=.Wc<@?g=.Wc<@?`=.Wc<@?b=.Wc<Y/b=.Wc<.'b=.Wc<.>b=.Wc<.Wb<%Tc<.>f=-Wc<.>c=.Wc<.>.<.Wc<.>a=.Wc<Rich.Wc<........PE..d....g.........." ................`.....................................................`.............................................4...$...T...............d............... >..............................(.......................(............................text............................... ..`.rdata..............................@..@.data....Z.......4...h..............@....pdata..d...........................@..@.rsrc................0..............@..@.reloc.. >.......@...2..............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\QCC_GL_LIB.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	326144
Entropy (8bit):	6.195700191357499
Encrypted:	false
SSDEEP:	6144:aiEihwMr/RYZfJTW3z9EVWJ9nB5ouD0K+6nkZRAAB5Ohl0omBEV/jVq9mUT74Rsx:aiEiOsJatVUEA
MD5:	E421801BEAB05A96A041EA2A759D7E50
SHA1:	6E6BA8E783E8F4A8E3984A8324D353D56F360AE8
SHA-256:	9E3B73B7395CF53942CE363FC69A825B53534703920691D38E97BD84C08825F8
SHA-512:	7DC1D88B8E5BD519887BD9DDA2700EBE7AB8647DB1E8E1B56D749EA670F91D451BD7DC8D0D1C02775F89D4EA108575ECE3A7402B43EE8DF32428F0A6F54AF3FA
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........L.\|U-./U-./U-./\Uw/]-./.E..B-./.E..]-./.E..W-./.E..Q-./.U..W-./.]..T-./.]..S-./.D..R-./U-./.../.D..]-./.D..T-./.D./T-./.D..T-./RichU-./........PE..d......g.........." .....v..........$[.......................................@............`.........................................0... q..P........ ..........l............0...... .......................@ ..(...@...................@............................text....u.......v.................. ..`.rdata...J.......L...z..............@..@.data...............................@....pdata..l...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\QCC_IO_LIB.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	803328
Entropy (8bit):	6.301764713308598
Encrypted:	false
SSDEEP:	12288:zi/B1Q7qKbhpvjs13V8nt0aG4m5UTmSpN2oyIKefN/4:zSB1Q7qK1pMktxQUT3v2XI9/
MD5:	65E878BE5E621489342B5369D2CD446D
SHA1:	5FE0112DD80BEAFF167212E13DB73335BC1C5120
SHA-256:	14DD904B4DF2BC9956EC1719F778E141350913DF097368E77BACE6CA1DC7F339
SHA-512:	31AEBFCB29905AE710C33A45A93B9EB28755CDEF47861B22A2854994B6ED634D999E93FDCE55913B218FF1D99290AA68F9CA7F80F9B66A517802495E66EC4205
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........V..7..7..7..O@..7.._..7......7.._..7.._..7.._..7..O..7..G..7..e...7.!^..7..7..1.!^..7.!^..7.!^..7.!^,..7.!^..7.Rich.7.........PE..d.....g.........." .........~.......i....................................................`......................................... .......f..T....P...........C...........`..\|...0X......................PY..(...PX...................2...........................text...@........................... ..`.rdata..T...........................@..@.data....*....... ..................@....pdata...C.......D..................@..@.rsrc........P......."..............@..@.reloc..\|....`.......$..............@..B................................................................................................................................................................................................................

C:\Program Files\CloudCompare\Qt5Concurrent.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33264
Entropy (8bit):	6.210822520849061
Encrypted:	false
SSDEEP:	768:zSv+K3b4/Cfg+E2wkjk/+ZW8DT92r+dDGMUf2hKd:Wvm6XS/8FDTsr+PUf/d
MD5:	7E40B0FAA08E8F2AD78BE6698225E3E4
SHA1:	03332C56E4DCFEFC33BB731133BD3EF71C4CA9EC
SHA-256:	2212E66EADD559705E244409354ED264C286A3CAC7A3E511737C3D31E2A0F4AE
SHA-512:	A4C545A8B8DAAF6B4321BB51745454B77D1F591C7131F19FDD40BACD943D5074886037CEAE19E7F1515313B0F990E42A83520957CEDF056A39E1EC1E4AFD7272
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................o.....8..............8.......8.......8.......u...............u.......u.......u.........k.....u.......Rich............PE..d...G._.........." .........:.......0....................................................`..........................................N......hW..................h....f..........H... C..T............................C..0............@.. ............................text...}-.......................... ..`.rdata..."...@...$...2..............@..@.data........p.......V..............@....pdata..h............X..............@..@.rsrc................^..............@..@.reloc..H............d..............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\Qt5Core.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6023664
Entropy (8bit):	6.768988071491288
Encrypted:	false
SSDEEP:	98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
MD5:	817520432A42EFA345B2D97F5C24510E
SHA1:	FEA7B9C61569D7E76AF5EFFD726B7FF6147961E5
SHA-256:	8D2FF4CE9096DDCCC4F4CD62C2E41FC854CFD1B0D6E8D296645A7F5FD4AE565A
SHA-512:	8673B26EC5421FCE8E23ADF720DE5690673BB4CE6116CB44EBCC61BBBEF12C0AD286DFD675EDBED5D8D000EFD7609C81AAE4533180CF4EC9CD5316E7028F7441
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......D.............................UJ......................................................W.....,..................r....................Rich............PE..d...;._.........." ..........-.......-......................................`\.....x.\...`...........................................L..O....T...... \.......U.. ....[......0\..%..,.H.T.....................H.(.....H.0............./.H............................text............................... ..`.rdata..F7%.../..8%.................@..@.data...x....PT..\...6T.............@....pdata... ....U.."....T.............@..@.qtmimed.....0W.......V.............@..P.rsrc........ \.......[.............@..@.reloc...%...0\..&....[.............@..B........................................................................................................................................................................

C:\Program Files\CloudCompare\Qt5Gamepad.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	102384
Entropy (8bit):	6.0152637062152445
Encrypted:	false
SSDEEP:	768:xivYT8++UTS1jFHI4XV+2my6cg4ydlgW935aoQL4AikNQsLedDGuUf2hI:YL3b1FHR+U6p4KlT9ESAimFLeFUfV
MD5:	AB650B8F02BF49D2FA1C015B8F9B5EE8
SHA1:	02A02BD474948E110FA8B25E21E3898776CACCA8
SHA-256:	32149ACD851FC37BDC5D1C39E84CCDB9AE4ECAC103BEC628E9C29450381C8248
SHA-512:	2A5C7AC3EB09B6F3CCCE3E150A84094CBA2EC1B3CE518F78CEBCE93564E505E42E609B338E9F2D0AD5BAC1A44D328CAA9E20D9082E8C46C988ADC9F4E256CAAD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\e!...O...O...O..\|....O..kN...O..oN...O..kJ...O..kK...O..kL...O.tN...O...N..O.tJ...O.tO...O.t....O.......O.tM...O.Rich..O.................PE..d...<.._.........." ................0..............................................._@....`..............................................0...N.......................t..........x.......T.......................(.......0............................................text...{........................... ..`.rdata..............................@..@.data...8....p.......X..............@....pdata...............^..............@..@.rsrc................l..............@..@.reloc..x............r..............@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\Qt5Gui.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7008240
Entropy (8bit):	6.674290383197779
Encrypted:	false
SSDEEP:	49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
MD5:	47307A1E2E9987AB422F09771D590FF1
SHA1:	0DFC3A947E56C749A75F921F4A850A3DCBF04248
SHA-256:	5E7D2D41B8B92A880E83B8CC0CA173F5DA61218604186196787EE1600956BE1E
SHA-512:	21B1C133334C7CA7BBBE4F00A689C580FF80005749DA1AA453CCEB293F1AD99F459CA954F54E93B249D406AEA038AD3D44D667899B73014F884AFDBD9C461C14
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......QH^~.)0-.)0-.)0-.Q.-.)0-...-.)0-.F4,.)0-.F3,.)0-.F5,.)0-.F1,.)0-.Y1,.)0-.B5,.)0-.B1,.)0-.)1-m,0-.Y4,.)0-.Y5,\|(0-.Y0,.)0-.Y.-.)0-.).-.)0-.Y2,.)0-Rich.)0-................PE..d....._.........." ......?...+.....X.?.......................................k.....R.k...`.........................................pKK.....d.e.\|....`k.......g.......j......pk..6....F.T................... .F.(.....F.0.............?.p+...........................text...2.?.......?................. ..`.rdata...z&...?..\|&...?.............@..@.data....o... f.......f.............@....pdata........g.......f.............@..@.rsrc........`k.......j.............@..@.reloc...6...pk..8....j.............@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\Qt5Network.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1340400
Entropy (8bit):	6.41486755163134
Encrypted:	false
SSDEEP:	24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI
MD5:	3569693D5BAE82854DE1D88F86C33184
SHA1:	1A6084ACFD2AA4D32CEDFB7D9023F60EB14E1771
SHA-256:	4EF341AE9302E793878020F0740B09B0F31CB380408A697F75C69FDBD20FC7A1
SHA-512:	E5EFF4A79E1BDAE28A6CA0DA116245A9919023560750FC4A087CDCD0AB969C2F0EEEC63BBEC2CD5222D6824A01DD27D2A8E6684A48202EA733F9BB2FAB048B32
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........Yt..7'..7'..7'...'..7'..3&..7'}.3&..7'}.4&..7'}.2&..7'}.6&..7'..6&..7'0.6&..7'..6'c.7'0.2&2.7'0.7&..7'0..'..7'...'..7'0.5&..7'Rich..7'........................PE..d....._.........." .................................................................c....`......................................... ....n..,...h....................X..........,.......T...................p...(...@...0............................................text...C........................... ..`.rdata...g.......h..................@..@.data...XN...@...2... ..............@....pdata...............R..............@..@.rsrc................>..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................

C:\Program Files\CloudCompare\Qt5OpenGL.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	321008
Entropy (8bit):	6.4037799339163355
Encrypted:	false
SSDEEP:	6144:dtqkKC7BjQV5eR1b+yRWsJQnNfckNI+STEDC4nkml+T/6qhdDqvJbb9fv:HRFe5en+gWUCNTF9fv
MD5:	B1F29EA399C173C50C64FFCA5F13DC7F
SHA1:	4A039AFF59F34BAE66AA24A0C349059795BF13B2
SHA-256:	0E179470446A14C3706182D88FC95E5C066957C3752DEFDD6D3649AE877C87A2
SHA-512:	0B95E7209CDBB1E977860E8A41E73C5232E682EF111A34A57762FA6BC83D8C3126BCD38069E1D8FB72703F356608F98C103717377493D41E0F4EB5CAA024D79B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?..{...{...{...r.w.s......y...o...y......m......s..............\|...{...W.......n.......z.......z...{.s.z.......z...Rich{...................PE..d...2._.........." .....Z...v.......\..............................................X$....`..........................................6..........................0-..................H...T.......................(.......0............p..p............................text....X.......Z.................. ..`.rdata..4#...p...$...^..............@..@.data...8...........................@....pdata..0-..........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\Qt5Svg.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	330736
Entropy (8bit):	6.381828869454302
Encrypted:	false
SSDEEP:	6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR
MD5:	03761F923E52A7269A6E3A7452F6BE93
SHA1:	2CE53C424336BCC8047E10FA79CE9BCE14059C50
SHA-256:	7348CFC6444438B8845FB3F59381227325D40CA2187D463E82FC7B8E93E38DB5
SHA-512:	DE0FF8EBFFC62AF279E239722E6EEDD0B46BC213E21D0A687572BFB92AE1A1E4219322233224CA8B7211FFEF52D26CB9FE171D175D2390E3B3E6710BBDA010CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............_._._..*_._,.^._..^._,.^._,.^._,.^._a.^._._=.._a.^._a.^._a.F_._.._._a.^._Rich._................PE..d......_.........." .........................................................@.......^....`.................................................((....... ...........0...........0..H...xL..T....................N..(....L..0............................................text............................... ..`.rdata..p...........................@..@.data...8...........................@....pdata...0.......2..................@..@.rsrc........ ......................@..@.reloc..H....0......................@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\Qt5WebSockets.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	149488
Entropy (8bit):	6.116105454277536
Encrypted:	false
SSDEEP:	3072:4sSkET6pEXb3loojg1Q2sorWvZXF2sorrLA7cG27Qhvvc:4sSd6pwzloDbsnX0sCrc7ct7QVc
MD5:	A016545F963548E0F37885E07EF945C7
SHA1:	CBE499E53AB0BD2DA21018F4E2092E33560C846F
SHA-256:	6B56F77DA6F17880A42D2F9D2EC8B426248F7AB2196A0F55D37ADE39E3878BC6
SHA-512:	47A3C965593B97392F8995C7B80394E5368D735D4C77F610AFD61367FFE7658A0E83A0DBD19962C4FA864D94F245A9185A915010AFA23467F999C833982654C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'`.CF.KCF.KCF.KJ>.KGF.K.).JAF.KW-.JAF.K.).JVF.K.).JKF.K.).J@F.K.6.JFF.KCF.K.G.K.6.JPF.K.6.JBF.K.6.KBF.KCF.KBF.K.6.JBF.KRichCF.K........................PE..d......_.........." .....$..........t(.......................................p.......5....`............................................."..l........P.......0.......,.......`..L...hw..T....................x..(....w..0............@...............................text....".......$.................. ..`.rdata..z....@.......(..............@..@.data...x...........................@....pdata.......0......................@..@.rsrc........P......."..............@..@.reloc..L....`.......(..............@..B........................................................................................................................................................................................................................

C:\Program Files\CloudCompare\Qt5Widgets.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5498352
Entropy (8bit):	6.619117060971844
Encrypted:	false
SSDEEP:	49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
MD5:	4CD1F8FDCD617932DB131C3688845EA8
SHA1:	B090ED884B07D2D98747141AEFD25590B8B254F9
SHA-256:	3788C669D4B645E5A576DE9FC77FCA776BF516D43C89143DC2CA28291BA14358
SHA-512:	7D47D2661BF8FAC937F0D168036652B7CFE0D749B571D9773A5446C512C58EE6BB081FEC817181A90F4543EBC2367C7F8881FF7F80908AA48A7F6BB261F1D199
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x..................I.......I.......I.......I...........................................9.................................Rich............PE..d....._.........." ......3..P .......3.......................................T......MT...`.........................................0.D.P^....L.h....pS......0P..8....S.......S.d.....?.T...................`.?.(...0.?.0.............3.._...........................text.....3.......3................. ..`.rdata..8.....3.......3.............@..@.data.........O......dO.............@....pdata...8...0P..:....O.............@..@.rsrc........pS......4S.............@..@.reloc..d.....S......:S.............@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\TKBRep.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	848624
Entropy (8bit):	6.226073557201281
Encrypted:	false
SSDEEP:	12288:glSRkt/ADhUy1qHvH5Bv+lO5h6n288n7BDtxThD+10:g4Ryy1qHBBv+l668n7jxm0
MD5:	09384FAE658A7566655E76C32DDEF653
SHA1:	FD16FD1A7504EFA9B1A17FDDE897141985271F32
SHA-256:	4448C09C7A0CF3A18DBCA33C7F889CD36D5192D668EA2ACBB4A4E65261F731AD
SHA-512:	52DE1C06DA4E2D3DD5F570A06E87F3AB703FC4578CE7D14A68108EE6BE7DD1563D1785BC8DAF107BCC18D7073C10CE45C2B06968FE3249322C431C06C8CE6295
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........c...........................................,.......4...,......,.....,.........,.....Rich............PE..d....d._.........." .....>...........\|....................................................`.....................................................@................M.................../.......................0..(..../...............P...............................text...L<.......>.................. ..`.rdata..N....P.......B..............@..@.data...x2...`...(...L..............@....pdata...M.......N...t..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\TKG2d.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	305392
Entropy (8bit):	6.242398831287072
Encrypted:	false
SSDEEP:	6144:zXvA6GWLMKIhiovzNWUbtQ0Q8L/hFHC7p:zXo6GWgsov9ZrQ8bhq
MD5:	3CFDE799979AB3BDDD93FFD46A375CD0
SHA1:	AAE44FC249918CE86ACA050D3FE7311C2FFC0C80
SHA-256:	83CF481C9AFA319C573BF642BC2271CD65C5435076A3BF99ECE9FB53C52A35D2
SHA-512:	5C355324802D80A97E3EAC823430C1E7E1D177AF562AC11B94E978450C789BBFBBB32A9DC01CB530764F0E5C114FBDE8D9F4370DE2FA19DBA689B0BBEF7E80F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........w...$...$...$..a$...$...%...$...%...$...%...$...%...$...%...$S..%...$...$'..$S..%...$S..%...$S..$...$..e$...$S..%...$Rich...$........PE..d....c._.........." .....N...B.......%..............................................j.....`.........................................0m..(...X....................$..............D...P.......................p...(...p................`...............................text....L.......N.................. ..`.rdata.......`.......R..............@..@.data........`.......H..............@....pdata...$.......&...X..............@..@.rsrc................~..............@..@.reloc..D...........................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\TKG3d.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	905456
Entropy (8bit):	6.410762946527034
Encrypted:	false
SSDEEP:	12288:aynKy8oJXHlyEolsglxb/Gj53/vpZcZjlIcPX3NDdpMEZhJeuv:ayXFyEoLk5+tn
MD5:	FED654B78DC2EF46288A50A506AD024F
SHA1:	DA1159917FF8E03451A9CEE0A7C26C09D838BDF8
SHA-256:	C64245CB6606570963F243F538F83A42EB04D280A6AECFAF6F71BC83D36E7159
SHA-512:	B9DBD4CA4EB9941FD5C9DC132C447D5A118DBDA586514AF2289807E4D817E120F4EAEB3CF9D3BDB019A5FAF6AC15B5CE8A5541E6233A7536568C88AB46BBD601
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=...y...y...y...p.......+.a...+.q...+.z...+.}...".{.....~...y...$.....".....x.....B.x...y..x.....x...Richy...........PE..d....c._.........." .....h...R......t...............................................5.....`..........................................$.......................p...Z..................._.......................`..(...._...............................................text...Ff.......h.................. ..`.rdata...............l..............@..@.data....#...@.....................@....pdata...Z...p...\...D..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\TKGeomAlgo.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3815664
Entropy (8bit):	6.407256607167561
Encrypted:	false
SSDEEP:	49152:+/uSVZLrvrTX30234JyyeZBzswYE9/EtYqJ9er/2CFCpJq:+/FpZBzOmr2CMpc
MD5:	9B65E7DC2CF1D85C62CF858E45B74E79
SHA1:	9ECFABE63716F9F270F2DC15BA2DB189BDAE7ED9
SHA-256:	9628E99890E59FDC11A6AA6351CEE7EFCC0AB96DB1A5A75B0EB986A5A64D14ED
SHA-512:	EC0F1B3D537AF6C7FD3C75E89A187BAAA15700E9A35D871636AED4B202C5AE7F800174EB2F3262ED90CEA8450ED15EADB69D89709F339C02610DEC60689361B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P.m.....................F.......F.......F.......F.......O.........................y................................Rich............PE..d.../d._.........." ................u'......................................`:......0;...`.........................................pV3..#..\|y7......0:......09.(.....:......@:.X...@0,.....................`1,.(...`0,..............0..&...........................text...6......................... ..`.rdata..J....0...... .............@..@.data...0`....8..T....8.............@....pdata..(....09.......8.............@..@.rsrc........0:.......9.............@..@.reloc..X....@:.......:.............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\TKGeomBase.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3783408
Entropy (8bit):	7.082603044017435
Encrypted:	false
SSDEEP:	49152:DvGbhb3gARA+DORgiDVVqWRcBP3Par9P8jtP8T4sLrM5up7PA:64NhRcBP3Par9+U0uhA
MD5:	2884F95C5C51B793A16C822F6865D468
SHA1:	40A6614137E528E76C78900E234AB31F5A76AF3E
SHA-256:	A58CF1A96B6073777C8C25C162692F4706B95428AD98A9BAD9D08E697E204125
SHA-512:	FCB46F404C405C5EEC13F223DB59B5144B4F4E6DE6777C671A5164283D278A13571472E35055A93BBC902933042AF894D6BBF2A1932BACBBB12D510403D2CEA5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......uA.1 ..1 ..1 ..8X..9 ..cH..9 ..cH..2 ..cH..- ..cH..5 ..jH..3 ..I..8 ..1 ...#..I..+!..I..0 ..I~.0 ..1 ..0 ..I..0 ..Rich1 ..................PE..d....d._.........." .........R.......B....................................... :......V:...`..........................................b0..&....3.......:......09.\.....9.......:.D...0.+.....................P.+.(...P.+.................`............................text.............................. ..`.rdata..2...........................@..@.data...X.....4..P...t4.............@....pdata..\....09.......8.............@..@.rsrc.........:.......9.............@..@.reloc..D.....:.......9.............@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\TKMath.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1674992
Entropy (8bit):	6.693921548534279
Encrypted:	false
SSDEEP:	49152:v0BOonBew9Ic4GrEoh9ald5RYaHOakyGCgKqHUWleD/SSrWZp:MnnrmvzgAXgp
MD5:	8AE454F4BF46749D2E326E66934BFC39
SHA1:	8998065CC8331982EB1DC7FA369BA366E114B302
SHA-256:	3CA6E5F349545FE2F7A11617CB082F4B60EF373A2702FA24CF4C2F88D8C5EA8A
SHA-512:	CBC35391B1C3FF074111B565BCF2CCE0D6C2C010FE2B4CE245531E33702F4B0F9538CB4B23AFBF632B1A18A0C176305491258DD678D08605957D0186DE38C98B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................!%E.............................................L.....o.................}...................Rich............PE..d....c._.........." .....4...L......ps...............................................?....`..........................................3...K..T........................r..........l... ;......................@<..(...@;...............P...............................text....3.......4.................. ..`.rdata...^...P...`...8..............@..@.data....A.......0..................@....pdata..............................@..@.rsrc................\..............@..@.reloc..l............b..............@..B........................................................................................................................................................................................................................

C:\Program Files\CloudCompare\TKMesh.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	638192
Entropy (8bit):	6.121612263603408
Encrypted:	false
SSDEEP:	12288:aeAClh/JUd4/0OHSsecsFJPNK3jNeJVhoo:ZACl10OHSs4PNKxsgo
MD5:	30035261439F666D41E3A8E851379EC7
SHA1:	16BB1176D6775EB1771477AE7CCF79759CBBE2E7
SHA-256:	CEC70C7601106FFA9F22BC316F6B56B356D3986EBB1846E85E5D8D70AAAC07F2
SHA-512:	117CF2E52F9F5798E19A6D9CD90E525EAE5998BEBBB49C8F8B961E45AD0121CC24F1615214E3D9E35D7A581EDE7E29365ABBAE402FC2CD7715FF6828599AEAD2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0}=.Q.n.Q.n.Q.n.).n.Q.n.9.o.Q.n.9.o.Q.n.9.o.Q.n.9.o.Q.n.9.o.Q.n]8.o.Q.n.Q.n.P.n]8.o.Q.n]8.o.Q.n]8.n.Q.n.Q.n.Q.n]8.o.Q.nRich.Q.n................PE..d...Yd._.........." .....d...D......................................................8+....`..........................................<...y..d....................E...................F.......................H..(....G...............................................text....c.......d.................. ..`.rdata...............h..............@..@.data....`.......V..................@....pdata...E.......F...F..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\TKSTEP.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2697456
Entropy (8bit):	6.294325960113847
Encrypted:	false
SSDEEP:	49152:tYFO3e6YpwBhqben1GtA+6pf2v7+zxUZUM/SRCJg7E661CebH2DOz7JsFWRZ2:AUMyDO3Ji5
MD5:	17571E2B575C43E910C8308A447EFAA5
SHA1:	EE605C41D4F11F2E6C489F613D7907CD442F0813
SHA-256:	8A7DF7EA0CD8EAEB38D354E3F0B1118A530580F23ED933DDCF28547701F72C55
SHA-512:	A3F4F9B5FC3B25C8082B85B06858DEED2AC24111214317F263A4D51F2DB15522C7EAF12A4CBB5882406134135D8F1F771D8ACD4FF86F6B87CC1CE88772EC5154
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H..&...&...&.....&...#...&..."...&...%...&...'...&...'...&...'...&...'.R.&...#.s.&...&...&......&.......&...$...&.Rich..&.........................PE..d....d._.........." .........,......\,........................................).....}.)...`................................................h........P).......(.D.....)......`).X...............................(....................0...............................text............................... ..`.rdata..$:...0...<..................@..@.data...x....p'......R'.............@....pdata..D.....(.......(.............@..@.rsrc........P).......(.............@..@.reloc..X....`).......(.............@..B........................................................................................................................................................................................................................

C:\Program Files\CloudCompare\TKSTEP209.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	471792
Entropy (8bit):	6.133406334839098
Encrypted:	false
SSDEEP:	6144:/C9mSwGqUtU6NFPIOWIhz8qtQej4gFlShFXA58+eIVPV/RrQp8XWLSZbRc:/2wGqKUyZ1zeYMKB+
MD5:	81C31E22F2EA4AD7D6512A00E276EAC4
SHA1:	7D95F2E547D177BA258E75E29D9D2B0C4C9A9287
SHA-256:	088446600B5947744066887DAF19E2562DCCA797A7E83F34BC474645C57DEF7E
SHA-512:	FDA5D99B69551755663540022F0E0468BEB289683F35D300D809DC35A2C9A63447AE24FE335DFEFB9DD6561B1917377C9525D94181F2F0E81462F045844497F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................$.......................................................".............H....... .............Rich............PE..d....d._.........." .........................................................`............`.........................................`.......X........@...........,...........P..................................(....................0...............................text............................... ..`.rdata.......0......................@..@.data....5.......*..................@....pdata...,..........................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\TKSTEPAttr.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	731376
Entropy (8bit):	6.179937626354653
Encrypted:	false
SSDEEP:	12288:r+VjdxvoKGf8vRRjggGQiaaNaRn+LEk33zTL5XcqNO3rX6/3TW+17T+SrdqJzUXZ:r+Vh9UkvRRjggb/aI+LEuBJpdq1YZ
MD5:	6AC7AA6A96EBB68D537099127715E551
SHA1:	343CF0E56413973A89FE82652A69FA9FE756E4B7
SHA-256:	DCD64A0F526F2B42D3052B239900D46FFE5D081F9C456A770A770A153AD4187D
SHA-512:	7E194AEFF72EE3632CBE8AB8D0A988A025B7780A3B3EC8729817E3C468B63BF9C0DE9B82C4BE66D8BD96FC4D091B8C06AD912A19CDE0D76DA2649BA226F84083
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .2}dp\.dp\.dp\.m...bp\.6.Y/\|p\.6.X/lp\.6._/fp\.6.]/`p\.?.]/fp\...]/cp\.dp]..p\...Y/Cq\...\/ep\.....ep\.dp..ep\...^/ep\.Richdp\.........................PE..d....d._.........." .........,.......f.......................................P......*.....`.........................................P........G.......0...........E...........@.............................. ...(... ...................P............................text............................... ..`.rdata..X~..........................@..@.data....S.......B...r..............@....pdata...E.......F..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Program Files\CloudCompare\TKSTEPBase.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1703152
Entropy (8bit):	6.263930597929995
Encrypted:	false
SSDEEP:	49152:zjIvfo41bZFaxoVEbck8vlXlq00MBdCHa4wceTlBKB4WBlz1/w2SvpNiX1nOrw2x:skzc
MD5:	4FB0AC0BE1DE51903B251B3BA7842A9E
SHA1:	6A27E35545C900D0480241FBC5D4EDB87AB50574
SHA-256:	83DB54F529B47A8E8E1A4B898AD64FD9F4B6A5D96829DA183EA650154AD132F3
SHA-512:	C883F31B18D172768C7B47EB0F62F45C166ACDB28B83B0D4D8137A61F12DA6F50D9B26B63410435B09F2D5EE98C958E4A1116098DE3AA47EAC41B66D5FEF6F93
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.P.p.>.p.>.p.>.y..v.>.".;.i.>.".:.x.>.".=.r.>.".?.t.>.+.?.r.>...?.u.>.p.?..>...;.r.>...>.q.>.....q.>.p...q.>...<.q.>.Richp.>.........PE..d....d._.........." .....&..........T........................................`.......o....`.........................................`......8........0.......................@.......F.......................G..(....F...............@...............................text....%.......&.................. ..`.rdata..l....@.......*..............@..@.data...........p..................@....pdata..............................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\TKShHealing.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2577648
Entropy (8bit):	6.18813475149753
Encrypted:	false
SSDEEP:	49152:3CGX7lSpFVYjlpLkiEtxcnPOjk91JQagBeqcMr8Trq9b:VsNrd9b
MD5:	108A3C3D5C16D20DB13B6800670BFC54
SHA1:	A23BA534B81502712956147185B1F15C2E2E80E3
SHA-256:	5A558E3AE5762EBFF3AB15A5B60FE4F45AA05EEC4A292EDBB1A2FE5E9A4AE605
SHA-512:	B04C83CF22416F92214CE8213E7AF841BE5952091245A6844E92028D8C9C88C319C3596A335CD2E345DDEEE9A42EAAB702B5F5336E6A2CA8F74BF98782B61938
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^.<X?.oX?.oX?.oQG=oP?.o.W.nA?.o.W.nP?.o.W.n[?.o.W.n\?.o.W.nZ?.o.V.nI?.oX?.oF;.o.V.n7?.o.V.nY?.o.VQoY?.oX?9oY?.o.V.nY?.oRichX?.o........................PE..d...Ud._.........." .....L..........@........................................p'.....\.'...`...........................................#....`?%.@....P'.......&.....8'......`'.`........................... ...(... ................`.. !...........................text....J.......L.................. ..`.rdata..@....`.......P..............@..@.data...(F...`&..:...N&.............@....pdata.......&.......&.............@..@.rsrc........P'......$'.............@..@.reloc..`....`'......*'.............@..B........................................................................................................................................................................................................................

C:\Program Files\CloudCompare\TKTopAlgo.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2326768
Entropy (8bit):	6.265149852539151
Encrypted:	false
SSDEEP:	24576:yPf0xVJnPKKuk6Fcg0UR/GHLv/8Cncx60IBSdDq75z8KIVZDba7JpNVs2SRPX:yPoJCKuJFsUR/m09IB8cuKIL/QJpNYR/
MD5:	FDDCFABB82A4BDF771B9C8504DEF8211
SHA1:	FA28EAF5D24A510A53CA3739BB533A5EBA200FF3
SHA-256:	B0F29826C1EC3AC4C8FB781D153084018ACE637FB7085FFA525483BCBF144FDE
SHA-512:	D3DFBF7524F2F0A4597FCE9E1D59AA393485FE1D0DF400DA176BE4D76C628D1D47C2AE9038B908BF6C487B4F66083E586C3AA1023D6D16F4CCDC270C272415A8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d>.. _.. _.. _..)'a.(_..r7..(_..r7..#_..r7..;_..r7..$_..{7.."_...6../_.. _..[...6.._...6..!_...6..!_.. _e.!_...6..!_..Rich _..........PE..d...1d._.........." .....z..........Xw........................................#......j$...`..............................................>...=!.,.....#......."......d#.......#.................................(.......................P$...........................text...vy.......z.................. ..`.rdata...............~..............@..@.data....Y...p"..P...Z".............@....pdata........".......".............@..@.rsrc.........#......N#.............@..@.reloc........#......T#.............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\TKXSBase.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2117872
Entropy (8bit):	6.289461121862461
Encrypted:	false
SSDEEP:	49152:MQ1PhsCh07gUJLD1y9Ez64XBOMSeMxHwdeLz/4pBbfqR+z6Yb7vQ1f5Ppm7HcIhp:w9Nr
MD5:	FEDAE2A00AEAA26418123C7607F8913D
SHA1:	112E8FEBD96880D7DF3EBD034AFEBF52A905B25F
SHA-256:	A96F624E8AD557F28A35C2B08CC238F4760FF73117932C473EB6AC94359B4D00
SHA-512:	10BD032039CBF8427B8FA97860D226360C10F1419AA48720474F49DD2BDB7CD5972A2C776CFA369D429FE957BE617A01E7999ABBE9C6E585BDFB7B9F005BBBCE
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................V...............................5........ ..5......5.....5.:......R....5.....Rich...........PE..d...Xd._.........." .....,..."................................................ .....p.!...`.........................................`5...h..X...\|....` .........(....4 ......p .....`...........................(....................@...............................text...@*.......,.................. ..`.rdata.......@.......0..............@..@.data....l.......P..................@....pdata..(............F..............@..@.rsrc........` ....... .............@..@.reloc.......p ....... .............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\TKernel.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1728752
Entropy (8bit):	5.177332416676532
Encrypted:	false
SSDEEP:	12288:XjIJQx+Njd+rxP+vzLCqq98daeRsu+y9RNiZSMsV2JNs04Wchnn9c7gQ7vDorJap:Tf+Ncx2zLCqiOaEL9biZ6MJNQ8orSUk
MD5:	3539141FFDA9CAE0C77131AEBA50A114
SHA1:	EA31877537A80E499C33811C10C66314D0C51B04
SHA-256:	047DFADDB4285896FC4AE8905114F9FE5808868B94CA34828FBDFC42135C747B
SHA-512:	9703E1BB77065773953C1F946786D661158D8DDF4DD07AC2E5C9673C87DB0198AFB6FA737BF0BDFDF7F5BA5A6FC1F6AA8E3B4DF4A2D635DEB79F9C9D0BE1F6DC
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=..y...y...y...p.6.m....'b.x...+..q...+..z...+..d...+..}......}..."..p...y..........x.............x.....Z.x...y.2.x......x...Richy...........PE..d....c._.........." .....z...<......`................................................,....`.........................................p.......T...\|............@......D...................................... ...(... ................................................text....x.......z.................. ..`.rdata...............~..............@..@.data....#..........................@....pdata......@......................@..@.rsrc...............................@..@.reloc...............4..............@..B........................................................................................................................................................................................................................

C:\Program Files\CloudCompare\avcodec-60.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	82336768
Entropy (8bit):	6.709624515309904
Encrypted:	false
SSDEEP:	1572864:KiySAJLva8soisRmwdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfagAoCFh4:KiySAcsc
MD5:	DC7F54B9AC3196E0D0775FA80F0FB6D9
SHA1:	475C7CB7CF74FA6014F12A26D169718FC5C377D5
SHA-256:	608C17870EA5F801959859639207F2A4DE581F16FD78C7BBD67E7B42377EFFFD
SHA-512:	5232D8993177281D7650C22D8E15EEA0DF58D6A70A7279EDEC28E53A94BA764DEB210A32FE963320EDC571CE9D24CB90A3AC4882E5009DAEE191A3AB957CB00E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....#f..........."...*.....X......0...............................................r.....`... .......................................\|.=$....\|..\...P}..........?...........`}..a..............................(...................@.\|..............................text...P...........................`..`.rodata.0`.......b..................`..`.data...@....0......................@....rdata........$.......$.............@..@.pdata...?.......@...r..............@..@.xdata..T...........................@..@.bss.....................................edata..=$....\|..&...n..............@..@.idata...\....\|..^..................@....CRT....p....0}.....................@....tls.........@}.....................@....rsrc........P}.....................@..@.reloc...a...`}..b..................@..B........................................................................................

C:\Program Files\CloudCompare\avformat-60.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	18416128
Entropy (8bit):	6.683302926545402
Encrypted:	false
SSDEEP:	196608:zMYiFS3ke63qeMs+eBH0Xbr8EYriPyv81djl1xV57VB:zMa3kLBH0rr8EYriqv4dRN5f
MD5:	36A0558B4768FC872970E6DF3D80E344
SHA1:	567EB56023D3CE1676B30F1087C3BB6182CFDAB0
SHA-256:	8154BAA7A6C1DFEAD2CB0EB27FEAF9568BD2AAABA0F53A6AAEE75705BF807E3A
SHA-512:	32B0EFD65869A622AAF12451D234A49DE4B159B07297813A72B9019BB56EF0D990C9308630262C5FB4C73455A04B0CC46CB81B828BA627B93B120DBF3283FB3C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....#f..........."...*............0.........................................&.....\.....`... .......................................#.(.....#..z....$.........@.............$.\|h..........................@<..(.....................#..............................text..............................`..`.data...............................@....rdata....9..P....9..6..............@..@.pdata..@...........................@..@.xdata..H~...........z..............@..@.bss......... ...........................edata..(.....#.....................@..@.idata...z....#..\|..................@....CRT....`....`$.....................@....tls.........p$.....................@....rsrc.........$.....................@..@.reloc..\|h....$..j..................@..B................................................................................................................................

C:\Program Files\CloudCompare\avutil-58.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2652672
Entropy (8bit):	6.5100737069425705
Encrypted:	false
SSDEEP:	49152:/drr5uORwWnFgekvnXCkqbPnVc/t93AnL2:dr50D+6th22
MD5:	3E6E3F672ED39CBEA7F7FC594BA65167
SHA1:	B2EC77464A04ABAA60CC3AEF232A01D302117FDB
SHA-256:	73124B69D6F3C54AFDAAB9CDE89656F415923119ACCDCF918ECDD47F78FB0210
SHA-512:	54CB29B1D2978886934B9181FA011EBF73427EA306D67DD4D920ECF57002DE636194FBCE53B9D94D0FD796D2CDD35E942619672442AB2A6A4D7F4E54CC35E724
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....#f..........."....N...v(.....0.........................................).......)...`... .......................................)..D...`)..)....).......%..............).l.............................#.(...................Pj)..............................text...0M.......N..................`..`.data.......`...,...R..............@....rdata...j.......l...~..............@..@.pdata.......%..,....$.............@..@.xdata.. ....0&.......&.............@..@.bss....0.....'..........................edata...D....)..F....'.............@..@.idata...)...`)..*....(.............@....CRT....`.....)......B(.............@....tls..........)......D(.............@....rsrc.........)......F(.............@..@.reloc..l.....)..0...J(.............@..B................................................................................................................................

C:\Program Files\CloudCompare\concrt140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	332568
Entropy (8bit):	6.217408928777197
Encrypted:	false
SSDEEP:	6144:tlBybiGsY4lxA6c40PMjoTrDPbv+Xipv6wfnWzgcpw2eRJ:tWbzsBcPPlbxpvIzQT
MD5:	1028995446D0032530461BE30CA98F48
SHA1:	18446678152E9997EED9C02995F957D58A8E8F32
SHA-256:	D404B49C25CC76DC4C86E1D82FC23799482F6509E85A73ED8177EFC320EC0195
SHA-512:	ADB9AE577F082E0246CAE5C804FA4CD08BCF54CE78EACA02D49B9B1B262779667A251E98CAE807AFF50FDAC504B8CD855CE4D786F587D02E0A18F6AC8E0D882E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\...2Q..2Q..2Qo..Q..2Q..Q..2Q..3P..2Q..3QR.2Q..6P..2Q..1P..2Q..7P..2Q..2P..2Q...Q..2Q..0P..2QRich..2Q........................PE..d.....0].........." ................................................................b.....`A........................................P....M..\Z...................6.......A......\|...@l..8............................l..................`............................text............................... ..`.rdata...k.......l..................@..@.data....9...p...2...V..............@....pdata...6.......8..................@..@.rsrc...............................@..@.reloc..\|...........................@..B................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\expat.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	137216
Entropy (8bit):	6.225171524893703
Encrypted:	false
SSDEEP:	3072:oeFPoVRx1tgigeosf1bt3eCwpQ6qPNq9K00mp7k43MnVA8ESgS45P04X:Ve1tgigeosf1bt3eCwC6KqkdA8ESgS45
MD5:	BE0ADCA466744EBA777289419966C0C7
SHA1:	7D2FFA0BED0B7DA841E58AA61C42E435D78E7E9B
SHA-256:	216992614BDCE256C01DC9B7FF6085C597E50B8024E67AAE5FE35B47BE318240
SHA-512:	F41DEF9F228CB7E6DF019E7B089F6C3E9453716237AF11B5B30162892468C38D34234DFCD72AE6E25C66CFA25C48165ECBA9E48D54DD38CC72F60CD97F8672EA
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b..^.~.^.~.^.~..R..].~..R.._.~..R..U.~..R..\.~.....\.~.^...z.~.SQ..[.~.SQ.._.~.SQ.._.~.SQ.._.~.Rich^.~.................PE..d...@4.T.........." .........~...............................................`............`.................................................$...<....@....... ..l............P..........................................p...............(............................text...;........................... ..`.rdata...P.......R..................@..@.data...............................@....pdata..l.... ... ..................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\freexl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	4.918600259690758
Encrypted:	false
SSDEEP:	768:k2PM9rCwnTNtag/Zbf7dOtx+3pg+2iQ6gPSN9uDsH9g+tRc:kP1n7gDnSL9g+7c
MD5:	1B5BAF09EBE88108D5DA26C0E0514875
SHA1:	5D1EE37B752D603991999BD7C0434B5FCD428E38
SHA-256:	24D9A38A0E090E2D50BFAAB9B5BDA9A753BCCB3770C7751CB81BB15BCEDF47FF
SHA-512:	F50539A482BBA73CA8C5B38E9C55F16FCE0111091187B90D8AAC5F5A0A6250C2F6F293A97DE499646B5EB8A2D921C034B0EE163E97E60C0DFD339BC3B9436562
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E...+...+...+.\| ..+......+......+.....+.....+.......+...*...+......+.......+.......+.Rich..+.........PE..d...._.V.........." .........>...............................................0............`.........................................p...........P............................ .. ...`...8...............................p............................................text...y........................... ..`.rdata..j...........................@..@.data...............................@....pdata..............................@..@.idata..............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\gamepads\is-T476D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32752
Entropy (8bit):	5.873520436484058
Encrypted:	false
SSDEEP:	384:VTMA5mqtXQltClg86LgCo0dJiHv08Ekjjj+fv0dDPFcqtVxtndDGulpDgf2hU:VjklNgO8HcY3+fctuqtVTdDGUpUf2hU
MD5:	97AE1E19B9755ED28E3F3F39AAFD5E55
SHA1:	4D7412C943B6AB07DA2582228A770A2FCF2E22E9
SHA-256:	AEBEA1CDED11CABB53F6545A55E82C90A969AD3AC6E88E9841399C297861E5D5
SHA-512:	9517727BE77422956FFD65AB43F3206132A6D079E8A03C30AA0836AE412B52AE5976D905443F91F1CE79E2526AA1630B651BBD59CF47FFF59D20A9F08CDB4B66
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=J.=y+zny+zny+znpS.n.+zn.D{o{+znm@{o{+zn.D.oj+zn.D~oq+zn.Dyoz+zn.[{o\|+zny+{n.+zn.[.oz+zn.[zox+zn.[.nx+zn.[xox+znRichy+zn................PE..d...A.._.........." .....$...B.......(............................................../.....`.........................................0W..\|....W..........P.......$....d...............I..T................... K..(....I..0............@...............................text...K".......$.................. ..`.rdata...+...@...,...(..............@..@.data...X....p.......T..............@....pdata..$............X..............@..@.qtmetad.............\..............@..P.rsrc...P............^..............@..@.reloc...............b..............@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\gamepads\xinputgamepad.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32752
Entropy (8bit):	5.873520436484058
Encrypted:	false
SSDEEP:	384:VTMA5mqtXQltClg86LgCo0dJiHv08Ekjjj+fv0dDPFcqtVxtndDGulpDgf2hU:VjklNgO8HcY3+fctuqtVTdDGUpUf2hU
MD5:	97AE1E19B9755ED28E3F3F39AAFD5E55
SHA1:	4D7412C943B6AB07DA2582228A770A2FCF2E22E9
SHA-256:	AEBEA1CDED11CABB53F6545A55E82C90A969AD3AC6E88E9841399C297861E5D5
SHA-512:	9517727BE77422956FFD65AB43F3206132A6D079E8A03C30AA0836AE412B52AE5976D905443F91F1CE79E2526AA1630B651BBD59CF47FFF59D20A9F08CDB4B66
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=J.=y+zny+zny+znpS.n.+zn.D{o{+znm@{o{+zn.D.oj+zn.D~oq+zn.Dyoz+zn.[{o\|+zny+{n.+zn.[.oz+zn.[zox+zn.[.nx+zn.[xox+znRichy+zn................PE..d...A.._.........." .....$...B.......(............................................../.....`.........................................0W..\|....W..........P.......$....d...............I..T................... K..(....I..0............@...............................text...K".......$.................. ..`.rdata...+...@...,...(..............@..@.data...X....p.......T..............@....pdata..$............X..............@..@.qtmetad.............\..............@..P.rsrc...P............^..............@..@.reloc...............b..............@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\gdal202.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18278912
Entropy (8bit):	6.415110000021905
Encrypted:	false
SSDEEP:	393216:EsQdvh76/JkvrxVY2Xkarvb1mTLlMGRhUU6DmA0viO/ilJ85EWlB/jBtLs:chU69GFrn/jBtL
MD5:	9B5689B0D551161AEE9D45FE6A438FCB
SHA1:	2C435765C66BA18086850EF532BBD08EAB755944
SHA-256:	79816E0BA8786690E2C1EE8758D6D64D2B583131934BE2F9E870736C54DA905E
SHA-512:	2193ABB629F1F04D4BFEEC4C74416C3E6D45572F9B02A29360FA08A19E17E0149B5A61BCADB92E0E409579C3B2DB08532E7CD2F5C82871D185B71B1616A94694
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........HJ.K)$.K)$.K)$....Y)$..x..L)$..x..F)$..x..O)$..x..A)$.$_..O)$....I)$....J)$....G)$.F{..X)$.K)%.+$.F{..7($.F{...-$.F{..J)$.F{..J)$.F{..J)$.RichK)$.........PE..d......Y.........." ..........l.....@.....................................................`.........................................Pm..u....M..h....... ....P...%..............0...................................pA..p............................................text............................. ..`.rdata....Y.......Y.................@..@.data...0...........................@....pdata...%...P...&..................@..@_RDATA.. ...........................@..@.rsrc... ...........................@..@.reloc..0...........................@..B........................................................................................................................................................................

C:\Program Files\CloudCompare\geos.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1304064
Entropy (8bit):	6.3870556331947235
Encrypted:	false
SSDEEP:	24576:hgar8jZShGQRO0mENxPM6LQtscfMlYiupJjpm:Lr8jZdELPM3jfMlYiuzpm
MD5:	CC559D3B8F1F0691DF94A76C5E869D16
SHA1:	4CA778423A255EA2F2269E18DDD7AE449E4FB32F
SHA-256:	E3DE026BF30FD187C3A893B8489CCD49C265F0747D38BCE0C94782A622D2B9B2
SHA-512:	C40516DBAD6E3EC3110A5A078F70F8C525C08CE45F159C1F83D2AC259BD74050A516D7808ECDDD2175343DB6D6945C4286B7FD32EE1F2B96C84A7BE41A2D9A04
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........UbP.4...4...4..e....4...e...4...e...4...e...4...e...4..&....4...4...4...f...5...f...4...f...4...f...4..Rich.4..........PE..d.....T.........." .....\|...p...............................................@............`..........................................3..........P............@............... .........................................p............................................text....z.......\|.................. ..`.rdata..<R.......T..................@..@.data....C.......:..................@....pdata.......@......................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\geos_c.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	278016
Entropy (8bit):	6.002198044760076
Encrypted:	false
SSDEEP:	3072:0YFEIZkLcSqMJUGotgtsKhXQsYxC50Xj1AWOAPEd:zuLcScGmNlC50Xj1AWOAPE
MD5:	5F0D90D65156DB90A2B5D0EC4C3FCFF8
SHA1:	D4341CA5CF262DE98EC772C770FA92F4B8E8A9F4
SHA-256:	EF215DA0B20F6F46B8FD2D7A557319EB30A1A2B1031D3E4C0B37B1AA4FAC58B4
SHA-512:	7C56D8A8FE5890C68F68E685B48E3D956159768FAAF7A27B701A5D62B5F55995E80519F200D8C11B8886165A67961545015438B1B48BA9B9139B4DF6CA6A8FDF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#.{.#.{.#.{.E..".{.e...".{.e.....{.e...'.{.e...'.{..... .{.....!.{.#.z..{.....!.{.....".{.....".{.....".{.Rich#.{.........................PE..d.....T.........." .................T....................................................`.........................................`..........d....`.......0..T-...........p..........................................p............................................text.............................. ..`.rdata...R.......T..................@..@.data...P...........................@....pdata..T-...0......................@..@.rsrc........`.......4..............@..@.reloc.......p.......6..............@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\global_shift_list_template.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	560
Entropy (8bit):	4.819890866613878
Encrypted:	false
SSDEEP:	12:jXlCrSbfJh+thGLD9nOAVDFexQjl5F+fJIzGIml2f:BCrSzJhWQ39OAVDFxjAJIyIM2f
MD5:	69C927B8C88EA2556CA7F0F201ED412C
SHA1:	C7E9CEB0568A5040EFC5D44CCE069453A414BE1E
SHA-256:	F32EC578A85CF99B4D1ECFA478499889F4155CA7B3B2920094F95DFA30516F26
SHA-512:	A3EB4CAEF5B5B1056AAB3ED87022A86CA662668BB8B73DEA2799908B47C2E53C68859567B33AB1B66A822CC2879BE3A834973EB2B01DB25125EE322473C4BC60
Malicious:	false
Reputation:	low
Preview:	// Before modifying this file, rename it 'global_shift_list.txt'..//..// You can place here sets of shift vectors and scale factors (associated to a name)...// Each set (name) will be displayed in the combo-box above the shift fields of the..// "Global Shift and Scale" dialog (this dialog typically appears at import time while..// loading a file with big coordinates)...//..// All values are separated by a semicolon character (;):..// name; shift(X); shift(Y); shift(Z); scale;..//..// Example:..//..// Ankh-Morpork ; -621900.0 ; -5114400.0 ; 0.0 ; 1.0 ;

C:\Program Files\CloudCompare\hdf5.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2240000
Entropy (8bit):	6.548212734365113
Encrypted:	false
SSDEEP:	49152:KJDs2vUNknXd2rb67z46BfyZtvqSI+Gr8Gs7Ts:7mnX9fyHrGps
MD5:	027AD255105FC361E9841ED8C696F7BD
SHA1:	06FD6FD68C0BCBB78AC9E7DC44172BB2F3865855
SHA-256:	F192C3BEA5F560166403114962F30E82F4EF14BF9DF1F0DFB7A06D45BC790080
SHA-512:	F27FA2F68FE3C4F7818D8B20BFCE230558CEC82CEA45856159B479CE83CA7300DC0D51FC30E98013A6C18563CAB5443825DEC5E06ECAEF1D3465FBB1134C77A4
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........K...K...K.....d.J.....~.I.....\|.I.....C.F.....B.I...F.~.I....Ih.N...K...>...F.C.....F...J...F.x.J...F.}.J...RichK...................PE..d...L..T.........." .........F......<........................................."...........`.........................................P. .P.....!.d....p".......!...............".\....................................4..p............ ...............................text............................... ..`.rdata..8.... ......................@..@.data....U... !..6....!.............@....pdata........!......>!.............@..@.rsrc........p"...... ".............@..@.reloc..\....."......"".............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\hdf5_hl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	99840
Entropy (8bit):	6.070375909397882
Encrypted:	false
SSDEEP:	1536:gidhTVwoKodN5deiZT++24zVwOe3XSjZ+DNli/xfoCbIhEkiJorBnpL:VhZwoKoXHZTF245wY9+ZlilZVyTL
MD5:	A62B144F7018735973AFEE25CA8B6B03
SHA1:	71DE842D0ED154C1CDCE145AF4B0389A8B21762B
SHA-256:	498C6EEE37060600B84CE9484A707386592C653022AB28CFADFF3B1A168C6547
SHA-512:	CB1BBD83627A800A1E6B81D6481DE0C69AC03DCE44F082A1BF6FFCC901C16E07956570FFC5D70D720C4B4696403997F70069DC4750AD30EFD19B817E78679755
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.............m.....K......K......K.3....K.2............2.............3.........................Rich...........PE..d...Q..T.........." ................\|.....................................................`..........................................I.......V..P...............$....................................................5..p............ ...............................text............................... ..`.rdata..8I... ...J..................@..@.data....7...p..."...P..............@....pdata..$............r..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\iconengines\is-2O479.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	41968
Entropy (8bit):	6.0993566622860635
Encrypted:	false
SSDEEP:	768:VPs5g31JfDgej5JZmA0ZsEEC6lmn+4FdDGimUf2hr:VkC31ee7ZmA+sEEC6lmn+4FOUfc
MD5:	313F89994F3FEA8F67A48EE13359F4BA
SHA1:	8C7D4509A0CAA1164CC9415F44735B885A2F3270
SHA-256:	42DDE60BEFCF1D9F96B8366A9988626B97D7D0D829EBEA32F756D6ECD9EA99A8
SHA-512:	06E5026F5DB929F242104A503F0D501A9C1DC92973DD0E91D2DAF5B277D190082DE8D37ACE7EDF643C70AA98BB3D670DEFE04CE89B483DA4F34E629F8ED5FECF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n.:..i..i..i#.Ei...i...h(..i>..h(..i...h8..i...h-..i...h(..i...h-..i..i...i...h(..i...h+..i..)i+..i...h+..iRich*..i........................PE..d......_.........." .....@...F.......F..............................................C.....`..........................................g..x...hh..........H...........................xX..T....................Z..(....X..0............P...............................text....>.......@.................. ..`.rdata...3...P...4...D..............@..@.data................x..............@....pdata...............z..............@..@.qtmetadj...........................@..P.rsrc...H...........................@..@.reloc..............................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\iconengines\qsvgicon.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	41968
Entropy (8bit):	6.0993566622860635
Encrypted:	false
SSDEEP:	768:VPs5g31JfDgej5JZmA0ZsEEC6lmn+4FdDGimUf2hr:VkC31ee7ZmA+sEEC6lmn+4FOUfc
MD5:	313F89994F3FEA8F67A48EE13359F4BA
SHA1:	8C7D4509A0CAA1164CC9415F44735B885A2F3270
SHA-256:	42DDE60BEFCF1D9F96B8366A9988626B97D7D0D829EBEA32F756D6ECD9EA99A8
SHA-512:	06E5026F5DB929F242104A503F0D501A9C1DC92973DD0E91D2DAF5B277D190082DE8D37ACE7EDF643C70AA98BB3D670DEFE04CE89B483DA4F34E629F8ED5FECF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n.:..i..i..i#.Ei...i...h(..i>..h(..i...h8..i...h-..i...h(..i...h-..i..i...i...h(..i...h+..i..)i+..i...h+..iRich*..i........................PE..d......_.........." .....@...F.......F..............................................C.....`..........................................g..x...hh..........H...........................xX..T....................Z..(....X..0............P...............................text....>.......@.................. ..`.rdata...3...P...4...D..............@..@.data................x..............@....pdata...............z..............@..@.qtmetadj...........................@..P.rsrc...H...........................@..@.reloc..............................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\iconv.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	914432
Entropy (8bit):	7.34282950558293
Encrypted:	false
SSDEEP:	24576:hznlJ9BAUZLY9uHjGavkg3Ny37mbbTufVbqf:9lJ9BAUZLY9uHjGaXElVG
MD5:	54280BD06D5C35DDF1B53091237C9672
SHA1:	E2806EAA2319B0728EA93A2C98164066D2955C64
SHA-256:	FB4C161160C38531CC4B9B91B2836E5CF62DF7EB095EFDDEFAF433633AE78D54
SHA-512:	975ABE5268B003D557C62DA3BEDC8139351F8566238CC02FDD70E57236DD6DAE888909AD48C89CA5652C3D541EEC0404D62B9A52A10932C786AB3643B1CBF425
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|....o,..o,..o,7.,..o,t..,..o,..n,..o,.L.,..o,.L.,..o,.L.,..o,.L.,..o,.O.,..o,.O.,..o,.O.,..o,.O.,..o,Rich..o,........PE..d...e..T.........." ................T$.......................................0............`.........................................p...........<............................ ..8.......................................p............0..H............................text............................... ..`.rdata.......0....... ..............@..@.data...@...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..8.... ......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\is-26VGE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32240
Entropy (8bit):	5.978149408776758
Encrypted:	false
SSDEEP:	768:uOVKDlJJVlTuLiMtsKVG7TSdDG9Uf2h4e:hVgJVlTuL/tsKVG7TSQUfre
MD5:	C0DE135782FA0235A0EA8E97898EAF2A
SHA1:	FCF5FD99239BF4E0B17B128B0EBEC144C7A17DE2
SHA-256:	B3498F0A10AC4CB42CF7213DB4944A34594FF36C78C50A0F249C9085D1B1FF39
SHA-512:	7BD5F90CCAB3CF50C55EAF14F7EF21E05D3C893FA7AC9846C6CA98D6E6D177263AC5EB8A85A34501BCFCA0DA7F0B6C39769726F4090FCA2231EE64869B81CF0B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x>...P...P...P..a...P.&vQ...P..rQ...P.&vU...P.&vT...P.&vS...P.kiQ...P...Q.n.P.kiU...P.kiP...P.ki....P.kiR...P.Rich..P.........PE..d......_.........." .....$...B......D)....................................................`.........................................PU..t....U..........@............b...............G..T....................I..(...PH..0............@..(............................text....".......$.................. ..`.rdata...+...@...,...(..............@..@.data...8....p.......T..............@....pdata...............V..............@..@.qtmetad.............Z..............@..P.rsrc...@............\..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\is-2F3I0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38384
Entropy (8bit):	5.957072398645384
Encrypted:	false
SSDEEP:	768:zBXBEfQiAzC9Oh5AS7a3Z5OGrTDeV9mp7nnsWdDGgYUf2hi/:8JAzuOhy3zOGrTDeV9mp7nnsWjYUfz
MD5:	A9ABD4329CA364D4F430EDDCB471BE59
SHA1:	C00A629419509929507A05AEBB706562C837E337
SHA-256:	1982A635DB9652304131C9C6FF9A693E70241600D2EF22B354962AA37997DE0B
SHA-512:	004EA8AE07C1A18B0B461A069409E4061D90401C8555DD23DBF164A08E96732F7126305134BFAF8B65B0406315F218E05B5F0F00BEDB840FB993D648CE996756
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u.G...G...G...N...C......E...S...E......R......O......D.......B...G...........D.......F.......F.......F...RichG...................PE..d...H._.........." .....4...H.......9....................................................`..........................................h..t...th..........@............z..............(X..T....................Y..(....X..0............P..8............................text....2.......4.................. ..`.rdata..B/...P...0...8..............@..@.data...h............h..............@....pdata...............l..............@..@.qtmetad.............r..............@..P.rsrc...@............t..............@..@.reloc...............x..............@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\is-8LGJR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31728
Entropy (8bit):	5.865766652452823
Encrypted:	false
SSDEEP:	768:1lGALluUEAQATWQ79Z2Y8Ar+dDG2vUf2hF:TZl/EH8WQ794Y8Ar+hvUfm
MD5:	A913276FA25D2E6FD999940454C23093
SHA1:	785B7BC7110218EC0E659C0E5ACE9520AA451615
SHA-256:	5B641DEC81AEC1CF7AC0CCE9FC067BB642FBD32DA138A36E3BDAC3BB5B36C37A
SHA-512:	CEBE48E6E6C5CDF8FC339560751813B8DE11D2471A3DAB7D648DF5B313D85735889D4E704E8EEC0AD1084AB43BE0EBDFBACD038AEAC46D7A951EFB3A7CE838EB
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F ._'N._'N._'N.V_.Y'N..HO.]'N.KLO.]'N..HK.M'N..HJ.W'N..HM.\'N..WO.Z'N._'O.4'N..WK.\'N..WN.^'N..W..^'N..WL.^'N.Rich_'N.........................PE..d......_.........." ....."...@.......'..............................................7.....`..........................................W..t...dX..........@.......`....`..............(I..T....................J..(....I..0............@..h............................text...[!.......".................. ..`.rdata...)...@...*...&..............@..@.data........p.......P..............@....pdata..`............T..............@..@.qtmetadu............X..............@..P.rsrc...@............Z..............@..@.reloc...............^..............@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\is-AM7K6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	421360
Entropy (8bit):	5.7491063936821405
Encrypted:	false
SSDEEP:	6144:USgOWz1eW38u9tyh6fpGUasBKTrsXWwMmH1l3JM5hn0uEfB4:USPQTnastBRB4
MD5:	16ABCCEB70BA20E73858E8F1912C05CD
SHA1:	4B3A32B166AB5BBBEE229790FDAE9CBC84F936BA
SHA-256:	FB4E980CB5FAFA8A4CD4239329AED93F7C32ED939C94B61FB2DF657F3C6AD158
SHA-512:	3E5C83967BF31C9B7F1720059DD51AA4338E518B076B0461541C781B076135E9CB9CBCEB13A8EC9217104517FBCC356BDD3FFACA7956D1C939E43988151F6273
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Iv"...L...L...L..o....L..xM...L..\|M...L.......L..xI...L..xH...L..xO...L..gM...L...M...L..gH.?.L..gI...L..gL...L..g....L..gN...L.Rich..L.........PE..d...o._.........." .....b...........i...............................................g....`.............................................t...............@....`.......R..............h...T.......................(.......0...............@............................text....`.......b.................. ..`.rdata..J............f..............@..@.data...8....P.......(..............@....pdata.......`... ...*..............@..@.qtmetad.............J..............@..P.rsrc...@............L..............@..@.reloc...............P..............@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\is-FFN20.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30192
Entropy (8bit):	5.938644231596902
Encrypted:	false
SSDEEP:	768:EfEM3S46JE2X/xBZ76pC5J6GdDGZUf2h4:63S3JE2PHZ76pC5J6GEUfn
MD5:	68919381E3C64E956D05863339F5C68C
SHA1:	CE0A2AD1F1A46B61CB298CEC5AA0B25FF2C12992
SHA-256:	0F05969FB926A62A338782B32446EA3E28E4BFBFFC0DBD25ED303FAB3404ABAC
SHA-512:	6222A3818157F6BCD793291A6C0380EF8C6B93ECEA2E0C9A767D9D9163461B541AFAF8C6B21C5A020F01C95C6EE9B2B74B358BA18DA120F520E87E24B20836AA
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]...<.I.<.I.<.I.D%I.<.I.S.H.<.I.W.H.<.I.S.H.<.I.S.H.<.I.S.H.<.IYL.H.<.I.<.I.<.IYL.H.<.IYL.H.<.IYLII.<.IYL.H.<.IRich.<.I........PE..d......_.........." ..... ...8.......'....................................................`......................................... D..t....D..........@....p..T....Z...............6..T...................p8..(...@7..0............0..p............................text............ .................. ..`.rdata..d&...0...(...$..............@..@.data........`.......L..............@....pdata..T....p.......N..............@..@.qtmetad~............R..............@..P.rsrc...@............T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\is-G554D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	510448
Entropy (8bit):	6.605517748735854
Encrypted:	false
SSDEEP:	12288:bPTjgdqdsvh+LrLrLrL5/y4DVHAsqx3hXS+oPZQqRaYG:jT5sMLrLrLrL5q4dAsaOFo
MD5:	308E4565C3C5646F9ABD77885B07358E
SHA1:	71CB8047A9EF0CDB3EE27428726CACD063BB95B7
SHA-256:	6E37ACD0D357871F92B7FDE7206C904C734CAA02F94544DF646957DF8C4987AF
SHA-512:	FFAEECFAE097D5E9D1186522BD8D29C95CE48B87583624EB6D0D52BD19E36DB2860A557E19F0A05847458605A9A540C2A9899D53D36A6B7FD5BF0AD86AF88124
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................a....s........s......s......s....>.........>......>.....>....>......>....Rich...................PE..d......_.........." .....B..........tH.......................................0......`q....`..........................................W..t....W..........@.......0H........... ......h...T.......................(.......0............`...............................text...[@.......B.................. ..`.rdata..J....`.......F..............@..@.data....'...........X..............@....pdata..0H.......J...\..............@..@.qtmetadv...........................@..P.rsrc...@...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\is-H2EK5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	390128
Entropy (8bit):	5.724665470266677
Encrypted:	false
SSDEEP:	6144:V0jqHiFBaRe0GPAKwP15e7xrEEEEEEN024Rx/3tkYiHUASQbs/l7OanYoOgyV:0qqwP15bx/q7/yyV
MD5:	9C0ACF12D3D25384868DCD81C787F382
SHA1:	C6E877ABA3FB3D2F21D86BE300E753E23BB0B74E
SHA-256:	825174429CED6B3DAB18115DBC6C9DA07BF5248C86EC1BD5C0DCAECA93B4C22D
SHA-512:	45594FA3C5D7C4F26325927BB8D51B0B88E162E3F5E7B7F39A5D72437606383E9FDC8F83A77F814E45AFF254914514AE52C1D840A6C7B98767F362ED3F4FC5BD
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................E....q............q......q......q......<.............<......<......<......<.)....<......Rich....................PE..d......_.........." .....(..........D-.......................................0............`.............................................t...4...........@........%........... ..(....d..T................... f..(....d..0............@..0............................text....&.......(.................. ..`.rdata...v...@...x...,..............@..@.data...(...........................@....pdata...%.......&..................@..@.qtmetad............................@..P.rsrc...@...........................@..@.reloc..(.... ......................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\is-R83R7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45040
Entropy (8bit):	6.016125225197622
Encrypted:	false
SSDEEP:	768:vEip0IlhxTDxut3dnm8IyAmQQ3ydJouEAkNypTAO0tfC3apmsdDG9Uf2hU:vxvXxgVIyA23ydJlEATpTAO0tfCKpms/
MD5:	AD84AF4D585643FF94BFA6DE672B3284
SHA1:	5D2DF51028FBEB7F6B52C02ADD702BC3FA781E08
SHA-256:	F4A229A082D16F80016F366156A2B951550F1E9DF6D4177323BBEDD92A429909
SHA-512:	B68D83A4A1928EB3390DEB9340CB27B8A3EB221C2E0BE86211EF318B4DD34B37531CA347C73CCE79A640C5B06FBD325E10F8C37E0CEE2581F22ABFBFF5CC0D55
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................a....Q........Q......Q......Q......................................Rich...........PE..d......_.........." .....B...N.......G...............................................&....`.............................................t...$...........@...........................xp..T....................r..(....p..0............`...............................text....@.......B.................. ..`.rdata...9...`...:...F..............@..@.data...............................@....pdata..............................@..@.qtmetadx...........................@..P.rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\is-VN2GT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39408
Entropy (8bit):	6.0316011626259405
Encrypted:	false
SSDEEP:	768:ygk2hM0GskFtvPCjEIxh8eDzFyPddeeGvnhotdDGPUf2he:yN2a05kfPOEMaeDzFkddeFnhotOUfh
MD5:	52FD90E34FE8DED8E197B532BD622EF7
SHA1:	834E280E00BAE48A9E509A7DC909BEA3169BDCE2
SHA-256:	36174DD4C5F37C5F065C7A26E0AC65C4C3A41FDC0416882AF856A23A5D03BB9D
SHA-512:	EF3FB3770808B3690C11A18316B0C1C56C80198C1B1910E8AA198DF8281BA4E13DC9A6179BB93A379AD849304F6BB934F23E6BBD3D258B274CC31856DE0FC12B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R...3..3..3..KA.3..o\..3..X..3..o\..3..o\..3..o\..3.."C..3..3...3.."C..3.."C..3.."C-.3.."C..3..Rich.3..........PE..d...H._.........." .....@...B.......E...............................................^....`..........................................f..t....f..........@............~..............HW..T....................X..(....W..0............P...............................text...k?.......@.................. ..`.rdata..&)...P...*...D..............@..@.data...(............n..............@....pdata...............p..............@..@.qtmetads............v..............@..P.rsrc...@............x..............@..@.reloc...............\|..............@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\qgif.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39408
Entropy (8bit):	6.0316011626259405
Encrypted:	false
SSDEEP:	768:ygk2hM0GskFtvPCjEIxh8eDzFyPddeeGvnhotdDGPUf2he:yN2a05kfPOEMaeDzFkddeFnhotOUfh
MD5:	52FD90E34FE8DED8E197B532BD622EF7
SHA1:	834E280E00BAE48A9E509A7DC909BEA3169BDCE2
SHA-256:	36174DD4C5F37C5F065C7A26E0AC65C4C3A41FDC0416882AF856A23A5D03BB9D
SHA-512:	EF3FB3770808B3690C11A18316B0C1C56C80198C1B1910E8AA198DF8281BA4E13DC9A6179BB93A379AD849304F6BB934F23E6BBD3D258B274CC31856DE0FC12B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R...3..3..3..KA.3..o\..3..X..3..o\..3..o\..3..o\..3.."C..3..3...3.."C..3.."C..3.."C-.3.."C..3..Rich.3..........PE..d...H._.........." .....@...B.......E...............................................^....`..........................................f..t....f..........@............~..............HW..T....................X..(....W..0............P...............................text...k?.......@.................. ..`.rdata..&)...P...*...D..............@..@.data...(............n..............@....pdata...............p..............@..@.qtmetads............v..............@..P.rsrc...@............x..............@..@.reloc...............\|..............@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\qicns.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45040
Entropy (8bit):	6.016125225197622
Encrypted:	false
SSDEEP:	768:vEip0IlhxTDxut3dnm8IyAmQQ3ydJouEAkNypTAO0tfC3apmsdDG9Uf2hU:vxvXxgVIyA23ydJlEATpTAO0tfCKpms/
MD5:	AD84AF4D585643FF94BFA6DE672B3284
SHA1:	5D2DF51028FBEB7F6B52C02ADD702BC3FA781E08
SHA-256:	F4A229A082D16F80016F366156A2B951550F1E9DF6D4177323BBEDD92A429909
SHA-512:	B68D83A4A1928EB3390DEB9340CB27B8A3EB221C2E0BE86211EF318B4DD34B37531CA347C73CCE79A640C5B06FBD325E10F8C37E0CEE2581F22ABFBFF5CC0D55
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................a....Q........Q......Q......Q......................................Rich...........PE..d......_.........." .....B...N.......G...............................................&....`.............................................t...$...........@...........................xp..T....................r..(....p..0............`...............................text....@.......B.................. ..`.rdata...9...`...:...F..............@..@.data...............................@....pdata..............................@..@.qtmetadx...........................@..P.rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\qico.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38384
Entropy (8bit):	5.957072398645384
Encrypted:	false
SSDEEP:	768:zBXBEfQiAzC9Oh5AS7a3Z5OGrTDeV9mp7nnsWdDGgYUf2hi/:8JAzuOhy3zOGrTDeV9mp7nnsWjYUfz
MD5:	A9ABD4329CA364D4F430EDDCB471BE59
SHA1:	C00A629419509929507A05AEBB706562C837E337
SHA-256:	1982A635DB9652304131C9C6FF9A693E70241600D2EF22B354962AA37997DE0B
SHA-512:	004EA8AE07C1A18B0B461A069409E4061D90401C8555DD23DBF164A08E96732F7126305134BFAF8B65B0406315F218E05B5F0F00BEDB840FB993D648CE996756
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u.G...G...G...N...C......E...S...E......R......O......D.......B...G...........D.......F.......F.......F...RichG...................PE..d...H._.........." .....4...H.......9....................................................`..........................................h..t...th..........@............z..............(X..T....................Y..(....X..0............P..8............................text....2.......4.................. ..`.rdata..B/...P...0...8..............@..@.data...h............h..............@....pdata...............l..............@..@.qtmetad.............r..............@..P.rsrc...@............t..............@..@.reloc...............x..............@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\qjpeg.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	421360
Entropy (8bit):	5.7491063936821405
Encrypted:	false
SSDEEP:	6144:USgOWz1eW38u9tyh6fpGUasBKTrsXWwMmH1l3JM5hn0uEfB4:USPQTnastBRB4
MD5:	16ABCCEB70BA20E73858E8F1912C05CD
SHA1:	4B3A32B166AB5BBBEE229790FDAE9CBC84F936BA
SHA-256:	FB4E980CB5FAFA8A4CD4239329AED93F7C32ED939C94B61FB2DF657F3C6AD158
SHA-512:	3E5C83967BF31C9B7F1720059DD51AA4338E518B076B0461541C781B076135E9CB9CBCEB13A8EC9217104517FBCC356BDD3FFACA7956D1C939E43988151F6273
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Iv"...L...L...L..o....L..xM...L..\|M...L.......L..xI...L..xH...L..xO...L..gM...L...M...L..gH.?.L..gI...L..gL...L..g....L..gN...L.Rich..L.........PE..d...o._.........." .....b...........i...............................................g....`.............................................t...............@....`.......R..............h...T.......................(.......0...............@............................text....`.......b.................. ..`.rdata..J............f..............@..@.data...8....P.......(..............@....pdata.......`... ...*..............@..@.qtmetad.............J..............@..P.rsrc...@............L..............@..@.reloc...............P..............@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\qsvg.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32240
Entropy (8bit):	5.978149408776758
Encrypted:	false
SSDEEP:	768:uOVKDlJJVlTuLiMtsKVG7TSdDG9Uf2h4e:hVgJVlTuL/tsKVG7TSQUfre
MD5:	C0DE135782FA0235A0EA8E97898EAF2A
SHA1:	FCF5FD99239BF4E0B17B128B0EBEC144C7A17DE2
SHA-256:	B3498F0A10AC4CB42CF7213DB4944A34594FF36C78C50A0F249C9085D1B1FF39
SHA-512:	7BD5F90CCAB3CF50C55EAF14F7EF21E05D3C893FA7AC9846C6CA98D6E6D177263AC5EB8A85A34501BCFCA0DA7F0B6C39769726F4090FCA2231EE64869B81CF0B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x>...P...P...P..a...P.&vQ...P..rQ...P.&vU...P.&vT...P.&vS...P.kiQ...P...Q.n.P.kiU...P.kiP...P.ki....P.kiR...P.Rich..P.........PE..d......_.........." .....$...B......D)....................................................`.........................................PU..t....U..........@............b...............G..T....................I..(...PH..0............@..(............................text....".......$.................. ..`.rdata...+...@...,...(..............@..@.data...8....p.......T..............@....pdata...............V..............@..@.qtmetad.............Z..............@..P.rsrc...@............\..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\qtga.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31728
Entropy (8bit):	5.865766652452823
Encrypted:	false
SSDEEP:	768:1lGALluUEAQATWQ79Z2Y8Ar+dDG2vUf2hF:TZl/EH8WQ794Y8Ar+hvUfm
MD5:	A913276FA25D2E6FD999940454C23093
SHA1:	785B7BC7110218EC0E659C0E5ACE9520AA451615
SHA-256:	5B641DEC81AEC1CF7AC0CCE9FC067BB642FBD32DA138A36E3BDAC3BB5B36C37A
SHA-512:	CEBE48E6E6C5CDF8FC339560751813B8DE11D2471A3DAB7D648DF5B313D85735889D4E704E8EEC0AD1084AB43BE0EBDFBACD038AEAC46D7A951EFB3A7CE838EB
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F ._'N._'N._'N.V_.Y'N..HO.]'N.KLO.]'N..HK.M'N..HJ.W'N..HM.\'N..WO.Z'N._'O.4'N..WK.\'N..WN.^'N..W..^'N..WL.^'N.Rich_'N.........................PE..d......_.........." ....."...@.......'..............................................7.....`..........................................W..t...dX..........@.......`....`..............(I..T....................J..(....I..0............@..h............................text...[!.......".................. ..`.rdata...)...@...*...&..............@..@.data........p.......P..............@....pdata..`............T..............@..@.qtmetadu............X..............@..P.rsrc...@............Z..............@..@.reloc...............^..............@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\qtiff.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	390128
Entropy (8bit):	5.724665470266677
Encrypted:	false
SSDEEP:	6144:V0jqHiFBaRe0GPAKwP15e7xrEEEEEEN024Rx/3tkYiHUASQbs/l7OanYoOgyV:0qqwP15bx/q7/yyV
MD5:	9C0ACF12D3D25384868DCD81C787F382
SHA1:	C6E877ABA3FB3D2F21D86BE300E753E23BB0B74E
SHA-256:	825174429CED6B3DAB18115DBC6C9DA07BF5248C86EC1BD5C0DCAECA93B4C22D
SHA-512:	45594FA3C5D7C4F26325927BB8D51B0B88E162E3F5E7B7F39A5D72437606383E9FDC8F83A77F814E45AFF254914514AE52C1D840A6C7B98767F362ED3F4FC5BD
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................E....q............q......q......q......<.............<......<......<......<.)....<......Rich....................PE..d......_.........." .....(..........D-.......................................0............`.............................................t...4...........@........%........... ..(....d..T................... f..(....d..0............@..0............................text....&.......(.................. ..`.rdata...v...@...x...,..............@..@.data...(...........................@....pdata...%.......&..................@..@.qtmetad............................@..P.rsrc...@...........................@..@.reloc..(.... ......................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\qwbmp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30192
Entropy (8bit):	5.938644231596902
Encrypted:	false
SSDEEP:	768:EfEM3S46JE2X/xBZ76pC5J6GdDGZUf2h4:63S3JE2PHZ76pC5J6GEUfn
MD5:	68919381E3C64E956D05863339F5C68C
SHA1:	CE0A2AD1F1A46B61CB298CEC5AA0B25FF2C12992
SHA-256:	0F05969FB926A62A338782B32446EA3E28E4BFBFFC0DBD25ED303FAB3404ABAC
SHA-512:	6222A3818157F6BCD793291A6C0380EF8C6B93ECEA2E0C9A767D9D9163461B541AFAF8C6B21C5A020F01C95C6EE9B2B74B358BA18DA120F520E87E24B20836AA
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]...<.I.<.I.<.I.D%I.<.I.S.H.<.I.W.H.<.I.S.H.<.I.S.H.<.I.S.H.<.IYL.H.<.I.<.I.<.IYL.H.<.IYL.H.<.IYLII.<.IYL.H.<.IRich.<.I........PE..d......_.........." ..... ...8.......'....................................................`......................................... D..t....D..........@....p..T....Z...............6..T...................p8..(...@7..0............0..p............................text............ .................. ..`.rdata..d&...0...(...$..............@..@.data........`.......L..............@....pdata..T....p.......N..............@..@.qtmetad~............R..............@..P.rsrc...@............T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\imageformats\qwebp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	510448
Entropy (8bit):	6.605517748735854
Encrypted:	false
SSDEEP:	12288:bPTjgdqdsvh+LrLrLrL5/y4DVHAsqx3hXS+oPZQqRaYG:jT5sMLrLrLrL5q4dAsaOFo
MD5:	308E4565C3C5646F9ABD77885B07358E
SHA1:	71CB8047A9EF0CDB3EE27428726CACD063BB95B7
SHA-256:	6E37ACD0D357871F92B7FDE7206C904C734CAA02F94544DF646957DF8C4987AF
SHA-512:	FFAEECFAE097D5E9D1186522BD8D29C95CE48B87583624EB6D0D52BD19E36DB2860A557E19F0A05847458605A9A540C2A9899D53D36A6B7FD5BF0AD86AF88124
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................a....s........s......s......s....>.........>......>.....>....>......>....Rich...................PE..d......_.........." .....B..........tH.......................................0......`q....`..........................................W..t....W..........@.......0H........... ......h...T.......................(.......0............`...............................text...[@.......B.................. ..`.rdata..J....`.......F..............@..@.data....'...........X..............@....pdata..0H.......J...\..............@..@.qtmetadv...........................@..P.rsrc...@...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\is-02UTJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	905456
Entropy (8bit):	6.410762946527034
Encrypted:	false
SSDEEP:	12288:aynKy8oJXHlyEolsglxb/Gj53/vpZcZjlIcPX3NDdpMEZhJeuv:ayXFyEoLk5+tn
MD5:	FED654B78DC2EF46288A50A506AD024F
SHA1:	DA1159917FF8E03451A9CEE0A7C26C09D838BDF8
SHA-256:	C64245CB6606570963F243F538F83A42EB04D280A6AECFAF6F71BC83D36E7159
SHA-512:	B9DBD4CA4EB9941FD5C9DC132C447D5A118DBDA586514AF2289807E4D817E120F4EAEB3CF9D3BDB019A5FAF6AC15B5CE8A5541E6233A7536568C88AB46BBD601
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=...y...y...y...p.......+.a...+.q...+.z...+.}...".{.....~...y...$.....".....x.....B.x...y..x.....x...Richy...........PE..d....c._.........." .....h...R......t...............................................5.....`..........................................$.......................p...Z..................._.......................`..(...._...............................................text...Ff.......h.................. ..`.rdata...............l..............@..@.data....#...@.....................@....pdata...Z...p...\...D..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-0ETAJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	914432
Entropy (8bit):	7.34282950558293
Encrypted:	false
SSDEEP:	24576:hznlJ9BAUZLY9uHjGavkg3Ny37mbbTufVbqf:9lJ9BAUZLY9uHjGaXElVG
MD5:	54280BD06D5C35DDF1B53091237C9672
SHA1:	E2806EAA2319B0728EA93A2C98164066D2955C64
SHA-256:	FB4C161160C38531CC4B9B91B2836E5CF62DF7EB095EFDDEFAF433633AE78D54
SHA-512:	975ABE5268B003D557C62DA3BEDC8139351F8566238CC02FDD70E57236DD6DAE888909AD48C89CA5652C3D541EEC0404D62B9A52A10932C786AB3643B1CBF425
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|....o,..o,..o,7.,..o,t..,..o,..n,..o,.L.,..o,.L.,..o,.L.,..o,.L.,..o,.O.,..o,.O.,..o,.O.,..o,.O.,..o,Rich..o,........PE..d...e..T.........." ................T$.......................................0............`.........................................p...........<............................ ..8.......................................p............0..H............................text............................... ..`.rdata.......0....... ..............@..@.data...@...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..8.... ......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-0UCED.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	137216
Entropy (8bit):	6.225171524893703
Encrypted:	false
SSDEEP:	3072:oeFPoVRx1tgigeosf1bt3eCwpQ6qPNq9K00mp7k43MnVA8ESgS45P04X:Ve1tgigeosf1bt3eCwC6KqkdA8ESgS45
MD5:	BE0ADCA466744EBA777289419966C0C7
SHA1:	7D2FFA0BED0B7DA841E58AA61C42E435D78E7E9B
SHA-256:	216992614BDCE256C01DC9B7FF6085C597E50B8024E67AAE5FE35B47BE318240
SHA-512:	F41DEF9F228CB7E6DF019E7B089F6C3E9453716237AF11B5B30162892468C38D34234DFCD72AE6E25C66CFA25C48165ECBA9E48D54DD38CC72F60CD97F8672EA
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b..^.~.^.~.^.~..R..].~..R.._.~..R..U.~..R..\.~.....\.~.^...z.~.SQ..[.~.SQ.._.~.SQ.._.~.SQ.._.~.Rich^.~.................PE..d...@4.T.........." .........~...............................................`............`.................................................$...<....@....... ..l............P..........................................p...............(............................text...;........................... ..`.rdata...P.......R..................@..@.data...............................@....pdata..l.... ... ..................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-192GB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3783408
Entropy (8bit):	7.082603044017435
Encrypted:	false
SSDEEP:	49152:DvGbhb3gARA+DORgiDVVqWRcBP3Par9P8jtP8T4sLrM5up7PA:64NhRcBP3Par9+U0uhA
MD5:	2884F95C5C51B793A16C822F6865D468
SHA1:	40A6614137E528E76C78900E234AB31F5A76AF3E
SHA-256:	A58CF1A96B6073777C8C25C162692F4706B95428AD98A9BAD9D08E697E204125
SHA-512:	FCB46F404C405C5EEC13F223DB59B5144B4F4E6DE6777C671A5164283D278A13571472E35055A93BBC902933042AF894D6BBF2A1932BACBBB12D510403D2CEA5
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......uA.1 ..1 ..1 ..8X..9 ..cH..9 ..cH..2 ..cH..- ..cH..5 ..jH..3 ..I..8 ..1 ...#..I..+!..I..0 ..I~.0 ..1 ..0 ..I..0 ..Rich1 ..................PE..d....d._.........." .........R.......B....................................... :......V:...`..........................................b0..&....3.......:......09.\.....9.......:.D...0.+.....................P.+.(...P.+.................`............................text.............................. ..`.rdata..2...........................@..@.data...X.....4..P...t4.............@....pdata..\....09.......8.............@..@.rsrc.........:.......9.............@..@.reloc..D.....:.......9.............@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-1AVDH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61680
Entropy (8bit):	5.923759574558729
Encrypted:	false
SSDEEP:	768:ek8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqe:ekwewnvtjnsfwGFIAB0hy
MD5:	A5471F05FD616B0F8E582211EA470A15
SHA1:	CB5F8BF048DC4FC58F80BDFD2E04570DBEF4730E
SHA-256:	8D5E09791B8B251676E16BDD66A7118D88B10B66AD80A87D5897FADBEFB91790
SHA-512:	E87D06778201615B129DCF4E8B4059399128276EB87102B5C3A64B6E92714F6B0D5BDE5DF4413CC1B66D33A77D7A3912EAA1035F73565DBFD62280D09D46ABFF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............d...d...d.\|.l...d.\|.d...d.\|.....d.\|.f...d.Rich..d.........................PE..d...\|O[a.........." .....................................................................`.........................................`...`...............................................T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-1D8GC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	285184
Entropy (8bit):	6.134546329576554
Encrypted:	false
SSDEEP:	6144:mwm1yAstRH4FBEiD17SCltmbuFeU77naU8ht8WEPZFlT3C0:lm1yAstRYFBEiD17SCOEhFl2
MD5:	7B228925B73F2D00787CA4B039C31648
SHA1:	1D7AFF84B58FCC076FB3897A80B6A41A3D601C2F
SHA-256:	62E57B4424230221F4A287D3F8960828A0AD2873EDD1A02920A8AAF48475779C
SHA-512:	075DC24D7E327F211E3FB6B9FA6C67C7A384503BD3230E08F2BCDFBDEDD099178F04F388F864996DD283DF12AC9A3F718EE644D055044CEDEB5BBFB0B0B481F4
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]B..3...3...3.......3...2...3...6...3...7...3...0...3...2...3...2...3.U.6...3.U.3...3.U.....3.U.1...3.Rich..3.........................PE..d...ca0c.........." .........v............................................................`......................................... ...t.... ...............P...(.............. ................................... ...................x............................text............................... ..`.rdata...+.......,..................@..@.data........0......................@....pdata...(...P...*...(..............@..@.rsrc................R..............@..@.reloc.. ............T..............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-1T592.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	31
Entropy (8bit):	4.373551149096553
Encrypted:	false
SSDEEP:	3:lLWQfZfd9:RWCpd9
MD5:	D3FC27613FF7EBD51808D0A0DB4D0FC9
SHA1:	E7E8F95165C18B542653B21FB71F970A03BE60E0
SHA-256:	9D5C9D8C3035D78040D5323DF783EA085EEFBED8780893139D30BAA3BD9E6455
SHA-512:	31B7CCDC6746CBA7B95CA51D93BA3F496DB64650CB716E0DBB4DCC46047065DF60BFDCA7C390CAACBE77D9AD17FF6084DFE5CE076ACB4EC30BC2EC95DA2A3B52
Malicious:	false
Reputation:	low
Preview:	@set PATH=...CloudCompare.exe..

C:\Program Files\CloudCompare\is-2BPFH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31512
Entropy (8bit):	6.482572392659554
Encrypted:	false
SSDEEP:	384:N7K97EGM9l0SJuJZVWnlVI/GDYWcn53WMlQpBj0HRN7gr5mQHRN7AFA8pUclXC/:tKcJJuJZVWlVlq/qWgro8WA8pU7
MD5:	D281BE80D404478EA08651AB0BF071B5
SHA1:	E81DC979D8CF166C961C8E7B26F5667DB9557C47
SHA-256:	5E627FAC479F72363075824423D74D0A5D100BB69377F2A8C0942E12099AF700
SHA-512:	FDA7C43FB6EE71C7CCBAD7AD32C1F00E454CCDEE3BBC35DE4045ABBC8998281CDAB9C506FEA8417DF25FF0EF09471EEA49F63B2181E160C62BDA804FBFD8C376
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8./.\|.A.\|.A.\|.A..9..~.A.u..x.A...E.{.A...B.}.A.\|.@.U.A...@.y.A...D.o.A...A.}.A....}.A...C.}.A.Rich\|.A.................PE..d.....0].........." .........$......p...............................................[r....`A.........................................>..L...L?..x....p.......`..@....:...A......d...03..8...........................p3...............0..@............................text............................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..@....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..d............8..............@..B........................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-2NF19.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4450544
Entropy (8bit):	6.458222828027988
Encrypted:	false
SSDEEP:	49152:+RYsIZfypUacEN7z1NR6JYL911cdl40pPQKE30tBuQS6BqL902zJAysI6maHmbM9:YYsI5xKZ4JxsvAI6xHEMb5Hs9d
MD5:	384349987B60775D6FC3A6D202C3E1BD
SHA1:	701CB80C55F859AD4A31C53AA744A00D61E467E5
SHA-256:	F281C2E252ED59DD96726DBB2DE529A2B07B818E9CC3799D1FFA9883E3028ED8
SHA-512:	6BF3EF9F08F4FC07461B6EA8D9822568AD0A0F211E471B990F62C6713ADB7B6BE28B90F206A4EC0673B92BAE99597D1C7785381E486F6091265C7DF85FF0F9B5
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................~..........................................3...F..3......3.\|....3......Rich...........PE..d...pO[a.........." .....X#..d!.....,.........................................E......D...`...........................................<......z=.\|....pD......@B.0.....C.......D..t..x.$.T.............................$.8............p#.8............................text...bW#......X#................. ..`.rdata...-...p#......\#.............@..@.data.........=.......=.............@....pdata..0....@B......6A.............@..@PyRuntim`....`D......HC.............@....rsrc........pD......LC.............@..@.reloc...t....D..v...VC.............@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-3UACU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	943104
Entropy (8bit):	4.884100718195113
Encrypted:	false
SSDEEP:	6144:GNVEvTyvUpeL7/Al2ntAFXgltlFgj5KsOHhTmkijOcprzyB61vdq0umlKnSDpd:GNOTyvTX/AxGlUK1KkWyB61FTuEK4
MD5:	799A5FF9D9919DB09A70ACBA8DA22E3F
SHA1:	737A8000644C5C59B8E609DCC7C87B807C4D70FB
SHA-256:	0C8F98093EADAA3EFBC4DEF4E047B61BCE3262A395F9214D574F51DDDFDA2E4E
SHA-512:	129F35F37874C228A74ADA9C429F303E1EC75E3701B085B8D7D9A360D6B525B93D40D46FA70795176625295DB19DA5EA67E4D07920C86F86B6702F0965B71981
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .^rd.0!d.0!d.0!.K.!g.0!"..!f.0!"..!f.0!"..!h.0!"..!f.0!i..!b.0!...!g.0!d.1!..0!i..!:.0!i..!e.0!i..!e.0!i..!e.0!Richd.0!........................PE..d...0..T.........." .........J...... .....................................................`..Zb.....................................@...S,......x....@...........[...........P...0..................................@7..p............ ...............................text............................... ..`.rdata..T.... ......................@..@.data...............................@....pdata...[.......\..................@..@.rsrc........@.......0..............@..@.reloc...0...P...2...2..............@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-4FB87.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1703152
Entropy (8bit):	6.263930597929995
Encrypted:	false
SSDEEP:	49152:zjIvfo41bZFaxoVEbck8vlXlq00MBdCHa4wceTlBKB4WBlz1/w2SvpNiX1nOrw2x:skzc
MD5:	4FB0AC0BE1DE51903B251B3BA7842A9E
SHA1:	6A27E35545C900D0480241FBC5D4EDB87AB50574
SHA-256:	83DB54F529B47A8E8E1A4B898AD64FD9F4B6A5D96829DA183EA650154AD132F3
SHA-512:	C883F31B18D172768C7B47EB0F62F45C166ACDB28B83B0D4D8137A61F12DA6F50D9B26B63410435B09F2D5EE98C958E4A1116098DE3AA47EAC41B66D5FEF6F93
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.P.p.>.p.>.p.>.y..v.>.".;.i.>.".:.x.>.".=.r.>.".?.t.>.+.?.r.>...?.u.>.p.?..>...;.r.>...>.q.>.....q.>.p...q.>...<.q.>.Richp.>.........PE..d....d._.........." .....&..........T........................................`.......o....`.........................................`......8........0.......................@.......F.......................G..(....F...............@...............................text....%.......&.................. ..`.rdata..l....@.......*..............@..@.data...........p..................@....pdata..............................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-4N83B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65625088
Entropy (8bit):	6.716204630721569
Encrypted:	false
SSDEEP:	393216:sbMrUzNKCHFRGrF9uETlbLiAUESilnLo:s2cNWrFwETlrnnL
MD5:	C8AA5618B3AEBB44A1DC971CF45DF6AF
SHA1:	E63D348666665876DFA22854F7DD3D450289425E
SHA-256:	8799F59DBCF8F7EB8B56A0D6EFD8E957A1985CD2CD4723B4228731288A5FAE88
SHA-512:	0936CBA77118A4451C73324D971E64946824E665DD411B84EFDB0B209BCA3CF5895C5A3D557489B303C970B870980E39DAC71D9B2BC472D22667006D81C80E47
Malicious:	false
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......!Rz.e3..e3..e3..lK..s3......o3...Q..M3...Q..n3...Q..c3...Q..\|3..GS..a3..e3..2..GS..p3..?....7..e3..C....P...3...P...2...P..d3...P..d3..e3..d3...P..d3..Riche3..........PE..d..."x=Z.........." .....2B..r............................................................`.........................................`...(............p.......`...................a......T.......................(....................PB..............................text............................... ..`IPPCODE...%.......%................. ..`.rdata.......PB......6B.............@..@.data...h~.......4..................@....pdata.......`......................@..@IPPDATA.....p......................@..._RDATA...F... ...H..................@..@.rsrc........p......................@..@.reloc...a.......b..................@..B................................................................................

C:\Program Files\CloudCompare\is-5DUDN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5498352
Entropy (8bit):	6.619117060971844
Encrypted:	false
SSDEEP:	49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
MD5:	4CD1F8FDCD617932DB131C3688845EA8
SHA1:	B090ED884B07D2D98747141AEFD25590B8B254F9
SHA-256:	3788C669D4B645E5A576DE9FC77FCA776BF516D43C89143DC2CA28291BA14358
SHA-512:	7D47D2661BF8FAC937F0D168036652B7CFE0D749B571D9773A5446C512C58EE6BB081FEC817181A90F4543EBC2367C7F8881FF7F80908AA48A7F6BB261F1D199
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x..................I.......I.......I.......I...........................................9.................................Rich............PE..d....._.........." ......3..P .......3.......................................T......MT...`.........................................0.D.P^....L.h....pS......0P..8....S.......S.d.....?.T...................`.?.(...0.?.0.............3.._...........................text.....3.......3................. ..`.rdata..8.....3.......3.............@..@.data.........O......dO.............@....pdata...8...0P..:....O.............@..@.rsrc........pS......4S.............@..@.reloc..d.....S......:S.............@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-5LLNK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	359936
Entropy (8bit):	5.682629096124071
Encrypted:	false
SSDEEP:	3072:9h1r89dfpp/Q82+udVRCEzgnvYJY3dCSU3by5ncqs0TslqX4x+F0NNUNbhEy6CU:9h10p/TMMvYJYdU36crbS4ZoRU
MD5:	97853DCCBC4B7F14E56D31F7B56364D6
SHA1:	5EB49E3441CA1A8F75B381AE1F98ADAD9A905D4D
SHA-256:	95A71D6D6600B0B78F8F2F200F97B539D92D59327B649DAA2D33E5F56BBC519B
SHA-512:	421C07DA9F53253ADEDC022C6AA9E0DA6248319B734678FC88D320C278C23B95CF969BC262BB1510B6F5710B80FAF5B1EE1CC5CD8B15FA57912F67202BE952CF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@a..2..2..20j.2..2s5.2..2./2...2...2..2...2..2...2..2...2..2...2~..2...2..2...2..2Rich..2........................PE..d...Z..T.........." .........~......4.....................................................`.........................................P...\.......<............P...1..............\...`&..8............................i..p............................................text............................... ..`.rdata....... ......................@..@.data....l.......h..................@....pdata...7...P...8...,..............@..@.idata..Z............d..............@..@.reloc...............r..............@..B................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-5NEDU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	278016
Entropy (8bit):	6.002198044760076
Encrypted:	false
SSDEEP:	3072:0YFEIZkLcSqMJUGotgtsKhXQsYxC50Xj1AWOAPEd:zuLcScGmNlC50Xj1AWOAPE
MD5:	5F0D90D65156DB90A2B5D0EC4C3FCFF8
SHA1:	D4341CA5CF262DE98EC772C770FA92F4B8E8A9F4
SHA-256:	EF215DA0B20F6F46B8FD2D7A557319EB30A1A2B1031D3E4C0B37B1AA4FAC58B4
SHA-512:	7C56D8A8FE5890C68F68E685B48E3D956159768FAAF7A27B701A5D62B5F55995E80519F200D8C11B8886165A67961545015438B1B48BA9B9139B4DF6CA6A8FDF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#.{.#.{.#.{.E..".{.e...".{.e.....{.e...'.{.e...'.{..... .{.....!.{.#.z..{.....!.{.....".{.....".{.....".{.Rich#.{.........................PE..d.....T.........." .................T....................................................`.........................................`..........d....`.......0..T-...........p..........................................p............................................text.............................. ..`.rdata...R.......T..................@..@.data...P...........................@....pdata..T-...0......................@..@.rsrc........`.......4..............@..@.reloc.......p.......6..............@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-5U5RQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	649728
Entropy (8bit):	7.039680213745585
Encrypted:	false
SSDEEP:	6144:MQOW+qYe7k6z8Mm6VKLjg1SL41q6iecU5PyAWIMWvh2MHg/sKuHNsEYhr/0p4D53:MQfi+r4w1SyqdexyHnMYsKutsEYR8pm
MD5:	31670756C84482C651BB895F9A6B87E5
SHA1:	A543B94A82DAD65923F4F2A666D5BB7020811BC8
SHA-256:	980069AFCB062404F1ACA91CACD514C28E55513244B44141D29359369EF950CB
SHA-512:	C1C1B5B88AB548A518CAF295954A3E833B0F7393ABF55011130707B76BF024034713313D8323026F2AD91D3ECB8635D7914AC336E3E627FEBB4C006657D509EE
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.....,...,...,.}i,...,.m.-...,.m.-...,.m.-...,.m.-...,.}.-...,.}y,...,#u.-...,.l.-...,...,...,.l.-...,.l.-...,.l.,...,.l.-...,Rich...,........PE..d...z..g.........." .....l..........,Z.......................................0............`..............................................?......@...............\............ ..H........................... ...(... ................................................text....j.......l.................. ..`.rdata..j=.......>...p..............@..@.data....%..........................@....pdata..\...........................@..@.rsrc...............................@..@.reloc..H.... ......................@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-6E13D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1405440
Entropy (8bit):	6.457300172251594
Encrypted:	false
SSDEEP:	24576:YF/mgRJ1GjiW1J/ZtHWTbFBy8L1OXerAKmj1l5+Fbya8q2eE:M2ZtHWPFByPP5+FbyFe
MD5:	9421DE1243DA93AC477AC5333AC04406
SHA1:	1098DFFC6F5955E00C2886E912FB17EC0C849A46
SHA-256:	7F6D8D720DE4720BDC0796D1AA1965E88CBA718BBEFF0C8ADA30987D6219C4A9
SHA-512:	0911FC373F6BBA0E0A5550A273C9D5125475C77E0983828EADE7C4A9358433884A07727E8EFA276F2423E83B652817F0379EA80F2852D8D9F706A75DB85827B3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V6.o.Wc<.Wc<.Wc<./.<.Wc<@?f=.Wc<@?g=.Wc<@?`=.Wc<@?b=.Wc<Y/b=.Wc<.'b=.Wc<.>b=.Wc<.Wb<%Tc<.>f=-Wc<.>c=.Wc<.>.<.Wc<.>a=.Wc<Rich.Wc<........PE..d....g.........." ................`.....................................................`.............................................4...$...T...............d............... >..............................(.......................(............................text............................... ..`.rdata..............................@..@.data....Z.......4...h..............@....pdata..d...........................@..@.rsrc................0..............@..@.reloc.. >.......@...2..............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-78AIN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2652672
Entropy (8bit):	6.5100737069425705
Encrypted:	false
SSDEEP:	49152:/drr5uORwWnFgekvnXCkqbPnVc/t93AnL2:dr50D+6th22
MD5:	3E6E3F672ED39CBEA7F7FC594BA65167
SHA1:	B2EC77464A04ABAA60CC3AEF232A01D302117FDB
SHA-256:	73124B69D6F3C54AFDAAB9CDE89656F415923119ACCDCF918ECDD47F78FB0210
SHA-512:	54CB29B1D2978886934B9181FA011EBF73427EA306D67DD4D920ECF57002DE636194FBCE53B9D94D0FD796D2CDD35E942619672442AB2A6A4D7F4E54CC35E724
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....#f..........."....N...v(.....0.........................................).......)...`... .......................................)..D...`)..)....).......%..............).l.............................#.(...................Pj)..............................text...0M.......N..................`..`.data.......`...,...R..............@....rdata...j.......l...~..............@..@.pdata.......%..,....$.............@..@.xdata.. ....0&.......&.............@..@.bss....0.....'..........................edata...D....)..F....'.............@..@.idata...)...`)..*....(.............@....CRT....`.....)......B(.............@....tls..........)......D(.............@....rsrc.........)......F(.............@..@.reloc..l.....)..0...J(.............@..B................................................................................................................................

C:\Program Files\CloudCompare\is-7AMNT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3778688
Entropy (8bit):	6.381493838760625
Encrypted:	false
SSDEEP:	49152:46SRSFneW0gGoV8tBB0pgRQBPMmS9BQRCSY0uKBY9zwaSNtASu58JfX/MkjX9F:XFFjByQET9iu8PXjT
MD5:	EB6EE54899E763C0C32625847735CB42
SHA1:	98DB0FC03A7BBD71901770F9637AA3EB57DC05D9
SHA-256:	0FA8364972240178560821D374BDA70A8A5E5B2AE05374E258C9599D8DF4A554
SHA-512:	E205199D0AE9A68BDD8E26809D5CC6C8360EA00D9C94A6B53F1B48A6EEC7DF7672062B4A9BF8A3A890D8053E66241464D099520841F647EFD98862AE3AE4AAFC
Malicious:	false
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......k../~../~../~..&./.#~..}...%~..}...+~..}....~..}...'~..d...+~......~..",a.-~.....%~....."~../~..Up.....u~......~...C..~......~..Rich/~..........................PE..d.....g..........".......!........... ........@..............................9.....D.9...`...........................................3.\X....3.......8.......7.......9..&...`9..i...+.......................+.(.....+...............". p...........................text.....!.......!................. ..`.rdata..b/...."..0....!.............@..@.data........@7..f....7.............@....pdata........7.......7.............@..@.rsrc.........8......x8.............@..@.reloc...i...`9..j....9.............@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-7D511.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1248
Entropy (8bit):	3.411406870003142
Encrypted:	false
SSDEEP:	24:JNQNANQs8Bw5NQMJ0y4TVOkHUYlg2NQNnNe:J+i+/Bw5+k0y4TjHUY+2+BM
MD5:	10E499DB3962E1CA5FECBCBDF2D623EA
SHA1:	BBD9C1D5F081144ED3096825900E7982120E9318
SHA-256:	B0180C8E73919E584EC2DB3D8916858D7EA3FF4FBB33A8C535CA5FBC2E6E57E4
SHA-512:	4BB76A579188E9A4AE5D48064BA24CC8049152A0961D835910FC013E2A2480AEEA1DFC9D2B5A419722077920B2EF854FDBEE073A3D1203A9977094D400A6456E
Malicious:	false
Reputation:	low
Preview:	//##########################################################################..//# #..//# CLOUDCOMPARE #..//# #..//# This program is free software; you can redistribute it and/or modify #..//# it under the terms of the GNU General Public License as published by #..//# the Free Software Foundation; version 2 of the License. #..//# #..//# This program is distributed in the hope that it will be useful, #..//# but WITHOUT ANY WARRANTY; without even the implied warranty of #..//# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #..//# GNU General Public License for more details. #..//#

C:\Program Files\CloudCompare\is-82NCD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	638192
Entropy (8bit):	6.121612263603408
Encrypted:	false
SSDEEP:	12288:aeAClh/JUd4/0OHSsecsFJPNK3jNeJVhoo:ZACl10OHSs4PNKxsgo
MD5:	30035261439F666D41E3A8E851379EC7
SHA1:	16BB1176D6775EB1771477AE7CCF79759CBBE2E7
SHA-256:	CEC70C7601106FFA9F22BC316F6B56B356D3986EBB1846E85E5D8D70AAAC07F2
SHA-512:	117CF2E52F9F5798E19A6D9CD90E525EAE5998BEBBB49C8F8B961E45AD0121CC24F1615214E3D9E35D7A581EDE7E29365ABBAE402FC2CD7715FF6828599AEAD2
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0}=.Q.n.Q.n.Q.n.).n.Q.n.9.o.Q.n.9.o.Q.n.9.o.Q.n.9.o.Q.n.9.o.Q.n]8.o.Q.n.Q.n.P.n]8.o.Q.n]8.o.Q.n]8.n.Q.n.Q.n.Q.n]8.o.Q.nRich.Q.n................PE..d...Yd._.........." .....d...D......................................................8+....`..........................................<...y..d....................E...................F.......................H..(....G...............................................text....c.......d.................. ..`.rdata...............h..............@..@.data....`.......V..................@....pdata...E.......F...F..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-86FV8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	646656
Entropy (8bit):	6.609281858827991
Encrypted:	false
SSDEEP:	12288:OglwOtpxXkR8AePKhBWvtUcvmfc1TnKGJfSBZHllBNlRCDddyNdtsprNE2:O4wOtpxXkR8AePKhBWvtUcvkc1qHlhlW
MD5:	59F908380C488F066D712014EEFF5BD7
SHA1:	CBA52F89D7E9087F694CB7D6958A80B6858EED75
SHA-256:	7F6FEAD1AA53772FD657D4462826E042B8F2049D3C3BBB493752F22B058F3A78
SHA-512:	D7E2E459B417B9C23CAAAE3843442048035DEF57F7ED679999EBFAD648E2455E0E6E0BC4FE229D62F7BDD7ED94D6C86156EE4CB7ED0A7C742F3B81CD2D3FFCDB
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....#f..........."...*............0...............................................],....`... ......................................p.......................p.../..........................................`<..(...................@...P............................text...............................`..`.data...`...........................@....rdata...x.......z..................@..@.pdata.../...p...0...J..............@..@.xdata...:.......<...z..............@..@.bss....@................................edata.......p......................@..@.idata..............................@....CRT....`...........................@....tls................................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................

C:\Program Files\CloudCompare\is-8GF8G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33264
Entropy (8bit):	6.210822520849061
Encrypted:	false
SSDEEP:	768:zSv+K3b4/Cfg+E2wkjk/+ZW8DT92r+dDGMUf2hKd:Wvm6XS/8FDTsr+PUf/d
MD5:	7E40B0FAA08E8F2AD78BE6698225E3E4
SHA1:	03332C56E4DCFEFC33BB731133BD3EF71C4CA9EC
SHA-256:	2212E66EADD559705E244409354ED264C286A3CAC7A3E511737C3D31E2A0F4AE
SHA-512:	A4C545A8B8DAAF6B4321BB51745454B77D1F591C7131F19FDD40BACD943D5074886037CEAE19E7F1515313B0F990E42A83520957CEDF056A39E1EC1E4AFD7272
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................o.....8..............8.......8.......8.......u...............u.......u.......u.........k.....u.......Rich............PE..d...G._.........." .........:.......0....................................................`..........................................N......hW..................h....f..........H... C..T............................C..0............@.. ............................text...}-.......................... ..`.rdata..."...@...$...2..............@..@.data........p.......V..............@....pdata..h............X..............@..@.rsrc................^..............@..@.reloc..H............d..............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-9564F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	102384
Entropy (8bit):	6.0152637062152445
Encrypted:	false
SSDEEP:	768:xivYT8++UTS1jFHI4XV+2my6cg4ydlgW935aoQL4AikNQsLedDGuUf2hI:YL3b1FHR+U6p4KlT9ESAimFLeFUfV
MD5:	AB650B8F02BF49D2FA1C015B8F9B5EE8
SHA1:	02A02BD474948E110FA8B25E21E3898776CACCA8
SHA-256:	32149ACD851FC37BDC5D1C39E84CCDB9AE4ECAC103BEC628E9C29450381C8248
SHA-512:	2A5C7AC3EB09B6F3CCCE3E150A84094CBA2EC1B3CE518F78CEBCE93564E505E42E609B338E9F2D0AD5BAC1A44D328CAA9E20D9082E8C46C988ADC9F4E256CAAD
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\e!...O...O...O..\|....O..kN...O..oN...O..kJ...O..kK...O..kL...O.tN...O...N..O.tJ...O.tO...O.t....O.......O.tM...O.Rich..O.................PE..d...<.._.........." ................0..............................................._@....`..............................................0...N.......................t..........x.......T.......................(.......0............................................text...{........................... ..`.rdata..............................@..@.data...8....p.......X..............@....pdata...............^..............@..@.rsrc................l..............@..@.reloc..x............r..............@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-96G17.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2240000
Entropy (8bit):	6.548212734365113
Encrypted:	false
SSDEEP:	49152:KJDs2vUNknXd2rb67z46BfyZtvqSI+Gr8Gs7Ts:7mnX9fyHrGps
MD5:	027AD255105FC361E9841ED8C696F7BD
SHA1:	06FD6FD68C0BCBB78AC9E7DC44172BB2F3865855
SHA-256:	F192C3BEA5F560166403114962F30E82F4EF14BF9DF1F0DFB7A06D45BC790080
SHA-512:	F27FA2F68FE3C4F7818D8B20BFCE230558CEC82CEA45856159B479CE83CA7300DC0D51FC30E98013A6C18563CAB5443825DEC5E06ECAEF1D3465FBB1134C77A4
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........K...K...K.....d.J.....~.I.....\|.I.....C.F.....B.I...F.~.I....Ih.N...K...>...F.C.....F...J...F.x.J...F.}.J...RichK...................PE..d...L..T.........." .........F......<........................................."...........`.........................................P. .P.....!.d....p".......!...............".\....................................4..p............ ...............................text............................... ..`.rdata..8.... ......................@..@.data....U... !..6....!.............@....pdata........!......>!.............@..@.rsrc........p"...... ".............@..@.reloc..\....."......"".............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-9MQ23.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	560
Entropy (8bit):	4.819890866613878
Encrypted:	false
SSDEEP:	12:jXlCrSbfJh+thGLD9nOAVDFexQjl5F+fJIzGIml2f:BCrSzJhWQ39OAVDFxjAJIyIM2f
MD5:	69C927B8C88EA2556CA7F0F201ED412C
SHA1:	C7E9CEB0568A5040EFC5D44CCE069453A414BE1E
SHA-256:	F32EC578A85CF99B4D1ECFA478499889F4155CA7B3B2920094F95DFA30516F26
SHA-512:	A3EB4CAEF5B5B1056AAB3ED87022A86CA662668BB8B73DEA2799908B47C2E53C68859567B33AB1B66A822CC2879BE3A834973EB2B01DB25125EE322473C4BC60
Malicious:	false
Reputation:	low
Preview:	// Before modifying this file, rename it 'global_shift_list.txt'..//..// You can place here sets of shift vectors and scale factors (associated to a name)...// Each set (name) will be displayed in the combo-box above the shift fields of the..// "Global Shift and Scale" dialog (this dialog typically appears at import time while..// loading a file with big coordinates)...//..// All values are separated by a semicolon character (;):..// name; shift(X); shift(Y); shift(Z); scale;..//..// Example:..//..// Ankh-Morpork ; -621900.0 ; -5114400.0 ; 0.0 ; 1.0 ;

C:\Program Files\CloudCompare\is-9Q3NC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18278912
Entropy (8bit):	6.415110000021905
Encrypted:	false
SSDEEP:	393216:EsQdvh76/JkvrxVY2Xkarvb1mTLlMGRhUU6DmA0viO/ilJ85EWlB/jBtLs:chU69GFrn/jBtL
MD5:	9B5689B0D551161AEE9D45FE6A438FCB
SHA1:	2C435765C66BA18086850EF532BBD08EAB755944
SHA-256:	79816E0BA8786690E2C1EE8758D6D64D2B583131934BE2F9E870736C54DA905E
SHA-512:	2193ABB629F1F04D4BFEEC4C74416C3E6D45572F9B02A29360FA08A19E17E0149B5A61BCADB92E0E409579C3B2DB08532E7CD2F5C82871D185B71B1616A94694
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........HJ.K)$.K)$.K)$....Y)$..x..L)$..x..F)$..x..O)$..x..A)$.$_..O)$....I)$....J)$....G)$.F{..X)$.K)%.+$.F{..7($.F{...-$.F{..J)$.F{..J)$.F{..J)$.RichK)$.........PE..d......Y.........." ..........l.....@.....................................................`.........................................Pm..u....M..h....... ....P...%..............0...................................pA..p............................................text............................. ..`.rdata....Y.......Y.................@..@.data...0...........................@....pdata...%...P...&..................@..@_RDATA.. ...........................@..@.rsrc... ...........................@..@.reloc..0...........................@..B........................................................................................................................................................................

C:\Program Files\CloudCompare\is-9V9PD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2697456
Entropy (8bit):	6.294325960113847
Encrypted:	false
SSDEEP:	49152:tYFO3e6YpwBhqben1GtA+6pf2v7+zxUZUM/SRCJg7E661CebH2DOz7JsFWRZ2:AUMyDO3Ji5
MD5:	17571E2B575C43E910C8308A447EFAA5
SHA1:	EE605C41D4F11F2E6C489F613D7907CD442F0813
SHA-256:	8A7DF7EA0CD8EAEB38D354E3F0B1118A530580F23ED933DDCF28547701F72C55
SHA-512:	A3F4F9B5FC3B25C8082B85B06858DEED2AC24111214317F263A4D51F2DB15522C7EAF12A4CBB5882406134135D8F1F771D8ACD4FF86F6B87CC1CE88772EC5154
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H..&...&...&.....&...#...&..."...&...%...&...'...&...'...&...'...&...'.R.&...#.s.&...&...&......&.......&...$...&.Rich..&.........................PE..d....d._.........." .........,......\,........................................).....}.)...`................................................h........P).......(.D.....)......`).X...............................(....................0...............................text............................... ..`.rdata..$:...0...<..................@..@.data...x....p'......R'.............@....pdata..D.....(.......(.............@..@.rsrc........P).......(.............@..@.reloc..X....`).......(.............@..B........................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-A4GQ6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	216064
Entropy (8bit):	6.0328472485055205
Encrypted:	false
SSDEEP:	6144:WxSpnOEgvfV8XO32ZHYHCct544Jd20dHUI/cGMnXOSIDOYvXUqiwrsAtj4hawtah:+jEo9t544Jd20dHUI/cGM6
MD5:	B23960264D44FC1F13250213106DC184
SHA1:	014D92C4DABA21E22D30435719477B6A146259AA
SHA-256:	7F7B6D425D87A7D8BBA1625CEDAAF0D9CC9B92AC9CA4ACA05B53820CD818A0D9
SHA-512:	45FA43135A66878B6E2B3352AF7DC13F9BC867F53067DBBCBB4A8AD6D7F7ED074EA60986F9E105C8896E8BF64C9089146124977CEF2AE5F6451FF562AD725A9B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i...`...a...;..~...;..a...;..k...;..m..."...k.......o......l...i.........a......h.....n.h......h...Richi...........PE..d......g.........." .....`...........O....................................................`.........................................0F...N...........p.......P..................................................(....................p...............................text...+_.......`.................. ..`.rdata.......p.......d..............@..@.data...p....0....... ..............@....pdata.......P.......*..............@..@.rsrc........p.......>..............@..@.reloc...............@..............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-AJ0MH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10633328
Entropy (8bit):	6.192336081640698
Encrypted:	false
SSDEEP:	98304:H7R37atBP0I6QGPuFnIG0rXM6xYQtDgLtRtVnnsdG:d7atBP0I6QGTGeM6xYR3nsdG
MD5:	6235580B1B5B7BE6CC64FDA77B06AEB8
SHA1:	F91D2194F25522D7DF16E08595FA9F78F2E11AFC
SHA-256:	B171C7FECAB2B4A717B5D6157A74069F45396958F60C3F892D0431E96D6E95A1
SHA-512:	629EFA682B08BCF1BFE27A496DCD43F00007BC160A96C520FC71B61BF7F668F7BCC4CC08E3A02367B65710E080948697FA7D7FCD5916C48B18834A243CB23D0D
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g....p...p...p..~...p...q.H.p.CH...p.....p...4.p...n.p.....p.....p.....p.Rich..p.........PE..d.....Zg.........." ......z...'......uM...........................2.................U.....@.........................................P..H7..l..d.......................p......@e.............................(.....................{. ............................text.....z.......z................. ..`.rdata........{.......z.............@..@.data...D.... ...P..................@....pdata...............N..............@..@text....q....P.....................@.. data.....A...`...B..................@..@.tls.................8..............@....rsrc................:..............@..@.reloc..F...........@..............@..B................................................................................................................................................

C:\Program Files\CloudCompare\is-BU6NB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	18416128
Entropy (8bit):	6.683302926545402
Encrypted:	false
SSDEEP:	196608:zMYiFS3ke63qeMs+eBH0Xbr8EYriPyv81djl1xV57VB:zMa3kLBH0rr8EYriqv4dRN5f
MD5:	36A0558B4768FC872970E6DF3D80E344
SHA1:	567EB56023D3CE1676B30F1087C3BB6182CFDAB0
SHA-256:	8154BAA7A6C1DFEAD2CB0EB27FEAF9568BD2AAABA0F53A6AAEE75705BF807E3A
SHA-512:	32B0EFD65869A622AAF12451D234A49DE4B159B07297813A72B9019BB56EF0D990C9308630262C5FB4C73455A04B0CC46CB81B828BA627B93B120DBF3283FB3C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....#f..........."...*............0.........................................&.....\.....`... .......................................#.(.....#..z....$.........@.............$.\|h..........................@<..(.....................#..............................text..............................`..`.data...............................@....rdata....9..P....9..6..............@..@.pdata..@...........................@..@.xdata..H~...........z..............@..@.bss......... ...........................edata..(.....#.....................@..@.idata...z....#..\|..................@....CRT....`....`$.....................@....tls.........p$.....................@....rsrc.........$.....................@..@.reloc..\|h....$..j..................@..B................................................................................................................................

C:\Program Files\CloudCompare\is-CRC3K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	324096
Entropy (8bit):	6.3377399185673235
Encrypted:	false
SSDEEP:	6144:FBgyWUu11adMCSxB8zPMc4UvH1gjSnSapcWAAEJTfSQSg913ieVSuQMsPcZwf:FBgXj11tC/PMcWapcbAoTfv130b5f
MD5:	8B7BB6C392EAE81F3B4F0A5638BD50E3
SHA1:	54AC8ACA96234D59BDC8AE2F800185E48F50CAAE
SHA-256:	B85A49A23BD8A554F7ED475A8817C5E027853A86B3D94BA4DCF4EFB9109D2579
SHA-512:	87B8E4CE2F414CCA07AF6EA10337A04D37C8243BF62BF092812A5406A546AD92F08EC572BE8D683598C8EC1DFD1AA55D50C17BA80243469833D896DDA1DDE70C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...in.Zin.Zin.Z...Zan.Z/?.Zkn.Z/?.Zkn.Z/?$Zen.Z/?%Zkn.Zd<.Zon.Z...Zln.Zin.Z{o.Zd<$Z.n.Zd<.Zhn.Zd<.Zhn.ZinSZhn.Zd<.Zhn.ZRichin.Z........PE..d...!..T.........." .........<......\........................................@............`......................................... ...c............ ...........3...........0.......................................t..p............................................text.............................. ..`.rdata..............................@..@.data... ...........................@....pdata...3.......4..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-DE3LQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	848624
Entropy (8bit):	6.226073557201281
Encrypted:	false
SSDEEP:	12288:glSRkt/ADhUy1qHvH5Bv+lO5h6n288n7BDtxThD+10:g4Ryy1qHBBv+l668n7jxm0
MD5:	09384FAE658A7566655E76C32DDEF653
SHA1:	FD16FD1A7504EFA9B1A17FDDE897141985271F32
SHA-256:	4448C09C7A0CF3A18DBCA33C7F889CD36D5192D668EA2ACBB4A4E65261F731AD
SHA-512:	52DE1C06DA4E2D3DD5F570A06E87F3AB703FC4578CE7D14A68108EE6BE7DD1563D1785BC8DAF107BCC18D7073C10CE45C2B06968FE3249322C431C06C8CE6295
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........c...........................................,.......4...,......,.....,.........,.....Rich............PE..d....d._.........." .....>...........\|....................................................`.....................................................@................M.................../.......................0..(..../...............P...............................text...L<.......>.................. ..`.rdata..N....P.......B..............@..@.data...x2...`...(...L..............@....pdata...M.......N...t..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-DG0J0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1575936
Entropy (8bit):	6.522022448413462
Encrypted:	false
SSDEEP:	49152:qSY0LA3zwiZzjs9nyFHV1Q62ThDAQp7/VqPVcuP:ahAThDAQpuVc
MD5:	21BF4638E5ADA899A43AC322BAC4600C
SHA1:	9BC1D6E44E14314C6B002436D4EDB9B7F8A51FB6
SHA-256:	AEE3F7C3EF4477D46F9CD65B00BB2EBAA23C2EDE84D60027102F97F3463542D5
SHA-512:	DDDC9A5EB060D82F8C3741E1F2241924DFD00A15A29D3EB00B0F87B38A34E0063E0B885E41F892A7966D28F5379A71D8BDD9DA434FA14B278672F64328540F5E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!..=e..ne..ne..n#.0ng..n#.2ng..n#..ni..n#..ng..n..&nn..ne..n...nh.2nd..nh..n"..nh.1nd..nh.6nd..nh.3nd..nRiche..n........................PE..d...[..T.........." .........j...... ........................................`............`..........................................Y..Q...............@.................... ..8?..0...8...............................p............................................text............................... ..`.rdata.../.......0..................@..@.data...............................@....pdata..............................@..@.rsrc...@...........................@..@.reloc..8?... ...@..................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-DMGNO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1304064
Entropy (8bit):	6.3870556331947235
Encrypted:	false
SSDEEP:	24576:hgar8jZShGQRO0mENxPM6LQtscfMlYiupJjpm:Lr8jZdELPM3jfMlYiuzpm
MD5:	CC559D3B8F1F0691DF94A76C5E869D16
SHA1:	4CA778423A255EA2F2269E18DDD7AE449E4FB32F
SHA-256:	E3DE026BF30FD187C3A893B8489CCD49C265F0747D38BCE0C94782A622D2B9B2
SHA-512:	C40516DBAD6E3EC3110A5A078F70F8C525C08CE45F159C1F83D2AC259BD74050A516D7808ECDDD2175343DB6D6945C4286B7FD32EE1F2B96C84A7BE41A2D9A04
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........UbP.4...4...4..e....4...e...4...e...4...e...4...e...4..&....4...4...4...f...5...f...4...f...4...f...4..Rich.4..........PE..d.....T.........." .....\|...p...............................................@............`..........................................3..........P............@............... .........................................p............................................text....z.......\|.................. ..`.rdata..<R.......T..................@..@.data....C.......:..................@....pdata.......@......................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-E67D7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3024000
Entropy (8bit):	6.401341683892991
Encrypted:	false
SSDEEP:	49152:gLJwSihjOb6GLb4SKEs3DyOMC2DlUt0+yO3A32ASNTvuS:cwSi0b67zeCzt0+yO3kS/
MD5:	CA9D0BC1FC3C0AEBE22047A2DCBCD715
SHA1:	8DF8054C0F3A9969493D74001AE6C6815090BB48
SHA-256:	69FEBFE8BB5D272CE0A488B1C4C7BF2C3CEAD22410F7E907681635DDD910EF42
SHA-512:	75D8B8811B736C6AF7802194508979209E34B6357662902456687E83FE348DE422B37A96A52B336448B9EE22F1B43D7C7B7266F67D9000B663F24CFE989F81AE
Malicious:	false
Reputation:	low
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...p.._.................$,.........P6,......@,...@.......................................@......@....................-......`-.49....-...............-..&....................................-......................i-.......-......................text...P.+.......+................. ..`.itext..t(....,..*....+............. ..`.data.......@,......(,.............@....bss.....x....,..........................idata..49...`-..:....,.............@....didata.......-.......,.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-.......-.............@..@.rsrc.........-.......-.............@..@......................-.............@..@........................................................

C:\Program Files\CloudCompare\is-EHH64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	330736
Entropy (8bit):	6.381828869454302
Encrypted:	false
SSDEEP:	6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR
MD5:	03761F923E52A7269A6E3A7452F6BE93
SHA1:	2CE53C424336BCC8047E10FA79CE9BCE14059C50
SHA-256:	7348CFC6444438B8845FB3F59381227325D40CA2187D463E82FC7B8E93E38DB5
SHA-512:	DE0FF8EBFFC62AF279E239722E6EEDD0B46BC213E21D0A687572BFB92AE1A1E4219322233224CA8B7211FFEF52D26CB9FE171D175D2390E3B3E6710BBDA010CB
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............_._._..*_._,.^._..^._,.^._,.^._,.^._a.^._._=.._a.^._a.^._a.F_._.._._a.^._Rich._................PE..d......_.........." .........................................................@.......^....`.................................................((....... ...........0...........0..H...xL..T....................N..(....L..0............................................text............................... ..`.rdata..p...........................@..@.data...8...........................@....pdata...0.......2..................@..@.rsrc........ ......................@..@.reloc..H....0......................@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-F0B2H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	82336768
Entropy (8bit):	6.709624515309904
Encrypted:	false
SSDEEP:	1572864:KiySAJLva8soisRmwdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfagAoCFh4:KiySAcsc
MD5:	DC7F54B9AC3196E0D0775FA80F0FB6D9
SHA1:	475C7CB7CF74FA6014F12A26D169718FC5C377D5
SHA-256:	608C17870EA5F801959859639207F2A4DE581F16FD78C7BBD67E7B42377EFFFD
SHA-512:	5232D8993177281D7650C22D8E15EEA0DF58D6A70A7279EDEC28E53A94BA764DEB210A32FE963320EDC571CE9D24CB90A3AC4882E5009DAEE191A3AB957CB00E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....#f..........."...*.....X......0...............................................r.....`... .......................................\|.=$....\|..\...P}..........?...........`}..a..............................(...................@.\|..............................text...P...........................`..`.rodata.0`.......b..................`..`.data...@....0......................@....rdata........$.......$.............@..@.pdata...?.......@...r..............@..@.xdata..T...........................@..@.bss.....................................edata..=$....\|..&...n..............@..@.idata...\....\|..^..................@....CRT....p....0}.....................@....tls.........@}.....................@....rsrc........P}.....................@..@.reloc...a...`}..b..................@..B........................................................................................

C:\Program Files\CloudCompare\is-F27EN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1340400
Entropy (8bit):	6.41486755163134
Encrypted:	false
SSDEEP:	24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI
MD5:	3569693D5BAE82854DE1D88F86C33184
SHA1:	1A6084ACFD2AA4D32CEDFB7D9023F60EB14E1771
SHA-256:	4EF341AE9302E793878020F0740B09B0F31CB380408A697F75C69FDBD20FC7A1
SHA-512:	E5EFF4A79E1BDAE28A6CA0DA116245A9919023560750FC4A087CDCD0AB969C2F0EEEC63BBEC2CD5222D6824A01DD27D2A8E6684A48202EA733F9BB2FAB048B32
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........Yt..7'..7'..7'...'..7'..3&..7'}.3&..7'}.4&..7'}.2&..7'}.6&..7'..6&..7'0.6&..7'..6'c.7'0.2&2.7'0.7&..7'0..'..7'...'..7'0.5&..7'Rich..7'........................PE..d....._.........." .................................................................c....`......................................... ....n..,...h....................X..........,.......T...................p...(...@...0............................................text...C........................... ..`.rdata...g.......h..................@..@.data...XN...@...2... ..............@....pdata...............R..............@..@.rsrc................>..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-F8008.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4072960
Entropy (8bit):	4.29892941159376
Encrypted:	false
SSDEEP:	24576:kurEhBFeA9Yocw4I3UX/Q6keuzbkLnqJFzTUbRBZxzf1fkG8qkUfT6T36S7cLqRd:kTgA9YIU03nzTABZR1f4/oT6TKZLqRd
MD5:	BBB1E3F824CCC683CFA76D66ABB815D3
SHA1:	A648215F3F8610BB79BE1DC2A291A7CA80B0C688
SHA-256:	F6ABC1333233A2B9B93312F2531AF32250BDC9DC3A337CDB3E20F6B4E3895476
SHA-512:	E32DF05E32C1DB5E2AF3B8EF567DFC4D5BCD43BE9C52BAC5B4FB8DD8B778E5A7B8D519AB18AAAA85EAB1B3A5D5E1239DCD107B578F9215BF99B7540268BD034A
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7..s...s...s.....`.t...5.F.K...5.G.....5.x.`...~.F.]...._l.z...s......~.G.....~.{.r...~.\|.r...s.0.r...~.y.r...Richs...........PE..d......T.........." .....f....<.....`.........................................E...........`.........................................p.6.n...."6.d....PE.`.....D..n...........`E.@2.................................. =5.p............................................text...xd.......f.................. ..`.rdata....-.......-..j..............@..@.data...x....@6..`....6.............@....pdata...n....D..p...~=.............@..@.rsrc...`....PE.......=.............@..@.reloc..@2...`E..4....=.............@..B................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-FVJ9O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2326768
Entropy (8bit):	6.265149852539151
Encrypted:	false
SSDEEP:	24576:yPf0xVJnPKKuk6Fcg0UR/GHLv/8Cncx60IBSdDq75z8KIVZDba7JpNVs2SRPX:yPoJCKuJFsUR/m09IB8cuKIL/QJpNYR/
MD5:	FDDCFABB82A4BDF771B9C8504DEF8211
SHA1:	FA28EAF5D24A510A53CA3739BB533A5EBA200FF3
SHA-256:	B0F29826C1EC3AC4C8FB781D153084018ACE637FB7085FFA525483BCBF144FDE
SHA-512:	D3DFBF7524F2F0A4597FCE9E1D59AA393485FE1D0DF400DA176BE4D76C628D1D47C2AE9038B908BF6C487B4F66083E586C3AA1023D6D16F4CCDC270C272415A8
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d>.. _.. _.. _..)'a.(_..r7..(_..r7..#_..r7..;_..r7..$_..{7.."_...6../_.. _..[...6.._...6..!_...6..!_.. _e.!_...6..!_..Rich _..........PE..d...1d._.........." .....z..........Xw........................................#......j$...`..............................................>...=!.,.....#......."......d#.......#.................................(.......................P$...........................text...vy.......z.................. ..`.rdata...............~..............@..@.data....Y...p"..P...Z".............@....pdata........".......".............@..@.rsrc.........#......N#.............@..@.reloc........#......T#.............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-GBVP7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	150016
Entropy (8bit):	6.153853842832493
Encrypted:	false
SSDEEP:	3072:795pD8/5DF369YVKIf/AihiUNS1ZHGQJImIQaya9bmMAznIcH6KkeNWi3uRNWONp:79n8/5o9YVK4WSmQ9lSHfkM
MD5:	4CC6FC8AA81C763F819EB171A72B0755
SHA1:	A795938F6A3A6878B7125C037E92CD64592BB9BE
SHA-256:	B6DE4A001F659EDDCFB2E0E818AACD4BD0BB687EF1EB316E682CC6955C2B6178
SHA-512:	15955838CC3C81A970A5DAE2805567BDC101B9B9FEA310316EBE115944E5492DA450BECCF14638BE81D8E3F49196E201415909181A0FD70774B339F2E0051B09
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.N...N...N...._.H......M......L.......B.......L...C...n...C..J......B...N.......C..O...C..O...C..O...RichN...................PE..d....T.........." .....\|..........t.....................................................`.............................................#............`..(....@...............p..,.......................................p...............P............................text....z.......\|.................. ..`.rdata..<...........................@..@.data...0.... ......................@....pdata.......@.......&..............@..@.rsrc...(....`.......@..............@..@.reloc..,....p.......D..............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-GD96M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	180736
Entropy (8bit):	6.4689591835949
Encrypted:	false
SSDEEP:	3072:3RZCni3L3TP4OKFE+rtuiNFEPj43AQsnA1Tg08fC7jqC5UouCGZCktTiNTqtOuK+:vCni73TgOKi+RzGr43AQsnAF5IWswPw
MD5:	EEA12E88CF534F41963EDAD1522D8802
SHA1:	9AF546CCE2DCC16EDDF3B517D89D35E51990DCD6
SHA-256:	18F3E0E9C7C84666C4D738247D607065CDE890569CEB621CFC95DE77AA8ACEF3
SHA-512:	F917F1655D9371A1D5A026677DFBE5B8EAE6FF69528253F36CAE468546A952733DBB159566240158A9608256383A92A8E64545522612E93ACC3BDB83EBBE045B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{bZ..1Z..1Z..1...1X..1.d.1[..1...1[..1...1Q..1...1X..1.;.1Y..1Z..1k..1W..1I..1W..1[..1W..1[..1W..1[..1RichZ..1........PE..d...a.T.........." ................`.....................................................`.................................................P...<...............\....................................................a..p............ ...............................text............................... ..`.rdata...w... ...x..................@..@.data...............................@....pdata..\........ ..................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-GMPDH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2577648
Entropy (8bit):	6.18813475149753
Encrypted:	false
SSDEEP:	49152:3CGX7lSpFVYjlpLkiEtxcnPOjk91JQagBeqcMr8Trq9b:VsNrd9b
MD5:	108A3C3D5C16D20DB13B6800670BFC54
SHA1:	A23BA534B81502712956147185B1F15C2E2E80E3
SHA-256:	5A558E3AE5762EBFF3AB15A5B60FE4F45AA05EEC4A292EDBB1A2FE5E9A4AE605
SHA-512:	B04C83CF22416F92214CE8213E7AF841BE5952091245A6844E92028D8C9C88C319C3596A335CD2E345DDEEE9A42EAAB702B5F5336E6A2CA8F74BF98782B61938
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^.<X?.oX?.oX?.oQG=oP?.o.W.nA?.o.W.nP?.o.W.n[?.o.W.n\?.o.W.nZ?.o.V.nI?.oX?.oF;.o.V.n7?.o.V.nY?.o.VQoY?.oX?9oY?.o.V.nY?.oRichX?.o........................PE..d...Ud._.........." .....L..........@........................................p'.....\.'...`...........................................#....`?%.@....P'.......&.....8'......`'.`........................... ...(... ................`.. !...........................text....J.......L.................. ..`.rdata..@....`.......P..............@..@.data...(F...`&..:...N&.............@....pdata.......&.......&.............@..@.rsrc........P'......$'.............@..@.reloc..`....`'......*'.............@..B........................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-JJ5J0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	149488
Entropy (8bit):	6.116105454277536
Encrypted:	false
SSDEEP:	3072:4sSkET6pEXb3loojg1Q2sorWvZXF2sorrLA7cG27Qhvvc:4sSd6pwzloDbsnX0sCrc7ct7QVc
MD5:	A016545F963548E0F37885E07EF945C7
SHA1:	CBE499E53AB0BD2DA21018F4E2092E33560C846F
SHA-256:	6B56F77DA6F17880A42D2F9D2EC8B426248F7AB2196A0F55D37ADE39E3878BC6
SHA-512:	47A3C965593B97392F8995C7B80394E5368D735D4C77F610AFD61367FFE7658A0E83A0DBD19962C4FA864D94F245A9185A915010AFA23467F999C833982654C2
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'`.CF.KCF.KCF.KJ>.KGF.K.).JAF.KW-.JAF.K.).JVF.K.).JKF.K.).J@F.K.6.JFF.KCF.K.G.K.6.JPF.K.6.JBF.K.6.KBF.KCF.KBF.K.6.JBF.KRichCF.K........................PE..d......_.........." .....$..........t(.......................................p.......5....`............................................."..l........P.......0.......,.......`..L...hw..T....................x..(....w..0............@...............................text....".......$.................. ..`.rdata..z....@.......(..............@..@.data...x...........................@....pdata.......0......................@..@.rsrc........P......."..............@..@.reloc..L....`.......(..............@..B........................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-K8E7Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.544702627865242
Encrypted:	false
SSDEEP:	768:TLAqRG/xoIUEVsaZ69deagBin87Z2c4AbGP:TK/xotEVtZ69kagBin87Z2cfGP
MD5:	C960C48DE097FD3C2BA3B43C095CE388
SHA1:	A4551EEF2EBA4A4EE4A6EC83A5953F63CE3BE0C6
SHA-256:	1D0F01ED76CE83AC277BF2260575FE47F3910E2CBA4C5A26F90F811E902962D9
SHA-512:	A3ACD232B28922C4C40A9BE09C002445E6384119A2937361E1C7ADA577924C6CB7B40053A06D9F433CE5660AFEFF5EC23853304C1102BAA45ED8B49583461183
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........G.............................................................................8......8......8.l.....8......Rich............PE..d....2Kg.........." .....4...R......L4....................................................`..........................................m......8x..................d...................0\..............................P\...............P..p............................text....2.......4.................. ..`.rdata..&<...P...>...8..............@..@.data...8............v..............@....pdata..d............z..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-KMJ88.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	332568
Entropy (8bit):	6.217408928777197
Encrypted:	false
SSDEEP:	6144:tlBybiGsY4lxA6c40PMjoTrDPbv+Xipv6wfnWzgcpw2eRJ:tWbzsBcPPlbxpvIzQT
MD5:	1028995446D0032530461BE30CA98F48
SHA1:	18446678152E9997EED9C02995F957D58A8E8F32
SHA-256:	D404B49C25CC76DC4C86E1D82FC23799482F6509E85A73ED8177EFC320EC0195
SHA-512:	ADB9AE577F082E0246CAE5C804FA4CD08BCF54CE78EACA02D49B9B1B262779667A251E98CAE807AFF50FDAC504B8CD855CE4D786F587D02E0A18F6AC8E0D882E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\...2Q..2Q..2Qo..Q..2Q..Q..2Q..3P..2Q..3QR.2Q..6P..2Q..1P..2Q..7P..2Q..2P..2Q...Q..2Q..0P..2QRich..2Q........................PE..d.....0].........." ................................................................b.....`A........................................P....M..\Z...................6.......A......\|...@l..8............................l..................`............................text............................... ..`.rdata...k.......l..................@..@.data....9...p...2...V..............@....pdata...6.......8..................@..@.rsrc...............................@..@.reloc..\|...........................@..B................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-LIKHT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	898048
Entropy (8bit):	6.498739548040389
Encrypted:	false
SSDEEP:	24576:mdk0Ytz7DREjBqXwuAOL7fjiV8t6f5xl4o9DCf:71tvDREjB01AOL7fn6fTeo9DM
MD5:	425A907E436D0FF71889DA0BF481DDD6
SHA1:	50D34868FADA4D532219F5B5252933757DAFFE04
SHA-256:	E4434FCF8C9DB1C3A09D4585B3AB4C47C6C6071A6117875544347068EEC84FF1
SHA-512:	E0F4938444DAE10DE8B47001482B4F5441BDB3C14D3AFB672A8D87B41756C9B6A28CFF643755A03E2A0F4F3CBC341A9FA34586B7A6B6DE4A9CC479D49BE1B9BD
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$...`...`...`....U\.c...`.......&.v.@...&.w.....&.H.j...m.w.a...m.K.a...m.I.a...Rich`...........PE..d...._.V.........." .................&....................................................`.........................................@^.......y..(............`..L............... .......................................p............................................text...=........................... ..`.rdata..............................@..@.data...8............r..............@....pdata..L....`......................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-LNQRQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7008240
Entropy (8bit):	6.674290383197779
Encrypted:	false
SSDEEP:	49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
MD5:	47307A1E2E9987AB422F09771D590FF1
SHA1:	0DFC3A947E56C749A75F921F4A850A3DCBF04248
SHA-256:	5E7D2D41B8B92A880E83B8CC0CA173F5DA61218604186196787EE1600956BE1E
SHA-512:	21B1C133334C7CA7BBBE4F00A689C580FF80005749DA1AA453CCEB293F1AD99F459CA954F54E93B249D406AEA038AD3D44D667899B73014F884AFDBD9C461C14
Malicious:	false
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......QH^~.)0-.)0-.)0-.Q.-.)0-...-.)0-.F4,.)0-.F3,.)0-.F5,.)0-.F1,.)0-.Y1,.)0-.B5,.)0-.B1,.)0-.)1-m,0-.Y4,.)0-.Y5,\|(0-.Y0,.)0-.Y.-.)0-.).-.)0-.Y2,.)0-Rich.)0-................PE..d....._.........." ......?...+.....X.?.......................................k.....R.k...`.........................................pKK.....d.e.\|....`k.......g.......j......pk..6....F.T................... .F.(.....F.0.............?.p+...........................text...2.?.......?................. ..`.rdata...z&...?..\|&...?.............@..@.data....o... f.......f.............@....pdata........g.......f.............@..@.rsrc........`k.......j.............@..@.reloc...6...pk..8....j.............@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-MF4VL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1674992
Entropy (8bit):	6.693921548534279
Encrypted:	false
SSDEEP:	49152:v0BOonBew9Ic4GrEoh9ald5RYaHOakyGCgKqHUWleD/SSrWZp:MnnrmvzgAXgp
MD5:	8AE454F4BF46749D2E326E66934BFC39
SHA1:	8998065CC8331982EB1DC7FA369BA366E114B302
SHA-256:	3CA6E5F349545FE2F7A11617CB082F4B60EF373A2702FA24CF4C2F88D8C5EA8A
SHA-512:	CBC35391B1C3FF074111B565BCF2CCE0D6C2C010FE2B4CE245531E33702F4B0F9538CB4B23AFBF632B1A18A0C176305491258DD678D08605957D0186DE38C98B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................!%E.............................................L.....o.................}...................Rich............PE..d....c._.........." .....4...L......ps...............................................?....`..........................................3...K..T........................r..........l... ;......................@<..(...@;...............P...............................text....3.......4.................. ..`.rdata...^...P...`...8..............@..@.data....A.......0..................@....pdata..............................@..@.rsrc................\..............@..@.reloc..l............b..............@..B........................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-MV458.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2214912
Entropy (8bit):	6.384721005949699
Encrypted:	false
SSDEEP:	49152:ia4lRuO7XhnHmm4HjrbUABSEIS0Al2wIiXXo:vP8wbX
MD5:	DBF3283EE74FACA95837DF0499F2769E
SHA1:	A616D088099D914356AFACB1CAD9D7FD6577838A
SHA-256:	C1D5952D8C1D258866AD7AA8C4A34E98E3953492093E39B651A8EEEB7B3C2911
SHA-512:	A6F928A7C3DCE1F3EFD344ADB31F495E9ACEDAD2735329D9CD26705460F4A1150AFC05B457B7B9166CDB0C2A9F34850FF2FCEBB495A2879AA65D5354F3A7FD52
Malicious:	false
Reputation:	low
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......>.4.z.ZMz.ZMz.ZMs..Ml.ZM..My.ZM(.^Lr.ZM(.YL~.ZM(._Lg.ZM(.[L\|.ZM1.[L}.ZMz.[MN.ZM.._LZ.ZMz.ZMa.ZM..^LB.ZM..^Ll.ZM..RL{.ZM.._L6.ZM..ZL{.ZM..M{.ZM..XL{.ZMRichz.ZM........................PE..d...p.Uf.........." .................K........................................$.....Uj"...`.........................................0W...P.....@.....#......@"...............$.....h6..T....................8..(....6..8............ ..@............................text............................... ..`.rdata....... ......................@..@.data...@S.......~..................@....pdata.......@"......:..............@..@.rsrc.........#.....................@..@.reloc........$.......!.............@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\is-N98JH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85784
Entropy (8bit):	6.594110245111798
Encrypted:	false
SSDEEP:	1536:U3qPWvVCMgfw2eeWqjOebgk0jIpePxd76LGYU8j6ecbolG8EB4h88ii0:U66dsFeeBGPj1L6LGY+ecboC/8ip
MD5:	1453290DB80241683288F33E6DD5E80E
SHA1:	29FB9AF50458DF43EF40BFC8F0F516D0C0A106FD
SHA-256:	2B7602CC1521101D116995E3E2DDFE0943349806378A0D40ADD81BA64E359B6C
SHA-512:	4EA48A11E29EA7AC3957DCAB1A7912F83FD1C922C43D7B7D78523178FE236B4418729455B78AC672BB5632ECD5400746179802C6A9690ADB025270B0ADE84E91
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ZWB..6,..6,..6,.....6,..N...6,..6-.26,.L^/..6,.L^(..6,.L^)..6,.L^,..6,.L^...6,.L^...6,.Rich.6,.........................PE..d.....0].........." .........R...............................................P......<.....`A............................................4............0....... ...........A...@..t...P...8............................................................................text.............................. ..`.rdata...6.......8..................@..@.data... ...........................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..t....@......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-NKH37.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	342016
Entropy (8bit):	6.124318304938587
Encrypted:	false
SSDEEP:	6144:vSqToXHt3rCtyUh3tizLg0SKiKxKDxrPnowU8s/bOgYP/8nU9EqTBD70eIzFvP6t:vSEoXHt3rwyUh3kz80SKVxKDdvowUj/C
MD5:	CE7CFCEA2D533B47372AC342E0BC56A3
SHA1:	ACBF16636AB30277983FED1E0401A9439CA1CF83
SHA-256:	AC6FD3101AC471A007693444153F7796ACD427C4B5E91BFEBCF015F0B95C6C08
SHA-512:	134ACDB8EF1828074D145FACA41EA4BA269BAC0C038B24BAAC9A955D78557E290DCEDD727FCCE29D772D51E5763B8ED5BCB4AFA96C21209FF73BDF4242F0E4F3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.P...>...>...>..?....>.Y.....>.Y.....>.Y.....>.Y.....>.......>...?..>.....0.>.......>.......>.......>.Rich..>.................PE..d...q..T.........." .....v...........}....................................................`.........................................@...p$......P....`..@....0...&...........p..L...P...8...............................p............................................text....t.......v.................. ..`.rdata..............z..............@..@.data...p....0......................@....pdata...&...0...(..................@..@.rsrc...@....`.......&..............@..@.reloc..L....p.......,..............@..B................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-NUL4B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3815664
Entropy (8bit):	6.407256607167561
Encrypted:	false
SSDEEP:	49152:+/uSVZLrvrTX30234JyyeZBzswYE9/EtYqJ9er/2CFCpJq:+/FpZBzOmr2CMpc
MD5:	9B65E7DC2CF1D85C62CF858E45B74E79
SHA1:	9ECFABE63716F9F270F2DC15BA2DB189BDAE7ED9
SHA-256:	9628E99890E59FDC11A6AA6351CEE7EFCC0AB96DB1A5A75B0EB986A5A64D14ED
SHA-512:	EC0F1B3D537AF6C7FD3C75E89A187BAAA15700E9A35D871636AED4B202C5AE7F800174EB2F3262ED90CEA8450ED15EADB69D89709F339C02610DEC60689361B2
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P.m.....................F.......F.......F.......F.......O.........................y................................Rich............PE..d.../d._.........." ................u'......................................`:......0;...`.........................................pV3..#..\|y7......0:......09.(.....:......@:.X...@0,.....................`1,.(...`0,..............0..&...........................text...6......................... ..`.rdata..J....0...... .............@..@.data...0`....8..T....8.............@....pdata..(....09.......8.............@..@.rsrc........0:.......9.............@..@.reloc..X....@:.......:.............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-O99L5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	731376
Entropy (8bit):	6.179937626354653
Encrypted:	false
SSDEEP:	12288:r+VjdxvoKGf8vRRjggGQiaaNaRn+LEk33zTL5XcqNO3rX6/3TW+17T+SrdqJzUXZ:r+Vh9UkvRRjggb/aI+LEuBJpdq1YZ
MD5:	6AC7AA6A96EBB68D537099127715E551
SHA1:	343CF0E56413973A89FE82652A69FA9FE756E4B7
SHA-256:	DCD64A0F526F2B42D3052B239900D46FFE5D081F9C456A770A770A153AD4187D
SHA-512:	7E194AEFF72EE3632CBE8AB8D0A988A025B7780A3B3EC8729817E3C468B63BF9C0DE9B82C4BE66D8BD96FC4D091B8C06AD912A19CDE0D76DA2649BA226F84083
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .2}dp\.dp\.dp\.m...bp\.6.Y/\|p\.6.X/lp\.6._/fp\.6.]/`p\.?.]/fp\...]/cp\.dp]..p\...Y/Cq\...\/ep\.....ep\.dp..ep\...^/ep\.Richdp\.........................PE..d....d._.........." .........,.......f.......................................P......*.....`.........................................P........G.......0...........E...........@.............................. ...(... ...................P............................text............................... ..`.rdata..X~..........................@..@.data....S.......B...r..............@....pdata...E.......F..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-OHVSP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1728752
Entropy (8bit):	5.177332416676532
Encrypted:	false
SSDEEP:	12288:XjIJQx+Njd+rxP+vzLCqq98daeRsu+y9RNiZSMsV2JNs04Wchnn9c7gQ7vDorJap:Tf+Ncx2zLCqiOaEL9biZ6MJNQ8orSUk
MD5:	3539141FFDA9CAE0C77131AEBA50A114
SHA1:	EA31877537A80E499C33811C10C66314D0C51B04
SHA-256:	047DFADDB4285896FC4AE8905114F9FE5808868B94CA34828FBDFC42135C747B
SHA-512:	9703E1BB77065773953C1F946786D661158D8DDF4DD07AC2E5C9673C87DB0198AFB6FA737BF0BDFDF7F5BA5A6FC1F6AA8E3B4DF4A2D635DEB79F9C9D0BE1F6DC
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=..y...y...y...p.6.m....'b.x...+..q...+..z...+..d...+..}......}..."..p...y..........x.............x.....Z.x...y.2.x......x...Richy...........PE..d....c._.........." .....z...<......`................................................,....`.........................................p.......T...\|............@......D...................................... ...(... ................................................text....x.......z.................. ..`.rdata...............~..............@..@.data....#..........................@....pdata......@......................@..@.rsrc...............................@..@.reloc...............4..............@..B........................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-OL3SL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2117872
Entropy (8bit):	6.289461121862461
Encrypted:	false
SSDEEP:	49152:MQ1PhsCh07gUJLD1y9Ez64XBOMSeMxHwdeLz/4pBbfqR+z6Yb7vQ1f5Ppm7HcIhp:w9Nr
MD5:	FEDAE2A00AEAA26418123C7607F8913D
SHA1:	112E8FEBD96880D7DF3EBD034AFEBF52A905B25F
SHA-256:	A96F624E8AD557F28A35C2B08CC238F4760FF73117932C473EB6AC94359B4D00
SHA-512:	10BD032039CBF8427B8FA97860D226360C10F1419AA48720474F49DD2BDB7CD5972A2C776CFA369D429FE957BE617A01E7999ABBE9C6E585BDFB7B9F005BBBCE
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................V...............................5........ ..5......5.....5.:......R....5.....Rich...........PE..d...Xd._.........." .....,..."................................................ .....p.!...`.........................................`5...h..X...\|....` .........(....4 ......p .....`...........................(....................@...............................text...@*.......,.................. ..`.rdata.......@.......0..............@..@.data....l.......P..................@....pdata..(............F..............@..@.rsrc........` ....... .............@..@.reloc.......p ....... .............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-ORCGS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	123632
Entropy (8bit):	6.284281913194961
Encrypted:	false
SSDEEP:	3072:/SfUojZOKNl/EYtExUOpyMZ7VnHFcDbOdKO4:/SsYZOK7cxtpyMJFHFcDbO8O4
MD5:	F6B28E1272214B3B7134D792CE38F956
SHA1:	81767B15ADC49BA1E9CF16498D3E6D20CA93FF40
SHA-256:	EC3298F6A7BDE1D4CAB59BA629BBEE87A322D0EFDC8A59D87FF6D406240407B1
SHA-512:	4A40CD3320512D19B9F63C793351DC9A374615E8BA6EAFAD2AE7A1C6D9A92A152106FBB5F96AB01ECE3D87CBA4C5FD050524DCBE4842F4E12D5B2F09D778052B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............T...T...T.eT...T...U...T&&=T...T...T...T...U...T...U...T...U...Ti..U...Ti..U...Ti..U...Ti..T...Ti..U...TRich...T........PE..d...LE.W.........." .....$..........(&.......................................@............`......................................................... ..@................"...0......0Y..T............................Y...............@.. ............................text....#.......$.................. ..`.rdata...K...@...L...(..............@..@.data....P.......$...t..............@....pdata..............................@..@.gfids..............................@..@.rsrc...@.... ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-OU74J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	321008
Entropy (8bit):	6.4037799339163355
Encrypted:	false
SSDEEP:	6144:dtqkKC7BjQV5eR1b+yRWsJQnNfckNI+STEDC4nkml+T/6qhdDqvJbb9fv:HRFe5en+gWUCNTF9fv
MD5:	B1F29EA399C173C50C64FFCA5F13DC7F
SHA1:	4A039AFF59F34BAE66AA24A0C349059795BF13B2
SHA-256:	0E179470446A14C3706182D88FC95E5C066957C3752DEFDD6D3649AE877C87A2
SHA-512:	0B95E7209CDBB1E977860E8A41E73C5232E682EF111A34A57762FA6BC83D8C3126BCD38069E1D8FB72703F356608F98C103717377493D41E0F4EB5CAA024D79B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?..{...{...{...r.w.s......y...o...y......m......s..............\|...{...W.......n.......z.......z...{.s.z.......z...Rich{...................PE..d...2._.........." .....Z...v.......\..............................................X$....`..........................................6..........................0-..................H...T.......................(.......0............p..p............................text....X.......Z.................. ..`.rdata..4#...p...$...^..............@..@.data...8...........................@....pdata..0-..........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-Q06N3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	6.427052922078226
Encrypted:	false
SSDEEP:	1536:NAtEBVLW449/7DU6BNNiWrnToIfCIOvIOwIY/ky:yKVLQxDRrcWLTBfghwIY/ky
MD5:	977D5FD0F1CE33492336D6D48E4BEF6D
SHA1:	575C7AC6104D3E000B091F8AF343E822DBC53931
SHA-256:	41775B504663392F630CDBA675894A0A65A9C09616D5738B2DF98AEE329F0AF7
SHA-512:	11C4EA625D74D55F1926DC237436784577B8F82523A996843A0357156CCBA6D46EDA56928FF7AC82ED59BD8C131F96A1691D90B3997080B442AADA286DDA2C27
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U-.X4C.X4C.X4C...Z4C.X4B.v4C..e..[4C..e..Z4C..e..S4C..e..Z4C.Uf..T4C.Uf..Y4C.Uf..Y4C.Uf..Y4C.RichX4C.................PE..d...?tWV.........." .........p...............................................`......:.....`......................................... ...].......<....@.......0...............P..`.......................................p............................................text............................... ..`.rdata..,W.......X..................@..@.data...0.... ......................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc..`....P......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-Q3UAG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	722944
Entropy (8bit):	6.461841037101138
Encrypted:	false
SSDEEP:	12288:+DGOd2K9pFsPqEbVqbo16ITqX5PBxH4UdAWhZ5HXJKl:iddZ9pFViVqRIM5ZrZ5HX4l
MD5:	EA03FE27DF3672898090FE652DCAFDF1
SHA1:	A4C555ABE482DE8A409DE9CB2B04B39458A47B94
SHA-256:	B8D52C7B6F5407F8FBB89EDA8F0D09DBF13665324B1B48CE08602EB5CEB915BE
SHA-512:	BAE517ACA75A646596201B977A04D8B0F08AA01777B387700AF3E2D155958C0CECBC944AC2C856661223B1DFB1888EDD7DD6E4DA99891CDBE4D97467D79D987A
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............f...f...f.......f...c...f...b...f...e...f...g...f...g...f.......f.*.g...f...g...f...c...f...f...f.....f...d...f.Rich..f.........PE..d....{yg.........." .........V......`{.......................................`............`.........................................``.......e.......@...........U...........P.......<.......................=..(....<...............................................text...F........................... ..`.rdata.............................@..@.data...XB.......<...l..............@....pdata...U.......V..................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-Q4FUF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6023664
Entropy (8bit):	6.768988071491288
Encrypted:	false
SSDEEP:	98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
MD5:	817520432A42EFA345B2D97F5C24510E
SHA1:	FEA7B9C61569D7E76AF5EFFD726B7FF6147961E5
SHA-256:	8D2FF4CE9096DDCCC4F4CD62C2E41FC854CFD1B0D6E8D296645A7F5FD4AE565A
SHA-512:	8673B26EC5421FCE8E23ADF720DE5690673BB4CE6116CB44EBCC61BBBEF12C0AD286DFD675EDBED5D8D000EFD7609C81AAE4533180CF4EC9CD5316E7028F7441
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......D.............................UJ......................................................W.....,..................r....................Rich............PE..d...;._.........." ..........-.......-......................................`\.....x.\...`...........................................L..O....T...... \.......U.. ....[......0\..%..,.H.T.....................H.(.....H.0............./.H............................text............................... ..`.rdata..F7%.../..8%.................@..@.data...x....PT..\...6T.............@....pdata... ....U.."....T.............@..@.qtmimed.....0W.......V.............@..P.rsrc........ \.......[.............@..@.reloc...%...0\..&....[.............@..B........................................................................................................................................................................

C:\Program Files\CloudCompare\is-Q8VGT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	206104
Entropy (8bit):	6.527663270766649
Encrypted:	false
SSDEEP:	3072:cXY40poiOthG/NS7rngyB9N4DfwAp2Ywz73GdXrQw18TYfHbd6q1:cINpBlNry5DAMYzXcY8TYfcq1
MD5:	210BB45A43B2F8FA7F6CFC31FA4EC6DD
SHA1:	3DACFA339AC11488D52A54806FFFAF437BB0CAA8
SHA-256:	AA965BC8429994C97BC2498ED8051A4101F7987A376924B105DE5F7915E42A48
SHA-512:	8A0E8863B06B306B11E0ABAD77B0285DBC17B8A778E241C2EBE0285BBF12C7B7CFDEACD6ED6D2BF71887342A94DACEADF8E0AA3164D4492E1CB9D0D1FECEAB96
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........$.ew.ew.ewq*.w.ew...w.ew..av.ew..fv.ew.dw..ew..dv..ew..`v.ew..ev.ew..w.ew..gv.ewRich.ew........PE..d.....0].........." ................0........................................ ......~.....`A............................................................................A...........k..8............................k..................@............................text...\|........................... ..`.rdata.............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-QJLST.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	627992
Entropy (8bit):	6.360523442335369
Encrypted:	false
SSDEEP:	12288:dO93oUW7jh6DN0RUhsduQjqDZ6X/t5mTOKGmJ7DseBiltBMQEKZm+jWodEEVoFt:s3oUW7jh6DN0RUhsduQjqDZ6X/t5mTOo
MD5:	C1B066F9E3E2F3A6785161A8C7E0346A
SHA1:	8B3B943E79C40BC81FDAC1E038A276D034BBE812
SHA-256:	99E3E25CDA404283FBD96B25B7683A8D213E7954674ADEFA2279123A8D0701FD
SHA-512:	36F9E6C86AFBD80375295238B67E4F472EB86FCB84A590D8DBA928D4E7A502D4F903971827FDC331353E5B3D06616664450759432FDC8D304A56E7DACB84B728
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`..r$..!$..!$..!.O.!&..!-.\|!2..!v.. '..!$..!...!v.. '..!v.. o..!v.. j..!v.. %..!v..!%..!v.. %..!Rich$..!................PE..d.....0].........." .........`...... ...............................................T.....`A............................................h....................0..t@...T...A..............8............................................ ..........@....................text...<........................... ..`.rdata..<.... ......................@..@.data....;..........................@....pdata..t@...0...B..................@..@.didat..h............B..............@....rsrc................D..............@..@.reloc...............H..............@..B................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-QLH03.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	99840
Entropy (8bit):	6.070375909397882
Encrypted:	false
SSDEEP:	1536:gidhTVwoKodN5deiZT++24zVwOe3XSjZ+DNli/xfoCbIhEkiJorBnpL:VhZwoKoXHZTF245wY9+ZlilZVyTL
MD5:	A62B144F7018735973AFEE25CA8B6B03
SHA1:	71DE842D0ED154C1CDCE145AF4B0389A8B21762B
SHA-256:	498C6EEE37060600B84CE9484A707386592C653022AB28CFADFF3B1A168C6547
SHA-512:	CB1BBD83627A800A1E6B81D6481DE0C69AC03DCE44F082A1BF6FFCC901C16E07956570FFC5D70D720C4B4696403997F70069DC4750AD30EFD19B817E78679755
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.............m.....K......K......K.3....K.2............2.............3.........................Rich...........PE..d...Q..T.........." ................\|.....................................................`..........................................I.......V..P...............$....................................................5..p............ ...............................text............................... ..`.rdata..8I... ...J..................@..@.data....7...p..."...P..............@....pdata..$............r..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-RK2D7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3778688
Entropy (8bit):	6.381493838760625
Encrypted:	false
SSDEEP:	49152:46SRSFneW0gGoV8tBB0pgRQBPMmS9BQRCSY0uKBY9zwaSNtASu58JfX/MkjX9F:XFFjByQET9iu8PXjT
MD5:	EB6EE54899E763C0C32625847735CB42
SHA1:	98DB0FC03A7BBD71901770F9637AA3EB57DC05D9
SHA-256:	0FA8364972240178560821D374BDA70A8A5E5B2AE05374E258C9599D8DF4A554
SHA-512:	E205199D0AE9A68BDD8E26809D5CC6C8360EA00D9C94A6B53F1B48A6EEC7DF7672062B4A9BF8A3A890D8053E66241464D099520841F647EFD98862AE3AE4AAFC
Malicious:	false
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......k../~../~../~..&./.#~..}...%~..}...+~..}....~..}...'~..d...+~......~..",a.-~.....%~....."~../~..Up.....u~......~...C..~......~..Rich/~..........................PE..d.....g..........".......!........... ........@..............................9.....D.9...`...........................................3.\X....3.......8.......7.......9..&...`9..i...+.......................+.(.....+...............". p...........................text.....!.......!................. ..`.rdata..b/...."..0....!.............@..@.data........@7..f....7.............@....pdata........7.......7.............@..@.rsrc.........8......x8.............@..@.reloc...i...`9..j....9.............@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-RKRC4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	543027
Entropy (8bit):	6.081562472859807
Encrypted:	false
SSDEEP:	6144:SS5KjgGnpG7wZAF86y2iLmKiXc2HsvOB/2FV2/vF98G5hSkZqBG1N64vdw:9AgMVwPy25G2j/2FVuvUY0yN64vdw
MD5:	5427B1D1E958FE77B18C6EA992B1BCD6
SHA1:	E3D8946C366402C7FDE6053DA666F1E066E5A7D7
SHA-256:	FEC43CB18CE0EC8A5DD6AD1DB745747167310CCB92B5ACFF0D445A8B3013F009
SHA-512:	FD47E681ABA34A0CA4A9E6300905834163257E3BF11EC4A214231DD0FCA85E023DE0285151B5DEE835EBD9A61EF39E8E49B0EE55BC0C77AEBC9F601EF3ADD799
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d... .oM.h........& .....j.....................j.............................0......l......... ......................................`..M7...........................................................................................................................text....h.......j.................. .P`.data....z.......\|...p..............@.`..rdata..0I.......J..................@.`@.bss.........P........................`..edata..M7...`...8...6..............@.0@.idata...............n..............@.0..CRT....X............x..............@.@..tls....H............z..............@.`..rsrc................\|..............@.0..reloc..............................@.0B/4....................................PB/19.....L..............................B/35.....^..............................B/47....................................B/61..................&.................B/73.....

C:\Program Files\CloudCompare\is-S20LH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	4.918600259690758
Encrypted:	false
SSDEEP:	768:k2PM9rCwnTNtag/Zbf7dOtx+3pg+2iQ6gPSN9uDsH9g+tRc:kP1n7gDnSL9g+7c
MD5:	1B5BAF09EBE88108D5DA26C0E0514875
SHA1:	5D1EE37B752D603991999BD7C0434B5FCD428E38
SHA-256:	24D9A38A0E090E2D50BFAAB9B5BDA9A753BCCB3770C7751CB81BB15BCEDF47FF
SHA-512:	F50539A482BBA73CA8C5B38E9C55F16FCE0111091187B90D8AAC5F5A0A6250C2F6F293A97DE499646B5EB8A2D921C034B0EE163E97E60C0DFD339BC3B9436562
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E...+...+...+.\| ..+......+......+.....+.....+.......+...*...+......+.......+.......+.Rich..+.........PE..d...._.V.........." .........>...............................................0............`.........................................p...........P............................ .. ...`...8...............................p............................................text...y........................... ..`.rdata..j...........................@..@.data...............................@....pdata..............................@..@.idata..............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-T6I4U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	261872
Entropy (8bit):	6.124188159004726
Encrypted:	false
SSDEEP:	3072:Td//dQmubTGzYPhdKbN/0mXNiL1JNUdvjyLBl2ndaLemXqiTlN/cozR6hyYGHs:YHGSo/Dc1ZLBl2daLGixRcozR6hyns
MD5:	C974C7B8CC66714A4BE0A7FAC840D193
SHA1:	E83936D5E3A1939B5B830B043936D55D79376CBD
SHA-256:	DA5E47C1FBA5C990CF66C529DA15EC050E3BA50EF9BEEE44AC8EC83A575E3569
SHA-512:	50C47CF18E354284CCEE0E370758EC5498B9D0769DC90141AFD458CC0D1D173423D12DD45E2EC140F5BAB4BADD017531FB81D6046340216ADD94B8BFF4553CA3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,.<dh.R7h.R7h.R7a..7b.R7...7j.R7S.Q6k.R7S.W6\|.R7S.V6c.R7h.S7..R7S.S6m.R7..W6M.R7..Q6k.R7..R6i.R7...7i.R7..P6i.R7Richh.R7........PE..d....D.W.........." .....Z...........S.......................................@.......]....`.............................................(>...l....... ..X....... 4......."...0.........T...........................P................p..p............................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data...pI...........h..............@....pdata.. 4.......6..................@..@.gfids..$...........................@..@.rsrc...X.... ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-T8E89.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	235711
Entropy (8bit):	4.881009157481132
Encrypted:	false
SSDEEP:	3072:VinPJqOuT19YK0ooi4M5Np+FrqzDnBUMvGnkKbAeLqHjawFUPM8CVuH3H32p:L193ou8rqzDLvGxAeODacNTyG
MD5:	8FA735FC69E7AE5D70271BA457633099
SHA1:	5DFA18BA94398B07728443A951B9BE99857254AB
SHA-256:	00A8F881A71EB2B13E18C5D6B1795A7D0D0A1B7A8E7D93753BA843D0D859555F
SHA-512:	050228D412EFF4FED36F8EF7D972DEF23EB369139CAB692AEFC83E83A2654C7E5D5E737F8F2160C13E93C8782C9C5283BD4B5D05975BFBAA4684DA6123ED410F
Malicious:	false
Reputation:	low
Preview:	CloudCompare Version History..============================....v2.14.alpha (???) - (??/??/202?)..----------------------..New features:...- Edit > Color > Gaussian filter...- Edit > Color > Bilateral filter...- Edit > Color > Median filter...- Edit > Color > Mean filter....- to improve coloring by applying a color filter.....- New Command line options....- New command -FILTER -RGB -SF {-MEAN\|-MEDIAN\|GAUSSIAN\|BILATERAL} -SIGMA {sigma} -SIGMA_SF {sigma_sf} -BURNT_COLOR_THRESHOLD {burnt_color_threshold} -BLEND_GRAYSCALE {grayscale_threshold} {grayscale_percent}.....- command arguments with a dash can be in any order.....- -RGB runs the filter on color.....- -SF runs the filter on the active scalar field.....- -RGB and -SF can be used at the same time, otherwise at least one of the 2 options is required.....- -MEAN\|-MEDIAN\|GAUSSIAN\|BILATERAL......- specifies the filtering algorithm to use......- required......- only one should be set (However, if multiple are passed, only the first one will

C:\Program Files\CloudCompare\is-TJIIT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11594752
Entropy (8bit):	5.8614931256398926
Encrypted:	false
SSDEEP:	49152:NNzpamKhw2a6O4ZycLPqxfXj9fKtYdOMiyys0dRssdkVEMNMndxm7mBU0915ROHU:ocdiDDMEf0Ff7IMHSdj
MD5:	7EF9CF9E7604E9E4728E63A85C9F5BEC
SHA1:	89BDDE3F68645FB7BE3F21A970B6E3AF8C750704
SHA-256:	66F741623E01E7204664D58750A44100D5342BCA0706EA58396DE925AE3041EB
SHA-512:	74BF0C9884C02B9827E1D80067535C1039A38C6DBE64695ABFF6C4CC10738A951FE72F7069376594BABA26B468D6046DE1A1650D4CA7D985AA77CB3C1B46BA90
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?.<.^.o.^.o.^.or..o.^.o...o.^.o1..o.^.o...o.^.o../o.^.o...o.^.o...o.^.o.^.o._.o../o.^.o...o.^.o...o.^.oRich.^.o................PE..d..._`.V.........." .....8H...h.......H......................................P............`..........................................J..X.....................T............@..h...`VH.8...........................p.H.p...........................................text...96H......8H................. ..`.rdata......PH......<H.............@..@.data...1.d...K...d...J.............@....pdata.............................@..@.idata...A......B..................@..@.reloc.......@.....................@..B................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-TLF74.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	436011
Entropy (8bit):	5.959829336161829
Encrypted:	false
SSDEEP:	6144:Whq6r4b+TzXbwkjY7A0cEecZjS2a3Q4k4P9:Whq6rjv0kjMAYu2ag4k4P9
MD5:	46342925772D32E44ECF4D846C450B20
SHA1:	AAC70299D4B1B9E10718313235C69C4FB75AB034
SHA-256:	09B3B868B96433991FC15C9C5AE6F9A44C62D2E21194110442607917391ED927
SHA-512:	144C7F914539BC42AB315C3E063AA483BA03CA50B4FF1636B447AC880E9DCB5E222F19B9365E0AAA4B4BCCC0C2B543DB3243C143B5DF7E339843827F0B56B994
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...,.oM.<..".....& ..........................To.............................................. ......................................@...!...p..................................4....................................................................................text............................... .P`.data...............................@.`..rdata..pS.......T..................@.`@.bss.........0........................`..edata...!...@..."..................@.0@.idata.......p.......:..............@.0..CRT....X............N..............@.@..tls....H............P..............@.`..rsrc................R..............@.0..reloc..4............V..............@.0B/4...................X................PB/19.....L............\.................B/35.....^............d.................B/47....................................B/61....................................B/73.....

C:\Program Files\CloudCompare\is-TRDII.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	640512
Entropy (8bit):	6.552116885372862
Encrypted:	false
SSDEEP:	12288:ltu3Vl+FYgd6Y5uvdrc7vBPj9KhPkLpLYz:ltu3VlfdY5Mdrc7vN91NLO
MD5:	533F81EB1CDADD117C5D0B2D75CE0D8A
SHA1:	C6003769F1CC324F7AEC324F1626A25D7396008D
SHA-256:	65F029D7DB3B4F4D372E89D490A77BDC43934563C5EE70E7501E12DEFFC79E5C
SHA-512:	56636DE5D2A61D9CF8F0DAFAB2CA8514885374B0C87B38766DC53EB5C84F8BD281D4451E8B20481B223A8428DCD34653D7106CA130AD7186DEC99C655CBC9892
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....#f..........."...*.:.......`..0...............................................?.....`... ...................................... .......0..\....p.......@..l0..............h........................... ...(....................6..h............................text...p9.......:..................`..`.data........P.......>..............@....rdata..P....`.......H..............@..@.pdata..l0...@...2...$..............@..@.xdata...>.......@...V..............@..@.bss....p_...............................edata....... ......................@..@.idata..\....0......................@....CRT....`....P......................@....tls.........`......................@....rsrc........p......................@..@.reloc..h...........................@..B................................................................................................................................

C:\Program Files\CloudCompare\is-ULPPI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	803328
Entropy (8bit):	6.301764713308598
Encrypted:	false
SSDEEP:	12288:zi/B1Q7qKbhpvjs13V8nt0aG4m5UTmSpN2oyIKefN/4:zSB1Q7qK1pMktxQUT3v2XI9/
MD5:	65E878BE5E621489342B5369D2CD446D
SHA1:	5FE0112DD80BEAFF167212E13DB73335BC1C5120
SHA-256:	14DD904B4DF2BC9956EC1719F778E141350913DF097368E77BACE6CA1DC7F339
SHA-512:	31AEBFCB29905AE710C33A45A93B9EB28755CDEF47861B22A2854994B6ED634D999E93FDCE55913B218FF1D99290AA68F9CA7F80F9B66A517802495E66EC4205
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........V..7..7..7..O@..7.._..7......7.._..7.._..7.._..7..O..7..G..7..e...7.!^..7..7..1.!^..7.!^..7.!^..7.!^,..7.!^..7.Rich.7.........PE..d.....g.........." .........~.......i....................................................`......................................... .......f..T....P...........C...........`..\|...0X......................PY..(...PX...................2...........................text...@........................... ..`.rdata..T...........................@..@.data....*....... ..................@....pdata...C.......D..................@..@.rsrc........P......."..............@..@.reloc..\|....`.......$..............@..B................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-UP0V3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2488832
Entropy (8bit):	6.160943225546191
Encrypted:	false
SSDEEP:	24576:F0/+sQ6I4bzQrzL7f2DdjAsWpCckWhfIHm5b4pgDpxiH+ROm:Q64bUnLb2DTWpCck7m5ZpseRt
MD5:	38A03AED710AD5C471F7864E05CBA4E9
SHA1:	E1A0FD42A0BBF5F7F22F9BCCE5C9BE1F4EABB221
SHA-256:	D8690C5E0EA25CA2AB480BCEA830CAAF07CA5BDCB5D81FDF6C5B36ACDEEDF124
SHA-512:	B66B526148E24DF3C8CD7150DEBF83D1D861939866B00B186759F26C75E187257AEFB25D7FAC44788CE04C54981381441C64BE141DA520BAF1EDEF9E9B5C7C11
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|P....................:'..............................yx.....................................................Rich............................PE..d...#:.X.........." .....J...........d.......................................0&.....]\&... ..............................................\....!.P.....$..<....#...............%.\7...d..8...........................PA..p............`..x............................text....I.......J.................. ..`.rdata......`.......N..............@..@.data...(.... !.......!.............@....pdata........#.......#.............@..@.rsrc....<....$..>....$.............@..@.reloc..\7....%..8....%.............@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-V60H0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48640
Entropy (8bit):	6.318600850824361
Encrypted:	false
SSDEEP:	384:OAsSKWgciQhMwpuEEXd6erEvCZ9dWVQlmg5EP+Bs4mw0z4KVX055VuPXkr/YuPCQ:j2sbAQE7WSgPws4mn5ahJ0yzK777cF
MD5:	4689FC376ACE9A9BD7C9B313850EC0BF
SHA1:	7E9C5BF39F0AF67983433F2459B08548C7542338
SHA-256:	E221514B68083A2F57B8441433A197A07D569F4038D8F0BD68F1734D95F9A456
SHA-512:	CA61E3BA794CEF6B53C06D34B17770363BC4FD9A436EF23111190321ABE0E1D606891B11C13159D6B3685385B09511E3A2FED2532B991CFC7883E8B0061C243F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............d...d...d...5r..d...5p..d...5O..d...5N..d..d.d..d...d...d...6O..d...6s..d...6t..d...6q..d..Rich.d..................PE..d......T.........." ................h.....................................................`............................................(.......<....`.......P..T............p.. .......................................p............................................text............................... ..`.rdata..............................@..@.data..............................@....pdata..T....P......................@..@.rsrc........`......................@..@.reloc.. ....p......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-V81UA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1305600
Entropy (8bit):	6.500414270235113
Encrypted:	false
SSDEEP:	24576:wsae7nuBe/fiK+A5RStikHZVVYIgkVkP/txyfk:wsluBe/aK+A5RnkHVNgkVG3yf
MD5:	5E340FB8D4F34B05560CDF0D6FAA0C95
SHA1:	DC94163D199DBF99CA9B2ABD52E9DA9BA411B3AA
SHA-256:	DE36FB112F7062BD5B507ECF689D08AB070163E410E72EF8F2DC4775A8A5795C
SHA-512:	4F5553011564A2631677B9360D68B878F4B6A4AB02BB0D485D0B340C1C4D4845489784EE4E8AAA6D48BCD92FE36BA2309C05489363CD4B8F41806AB5E154AF3D
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..............@.b......x.....@.`.....@._.....@.^......-b......t.............-_.-....-c......-a.....Rich....................PE..d....1.T.........." .....@...........J.......................................0............`.....................................................d...............................0...................................@...p............P.. ............................text....?.......@.................. ..`.rdata..Rf...P...h...D..............@..@.data... 6..........................@....pdata..............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-VD2K0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	471792
Entropy (8bit):	6.133406334839098
Encrypted:	false
SSDEEP:	6144:/C9mSwGqUtU6NFPIOWIhz8qtQej4gFlShFXA58+eIVPV/RrQp8XWLSZbRc:/2wGqKUyZ1zeYMKB+
MD5:	81C31E22F2EA4AD7D6512A00E276EAC4
SHA1:	7D95F2E547D177BA258E75E29D9D2B0C4C9A9287
SHA-256:	088446600B5947744066887DAF19E2562DCCA797A7E83F34BC474645C57DEF7E
SHA-512:	FDA5D99B69551755663540022F0E0468BEB289683F35D300D809DC35A2C9A63447AE24FE335DFEFB9DD6561B1917377C9525D94181F2F0E81462F045844497F2
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................$.......................................................".............H....... .............Rich............PE..d....d._.........." .........................................................`............`.........................................`.......X........@...........,...........P..................................(....................0...............................text............................... ..`.rdata.......0......................@..@.data....5.......*..................@....pdata...,..........................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-VQV6S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	305392
Entropy (8bit):	6.242398831287072
Encrypted:	false
SSDEEP:	6144:zXvA6GWLMKIhiovzNWUbtQ0Q8L/hFHC7p:zXo6GWgsov9ZrQ8bhq
MD5:	3CFDE799979AB3BDDD93FFD46A375CD0
SHA1:	AAE44FC249918CE86ACA050D3FE7311C2FFC0C80
SHA-256:	83CF481C9AFA319C573BF642BC2271CD65C5435076A3BF99ECE9FB53C52A35D2
SHA-512:	5C355324802D80A97E3EAC823430C1E7E1D177AF562AC11B94E978450C789BBFBBB32A9DC01CB530764F0E5C114FBDE8D9F4370DE2FA19DBA689B0BBEF7E80F6
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........w...$...$...$..a$...$...%...$...%...$...%...$...%...$...%...$S..%...$...$'..$S..%...$S..%...$S..$...$..e$...$S..%...$Rich...$........PE..d....c._.........." .....N...B.......%..............................................j.....`.........................................0m..(...X....................$..............D...P.......................p...(...p................`...............................text....L.......N.................. ..`.rdata.......`.......R..............@..@.data........`.......H..............@....pdata...$.......&...X..............@..@.rsrc................~..............@..@.reloc..D...........................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\is-VUNA7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	326144
Entropy (8bit):	6.195700191357499
Encrypted:	false
SSDEEP:	6144:aiEihwMr/RYZfJTW3z9EVWJ9nB5ouD0K+6nkZRAAB5Ohl0omBEV/jVq9mUT74Rsx:aiEiOsJatVUEA
MD5:	E421801BEAB05A96A041EA2A759D7E50
SHA1:	6E6BA8E783E8F4A8E3984A8324D353D56F360AE8
SHA-256:	9E3B73B7395CF53942CE363FC69A825B53534703920691D38E97BD84C08825F8
SHA-512:	7DC1D88B8E5BD519887BD9DDA2700EBE7AB8647DB1E8E1B56D749EA670F91D451BD7DC8D0D1C02775F89D4EA108575ECE3A7402B43EE8DF32428F0A6F54AF3FA
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........L.\|U-./U-./U-./\Uw/]-./.E..B-./.E..]-./.E..W-./.E..Q-./.U..W-./.]..T-./.]..S-./.D..R-./U-./.../.D..]-./.D..T-./.D./T-./.D..T-./RichU-./........PE..d......g.........." .....v..........$[.......................................@............`.........................................0... q..P........ ..........l............0...... .......................@ ..(...@...................@............................text....u.......v.................. ..`.rdata...J.......L...z..............@..@.data...............................@....pdata..l...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\laszip3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	285184
Entropy (8bit):	6.134546329576554
Encrypted:	false
SSDEEP:	6144:mwm1yAstRH4FBEiD17SCltmbuFeU77naU8ht8WEPZFlT3C0:lm1yAstRYFBEiD17SCOEhFl2
MD5:	7B228925B73F2D00787CA4B039C31648
SHA1:	1D7AFF84B58FCC076FB3897A80B6A41A3D601C2F
SHA-256:	62E57B4424230221F4A287D3F8960828A0AD2873EDD1A02920A8AAF48475779C
SHA-512:	075DC24D7E327F211E3FB6B9FA6C67C7A384503BD3230E08F2BCDFBDEDD099178F04F388F864996DD283DF12AC9A3F718EE644D055044CEDEB5BBFB0B0B481F4
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]B..3...3...3.......3...2...3...6...3...7...3...0...3...2...3...2...3.U.6...3.U.3...3.U.....3.U.1...3.Rich..3.........................PE..d...ca0c.........." .........v............................................................`......................................... ...t.... ...............P...(.............. ................................... ...................x............................text............................... ..`.rdata...+.......,..................@..@.data........0......................@....pdata...(...P...*...(..............@..@.rsrc................R..............@..@.reloc.. ............T..............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\libcurl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	324096
Entropy (8bit):	6.3377399185673235
Encrypted:	false
SSDEEP:	6144:FBgyWUu11adMCSxB8zPMc4UvH1gjSnSapcWAAEJTfSQSg913ieVSuQMsPcZwf:FBgXj11tC/PMcWapcbAoTfv130b5f
MD5:	8B7BB6C392EAE81F3B4F0A5638BD50E3
SHA1:	54AC8ACA96234D59BDC8AE2F800185E48F50CAAE
SHA-256:	B85A49A23BD8A554F7ED475A8817C5E027853A86B3D94BA4DCF4EFB9109D2579
SHA-512:	87B8E4CE2F414CCA07AF6EA10337A04D37C8243BF62BF092812A5406A546AD92F08EC572BE8D683598C8EC1DFD1AA55D50C17BA80243469833D896DDA1DDE70C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...in.Zin.Zin.Z...Zan.Z/?.Zkn.Z/?.Zkn.Z/?$Zen.Z/?%Zkn.Zd<.Zon.Z...Zln.Zin.Z{o.Zd<$Z.n.Zd<.Zhn.Zd<.Zhn.ZinSZhn.Zd<.Zhn.ZRichin.Z........PE..d...!..T.........." .........<......\........................................@............`......................................... ...c............ ...........3...........0.......................................t..p............................................text.............................. ..`.rdata..............................@..@.data... ...........................@....pdata...3.......4..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1575936
Entropy (8bit):	6.522022448413462
Encrypted:	false
SSDEEP:	49152:qSY0LA3zwiZzjs9nyFHV1Q62ThDAQp7/VqPVcuP:ahAThDAQpuVc
MD5:	21BF4638E5ADA899A43AC322BAC4600C
SHA1:	9BC1D6E44E14314C6B002436D4EDB9B7F8A51FB6
SHA-256:	AEE3F7C3EF4477D46F9CD65B00BB2EBAA23C2EDE84D60027102F97F3463542D5
SHA-512:	DDDC9A5EB060D82F8C3741E1F2241924DFD00A15A29D3EB00B0F87B38A34E0063E0B885E41F892A7966D28F5379A71D8BDD9DA434FA14B278672F64328540F5E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!..=e..ne..ne..n#.0ng..n#.2ng..n#..ni..n#..ng..n..&nn..ne..n...nh.2nd..nh..n"..nh.1nd..nh.6nd..nh.3nd..nRiche..n........................PE..d...[..T.........." .........j...... ........................................`............`..........................................Y..Q...............@.................... ..8?..0...8...............................p............................................text............................... ..`.rdata.../.......0..................@..@.data...............................@....pdata..............................@..@.rsrc...@...........................@..@.reloc..8?... ...@..................@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\libgmp-10.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	543027
Entropy (8bit):	6.081562472859807
Encrypted:	false
SSDEEP:	6144:SS5KjgGnpG7wZAF86y2iLmKiXc2HsvOB/2FV2/vF98G5hSkZqBG1N64vdw:9AgMVwPy25G2j/2FVuvUY0yN64vdw
MD5:	5427B1D1E958FE77B18C6EA992B1BCD6
SHA1:	E3D8946C366402C7FDE6053DA666F1E066E5A7D7
SHA-256:	FEC43CB18CE0EC8A5DD6AD1DB745747167310CCB92B5ACFF0D445A8B3013F009
SHA-512:	FD47E681ABA34A0CA4A9E6300905834163257E3BF11EC4A214231DD0FCA85E023DE0285151B5DEE835EBD9A61EF39E8E49B0EE55BC0C77AEBC9F601EF3ADD799
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d... .oM.h........& .....j.....................j.............................0......l......... ......................................`..M7...........................................................................................................................text....h.......j.................. .P`.data....z.......\|...p..............@.`..rdata..0I.......J..................@.`@.bss.........P........................`..edata..M7...`...8...6..............@.0@.idata...............n..............@.0..CRT....X............x..............@.@..tls....H............z..............@.`..rsrc................\|..............@.0..reloc..............................@.0B/4....................................PB/19.....L..............................B/35.....^..............................B/47....................................B/61..................&.................B/73.....

C:\Program Files\CloudCompare\libmpfr-4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	436011
Entropy (8bit):	5.959829336161829
Encrypted:	false
SSDEEP:	6144:Whq6r4b+TzXbwkjY7A0cEecZjS2a3Q4k4P9:Whq6rjv0kjMAYu2ag4k4P9
MD5:	46342925772D32E44ECF4D846C450B20
SHA1:	AAC70299D4B1B9E10718313235C69C4FB75AB034
SHA-256:	09B3B868B96433991FC15C9C5AE6F9A44C62D2E21194110442607917391ED927
SHA-512:	144C7F914539BC42AB315C3E063AA483BA03CA50B4FF1636B447AC880E9DCB5E222F19B9365E0AAA4B4BCCC0C2B543DB3243C143B5DF7E339843827F0B56B994
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...,.oM.<..".....& ..........................To.............................................. ......................................@...!...p..................................4....................................................................................text............................... .P`.data...............................@.`..rdata..pS.......T..................@.`@.bss.........0........................`..edata...!...@..."..................@.0@.idata.......p.......:..............@.0..CRT....X............N..............@.@..tls....H............P..............@.`..rsrc................R..............@.0..reloc..4............V..............@.0B/4...................X................PB/19.....L............\.................B/35.....^............d.................B/47....................................B/61....................................B/73.....

C:\Program Files\CloudCompare\libmysql.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4072960
Entropy (8bit):	4.29892941159376
Encrypted:	false
SSDEEP:	24576:kurEhBFeA9Yocw4I3UX/Q6keuzbkLnqJFzTUbRBZxzf1fkG8qkUfT6T36S7cLqRd:kTgA9YIU03nzTABZR1f4/oT6TKZLqRd
MD5:	BBB1E3F824CCC683CFA76D66ABB815D3
SHA1:	A648215F3F8610BB79BE1DC2A291A7CA80B0C688
SHA-256:	F6ABC1333233A2B9B93312F2531AF32250BDC9DC3A337CDB3E20F6B4E3895476
SHA-512:	E32DF05E32C1DB5E2AF3B8EF567DFC4D5BCD43BE9C52BAC5B4FB8DD8B778E5A7B8D519AB18AAAA85EAB1B3A5D5E1239DCD107B578F9215BF99B7540268BD034A
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7..s...s...s.....`.t...5.F.K...5.G.....5.x.`...~.F.]...._l.z...s......~.G.....~.{.r...~.\|.r...s.0.r...~.y.r...Richs...........PE..d......T.........." .....f....<.....`.........................................E...........`.........................................p.6.n...."6.d....PE.`.....D..n...........`E.@2.................................. =5.p............................................text...xd.......f.................. ..`.rdata....-.......-..j..............@..@.data...x....@6..`....6.............@....pdata...n....D..p...~=.............@..@.rsrc...`....PE.......=.............@..@.reloc..@2...`E..4....=.............@..B................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\libpq.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	150016
Entropy (8bit):	6.153853842832493
Encrypted:	false
SSDEEP:	3072:795pD8/5DF369YVKIf/AihiUNS1ZHGQJImIQaya9bmMAznIcH6KkeNWi3uRNWONp:79n8/5o9YVK4WSmQ9lSHfkM
MD5:	4CC6FC8AA81C763F819EB171A72B0755
SHA1:	A795938F6A3A6878B7125C037E92CD64592BB9BE
SHA-256:	B6DE4A001F659EDDCFB2E0E818AACD4BD0BB687EF1EB316E682CC6955C2B6178
SHA-512:	15955838CC3C81A970A5DAE2805567BDC101B9B9FEA310316EBE115944E5492DA450BECCF14638BE81D8E3F49196E201415909181A0FD70774B339F2E0051B09
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.N...N...N...._.H......M......L.......B.......L...C...n...C..J......B...N.......C..O...C..O...C..O...RichN...................PE..d....T.........." .....\|..........t.....................................................`.............................................#............`..(....@...............p..,.......................................p...............P............................text....z.......\|.................. ..`.rdata..<...........................@..@.data...0.... ......................@....pdata.......@.......&..............@..@.rsrc...(....`.......@..............@..@.reloc..,....p.......D..............@..B........................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\libxml2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1305600
Entropy (8bit):	6.500414270235113
Encrypted:	false
SSDEEP:	24576:wsae7nuBe/fiK+A5RStikHZVVYIgkVkP/txyfk:wsluBe/aK+A5RnkHVNgkVG3yf
MD5:	5E340FB8D4F34B05560CDF0D6FAA0C95
SHA1:	DC94163D199DBF99CA9B2ABD52E9DA9BA411B3AA
SHA-256:	DE36FB112F7062BD5B507ECF689D08AB070163E410E72EF8F2DC4775A8A5795C
SHA-512:	4F5553011564A2631677B9360D68B878F4B6A4AB02BB0D485D0B340C1C4D4845489784EE4E8AAA6D48BCD92FE36BA2309C05489363CD4B8F41806AB5E154AF3D
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..............@.b......x.....@.`.....@._.....@.^......-b......t.............-_.-....-c......-a.....Rich....................PE..d....1.T.........." .....@...........J.......................................0............`.....................................................d...............................0...................................@...p............P.. ............................text....?.......@.................. ..`.rdata..Rf...P...h...D..............@..@.data... 6..........................@....pdata..............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\license.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1248
Entropy (8bit):	3.411406870003142
Encrypted:	false
SSDEEP:	24:JNQNANQs8Bw5NQMJ0y4TVOkHUYlg2NQNnNe:J+i+/Bw5+k0y4TjHUY+2+BM
MD5:	10E499DB3962E1CA5FECBCBDF2D623EA
SHA1:	BBD9C1D5F081144ED3096825900E7982120E9318
SHA-256:	B0180C8E73919E584EC2DB3D8916858D7EA3FF4FBB33A8C535CA5FBC2E6E57E4
SHA-512:	4BB76A579188E9A4AE5D48064BA24CC8049152A0961D835910FC013E2A2480AEEA1DFC9D2B5A419722077920B2EF854FDBEE073A3D1203A9977094D400A6456E
Malicious:	false
Reputation:	low
Preview:	//##########################################################################..//# #..//# CLOUDCOMPARE #..//# #..//# This program is free software; you can redistribute it and/or modify #..//# it under the terms of the GNU General Public License as published by #..//# the Free Software Foundation; version 2 of the License. #..//# #..//# This program is distributed in the hope that it will be useful, #..//# but WITHOUT ANY WARRANTY; without even the implied warranty of #..//# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #..//# GNU General Public License for more details. #..//#

C:\Program Files\CloudCompare\msvcp140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	627992
Entropy (8bit):	6.360523442335369
Encrypted:	false
SSDEEP:	12288:dO93oUW7jh6DN0RUhsduQjqDZ6X/t5mTOKGmJ7DseBiltBMQEKZm+jWodEEVoFt:s3oUW7jh6DN0RUhsduQjqDZ6X/t5mTOo
MD5:	C1B066F9E3E2F3A6785161A8C7E0346A
SHA1:	8B3B943E79C40BC81FDAC1E038A276D034BBE812
SHA-256:	99E3E25CDA404283FBD96B25B7683A8D213E7954674ADEFA2279123A8D0701FD
SHA-512:	36F9E6C86AFBD80375295238B67E4F472EB86FCB84A590D8DBA928D4E7A502D4F903971827FDC331353E5B3D06616664450759432FDC8D304A56E7DACB84B728
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`..r$..!$..!$..!.O.!&..!-.\|!2..!v.. '..!$..!...!v.. '..!v.. o..!v.. j..!v.. %..!v..!%..!v.. %..!Rich$..!................PE..d.....0].........." .........`...... ...............................................T.....`A............................................h....................0..t@...T...A..............8............................................ ..........@....................text...<........................... ..`.rdata..<.... ......................@..@.data....;..........................@....pdata..t@...0...B..................@..@.didat..h............B..............@....rsrc................D..............@..@.reloc...............H..............@..B................................................................................................................................................................................................................

C:\Program Files\CloudCompare\msvcp140_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31512
Entropy (8bit):	6.482572392659554
Encrypted:	false
SSDEEP:	384:N7K97EGM9l0SJuJZVWnlVI/GDYWcn53WMlQpBj0HRN7gr5mQHRN7AFA8pUclXC/:tKcJJuJZVWlVlq/qWgro8WA8pU7
MD5:	D281BE80D404478EA08651AB0BF071B5
SHA1:	E81DC979D8CF166C961C8E7B26F5667DB9557C47
SHA-256:	5E627FAC479F72363075824423D74D0A5D100BB69377F2A8C0942E12099AF700
SHA-512:	FDA7C43FB6EE71C7CCBAD7AD32C1F00E454CCDEE3BBC35DE4045ABBC8998281CDAB9C506FEA8417DF25FF0EF09471EEA49F63B2181E160C62BDA804FBFD8C376
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8./.\|.A.\|.A.\|.A..9..~.A.u..x.A...E.{.A...B.}.A.\|.@.U.A...@.y.A...D.o.A...A.}.A....}.A...C.}.A.Rich\|.A.................PE..d.....0].........." .........$......p...............................................[r....`A.........................................>..L...L?..x....p.......`..@....:...A......d...03..8...........................p3...............0..@............................text............................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..@....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..d............8..............@..B........................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\msvcp140_2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	206104
Entropy (8bit):	6.527663270766649
Encrypted:	false
SSDEEP:	3072:cXY40poiOthG/NS7rngyB9N4DfwAp2Ywz73GdXrQw18TYfHbd6q1:cINpBlNry5DAMYzXcY8TYfcq1
MD5:	210BB45A43B2F8FA7F6CFC31FA4EC6DD
SHA1:	3DACFA339AC11488D52A54806FFFAF437BB0CAA8
SHA-256:	AA965BC8429994C97BC2498ED8051A4101F7987A376924B105DE5F7915E42A48
SHA-512:	8A0E8863B06B306B11E0ABAD77B0285DBC17B8A778E241C2EBE0285BBF12C7B7CFDEACD6ED6D2BF71887342A94DACEADF8E0AA3164D4492E1CB9D0D1FECEAB96
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........$.ew.ew.ewq*.w.ew...w.ew..av.ew..fv.ew.dw..ew..dv..ew..`v.ew..ev.ew..w.ew..gv.ewRich.ew........PE..d.....0].........." ................0........................................ ......~.....`A............................................................................A...........k..8............................k..................@............................text...\|........................... ..`.rdata.............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\netcdf.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	943104
Entropy (8bit):	4.884100718195113
Encrypted:	false
SSDEEP:	6144:GNVEvTyvUpeL7/Al2ntAFXgltlFgj5KsOHhTmkijOcprzyB61vdq0umlKnSDpd:GNOTyvTX/AxGlUK1KkWyB61FTuEK4
MD5:	799A5FF9D9919DB09A70ACBA8DA22E3F
SHA1:	737A8000644C5C59B8E609DCC7C87B807C4D70FB
SHA-256:	0C8F98093EADAA3EFBC4DEF4E047B61BCE3262A395F9214D574F51DDDFDA2E4E
SHA-512:	129F35F37874C228A74ADA9C429F303E1EC75E3701B085B8D7D9A360D6B525B93D40D46FA70795176625295DB19DA5EA67E4D07920C86F86B6702F0965B71981
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .^rd.0!d.0!d.0!.K.!g.0!"..!f.0!"..!f.0!"..!h.0!"..!f.0!i..!b.0!...!g.0!d.1!..0!i..!:.0!i..!e.0!i..!e.0!i..!e.0!Richd.0!........................PE..d...0..T.........." .........J...... .....................................................`..Zb.....................................@...S,......x....@...........[...........P...0..................................@7..p............ ...............................text............................... ..`.rdata..T.... ......................@..@.data...............................@....pdata...[.......\..................@..@.rsrc........@.......0..............@..@.reloc...0...P...2...2..............@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\opencv_world340.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65625088
Entropy (8bit):	6.716204630721569
Encrypted:	false
SSDEEP:	393216:sbMrUzNKCHFRGrF9uETlbLiAUESilnLo:s2cNWrFwETlrnnL
MD5:	C8AA5618B3AEBB44A1DC971CF45DF6AF
SHA1:	E63D348666665876DFA22854F7DD3D450289425E
SHA-256:	8799F59DBCF8F7EB8B56A0D6EFD8E957A1985CD2CD4723B4228731288A5FAE88
SHA-512:	0936CBA77118A4451C73324D971E64946824E665DD411B84EFDB0B209BCA3CF5895C5A3D557489B303C970B870980E39DAC71D9B2BC472D22667006D81C80E47
Malicious:	false
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......!Rz.e3..e3..e3..lK..s3......o3...Q..M3...Q..n3...Q..c3...Q..\|3..GS..a3..e3..2..GS..p3..?....7..e3..C....P...3...P...2...P..d3...P..d3..e3..d3...P..d3..Riche3..........PE..d..."x=Z.........." .....2B..r............................................................`.........................................`...(............p.......`...................a......T.......................(....................PB..............................text............................... ..`IPPCODE...%.......%................. ..`.rdata.......PB......6B.............@..@.data...h~.......4..................@....pdata.......`......................@..@IPPDATA.....p......................@..._RDATA...F... ...H..................@..@.rsrc........p......................@..@.reloc...a.......b..................@..B................................................................................

C:\Program Files\CloudCompare\openjp2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	180736
Entropy (8bit):	6.4689591835949
Encrypted:	false
SSDEEP:	3072:3RZCni3L3TP4OKFE+rtuiNFEPj43AQsnA1Tg08fC7jqC5UouCGZCktTiNTqtOuK+:vCni73TgOKi+RzGr43AQsnAF5IWswPw
MD5:	EEA12E88CF534F41963EDAD1522D8802
SHA1:	9AF546CCE2DCC16EDDF3B517D89D35E51990DCD6
SHA-256:	18F3E0E9C7C84666C4D738247D607065CDE890569CEB621CFC95DE77AA8ACEF3
SHA-512:	F917F1655D9371A1D5A026677DFBE5B8EAE6FF69528253F36CAE468546A952733DBB159566240158A9608256383A92A8E64545522612E93ACC3BDB83EBBE045B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{bZ..1Z..1Z..1...1X..1.d.1[..1...1[..1...1Q..1...1X..1.;.1Y..1Z..1k..1W..1I..1W..1[..1W..1[..1W..1[..1RichZ..1........PE..d...a.T.........." ................`.....................................................`.................................................P...<...............\....................................................a..p............ ...............................text............................... ..`.rdata...w... ...x..................@..@.data...............................@....pdata..\........ ..................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\platforms\is-JL72O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1477104
Entropy (8bit):	6.575113537540671
Encrypted:	false
SSDEEP:	24576:4mCSPJrAbXEEuV9Hw2SoYFo3HdxjEgqJkLdLu5qpmZuhg/A2b:nPlIEEuV9Hw2SFFWHdWZsdmqja/A2b
MD5:	4931FCD0E86C4D4F83128DC74E01EAAD
SHA1:	AC1D0242D36896D4DDA53B95812F11692E87D8DF
SHA-256:	3333BA244C97264E3BD19DB5953EFA80A6E47AACED9D337AC3287EC718162B85
SHA-512:	0396BCCDA43856950AFE4E7B16E0F95D4D48B87473DC90CF029E6DDFD0777E1192C307CFE424EAE6FB61C1B479F0BA1EF1E4269A69C843311A37252CF817D84D
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i...-...-...-...$.%.9.....q.,......8......%......)......+...9......9..,......)..........9..8...-..........d......,.....I.,......,...Rich-...........PE..d....._.........." .....,...h......4+..............................................n.....`.............................................x...(...........H............n..........X....r..T...................Pt..(... s..0............@...5...........................text..._+.......,.................. ..`.rdata.......@.......0..............@..@.data....m...@...D...(..............@....pdata...............l..............@..@.qtmetad.............J..............@..P.rsrc...H............L..............@..@.reloc..X............P..............@..B........................................................................................................................................................................

C:\Program Files\CloudCompare\platforms\qwindows.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1477104
Entropy (8bit):	6.575113537540671
Encrypted:	false
SSDEEP:	24576:4mCSPJrAbXEEuV9Hw2SoYFo3HdxjEgqJkLdLu5qpmZuhg/A2b:nPlIEEuV9Hw2SFFWHdWZsdmqja/A2b
MD5:	4931FCD0E86C4D4F83128DC74E01EAAD
SHA1:	AC1D0242D36896D4DDA53B95812F11692E87D8DF
SHA-256:	3333BA244C97264E3BD19DB5953EFA80A6E47AACED9D337AC3287EC718162B85
SHA-512:	0396BCCDA43856950AFE4E7B16E0F95D4D48B87473DC90CF029E6DDFD0777E1192C307CFE424EAE6FB61C1B479F0BA1EF1E4269A69C843311A37252CF817D84D
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i...-...-...-...$.%.9.....q.,......8......%......)......+...9......9..,......)..........9..8...-..........d......,.....I.,......,...Rich-...........PE..d....._.........." .....,...h......4+..............................................n.....`.............................................x...(...........H............n..........X....r..T...................Pt..(... s..0............@...5...........................text..._+.......,.................. ..`.rdata.......@.......0..............@..@.data....m...@...D...(..............@....pdata...............l..............@..@.qtmetad.............J..............@..P.rsrc...H............L..............@..@.reloc..X............P..............@..B........................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\MeshIO.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2327552
Entropy (8bit):	6.176241265246855
Encrypted:	false
SSDEEP:	24576:O9XXVP3T68F+qFOeFHHnCezLuDOVPWoMTHNRxoeGMQTemhlYglQ6/:O55p9FHHChuWoMTtRxoeG7TemhlYgl
MD5:	BDFC79FCB07C834E2DA85800A1DED6E8
SHA1:	CC10974040DF9453D3C2E1F63CFD0353B334547C
SHA-256:	15B657DCC6FCA6FADD1B1BC578F6AFCC661E4B5C5B6EC932CB830D954DD8C6CF
SHA-512:	D9A309458508EC95D5D17DA6028516EB44395757EBF2E0F232C454F3DFC5189463CD874F7452147C3AB2542D305F4D6417ADD600C05864150786BA8B6484C35D
Malicious:	false
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........\.F.=...=...=...E...=...U...=...U...=...U...=...U...=...E...=...M...=...T...=...=...?...T...=...T...=...T...=...T...=...T\|..=...T...=..Rich.=..........................PE..d...d..g.........." ..........................................................#...........`.........................................0I .t....I .T.....#.......".t.............#.X4...L..8....................N..(....M...............................................text............................... ..`.rdata.."...........................@..@.data...p..... ....... .............@....pdata..t....."......\".............@..@.qtmetad9.....#......H#.............@..P.rsrc.........#......L#.............@..@.reloc..X4....#..6...N#.............@..B................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\Q3DMASC_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	809984
Entropy (8bit):	7.311103595541181
Encrypted:	false
SSDEEP:	24576:McEE5PGNJcyJDJKpEW+QCWYCG9XnZJmy5njJ4:MLE5P2ayJDJqgWY9dNJjJ
MD5:	9014EA0027A81C883FF4306AF520ECA1
SHA1:	DF47F88964B5BC61B4E64E52F82ADA16CD2621FB
SHA-256:	1088FC098DB5CAB69AB2EBDB746499917427153B638236874E4D4E787CAA7C48
SHA-512:	DB62B6D9CD89D373D6899AC72BE54EEF40D0661208DD3C4D4A339215268AC2064AB11E17F9282CCB6E31D957DCA10DAA10379A711914B17268BCFBD71251FEBB
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........j..j..j...%.j......j......j......j......j......j..6...j......j......j..j...n......j......j....I.j......j..Rich.j..........................PE..d.....g.........." .....x..........0?....................................................`..........................................)..\|...L*..h............P... ..................@F......................`G..(...`F...................#...........................text...kw.......x.................. ..`.rdata...............\|..............@..@.data...X....0......................@....pdata... ...P..."...&..............@..@.qtmetad.............H..............@..P.rsrc................J..............@..@.reloc...............L..............@..B........................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QADDITIONAL_IO_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	256000
Entropy (8bit):	6.02324937299118
Encrypted:	false
SSDEEP:	6144:ub3DYs9jX5c8AyhnZONYRfSWDOYWZXUqXQ2r1At3d4haPqjaGQzJAS:ub3DYkJNZOCl
MD5:	3B591115D780BFE4451617ADF78ED6C0
SHA1:	C02FA4AAADD880BD67BB4F4ECA3F7D14B1BB6EB1
SHA-256:	42C6CA961FCF7BA295C6E5B557791CB31A7BEEEAEEB93537B7305D7D88822F61
SHA-512:	B140C1E6AFEFB0730EC260E5A14CABCF2B12CBCE93EB9D94C2652DE275DC1BF0F3C9277C83B8AB04C573C1F0278C859DD7AC5B3491DBDEA0067080173B42D798
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d#.Y.M.Y.M.Y.M.P}.U.M..mH.L.M..mI.Q.M..mN.Z.M..mL.].M..}L.[.M..uL._.M..lL.P.M.Y.L...M..lH.W.M..lM.X.M..l..X.M..lO.X.M.RichY.M.........PE..d...v..g.........." .........4......X........................................0............`.................................................$...T............................ .......i.......................j..(....i...............................................text............................... ..`.rdata..............................@..@.data...(...........................@....pdata..............................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QANIMATION_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	199680
Entropy (8bit):	5.994057512347577
Encrypted:	false
SSDEEP:	6144:7Zf559/yXbc5N6Od7wUZiVOYWZXUqX8wrAAt3d4thaPytaGmdFSVX0Go3E:7Zf1qYXd
MD5:	B0CC9E45C8D303F745F0B68762C8A112
SHA1:	CF860A5490A7722B992A5AA783D463F5A40B8DC0
SHA-256:	3A224F72F4338C977E1CBEFDFCDEF4FF11BB1BE6B1283365710F746B98F74AB0
SHA-512:	318BB5009060E937B4D4EA4569458083BBD4D9D81EF07027AC41CD0CAF18D36FEDE6007514190FE86361A0BBA19EE0DE1A59B0B312C32BFEC0F4D4110AD57BF4
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(b.l...l...l...e{?.f...>k..x...>k..d...>k..n...>k..h...'{..n...l...E....s..j....j..k...l........j..k....j..m....jS.m....j..m...Richl...................PE..d...V..g.........." .....0...........$.......................................P............`.................................................P...\|....0..........,............@......@.......................`...(...`................@...............................text............0.................. ..`.rdata..t....@.......4..............@..@.data...............................@....pdata..,...........................@..@.qtmetad..... ......................@..P.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QAUTO_SEG_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	418816
Entropy (8bit):	6.226647789656364
Encrypted:	false
SSDEEP:	6144:FK1HkSgTvS0y0PupZ3n5IudVJ3agowgieMjNhDhu7juPU7+VYWXUq5jt34rUjGbs:FKdgTvY0235DJtdjNhDhKSD
MD5:	C6432247B75174F587472B3721D3742F
SHA1:	40A4DA32B40B98C09BF9926D81FC7DE03A39E705
SHA-256:	B91970A166CE4E44EC392D8C4193996D9079F17A1A2135232891FFB677B0FCA6
SHA-512:	6073987EBAE011A4FF3D24CB8778128073AB900E43F1D322781860D26C55EFEDBCE31C6ED586573D307E8C05CD93BE366245B18B84DD7CFBA2FF2864FF0FACA0
Malicious:	false
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........db...........}......m......m......m......m......}.....#u......l......f............l......l......l......l......l.....Rich............................PE..d...q..g.........." .........z......4.....................................................`.........................................P].......]...............@...0..............<...............................(....................................................text...x........................... ..`.rdata..>...........................@..@.data... )......."..................@....pdata...0...@...2..................@..@.qtmetad.............P..............@..P.rsrc................T..............@..@.reloc..<............V..............@..B................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QBROOM_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	228864
Entropy (8bit):	6.33558640199254
Encrypted:	false
SSDEEP:	6144:nOarQz/c6r5l6zjq3GBpt5zSTDXq5MmUjGx2/PYWZU8wR3dthwaN+rVtI:nlOv5lojZbh
MD5:	C4136253C43123F1AC10F8A3264105BB
SHA1:	56B6C6E55C5CA52E251013C43CF82C0323756AD3
SHA-256:	96AC8A5F9535F785D38D0E04ADC07B926316297D9BF4F31B40270E2DC103527C
SHA-512:	E9A590BCF344EB500AECE2EF31CAE9399715651A0357E2DAC00FCA9D0135045B0727FE76EE9DD21093D5DD050887C75928673351483ACD76753CA0F541C286E8
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........o.z.<.z.<.z.<...<.z.<...=.z.<...=.z.<...=.z.<...=.z.<...=.z.<...=.z.<+..=.z.<.z.<.y.<+..=.z.<+..=.z.<+.c<.z.<+..=.z.<Rich.z.<........................PE..d...b..g.........." .....2...N.......'....................................................`.............................................\|...\.......................................`6.......................7..(....6...............P..h............................text...{0.......2.................. ..`.rdata..f....P.......6..............@..@.data...H....p.......L..............@....pdata...............Z..............@..@.qtmetad\|............h..............@..P.rsrc................l..............@..@.reloc...............n..............@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QCANUPO_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	762880
Entropy (8bit):	6.830912301583025
Encrypted:	false
SSDEEP:	12288:zf1o+/qdWYlYw5Ne23xko1w4G9AtsZqoq+qrqoq+q+q+qYqIqGq+qJEWKRQ0zrW9:zfK+iYO3sp6sPEW+QCWYCGf
MD5:	19CA96363DED6BC2860E5B75E047A4FB
SHA1:	0695FE635DDD05AA03BCF5C8FFB10FEA2883B210
SHA-256:	896D546BFB5F1DAD137149AE1E79A5581C1E17DA54C971B28958BD0960F7FA1E
SHA-512:	03EA10E313BA0B6D82B9549B2D8E65A3B7BBF1F412C150C514021EDC70B8D3054AC65A2EEF4D1F8F3401E875C83AB496100A804AC1262B3AF60DBB0D23E78428
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........ol...?...?...?..?...?...>...?...>...?...>...?...>...?...>...?=..>...?...>...?...?...?...>...?...>...?...?...?...>...?Rich...?........PE..d...K..g.........." ................$.....................................................`.............................................\|...<....................-..................0.......................P...(...P....................%...........................text............................... ..`.rdata..r...........................@..@.data............\|..................@....pdata...-...........X..............@..@.qtmetad,...........................@..P.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QCLOUDLAYERS_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	176640
Entropy (8bit):	5.979004104906084
Encrypted:	false
SSDEEP:	3072:yDezrKCWiK4KUCT58JUpGK3ETnvMdnRSxDOkZXqi0n3d4Uwtv0QZdn1d5BKJ7:ygK4BC8JmGKU7MdRSxDOkZXqi0n3d4UN
MD5:	CAE0381FA5B340F4D994D60934FE517F
SHA1:	5B8DE02471B39CCC1159698A7029EBC918375F26
SHA-256:	9B8083EC253D0BE27D15BCF1FB9E8FFA2137C99E6608BB23D135FB082B03353A
SHA-512:	91EA95A3840723D3BBDFA062C7BC987E0EEE258A919119E6F901C6C1F2041D45815CAE4D1F682149FD05B94A7889E8FCA302F14BABCAB1BB51A32262DA915C5F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........GC..C..C..J...K......V......K......A......G......A.....E....D..C..\....J....B...}.B....B..RichC..........PE..d...=..g.........." ......................................................................`.....................................................................................(... .......................@...(...@................ ...............................text...;........................... ..`.rdata..Fu... ...v..................@..@.data...............................@....pdata..............................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QCOLORIMETRIC_SEGMENTER_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	176640
Entropy (8bit):	6.210464486399451
Encrypted:	false
SSDEEP:	3072:CHqi5QS9LZnjXtSUYSI5mvZMmxsIBEoE0UlQwSpPUB+VYVUqK2rntmrUgjaGAKvV:CHqi5105mhMmWIBrzpPUB+VYVUqK2rni
MD5:	B5B35AEC6CDFAAD5B25BC2FEFFB65FB0
SHA1:	E6BE61074D3DCC11F53FC81B0FB533832E6481D8
SHA-256:	A7A4E133D4AACD25A8E135676A15453C25B924A99356BCB4118CAFAA22F66066
SHA-512:	9168DF919D02C5DDF324966101A6D8BABC77CD34B4888E607B425E705DB9557E156A4BAD16DFD3C726A3FD370AE263BA8F8A52BE62A9BD765B8EB3C3F7FD6407
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?...^b..^b..^b..&..^b..6g..^b..6f..^b..6a..^b..6c..^b..&c..^b.v.c..^b.U7c..^b..^c.._b.U7g..^b.U7b..^b.U7...^b.U7`..^b.Rich.^b.........................PE..d...8..g.........." .....(..........."....................................................`.........................................`9.......9..................................t...@.......................`...(...`................@..8............................text...k'.......(.................. ..`.rdata...[...@...\...,..............@..@.data...(...........................@....pdata..............................@..@.qtmetade...........................@..P.rsrc...............................@..@.reloc..t...........................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QCOMPASS_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	513536
Entropy (8bit):	6.228865745475452
Encrypted:	false
SSDEEP:	6144:ICUdIydi6hckUW25QqnOELi4e23dyjk7hOgl7OGi18ttFHP6gj11FNB+qiwrOhal:IXi6EW25QoOELwgdOvgHygjrmm
MD5:	399F8B310DBC01696C3DDB6CE788C564
SHA1:	82FB9A77B710367DA8D2154A946B0BCA92369B93
SHA-256:	B389F5986484FB17F814B4B78211BE98AAEBDF95A803BA9A63ED21BD4BC7A75B
SHA-512:	F4A355EA7E115C7C8B7FBAF37195ABC7D995CAC439924C048BA9FE2D925D191379462072D68C9329B9D8344061E16C6BD1101573EFA3869B87313245BC608B24
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.e.a...a...a...h...k...3...v...3...i...3...b...3...e......c......g......h...a..........z......`......`......`...Richa...........PE..d......g.........." ........................................................@............`..........................................{..\|....\|..@................'............... ...~..........................(....~...............@..8%...........................text....(.......*.................. ..`.rdata..2D...@...F..................@..@.data...H#...........t..............@....pdata...'.......(..................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc... ......."..................@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QCORE_IO_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	359424
Entropy (8bit):	6.110250673660502
Encrypted:	false
SSDEEP:	6144:egGbJ/wl8Zg7MwSg3KkOdy/eceJc4kb6QHyHhJUDVZqXr/4tUPtGh3J8:HGbJ/xtzy2vU6m
MD5:	72617BB41D6B8FFBD21C41B656743F15
SHA1:	D0450960CA791E5089D94F28685D44FE7B66D9DA
SHA-256:	4E2DEEB11349005DB7C7C66AB894EF993C3B0ED77C67E9E6DCF0B733A77CA7F5
SHA-512:	405D97ADFB5D5DE6B7A980491CDD1C295EF13ED1145777C15EAD77661DB568E0EE253437AE6F81C2F564F5155FACA60A1271A0A9464F7282759CA640FD8E3627
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........RE4R3+gR3+gR3+g[K.g^3+g.[.fJ3+g.[/fZ3+g.[(fQ3+g.[fV3+g.KfP3+g.CfT3+g.ZfU3+gR3gX7+g.Z.fB3+g.Z+fS3+g.Z.gS3+g.Z)fS3+gRichR3+g........PE..d...p..g.........." ................(.....................................................`..........................................M..\|....M..@............p..4..............................................(........................ ...........................text............................... ..`.rdata...e.......f..................@..@.data...0%...@.....................@....pdata..4....p.......@..............@..@.qtmetad.............^..............@..P.rsrc................`..............@..@.reloc...............b..............@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QCORK_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	446464
Entropy (8bit):	6.568690443444106
Encrypted:	false
SSDEEP:	6144:nO9LDFnmdy+DvALZLBo2os4hzkcjxa1jW1o6cjSNxGQTgaOnPjS3oSSPUa+VXqXt:O9dmdy+DoLC9hzkctUjW1oVjSNOnOY
MD5:	5209609C3F800F5B30BF5F3BD7091E89
SHA1:	62DBACC264BA0DD9AE839767FE2323C693807D7D
SHA-256:	A3D3031B665E5C1E2A8992826A57297E00DD3B7EA7EB559084E8BA204ACC15FB
SHA-512:	05EFB8E07D73EBD36E655A1D02C152758ABDBD43D0F65553BC71BC3B2D252843666C94A9CB69F4510FD21FB375254A24320D7C644E3BBF0706E7941628A241C9
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........=...n...n...n...n...n..o...n..o...n..o...n..o...n..o...n..o...n..o...n...nw..n0.o...n..o...n..o...n..o...n..}n...n..o...nRich...n........PE..d...)..g.........." .....J...........+....................................... ............`.........................................P...\|.......@...............`..............x....Q.......................R..(....Q...............`...............................text....H.......J.................. ..`.rdata.......`... ...N..............@..@.data...8"...........n..............@....pdata..`.......,..................@..@.qtmetadQ...........................@..P_RDATA..P...........................@..@.rsrc...............................@..@.reloc..x...........................@..B........................................................................................................................................

C:\Program Files\CloudCompare\plugins\QCSF_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	175104
Entropy (8bit):	6.11735671904995
Encrypted:	false
SSDEEP:	3072:9Y0G2KFUjBfARsbW/OrqDwkqT2QuwU6iVOYWXUqKK5tAt34tUgj5Eg8v0/Vb:uf2eABnbIOrqbqTDuwU6iVOYWXUqKK5X
MD5:	8EB327D1029B136E4D7A71095022D062
SHA1:	B5C1874A4E23EE1FFC9EAAF272D4627EAD2609A7
SHA-256:	C426A8A164ABFFD2569811AD6E808DD575ABE10E472C68EDE69E9B6D6946D638
SHA-512:	29ED58A53A60CEF2AFC9B5824AB7FE2E47EE78C2F59A67858FC8ACB82D1409C622CDC7D7537AC32B7807D6C43971E95DD75A37E30CD381A5AB35ADE67C48DC8A
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................................3.........3.....3.....3.y...3.....Rich...........PE..d...-..g.........." ................8.....................................................`.............................................x...(...,..............................................................(.......................p............................text............................... ..`.rdata.............................@..@.data...............................@....pdata..............................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QCSV_MATRIX_IO_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	128512
Entropy (8bit):	5.681739065236602
Encrypted:	false
SSDEEP:	3072:WN4ouHYzbyr5a1tAIyrSvfHwUKiVYWXUqXwrTt34thaPtaGbBvIiH/:sz+Yzia3vfHwUKiVYWXUqXwrTt34thaJ
MD5:	C56F2BC406754EE7FCC98F207DF7E6A4
SHA1:	6BD56A580AAE0F5268F2E47205201D3E980B9425
SHA-256:	8F3B7191F8E63451C97E050197C95797823041318AB632B4890563A8AAD25C4C
SHA-512:	10B3369D8CCE4BDEBAC0F1194924E936A8B834B68432D55B4ABDA4AA85E6D4D9DB756823115B6C2E37B02F87FDFFC9CE717F6B977623325BABC5FD14AA0BC082
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............o..o..o......o..j..o..k..o..l...o..n..o..n...o.D.n..o.g.n..o..n.2.o.g.j..o.g.o..o.g...o.g.m..o.Rich.o.........................PE..d...&..g.........." .........t.......~.......................................P............`..........................................<......T=.......0.......................@..................................(....................................................text...K........................... ..`.rdata..hD.......F..................@..@.data...............................@....pdata..............................@..@.qtmetad>.... ......................@..P.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QDOT_PRODUCT_IO_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	92672
Entropy (8bit):	5.699025601635425
Encrypted:	false
SSDEEP:	768:ZH/4VAVjyv3/I+5sjlfsUbsqA4HGNtYAG7RehRRldqKqhaaShhNt42L2XI0:54BoSstswsb4HM9BQbohh/FL2XI0
MD5:	7E8B270B0F5D6FAC1C08287A2311F182
SHA1:	922F7BC5D619A87DE976FD245C92807B0D9D25E1
SHA-256:	8DEBB1DE532E8F19910A5171BC17A4F61D95F64EA218A0BA06428F629819989A
SHA-512:	39083C9BA8003B1E2D0E96BE80468D71D0CAEF02D8A528F83A59BEDA646BDC8AB73520AE66AE6BE6E4727F2C90D18D7833812946EF512410F4B299D738B40695
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................).........................................4......[.........^..4......4......4.E....4......Rich...................PE..d...O..g.........." .....z..........Hs....................................................`.................................................t...,............p..L...................0.......................P...(...P................................................text...;y.......z.................. ..`.rdata...............~..............@..@.data........`.......N..............@....pdata..L....p.......V..............@..@.qtmetad.............`..............@..P.rsrc................b..............@..@.reloc...............d..............@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QDRACO_IO_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	667136
Entropy (8bit):	6.34619241274607
Encrypted:	false
SSDEEP:	12288:JN/JS7wk02GaPVBbhBuMfhar4oKEis9lSiHyu:H/JYbtfhar4o4s9N
MD5:	5B08EE82E421440576CC76FA55C815B0
SHA1:	9CB7BB486FD098E4D727820662B3247A1CDB2681
SHA-256:	04C5A5E11C5679B72AC7901EF3850BFEA96A37AA85CE4DE82EAF3D04F41A1417
SHA-512:	F954E7A36F2B3274DBE8123C96B344DDD770F7DD433DA4B5C0ACAC0ECA14ADDC08E2AD810FD7D58D03169D131B558FD35259B0E4045C30410EC25A4B980B5B7B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.[.v.5Iv.5Iv.5I...Iz.5I$.1H~.5I$.6Hs.5I$.0Hl.5I$.4Hr.5I=.4Ht.5I..4Hp.5I..4Hq.5Iv.4I*.5I..0H0.5I..5Hw.5I...Iw.5I..7Hw.5IRichv.5I................PE..d.....1g.........." ......................................................................`.........................................`...........@....`...........I...........p..t...............................(....................0..0............................text...[........................... ..`.rdata...[...0...\... ..............@..@.data...@W.......P...\|..............@....pdata...I.......J..................@..@.qtmetad.....@......................@..P_RDATA..0....P......................@..@.rsrc........`......................@..@.reloc..t....p......................@..B................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QE57_IO_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2413568
Entropy (8bit):	5.788428616549328
Encrypted:	false
SSDEEP:	49152:jvh3MIAWPmR2DXCVLDzh5mJ8dIfialhjj/:jx+WPCVqfvjT
MD5:	6FCB8364953136BD82083C3D83811BA1
SHA1:	ABBC9B532F13CF6EF25FAC46F25E534BD294171C
SHA-256:	5D1595E5041B3773B3755D16E1AC291F04E99EE429479398410586434450C320
SHA-512:	391C676EEFBF7E4271955E0C7BCAB0F0FA0BB569E92D8BEAC6F8F538F9B43EC2FA19C72FE5DDFD4FC874EB29170DFC2640F22C5B43DBB88B3F8D93233F9F55B5
Malicious:	false
Reputation:	low
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.........GY.s)..s)..s)......s).P....s)...,..s)...-..s)...*..s)...(..s)...(..s).u.,..r).H.(..s).k.(..s)..s(..q).k. ..s).k.,..s).k.)..s).k....s).k.+..s).Rich.s).........................PE..d...1..g.........." ........................................................ %...........`..........................................f .\|...\g .......$.......#...............$..;..............................(....................................................text............................... ..`.rdata..............................@..@.data.........!....... .............@....pdata........#.......#.............@..@.qtmetadr.....$.......$.............@..P.rsrc.........$.......$.............@..@.reloc...;....$..<....$.............@..B........................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QEDL_GL_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	5.56216524552819
Encrypted:	false
SSDEEP:	768:NB//tTSg1XQ9BbTYqIb10G7uBVtpnoc+G9/qxyVl2B6Zq4AYUXRL:NB//Bhg9tYqIaPupxyVl2B6ZqLX
MD5:	D0035DFB056E4D41C22ADBC73A0610F5
SHA1:	C9BBA2F02EA2E19711DDB1694FB23D1783F90666
SHA-256:	A854FE42BD3DF262308C0AA558D9C4BD72E7A02503CE97A32B21584997640271
SHA-512:	80D89E6B5B45397EFA8CAD1C59BCB37B3527024334E086C9C97717ED8BB18FDAD055CEC05A393DAD1E903ED57F626892A8AD0EB2BA4833394138DB588F8D3A20
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5..T...T...T...,8..T..<...T..<...T..<...T..<...T..,...T..k$...T..H=...T...T..tT..H=...T..H=...T..H=T..T..H=...T..Rich.T..................PE..d......g.........." .....@...^.......A....................................................`..........................................~..\|...\...................d............... ....f.......................g..(....f...............P...............................text....?.......@.................. ..`.rdata...J...P...L...D..............@..@.data...X...........................@....pdata..d...........................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QELLIPSER_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	179712
Entropy (8bit):	5.852434135668565
Encrypted:	false
SSDEEP:	3072:4hxnD6aRnrTiNTOPIGx2WhkaFzRRfxXUfBG2JyKD2ZEeyaYstPuUSikVYWXUqX8j:u7yNO2WVzRRfVUfBjkKyZdyaYstPuUSY
MD5:	66A1CE3D888299DD5BE35A198D3F4193
SHA1:	A50F711813243687966E82C8074199EE6D0CA5FA
SHA-256:	3992F7A2AEEEC2B0F980945CA7E234CF9B5A3E3DBC22175B7CA7E32F33EA15F6
SHA-512:	54333662EB185F693AEEA7B75F5A1AEE101AD863E7DB98AD1997DB5065388560C73E772B2855338594BE37F0704046F39A348A83F8C0586DD8BEC70D7A51DAE7
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h.i.,..H,..H,..H%..H$..H~..I8..H~..I$..H~..I...H~..I(..Hg..I...H...I..H...I%..H,..H...H...I..H...I-..H...H-..H...I-..HRich,..H........PE..d...u..g.........." ................ .....................................................`.........................................`...........,............... ...............................................(....................................................text............................... ..`.rdata..............................@..@.data...............................@....pdata.. ...........................@..@.qtmetad@...........................@..P.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QFACETS_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	284672
Entropy (8bit):	6.16807195752963
Encrypted:	false
SSDEEP:	6144:VwYd2oduCK61HFSx6i61ySbDXUqXQ2rtmhaPqjaGx5OYWZmA3dtlsCK8Ity5Sqzp:e3o3HFSx6x
MD5:	12526E76341EF89259D59CAEC18045D1
SHA1:	349A87B9D215182D333ED5C775E20D8411F8CDBF
SHA-256:	73716620D787107D48AD76A589EB05BD425E47A4BC0ED9C7B5043811EB624FAF
SHA-512:	607B695650C68E3FE92CD7BF4767259F1746187D062EC77C1D8ADAC040B9E5ACDEBE4CC3523B42535655DC35BC9269212E7D2747827BF4F7FB276459CB4BD321
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................)..................................S......p.........'..p......p......p.E....p......Rich...........PE..d...<..g.........." .........z............................................................`..........................................X..\|...\|X..@............`..x...................@.......................`...(...`................................................text...{........................... ..`.rdata...6.......8..................@..@.data........@......................@....pdata..x....`......................@..@.qtmetad.............B..............@..P.rsrc................D..............@..@.reloc...............F..............@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QFBX_IO_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7794688
Entropy (8bit):	6.463547042992633
Encrypted:	false
SSDEEP:	49152:jto9kTHzq7czDlqm32WKMI57d6H+6yBg6CZNjHBEo/Uo9JKmjQwqZX+6+Yj7rne7:5ooDlq1BsMJ+ovWh4rdOqIkMVUaT7
MD5:	F76AB453BFBE4065FA95905950765C21
SHA1:	D6C512637C868ED73ADA1C38FEC3973065DF82F7
SHA-256:	646DC8D582D9A93B5FBC62C5212F698463EBF50537B2FEB7928EA1E560DBF34D
SHA-512:	4C6FF309B4B49927FD18387FAAABDD3C645743B8BB093963DB33E3971F4A366E386E90D29DE0BEFAABE15345D2D723FC625A23BBFAB9A13CD42EF53170DDE45B
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......M.KS..%...%...%......%..8....%.[.!...%.[.&...%.[. ...%.[.$...%.B.$...%...$...%...!./.%... ...%...$...%...$...%... ...%...%...%.......%...'...%.Rich..%.........PE..d...8..g.........." .....vU...!.....\.P......................................pw...........`.........................................psp.\|....sp.......w......`s.\............ w..K..0.b.....................P.b.(...P.b...............U.8............................text....tU......vU................. ..`.rdata..$w....U..x...zU.............@..@.data....G....q.......p.............@....pdata..\....`s.......s.............@..@.qtmetadE.....w.......v.............@..P.rsrc.........w.......v.............@..@.reloc...K... w..L....v.............@..B........................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QHOUGH_NORMALS_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	100864
Entropy (8bit):	5.986356949370447
Encrypted:	false
SSDEEP:	3072:588ia+Q4c3APlOqOGkP9wciYWXq5Wt34tUEpY+:58ha+Q4gUOqfIwciYWXq5Wt34tUEpY+
MD5:	7A1C478B641E5E42BDB17D52DB27BCA9
SHA1:	DB5119B53A0CFA9FB4D2A5C4AF48891B4D1A0712
SHA-256:	FCDA7F52F90ECFB749C8E4289271C209DDC4685DBA3944A41894E2551DB247CB
SHA-512:	B5112CACD7A0A9F36B769CE496FD66CB5B1EB628424FBAAFF43E4E38EF113CFF031C11A8EA91D0709F7FB11B72982A96622E49043879E14FAABEAAD2A5A20C53
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J...+n..+n..+n..S...+n..Ck..+n..Cj..+n..Cm..+n..Co..+n..So..+n.x[o..+n.[Bo..+n..+o..*n.[Bk..+n.[Bn..+n.[B...+n.[Bl..+n.Rich.+n.........................PE..d...j..g.........." ......................................................................`.........................................P3.......3..@...............D........................................... ...(... ................................................text............................... ..`.rdata..L...........................@..@.data................l..............@....pdata..D............r..............@..@.qtmetado............~..............@..P.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QHPR_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	364544
Entropy (8bit):	6.4959469184242735
Encrypted:	false
SSDEEP:	6144:I7lFMU+DIJaUthVezRKgC294EAA/dOY3T69W4cOjdKrgb33uVq5UtmUEeXjb:IxSU+DIU6p2ZO2W90P
MD5:	182794EC6C7E81E6FE33AD5EFEC2CED6
SHA1:	6F7C46A98DC62899A5E3869F32AC403166CE4C6F
SHA-256:	691A4E08C5D84CFE3E6FD5CA2D8088221AF86FD27657FA5B452E2951D25DD1F1
SHA-512:	29BE9CA3538F88179B4AAAFB88227A8F0EBADE370758E0B312C901CBBE8BE52ABBEF13433016FB0F3888C36A9EF25970FD7E5D43E4F754B994BB84D56BB3715C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.i....................6......U.......U.......U.......U.......L...............................................................Rich............PE..d...)..g.........." .....R...b......xP....................................................`......................................... ...x.......T................+.................. .......................@...(...@................p...............................text....Q.......R.................. ..`.rdata..B....p.......V..............@..@.data....,...p.......R..............@....pdata...+.......,...X..............@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QJSON_RPC_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	5.706468056806483
Encrypted:	false
SSDEEP:	1536:9k4/Mci6r3c8rqCn4ECmDaIwZMf7SHQQg:9Wir36CnDCmDtes7o5g
MD5:	2A1AF3679C02070A52A13B75B548310F
SHA1:	912BBFEBABAEFDB581CD88D2695AC5B8EA9A08C0
SHA-256:	34CE6BD3C5981C8C6E0EA329F30473E10511B01A5C901E70820CC0684F90B2DD
SHA-512:	C3490BB968E6B0C4FFC4458F7AD4AC0C67610C87C868A9BE436EBED641BAD820DB8297A9F92FA2244FDE3B5B50C4E409DD292FF2B792518AD7BD9657536F82D0
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^.....o...o...o.......o.H.j...o.H.k...o.H.l...o.H.n...o.Q.n...o...n...o...n...o...n.I.o...j...o...o...o.......o...m...o.Rich..o.................PE..d...&..g.........." .................y....................................................`.........................................P...........,....p.......P..................8...@.......................`...(...`................................................text...{........................... ..`.rdata..D...........................@..@.data........@......................@....pdata.......P......."..............@..@.qtmetad]....`.......,..............@..P.rsrc........p......................@..@.reloc..8............0..............@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QLAS_IO_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	331776
Entropy (8bit):	6.093352707192958
Encrypted:	false
SSDEEP:	6144:rFQnkwlKk8uChUCw63q16OAVsLaCXPUy+VOYWZXUqX8SI2rrAt3d4hlUPytQ54GY:ekw0k8dUZas2CrLh
MD5:	838D1AEFC3FDBC6E138D6513B714FE7B
SHA1:	5B4C6818BFE34684138757E1690CAD5A730A36CE
SHA-256:	E242F8C764A015DEA36CCA2A183A431A53680BD5E5FC4F24F9D878909E90A61D
SHA-512:	66717B006A31FE9D8001F0A1AFCE4961C7D8DED050CC9C67C7EBDCF4B85902F10D49B5E1825547049224A63A0F6991C97EDDA3566E82C45476E1C20D51A6789C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................;...................(...................b.............Rich....................PE..d...k..g.........." .....r..........@[.......................................`............`.............................................\|...L...@....@..........\|............P.......=.......................>..(....=...................%...........................text....p.......r.................. ..`.rdata...\.......^...v..............@..@.data...............................@....pdata..\|...........................@..@.qtmetad.....0......................@..P.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QM3C2_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	420864
Entropy (8bit):	7.017370754405623
Encrypted:	false
SSDEEP:	6144:2Aa3aJFF+Po+4qnyRil/VcrSv2oGjDLXabtl+qTG1OmRwMMkuIO1ryswPijPuUKw:7PLFfqnuTo2D3AG14FktOh
MD5:	B623F80A4A8EA781520D28E372871E6C
SHA1:	E4BCC0D38771C80AD74515F713030C3E4A3FAEE4
SHA-256:	B47DA49ACB85BC7444F0B541B2C291711E2ABC3F4D6C3C7BFA40E160F0FB1C7E
SHA-512:	F41E1D6A78D1B94888D2A9D239220C39FB3F33F43EA484BB863D4AEEEE047FE61C35716012C0265BBD5F8D7A25E37DFC11870B333D958F6E637DF25D87303258
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...rj.rj.rj.{.F.xj. ..dj. ..zj. ..pj. ..vj.9..pj....zj....uj.rj..i....zj....sj...*.sj....sj.Richrj.........PE..d...P..g.........." ................x.....................................................`..............................................R..Pj..@............p..................................................(....................................................text............................... ..`.rdata...r.......t..................@..@.data...h....P.......8..............@....pdata.......p.......H..............@..@.qtmetad.............X..............@..P.rsrc................\..............@..@.reloc...............^..............@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QMANUAL_SEG_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	316928
Entropy (8bit):	6.223565644541473
Encrypted:	false
SSDEEP:	3072:zdxdtadpwya3eLy5j3OtVVVmMaW+2FdEXwxCJA1jUJ18oxzD/2a7IXACAX2r:5YnMgMSz18umXwxssW18o9bE9AX2r
MD5:	6282EFE661D435A3D98DB5C7FD214B0E
SHA1:	47BEC89BBEC8D729F8E663328B4D12243A864411
SHA-256:	7389CE534D96406574370A2C0D3439D1F39A2D8B158E9AC60C8AC643A15433BF
SHA-512:	6A624FE9D2E900CB3665DC8DF51AFF111B42F5E60A4DF15C5CD26D7792538508D6C1193C3516E4A3593E5576423DC9C81FDF76E0F2F1AECE79A571800FAB36E2
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$....................G...................................4.....5........t..4.....4.....4.....4.+....4.....Rich...................PE..d...x..g.........." ................t........................................ ............`..........................................$.......%...................+..............P...`...........................(.................... ..0............................text............................... ..`.rdata...m... ...n..................@..@.data...P%...........\|..............@....pdata...+.......,..................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QMESH_BOOLEAN_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1361920
Entropy (8bit):	6.441693455500275
Encrypted:	false
SSDEEP:	24576:6YpS27MkXILSoe6WBg2GXfc9pFB9pF/WOZNVJmC:6EMk4pe6WBg2Gvc9pFB9pF/WOZhmC
MD5:	2B9053038D000CC42E3A1B8B8862C971
SHA1:	97C3274374A640F0E79F93558C8BC6615F5E5568
SHA-256:	3A1A9BC4F3C77E863B864BDB9749B01664EE2A2E121BBEB98E982F3447F6A721
SHA-512:	0DD811012295FE9EFBD3F7BECBEEB59D395049ADD9D2A175B080AF7E479D52CF8D071CEE5752E6105C115C7D25C825FFF127E66EF5607BB9D1DEF8F71E05F6EF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........NX+./6x./6x./6x.W.x./6x.G2y./6x.G5y./6x.G3y./6x.G7y./6x.W7y./6x.Y.x./6x$_7y./6x.F7y./6x./7x.,6x.F3y./6x.F6y./6x.F.x./6x.F4y./6xRich./6x........PE..d...x..g.........." .........J......X........................................ ............`..........................................w......Dx..h............`..\...................p...........................(.......................p............................text............................... ..`.rdata..H}.......~..................@..@.data...p0... ...*..................@....pdata..\....`......................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QMPLANE_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	6.02419104352401
Encrypted:	false
SSDEEP:	3072:+yeGccIj8jidrMGzR2GvUjgWjidUykuJHgkX8QK5yn34yqPE0i0PpJ:xetNWihzR2GsjgQiWReHgkX8QK5yn34n
MD5:	818363094BDA8CEDF7A3A763F9DCBFE4
SHA1:	EEB593167B2E3B3284A686832B2304EEFA7E50DC
SHA-256:	5948F61BDBD5366012C56418C21FA5665A16C295B5D492874C78D4535497E00C
SHA-512:	2723BE8BA0E6332966F8A13FC3E69EC89E5CF885EA4DF91C43E56E3D4ECEBEC24E0CEFFC9E051C7B0B363A5EAAEE2B3F1EB5CD99FCDB006540A1E84EFB45B0D4
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[..5..5..5.....5...0...5...1..5...6..5...4..5...4..5.h.4..5.K.4..5..4.g.5.K.0..5.K.5..5.K...5.K.7..5.Rich.5.........................PE..d...E..g.........." .........n......T........................................p............`..........................................u..\|...,v.......P.......0...............`.......5.......................6..(....5...............................................text............................... ..`.rdata...C.......D..................@..@.data...8...........................@....pdata.......0......................@..@.qtmetad.....@......................@..P.rsrc........P......................@..@.reloc.......`......................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QPCL_IO_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	316416
Entropy (8bit):	6.1927679608514135
Encrypted:	false
SSDEEP:	6144:/k2B70hUcIBUDc1NSkJjZsQzRUbgSQDXUqK55mUgjGqj4YKp:/k2BC6BUDc1wAzOQ
MD5:	D0917D3646F86D8DCDFE709547CDD7DA
SHA1:	BE36123C1DD825A91245B13DCFF2BC6A9914CA95
SHA-256:	1774ECAC1EBA3F56E74A0815D62763927DCE7EB0C1657D1275A277AAED351347
SHA-512:	642D453CB10398BEEE7B2746E32BFE6FDB650E85BE36C49127DDEF27C1BA47C07006DFE1F0A39A3F5F9F7552CB69133F3D47AA07D502C6DB8D91F1FF43496D84
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S{{..............b......Er......Er......Er......Er......\b......s......s......j......s..............s......s......s......s......Rich............PE..d......g.........." ................`........................................ ............`.........................................0...\|........................'...................V.......................W..(....V..................H............................text............................... ..`.rdata..............................@..@.data...............................@....pdata...'.......(..................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QPCL_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	770048
Entropy (8bit):	6.354803561730781
Encrypted:	false
SSDEEP:	12288:faGFclpTrMvgd4IY9vht1Ccd8rQ+lQK3X5gPHl:J4prMzv8rwS5gPl
MD5:	599F1F3542B6FE33112F6382D0940E90
SHA1:	0D1A67C6F447E68C4BE6D5EB7D56137DDB89B57A
SHA-256:	D36076A06F5698F073B56834015A257B0945684B2D8E87CF4223D3823D76401A
SHA-512:	C6BFBEE4915C6315E8750AA35741C74771374F5CBF34F55FFDB70A9AB35DD8F91291DAFE0A7E7B737CD5D64C8DA9B285AD519A5D0A57D393C47D759EF0A21898
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'...F.M.F.M.F.M.>NM.F.M...L.F.M...L.F.M...L.F.M...L.F.M.>.L.F.Mb/.L.F.MA6.L.F.Mb/.L.F.M.F.M.E.Mb/.L.F.Mb/.L.F.Mb/"M.F.Mb/.L.F.MRich.F.M................PE..d.....g.........." .....................................................................`..........................................r..x....s..\|............p...]..............X...0 ......................P!..(...P ...............@..8............................text...K(......................... ..`.rdata.......@......................@..@.data....>...0...8..................@....pdata...]...p...^...J..............@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QPCV_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	108032
Entropy (8bit):	5.862335076596899
Encrypted:	false
SSDEEP:	3072:vFXiKQQSP+pAK0V1bmB05idIzV/SYDYWZXUqK5Gt3d4hagjGjs898jm:vFbZSjK0VU653J/SYDYWZXUqK5Gt3d4Q
MD5:	8A6C6D702D6BBA4C871F3DD53FA2798A
SHA1:	024A0AB1EB863D73FEE204A3586972908D650C93
SHA-256:	C996075B8E024900DC234617FDEE684A70B6485B30A475912DAFCC89762C14FC
SHA-512:	3B1AD8DB67D95FF70B40B76542BEA099861E84E94028633661227E5AE89E0B37244851714EEEA9B3CA67F89649A6B59108B02C1FF5A372A935D2D97DDEA33A2F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@.E..............V.....V.......V.......V.......V...............O.........................................:.............Rich............................PE..d.../..g.........." .....................................................................`.........................................06..x....6..T...................................p...........................(.......................(............................text............................... ..`.rdata..&...........................@..@.data...............................@....pdata..............................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QPHOTOSCAN_IO_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	173056
Entropy (8bit):	6.28250687905917
Encrypted:	false
SSDEEP:	3072:sfuX2oK8zK6VZXHL6MeXVhpDHKTBfCQDEt6B3SJMhyvOU:YuX2/8zXPXHOpnpDHKTBqQo2hyvx
MD5:	B0B546CCB963E0AA404D0BF60B3BD1ED
SHA1:	11FB2F616C12C00075B2F15E2A1D14CF17CE45E9
SHA-256:	E54D57A7957F6ACF88345C143BCBC4B76850F1CED48F74A452C1DCBBD23D3188
SHA-512:	FA6C3194FF9B159089111762B9893F459514840C8434E57FB05AF3D8D89C94AA255D9DF11928E6C65084978E5F30F7066E795160E17B37F8A26AC7D9FABAE59B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f...".k.".k.".k.+...(.k.p.n.7.k.p.o..k.p.h.!.k.p.j.&.k.i.j. .k..o..k..j.$.k..j.%.k.".j..k..o. .k..n.+.k..k.#.k...#.k..i.#.k.Rich".k.........PE..d...6..g.........." .....d...B...... R....................................................`..........................................9.......9..................d...............<...P.......................p...(...p................................................text...[b.......d.................. ..`.rdata..<............h..............@..@.data...............................@....pdata..d...........................@..@.qtmetadp...........................@..P.rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QPOISSON_RECON_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1346048
Entropy (8bit):	6.288854706571648
Encrypted:	false
SSDEEP:	12288:t2DZIuKxxUx0vcOe2HD9u7Hi1rudaUH3S9Wo3n4UBYuN+KEA/gb4Y+:CKxxUx0vcOe2Iu1rudaUHqesX
MD5:	53F46FFC523CEAB1FAAC4C667EB06168
SHA1:	C4FEB1473E0FD2B90DF289B98DF0399646D0BA6B
SHA-256:	62A7E7B2C1FB8C2F1543B2C8AA3D7CB4D4CACA0FF14F9DE73E19EFED2EB745F3
SHA-512:	F519F5029AD0C7C656256C6E6B7C78D465B6902BF96E180C54DB8CEB55BD84B5DA5D543FD770C20FBAE1FF368780D66F9ACEA9404D88FCF77513BDFF14410FFF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P..P..P..(..P...8..P...8..P...8..P...8..P...(..P... ..P..%9..P..P.."S..%9..P..%9..P..%9n.P..%9..P..Rich.P..................PE..d...8..g.........." ................D3....................................................`......................................... ...........@....P..........P\|...........`.................................(....................................................text............................... ..`.rdata..............................@..@.data....%.......b...x..............@....pdata..P\|.......~..................@..@.qtmetadt....@.......X..............@..P.rsrc........P.......\..............@..@.reloc......`...,...^..............@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QRANSAC_SD_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	523776
Entropy (8bit):	6.389601028187329
Encrypted:	false
SSDEEP:	6144:5bWXCihAWw8nKsZjlcsJULzI6d7W77NZ3VW02d19advWYo2HdDvd2aZLSPU6+VY5:56CiejqlcsJUYI7W77vMdd1iBdtm
MD5:	8F3A2705AD8A5E19C224B36E22BD6DB8
SHA1:	EBCD0FBF3009A8182E8DAB031F9F866B2852D06B
SHA-256:	7896DC19C928DFA9CDF1955696D144C555B6AACB944EBA62DC0870D9A97957EA
SHA-512:	FB751BCB18121A98D6BB175719E463CEBA158B981FDDEDAC197C99B873B2FE2FCC9E5FC9E1D08897FCAFA3C069705E9431366FA2C544476EA4274250920B34DE
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................).........................................>............>......>......>.E....>......Rich...........PE..d...=..g.........." .........................................................`............`.........................................P..........@....0..........l...........@..(...............................(.................... ...............................text............................... ..`.rdata....... ......................@..@.data...H....@.......&..............@....pdata..l.......,..................@..@.qtmetad..... ......................@..P.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QRDB_IO_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	172032
Entropy (8bit):	5.89641363334421
Encrypted:	false
SSDEEP:	3072:b6Cb6EUwSEadKUEFUIxigkChM0GpyUw8lgkswXpqwliOXUqXrjnmtUPGwMfci:56sZadKfUF5yM0SyvI5swXpqwliOXUqX
MD5:	D2CC1707FBAC27F315C2B3F6327E140F
SHA1:	ED511A987A2F7CC3D356DC9DC79570F6FA2F58C2
SHA-256:	A800B6DA1590B479D87C8438CCAD330B225A28D68DD79B9F9CF6D92D3AB56344
SHA-512:	50C0BCCD027E5422305178A4E65790B4F25C55402E5527FA96C4BF01283E11D422A3BB36B9E071B2A715ADDE6DDF27698857C13E7379C61C54F090A908B104BD
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.P./.>./.>./.>.&...%.>.}.;.:.>.}.:.'.>.}.=.-.>.}.?.+.>.d.?.-.>.4...-.>...?.).>...?.(.>./.?..>...;.(.>...>...>.......>...<...>.Rich/.>.........PE..d...`..g.........." ......................................................................`.........................................`...\|.......,....................................e.......................f..(....e...............................................text............................... ..`.rdata...m.......n..................@..@.data................p..............@....pdata..............................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QRIEGL_IO_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	5.785738063158019
Encrypted:	false
SSDEEP:	1536:xSYxmiiU4t+kpIJm2Ux6d6IjPI2kovWXv7liuKovWXvho6Ux:QMmiy+kCm2Ux6Ntg7lijvho6Ux
MD5:	797B066E161D1344E0C3E2903FE5F46B
SHA1:	725466588FA7D46A20108D66823FF8E36A967EAE
SHA-256:	34D2B492F6E636564FF2DB0C6CB26EB4BFD533E8F9D61A11B5B7E22E0A6D73A0
SHA-512:	467729520876F34FF3953BEDA3BA52E0AAB067A0150B1E956291EFF5EAFC6D4EFD1842482ADFA2C2FCDD4133799462A6173299987F39308AF36C78C3D9E39480
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8.y.Yl.Yl.Yl.!..Yl.1i+.Yl.1h+.Yl.1o+.Yl.1m+.Yl.!m+.Ylg)m+.YlD0m+.Yl.Ym.XlD0i+.YlD0l+.YlD0..YlD0n+.YlRich.Yl........................PE..d...>..g.........." ......................................................................`.................................................p...................................................................(.......................x............................text...[........................... ..`.rdata..............................@..@.data................r..............@....pdata...............z..............@..@.qtmetadP...........................@..P.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QSRA_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	462848
Entropy (8bit):	6.1517197219214514
Encrypted:	false
SSDEEP:	6144:sTrCuTSmCCDS+jV3nPAzNONxLAoaLPWYnzN3WnK3VoLw2iPuUjikVOYWZXUqX8Iq:xESfCDS+jV3sNOb9YzNe8
MD5:	CBC528A4688F05F18F323BB4A025F5FC
SHA1:	1EC1D2FCC448A7651B8B46C42CC3E99D66D89B6C
SHA-256:	9587E5617D41BDECE926A7F509DA4E4CC59D100BC6996D0053B50BC8445C4312
SHA-512:	D9F203DF2F268FC83588ADD08C578663A7517012009D43FA871CB08664C366CD023D92EB2A38F9379AC7929C3F44B3FA61BFEE73DFE1DFA0CE20FEDEF30BCD08
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..rr..!r..!r..!{..!\|..! .. z..! .. q..! .. k..! .. v..!9.. p..!. t..!.. {..!r..!...!.. ...!.. s..!.d!s..!.. s..!Richr..!................PE..d...W..g.........." .........v......Ho.......................................P............`.........................................p...x......T.... .......................0..x..............................(.......................*...........................text...H........................... ..`.rdata..l...........................@..@.data...`...........................@....pdata..............................@..@.qtmetad............................@..P.rsrc........ ......................@..@.reloc..x....0......................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QSSAO_GL_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	69120
Entropy (8bit):	5.054303653190612
Encrypted:	false
SSDEEP:	768:UzW7GvL0IMf8zvQwhDMJnTR2xJKsJAkXM8AFZWPxrul2B6Z4T4AEdE4TQUV:cW7DfoYwZaGKH1oPxrul2B6Z4TDg
MD5:	63B24FE8EECC0DF28FC94E0C01D580EE
SHA1:	2DC8D461F06F2E18D77978FEE91E7B340F00643C
SHA-256:	930785E71302472EFDC198E225775B9F8BABC863BB909161BCB683F32CAAE713
SHA-512:	952D326BA29BC4396799355B4218BBD8C99399B6B02C979689FC94354A10A3ADE2CBB80B04FCE6CB1616A3ED1BB1BEEDE472C4F24CB09491ECB0BF22EA2F2302
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.Zb..41..41..41..1..41M.10..41M.00..41M.70..41M.50..41T.50..41..50..41..50..41..51..41..00..41..10..41..40..41...1..41..60..41Rich..41................PE..d...;..g.........." .....P..........4R.......................................`............`.....................................................@....@....... ...............P..8...............................(....................`...............................text....O.......P.................. ..`.rdata..6....`.......T..............@..@.data...............................@....pdata....... ......................@..@.qtmetad.....0......................@..P.rsrc........@......................@..@.reloc..8....P......................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QSTEP_IO_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	5.659619833066197
Encrypted:	false
SSDEEP:	768:kD5tnELC2k08u7ZEQDRjCfHFZ9MR5tGSvWmjBhWy43mxJBLKdtz8DyChgxWA/Nrr:ijPsaQDRGPFZ9MR59pHctz6Xh1aKNqB
MD5:	FACF7AB3AE107401C49CB6714522E4FD
SHA1:	5B7A05D9D106502A103DAFDA0215EC90416EB291
SHA-256:	69CDB02A45887D86DE988CF990E54B6D370B832EB9682AB8FB5D06FAB0CB24A4
SHA-512:	DF65C33654248B5F492130F8B018D39E18A236FD2181742ACB2F8BD83B48C11226294C24996A0ED2A8E57048C2AEDFA0D8587E38C5AC1F6BFCE3B25429BE45F3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<..Mx...x...x...q.+.~......o......p......z......\|...3...z.......~......\|......w...x..........}......y....G.y......y...Richx...................PE..d...F..g.........." .....v...........o....................................................`.....................................................\|............p......................0.......................P...(...P...................X............................text....u.......v.................. ..`.rdata...............z..............@..@.data........`.......@..............@....pdata.......p.......H..............@..@.qtmetad.............R..............@..P.rsrc................T..............@..@.reloc...............V..............@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QTREEISO_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	651264
Entropy (8bit):	6.753107640302034
Encrypted:	false
SSDEEP:	12288:0vZsNBg/Oe0GGsK0EvT4LpAyBxe5OWRJd2jZRXyq6:0WNBgP0GxRMm3e5OWRTq
MD5:	CC8768E57582CE990A60B07A7FBE9A05
SHA1:	96058C0CFDA8E0318E2B6617D58803CFACE0DFB2
SHA-256:	719D97EF2D0A68290F0EC5DF1E5A3270C0F9835C019A2D2000008367E41F2B47
SHA-512:	825B6EBA254DA844805DFDAEC2623132B34666584076502EDB5DA762E704B0E9C7FE693254E8A6B22A92780B88D013D65F294C33AB8F81F3D08716CD88B4E35B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@.....@...@...@......@.V.D...@.V.C...@.V.E...@.V.A...@.O.A...@...A...@...A...@...A.'.@...E...@...@...@.......@...B...@.Rich..@.................PE..d...`..g.........." .........................................................0............`..........................................*..\|....+..T...............\|>........... ..P...0?......................P@..(...P?..................P............................text............................... ..`.rdata..............................@..@.data...p...........................@....pdata..\|>.......@..................@..@.qtmetadr...........................@..P.rsrc...............................@..@.reloc..P.... ......................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\QVOXFALL_PLUGIN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	422912
Entropy (8bit):	7.425381454206718
Encrypted:	false
SSDEEP:	6144:DVkjDczIQay6XxQM1+mXzoIpGUAlvtPJ2PaluoVuH9GGH8QXAtWfwOGjHhPuXik1:DWPDvr71NxAhUPvEGH9wv
MD5:	FF8997D34D249D75BA175C6013E9E7F0
SHA1:	3257506C7279879FF2235BC7BFE0702A498BB222
SHA-256:	BFA3E09AE7F649A4DD99E9667CBB715E75D0C6F4E6749EDC8EF37CE489626A58
SHA-512:	AC29C32179F2CE9D7AAF4048475A2600A209BA199D829F57E93B686B45C17EF6D3FEFDF322FA6BEBF2243E7943EBD08A754BBD3D7B79B0AB7EA9478BC6E5438F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H.$..\|J..\|J..\|J.....\|J.^.O..\|J.^.N..\|J.^.I..\|J.^.K..\|J.G.K..\|J...K..\|J...K..\|J..\|K.6.J...O..\|J...J..\|J......\|J...H..\|J.Rich.\|J.........................PE..d...j..g.........." .........r............................................................`............................................\|...l...,....................................O.......................Q..(....P............... ..0............................text...;........................... ..`.rdata..p<... ...>..................@..@.data........`.......H..............@....pdata...............T..............@..@.qtmetadA............b..............@..P.rsrc................f..............@..@.reloc...............h..............@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-09N3S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	92672
Entropy (8bit):	5.699025601635425
Encrypted:	false
SSDEEP:	768:ZH/4VAVjyv3/I+5sjlfsUbsqA4HGNtYAG7RehRRldqKqhaaShhNt42L2XI0:54BoSstswsb4HM9BQbohh/FL2XI0
MD5:	7E8B270B0F5D6FAC1C08287A2311F182
SHA1:	922F7BC5D619A87DE976FD245C92807B0D9D25E1
SHA-256:	8DEBB1DE532E8F19910A5171BC17A4F61D95F64EA218A0BA06428F629819989A
SHA-512:	39083C9BA8003B1E2D0E96BE80468D71D0CAEF02D8A528F83A59BEDA646BDC8AB73520AE66AE6BE6E4727F2C90D18D7833812946EF512410F4B299D738B40695
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................).........................................4......[.........^..4......4......4.E....4......Rich...................PE..d...O..g.........." .....z..........Hs....................................................`.................................................t...,............p..L...................0.......................P...(...P................................................text...;y.......z.................. ..`.rdata...............~..............@..@.data........`.......N..............@....pdata..L....p.......V..............@..@.qtmetad.............`..............@..P.rsrc................b..............@..@.reloc...............d..............@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-1BHUB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	176640
Entropy (8bit):	5.979004104906084
Encrypted:	false
SSDEEP:	3072:yDezrKCWiK4KUCT58JUpGK3ETnvMdnRSxDOkZXqi0n3d4Uwtv0QZdn1d5BKJ7:ygK4BC8JmGKU7MdRSxDOkZXqi0n3d4UN
MD5:	CAE0381FA5B340F4D994D60934FE517F
SHA1:	5B8DE02471B39CCC1159698A7029EBC918375F26
SHA-256:	9B8083EC253D0BE27D15BCF1FB9E8FFA2137C99E6608BB23D135FB082B03353A
SHA-512:	91EA95A3840723D3BBDFA062C7BC987E0EEE258A919119E6F901C6C1F2041D45815CAE4D1F682149FD05B94A7889E8FCA302F14BABCAB1BB51A32262DA915C5F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........GC..C..C..J...K......V......K......A......G......A.....E....D..C..\....J....B...}.B....B..RichC..........PE..d...=..g.........." ......................................................................`.....................................................................................(... .......................@...(...@................ ...............................text...;........................... ..`.rdata..Fu... ...v..................@..@.data...............................@....pdata..............................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-232MC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	523776
Entropy (8bit):	6.389601028187329
Encrypted:	false
SSDEEP:	6144:5bWXCihAWw8nKsZjlcsJULzI6d7W77NZ3VW02d19advWYo2HdDvd2aZLSPU6+VY5:56CiejqlcsJUYI7W77vMdd1iBdtm
MD5:	8F3A2705AD8A5E19C224B36E22BD6DB8
SHA1:	EBCD0FBF3009A8182E8DAB031F9F866B2852D06B
SHA-256:	7896DC19C928DFA9CDF1955696D144C555B6AACB944EBA62DC0870D9A97957EA
SHA-512:	FB751BCB18121A98D6BB175719E463CEBA158B981FDDEDAC197C99B873B2FE2FCC9E5FC9E1D08897FCAFA3C069705E9431366FA2C544476EA4274250920B34DE
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................).........................................>............>......>......>.E....>......Rich...........PE..d...=..g.........." .........................................................`............`.........................................P..........@....0..........l...........@..(...............................(.................... ...............................text............................... ..`.rdata....... ......................@..@.data...H....@.......&..............@....pdata..l.......,..................@..@.qtmetad..... ......................@..P.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-23FRJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	5.56216524552819
Encrypted:	false
SSDEEP:	768:NB//tTSg1XQ9BbTYqIb10G7uBVtpnoc+G9/qxyVl2B6Zq4AYUXRL:NB//Bhg9tYqIaPupxyVl2B6ZqLX
MD5:	D0035DFB056E4D41C22ADBC73A0610F5
SHA1:	C9BBA2F02EA2E19711DDB1694FB23D1783F90666
SHA-256:	A854FE42BD3DF262308C0AA558D9C4BD72E7A02503CE97A32B21584997640271
SHA-512:	80D89E6B5B45397EFA8CAD1C59BCB37B3527024334E086C9C97717ED8BB18FDAD055CEC05A393DAD1E903ED57F626892A8AD0EB2BA4833394138DB588F8D3A20
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5..T...T...T...,8..T..<...T..<...T..<...T..<...T..,...T..k$...T..H=...T...T..tT..H=...T..H=...T..H=T..T..H=...T..Rich.T..................PE..d......g.........." .....@...^.......A....................................................`..........................................~..\|...\...................d............... ....f.......................g..(....f...............P...............................text....?.......@.................. ..`.rdata...J...P...L...D..............@..@.data...X...........................@....pdata..d...........................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-3FSQ4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	69120
Entropy (8bit):	5.054303653190612
Encrypted:	false
SSDEEP:	768:UzW7GvL0IMf8zvQwhDMJnTR2xJKsJAkXM8AFZWPxrul2B6Z4T4AEdE4TQUV:cW7DfoYwZaGKH1oPxrul2B6Z4TDg
MD5:	63B24FE8EECC0DF28FC94E0C01D580EE
SHA1:	2DC8D461F06F2E18D77978FEE91E7B340F00643C
SHA-256:	930785E71302472EFDC198E225775B9F8BABC863BB909161BCB683F32CAAE713
SHA-512:	952D326BA29BC4396799355B4218BBD8C99399B6B02C979689FC94354A10A3ADE2CBB80B04FCE6CB1616A3ED1BB1BEEDE472C4F24CB09491ECB0BF22EA2F2302
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.Zb..41..41..41..1..41M.10..41M.00..41M.70..41M.50..41T.50..41..50..41..50..41..51..41..00..41..10..41..40..41...1..41..60..41Rich..41................PE..d...;..g.........." .....P..........4R.......................................`............`.....................................................@....@....... ...............P..8...............................(....................`...............................text....O.......P.................. ..`.rdata..6....`.......T..............@..@.data...............................@....pdata....... ......................@..@.qtmetad.....0......................@..P.rsrc........@......................@..@.reloc..8....P......................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-4H4J7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	418816
Entropy (8bit):	6.226647789656364
Encrypted:	false
SSDEEP:	6144:FK1HkSgTvS0y0PupZ3n5IudVJ3agowgieMjNhDhu7juPU7+VYWXUq5jt34rUjGbs:FKdgTvY0235DJtdjNhDhKSD
MD5:	C6432247B75174F587472B3721D3742F
SHA1:	40A4DA32B40B98C09BF9926D81FC7DE03A39E705
SHA-256:	B91970A166CE4E44EC392D8C4193996D9079F17A1A2135232891FFB677B0FCA6
SHA-512:	6073987EBAE011A4FF3D24CB8778128073AB900E43F1D322781860D26C55EFEDBCE31C6ED586573D307E8C05CD93BE366245B18B84DD7CFBA2FF2864FF0FACA0
Malicious:	false
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........db...........}......m......m......m......m......}.....#u......l......f............l......l......l......l......l.....Rich............................PE..d...q..g.........." .........z......4.....................................................`.........................................P].......]...............@...0..............<...............................(....................................................text...x........................... ..`.rdata..>...........................@..@.data... )......."..................@....pdata...0...@...2..................@..@.qtmetad.............P..............@..P.rsrc................T..............@..@.reloc..<............V..............@..B................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-51UVB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	179712
Entropy (8bit):	5.852434135668565
Encrypted:	false
SSDEEP:	3072:4hxnD6aRnrTiNTOPIGx2WhkaFzRRfxXUfBG2JyKD2ZEeyaYstPuUSikVYWXUqX8j:u7yNO2WVzRRfVUfBjkKyZdyaYstPuUSY
MD5:	66A1CE3D888299DD5BE35A198D3F4193
SHA1:	A50F711813243687966E82C8074199EE6D0CA5FA
SHA-256:	3992F7A2AEEEC2B0F980945CA7E234CF9B5A3E3DBC22175B7CA7E32F33EA15F6
SHA-512:	54333662EB185F693AEEA7B75F5A1AEE101AD863E7DB98AD1997DB5065388560C73E772B2855338594BE37F0704046F39A348A83F8C0586DD8BEC70D7A51DAE7
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h.i.,..H,..H,..H%..H$..H~..I8..H~..I$..H~..I...H~..I(..Hg..I...H...I..H...I%..H,..H...H...I..H...I-..H...H-..H...I-..HRich,..H........PE..d...u..g.........." ................ .....................................................`.........................................`...........,............... ...............................................(....................................................text............................... ..`.rdata..............................@..@.data...............................@....pdata.. ...........................@..@.qtmetad@...........................@..P.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-58SRQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	364544
Entropy (8bit):	6.4959469184242735
Encrypted:	false
SSDEEP:	6144:I7lFMU+DIJaUthVezRKgC294EAA/dOY3T69W4cOjdKrgb33uVq5UtmUEeXjb:IxSU+DIU6p2ZO2W90P
MD5:	182794EC6C7E81E6FE33AD5EFEC2CED6
SHA1:	6F7C46A98DC62899A5E3869F32AC403166CE4C6F
SHA-256:	691A4E08C5D84CFE3E6FD5CA2D8088221AF86FD27657FA5B452E2951D25DD1F1
SHA-512:	29BE9CA3538F88179B4AAAFB88227A8F0EBADE370758E0B312C901CBBE8BE52ABBEF13433016FB0F3888C36A9EF25970FD7E5D43E4F754B994BB84D56BB3715C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.i....................6......U.......U.......U.......U.......L...............................................................Rich............PE..d...)..g.........." .....R...b......xP....................................................`......................................... ...x.......T................+.................. .......................@...(...@................p...............................text....Q.......R.................. ..`.rdata..B....p.......V..............@..@.data....,...p.......R..............@....pdata...+.......,...X..............@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-5R3DL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	199680
Entropy (8bit):	5.994057512347577
Encrypted:	false
SSDEEP:	6144:7Zf559/yXbc5N6Od7wUZiVOYWZXUqX8wrAAt3d4thaPytaGmdFSVX0Go3E:7Zf1qYXd
MD5:	B0CC9E45C8D303F745F0B68762C8A112
SHA1:	CF860A5490A7722B992A5AA783D463F5A40B8DC0
SHA-256:	3A224F72F4338C977E1CBEFDFCDEF4FF11BB1BE6B1283365710F746B98F74AB0
SHA-512:	318BB5009060E937B4D4EA4569458083BBD4D9D81EF07027AC41CD0CAF18D36FEDE6007514190FE86361A0BBA19EE0DE1A59B0B312C32BFEC0F4D4110AD57BF4
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(b.l...l...l...e{?.f...>k..x...>k..d...>k..n...>k..h...'{..n...l...E....s..j....j..k...l........j..k....j..m....jS.m....j..m...Richl...................PE..d...V..g.........." .....0...........$.......................................P............`.................................................P...\|....0..........,............@......@.......................`...(...`................@...............................text............0.................. ..`.rdata..t....@.......4..............@..@.data...............................@....pdata..,...........................@..@.qtmetad..... ......................@..P.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-7SBVS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2413568
Entropy (8bit):	5.788428616549328
Encrypted:	false
SSDEEP:	49152:jvh3MIAWPmR2DXCVLDzh5mJ8dIfialhjj/:jx+WPCVqfvjT
MD5:	6FCB8364953136BD82083C3D83811BA1
SHA1:	ABBC9B532F13CF6EF25FAC46F25E534BD294171C
SHA-256:	5D1595E5041B3773B3755D16E1AC291F04E99EE429479398410586434450C320
SHA-512:	391C676EEFBF7E4271955E0C7BCAB0F0FA0BB569E92D8BEAC6F8F538F9B43EC2FA19C72FE5DDFD4FC874EB29170DFC2640F22C5B43DBB88B3F8D93233F9F55B5
Malicious:	false
Reputation:	low
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.........GY.s)..s)..s)......s).P....s)...,..s)...-..s)...*..s)...(..s)...(..s).u.,..r).H.(..s).k.(..s)..s(..q).k. ..s).k.,..s).k.)..s).k....s).k.+..s).Rich.s).........................PE..d...1..g.........." ........................................................ %...........`..........................................f .\|...\g .......$.......#...............$..;..............................(....................................................text............................... ..`.rdata..............................@..@.data.........!....... .............@....pdata........#.......#.............@..@.qtmetadr.....$.......$.............@..P.rsrc.........$.......$.............@..@.reloc...;....$..<....$.............@..B........................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-84SFH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	172032
Entropy (8bit):	5.89641363334421
Encrypted:	false
SSDEEP:	3072:b6Cb6EUwSEadKUEFUIxigkChM0GpyUw8lgkswXpqwliOXUqXrjnmtUPGwMfci:56sZadKfUF5yM0SyvI5swXpqwliOXUqX
MD5:	D2CC1707FBAC27F315C2B3F6327E140F
SHA1:	ED511A987A2F7CC3D356DC9DC79570F6FA2F58C2
SHA-256:	A800B6DA1590B479D87C8438CCAD330B225A28D68DD79B9F9CF6D92D3AB56344
SHA-512:	50C0BCCD027E5422305178A4E65790B4F25C55402E5527FA96C4BF01283E11D422A3BB36B9E071B2A715ADDE6DDF27698857C13E7379C61C54F090A908B104BD
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.P./.>./.>./.>.&...%.>.}.;.:.>.}.:.'.>.}.=.-.>.}.?.+.>.d.?.-.>.4...-.>...?.).>...?.(.>./.?..>...;.(.>...>...>.......>...<...>.Rich/.>.........PE..d...`..g.........." ......................................................................`.........................................`...\|.......,....................................e.......................f..(....e...............................................text............................... ..`.rdata...m.......n..................@..@.data................p..............@....pdata..............................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-8A210.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1346048
Entropy (8bit):	6.288854706571648
Encrypted:	false
SSDEEP:	12288:t2DZIuKxxUx0vcOe2HD9u7Hi1rudaUH3S9Wo3n4UBYuN+KEA/gb4Y+:CKxxUx0vcOe2Iu1rudaUHqesX
MD5:	53F46FFC523CEAB1FAAC4C667EB06168
SHA1:	C4FEB1473E0FD2B90DF289B98DF0399646D0BA6B
SHA-256:	62A7E7B2C1FB8C2F1543B2C8AA3D7CB4D4CACA0FF14F9DE73E19EFED2EB745F3
SHA-512:	F519F5029AD0C7C656256C6E6B7C78D465B6902BF96E180C54DB8CEB55BD84B5DA5D543FD770C20FBAE1FF368780D66F9ACEA9404D88FCF77513BDFF14410FFF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P..P..P..(..P...8..P...8..P...8..P...8..P...(..P... ..P..%9..P..P.."S..%9..P..%9..P..%9n.P..%9..P..Rich.P..................PE..d...8..g.........." ................D3....................................................`......................................... ...........@....P..........P\|...........`.................................(....................................................text............................... ..`.rdata..............................@..@.data....%.......b...x..............@....pdata..P\|.......~..................@..@.qtmetadt....@.......X..............@..P.rsrc........P.......\..............@..@.reloc......`...,...^..............@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-8BQMI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	770048
Entropy (8bit):	6.354803561730781
Encrypted:	false
SSDEEP:	12288:faGFclpTrMvgd4IY9vht1Ccd8rQ+lQK3X5gPHl:J4prMzv8rwS5gPl
MD5:	599F1F3542B6FE33112F6382D0940E90
SHA1:	0D1A67C6F447E68C4BE6D5EB7D56137DDB89B57A
SHA-256:	D36076A06F5698F073B56834015A257B0945684B2D8E87CF4223D3823D76401A
SHA-512:	C6BFBEE4915C6315E8750AA35741C74771374F5CBF34F55FFDB70A9AB35DD8F91291DAFE0A7E7B737CD5D64C8DA9B285AD519A5D0A57D393C47D759EF0A21898
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'...F.M.F.M.F.M.>NM.F.M...L.F.M...L.F.M...L.F.M...L.F.M.>.L.F.Mb/.L.F.MA6.L.F.Mb/.L.F.M.F.M.E.Mb/.L.F.Mb/.L.F.Mb/"M.F.Mb/.L.F.MRich.F.M................PE..d.....g.........." .....................................................................`..........................................r..x....s..\|............p...]..............X...0 ......................P!..(...P ...............@..8............................text...K(......................... ..`.rdata.......@......................@..@.data....>...0...8..................@....pdata...]...p...^...J..............@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-8RLKI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	5.785738063158019
Encrypted:	false
SSDEEP:	1536:xSYxmiiU4t+kpIJm2Ux6d6IjPI2kovWXv7liuKovWXvho6Ux:QMmiy+kCm2Ux6Ntg7lijvho6Ux
MD5:	797B066E161D1344E0C3E2903FE5F46B
SHA1:	725466588FA7D46A20108D66823FF8E36A967EAE
SHA-256:	34D2B492F6E636564FF2DB0C6CB26EB4BFD533E8F9D61A11B5B7E22E0A6D73A0
SHA-512:	467729520876F34FF3953BEDA3BA52E0AAB067A0150B1E956291EFF5EAFC6D4EFD1842482ADFA2C2FCDD4133799462A6173299987F39308AF36C78C3D9E39480
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8.y.Yl.Yl.Yl.!..Yl.1i+.Yl.1h+.Yl.1o+.Yl.1m+.Yl.!m+.Ylg)m+.YlD0m+.Yl.Ym.XlD0i+.YlD0l+.YlD0..YlD0n+.YlRich.Yl........................PE..d...>..g.........." ......................................................................`.................................................p...................................................................(.......................x............................text...[........................... ..`.rdata..............................@..@.data................r..............@....pdata...............z..............@..@.qtmetadP...........................@..P.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-9UK7J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	256000
Entropy (8bit):	6.02324937299118
Encrypted:	false
SSDEEP:	6144:ub3DYs9jX5c8AyhnZONYRfSWDOYWZXUqXQ2r1At3d4haPqjaGQzJAS:ub3DYkJNZOCl
MD5:	3B591115D780BFE4451617ADF78ED6C0
SHA1:	C02FA4AAADD880BD67BB4F4ECA3F7D14B1BB6EB1
SHA-256:	42C6CA961FCF7BA295C6E5B557791CB31A7BEEEAEEB93537B7305D7D88822F61
SHA-512:	B140C1E6AFEFB0730EC260E5A14CABCF2B12CBCE93EB9D94C2652DE275DC1BF0F3C9277C83B8AB04C573C1F0278C859DD7AC5B3491DBDEA0067080173B42D798
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d#.Y.M.Y.M.Y.M.P}.U.M..mH.L.M..mI.Q.M..mN.Z.M..mL.].M..}L.[.M..uL._.M..lL.P.M.Y.L...M..lH.W.M..lM.X.M..l..X.M..lO.X.M.RichY.M.........PE..d...v..g.........." .........4......X........................................0............`.................................................$...T............................ .......i.......................j..(....i...............................................text............................... ..`.rdata..............................@..@.data...(...........................@....pdata..............................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-A6DSE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	809984
Entropy (8bit):	7.311103595541181
Encrypted:	false
SSDEEP:	24576:McEE5PGNJcyJDJKpEW+QCWYCG9XnZJmy5njJ4:MLE5P2ayJDJqgWY9dNJjJ
MD5:	9014EA0027A81C883FF4306AF520ECA1
SHA1:	DF47F88964B5BC61B4E64E52F82ADA16CD2621FB
SHA-256:	1088FC098DB5CAB69AB2EBDB746499917427153B638236874E4D4E787CAA7C48
SHA-512:	DB62B6D9CD89D373D6899AC72BE54EEF40D0661208DD3C4D4A339215268AC2064AB11E17F9282CCB6E31D957DCA10DAA10379A711914B17268BCFBD71251FEBB
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........j..j..j...%.j......j......j......j......j......j..6...j......j......j..j...n......j......j....I.j......j..Rich.j..........................PE..d.....g.........." .....x..........0?....................................................`..........................................)..\|...L*..h............P... ..................@F......................`G..(...`F...................#...........................text...kw.......x.................. ..`.rdata...............\|..............@..@.data...X....0......................@....pdata... ...P..."...&..............@..@.qtmetad.............H..............@..P.rsrc................J..............@..@.reloc...............L..............@..B........................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-AKS9N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	5.706468056806483
Encrypted:	false
SSDEEP:	1536:9k4/Mci6r3c8rqCn4ECmDaIwZMf7SHQQg:9Wir36CnDCmDtes7o5g
MD5:	2A1AF3679C02070A52A13B75B548310F
SHA1:	912BBFEBABAEFDB581CD88D2695AC5B8EA9A08C0
SHA-256:	34CE6BD3C5981C8C6E0EA329F30473E10511B01A5C901E70820CC0684F90B2DD
SHA-512:	C3490BB968E6B0C4FFC4458F7AD4AC0C67610C87C868A9BE436EBED641BAD820DB8297A9F92FA2244FDE3B5B50C4E409DD292FF2B792518AD7BD9657536F82D0
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^.....o...o...o.......o.H.j...o.H.k...o.H.l...o.H.n...o.Q.n...o...n...o...n...o...n.I.o...j...o...o...o.......o...m...o.Rich..o.................PE..d...&..g.........." .................y....................................................`.........................................P...........,....p.......P..................8...@.......................`...(...`................................................text...{........................... ..`.rdata..D...........................@..@.data........@......................@....pdata.......P......."..............@..@.qtmetad]....`.......,..............@..P.rsrc........p......................@..@.reloc..8............0..............@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-C1KHU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	462848
Entropy (8bit):	6.1517197219214514
Encrypted:	false
SSDEEP:	6144:sTrCuTSmCCDS+jV3nPAzNONxLAoaLPWYnzN3WnK3VoLw2iPuUjikVOYWZXUqX8Iq:xESfCDS+jV3sNOb9YzNe8
MD5:	CBC528A4688F05F18F323BB4A025F5FC
SHA1:	1EC1D2FCC448A7651B8B46C42CC3E99D66D89B6C
SHA-256:	9587E5617D41BDECE926A7F509DA4E4CC59D100BC6996D0053B50BC8445C4312
SHA-512:	D9F203DF2F268FC83588ADD08C578663A7517012009D43FA871CB08664C366CD023D92EB2A38F9379AC7929C3F44B3FA61BFEE73DFE1DFA0CE20FEDEF30BCD08
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..rr..!r..!r..!{..!\|..! .. z..! .. q..! .. k..! .. v..!9.. p..!. t..!.. {..!r..!...!.. ...!.. s..!.d!s..!.. s..!Richr..!................PE..d...W..g.........." .........v......Ho.......................................P............`.........................................p...x......T.... .......................0..x..............................(.......................*...........................text...H........................... ..`.rdata..l...........................@..@.data...`...........................@....pdata..............................@..@.qtmetad............................@..P.rsrc........ ......................@..@.reloc..x....0......................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-DDST8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7794688
Entropy (8bit):	6.463547042992633
Encrypted:	false
SSDEEP:	49152:jto9kTHzq7czDlqm32WKMI57d6H+6yBg6CZNjHBEo/Uo9JKmjQwqZX+6+Yj7rne7:5ooDlq1BsMJ+ovWh4rdOqIkMVUaT7
MD5:	F76AB453BFBE4065FA95905950765C21
SHA1:	D6C512637C868ED73ADA1C38FEC3973065DF82F7
SHA-256:	646DC8D582D9A93B5FBC62C5212F698463EBF50537B2FEB7928EA1E560DBF34D
SHA-512:	4C6FF309B4B49927FD18387FAAABDD3C645743B8BB093963DB33E3971F4A366E386E90D29DE0BEFAABE15345D2D723FC625A23BBFAB9A13CD42EF53170DDE45B
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......M.KS..%...%...%......%..8....%.[.!...%.[.&...%.[. ...%.[.$...%.B.$...%...$...%...!./.%... ...%...$...%...$...%... ...%...%...%.......%...'...%.Rich..%.........PE..d...8..g.........." .....vU...!.....\.P......................................pw...........`.........................................psp.\|....sp.......w......`s.\............ w..K..0.b.....................P.b.(...P.b...............U.8............................text....tU......vU................. ..`.rdata..$w....U..x...zU.............@..@.data....G....q.......p.............@....pdata..\....`s.......s.............@..@.qtmetadE.....w.......v.............@..P.rsrc.........w.......v.............@..@.reloc...K... w..L....v.............@..B........................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-DG6LF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1361920
Entropy (8bit):	6.441693455500275
Encrypted:	false
SSDEEP:
MD5:	2B9053038D000CC42E3A1B8B8862C971
SHA1:	97C3274374A640F0E79F93558C8BC6615F5E5568
SHA-256:	3A1A9BC4F3C77E863B864BDB9749B01664EE2A2E121BBEB98E982F3447F6A721
SHA-512:	0DD811012295FE9EFBD3F7BECBEEB59D395049ADD9D2A175B080AF7E479D52CF8D071CEE5752E6105C115C7D25C825FFF127E66EF5607BB9D1DEF8F71E05F6EF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........NX+./6x./6x./6x.W.x./6x.G2y./6x.G5y./6x.G3y./6x.G7y./6x.W7y./6x.Y.x./6x$_7y./6x.F7y./6x./7x.,6x.F3y./6x.F6y./6x.F.x./6x.F4y./6xRich./6x........PE..d...x..g.........." .........J......X........................................ ............`..........................................w......Dx..h............`..\...................p...........................(.......................p............................text............................... ..`.rdata..H}.......~..................@..@.data...p0... ...*..................@....pdata..\....`......................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-E63HF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	100864
Entropy (8bit):	5.986356949370447
Encrypted:	false
SSDEEP:
MD5:	7A1C478B641E5E42BDB17D52DB27BCA9
SHA1:	DB5119B53A0CFA9FB4D2A5C4AF48891B4D1A0712
SHA-256:	FCDA7F52F90ECFB749C8E4289271C209DDC4685DBA3944A41894E2551DB247CB
SHA-512:	B5112CACD7A0A9F36B769CE496FD66CB5B1EB628424FBAAFF43E4E38EF113CFF031C11A8EA91D0709F7FB11B72982A96622E49043879E14FAABEAAD2A5A20C53
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J...+n..+n..+n..S...+n..Ck..+n..Cj..+n..Cm..+n..Co..+n..So..+n.x[o..+n.[Bo..+n..+o..*n.[Bk..+n.[Bn..+n.[B...+n.[Bl..+n.Rich.+n.........................PE..d...j..g.........." ......................................................................`.........................................P3.......3..@...............D........................................... ...(... ................................................text............................... ..`.rdata..L...........................@..@.data................l..............@....pdata..D............r..............@..@.qtmetado............~..............@..P.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-EJTBC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	173056
Entropy (8bit):	6.28250687905917
Encrypted:	false
SSDEEP:
MD5:	B0B546CCB963E0AA404D0BF60B3BD1ED
SHA1:	11FB2F616C12C00075B2F15E2A1D14CF17CE45E9
SHA-256:	E54D57A7957F6ACF88345C143BCBC4B76850F1CED48F74A452C1DCBBD23D3188
SHA-512:	FA6C3194FF9B159089111762B9893F459514840C8434E57FB05AF3D8D89C94AA255D9DF11928E6C65084978E5F30F7066E795160E17B37F8A26AC7D9FABAE59B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f...".k.".k.".k.+...(.k.p.n.7.k.p.o..k.p.h.!.k.p.j.&.k.i.j. .k..o..k..j.$.k..j.%.k.".j..k..o. .k..n.+.k..k.#.k...#.k..i.#.k.Rich".k.........PE..d...6..g.........." .....d...B...... R....................................................`..........................................9.......9..................d...............<...P.......................p...(...p................................................text...[b.......d.................. ..`.rdata..<............h..............@..@.data...............................@....pdata..d...........................@..@.qtmetadp...........................@..P.rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-EKSJ8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	228864
Entropy (8bit):	6.33558640199254
Encrypted:	false
SSDEEP:
MD5:	C4136253C43123F1AC10F8A3264105BB
SHA1:	56B6C6E55C5CA52E251013C43CF82C0323756AD3
SHA-256:	96AC8A5F9535F785D38D0E04ADC07B926316297D9BF4F31B40270E2DC103527C
SHA-512:	E9A590BCF344EB500AECE2EF31CAE9399715651A0357E2DAC00FCA9D0135045B0727FE76EE9DD21093D5DD050887C75928673351483ACD76753CA0F541C286E8
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........o.z.<.z.<.z.<...<.z.<...=.z.<...=.z.<...=.z.<...=.z.<...=.z.<...=.z.<+..=.z.<.z.<.y.<+..=.z.<+..=.z.<+.c<.z.<+..=.z.<Rich.z.<........................PE..d...b..g.........." .....2...N.......'....................................................`.............................................\|...\.......................................`6.......................7..(....6...............P..h............................text...{0.......2.................. ..`.rdata..f....P.......6..............@..@.data...H....p.......L..............@....pdata...............Z..............@..@.qtmetad\|............h..............@..P.rsrc................l..............@..@.reloc...............n..............@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-EV193.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	128512
Entropy (8bit):	5.681739065236602
Encrypted:	false
SSDEEP:
MD5:	C56F2BC406754EE7FCC98F207DF7E6A4
SHA1:	6BD56A580AAE0F5268F2E47205201D3E980B9425
SHA-256:	8F3B7191F8E63451C97E050197C95797823041318AB632B4890563A8AAD25C4C
SHA-512:	10B3369D8CCE4BDEBAC0F1194924E936A8B834B68432D55B4ABDA4AA85E6D4D9DB756823115B6C2E37B02F87FDFFC9CE717F6B977623325BABC5FD14AA0BC082
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............o..o..o......o..j..o..k..o..l...o..n..o..n...o.D.n..o.g.n..o..n.2.o.g.j..o.g.o..o.g...o.g.m..o.Rich.o.........................PE..d...&..g.........." .........t.......~.......................................P............`..........................................<......T=.......0.......................@..................................(....................................................text...K........................... ..`.rdata..hD.......F..................@..@.data...............................@....pdata..............................@..@.qtmetad>.... ......................@..P.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-EVN8N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	762880
Entropy (8bit):	6.830912301583025
Encrypted:	false
SSDEEP:
MD5:	19CA96363DED6BC2860E5B75E047A4FB
SHA1:	0695FE635DDD05AA03BCF5C8FFB10FEA2883B210
SHA-256:	896D546BFB5F1DAD137149AE1E79A5581C1E17DA54C971B28958BD0960F7FA1E
SHA-512:	03EA10E313BA0B6D82B9549B2D8E65A3B7BBF1F412C150C514021EDC70B8D3054AC65A2EEF4D1F8F3401E875C83AB496100A804AC1262B3AF60DBB0D23E78428
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........ol...?...?...?..?...?...>...?...>...?...>...?...>...?...>...?=..>...?...>...?...?...?...>...?...>...?...?...?...>...?Rich...?........PE..d...K..g.........." ................$.....................................................`.............................................\|...<....................-..................0.......................P...(...P....................%...........................text............................... ..`.rdata..r...........................@..@.data............\|..................@....pdata...-...........X..............@..@.qtmetad,...........................@..P.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-H5T2H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	446464
Entropy (8bit):	6.568690443444106
Encrypted:	false
SSDEEP:
MD5:	5209609C3F800F5B30BF5F3BD7091E89
SHA1:	62DBACC264BA0DD9AE839767FE2323C693807D7D
SHA-256:	A3D3031B665E5C1E2A8992826A57297E00DD3B7EA7EB559084E8BA204ACC15FB
SHA-512:	05EFB8E07D73EBD36E655A1D02C152758ABDBD43D0F65553BC71BC3B2D252843666C94A9CB69F4510FD21FB375254A24320D7C644E3BBF0706E7941628A241C9
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........=...n...n...n...n...n..o...n..o...n..o...n..o...n..o...n..o...n..o...n...nw..n0.o...n..o...n..o...n..o...n..}n...n..o...nRich...n........PE..d...)..g.........." .....J...........+....................................... ............`.........................................P...\|.......@...............`..............x....Q.......................R..(....Q...............`...............................text....H.......J.................. ..`.rdata.......`... ...N..............@..@.data...8"...........n..............@....pdata..`.......,..................@..@.qtmetadQ...........................@..P_RDATA..P...........................@..@.rsrc...............................@..@.reloc..x...........................@..B........................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-HMUPJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	175104
Entropy (8bit):	6.11735671904995
Encrypted:	false
SSDEEP:
MD5:	8EB327D1029B136E4D7A71095022D062
SHA1:	B5C1874A4E23EE1FFC9EAAF272D4627EAD2609A7
SHA-256:	C426A8A164ABFFD2569811AD6E808DD575ABE10E472C68EDE69E9B6D6946D638
SHA-512:	29ED58A53A60CEF2AFC9B5824AB7FE2E47EE78C2F59A67858FC8ACB82D1409C622CDC7D7537AC32B7807D6C43971E95DD75A37E30CD381A5AB35ADE67C48DC8A
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................................3.........3.....3.....3.y...3.....Rich...........PE..d...-..g.........." ................8.....................................................`.............................................x...(...,..............................................................(.......................p............................text............................... ..`.rdata.............................@..@.data...............................@....pdata..............................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-K59TJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	176640
Entropy (8bit):	6.210464486399451
Encrypted:	false
SSDEEP:
MD5:	B5B35AEC6CDFAAD5B25BC2FEFFB65FB0
SHA1:	E6BE61074D3DCC11F53FC81B0FB533832E6481D8
SHA-256:	A7A4E133D4AACD25A8E135676A15453C25B924A99356BCB4118CAFAA22F66066
SHA-512:	9168DF919D02C5DDF324966101A6D8BABC77CD34B4888E607B425E705DB9557E156A4BAD16DFD3C726A3FD370AE263BA8F8A52BE62A9BD765B8EB3C3F7FD6407
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?...^b..^b..^b..&..^b..6g..^b..6f..^b..6a..^b..6c..^b..&c..^b.v.c..^b.U7c..^b..^c.._b.U7g..^b.U7b..^b.U7...^b.U7`..^b.Rich.^b.........................PE..d...8..g.........." .....(..........."....................................................`.........................................`9.......9..................................t...@.......................`...(...`................@..8............................text...k'.......(.................. ..`.rdata...[...@...\...,..............@..@.data...(...........................@....pdata..............................@..@.qtmetade...........................@..P.rsrc...............................@..@.reloc..t...........................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-L6IDA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	5.659619833066197
Encrypted:	false
SSDEEP:
MD5:	FACF7AB3AE107401C49CB6714522E4FD
SHA1:	5B7A05D9D106502A103DAFDA0215EC90416EB291
SHA-256:	69CDB02A45887D86DE988CF990E54B6D370B832EB9682AB8FB5D06FAB0CB24A4
SHA-512:	DF65C33654248B5F492130F8B018D39E18A236FD2181742ACB2F8BD83B48C11226294C24996A0ED2A8E57048C2AEDFA0D8587E38C5AC1F6BFCE3B25429BE45F3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<..Mx...x...x...q.+.~......o......p......z......\|...3...z.......~......\|......w...x..........}......y....G.y......y...Richx...................PE..d...F..g.........." .....v...........o....................................................`.....................................................\|............p......................0.......................P...(...P...................X............................text....u.......v.................. ..`.rdata...............z..............@..@.data........`.......@..............@....pdata.......p.......H..............@..@.qtmetad.............R..............@..P.rsrc................T..............@..@.reloc...............V..............@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-MN40I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	651264
Entropy (8bit):	6.753107640302034
Encrypted:	false
SSDEEP:
MD5:	CC8768E57582CE990A60B07A7FBE9A05
SHA1:	96058C0CFDA8E0318E2B6617D58803CFACE0DFB2
SHA-256:	719D97EF2D0A68290F0EC5DF1E5A3270C0F9835C019A2D2000008367E41F2B47
SHA-512:	825B6EBA254DA844805DFDAEC2623132B34666584076502EDB5DA762E704B0E9C7FE693254E8A6B22A92780B88D013D65F294C33AB8F81F3D08716CD88B4E35B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@.....@...@...@......@.V.D...@.V.C...@.V.E...@.V.A...@.O.A...@...A...@...A...@...A.'.@...E...@...@...@.......@...B...@.Rich..@.................PE..d...`..g.........." .........................................................0............`..........................................*..\|....+..T...............\|>........... ..P...0?......................P@..(...P?..................P............................text............................... ..`.rdata..............................@..@.data...p...........................@....pdata..\|>.......@..................@..@.qtmetadr...........................@..P.rsrc...............................@..@.reloc..P.... ......................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-MPFLG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	108032
Entropy (8bit):	5.862335076596899
Encrypted:	false
SSDEEP:
MD5:	8A6C6D702D6BBA4C871F3DD53FA2798A
SHA1:	024A0AB1EB863D73FEE204A3586972908D650C93
SHA-256:	C996075B8E024900DC234617FDEE684A70B6485B30A475912DAFCC89762C14FC
SHA-512:	3B1AD8DB67D95FF70B40B76542BEA099861E84E94028633661227E5AE89E0B37244851714EEEA9B3CA67F89649A6B59108B02C1FF5A372A935D2D97DDEA33A2F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@.E..............V.....V.......V.......V.......V...............O.........................................:.............Rich............................PE..d.../..g.........." .....................................................................`.........................................06..x....6..T...................................p...........................(.......................(............................text............................... ..`.rdata..&...........................@..@.data...............................@....pdata..............................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-NO2LL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2327552
Entropy (8bit):	6.176241265246855
Encrypted:	false
SSDEEP:
MD5:	BDFC79FCB07C834E2DA85800A1DED6E8
SHA1:	CC10974040DF9453D3C2E1F63CFD0353B334547C
SHA-256:	15B657DCC6FCA6FADD1B1BC578F6AFCC661E4B5C5B6EC932CB830D954DD8C6CF
SHA-512:	D9A309458508EC95D5D17DA6028516EB44395757EBF2E0F232C454F3DFC5189463CD874F7452147C3AB2542D305F4D6417ADD600C05864150786BA8B6484C35D
Malicious:	false
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........\.F.=...=...=...E...=...U...=...U...=...U...=...U...=...E...=...M...=...T...=...=...?...T...=...T...=...T...=...T...=...T\|..=...T...=..Rich.=..........................PE..d...d..g.........." ..........................................................#...........`.........................................0I .t....I .T.....#.......".t.............#.X4...L..8....................N..(....M...............................................text............................... ..`.rdata.."...........................@..@.data...p..... ....... .............@....pdata..t....."......\".............@..@.qtmetad9.....#......H#.............@..P.rsrc.........#......L#.............@..@.reloc..X4....#..6...N#.............@..B................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-O1011.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	422912
Entropy (8bit):	7.425381454206718
Encrypted:	false
SSDEEP:
MD5:	FF8997D34D249D75BA175C6013E9E7F0
SHA1:	3257506C7279879FF2235BC7BFE0702A498BB222
SHA-256:	BFA3E09AE7F649A4DD99E9667CBB715E75D0C6F4E6749EDC8EF37CE489626A58
SHA-512:	AC29C32179F2CE9D7AAF4048475A2600A209BA199D829F57E93B686B45C17EF6D3FEFDF322FA6BEBF2243E7943EBD08A754BBD3D7B79B0AB7EA9478BC6E5438F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H.$..\|J..\|J..\|J.....\|J.^.O..\|J.^.N..\|J.^.I..\|J.^.K..\|J.G.K..\|J...K..\|J...K..\|J..\|K.6.J...O..\|J...J..\|J......\|J...H..\|J.Rich.\|J.........................PE..d...j..g.........." .........r............................................................`............................................\|...l...,....................................O.......................Q..(....P............... ..0............................text...;........................... ..`.rdata..p<... ...>..................@..@.data........`.......H..............@....pdata...............T..............@..@.qtmetadA............b..............@..P.rsrc................f..............@..@.reloc...............h..............@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-QP8K8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	6.02419104352401
Encrypted:	false
SSDEEP:
MD5:	818363094BDA8CEDF7A3A763F9DCBFE4
SHA1:	EEB593167B2E3B3284A686832B2304EEFA7E50DC
SHA-256:	5948F61BDBD5366012C56418C21FA5665A16C295B5D492874C78D4535497E00C
SHA-512:	2723BE8BA0E6332966F8A13FC3E69EC89E5CF885EA4DF91C43E56E3D4ECEBEC24E0CEFFC9E051C7B0B363A5EAAEE2B3F1EB5CD99FCDB006540A1E84EFB45B0D4
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[..5..5..5.....5...0...5...1..5...6..5...4..5...4..5.h.4..5.K.4..5..4.g.5.K.0..5.K.5..5.K...5.K.7..5.Rich.5.........................PE..d...E..g.........." .........n......T........................................p............`..........................................u..\|...,v.......P.......0...............`.......5.......................6..(....5...............................................text............................... ..`.rdata...C.......D..................@..@.data...8...........................@....pdata.......0......................@..@.qtmetad.....@......................@..P.rsrc........P......................@..@.reloc.......`......................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-QQLBV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	316928
Entropy (8bit):	6.223565644541473
Encrypted:	false
SSDEEP:
MD5:	6282EFE661D435A3D98DB5C7FD214B0E
SHA1:	47BEC89BBEC8D729F8E663328B4D12243A864411
SHA-256:	7389CE534D96406574370A2C0D3439D1F39A2D8B158E9AC60C8AC643A15433BF
SHA-512:	6A624FE9D2E900CB3665DC8DF51AFF111B42F5E60A4DF15C5CD26D7792538508D6C1193C3516E4A3593E5576423DC9C81FDF76E0F2F1AECE79A571800FAB36E2
Malicious:	false
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$....................G...................................4.....5........t..4.....4.....4.....4.+....4.....Rich...................PE..d...x..g.........." ................t........................................ ............`..........................................$.......%...................+..............P...`...........................(.................... ..0............................text............................... ..`.rdata...m... ...n..................@..@.data...P%...........\|..............@....pdata...+.......,..................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-RGJQE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	316416
Entropy (8bit):	6.1927679608514135
Encrypted:	false
SSDEEP:
MD5:	D0917D3646F86D8DCDFE709547CDD7DA
SHA1:	BE36123C1DD825A91245B13DCFF2BC6A9914CA95
SHA-256:	1774ECAC1EBA3F56E74A0815D62763927DCE7EB0C1657D1275A277AAED351347
SHA-512:	642D453CB10398BEEE7B2746E32BFE6FDB650E85BE36C49127DDEF27C1BA47C07006DFE1F0A39A3F5F9F7552CB69133F3D47AA07D502C6DB8D91F1FF43496D84
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S{{..............b......Er......Er......Er......Er......\b......s......s......j......s..............s......s......s......s......Rich............PE..d......g.........." ................`........................................ ............`.........................................0...\|........................'...................V.......................W..(....V..................H............................text............................... ..`.rdata..............................@..@.data...............................@....pdata...'.......(..................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-S1TGF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	284672
Entropy (8bit):	6.16807195752963
Encrypted:	false
SSDEEP:
MD5:	12526E76341EF89259D59CAEC18045D1
SHA1:	349A87B9D215182D333ED5C775E20D8411F8CDBF
SHA-256:	73716620D787107D48AD76A589EB05BD425E47A4BC0ED9C7B5043811EB624FAF
SHA-512:	607B695650C68E3FE92CD7BF4767259F1746187D062EC77C1D8ADAC040B9E5ACDEBE4CC3523B42535655DC35BC9269212E7D2747827BF4F7FB276459CB4BD321
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................)..................................S......p.........'..p......p......p.E....p......Rich...........PE..d...<..g.........." .........z............................................................`..........................................X..\|...\|X..@............`..x...................@.......................`...(...`................................................text...{........................... ..`.rdata...6.......8..................@..@.data........@......................@....pdata..x....`......................@..@.qtmetad.............B..............@..P.rsrc................D..............@..@.reloc...............F..............@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-SFOAI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	359424
Entropy (8bit):	6.110250673660502
Encrypted:	false
SSDEEP:
MD5:	72617BB41D6B8FFBD21C41B656743F15
SHA1:	D0450960CA791E5089D94F28685D44FE7B66D9DA
SHA-256:	4E2DEEB11349005DB7C7C66AB894EF993C3B0ED77C67E9E6DCF0B733A77CA7F5
SHA-512:	405D97ADFB5D5DE6B7A980491CDD1C295EF13ED1145777C15EAD77661DB568E0EE253437AE6F81C2F564F5155FACA60A1271A0A9464F7282759CA640FD8E3627
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........RE4R3+gR3+gR3+g[K.g^3+g.[.fJ3+g.[/fZ3+g.[(fQ3+g.[fV3+g.KfP3+g.CfT3+g.ZfU3+gR3gX7+g.Z.fB3+g.Z+fS3+g.Z.gS3+g.Z)fS3+gRichR3+g........PE..d...p..g.........." ................(.....................................................`..........................................M..\|....M..@............p..4..............................................(........................ ...........................text............................... ..`.rdata...e.......f..................@..@.data...0%...@.....................@....pdata..4....p.......@..............@..@.qtmetad.............^..............@..P.rsrc................`..............@..@.reloc...............b..............@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-SVRC0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	667136
Entropy (8bit):	6.34619241274607
Encrypted:	false
SSDEEP:
MD5:	5B08EE82E421440576CC76FA55C815B0
SHA1:	9CB7BB486FD098E4D727820662B3247A1CDB2681
SHA-256:	04C5A5E11C5679B72AC7901EF3850BFEA96A37AA85CE4DE82EAF3D04F41A1417
SHA-512:	F954E7A36F2B3274DBE8123C96B344DDD770F7DD433DA4B5C0ACAC0ECA14ADDC08E2AD810FD7D58D03169D131B558FD35259B0E4045C30410EC25A4B980B5B7B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.[.v.5Iv.5Iv.5I...Iz.5I$.1H~.5I$.6Hs.5I$.0Hl.5I$.4Hr.5I=.4Ht.5I..4Hp.5I..4Hq.5Iv.4I*.5I..0H0.5I..5Hw.5I...Iw.5I..7Hw.5IRichv.5I................PE..d.....1g.........." ......................................................................`.........................................`...........@....`...........I...........p..t...............................(....................0..0............................text...[........................... ..`.rdata...[...0...\... ..............@..@.data...@W.......P...\|..............@....pdata...I.......J..................@..@.qtmetad.....@......................@..P_RDATA..0....P......................@..@.rsrc........`......................@..@.reloc..t....p......................@..B................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-U95IF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	331776
Entropy (8bit):	6.093352707192958
Encrypted:	false
SSDEEP:
MD5:	838D1AEFC3FDBC6E138D6513B714FE7B
SHA1:	5B4C6818BFE34684138757E1690CAD5A730A36CE
SHA-256:	E242F8C764A015DEA36CCA2A183A431A53680BD5E5FC4F24F9D878909E90A61D
SHA-512:	66717B006A31FE9D8001F0A1AFCE4961C7D8DED050CC9C67C7EBDCF4B85902F10D49B5E1825547049224A63A0F6991C97EDDA3566E82C45476E1C20D51A6789C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................;...................(...................b.............Rich....................PE..d...k..g.........." .....r..........@[.......................................`............`.............................................\|...L...@....@..........\|............P.......=.......................>..(....=...................%...........................text....p.......r.................. ..`.rdata...\.......^...v..............@..@.data...............................@....pdata..\|...........................@..@.qtmetad.....0......................@..P.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-UQ6Q7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	513536
Entropy (8bit):	6.228865745475452
Encrypted:	false
SSDEEP:
MD5:	399F8B310DBC01696C3DDB6CE788C564
SHA1:	82FB9A77B710367DA8D2154A946B0BCA92369B93
SHA-256:	B389F5986484FB17F814B4B78211BE98AAEBDF95A803BA9A63ED21BD4BC7A75B
SHA-512:	F4A355EA7E115C7C8B7FBAF37195ABC7D995CAC439924C048BA9FE2D925D191379462072D68C9329B9D8344061E16C6BD1101573EFA3869B87313245BC608B24
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.e.a...a...a...h...k...3...v...3...i...3...b...3...e......c......g......h...a..........z......`......`......`...Richa...........PE..d......g.........." ........................................................@............`..........................................{..\|....\|..@................'............... ...~..........................(....~...............@..8%...........................text....(.......*.................. ..`.rdata..2D...@...F..................@..@.data...H#...........t..............@....pdata...'.......(..................@..@.qtmetad............................@..P.rsrc...............................@..@.reloc... ......."..................@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\plugins\is-VJOEG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	420864
Entropy (8bit):	7.017370754405623
Encrypted:	false
SSDEEP:
MD5:	B623F80A4A8EA781520D28E372871E6C
SHA1:	E4BCC0D38771C80AD74515F713030C3E4A3FAEE4
SHA-256:	B47DA49ACB85BC7444F0B541B2C291711E2ABC3F4D6C3C7BFA40E160F0FB1C7E
SHA-512:	F41E1D6A78D1B94888D2A9D239220C39FB3F33F43EA484BB863D4AEEEE047FE61C35716012C0265BBD5F8D7A25E37DFC11870B333D958F6E637DF25D87303258
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...rj.rj.rj.{.F.xj. ..dj. ..zj. ..pj. ..vj.9..pj....zj....uj.rj..i....zj....sj...*.sj....sj.Richrj.........PE..d...P..g.........." ................x.....................................................`..............................................R..Pj..@............p..................................................(....................................................text............................... ..`.rdata...r.......t..................@..@.data...h....P.......8..............@....pdata.......p.......H..............@..@.qtmetad.............X..............@..P.rsrc................\..............@..@.reloc...............^..............@..B................................................................................................................................................................................................

C:\Program Files\CloudCompare\proj.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	359936
Entropy (8bit):	5.682629096124071
Encrypted:	false
SSDEEP:
MD5:	97853DCCBC4B7F14E56D31F7B56364D6
SHA1:	5EB49E3441CA1A8F75B381AE1F98ADAD9A905D4D
SHA-256:	95A71D6D6600B0B78F8F2F200F97B539D92D59327B649DAA2D33E5F56BBC519B
SHA-512:	421C07DA9F53253ADEDC022C6AA9E0DA6248319B734678FC88D320C278C23B95CF969BC262BB1510B6F5710B80FAF5B1EE1CC5CD8B15FA57912F67202BE952CF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@a..2..2..20j.2..2s5.2..2./2...2...2..2...2..2...2..2...2..2...2~..2...2..2...2..2Rich..2........................PE..d...Z..T.........." .........~......4.....................................................`.........................................P...\.......<............P...1..............\...`&..8............................i..p............................................text............................... ..`.rdata....... ......................@..@.data....l.......h..................@....pdata...7...P...8...,..............@..@.idata..Z............d..............@..@.reloc...............r..............@..B................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\python3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61680
Entropy (8bit):	5.923759574558729
Encrypted:	false
SSDEEP:
MD5:	A5471F05FD616B0F8E582211EA470A15
SHA1:	CB5F8BF048DC4FC58F80BDFD2E04570DBEF4730E
SHA-256:	8D5E09791B8B251676E16BDD66A7118D88B10B66AD80A87D5897FADBEFB91790
SHA-512:	E87D06778201615B129DCF4E8B4059399128276EB87102B5C3A64B6E92714F6B0D5BDE5DF4413CC1B66D33A77D7A3912EAA1035F73565DBFD62280D09D46ABFF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............d...d...d.\|.l...d.\|.d...d.\|.....d.\|.f...d.Rich..d.........................PE..d...\|O[a.........." .....................................................................`.........................................`...`...............................................T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\python310.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4450544
Entropy (8bit):	6.458222828027988
Encrypted:	false
SSDEEP:
MD5:	384349987B60775D6FC3A6D202C3E1BD
SHA1:	701CB80C55F859AD4A31C53AA744A00D61E467E5
SHA-256:	F281C2E252ED59DD96726DBB2DE529A2B07B818E9CC3799D1FFA9883E3028ED8
SHA-512:	6BF3EF9F08F4FC07461B6EA8D9822568AD0A0F211E471B990F62C6713ADB7B6BE28B90F206A4EC0673B92BAE99597D1C7785381E486F6091265C7DF85FF0F9B5
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................~..........................................3...F..3......3.\|....3......Rich...........PE..d...pO[a.........." .....X#..d!.....,.........................................E......D...`...........................................<......z=.\|....pD......@B.0.....C.......D..t..x.$.T.............................$.8............p#.8............................text...bW#......X#................. ..`.rdata...-...p#......\#.............@..@.data.........=.......=.............@....pdata..0....@B......6A.............@..@PyRuntim`....`D......HC.............@....rsrc........pD......LC.............@..@.reloc...t....D..v...VC.............@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\rdblib.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10633328
Entropy (8bit):	6.192336081640698
Encrypted:	false
SSDEEP:
MD5:	6235580B1B5B7BE6CC64FDA77B06AEB8
SHA1:	F91D2194F25522D7DF16E08595FA9F78F2E11AFC
SHA-256:	B171C7FECAB2B4A717B5D6157A74069F45396958F60C3F892D0431E96D6E95A1
SHA-512:	629EFA682B08BCF1BFE27A496DCD43F00007BC160A96C520FC71B61BF7F668F7BCC4CC08E3A02367B65710E080948697FA7D7FCD5916C48B18834A243CB23D0D
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g....p...p...p..~...p...q.H.p.CH...p.....p...4.p...n.p.....p.....p.....p.Rich..p.........PE..d.....Zg.........." ......z...'......uM...........................2.................U.....@.........................................P..H7..l..d.......................p......@e.............................(.....................{. ............................text.....z.......z................. ..`.rdata........{.......z.............@..@.data...D.... ...P..................@....pdata...............N..............@..@text....q....P.....................@.. data.....A...`...B..................@..@.tls.................8..............@....rsrc................:..............@..@.reloc..F...........@..............@..B................................................................................................................................................

C:\Program Files\CloudCompare\shaders\Bilateral\bilateral.frag (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2054
Entropy (8bit):	4.952088682948797
Encrypted:	false
SSDEEP:
MD5:	44861A2AC1B8401AE2E7B4A8B7481105
SHA1:	3153AD90FB9AC9AB9B408769334DD2294871481D
SHA-256:	FBB200C6CA5BF0ABBFF051ED7D7DA77E99BC1CC8BAAEC9B7919209EE812E3505
SHA-512:	3CA79FB9E228E38F36613BDB43E44AB7877959037D7F49108415DE1CB211E2E67E1409B2700EEBE5AB8812FA501AC682512A8A1CEBCCC580CD09B100910DA673
Malicious:	false
Reputation:	low
Preview:	//////////////////////////////////////////////////////////////////////////////////////..//..//..//.Bilateral filtering..//..//..C.B. - 08/16/2008..// D.G-M. - 10/20/2010..// D.G-M. - 02/18/2014..//..//.IN:..//..s2_I.-.Image to blur..//..s2_D.-.Modulating depth image..//..//.OUT:..//..Filtered image..//..///////////////////////////////////////////////////////////////////////////////////////..//#extension GL_ARB_draw_buffers : enable....../***************************************************/..uniform.sampler2D.s2_I;..uniform.sampler2D.s2_D;..uniform.float..SX;..uniform.float..SY;..uniform.int.. NHalf;.....//.half filter size (<= 7!)..uniform float..DistCoefs[64];...//.pixel distance based damping coefs (max = 88)...uniform float..SigmaDepth;....// pixel depth distribution variance../****************************************************/....void main (void)..{...float.z..= texture2D(s2_D,gl_TexCoord[0].st).r;.....float.wsum.=.0.0;....// sum of all weights...vec3.csum.=

C:\Program Files\CloudCompare\shaders\Bilateral\bilateral.vert (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	575
Entropy (8bit):	4.217582186850506
Encrypted:	false
SSDEEP:
MD5:	65ABEDC7232060F38E374DAA2D464AA4
SHA1:	49980217E6FD91DD27EA093FCC27394C690E8974
SHA-256:	0F3089B49562873AA19B14783BA9095A5F0A4D0436C4678F41064E2ED9DF52C6
SHA-512:	F8019114DE004EE7ADA0A24D7C18FFFFF68347AA5B8316276D35E420430225BE5C018EC49CB7D0C9D94BBFFF20ABDE1589D62B868269CB1B62ED5ADAAD39A91F
Malicious:	false
Reputation:	low
Preview:	//////////////////////////////////////////////////////////////////////////////////////..//..//..//.Bilateral filtering..//..//..C.B. - 08/16/2008..// D.G-M. - 10/20/2010..//..//.IN:..//..s2_I.-.Image to blur..//..s2_D.-.Modulating depth image..//..//.OUT:..//..Filtered image..//..///////////////////////////////////////////////////////////////////////////////////////..//#extension GL_EXT_gpu_shader4 : enable..//#version 110..//#extension GL_ARB_draw_buffers : enable....void.main ()..{...gl_TexCoord[0].=.gl_MultiTexCoord0;...gl_Position =.ftransform ();..}..

C:\Program Files\CloudCompare\shaders\Bilateral\is-7E84J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2054
Entropy (8bit):	4.952088682948797
Encrypted:	false
SSDEEP:
MD5:	44861A2AC1B8401AE2E7B4A8B7481105
SHA1:	3153AD90FB9AC9AB9B408769334DD2294871481D
SHA-256:	FBB200C6CA5BF0ABBFF051ED7D7DA77E99BC1CC8BAAEC9B7919209EE812E3505
SHA-512:	3CA79FB9E228E38F36613BDB43E44AB7877959037D7F49108415DE1CB211E2E67E1409B2700EEBE5AB8812FA501AC682512A8A1CEBCCC580CD09B100910DA673
Malicious:	false
Reputation:	low
Preview:	//////////////////////////////////////////////////////////////////////////////////////..//..//..//.Bilateral filtering..//..//..C.B. - 08/16/2008..// D.G-M. - 10/20/2010..// D.G-M. - 02/18/2014..//..//.IN:..//..s2_I.-.Image to blur..//..s2_D.-.Modulating depth image..//..//.OUT:..//..Filtered image..//..///////////////////////////////////////////////////////////////////////////////////////..//#extension GL_ARB_draw_buffers : enable....../***************************************************/..uniform.sampler2D.s2_I;..uniform.sampler2D.s2_D;..uniform.float..SX;..uniform.float..SY;..uniform.int.. NHalf;.....//.half filter size (<= 7!)..uniform float..DistCoefs[64];...//.pixel distance based damping coefs (max = 88)...uniform float..SigmaDepth;....// pixel depth distribution variance../****************************************************/....void main (void)..{...float.z..= texture2D(s2_D,gl_TexCoord[0].st).r;.....float.wsum.=.0.0;....// sum of all weights...vec3.csum.=

C:\Program Files\CloudCompare\shaders\Bilateral\is-I54SL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	575
Entropy (8bit):	4.217582186850506
Encrypted:	false
SSDEEP:
MD5:	65ABEDC7232060F38E374DAA2D464AA4
SHA1:	49980217E6FD91DD27EA093FCC27394C690E8974
SHA-256:	0F3089B49562873AA19B14783BA9095A5F0A4D0436C4678F41064E2ED9DF52C6
SHA-512:	F8019114DE004EE7ADA0A24D7C18FFFFF68347AA5B8316276D35E420430225BE5C018EC49CB7D0C9D94BBFFF20ABDE1589D62B868269CB1B62ED5ADAAD39A91F
Malicious:	false
Reputation:	low
Preview:	//////////////////////////////////////////////////////////////////////////////////////..//..//..//.Bilateral filtering..//..//..C.B. - 08/16/2008..// D.G-M. - 10/20/2010..//..//.IN:..//..s2_I.-.Image to blur..//..s2_D.-.Modulating depth image..//..//.OUT:..//..Filtered image..//..///////////////////////////////////////////////////////////////////////////////////////..//#extension GL_EXT_gpu_shader4 : enable..//#version 110..//#extension GL_ARB_draw_buffers : enable....void.main ()..{...gl_TexCoord[0].=.gl_MultiTexCoord0;...gl_Position =.ftransform ();..}..

C:\Program Files\CloudCompare\shaders\ColorRamp\color_ramp.frag (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1493
Entropy (8bit):	5.139795787271186
Encrypted:	false
SSDEEP:
MD5:	2FE6DA9614E33E9DF2B01DB6E993593C
SHA1:	DD08737C5E040152A17F0A286F20D19124912FF8
SHA-256:	DA55F4ED9DE650E3197F708DB714789F184624A24E23BB62B7CABF70EA9850CA
SHA-512:	6DE06B2682483F8C28E2225E5D5D17CAFA8E3477AD67A9E88BE4CE30DE7F3175EA08D5D2D6CCBD71BF5C94A4302A4193E44EE18D1350FC8AD5BECD87ED065B6C
Malicious:	false
Reputation:	low
Preview:	#version 110....// Color Ramp Shader (CloudCompare - 04/23/2013)....uniform float uf_minSaturation;...//minimum saturation value (between 0 and 1)..uniform float uf_maxSaturation;...//maximum saturation value (between 0 and 1)....uniform float uf_colormapTable[256];.//float-packed RGB colors (max: 256)..uniform float uf_colormapSize;...//colormap size (as a float as we only use it as a float!)..uniform float uf_colorGray;....//color for grayed-out points....void main(void)..{...//input: gl_Color...// - gl_Color[0] = normalized scalar value...// - gl_Color[1] = flag: whether point should be grayed (< 1.0) or not (1.0)...// - gl_Color[2] = true lighting value...//output: gl_FragColor......vec3 unpackedValues = vec3(1.0, 256.0, 65536.0);......if (gl_Color[1] > 0.99) //0.99 to cope with round-off issues (in perspective mode for instance)...{....//determine position in current colormap....int rampPosi;....if (gl_Color[0] <= uf_minSaturation).....rampPosi = 0;....else if (gl_Color[0] < uf_ma

C:\Program Files\CloudCompare\shaders\ColorRamp\is-QD1K5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1493
Entropy (8bit):	5.139795787271186
Encrypted:	false
SSDEEP:
MD5:	2FE6DA9614E33E9DF2B01DB6E993593C
SHA1:	DD08737C5E040152A17F0A286F20D19124912FF8
SHA-256:	DA55F4ED9DE650E3197F708DB714789F184624A24E23BB62B7CABF70EA9850CA
SHA-512:	6DE06B2682483F8C28E2225E5D5D17CAFA8E3477AD67A9E88BE4CE30DE7F3175EA08D5D2D6CCBD71BF5C94A4302A4193E44EE18D1350FC8AD5BECD87ED065B6C
Malicious:	false
Reputation:	low
Preview:	#version 110....// Color Ramp Shader (CloudCompare - 04/23/2013)....uniform float uf_minSaturation;...//minimum saturation value (between 0 and 1)..uniform float uf_maxSaturation;...//maximum saturation value (between 0 and 1)....uniform float uf_colormapTable[256];.//float-packed RGB colors (max: 256)..uniform float uf_colormapSize;...//colormap size (as a float as we only use it as a float!)..uniform float uf_colorGray;....//color for grayed-out points....void main(void)..{...//input: gl_Color...// - gl_Color[0] = normalized scalar value...// - gl_Color[1] = flag: whether point should be grayed (< 1.0) or not (1.0)...// - gl_Color[2] = true lighting value...//output: gl_FragColor......vec3 unpackedValues = vec3(1.0, 256.0, 65536.0);......if (gl_Color[1] > 0.99) //0.99 to cope with round-off issues (in perspective mode for instance)...{....//determine position in current colormap....int rampPosi;....if (gl_Color[0] <= uf_minSaturation).....rampPosi = 0;....else if (gl_Color[0] < uf_ma

C:\Program Files\CloudCompare\shaders\DrawNormals\DrawNormals.fs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.483574097306791
Encrypted:	false
SSDEEP:
MD5:	1FFC70357549CB8D436AC4BE9B04AD45
SHA1:	D34A2F8B2356801B35547DA446A7D61896C65780
SHA-256:	704D8EB9A2C769AA323CF7B22F4389F519B63242B3CA5B96B5568B380B71371A
SHA-512:	E6243A7FEE1F16D267BA5F14CAEEA6637D67AB91911FFF58D337AA4CC0650F254D5028A28513D19E2BD6086564AC03F98790224C9E1B497EC9087132CA382C2D
Malicious:	false
Reputation:	low
Preview:	uniform mediump vec4 color;....void main(void)..{...gl_FragColor = color;..}..

C:\Program Files\CloudCompare\shaders\DrawNormals\DrawNormals.gs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	500
Entropy (8bit):	4.941886416524513
Encrypted:	false
SSDEEP:
MD5:	9E15D4ACA879CDBFA295C44181486640
SHA1:	AA6CDE1E894501C4D77A739A2FA3B59AA1019AAB
SHA-256:	7BF3E2343228E7B358748D65124237944FC3554E84C3231BCB32C203B4489DEC
SHA-512:	11490C58924AFFC1C94AEAC6EF3352DA9F4AACA75F9FB1A0601E9D24912138A284C1009D8C12DBF94C230B1841958C2E5B6E22A318009F0739FD856B2A5D81C0
Malicious:	false
Reputation:	low
Preview:	#version 330 core..layout (points) in;..layout (line_strip, max_vertices = 2) out;....in Vertex..{.. vec3 normal;..} vertex[];....uniform float normalLength;..uniform mat4 modelViewProjectionMatrix;......void main(void)..{...vec3 P = gl_in[0].gl_Position.xyz;.. vec3 N = vertex[0].normal;.... gl_Position = modelViewProjectionMatrix * vec4(P, 1.0);.. EmitVertex();.....gl_Position = modelViewProjectionMatrix * vec4(P + N * normalLength, 1);.. EmitVertex();.. .. EndPrimitive();..}

C:\Program Files\CloudCompare\shaders\DrawNormals\DrawNormals.vs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.752538927356536
Encrypted:	false
SSDEEP:
MD5:	049C8D4D4C74118D63E6BD3B93602999
SHA1:	A164F8E6F8145CDFB292F3042C74AB829909E5D6
SHA-256:	BE9E508487D97A7507B0418B37F22619F83CC421104BF08F817A26E51223EE3A
SHA-512:	31F18BC03EF893FCDA9E6D10C6BCC8DC795E6881DE9037270D5C5A8A16B42DA4DD57153421F2A3B675645472A6F28A0D2724749C32D75AB9EAB275E0F1B72CF4
Malicious:	false
Reputation:	low
Preview:	attribute highp vec3 vertexIn;..attribute highp vec3 normal;....out Vertex..{.. vec3 normal;..} vertex;....void main(void)..{...gl_Position = vec4(vertexIn, 1.0);...vertex.normal = normal;..}..

C:\Program Files\CloudCompare\shaders\DrawNormals\is-079CG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	500
Entropy (8bit):	4.941886416524513
Encrypted:	false
SSDEEP:
MD5:	9E15D4ACA879CDBFA295C44181486640
SHA1:	AA6CDE1E894501C4D77A739A2FA3B59AA1019AAB
SHA-256:	7BF3E2343228E7B358748D65124237944FC3554E84C3231BCB32C203B4489DEC
SHA-512:	11490C58924AFFC1C94AEAC6EF3352DA9F4AACA75F9FB1A0601E9D24912138A284C1009D8C12DBF94C230B1841958C2E5B6E22A318009F0739FD856B2A5D81C0
Malicious:	false
Reputation:	low
Preview:	#version 330 core..layout (points) in;..layout (line_strip, max_vertices = 2) out;....in Vertex..{.. vec3 normal;..} vertex[];....uniform float normalLength;..uniform mat4 modelViewProjectionMatrix;......void main(void)..{...vec3 P = gl_in[0].gl_Position.xyz;.. vec3 N = vertex[0].normal;.... gl_Position = modelViewProjectionMatrix * vec4(P, 1.0);.. EmitVertex();.....gl_Position = modelViewProjectionMatrix * vec4(P + N * normalLength, 1);.. EmitVertex();.. .. EndPrimitive();..}

C:\Program Files\CloudCompare\shaders\DrawNormals\is-16Q60.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.483574097306791
Encrypted:	false
SSDEEP:
MD5:	1FFC70357549CB8D436AC4BE9B04AD45
SHA1:	D34A2F8B2356801B35547DA446A7D61896C65780
SHA-256:	704D8EB9A2C769AA323CF7B22F4389F519B63242B3CA5B96B5568B380B71371A
SHA-512:	E6243A7FEE1F16D267BA5F14CAEEA6637D67AB91911FFF58D337AA4CC0650F254D5028A28513D19E2BD6086564AC03F98790224C9E1B497EC9087132CA382C2D
Malicious:	false
Reputation:	low
Preview:	uniform mediump vec4 color;....void main(void)..{...gl_FragColor = color;..}..

C:\Program Files\CloudCompare\shaders\DrawNormals\is-1T3F7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.752538927356536
Encrypted:	false
SSDEEP:
MD5:	049C8D4D4C74118D63E6BD3B93602999
SHA1:	A164F8E6F8145CDFB292F3042C74AB829909E5D6
SHA-256:	BE9E508487D97A7507B0418B37F22619F83CC421104BF08F817A26E51223EE3A
SHA-512:	31F18BC03EF893FCDA9E6D10C6BCC8DC795E6881DE9037270D5C5A8A16B42DA4DD57153421F2A3B675645472A6F28A0D2724749C32D75AB9EAB275E0F1B72CF4
Malicious:	false
Reputation:	low
Preview:	attribute highp vec3 vertexIn;..attribute highp vec3 normal;....out Vertex..{.. vec3 normal;..} vertex;....void main(void)..{...gl_Position = vec4(vertexIn, 1.0);...vertex.normal = normal;..}..

C:\Program Files\CloudCompare\shaders\EDL\edl_mix.frag (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1318
Entropy (8bit):	5.044374735527496
Encrypted:	false
SSDEEP:
MD5:	77BDBFB03ED4EF0DD94B8DF011B49539
SHA1:	E18E3DB7B10E05FD10FBEB7309E0B7965990A087
SHA-256:	5BFC1464DBA215315ACF03FF79F026A1B86CC9845DBFC08079D54F4A7BB7012D
SHA-512:	7ACB2A78C42F7C80E57B515934D9B96F8A70002807368E03AD3CE6F434E549680A68B43BD975CC6023DF016DF0F51FF4C9EE6AD4A5FF1DC4F17ECCDF8F57E73D
Malicious:	false
Reputation:	low
Preview:	//////////////////////////////////////////////////////////////////////////////////////..//..//..//.EyeDome Lighting.-.Compositing..//..//..C.B. - 04/23/2008..//..D.G-M. - 10/21/2010..//..//.IN:..//..s2_I1..-.full scale shading image..//..s2_I2..-.half-size shading image..//..s2_I4..-.quarter-size shading image..//..s2_D..-.depth image..//.OUT:..//..composited image..//..//////////////////////////////////////////////////////////////////////////////////////..//#extension GL_ARB_draw_buffers : enable..../************************************************/..uniform.sampler2D.s2_I1;.//.X1 scale..uniform sampler2D.s2_I2;.//.X2 scale..uniform sampler2D.s2_I4;.//.X4 scale..uniform sampler2D.s2_D;.// initial depth texture..//..uniform float..A0;..uniform float..A1;..uniform float..A2;../************************************************/....void main (void)..{...float d = texture2D(s2_D,gl_TexCoord[0].st).r;...if( d > 0.999)...{....gl_FragData[0].rgb = texture2D(s2_I1,gl_TexCoord[0].st).rgb

C:\Program Files\CloudCompare\shaders\EDL\edl_mix.vert (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	535
Entropy (8bit):	4.083502322762377
Encrypted:	false
SSDEEP:
MD5:	06459F93E931EB1B37A11A009528956F
SHA1:	37871AE603F3B77AB0D98531B034F03F2E308C5C
SHA-256:	4A33B591ED0990CDD03D3BCD4EDFEAC0E40AFF413D57E087AFB6D73909C27E24
SHA-512:	92E49398C4F6402F679541631B2148D280FB2F261D98C27AF564D9178AF926F284340F7557F5945DE70F746FFDE8F8971BA61A0D31828570F70430A55E42398A
Malicious:	false
Reputation:	low
Preview:	//////////////////////////////////////////////////////////////////////////////////////..//..//..//.EyeDome Lighting.-.Compositing..//..//..C.B. - 23 avril 2008..//..//.IN:...//..s2_I1..-.full scale shading image..//..s2_I2..-.half-size shading image..//..s2_I4..-.quarter-size shading image..//..s2_D..-.depth image..//.OUT:...//..composited image..//..//////////////////////////////////////////////////////////////////////////////////////..void.main ()..{...gl_TexCoord[0].=.gl_MultiTexCoord0;....gl_Position =.ftransform ();..}..

C:\Program Files\CloudCompare\shaders\EDL\edl_shade.frag (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2752
Entropy (8bit):	5.165830354759113
Encrypted:	false
SSDEEP:
MD5:	13AC0F89F28390C4A112E21988A32B15
SHA1:	0025C25A822F6724D5D2E1EBB9A3374773CEB391
SHA-256:	E54BD02726535231A7764A41CBF17B88D257344518212839DCE42EA3B263BD5F
SHA-512:	80819A1563A961EAB7388B1BC2C7C9D7585B15A5153DAD28BDB05C5B1A173A18EAE7573F531530DC2D1996A5F16E2ED4545906ABD4692E48269AD680D2234DF4
Malicious:	false
Reputation:	low
Preview:	//////////////////////////////////////////////////////////////////////////////////////..//..//..//.EyeDome Lighting - oriented light version..//..//..C.B. - 04/23/2008..//..D.G-M. - 10/21/2010..//..D.G-M. - 02/17/2014..//..//.IN:. Depth buffer of the scene..//...r (red component) = recorded z..//.OUT:.EDL shaded image..//..///////////////////////////////////////////////////////////////////////////////////////..//#extension GL_ARB_draw_buffers : enable..//#version 110..../**************************************************/..uniform.sampler2D.s1_color;..uniform.sampler2D.s2_depth;....uniform float..Pix_scale;....// (relative) pixel scale in image..uniform vec2..Neigh_pos_2D[8];..// array of neighbors (2D positions)..uniform float..Exp_scale;....// exponential scale factor (for computed AO)....uniform float..Zm;......// minimal depth in image..uniform float..ZM;......// maximal depth in image....uniform float..Sx;......// screen width (pix)..uniform float..Sy;......// screen heigh

C:\Program Files\CloudCompare\shaders\EDL\edl_shade.vert (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	429
Entropy (8bit):	3.810326833847726
Encrypted:	false
SSDEEP:
MD5:	157661B48C7FB9C9423CD2BA933ED373
SHA1:	C1446AA6649137E25C4A269905473AC84CB96E8B
SHA-256:	C0DFD4C7CC4FBBFF34B3107E97EBE6E7A1EC90064A5AF1F48FFAB24AEE02AC0F
SHA-512:	CE2D36526701B3F06A5B069FF5C0265D430BF30EC8537636C8D8CA0D739CF87D040E50AD3DFF740FEC9140229339460B86FE6BB171DD9D355872239EE66EC5A6
Malicious:	false
Reputation:	low
Preview:	//////////////////////////////////////////////////////////////////////////////////////..//..//..//.EyeDome Lighting..//..//..C.B. - 23 avril 2008..//..//.IN:.Depth buffer of the scene..//...r = recorded z, in [0:1]..//.OUT:.EDL shaded image..//..///////////////////////////////////////////////////////////////////////////////////////..void.main ()..{...gl_TexCoord[0].=.gl_MultiTexCoord0;....gl_Position =.ftransform ();..}..

C:\Program Files\CloudCompare\shaders\EDL\is-CSNSK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	535
Entropy (8bit):	4.083502322762377
Encrypted:	false
SSDEEP:
MD5:	06459F93E931EB1B37A11A009528956F
SHA1:	37871AE603F3B77AB0D98531B034F03F2E308C5C
SHA-256:	4A33B591ED0990CDD03D3BCD4EDFEAC0E40AFF413D57E087AFB6D73909C27E24
SHA-512:	92E49398C4F6402F679541631B2148D280FB2F261D98C27AF564D9178AF926F284340F7557F5945DE70F746FFDE8F8971BA61A0D31828570F70430A55E42398A
Malicious:	false
Reputation:	low
Preview:	//////////////////////////////////////////////////////////////////////////////////////..//..//..//.EyeDome Lighting.-.Compositing..//..//..C.B. - 23 avril 2008..//..//.IN:...//..s2_I1..-.full scale shading image..//..s2_I2..-.half-size shading image..//..s2_I4..-.quarter-size shading image..//..s2_D..-.depth image..//.OUT:...//..composited image..//..//////////////////////////////////////////////////////////////////////////////////////..void.main ()..{...gl_TexCoord[0].=.gl_MultiTexCoord0;....gl_Position =.ftransform ();..}..

C:\Program Files\CloudCompare\shaders\EDL\is-KV0SK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2752
Entropy (8bit):	5.165830354759113
Encrypted:	false
SSDEEP:
MD5:	13AC0F89F28390C4A112E21988A32B15
SHA1:	0025C25A822F6724D5D2E1EBB9A3374773CEB391
SHA-256:	E54BD02726535231A7764A41CBF17B88D257344518212839DCE42EA3B263BD5F
SHA-512:	80819A1563A961EAB7388B1BC2C7C9D7585B15A5153DAD28BDB05C5B1A173A18EAE7573F531530DC2D1996A5F16E2ED4545906ABD4692E48269AD680D2234DF4
Malicious:	false
Reputation:	low
Preview:	//////////////////////////////////////////////////////////////////////////////////////..//..//..//.EyeDome Lighting - oriented light version..//..//..C.B. - 04/23/2008..//..D.G-M. - 10/21/2010..//..D.G-M. - 02/17/2014..//..//.IN:. Depth buffer of the scene..//...r (red component) = recorded z..//.OUT:.EDL shaded image..//..///////////////////////////////////////////////////////////////////////////////////////..//#extension GL_ARB_draw_buffers : enable..//#version 110..../**************************************************/..uniform.sampler2D.s1_color;..uniform.sampler2D.s2_depth;....uniform float..Pix_scale;....// (relative) pixel scale in image..uniform vec2..Neigh_pos_2D[8];..// array of neighbors (2D positions)..uniform float..Exp_scale;....// exponential scale factor (for computed AO)....uniform float..Zm;......// minimal depth in image..uniform float..ZM;......// maximal depth in image....uniform float..Sx;......// screen width (pix)..uniform float..Sy;......// screen heigh

C:\Program Files\CloudCompare\shaders\EDL\is-V57QR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	429
Entropy (8bit):	3.810326833847726
Encrypted:	false
SSDEEP:
MD5:	157661B48C7FB9C9423CD2BA933ED373
SHA1:	C1446AA6649137E25C4A269905473AC84CB96E8B
SHA-256:	C0DFD4C7CC4FBBFF34B3107E97EBE6E7A1EC90064A5AF1F48FFAB24AEE02AC0F
SHA-512:	CE2D36526701B3F06A5B069FF5C0265D430BF30EC8537636C8D8CA0D739CF87D040E50AD3DFF740FEC9140229339460B86FE6BB171DD9D355872239EE66EC5A6
Malicious:	false
Reputation:	low
Preview:	//////////////////////////////////////////////////////////////////////////////////////..//..//..//.EyeDome Lighting..//..//..C.B. - 23 avril 2008..//..//.IN:.Depth buffer of the scene..//...r = recorded z, in [0:1]..//.OUT:.EDL shaded image..//..///////////////////////////////////////////////////////////////////////////////////////..void.main ()..{...gl_TexCoord[0].=.gl_MultiTexCoord0;....gl_Position =.ftransform ();..}..

C:\Program Files\CloudCompare\shaders\EDL\is-VLK83.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1318
Entropy (8bit):	5.044374735527496
Encrypted:	false
SSDEEP:
MD5:	77BDBFB03ED4EF0DD94B8DF011B49539
SHA1:	E18E3DB7B10E05FD10FBEB7309E0B7965990A087
SHA-256:	5BFC1464DBA215315ACF03FF79F026A1B86CC9845DBFC08079D54F4A7BB7012D
SHA-512:	7ACB2A78C42F7C80E57B515934D9B96F8A70002807368E03AD3CE6F434E549680A68B43BD975CC6023DF016DF0F51FF4C9EE6AD4A5FF1DC4F17ECCDF8F57E73D
Malicious:	false
Reputation:	low
Preview:	//////////////////////////////////////////////////////////////////////////////////////..//..//..//.EyeDome Lighting.-.Compositing..//..//..C.B. - 04/23/2008..//..D.G-M. - 10/21/2010..//..//.IN:..//..s2_I1..-.full scale shading image..//..s2_I2..-.half-size shading image..//..s2_I4..-.quarter-size shading image..//..s2_D..-.depth image..//.OUT:..//..composited image..//..//////////////////////////////////////////////////////////////////////////////////////..//#extension GL_ARB_draw_buffers : enable..../************************************************/..uniform.sampler2D.s2_I1;.//.X1 scale..uniform sampler2D.s2_I2;.//.X2 scale..uniform sampler2D.s2_I4;.//.X4 scale..uniform sampler2D.s2_D;.// initial depth texture..//..uniform float..A0;..uniform float..A1;..uniform float..A2;../************************************************/....void main (void)..{...float d = texture2D(s2_D,gl_TexCoord[0].st).r;...if( d > 0.999)...{....gl_FragData[0].rgb = texture2D(s2_I1,gl_TexCoord[0].st).rgb

C:\Program Files\CloudCompare\shaders\SSAO\is-16B4L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	452
Entropy (8bit):	3.924773619817995
Encrypted:	false
SSDEEP:
MD5:	8721B966217FAD5523761FBB6A0397F5
SHA1:	F940E461D69299D1DB3A0FA89F0F4991B6F57CE7
SHA-256:	0BF3FE472D045CACC5B31685600965B24EBED800FE6713904D55E143751BFC11
SHA-512:	ED09207794F9578FC87E9DA65A044F2516B22BE58AA5DCE73B2BB2B86E0603F6DC6310218A2897ECE956555D8D8D8DA977534C719890C1AB05B43AB2CEA2F7C1
Malicious:	false
Reputation:	low
Preview:	//////////////////////////////////////////////////////////////////////////////////////..//..//..//.Screen Space Ambient Occlusion..//..//..C.B. - 5 march 2008..//..Adapted from notes by Crytek and Inigo Quilez..//..//.OUT:.gl_TexCoord[0].-.viewport coordinates..//..////////////////////////////////////////////////////////////////////////////////////////....void.main ()..{...gl_TexCoord[0].=.gl_MultiTexCoord0;....gl_Position =.ftransform ();..}..

C:\Program Files\CloudCompare\shaders\SSAO\is-NGK93.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2146
Entropy (8bit):	4.727927174433521
Encrypted:	false
SSDEEP:
MD5:	8DAFF0D8D1933FEDF30066894DADF46A
SHA1:	C1C5325C136C53461151C2C6611D8DD2BC0CB58E
SHA-256:	D32EB2AE3279762DAF211C7C347638A0D0DBBEE98EB6E5CC634B0D3AC864ACB0
SHA-512:	BF43A470FDA5CE536D483BB35566A49111A60B4B103935BD8470CD543D39B4B819438BE8F3517D096E05654AE5C8A732110F808048A8D0EBA426DDF148CD1F67
Malicious:	false
Reputation:	low
Preview:	//////////////////////////////////////////////////////////////////////////////////////..//..//..//.Screen Space Ambient Occlusion..//..//..C.B. - 03/05/2008..//..D.G-M. - 10/22/2010..//..Adapted from notes by Crytek and Inigo Quilez..//..//.IN:.Depth buffer of the scene..//...r = recorded z, in [0:1]..//.OUT:.AO shaded image..//..////////////////////////////////////////////////////////////////////////////////////////....//#extension GL_ARB_draw_buffers : enable....//////////////////////////////////////////////////////////////////////////////////////..//..uniform.sampler2D.s2_Z;..uniform sampler2D.s2_R;..uniform sampler2D.s2_C;....uniform float.R;..//.Radius of neighborhood sphere..uniform.float.F;..//.Amplification of shading..uniform float.Kz;..//.distance attenuation factor..uniform int. B_REF;..//.if 1 use random reflect of neighbours..uniform vec3.P[256];..//.The Neighbours in unit sphere..const.int. N = 32;..//.Number of neighbouri..//..//////////////////////////////////

C:\Program Files\CloudCompare\shaders\SSAO\ssao.frag (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2146
Entropy (8bit):	4.727927174433521
Encrypted:	false
SSDEEP:
MD5:	8DAFF0D8D1933FEDF30066894DADF46A
SHA1:	C1C5325C136C53461151C2C6611D8DD2BC0CB58E
SHA-256:	D32EB2AE3279762DAF211C7C347638A0D0DBBEE98EB6E5CC634B0D3AC864ACB0
SHA-512:	BF43A470FDA5CE536D483BB35566A49111A60B4B103935BD8470CD543D39B4B819438BE8F3517D096E05654AE5C8A732110F808048A8D0EBA426DDF148CD1F67
Malicious:	false
Reputation:	low
Preview:	//////////////////////////////////////////////////////////////////////////////////////..//..//..//.Screen Space Ambient Occlusion..//..//..C.B. - 03/05/2008..//..D.G-M. - 10/22/2010..//..Adapted from notes by Crytek and Inigo Quilez..//..//.IN:.Depth buffer of the scene..//...r = recorded z, in [0:1]..//.OUT:.AO shaded image..//..////////////////////////////////////////////////////////////////////////////////////////....//#extension GL_ARB_draw_buffers : enable....//////////////////////////////////////////////////////////////////////////////////////..//..uniform.sampler2D.s2_Z;..uniform sampler2D.s2_R;..uniform sampler2D.s2_C;....uniform float.R;..//.Radius of neighborhood sphere..uniform.float.F;..//.Amplification of shading..uniform float.Kz;..//.distance attenuation factor..uniform int. B_REF;..//.if 1 use random reflect of neighbours..uniform vec3.P[256];..//.The Neighbours in unit sphere..const.int. N = 32;..//.Number of neighbouri..//..//////////////////////////////////

C:\Program Files\CloudCompare\shaders\SSAO\ssao.vert (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	452
Entropy (8bit):	3.924773619817995
Encrypted:	false
SSDEEP:
MD5:	8721B966217FAD5523761FBB6A0397F5
SHA1:	F940E461D69299D1DB3A0FA89F0F4991B6F57CE7
SHA-256:	0BF3FE472D045CACC5B31685600965B24EBED800FE6713904D55E143751BFC11
SHA-512:	ED09207794F9578FC87E9DA65A044F2516B22BE58AA5DCE73B2BB2B86E0603F6DC6310218A2897ECE956555D8D8D8DA977534C719890C1AB05B43AB2CEA2F7C1
Malicious:	false
Reputation:	low
Preview:	//////////////////////////////////////////////////////////////////////////////////////..//..//..//.Screen Space Ambient Occlusion..//..//..C.B. - 5 march 2008..//..Adapted from notes by Crytek and Inigo Quilez..//..//.OUT:.gl_TexCoord[0].-.viewport coordinates..//..////////////////////////////////////////////////////////////////////////////////////////....void.main ()..{...gl_TexCoord[0].=.gl_MultiTexCoord0;....gl_Position =.ftransform ();..}..

C:\Program Files\CloudCompare\spatialite.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11594752
Entropy (8bit):	5.8614931256398926
Encrypted:	false
SSDEEP:
MD5:	7EF9CF9E7604E9E4728E63A85C9F5BEC
SHA1:	89BDDE3F68645FB7BE3F21A970B6E3AF8C750704
SHA-256:	66F741623E01E7204664D58750A44100D5342BCA0706EA58396DE925AE3041EB
SHA-512:	74BF0C9884C02B9827E1D80067535C1039A38C6DBE64695ABFF6C4CC10738A951FE72F7069376594BABA26B468D6046DE1A1650D4CA7D985AA77CB3C1B46BA90
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?.<.^.o.^.o.^.or..o.^.o...o.^.o1..o.^.o...o.^.o../o.^.o...o.^.o...o.^.o.^.o._.o../o.^.o...o.^.o...o.^.oRich.^.o................PE..d..._`.V.........." .....8H...h.......H......................................P............`..........................................J..X.....................T............@..h...`VH.8...........................p.H.p...........................................text...96H......8H................. ..`.rdata......PH......<H.............@..@.data...1.d...K...d...J.............@....pdata.............................@..@.idata...A......B..................@..@.reloc.......@.....................@..B................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\sqlite3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	898048
Entropy (8bit):	6.498739548040389
Encrypted:	false
SSDEEP:
MD5:	425A907E436D0FF71889DA0BF481DDD6
SHA1:	50D34868FADA4D532219F5B5252933757DAFFE04
SHA-256:	E4434FCF8C9DB1C3A09D4585B3AB4C47C6C6071A6117875544347068EEC84FF1
SHA-512:	E0F4938444DAE10DE8B47001482B4F5441BDB3C14D3AFB672A8D87B41756C9B6A28CFF643755A03E2A0F4F3CBC341A9FA34586B7A6B6DE4A9CC479D49BE1B9BD
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$...`...`...`....U\.c...`.......&.v.@...&.w.....&.H.j...m.w.a...m.K.a...m.I.a...Rich`...........PE..d...._.V.........." .................&....................................................`.........................................@^.......y..(............`..L............... .......................................p............................................text...=........................... ..`.rdata..............................@..@.data...8............r..............@....pdata..L....`......................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	342016
Entropy (8bit):	6.124318304938587
Encrypted:	false
SSDEEP:
MD5:	CE7CFCEA2D533B47372AC342E0BC56A3
SHA1:	ACBF16636AB30277983FED1E0401A9439CA1CF83
SHA-256:	AC6FD3101AC471A007693444153F7796ACD427C4B5E91BFEBCF015F0B95C6C08
SHA-512:	134ACDB8EF1828074D145FACA41EA4BA269BAC0C038B24BAAC9A955D78557E290DCEDD727FCCE29D772D51E5763B8ED5BCB4AFA96C21209FF73BDF4242F0E4F3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.P...>...>...>..?....>.Y.....>.Y.....>.Y.....>.Y.....>.......>...?..>.....0.>.......>.......>.......>.Rich..>.................PE..d...q..T.........." .....v...........}....................................................`.........................................@...p$......P....`..@....0...&...........p..L...P...8...............................p............................................text....t.......v.................. ..`.rdata..............z..............@..@.data...p....0......................@....pdata...&...0...(..................@..@.rsrc...@....`.......&..............@..@.reloc..L....p.......,..............@..B................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\start.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	31
Entropy (8bit):	4.373551149096553
Encrypted:	false
SSDEEP:
MD5:	D3FC27613FF7EBD51808D0A0DB4D0FC9
SHA1:	E7E8F95165C18B542653B21FB71F970A03BE60E0
SHA-256:	9D5C9D8C3035D78040D5323DF783EA085EEFBED8780893139D30BAA3BD9E6455
SHA-512:	31B7CCDC6746CBA7B95CA51D93BA3F496DB64650CB716E0DBB4DCC46047065DF60BFDCA7C390CAACBE77D9AD17FF6084DFE5CE076ACB4EC30BC2EC95DA2A3B52
Malicious:	false
Reputation:	low
Preview:	@set PATH=...CloudCompare.exe..

C:\Program Files\CloudCompare\styles\is-HV0JM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	144368
Entropy (8bit):	6.294675868932723
Encrypted:	false
SSDEEP:
MD5:	53A85F51054B7D58D8AD7C36975ACB96
SHA1:	893A757CA01472A96FB913D436AA9F8CFB2A297F
SHA-256:	D9B21182952682FE7BA63AF1DF24E23ACE592C35B3F31ECEEF9F0EABEB5881B9
SHA-512:	35957964213B41F1F21B860B03458404FBF11DAF03D102FBEA8C2B2F249050CEFBB348EDC3F22D8ECC3CB8ABFDC44215C2DC9DA029B4F93A7F40197BD0C16960
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R._...1]..1]..1]..]..1]..0\..1]..5\..1]..2\..1]..4\..1]..0\..1]..0\..1]..0]..1]..4\..1]..1\..1]...]..1]..3\..1]Rich..1]........................PE..d...`._.........." .....\...........`.......................................`......wJ....`................................................. ........@..X.... ...............P.........T...................`...(...0...0............p...............................text....Z.......\.................. ..`.rdata......p.......`..............@..@.data...............................@....pdata....... ......................@..@.qtmetadm....0......................@..P.rsrc...X....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\styles\qwindowsvistastyle.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	144368
Entropy (8bit):	6.294675868932723
Encrypted:	false
SSDEEP:
MD5:	53A85F51054B7D58D8AD7C36975ACB96
SHA1:	893A757CA01472A96FB913D436AA9F8CFB2A297F
SHA-256:	D9B21182952682FE7BA63AF1DF24E23ACE592C35B3F31ECEEF9F0EABEB5881B9
SHA-512:	35957964213B41F1F21B860B03458404FBF11DAF03D102FBEA8C2B2F249050CEFBB348EDC3F22D8ECC3CB8ABFDC44215C2DC9DA029B4F93A7F40197BD0C16960
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R._...1]..1]..1]..]..1]..0\..1]..5\..1]..2\..1]..4\..1]..0\..1]..0\..1]..0]..1]..4\..1]..1\..1]...]..1]..3\..1]Rich..1]........................PE..d...`._.........." .....\...........`.......................................`......wJ....`................................................. ........@..X.... ...............P.........T...................`...(...0...0............p...............................text....Z.......\.................. ..`.rdata......p.......`..............@..@.data...............................@....pdata....... ......................@..@.qtmetadm....0......................@..P.rsrc...X....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................

C:\Program Files\CloudCompare\swresample-4.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	640512
Entropy (8bit):	6.552116885372862
Encrypted:	false
SSDEEP:
MD5:	533F81EB1CDADD117C5D0B2D75CE0D8A
SHA1:	C6003769F1CC324F7AEC324F1626A25D7396008D
SHA-256:	65F029D7DB3B4F4D372E89D490A77BDC43934563C5EE70E7501E12DEFFC79E5C
SHA-512:	56636DE5D2A61D9CF8F0DAFAB2CA8514885374B0C87B38766DC53EB5C84F8BD281D4451E8B20481B223A8428DCD34653D7106CA130AD7186DEC99C655CBC9892
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....#f..........."...*.:.......`..0...............................................?.....`... ...................................... .......0..\....p.......@..l0..............h........................... ...(....................6..h............................text...p9.......:..................`..`.data........P.......>..............@....rdata..P....`.......H..............@..@.pdata..l0...@...2...$..............@..@.xdata...>.......@...V..............@..@.bss....p_...............................edata....... ......................@..@.idata..\....0......................@....CRT....`....P......................@....tls.........`......................@....rsrc........p......................@..@.reloc..h...........................@..B................................................................................................................................

C:\Program Files\CloudCompare\swscale-7.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	646656
Entropy (8bit):	6.609281858827991
Encrypted:	false
SSDEEP:
MD5:	59F908380C488F066D712014EEFF5BD7
SHA1:	CBA52F89D7E9087F694CB7D6958A80B6858EED75
SHA-256:	7F6FEAD1AA53772FD657D4462826E042B8F2049D3C3BBB493752F22B058F3A78
SHA-512:	D7E2E459B417B9C23CAAAE3843442048035DEF57F7ED679999EBFAD648E2455E0E6E0BC4FE229D62F7BDD7ED94D6C86156EE4CB7ED0A7C742F3B81CD2D3FFCDB
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....#f..........."...*............0...............................................],....`... ......................................p.......................p.../..........................................`<..(...................@...P............................text...............................`..`.data...`...........................@....rdata...x.......z..................@..@.pdata.../...p...0...J..............@..@.xdata...:.......<...z..............@..@.bss....@................................edata.......p......................@..@.idata..............................@....CRT....`...........................@....tls................................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................

C:\Program Files\CloudCompare\szip.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48640
Entropy (8bit):	6.318600850824361
Encrypted:	false
SSDEEP:
MD5:	4689FC376ACE9A9BD7C9B313850EC0BF
SHA1:	7E9C5BF39F0AF67983433F2459B08548C7542338
SHA-256:	E221514B68083A2F57B8441433A197A07D569F4038D8F0BD68F1734D95F9A456
SHA-512:	CA61E3BA794CEF6B53C06D34B17770363BC4FD9A436EF23111190321ABE0E1D606891B11C13159D6B3685385B09511E3A2FED2532B991CFC7883E8B0061C243F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............d...d...d...5r..d...5p..d...5O..d...5N..d..d.d..d...d...d...6O..d...6s..d...6t..d...6q..d..Rich.d..................PE..d......T.........." ................h.....................................................`............................................(.......<....`.......P..T............p.. .......................................p............................................text............................... ..`.rdata..............................@..@.data..............................@....pdata..T....P......................@..@.rsrc........`......................@..@.reloc.. ....p......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\tbb.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	261872
Entropy (8bit):	6.124188159004726
Encrypted:	false
SSDEEP:
MD5:	C974C7B8CC66714A4BE0A7FAC840D193
SHA1:	E83936D5E3A1939B5B830B043936D55D79376CBD
SHA-256:	DA5E47C1FBA5C990CF66C529DA15EC050E3BA50EF9BEEE44AC8EC83A575E3569
SHA-512:	50C47CF18E354284CCEE0E370758EC5498B9D0769DC90141AFD458CC0D1D173423D12DD45E2EC140F5BAB4BADD017531FB81D6046340216ADD94B8BFF4553CA3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,.<dh.R7h.R7h.R7a..7b.R7...7j.R7S.Q6k.R7S.W6\|.R7S.V6c.R7h.S7..R7S.S6m.R7..W6M.R7..Q6k.R7..R6i.R7...7i.R7..P6i.R7Richh.R7........PE..d....D.W.........." .....Z...........S.......................................@.......]....`.............................................(>...l....... ..X....... 4......."...0.........T...........................P................p..p............................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data...pI...........h..............@....pdata.. 4.......6..................@..@.gfids..$...........................@..@.rsrc...X.... ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\tbbmalloc.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	123632
Entropy (8bit):	6.284281913194961
Encrypted:	false
SSDEEP:
MD5:	F6B28E1272214B3B7134D792CE38F956
SHA1:	81767B15ADC49BA1E9CF16498D3E6D20CA93FF40
SHA-256:	EC3298F6A7BDE1D4CAB59BA629BBEE87A322D0EFDC8A59D87FF6D406240407B1
SHA-512:	4A40CD3320512D19B9F63C793351DC9A374615E8BA6EAFAD2AE7A1C6D9A92A152106FBB5F96AB01ECE3D87CBA4C5FD050524DCBE4842F4E12D5B2F09D778052B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............T...T...T.eT...T...U...T&&=T...T...T...T...U...T...U...T...U...Ti..U...Ti..U...Ti..U...Ti..T...Ti..U...TRich...T........PE..d...LE.W.........." .....$..........(&.......................................@............`......................................................... ..@................"...0......0Y..T............................Y...............@.. ............................text....#.......$.................. ..`.rdata...K...@...L...(..............@..@.data....P.......$...t..............@....pdata..............................@..@.gfids..............................@..@.rsrc...@.... ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................

C:\Program Files\CloudCompare\translations\CloudCompare_chs.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:
MD5:	BCEBCF42735C6849BDECBB77451021DD
SHA1:	4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
SHA-256:	9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
SHA-512:	F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
Malicious:	false
Reputation:	low
Preview:	<.d....!..`...

C:\Program Files\CloudCompare\translations\CloudCompare_de.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	521134
Entropy (8bit):	4.716352469714204
Encrypted:	false
SSDEEP:
MD5:	5FF09C5E4C5737EC86CBB8B803D4EE1D
SHA1:	628157DE3381DFD45051A5D0669E41E86282912F
SHA-256:	71F1E7E4CD5AD771CF9DD031C4AD0EDB52B86355AFE0CAA362F20396FE9C7773
SHA-512:	78521DEF6AC6EE85B6736D4729C94D7C4066622F80345F6042AB977AB72842582F9157F88A9E3C47C4DFED69DAFA49273525300CD74960C38B1DB199F7EE8D88
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......deB..g....+.......0..:"...1..:@...1..0u...=.......A..5....A.......A..S....B..5+...B...M...B..S....C...V...C...&...D.......E.......L..X....M.._W...N..p....P...:...S.../...T...}...V.......X......Z...>...x..x.......4.......5U......5z......5.......5.......5.......6.......63...;...A...;..M....;..P....;..k....;...\...;......O..M....[..'F...v...Q..............U.......D...&....n..1...ZP..1.......1...9...1...H...1...yF..1...k...7...:...G.......H,...:..I@..5...IA..5-..Ih...(..Ih...w..I.......J...."..K...>...L?../...L...n...M...EW..M.......MR..]_..M....C..PP.../..PP..;...S.......S...x...S.......S...ac..S.......S...e~..T...q...V.......V....3..V...<...V...~=..W#..S...X.......X....b..X.......a... :..h,......h,..h...j....d..k.......k......s....!..s...i9..s......s...ig..v...V...xt......x...Wr..zr..G!..{....2..f.......f.......j......ms......w...........x................r..[..........Z......../......R........2..............................;.......^I......z....................E

C:\Program Files\CloudCompare\translations\CloudCompare_es_AR.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	381344
Entropy (8bit):	4.669829345699403
Encrypted:	false
SSDEEP:
MD5:	7E515CB3FEB67498865D63BDFBFD6F8D
SHA1:	121EB386EA79599FD893A34DC43990CEADDAB093
SHA-256:	C7DCDCEFB2C9F5973F2A29B0DE986918B8226B09C807D7E6A2199DB077BCFBA3
SHA-512:	6D590D4D869C097B939404E07EF770AB9D7520DE819C12CD92E82EA79FDD452E2C4EBDD93E8C4D3573C81E941E101D9D1697579F84CF0017168097AD12DEDDEC
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......es_ARB..J....+.......=...,...A.. ....A...N...A..OS...B.. ....B.......B..O\|...C.......C.......D...g...L...@...M...!...N.......P.......S.......V..8....Z..;....x..rs..............+.......P.......u.................................;...O...;..I....;..A....;..W....;......;..._...[.......v..................E...&...y!..1...T...1.......1...%...1...<...1...d...1...e...G.......H,..."..I@......IA......Ih......Ih......I.......J......K...*1..L?..Y...L...m^..M.......MR..J...M....{..PP...}..PP..&...S.......S...v...S.......S.......S.......S.......T....%..V.......V....s..V...(...V...h...X.......X.......X.......a...x...h,......h,..h...j.......k.......k.......s.......s.......s.......s...i...s.......s.......s.......s...i8..v...F...xt......f....?..f.......j...-M..ms......w....D..............}...........[...........V........<......M.......-........_...............u......K........................J...E.......E...e...E.......E...U...............#...........`...Q...`...e...........E.....

C:\Program Files\CloudCompare\translations\CloudCompare_fr.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	53795
Entropy (8bit):	4.600892640452502
Encrypted:	false
SSDEEP:
MD5:	6A7D4CB69AC026B9A0DB6E51D3D78117
SHA1:	CBC9763F6E3B543127FB36F36384DB2A593D63BF
SHA-256:	961542E2B04EE03A56480040D5EF41AADC19D53BB5491B9867346D5FC9A3CA4F
SHA-512:	DD8F9969299A594C8F836F1760A65171EF466E66F3B881CF6FF357149CE40C3525FBEE9C6162B038D939877DD2EE5CE7A8D22953F11E023558E1FCB8940B274F
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......fr_FRB... ...+..6e...D..X....M..u....P...\|...Z..........g\|......g.......h.......h9......h^......h.......h.......h....;...b...;..."..H,...#..I@..g...IA..g...J...Y!..M...k...T...{_..w...".......................).......6...`..V....`..........+.......].......""......oR...................0..p...(....H..7...u...<...,`..<...x...<.......<.......VE......VE..2"..VE..4v..VE...J..VE...?..f...}...............!............U.......0..........(........L...................]..........(...............<..&.......&...."W.&......&....+..&....2..&.......&.......&.......'p..."..'....]t..%..5...0..5..+f...5..+....5..+....6).3M...1..3M....+.3M......G....8..H6...<..J+~..B..J+..., .J+...C..J+......J+....P.J6E..C..J.J.....P.1..r..P.2..r..Rx....g.Rx...*o.Rx....W.R...2..R...s..S....xP.TZ......TZ...3..T}...z..V....-(.V.....L.V.....x.V.......W(E...H.W(E...?.W(E.....W(E.....[f3.....\.......\.....-.\.......\.......].....n.].....g.].....^.i2....H.i2......n,.......~3..v...<"..p=..t...Jl...>..,..

C:\Program Files\CloudCompare\translations\CloudCompare_ja.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	52749
Entropy (8bit):	5.753260720005621
Encrypted:	false
SSDEEP:
MD5:	46F9ED5E1C64EBFAA86BAFB3CD751C5C
SHA1:	013DE3E06B4DFA168D717E12D4848889F72C12B7
SHA-256:	BDF2F0C8653BD5045CB932655CBD6C3068FE8355CF19394F78F3B28FE3C252AF
SHA-512:	6A6A501C8E870D35007A0737A1733A3E85FF6208904624EF65F713F53D87AEC15673C4812FCF41D8435E398536667F8C31FA1E6A7E8F299DDC800499F4AC9829
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......jaB.......+..3....=..6....A..(....A..6....A.......B..(....B..?....B.......C..@h...C...W...D..W....L..p....M..tV...N..yX...P..\|....S...5...V...0...Z...X......f.......f.......f.......f.......f.......g.......gC......gh...;...A...;...[...;...n...;../....;.......;.......[..'....v...W..I@..f:..IA..fb..J...Wk..M...i?..T...y...w....................u...... ....`..T....`...F......(.......\<..............mM...................0..m...(.......7...tx..<...)<..<...wa..<.......<....o..VE...u..VE......VE..1(..VE...3..VE......f...{................m.......R...U..~p...0...............................]...................b......;..&.......&.......&.......&....(..&..../z.&.....?.&.......&.....&.'p....3.'....[q..%..2J..0..2..+f...2..+....3..+....3/.+.%..3Y.3M......3M......3M......;Q...[..?^...Kg.G....6..H6...;K.J+~..B..J+...)..J+...B*.J+......J+....p.J6E..B..J6... ..J6......J6....@.J.J...,.P.1..p..P.2..p1.Rx....,.Rx... H.Rx......R.../S.R...q..S....v..TZ......TZ.../..T}...yz.V....+..V..

C:\Program Files\CloudCompare\translations\CloudCompare_ko.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	553296
Entropy (8bit):	5.6770423337867655
Encrypted:	false
SSDEEP:
MD5:	31D12C0A17D3790A624421740678C83E
SHA1:	65B4B5747BAC1D55AD46AD9CD68980A41C13D726
SHA-256:	E5941229506994E3FF58B0C53D91E7091AA3FB0FC6FF80B505F92D41DCD95DB9
SHA-512:	DA71848A3E6749DF8B2DC529A27C0CE408C876EC94DAE78E4F50A13AB13A82AEEEB341CAED6CFFB3EEA06BB56D1FA4AE27EBE70D7A99A30BEB4180277FBBA944
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......ko_KRB..}....%..1b...%...g...+...)...-...K...-...Y...-...O...-.......0.......1.......1..!....=...B...A.......A...d...A..?....B.......B..1....B..?....C..3....C.......D..Ys...E..c....I..$....J..%....K..%....L.......M.......N.......P.......S.......T.......V...(...X.......Z.......k...>...x..\u......s!......s.......s.......s.......t.......t......tO......tt...;...?...;..B....;.......;.......;.......;.......O.......X...l...Y.......Z.......[.......v...........r......=...............=.......................:......>...................................~..[,.......~..&.......1...J...1.......1.......1....<..1....L..1...Q...7....a..G.......G......G...g...H,......H.......I@..sF..IA..sn..Ih..3...Ih...A..I.......J...Z...K....v..L?......L.... ..M...~...M...t...MR...I..M...g-..PP......PP......S.......S.......S.......S...V...S.......S...Y...Ta...!..Tb...S..T.......T.......V...u...V...z6..V.......V.......W#......X...v...X...ze..X...jf..Y......a.......g...p...h,......h,......j......

C:\Program Files\CloudCompare\translations\CloudCompare_kr.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	342848
Entropy (8bit):	5.71396246768156
Encrypted:	false
SSDEEP:
MD5:	041A18E4EAA08BE4F565E3B7ED1C7CEA
SHA1:	90FD52A9943BB51CEAAD511EA0F31D1C9FED723E
SHA-256:	70ADDFD279E4290A21A87BC0B968569F1946ECEB0ECC9F1D8EF7212197D7D735
SHA-512:	EEB682F8568DEDB2592E6B74762BEE96BA00E77B475F9FA904FAFC42166B0C37AEA2875E7D849D12E4DF74B3BF58C02E3AA1F50D18D3F7310B21304016030EFB
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......ko_KRB..Z....+..4....0.......1.......1...6...=..7....A.......A..7=...A.......B.......B..@....B.......C..B....C..Rh...D..],...E..b....L..y....M..}....N...,...P.......S.......T...h...V.......X.......Z...8...x..........m.......m.......m.......m.......m.......n#......nH......nm...;...?...;..8....;......;...*...;..3....;..S....O...o...[......[......v..........O?.........&...6W..1...A;..1...y...1......1....M..1......7....+..G...;...H,......I@..m?..IA..mg..Ih..A...Ih......I...=u..J...]~..K....-..L?...U..L....b..M...p...M.......MR......M......PP...h..PP.....S...AV..S.......S...CI..S...p...S...F6..S...r$..T.......V.......V....D..V.......V.......W#......X.......X....s..X......a.......h,..QV..h,...2..j...MK..k....X..k...Mb..s.......s....r..s...Q...s......s.......s.......s...Q...s......v....<..xt..O...x.......{......f...[...f...<...j...qB..ms......w...ji...............s..........[...)...............;0..............q........A......................w.................

C:\Program Files\CloudCompare\translations\CloudCompare_pt.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	62408
Entropy (8bit):	4.592973557077949
Encrypted:	false
SSDEEP:
MD5:	33B55A906BE90674F9588BA40AF78D87
SHA1:	31515CC7AA4DAFF5F1B406AB269CF46AC7AECF55
SHA-256:	6A6DACCB8D5C1D0E11725AF101FE8B68D21793B217E54B44E65E986658B19D5D
SHA-512:	BAA2ACF8ED6D657BAF48DD7B6DD0481EEA87D6D2BE8C685FF6C0CAF56FB565054DA1080A3F154F1087977A2FDCD3E5EB40CFCA862CD518C4D8B676D20832F541
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......pt_BRB.......+..7....D..g@...M...G...P.......Z...W......y.......zB......zg......z.......z.......z.......z.......{ ...;...Z...;...j..H,...9..I@..y...IA..z...J...g...M...}...T.......w...#..............................+W...`..di...`.........,.......m;...........................0......(.......7....g..<....g..<....>..VE... ..VE..2I..VE..4...VE.....VE.....f...........X......#@...........U.......0..........)........&...................]..................3......A..&.......&....#p.&....+%.&....-..&....3..&......&......&.......'p...#..'....l...%..5..*.0..6S.+f...6..+....6..+....6..3M...1..3M......3M....a.?^...W..G....9..H6...@..J+~..I(.J+...IZ.J+......J6E..I..J.J.....O^......P.1.....P.2.....Rx......Rx...+..Rx......R...2..R......S.......TZ.... .TZ...3=.T}....H.V....-..V.......V.......W(E...V.W(E.....W(E.....[f3.....\.......\.....u.\.......\.....T.].... ..]......].......i2......i2......n,....2..~3......<"......t...S....>.......>...z.........[e...x...%..@...1......

C:\Program Files\CloudCompare\translations\CloudCompare_ru.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	496971
Entropy (8bit):	5.350633764762437
Encrypted:	false
SSDEEP:
MD5:	E8EC7F482E36489E303D79B6060CB412
SHA1:	494C63A091D8063F351514C4D47CC0539A63958F
SHA-256:	B360CBE71F9C6D54E96F42A5F50F08D9F3540211952F6712CDB7FE8BFA08E6C4
SHA-512:	88EBAC5083BF8D2273898937FAC19732248118D20147D3A113115368C0E18333EB4E3F2002EE4DEE972B956D51ED2A3E1C84F2051090CD028525DC7273299578
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......ru_RUB..g@...+.......0..(....1..(....1...R...=.......A..#....A...&...A..%....B..#....B...X...B..%....C...U...C..\|E...D.......E.......L..M....M..S....N..c....P..t....S.......T.......V.......X...n...Z.......x..H.......,5......,.......,.......,.......-.......->......-c......-....;...=...;..I....;..OR...;..j4...;..Q....;..~`...O......[...@...v..................U...........&...{...1...T...1.......1...(...1...G...1...v...1...;...7...)...G.......H,...H..I@..,Z..IA..,...Ih...)..Ih..l;..I.......J.......K...,...L?......L.......M...;...M.......MR..\>..M....i..PP...M..PP..)...S.......S.......S.......S...&...S.......S...*~..T...d...V.......V....a..V...+^..V...{...W#......X....&..X.......X...[`..a....q..h,..{...h,......j....z..k...W...k...u...s....M..s...2-..s...{>..s.... ..s.......s...2]..s...{...s....P..v...V...xt......x...V...zr..B...{......f.......f....c..j....i..ms......w...........(......."c..........[...........,........9......$@..............................Y..........

C:\Program Files\CloudCompare\translations\CloudCompare_zh.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	248501
Entropy (8bit):	5.750926703704071
Encrypted:	false
SSDEEP:
MD5:	B8D2C4AD739C1E1170E59DB953A15D4A
SHA1:	CA6E7D99D3EF4EFA94184C2D93231C0126670D30
SHA-256:	F9ED475A57543C5BB790D0172652C731D5AE58CC54C33D6DF62512C771679F50
SHA-512:	5A6F9DF34538287A7C48A3DF3824478E8D974E34C7EB0E4732F0CF96428BD27E43E35B25E85E409157BC198BB297D176CA264F1C6FE36535DABD42471A143E3B
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......zhB..Z ...+..n....1...9...=..q....A.......A..r....B.......B..{o...C..\|....C.......D...A...E...,...L.......M.......N...i...P.......S.......T.......V......X......Z.......x...........z.......................9.......^...........................;...)...;..,....;..>....;..N....;.......;...0...O..K....[.......[..kf...v...........4......A...&......1...4(..1...y...1....{..G....~..H,......I@......IA......Ih..\|...Ih..#\..I.......J.......K.......L?..9 ..L...`...M.......M.......MR..F_..M.......PP......S....c..S...d...S.......S.......T.......V.......V.......W#..O...X.......X.......X.......a.......h,......h,..\...j......k....]..k.......s....*..s...]...s.......s...]E..v...B=..xt......x...B...{....5..f.......j.......ms......w...l..............h........P..[...@........................................f.......v..............?.......F.......................N...E.......E..#....E.......E...F...............<...`.......`..M.......$V...E..w:...............N.....j...................,

C:\Program Files\CloudCompare\translations\is-0NGBU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	160494
Entropy (8bit):	4.831791320613137
Encrypted:	false
SSDEEP:
MD5:	E9D302A698B9272BDA41D6DE1D8313FB
SHA1:	BBF35C04177CF290B43F7D2533BE44A15D929D02
SHA-256:	C61B67BB9D1E84F0AB0792B6518FE055414A68E44D0C7BC7C862773800FA8299
SHA-512:	12947B306874CF93ABA64BB46FAC48179C2D055E770D41AF32E50FFFB9F0C092F583AFCEA8B53FE9E238EF9370E9FFFBEB581270DFA1A7CB74EBE54D9BFF459F
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......hu_HUB../...........+.......@.......A...0...B...{...C.......D.......E.......F.......G...<...H...`...I.......P...s...Q.......R.......S.......T......U...N...V.......W.......X.......Y.......]..+y...s.......t.......................;..+Q...;..,U...;.......;.......;..&....M..+....O.......O...U..........}..+............=.......m..+....t..........9c..(5..,...+;..;...+;..m7..+O......1...9...D@...T..E@......H4...v..HY..Y...H.......IC......J.......J.......J.......LD......L.......PS...}..QR..!...R...]...T.......U....{..X.......Zr...=..[`......\......]x...-.._......._......yg...M..1...<....E..>...............J........T.......(.......S...$..Z....[.......,...u...y.......y...[...............#...........9..Z....E..#&...........z..!'...................%..Mv...D..._....................32.....5......9....5.......0...h...0...E...0.......0.......0..#....5...Z...5...........G......_2.. D..,... D..W...+....W..<U......<U...B..<.......H5..,...H5..X{..L....)..VE.."...VE..6l..V.....

C:\Program Files\CloudCompare\translations\is-10N3O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	138690
Entropy (8bit):	5.4870451639261075
Encrypted:	false
SSDEEP:
MD5:	26B777C6C94C5AA6E61F949AA889BF74
SHA1:	F78DA73388C86D4D5E90D19BB3BD5F895C027F27
SHA-256:	4281C421984772665A9D72AB32276CFE1E2A3B0EBE21D4B63C5A4C3BA1F49365
SHA-512:	8E02CE06F6DE77729AEFA24410CBD4BFBA2D935EF10DCF071DA47BB70D9C5E0969F528BDB3DB5CAB00E3142D7C573FCF66EA5EB4A2BC557229AD082C0EB1DBCC
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......he_ILB../....*......+..Sw...@......A......B.......C.......D...X...E.......F.../...G...O...H...o...I......P.......Q.......R...I...S...i...T......U......V.......W.......X.../...Y...O...]..$....s......t..X:.......4......`Y...;..$....;..%....;.......;...5...;.......M..$....O...6...O..s............}..%-...........=...m...m..%k...t..........^..(5......+;..2...+;..^...+O...N..1.......D@......E@...(..H4..T...HY..L...H..._...IC..\...J...\...J.......J...\j..LD..^...L...^o..PS..fl..QR......R...Q...T...su..U...s...X...x3..Zr..~...[`..L\..\.......]x....._......._....o..yg...(..1...3....E..5C.......z......?V......U.......U.......W....$..M....[..W....,..X....y.......y..\........a..............\@...9..NO...E...?......]s...z...G.......(......^....%..B^...D.._......._.................... ..........5..`/...0.......0...L...0......0..d(...0......5..ek...5..........fB......R... D..&O.. D..K...+...l...<U......<U..p)..<...p...H5..&w..H5..La..L...s...VE......VE......V.....

C:\Program Files\CloudCompare\translations\is-1CVRR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	342848
Entropy (8bit):	5.71396246768156
Encrypted:	false
SSDEEP:
MD5:	041A18E4EAA08BE4F565E3B7ED1C7CEA
SHA1:	90FD52A9943BB51CEAAD511EA0F31D1C9FED723E
SHA-256:	70ADDFD279E4290A21A87BC0B968569F1946ECEB0ECC9F1D8EF7212197D7D735
SHA-512:	EEB682F8568DEDB2592E6B74762BEE96BA00E77B475F9FA904FAFC42166B0C37AEA2875E7D849D12E4DF74B3BF58C02E3AA1F50D18D3F7310B21304016030EFB
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......ko_KRB..Z....+..4....0.......1.......1...6...=..7....A.......A..7=...A.......B.......B..@....B.......C..B....C..Rh...D..],...E..b....L..y....M..}....N...,...P.......S.......T...h...V.......X.......Z...8...x..........m.......m.......m.......m.......m.......n#......nH......nm...;...?...;..8....;......;...*...;..3....;..S....O...o...[......[......v..........O?.........&...6W..1...A;..1...y...1......1....M..1......7....+..G...;...H,......I@..m?..IA..mg..Ih..A...Ih......I...=u..J...]~..K....-..L?...U..L....b..M...p...M.......MR......M......PP...h..PP.....S...AV..S.......S...CI..S...p...S...F6..S...r$..T.......V.......V....D..V.......V.......W#......X.......X....s..X......a.......h,..QV..h,...2..j...MK..k....X..k...Mb..s.......s....r..s...Q...s......s.......s.......s...Q...s......v....<..xt..O...x.......{......f...[...f...<...j...qB..ms......w...ji...............s..........[...)...............;0..............q........A......................w.................

C:\Program Files\CloudCompare\translations\is-1E24F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	53795
Entropy (8bit):	4.600892640452502
Encrypted:	false
SSDEEP:
MD5:	6A7D4CB69AC026B9A0DB6E51D3D78117
SHA1:	CBC9763F6E3B543127FB36F36384DB2A593D63BF
SHA-256:	961542E2B04EE03A56480040D5EF41AADC19D53BB5491B9867346D5FC9A3CA4F
SHA-512:	DD8F9969299A594C8F836F1760A65171EF466E66F3B881CF6FF357149CE40C3525FBEE9C6162B038D939877DD2EE5CE7A8D22953F11E023558E1FCB8940B274F
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......fr_FRB... ...+..6e...D..X....M..u....P...\|...Z..........g\|......g.......h.......h9......h^......h.......h.......h....;...b...;..."..H,...#..I@..g...IA..g...J...Y!..M...k...T...{_..w...".......................).......6...`..V....`..........+.......].......""......oR...................0..p...(....H..7...u...<...,`..<...x...<.......<.......VE......VE..2"..VE..4v..VE...J..VE...?..f...}...............!............U.......0..........(........L...................]..........(...............<..&.......&...."W.&......&....+..&....2..&.......&.......&.......'p..."..'....]t..%..5...0..5..+f...5..+....5..+....6).3M...1..3M....+.3M......G....8..H6...<..J+~..B..J+..., .J+...C..J+......J+....P.J6E..C..J.J.....P.1..r..P.2..r..Rx....g.Rx...*o.Rx....W.R...2..R...s..S....xP.TZ......TZ...3..T}...z..V....-(.V.....L.V.....x.V.......W(E...H.W(E...?.W(E.....W(E.....[f3.....\.......\.....-.\.......\.......].....n.].....g.].....^.i2....H.i2......n,.......~3..v...<"..p=..t...Jl...>..,..

C:\Program Files\CloudCompare\translations\is-2QKRK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	166167
Entropy (8bit):	4.685212271435657
Encrypted:	false
SSDEEP:
MD5:	1F41FF5D3A781908A481C07B35998729
SHA1:	ECF3B3156FFE14569ECDF805CF3BE12F29681261
SHA-256:	EDB32A933CEF376A2636634E14E2977CED6284E4AA9A4AC7E2292F9CA54C384A
SHA-512:	A492E8AC88095A38A13549C18C68E1F61C7054AB9362C2B04C65B93E48E4A07941C8DA6950BAE79041094623E0ED330CA975110FDE8248B4D9380B9F729AD891
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......fr_FRB../....*..-....+.......@.......A.......B.......C...?...D.......E...\...F.......G.......H.......I..."...P.......Q...5...R.......S.......T.......U.......V...F...W...j...X.......Y.......]..+....s...=...t.......................;..+....;..,....;.......;..$b...;.......M..,....O.......O...5...........}..,3...........=.......m..,]...t..........A...(5..5j..+;..<T..+;..o...+O.."+..1...B\..D@......E@...Y..H4...8..HY..[{..H.......IC......J.......J.......J.......LD...\|..L.......PS...?..QR..!...R...`j..T.......U....[..X.......Zr.....[`...)..\......]x......_....7.._.......yg...i..1...=Q...E..?@......"Y......K............................$..\....[...^...,...'...y.......y...+.......o....../c.......Y...9..\....E..6(...........z..!................j...%..OC...D...+.......[......a.....;......>......B....5.......0.......0...m...0..#....0.......0..6....5.......5..................a... D..-Y.. D..Ze..+....]..<U...;..<U......<.......H5..-...H5..Z...L.......VE.."...VE..?...V......

C:\Program Files\CloudCompare\translations\is-2S2PK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	181387
Entropy (8bit):	4.755193800761075
Encrypted:	false
SSDEEP:
MD5:	859CE522A233AF31ED8D32822DA7755B
SHA1:	70B19B2A6914DA7D629F577F8987553713CD5D3F
SHA-256:	7D1E5CA3310B54D104C19BF2ABD402B38E584E87039A70E153C4A9AF74B25C22
SHA-512:	F9FAA5A19C2FD99CCD03151B7BE5DDA613E9C69678C028CDF678ADB176C23C7DE9EB846CF915BC3CC67ABD5D62D9CD483A5F47A57D5E6BB2F2053563D62E1EF5
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......daB..4......h....+......@...f...A.......B.......C.......D...U...E.......F...v...G.......H.......I.......P.......Q.......R...6...S...Z...T...~...U.......V.......W..."...X...F...Y...j...]..+....s.......t..................-...;..+....;..,....;../....;..;....M..+....O.......O...r...........}..,............=...8...m..,0...t...c......T...(5..B...+;..NH..+;..~H..+O..,...1...UP..D@......E@......H4...E..HY..j...H.......IC...#..J....J..J.......J.......LD......L....1..PS...B..QR......R...o...T.......U.......X.......Zr......[`...W..\....}..]x...[.._....-.._.......yg...e..1...O....E..R....7..........-!......]............................$..k....[...7...,.......y...c...y.................j4...........9..l8...E..p............z...;..................%..a....D...~.............-.....L......OH.....Uz...5.......0.......0...U...0.......0..p....5...7...5..L$..............p... D..-... D..i...+....@..<U.....<U.....<....S..H5..-2..H5..j$..L....B..VE.. ...VE..P...V......f...e...f.

C:\Program Files\CloudCompare\translations\is-3HP9U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	125763
Entropy (8bit):	4.803076457235141
Encrypted:	false
SSDEEP:
MD5:	5BBA1E27FCABC34B403CDF11F0A63CEF
SHA1:	EA02695BDBB9C7F55A94F60B306703F0D67B30C3
SHA-256:	B70C6DE694E717FA05C46831B6A11927536AEAD937CCE6BA66665D5C496EED06
SHA-512:	E15DB4397E5388B56B9869080DB06CB3357E3D575C619CB1187F7372AEC5B7F19F14EEC6D2674F174094945AEDB5470AB1CCEC1347B96E8E6BB20279FD038F6C
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......sk_SKB..$x...*.......+..>....@......A......B.......C.......D...3...E...Z...F......G......H.......I.......P.......Q...D...R.......S......T.......U.......V...1...W...X...X.......Y......]...Y...t..D-......K....;...3...;.......;.......;......;...V...M.......O.._ ......l....}.......m...........T..(5...(..+;......+;..%...+O......1......E@...k..F.......H4..?I..HY..@7..H...J...I....,..IC..HT..J...H{..J...H...LD..J"..L...Jv..PS..Q...R...D...Zr..i]..[`..7...\...nB.._...o...1...&....E..(........B......19......A.......A....$..AF...[..C....,..D....y..G.......v........g......G....9..A....E..........IH...%..4.......Kf..............................5..K....0...,...0.......0.......0..Of...0.......5..P....5..........E... D...C.. D..?'..+...Y`..<U......<U..\...<...]...H5...m..H5..?...L...^...VE......f.......f...8...g.......l...aP.......................6......d....D..f(...`..f...............?....`..h5...y..H....5..j........E...e.......e..@....... ......>......oZ......l..

C:\Program Files\CloudCompare\translations\is-443P6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:
MD5:	BCEBCF42735C6849BDECBB77451021DD
SHA1:	4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
SHA-256:	9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
SHA-512:	F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
Malicious:	false
Reputation:	low
Preview:	<.d....!..`...

C:\Program Files\CloudCompare\translations\is-5O1M6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	203767
Entropy (8bit):	5.362347888784502
Encrypted:	false
SSDEEP:
MD5:	7C1D56064AF52DC1C834FF709FC53609
SHA1:	C415A8B1B6B9D40DD68173A0772F32F639CD743A
SHA-256:	B2C601C7DECB9F8D2D6DC3B1929F2EC20656FF21783BF283DF23B02DD022DC5B
SHA-512:	FCBD753BECF6D2FC4B0074440AFBE06ED27B6FDF15D14ABD66DF28EF44272E98DC6DED66BAAE09EC8666BC78E454E20D38F945F4B0F6D0B6899CFD663E1BA1F9
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......ru_RUB..7.......L...+...W...@..,....A..,....B..-1...C..-U...D..-....E...r...F.......G.......H../....I../8...P..1'...Q..1K...R..1....S..1....T..1....U..2....V..2\...W..2....X..2....Y..2....].......s..$c...t...'......%........r...;..-....;.......;..J....;..V....M...C...O.......O..&.......8....}...m......+3...=..+....m.......t..+.......p...(5..]@..+;..[0..+;......+O..H...1...qM..D@..-...E@..1o..H4...p..HY..xm..H......IC...@..J....g..J.......J.......LD......L....p..PS......QR..!...R...}...T...&...U...'...U...ki..X...+...Zr..3...[`......\...:...]x..)..._......._...;...yg..S...1...\....E..__...7.........H.......k................j.......U...$..y....[.......,.......y...k...y...............................9..y....E...O...........z..!*...................%..nW...D.................%w.....g......j~.....qw...5...H...0.......0..I....0..._...0......5.......5..................~... D../k.. D..wa..+....?..<?.."t..<U......<U.."...<...#z..H5../...H5..w...L...&...VE.."...V...F$.

C:\Program Files\CloudCompare\translations\is-6DHOH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	220467
Entropy (8bit):	4.626295310482312
Encrypted:	false
SSDEEP:
MD5:	40760A3456C9C8ABE6EA90336AF5DA01
SHA1:	B249AA1CBF8C2636CE57EB4932D53492E4CE36AC
SHA-256:	553C046835DB9ADEF15954FA9A576625366BA8BFD16637038C4BCD28E5EBACE1
SHA-512:	068E55F39B5250CC937E4B2BD627873132D201D351B9351BE703CD9B95D3BAFB4BD649CB4DF120A976D7C156DA679758D952CAC5E0523107244E517D323BC0C5
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......de_DEB..7....*.......+..3....@..R....A..R....B..S....C..S@...D..S....E..T]...F..T....G..T....H..T....I..U#...P..W....Q..W6...R..W....S..W....T..W....U..W....V..XG...W..Xk...X..X....Y..X....]..2%...s..J$...t..9R......J.......B....;..1....;..3....;..q....;.......M..2O...O.......O..X@......ia...}..2y......Q....=..Q....m..2....t..Q...........(5......+;..ev..+;......+O..oh..1....4..D@..R...E@..WZ..H4..4...HY...[..H...AY..IC..>o..J...>...J.......J...>6..LD..@A..L...@...PS..I...QR..#...R....h..T...W...U...Xh..U....~..X...]...Zr..e(..[`..)...\...j...]x..O..._....K.._...lI..yg...U..1...f....E..i....7..........o.......wG......6.......6.......8....$...n...[..8....,..9....y.......y..=................3......>....9.......E..."......?_...z..#d.......0......A%...%..z....D..A.......B......KP......2.............^...5..B....0.......0..p....0..F....0...}...5..G....5..........H........... D..3}.. D...O..+...Q...<?..Ti..<U......<U..T...<...U)..H5..3...H5......L...X...VE..%j..V...l..

C:\Program Files\CloudCompare\translations\is-7DSMM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153608
Entropy (8bit):	4.843805801051326
Encrypted:	false
SSDEEP:
MD5:	BD8BDC7BBDB7A80C56DCB61B1108961D
SHA1:	9538C4D8BB9A95C0D9DC57C7708A99DD53A32D1F
SHA-256:	846E047573AE40C83671C3BA7F73E27EFC24B98C82701DA0DF9973E574178BB2
SHA-512:	F040EC410EBFEA21145F944E71ADCAE8E5F60907D1D3716A937A9A59A48F70C6B7EAAC91C2C554F59357A7BC820CDBD17C73A4DECC20B51F68EB79EDD35C5554
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......lv_LVB..........B...+..y....@.......A...=...B......C......D.......E.......F...#...G...G...H...k...I.......P...~...Q......R.......S.......T...5...U...Y...V......W.......X.......Y.......]..%....s.......t...8.......n.......A...;..&....;.......;...!...;...A...;../....M..%....O.......O...............}..%...........=.......m..&....t...(......(g..(5...+..+;..4...+;..d...+O......1...(...D@...a..E@......H4..z...HY..Q...H.......IC......J....6..J.......J.......LD......L....9..PS......QR......R...U...T....S..U.......X...._..Zr......[`..r...\.......]x....._......._....{..yg......1...5v...E..7........(......B.......\|.......\|W......~r...$..R....[..~....,.......y...l...y...............................9..S....E...g...........z...z...................%..F....D........................"Z.....$......)....5.......0...\...0.......0...r...0.......0.......5...a...5..........J......V... D..&... D..P...+.......<U......<U......<.......H5..'"..H5..P...L....~..VE...R..VE..%...V......

C:\Program Files\CloudCompare\translations\is-8LM9M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	127849
Entropy (8bit):	5.83455389078597
Encrypted:	false
SSDEEP:
MD5:	9C6A3721D01ECAF3F952CE96F46CE046
SHA1:	4A944E9E31DF778F7012D8E4A66497583BFD2118
SHA-256:	085D29EAF9BBB788B2F2503D74A1EF963A9411CEB600441254CE49A120E1AB63
SHA-512:	6E2807B8785F42A26C9CCBDBA0327DD40B529B10C468593F0E74113774D1CCDAA4FD9ACE9B259B9040E1475911428ECAEA49425B0F170862CF8147D23DB48E46
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......zh_TWB..2x..........+..)....@.......A.......B...j...C......D.......E......F.......G...)...H...M...I...q...P...%...Q...I...R......S......T.......U.......V...Z...W...~...X......Y.......]..!....s.......t..-...............4....;..!z...;.."\|...;.......;.......M..!....O.......O..Ay......N)...}..!............=.......m.." ...t...(.........(5......+;..;...+;.._...+O......1.......D@...C..E@...m..H4..W..HY..Pm..H...3...IC..1...J...1...J.......J...1...LD..2...L...38..PS..6...QR...T..R...T...T...A...U...A...X...E...Zr..K...[`..$...\...OW..]x......_......._...P...yg..a^..1...<....E..>....7...>.......;......Fo......+.......+.......-L...$..QR...[..-....,...F...y.......y..1J...............6......1p...9..Q....E..........2....z...........<......3....%..H....D..4W......4}....................Z...... ...5..4....0...?...0...K...0..5....0...L...5..6....5..........6.......U... D.."... D..O...+...<%..<U......<U..>...<...?:..H5..#...H5..O...L...AS..VE...M..VE......V.......f...L..

C:\Program Files\CloudCompare\translations\is-9AV9B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	553296
Entropy (8bit):	5.6770423337867655
Encrypted:	false
SSDEEP:
MD5:	31D12C0A17D3790A624421740678C83E
SHA1:	65B4B5747BAC1D55AD46AD9CD68980A41C13D726
SHA-256:	E5941229506994E3FF58B0C53D91E7091AA3FB0FC6FF80B505F92D41DCD95DB9
SHA-512:	DA71848A3E6749DF8B2DC529A27C0CE408C876EC94DAE78E4F50A13AB13A82AEEEB341CAED6CFFB3EEA06BB56D1FA4AE27EBE70D7A99A30BEB4180277FBBA944
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......ko_KRB..}....%..1b...%...g...+...)...-...K...-...Y...-...O...-.......0.......1.......1..!....=...B...A.......A...d...A..?....B.......B..1....B..?....C..3....C.......D..Ys...E..c....I..$....J..%....K..%....L.......M.......N.......P.......S.......T.......V...(...X.......Z.......k...>...x..\u......s!......s.......s.......s.......t.......t......tO......tt...;...?...;..B....;.......;.......;.......;.......O.......X...l...Y.......Z.......[.......v...........r......=...............=.......................:......>...................................~..[,.......~..&.......1...J...1.......1.......1....<..1....L..1...Q...7....a..G.......G......G...g...H,......H.......I@..sF..IA..sn..Ih..3...Ih...A..I.......J...Z...K....v..L?......L.... ..M...~...M...t...MR...I..M...g-..PP......PP......S.......S.......S.......S...V...S.......S...Y...Ta...!..Tb...S..T.......T.......V...u...V...z6..V.......V.......W#......X...v...X...ze..X...jf..Y......a.......g...p...h,......h,......j......

C:\Program Files\CloudCompare\translations\is-9VPOJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	158241
Entropy (8bit):	5.401819605980093
Encrypted:	false
SSDEEP:
MD5:	ACBE9498B42AE04A8A05DDB08F88DAF0
SHA1:	F847CC1A45A19B5527148BFBC93A3942819F22CD
SHA-256:	4835B26FC4FCCBF4444E4AF1178BA89ADA88D340BA74D61EAE344D81B8A26461
SHA-512:	D488BA62873DF44021B2DF7683B80F6207E998AC14F5DBA85E860949A8A01B4D826CFD574D83C8B1107294197D61F9098210D93729B026F03CEE86CC6B576C45
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......uk_UAB../.......$...+...K...@.......A.......B...&...C...J...D.......E...g...F.......G.......H.......I...-...P.......Q...@...R.......S.......T.......U.......V...Q...W...u...X.......Y.......]..y...s...b...t...~...............M...;..Q...;..+U...;.......;...W...;..!....M......O.......O...`...........}..........$...=.......m......t..........3...(5..&...+;..:...+;..k...+O... ..1...4...D@......E@...d..H4......HY..W...H.......IC...5..J....\..J.......J.......LD......L....Y..PS......QR.. ...R...\...T.......U.......X....y..Zr......[`..~...\.......]x......_......._.......yg...B..1...;....E..=w.......L......I............................$..X....[.......,.......y.......y...........,...................9..Y....E...%.......#...z.. ........P...........%..LB...D.......................-M...../......46...5...%...0...O...0...6...0.......0...J...0.......5.......5..................^... D..+... D..V...+.......<U......<U...e..<.......H5..+...H5..V...L....2..VE..!...VE..0...V......

C:\Program Files\CloudCompare\translations\is-A4SLN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	62408
Entropy (8bit):	4.592973557077949
Encrypted:	false
SSDEEP:
MD5:	33B55A906BE90674F9588BA40AF78D87
SHA1:	31515CC7AA4DAFF5F1B406AB269CF46AC7AECF55
SHA-256:	6A6DACCB8D5C1D0E11725AF101FE8B68D21793B217E54B44E65E986658B19D5D
SHA-512:	BAA2ACF8ED6D657BAF48DD7B6DD0481EEA87D6D2BE8C685FF6C0CAF56FB565054DA1080A3F154F1087977A2FDCD3E5EB40CFCA862CD518C4D8B676D20832F541
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......pt_BRB.......+..7....D..g@...M...G...P.......Z...W......y.......zB......zg......z.......z.......z.......z.......{ ...;...Z...;...j..H,...9..I@..y...IA..z...J...g...M...}...T.......w...#..............................+W...`..di...`.........,.......m;...........................0......(.......7....g..<....g..<....>..VE... ..VE..2I..VE..4...VE.....VE.....f...........X......#@...........U.......0..........)........&...................]..................3......A..&.......&....#p.&....+%.&....-..&....3..&......&......&.......'p...#..'....l...%..5..*.0..6S.+f...6..+....6..+....6..3M...1..3M......3M....a.?^...W..G....9..H6...@..J+~..I(.J+...IZ.J+......J6E..I..J.J.....O^......P.1.....P.2.....Rx......Rx...+..Rx......R...2..R......S.......TZ.... .TZ...3=.T}....H.V....-..V.......V.......W(E...V.W(E.....W(E.....[f3.....\.......\.....u.\.......\.....T.].... ..]......].......i2......i2......n,....2..~3......<"......t...S....>.......>...z.........[e...x...%..@...1......

C:\Program Files\CloudCompare\translations\is-CGINU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	521134
Entropy (8bit):	4.716352469714204
Encrypted:	false
SSDEEP:
MD5:	5FF09C5E4C5737EC86CBB8B803D4EE1D
SHA1:	628157DE3381DFD45051A5D0669E41E86282912F
SHA-256:	71F1E7E4CD5AD771CF9DD031C4AD0EDB52B86355AFE0CAA362F20396FE9C7773
SHA-512:	78521DEF6AC6EE85B6736D4729C94D7C4066622F80345F6042AB977AB72842582F9157F88A9E3C47C4DFED69DAFA49273525300CD74960C38B1DB199F7EE8D88
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......deB..g....+.......0..:"...1..:@...1..0u...=.......A..5....A.......A..S....B..5+...B...M...B..S....C...V...C...&...D.......E.......L..X....M.._W...N..p....P...:...S.../...T...}...V.......X......Z...>...x..x.......4.......5U......5z......5.......5.......5.......6.......63...;...A...;..M....;..P....;..k....;...\...;......O..M....[..'F...v...Q..............U.......D...&....n..1...ZP..1.......1...9...1...H...1...yF..1...k...7...:...G.......H,...:..I@..5...IA..5-..Ih...(..Ih...w..I.......J...."..K...>...L?../...L...n...M...EW..M.......MR..]_..M....C..PP.../..PP..;...S.......S...x...S.......S...ac..S.......S...e~..T...q...V.......V....3..V...<...V...~=..W#..S...X.......X....b..X.......a... :..h,......h,..h...j....d..k.......k......s....!..s...i9..s......s...ig..v...V...xt......x...Wr..zr..G!..{....2..f.......f.......j......ms......w...........x................r..[..........Z......../......R........2..............................;.......^I......z....................E

C:\Program Files\CloudCompare\translations\is-F6T7O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	189580
Entropy (8bit):	4.629471775298668
Encrypted:	false
SSDEEP:
MD5:	D512456777500DC13EF834ED528D3704
SHA1:	90A32284052C3FE12C18AFEC9F7FF56735E2E34B
SHA-256:	C515DD2A2E00765B5F651AAE124A55D617B24777138019ABC5A7001DA7417561
SHA-512:	BABEF929AC600C117967B42389623F352D219A466C484AE68EF3C9DA9FF61555875FFB0DAFC3E5EADA6FB43D37F7AFE74A6B6C73458A93FFB42819E1068C9A3B
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......gd_GBB..2....*...u...+......@.......A...B...B.......C.......D.. ....E.. ....F..!&...G..!J...H..!n...I..!....P..#m...Q..#....R..#....S..$....T..$$...U..$H...V..$....W..$....X..$....Y..%....]../....s...'...t...................F...;.......;../....;..=V...;..G....M../G...O.......O...k......$....}../o.......i...=.......m../....t..........[...(5..M...+;..@...+;..x...+O..:...1...\7..D@...f..E@..#...H4...p..HY..be..H.......IC......J.......J....R..J.......LD......L.......PS......QR..#l..R...g...T.......U.......X....\..Zr......[`......\...&...]x......_....C.._...'t..yg..?...1...BM...E..D.......;.......R'.......t.......@.......?...$..c....[......,...i...y.......y...Y.......f.......+...........9..c....E...............z.."....................%..U....D..................G.....UB.....W......\]...5.......0.......0..<....0...;...0.......5.......5..ij..............h... D..0... D..aC..+....K..<U.....<U...~..<.......H5..0...H5..a...L....1..VE..$...VE..X...V...8\|..f...Z...f...=..

C:\Program Files\CloudCompare\translations\is-GJN0R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	194487
Entropy (8bit):	4.877239354585035
Encrypted:	false
SSDEEP:
MD5:	6CBC5D8E1EABEC96C281065ECC51E35E
SHA1:	4E1E6BA3772428227CB033747006B4887E5D9AD1
SHA-256:	6A0BF6E70E7920C2B193E76E92F78F315936955D3B06AC039D917F2E06C43281
SHA-512:	CE1F9EE180176153D5F523D71E0DB06F4DEA65C24E5E2CD56341CFAEE349A8E9A0F606D99F7219A35DD4516D1528C90AEA4BB87548A55392B8F2B36164D478B1
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......tr_TRB..7....*.......+...-...@.......A.......B.......C...%...D.......E...F...F.......G.......H.......I.......P.. ....Q.. ....R..!D...S..!h...T..!....U..!....V.."....W.."0...X.."T...Y.."x...]..,g...s.../...t......................;..,9...;..-I...;..9@...;..E....M..,....O.......O...G...........}..,............=...\...m..,....t.........._3..(5..LJ..+;..Wt..+;...\..+O..7...1..._...D@......E@..!...H4...@..HY..t...H....2..IC...r..J......J....D..J....K..LD...$..L....x..PS......QR..!...R...x...T.......U....q..U...Y...X...."..Zr...%..[`......\....:..]x......_......._.......yg..6...1...X....E..[....7...Z......7Q......f............................$..u....[...:...,...5...y.......y...........7...............!...9..u....E...........P...z.. ........p...........%..j....D..................A.....U......Y......_....5...V...0.......0..8....0...U...0.......5.......5..~b..............z+.. D..-... D..s...+.......<?...8..<U...s..<U...p..<.......H5..-...H5..s...L.......VE.."0..V...4..

C:\Program Files\CloudCompare\translations\is-GP11Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	381344
Entropy (8bit):	4.669829345699403
Encrypted:	false
SSDEEP:
MD5:	7E515CB3FEB67498865D63BDFBFD6F8D
SHA1:	121EB386EA79599FD893A34DC43990CEADDAB093
SHA-256:	C7DCDCEFB2C9F5973F2A29B0DE986918B8226B09C807D7E6A2199DB077BCFBA3
SHA-512:	6D590D4D869C097B939404E07EF770AB9D7520DE819C12CD92E82EA79FDD452E2C4EBDD93E8C4D3573C81E941E101D9D1697579F84CF0017168097AD12DEDDEC
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......es_ARB..J....+.......=...,...A.. ....A...N...A..OS...B.. ....B.......B..O\|...C.......C.......D...g...L...@...M...!...N.......P.......S.......V..8....Z..;....x..rs..............+.......P.......u.................................;...O...;..I....;..A....;..W....;......;..._...[.......v..................E...&...y!..1...T...1.......1...%...1...<...1...d...1...e...G.......H,..."..I@......IA......Ih......Ih......I.......J......K...*1..L?..Y...L...m^..M.......MR..J...M....{..PP...}..PP..&...S.......S...v...S.......S.......S.......S.......T....%..V.......V....s..V...(...V...h...X.......X.......X.......a...x...h,......h,..h...j.......k.......k.......s.......s.......s.......s...i...s.......s.......s.......s...i8..v...F...xt......f....?..f.......j...-M..ms......w....D..............}...........[...........V........<......M.......-........_...............u......K........................J...E.......E...e...E.......E...U...............#...........`...Q...`...e...........E.....

C:\Program Files\CloudCompare\translations\is-HJ7JF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	129911
Entropy (8bit):	5.802855391832282
Encrypted:	false
SSDEEP:
MD5:	608B80932119D86503CDDCB1CA7F98BA
SHA1:	7F440399ABA23120F40F6F4FCAE966D621A1CC67
SHA-256:	CBA382ACC44D3680D400F2C625DE93D0C4BD72A90102769EDFD1FE91CB9B617B
SHA-512:	424618011A7C06748AADFC2295109D2D916289C81B01C669DA4991499B207B781604A03259C546739A3A6CF2F8F6DFA753B23406B2E2812F5407AEE343B5CBDD
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......jaB../....*...'...+..=....@.......A.......B...?...C...c...D......E......F.......G.......H..."...I...F...P.......Q...'...R...r...S......T......U.......V...8...W...\...X......Y......].."k...s...Q...t..A...............I....;.."C...;..#A...;.......;.......;.......M.."....O...B...O..[?......h....}.."........m...=.......m.."....t...........M..(5......+;......+;..WU..+O......1.......D@......E@...K..H4..>=..HY..F...H...Hr..IC..E...J...F...J.......J...E...LD..Gz..L...G...PS..O...QR......R...K!..T...Z...U...[e..X..._f..Zr..e...[`..7...\...i...]x...'.._......._...j...yg..~+..1.../....E..1?.......#......:.......?.......?n......A....$..G....[..Ap...,..B....y.......y..Ew......\|...............E....9..H....E..........F....z...]..............HL...%..=R...D..H.......I!......[......J......M..........5..It...0...3...0.......0...C...0..M....0...a...5..N....5..........N.......L6.. D..#... D..E...+...U%..<U......<U..X ..<...X...H5..#...H5..FK..L...[...VE......VE......V......f.

C:\Program Files\CloudCompare\translations\is-ITE62.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	248501
Entropy (8bit):	5.750926703704071
Encrypted:	false
SSDEEP:
MD5:	B8D2C4AD739C1E1170E59DB953A15D4A
SHA1:	CA6E7D99D3EF4EFA94184C2D93231C0126670D30
SHA-256:	F9ED475A57543C5BB790D0172652C731D5AE58CC54C33D6DF62512C771679F50
SHA-512:	5A6F9DF34538287A7C48A3DF3824478E8D974E34C7EB0E4732F0CF96428BD27E43E35B25E85E409157BC198BB297D176CA264F1C6FE36535DABD42471A143E3B
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......zhB..Z ...+..n....1...9...=..q....A.......A..r....B.......B..{o...C..\|....C.......D...A...E...,...L.......M.......N...i...P.......S.......T.......V......X......Z.......x...........z.......................9.......^...........................;...)...;..,....;..>....;..N....;.......;...0...O..K....[.......[..kf...v...........4......A...&......1...4(..1...y...1....{..G....~..H,......I@......IA......Ih..\|...Ih..#\..I.......J.......K.......L?..9 ..L...`...M.......M.......MR..F_..M.......PP......S....c..S...d...S.......S.......T.......V.......V.......W#..O...X.......X.......X.......a.......h,......h,..\...j......k....]..k.......s....*..s...]...s.......s...]E..v...B=..xt......x...B...{....5..f.......j.......ms......w...l..............h........P..[...@........................................f.......v..............?.......F.......................N...E.......E..#....E.......E...F...............<...`.......`..M.......$V...E..w:...............N.....j...................,

C:\Program Files\CloudCompare\translations\is-J6M97.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	496971
Entropy (8bit):	5.350633764762437
Encrypted:	false
SSDEEP:
MD5:	E8EC7F482E36489E303D79B6060CB412
SHA1:	494C63A091D8063F351514C4D47CC0539A63958F
SHA-256:	B360CBE71F9C6D54E96F42A5F50F08D9F3540211952F6712CDB7FE8BFA08E6C4
SHA-512:	88EBAC5083BF8D2273898937FAC19732248118D20147D3A113115368C0E18333EB4E3F2002EE4DEE972B956D51ED2A3E1C84F2051090CD028525DC7273299578
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......ru_RUB..g@...+.......0..(....1..(....1...R...=.......A..#....A...&...A..%....B..#....B...X...B..%....C...U...C..\|E...D.......E.......L..M....M..S....N..c....P..t....S.......T.......V.......X...n...Z.......x..H.......,5......,.......,.......,.......-.......->......-c......-....;...=...;..I....;..OR...;..j4...;..Q....;..~`...O......[...@...v..................U...........&...{...1...T...1.......1...(...1...G...1...v...1...;...7...)...G.......H,...H..I@..,Z..IA..,...Ih...)..Ih..l;..I.......J.......K...,...L?......L.......M...;...M.......MR..\>..M....i..PP...M..PP..)...S.......S.......S.......S...&...S.......S...*~..T...d...V.......V....a..V...+^..V...{...W#......X....&..X.......X...[`..a....q..h,..{...h,......j....z..k...W...k...u...s....M..s...2-..s...{>..s.... ..s.......s...2]..s...{...s....P..v...V...xt......x...V...zr..B...{......f.......f....c..j....i..ms......w...........(......."c..........[...........,........9......$@..............................Y..........

C:\Program Files\CloudCompare\translations\is-KN4UH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	160017
Entropy (8bit):	5.356034639583569
Encrypted:	false
SSDEEP:
MD5:	257BCE0D43476FF6548F7D9D2C3A5809
SHA1:	3D7B581860C381FC5644F739850F4C126F27838D
SHA-256:	C14EBFAA0FECB341B43ED2179DF9372D27AD20A15BAFB9F5403D57838AE1D88A
SHA-512:	051C71E4D105B082D169C5B57D2B6CFC093D174A649A0B4D42FD226B808C9FEDB51A8CED6D5CB5DB7F4FCCE29419EC068D473B7FF7B8E15B9F8A82D32B73BE00
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......arB..2....*.......+.......@.......A.......B..._...C......D.......E......F.......G... ...H...D...I...h...P...C...Q...g...R......S.......T.......U.......V...x...W......X.......Y.......]..'=...s......t...........]...........;..'....;..(....;.......;.......M..'e...O.......O...9...........}..'........C...=......m..'....t..........!o..(5...Z..+;..5u..+;..c...+O......1...!...D@...8..E@.....H4...,..HY..QI..H.......IC......J....1..J.......J.......LD......L.......PS......QR...R..R...V2..T.......U....]..X.......Zr.....[`......\....t..]x......_......._.......yg......1...6....E..8V..............C............................$..RN...[...0...,.......y.......y...................K...........9..R....E.."............z.......................%..F;...D...[..................................!....5.......0...I...0.......0...5...0..#....5.......5...p..............W}.. D..(... D..P=..+.......<U......<U......<.......H5..(...H5..P...L.......VE......VE......V....B..f...JJ..f.......f.

C:\Program Files\CloudCompare\translations\is-OQE25.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	161139
Entropy (8bit):	4.679177649012242
Encrypted:	false
SSDEEP:
MD5:	66C2DBE4E048D365AA3531409BB319E9
SHA1:	43376F186D324E261B0F6A2475FF2F0B5261B5E1
SHA-256:	EEDA9549376601652F8E2F35048E56548F4C15BC6CCAB48F5A3D5A249D631BEE
SHA-512:	4D4325752872BA0A3D4CA5F2ABA6FAC0D93EA7D36CAF2BF7EA2B32C9CD2B4832CC3A6B78AF7CAF33B28F7D6259CE1CE0F372089E16843FBE459B14F2A43B1904
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......it_ITB../....*.......+...i...@.......A.......B...L...C...p...D.......E.......F.......G.......H...3...I...W...P...P...Q...t...R.......S.......T.......U...+...V.......W.......X.......Y.......]..+....s.......t..................=...;..+[...;..,g...;.......;.......;..!!...M..+....O...D...O...............}..+........(...=.......m..,....t..........4...(5..'m..+;..<...+;..o5..+O......1...4...D@...%..E@......H4...)..HY..Z...H.......IC...+..J....R..J....j..J.......LD......L....E..PS...j..QR..!...R..._...T.......U.......X.......Zr......[`...0..\.......]x......_......._.......yg..."..1...=....E..?o..............Kf.......G...............(...$..[....[.......,...L...y...9...y...........Y.......Y...........9..\=...E..$T...........z.. k...................%..N....D..................,......_.....0......5....5.......0.......0.......0... ...0.......0..$....5...a...5...).......@......a... D..,... D..Y...+.......<U..._..<U......<....U..H5..-...H5..Z...L.......VE.."c..VE..1...V....7.

C:\Program Files\CloudCompare\translations\is-PCIMT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	162982
Entropy (8bit):	4.841899887077422
Encrypted:	false
SSDEEP:
MD5:	F9475A909A0BAF4B6B7A1937D58293C3
SHA1:	76B97225A11DD1F77CAC6EF144812F91BD8734BD
SHA-256:	CE99032A3B0BF8ABAD758895CC22837088EAD99FD2D2514E2D180693081CFE57
SHA-512:	8A4F1B802B6B81FF25C44251FB4A880E93E9A5FE25E36825A24BFE0EFB34E764E7E1EE585D3A56554964B7921E7813C67F12D200D6E0C5EAF4BB76B064B5C890
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......pl_PLB..0......"....+.......@...F...A...j...B......C.......D...3...E.......F...P...G...t...H.......I.......P.......Q.......R.......S...>...T...b...U.......V.......W.......X...(...Y...L...]......s.......t...r.......o.......+...;......;..+....;..."...;... ...M......O...6...O...........a...}..+...........=.......m..+G...t...G......,...(5......+;..:...+;..k...+O......1...-[..D@.....E@......H4...U..HY..WU..H.......IC......J....6..J.......J.......LD......L....%..PS......QR.. ...R...[...T....1..U.......X......Zr......[`......\.......]x...A.._......._....}..yg......1...;W...E..=........%......H....................$..Xp...[.......,.......y...i...y...........}......$R...........9..X....E..+)...........z.. E...................%..K....D...p....................&......(......-....5.......0.......0...e...0.......0..+....5...]...5...........f......]-.. D..,%.. D..V?..+....V..<U......<U......<....-..H5..,M..H5..V...L....Z..VE..!...VE..)...V.......f...P...f....K..f......

C:\Program Files\CloudCompare\translations\is-PFR24.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	165337
Entropy (8bit):	5.332219158085151
Encrypted:	false
SSDEEP:
MD5:	660413AD666A6B31A1ACF8F216781D6E
SHA1:	654409CDF3F551555957D3DBCF8D6A0D8F03A6C5
SHA-256:	E448AC9E3F16C29EB27AF3012EFE21052DAA78FABFB34CD6DFF2F69EE3BD3CDB
SHA-512:	C6AE4B784C3D302D7EC6B9CE7B27DDAF00713ADF233F1246CD0475697A59C84D6A86BAA1005283B1F89FCC0835FD131E5CF07B3534B66A0A0AA6AC6356006B8F
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......bg_BGB../......,....+..."...@...]...A.......B.......C.......D...P...E...!...F.......G.......H.......I.......P.......Q.......R...A...S...e...T.......U.......V.......W...1...X...U...Y...y...]..,....s...,...t...................P...;..+....;..-E...;..!....;..+....M..,Y...O...,...O..............}..,............=...Q...m..,....t...\|......>...(5..1...+;..<...+;..o...+O...r..1...>...D@......E@......H4......HY..[...H.......IC......J....E..J....X..J.......LD......L....L..PS......QR.."...R...`...T....X..U.......X.......Zr...q..[`...`..\.......]x......_......._....T..yg.....1...=....E..?...............L(.......(...............'...$..\....[.......,...I...y...!...y...................S...........9..]%...E..5p...........z..!q...................%..O....D..................D.....8......:......?....5...&...0.......0.. ....0...c...0..5....5.......5..................b:.. D..-... D..Z...+.......<U......<U...0..<.......H5..-...H5..[...L.......VE..#a..VE..;...V.......f...T...f...!..

C:\Program Files\CloudCompare\translations\is-QC8LA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	156799
Entropy (8bit):	5.859529082176036
Encrypted:	false
SSDEEP:
MD5:	082E361CBAC2E3A0849F87B76EF6E121
SHA1:	F10E882762DCD2E60041BDD6CC57598FC3DF4343
SHA-256:	0179ED1B136E1CB3F583351EAA2C545BA3D83A6EE3F82C32505926A1A5F5F183
SHA-512:	F378A42116924E30FA0B8FFF1D3C3CB185DC35B2746DCE2818BE7C2AA95C5DE103DF44AAC74DA969C36C557F1D4DE42AC7647EC41066247F8AD2697BDED667EA
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......koB..7...........+.......@...K...A...o...B......C.......D...8...E.......F...U...G...y...H......I.......P......Q.......R.......S...C...T...g...U.......V.......W.......X...-...Y...Q...]..$....s...>...t...................y...;..${...;..%....;...u...;...l...M..$....O.......O...8...........}..$............=...C...m..%!...t...n..........(5...a..+;..E@..+;..l\|..+O......1.......D@.....E@......H4......HY..\...H....]..IC......J.......J....8..J.......LD...a..L.......PS......QR......R...`...T.......U....^..U.......X....y..Zr......[`..y...\....A..]x......_......._....o..yg......1...FJ...E..HE...7..................Q........a.......5...........$..]....[...;...,.......y.......y...V...............!.......\|...9..]....E...R...........z...4.......f.......5...%..Te...D..................D......^................5...S...0.......0.......0.......0.......5.......5...........n......a... D..%... D..[...+.......<?......<U...;..<U...+..<.......H5..&...H5..\...L.......VE......V....A..f.

C:\Program Files\CloudCompare\translations\is-S6F83.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	52749
Entropy (8bit):	5.753260720005621
Encrypted:	false
SSDEEP:
MD5:	46F9ED5E1C64EBFAA86BAFB3CD751C5C
SHA1:	013DE3E06B4DFA168D717E12D4848889F72C12B7
SHA-256:	BDF2F0C8653BD5045CB932655CBD6C3068FE8355CF19394F78F3B28FE3C252AF
SHA-512:	6A6A501C8E870D35007A0737A1733A3E85FF6208904624EF65F713F53D87AEC15673C4812FCF41D8435E398536667F8C31FA1E6A7E8F299DDC800499F4AC9829
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......jaB.......+..3....=..6....A..(....A..6....A.......B..(....B..?....B.......C..@h...C...W...D..W....L..p....M..tV...N..yX...P..\|....S...5...V...0...Z...X......f.......f.......f.......f.......f.......g.......gC......gh...;...A...;...[...;...n...;../....;.......;.......[..'....v...W..I@..f:..IA..fb..J...Wk..M...i?..T...y...w....................u...... ....`..T....`...F......(.......\<..............mM...................0..m...(.......7...tx..<...)<..<...wa..<.......<....o..VE...u..VE......VE..1(..VE...3..VE......f...{................m.......R...U..~p...0...............................]...................b......;..&.......&.......&.......&....(..&..../z.&.....?.&.......&.....&.'p....3.'....[q..%..2J..0..2..+f...2..+....3..+....3/.+.%..3Y.3M......3M......3M......;Q...[..?^...Kg.G....6..H6...;K.J+~..B..J+...)..J+...B*.J+......J+....p.J6E..B..J6... ..J6......J6....@.J.J...,.P.1..p..P.2..p1.Rx....,.Rx... H.Rx......R.../S.R...q..S....v..TZ......TZ.../..T}...yz.V....+..V..

C:\Program Files\CloudCompare\translations\is-THVTA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.513794876803093
Encrypted:	false
SSDEEP:
MD5:	AAEA7BA475C961F941D0A23488457BEB
SHA1:	2BF0054002C8F7D85DD080DF332553BF9B3A8E26
SHA-256:	494AC9A2B2CB2FDECED353F4A9F898ED8DCF616E9BC667438C62681E3F7F79CF
SHA-512:	5B408C36C8F93F71E73E3D3B1C0C2AD699E92A6088604B8ADF8E588E8A75FC3FC92828199B7F00F5B05B224AE819220D07E56D610A76A267594870BEC77172BE
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......en_US.......

C:\Program Files\CloudCompare\translations\is-TL72C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	210126
Entropy (8bit):	4.665314011804837
Encrypted:	false
SSDEEP:
MD5:	1D351670EA821DB3BBB5AEE0AD186F10
SHA1:	AC0548EB87E7E4A12A604523713E5B08DF88FB50
SHA-256:	235F502810D5750A47421D3E57620DCAE5CFCFD83BC97766AD8B99B75238A544
SHA-512:	7A769F0C0858C25EBBBDD25C7308523ED298E35E2B5533981967773CF7D08899D81D05D34D67567BB48FB0DE21B3CE9C9D83866EC701DC841F8B430EADB43E29
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......caB..7...........+.......@..:/...A..:S...B..:....C..:....D..;....E..;....F..<9...G..<]...H..<....I..<....P..>....Q..>....R..?....S..?1...T..?U...U..?y...V..?....W..?....X..@....Y..@?...]../....s..1....t..........2R......#O...;.......;../....;..W....;..e....M../3...O.......O..9.......Jy...}../]......8....=..9....m../....t..98.......2..(5..l!..+;.._...+;......+O..U...1.......D@..:w..E@..>...H4...)..HY..~...H...!...IC......J....6..J....0..J.......LD.. ...L...!E..PS..)...QR.."...R.......T...9]..U...9...U...z...X...>s..Zr..E...[`...D..\...L#..]x..74.._......._...M...yg..fi..1...a....E..c....7...k......U.......p........A..................$.......[.......,.......y.......y...................=...........9...:...E...R...... ....z..":.......d......!....%..tQ...D.."......."......2......vD.....y...........5..#'...0...;...0..W....0..'....0......5..(g...5...a......)R.......... D..0w.. D..}...+...1...<?..5W..<U......<U..5...<...6...H5..0...H5..~...L...9...VE..$...V...S5..f.

C:\Program Files\CloudCompare\translations\is-TRV8H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	165170
Entropy (8bit):	4.679910767547088
Encrypted:	false
SSDEEP:
MD5:	C7C58A6D683797BFDD3EF676A37E2A40
SHA1:	809E580CDBF2FFDA10C77F8BE9BAC081978C102B
SHA-256:	4FFDA56BA3BB5414AB0482D1DDE64A6F226E3488F6B7F3F11A150E01F53FA4C8
SHA-512:	C5AED1A1AA13B8E794C83739B7FDDEAFD96785655C287993469F39607C8B9B0D2D8D222ECD1C13CF8445E623B195192F64DE373A8FB6FE43743BAF50E153CDA5
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......es_ESB../......,...+...y...@.......A.......B.......C.......D...v...E...=...F.......G.......H.......I.......P.......Q... ...R...k...S.......T.......U.......V...1...W...U...X...y...Y.......]..+....s.......t...................c...;..+....;..,....;...%...;..#....;..-....M..+....O.......O...............}..,............=...]...m..,/...t..........A...(5..3...+;..<...+;..o...+O..!b..1...Ap..D@......E@...D..H4...-..HY..[F..H.......IC...%..J....L..J.......J.......LD......L....O..PS......QR..!...R...`K..T.......U....&..X.......Zr.....[`...h..\......]x...\|.._....Y.._....A..yg......1...=....E..?a......!.......K........G...............R...$..\Q...[.......,...z...y.......y..................+............9..\....E..2............z.. ....................%..ON...D........................:......=B.....A....5...7...0.......0......0.."....0...,...0..3....5...}...5...Y..............a... D..-!.. D..Z6..+....0..<U...h..<U......<.......H5..-M..H5..Z...L.......VE.."...VE..>...V......

C:\Program Files\CloudCompare\translations\is-UBV0R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	179941
Entropy (8bit):	4.720938209922096
Encrypted:	false
SSDEEP:
MD5:	8472CF0BF6C659177AD45AA9E3A3247C
SHA1:	7B5313CDA126BB7863001499FB66FB1B56C255FC
SHA-256:	E47FE13713E184D07FA4495DDE0C589B0E8F562E91574A3558A9363443A4FA72
SHA-512:	DE36A1F033BD7A4D6475681EDC93CC7B0B5DCB6A7051831F2EE6F397C971B843E1C10B66C4FB2EFF2A23DC07433E80FBF7B95E62C5B93E121AB5AD88354D9CB8
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......fiB..38.....ct...+......@.......A.......B.......C...@...D.......E...]...F.......G.......H.......I...#...P.......Q...6...R.......S.......T.......U.......V...G...W...k...X.......Y.......]......s...T...t.......................;......;..+....;..&....;..3....M..+!...O.......O...e...........}..+K...........=.......m..+w...t..........J...(5..9...+;..:y..+;..mW..+O..$...1...KY..D@......E@...Z..H4...l..HY..X&..H.......IC......J.......J...."..J......LD.....L.......PS...'..QR.. L..R...]...T.......U.......X.......Zr......[`......\.......]x......_....k.._....>..yg.. /..1...;....E..>....7..{(......%.......J........T.......&.......U...$..Y[...[......,...s...y.......y...a.......}......d...........9..Y....E..k'...........z...........V..........%..M....D...Q.......{......d.....A......E......K....5.......0.......0..&J...0.......0..k....5......5..I9.............._:.. D..,O.. D..W...+....9..<U...G..<U...*..<.......H5..,y..H5..W...H5......L....5..VE..!u..VE..E...V..."{..f.

C:\Program Files\CloudCompare\translations\is-VNUAS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	174701
Entropy (8bit):	4.87192387061682
Encrypted:	false
SSDEEP:
MD5:	C57D0DE9D8458A5BEB2114E47B0FDE47
SHA1:	3A0E777539C51BB65EE76B8E1D8DCE4386CBC886
SHA-256:	03028B42DF5479270371E4C3BDC7DF2F56CBBE6DDA956A2864AC6F6415861FE8
SHA-512:	F7970C132064407752C3D42705376FE04FACAFD2CFE1021E615182555F7BA82E7970EDF5D14359F9D5CA69D4D570AA9DDC46D48CE787CFF13D305341A3E4AF79
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......cs_CZB..3p.....F....+.......@..!....@..Ef...A..!....A..E....B.."1...B..E....C.."U...C..E....D.."....D..F....E..#p...E..F)...F..#....F..FP...G..#....G..Fw...H..$....H..F....I..$6...I..F....P..&%...P..Gr...Q..&I...Q..G....R..&....R..G....S..&....S..H....T..&....T..H8...U..'....U..H_...V..'Z...V..H....W..'~...W..H....X..'....X..H....Y..'....Y..H....]..,....]..,....s.......t...9..................;.......;..+....;..1B...;......;..?x...;..N....;..iY...;..s3...M..,B...M..,....O.......O...w...O..rr...........}..,j...}..-....... 5...=.. ....m..,....m..-8...t.. .......ay..(5..TT..+;...A..+;..B...+;..u...+O......+O..=a..1...a...D@.."...E@..&m..E@..G...F...J...H4...=..HY..`...H.......I...J...IC......J....-..J.......J.......LD......L....(..PS.....QR.."S..R...e...T.... ..U......X.......Zr...g..[`......\......]x......_......._......._...v...yg......1...C....E..E...............=.......Q........................s...$..a....[.......,.......y.......y...y..............G..........

C:\Program Files\CloudCompare\translations\qt_ar.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	160017
Entropy (8bit):	5.356034639583569
Encrypted:	false
SSDEEP:
MD5:	257BCE0D43476FF6548F7D9D2C3A5809
SHA1:	3D7B581860C381FC5644F739850F4C126F27838D
SHA-256:	C14EBFAA0FECB341B43ED2179DF9372D27AD20A15BAFB9F5403D57838AE1D88A
SHA-512:	051C71E4D105B082D169C5B57D2B6CFC093D174A649A0B4D42FD226B808C9FEDB51A8CED6D5CB5DB7F4FCCE29419EC068D473B7FF7B8E15B9F8A82D32B73BE00
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......arB..2....*.......+.......@.......A.......B..._...C......D.......E......F.......G... ...H...D...I...h...P...C...Q...g...R......S.......T.......U.......V...x...W......X.......Y.......]..'=...s......t...........]...........;..'....;..(....;.......;.......M..'e...O.......O...9...........}..'........C...=......m..'....t..........!o..(5...Z..+;..5u..+;..c...+O......1...!...D@...8..E@.....H4...,..HY..QI..H.......IC......J....1..J.......J.......LD......L.......PS......QR...R..R...V2..T.......U....]..X.......Zr.....[`......\....t..]x......_......._.......yg......1...6....E..8V..............C............................$..RN...[...0...,.......y.......y...................K...........9..R....E.."............z.......................%..F;...D...[..................................!....5.......0...I...0.......0...5...0..#....5.......5...p..............W}.. D..(... D..P=..+.......<U......<U......<.......H5..(...H5..P...L.......VE......VE......V....B..f...JJ..f.......f.

C:\Program Files\CloudCompare\translations\qt_bg.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	165337
Entropy (8bit):	5.332219158085151
Encrypted:	false
SSDEEP:
MD5:	660413AD666A6B31A1ACF8F216781D6E
SHA1:	654409CDF3F551555957D3DBCF8D6A0D8F03A6C5
SHA-256:	E448AC9E3F16C29EB27AF3012EFE21052DAA78FABFB34CD6DFF2F69EE3BD3CDB
SHA-512:	C6AE4B784C3D302D7EC6B9CE7B27DDAF00713ADF233F1246CD0475697A59C84D6A86BAA1005283B1F89FCC0835FD131E5CF07B3534B66A0A0AA6AC6356006B8F
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......bg_BGB../......,....+..."...@...]...A.......B.......C.......D...P...E...!...F.......G.......H.......I.......P.......Q.......R...A...S...e...T.......U.......V.......W...1...X...U...Y...y...]..,....s...,...t...................P...;..+....;..-E...;..!....;..+....M..,Y...O...,...O..............}..,............=...Q...m..,....t...\|......>...(5..1...+;..<...+;..o...+O...r..1...>...D@......E@......H4......HY..[...H.......IC......J....E..J....X..J.......LD......L....L..PS......QR.."...R...`...T....X..U.......X.......Zr...q..[`...`..\.......]x......_......._....T..yg.....1...=....E..?...............L(.......(...............'...$..\....[.......,...I...y...!...y...................S...........9..]%...E..5p...........z..!q...................%..O....D..................D.....8......:......?....5...&...0.......0.. ....0...c...0..5....5.......5..................b:.. D..-... D..Z...+.......<U......<U...0..<.......H5..-...H5..[...L.......VE..#a..VE..;...V.......f...T...f...!..

C:\Program Files\CloudCompare\translations\qt_ca.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	210126
Entropy (8bit):	4.665314011804837
Encrypted:	false
SSDEEP:
MD5:	1D351670EA821DB3BBB5AEE0AD186F10
SHA1:	AC0548EB87E7E4A12A604523713E5B08DF88FB50
SHA-256:	235F502810D5750A47421D3E57620DCAE5CFCFD83BC97766AD8B99B75238A544
SHA-512:	7A769F0C0858C25EBBBDD25C7308523ED298E35E2B5533981967773CF7D08899D81D05D34D67567BB48FB0DE21B3CE9C9D83866EC701DC841F8B430EADB43E29
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......caB..7...........+.......@..:/...A..:S...B..:....C..:....D..;....E..;....F..<9...G..<]...H..<....I..<....P..>....Q..>....R..?....S..?1...T..?U...U..?y...V..?....W..?....X..@....Y..@?...]../....s..1....t..........2R......#O...;.......;../....;..W....;..e....M../3...O.......O..9.......Jy...}../]......8....=..9....m../....t..98.......2..(5..l!..+;.._...+;......+O..U...1.......D@..:w..E@..>...H4...)..HY..~...H...!...IC......J....6..J....0..J.......LD.. ...L...!E..PS..)...QR.."...R.......T...9]..U...9...U...z...X...>s..Zr..E...[`...D..\...L#..]x..74.._......._...M...yg..fi..1...a....E..c....7...k......U.......p........A..................$.......[.......,.......y.......y...................=...........9...:...E...R...... ....z..":.......d......!....%..tQ...D.."......."......2......vD.....y...........5..#'...0...;...0..W....0..'....0......5..(g...5...a......)R.......... D..0w.. D..}...+...1...<?..5W..<U......<U..5...<...6...H5..0...H5..~...L...9...VE..$...V...S5..f.

C:\Program Files\CloudCompare\translations\qt_cs.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	174701
Entropy (8bit):	4.87192387061682
Encrypted:	false
SSDEEP:
MD5:	C57D0DE9D8458A5BEB2114E47B0FDE47
SHA1:	3A0E777539C51BB65EE76B8E1D8DCE4386CBC886
SHA-256:	03028B42DF5479270371E4C3BDC7DF2F56CBBE6DDA956A2864AC6F6415861FE8
SHA-512:	F7970C132064407752C3D42705376FE04FACAFD2CFE1021E615182555F7BA82E7970EDF5D14359F9D5CA69D4D570AA9DDC46D48CE787CFF13D305341A3E4AF79
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......cs_CZB..3p.....F....+.......@..!....@..Ef...A..!....A..E....B.."1...B..E....C.."U...C..E....D.."....D..F....E..#p...E..F)...F..#....F..FP...G..#....G..Fw...H..$....H..F....I..$6...I..F....P..&%...P..Gr...Q..&I...Q..G....R..&....R..G....S..&....S..H....T..&....T..H8...U..'....U..H_...V..'Z...V..H....W..'~...W..H....X..'....X..H....Y..'....Y..H....]..,....]..,....s.......t...9..................;.......;..+....;..1B...;......;..?x...;..N....;..iY...;..s3...M..,B...M..,....O.......O...w...O..rr...........}..,j...}..-....... 5...=.. ....m..,....m..-8...t.. .......ay..(5..TT..+;...A..+;..B...+;..u...+O......+O..=a..1...a...D@.."...E@..&m..E@..G...F...J...H4...=..HY..`...H.......I...J...IC......J....-..J.......J.......LD......L....(..PS.....QR.."S..R...e...T.... ..U......X.......Zr...g..[`......\......]x......_......._......._...v...yg......1...C....E..E...............=.......Q........................s...$..a....[.......,.......y.......y...y..............G..........

C:\Program Files\CloudCompare\translations\qt_da.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	181387
Entropy (8bit):	4.755193800761075
Encrypted:	false
SSDEEP:
MD5:	859CE522A233AF31ED8D32822DA7755B
SHA1:	70B19B2A6914DA7D629F577F8987553713CD5D3F
SHA-256:	7D1E5CA3310B54D104C19BF2ABD402B38E584E87039A70E153C4A9AF74B25C22
SHA-512:	F9FAA5A19C2FD99CCD03151B7BE5DDA613E9C69678C028CDF678ADB176C23C7DE9EB846CF915BC3CC67ABD5D62D9CD483A5F47A57D5E6BB2F2053563D62E1EF5
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......daB..4......h....+......@...f...A.......B.......C.......D...U...E.......F...v...G.......H.......I.......P.......Q.......R...6...S...Z...T...~...U.......V.......W..."...X...F...Y...j...]..+....s.......t..................-...;..+....;..,....;../....;..;....M..+....O.......O...r...........}..,............=...8...m..,0...t...c......T...(5..B...+;..NH..+;..~H..+O..,...1...UP..D@......E@......H4...E..HY..j...H.......IC...#..J....J..J.......J.......LD......L....1..PS...B..QR......R...o...T.......U.......X.......Zr......[`...W..\....}..]x...[.._....-.._.......yg...e..1...O....E..R....7..........-!......]............................$..k....[...7...,.......y...c...y.................j4...........9..l8...E..p............z...;..................%..a....D...~.............-.....L......OH.....Uz...5.......0.......0...U...0.......0..p....5...7...5..L$..............p... D..-... D..i...+....@..<U.....<U.....<....S..H5..-2..H5..j$..L....B..VE.. ...VE..P...V......f...e...f.

C:\Program Files\CloudCompare\translations\qt_de.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	220467
Entropy (8bit):	4.626295310482312
Encrypted:	false
SSDEEP:
MD5:	40760A3456C9C8ABE6EA90336AF5DA01
SHA1:	B249AA1CBF8C2636CE57EB4932D53492E4CE36AC
SHA-256:	553C046835DB9ADEF15954FA9A576625366BA8BFD16637038C4BCD28E5EBACE1
SHA-512:	068E55F39B5250CC937E4B2BD627873132D201D351B9351BE703CD9B95D3BAFB4BD649CB4DF120A976D7C156DA679758D952CAC5E0523107244E517D323BC0C5
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......de_DEB..7....*.......+..3....@..R....A..R....B..S....C..S@...D..S....E..T]...F..T....G..T....H..T....I..U#...P..W....Q..W6...R..W....S..W....T..W....U..W....V..XG...W..Xk...X..X....Y..X....]..2%...s..J$...t..9R......J.......B....;..1....;..3....;..q....;.......M..2O...O.......O..X@......ia...}..2y......Q....=..Q....m..2....t..Q...........(5......+;..ev..+;......+O..oh..1....4..D@..R...E@..WZ..H4..4...HY...[..H...AY..IC..>o..J...>...J.......J...>6..LD..@A..L...@...PS..I...QR..#...R....h..T...W...U...Xh..U....~..X...]...Zr..e(..[`..)...\...j...]x..O..._....K.._...lI..yg...U..1...f....E..i....7..........o.......wG......6.......6.......8....$...n...[..8....,..9....y.......y..=................3......>....9.......E..."......?_...z..#d.......0......A%...%..z....D..A.......B......KP......2.............^...5..B....0.......0..p....0..F....0...}...5..G....5..........H........... D..3}.. D...O..+...Q...<?..Ti..<U......<U..T...<...U)..H5..3...H5......L...X...VE..%j..V...l..

C:\Program Files\CloudCompare\translations\qt_en.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.513794876803093
Encrypted:	false
SSDEEP:
MD5:	AAEA7BA475C961F941D0A23488457BEB
SHA1:	2BF0054002C8F7D85DD080DF332553BF9B3A8E26
SHA-256:	494AC9A2B2CB2FDECED353F4A9F898ED8DCF616E9BC667438C62681E3F7F79CF
SHA-512:	5B408C36C8F93F71E73E3D3B1C0C2AD699E92A6088604B8ADF8E588E8A75FC3FC92828199B7F00F5B05B224AE819220D07E56D610A76A267594870BEC77172BE
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......en_US.......

C:\Program Files\CloudCompare\translations\qt_es.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	165170
Entropy (8bit):	4.679910767547088
Encrypted:	false
SSDEEP:
MD5:	C7C58A6D683797BFDD3EF676A37E2A40
SHA1:	809E580CDBF2FFDA10C77F8BE9BAC081978C102B
SHA-256:	4FFDA56BA3BB5414AB0482D1DDE64A6F226E3488F6B7F3F11A150E01F53FA4C8
SHA-512:	C5AED1A1AA13B8E794C83739B7FDDEAFD96785655C287993469F39607C8B9B0D2D8D222ECD1C13CF8445E623B195192F64DE373A8FB6FE43743BAF50E153CDA5
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......es_ESB../......,...+...y...@.......A.......B.......C.......D...v...E...=...F.......G.......H.......I.......P.......Q... ...R...k...S.......T.......U.......V...1...W...U...X...y...Y.......]..+....s.......t...................c...;..+....;..,....;...%...;..#....;..-....M..+....O.......O...............}..,............=...]...m..,/...t..........A...(5..3...+;..<...+;..o...+O..!b..1...Ap..D@......E@...D..H4...-..HY..[F..H.......IC...%..J....L..J.......J.......LD......L....O..PS......QR..!...R...`K..T.......U....&..X.......Zr.....[`...h..\......]x...\|.._....Y.._....A..yg......1...=....E..?a......!.......K........G...............R...$..\Q...[.......,...z...y.......y..................+............9..\....E..2............z.. ....................%..ON...D........................:......=B.....A....5...7...0.......0......0.."....0...,...0..3....5...}...5...Y..............a... D..-!.. D..Z6..+....0..<U...h..<U......<.......H5..-M..H5..Z...L.......VE.."...VE..>...V......

C:\Program Files\CloudCompare\translations\qt_fi.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	179941
Entropy (8bit):	4.720938209922096
Encrypted:	false
SSDEEP:
MD5:	8472CF0BF6C659177AD45AA9E3A3247C
SHA1:	7B5313CDA126BB7863001499FB66FB1B56C255FC
SHA-256:	E47FE13713E184D07FA4495DDE0C589B0E8F562E91574A3558A9363443A4FA72
SHA-512:	DE36A1F033BD7A4D6475681EDC93CC7B0B5DCB6A7051831F2EE6F397C971B843E1C10B66C4FB2EFF2A23DC07433E80FBF7B95E62C5B93E121AB5AD88354D9CB8
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......fiB..38.....ct...+......@.......A.......B.......C...@...D.......E...]...F.......G.......H.......I...#...P.......Q...6...R.......S.......T.......U.......V...G...W...k...X.......Y.......]......s...T...t.......................;......;..+....;..&....;..3....M..+!...O.......O...e...........}..+K...........=.......m..+w...t..........J...(5..9...+;..:y..+;..mW..+O..$...1...KY..D@......E@...Z..H4...l..HY..X&..H.......IC......J.......J...."..J......LD.....L.......PS...'..QR.. L..R...]...T.......U.......X.......Zr......[`......\.......]x......_....k.._....>..yg.. /..1...;....E..>....7..{(......%.......J........T.......&.......U...$..Y[...[......,...s...y.......y...a.......}......d...........9..Y....E..k'...........z...........V..........%..M....D...Q.......{......d.....A......E......K....5.......0.......0..&J...0.......0..k....5......5..I9.............._:.. D..,O.. D..W...+....9..<U...G..<U...*..<.......H5..,y..H5..W...H5......L....5..VE..!u..VE..E...V..."{..f.

C:\Program Files\CloudCompare\translations\qt_fr.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	166167
Entropy (8bit):	4.685212271435657
Encrypted:	false
SSDEEP:
MD5:	1F41FF5D3A781908A481C07B35998729
SHA1:	ECF3B3156FFE14569ECDF805CF3BE12F29681261
SHA-256:	EDB32A933CEF376A2636634E14E2977CED6284E4AA9A4AC7E2292F9CA54C384A
SHA-512:	A492E8AC88095A38A13549C18C68E1F61C7054AB9362C2B04C65B93E48E4A07941C8DA6950BAE79041094623E0ED330CA975110FDE8248B4D9380B9F729AD891
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......fr_FRB../....*..-....+.......@.......A.......B.......C...?...D.......E...\...F.......G.......H.......I..."...P.......Q...5...R.......S.......T.......U.......V...F...W...j...X.......Y.......]..+....s...=...t.......................;..+....;..,....;.......;..$b...;.......M..,....O.......O...5...........}..,3...........=.......m..,]...t..........A...(5..5j..+;..<T..+;..o...+O.."+..1...B\..D@......E@...Y..H4...8..HY..[{..H.......IC......J.......J.......J.......LD...\|..L.......PS...?..QR..!...R...`j..T.......U....[..X.......Zr.....[`...)..\......]x......_....7.._.......yg...i..1...=Q...E..?@......"Y......K............................$..\....[...^...,...'...y.......y...+.......o....../c.......Y...9..\....E..6(...........z..!................j...%..OC...D...+.......[......a.....;......>......B....5.......0.......0...m...0..#....0.......0..6....5.......5..................a... D..-Y.. D..Ze..+....]..<U...;..<U......<.......H5..-...H5..Z...L.......VE.."...VE..?...V......

C:\Program Files\CloudCompare\translations\qt_gd.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	189580
Entropy (8bit):	4.629471775298668
Encrypted:	false
SSDEEP:
MD5:	D512456777500DC13EF834ED528D3704
SHA1:	90A32284052C3FE12C18AFEC9F7FF56735E2E34B
SHA-256:	C515DD2A2E00765B5F651AAE124A55D617B24777138019ABC5A7001DA7417561
SHA-512:	BABEF929AC600C117967B42389623F352D219A466C484AE68EF3C9DA9FF61555875FFB0DAFC3E5EADA6FB43D37F7AFE74A6B6C73458A93FFB42819E1068C9A3B
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......gd_GBB..2....*...u...+......@.......A...B...B.......C.......D.. ....E.. ....F..!&...G..!J...H..!n...I..!....P..#m...Q..#....R..#....S..$....T..$$...U..$H...V..$....W..$....X..$....Y..%....]../....s...'...t...................F...;.......;../....;..=V...;..G....M../G...O.......O...k......$....}../o.......i...=.......m../....t..........[...(5..M...+;..@...+;..x...+O..:...1...\7..D@...f..E@..#...H4...p..HY..be..H.......IC......J.......J....R..J.......LD......L.......PS......QR..#l..R...g...T.......U.......X....\..Zr......[`......\...&...]x......_....C.._...'t..yg..?...1...BM...E..D.......;.......R'.......t.......@.......?...$..c....[......,...i...y.......y...Y.......f.......+...........9..c....E...............z.."....................%..U....D..................G.....UB.....W......\]...5.......0.......0..<....0...;...0.......5.......5..ij..............h... D..0... D..aC..+....K..<U.....<U...~..<.......H5..0...H5..a...L....1..VE..$...VE..X...V...8\|..f...Z...f...=..

C:\Program Files\CloudCompare\translations\qt_he.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	138690
Entropy (8bit):	5.4870451639261075
Encrypted:	false
SSDEEP:
MD5:	26B777C6C94C5AA6E61F949AA889BF74
SHA1:	F78DA73388C86D4D5E90D19BB3BD5F895C027F27
SHA-256:	4281C421984772665A9D72AB32276CFE1E2A3B0EBE21D4B63C5A4C3BA1F49365
SHA-512:	8E02CE06F6DE77729AEFA24410CBD4BFBA2D935EF10DCF071DA47BB70D9C5E0969F528BDB3DB5CAB00E3142D7C573FCF66EA5EB4A2BC557229AD082C0EB1DBCC
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......he_ILB../....*......+..Sw...@......A......B.......C.......D...X...E.......F.../...G...O...H...o...I......P.......Q.......R...I...S...i...T......U......V.......W.......X.../...Y...O...]..$....s......t..X:.......4......`Y...;..$....;..%....;.......;...5...;.......M..$....O...6...O..s............}..%-...........=...m...m..%k...t..........^..(5......+;..2...+;..^...+O...N..1.......D@......E@...(..H4..T...HY..L...H..._...IC..\...J...\...J.......J...\j..LD..^...L...^o..PS..fl..QR......R...Q...T...su..U...s...X...x3..Zr..~...[`..L\..\.......]x....._......._....o..yg...(..1...3....E..5C.......z......?V......U.......U.......W....$..M....[..W....,..X....y.......y..\........a..............\@...9..NO...E...?......]s...z...G.......(......^....%..B^...D.._......._.................... ..........5..`/...0.......0...L...0......0..d(...0......5..ek...5..........fB......R... D..&O.. D..K...+...l...<U......<U..p)..<...p...H5..&w..H5..La..L...s...VE......VE......V.....

C:\Program Files\CloudCompare\translations\qt_hu.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	160494
Entropy (8bit):	4.831791320613137
Encrypted:	false
SSDEEP:
MD5:	E9D302A698B9272BDA41D6DE1D8313FB
SHA1:	BBF35C04177CF290B43F7D2533BE44A15D929D02
SHA-256:	C61B67BB9D1E84F0AB0792B6518FE055414A68E44D0C7BC7C862773800FA8299
SHA-512:	12947B306874CF93ABA64BB46FAC48179C2D055E770D41AF32E50FFFB9F0C092F583AFCEA8B53FE9E238EF9370E9FFFBEB581270DFA1A7CB74EBE54D9BFF459F
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......hu_HUB../...........+.......@.......A...0...B...{...C.......D.......E.......F.......G...<...H...`...I.......P...s...Q.......R.......S.......T......U...N...V.......W.......X.......Y.......]..+y...s.......t.......................;..+Q...;..,U...;.......;.......;..&....M..+....O.......O...U..........}..+............=.......m..+....t..........9c..(5..,...+;..;...+;..m7..+O......1...9...D@...T..E@......H4...v..HY..Y...H.......IC......J.......J.......J.......LD......L.......PS...}..QR..!...R...]...T.......U....{..X.......Zr...=..[`......\......]x...-.._......._......yg...M..1...<....E..>...............J........T.......(.......S...$..Z....[.......,...u...y.......y...[...............#...........9..Z....E..#&...........z..!'...................%..Mv...D..._....................32.....5......9....5.......0...h...0...E...0.......0.......0..#....5...Z...5...........G......_2.. D..,... D..W...+....W..<U......<U...B..<.......H5..,...H5..X{..L....)..VE.."...VE..6l..V.....

C:\Program Files\CloudCompare\translations\qt_it.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	161139
Entropy (8bit):	4.679177649012242
Encrypted:	false
SSDEEP:
MD5:	66C2DBE4E048D365AA3531409BB319E9
SHA1:	43376F186D324E261B0F6A2475FF2F0B5261B5E1
SHA-256:	EEDA9549376601652F8E2F35048E56548F4C15BC6CCAB48F5A3D5A249D631BEE
SHA-512:	4D4325752872BA0A3D4CA5F2ABA6FAC0D93EA7D36CAF2BF7EA2B32C9CD2B4832CC3A6B78AF7CAF33B28F7D6259CE1CE0F372089E16843FBE459B14F2A43B1904
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......it_ITB../....*.......+...i...@.......A.......B...L...C...p...D.......E.......F.......G.......H...3...I...W...P...P...Q...t...R.......S.......T.......U...+...V.......W.......X.......Y.......]..+....s.......t..................=...;..+[...;..,g...;.......;.......;..!!...M..+....O...D...O...............}..+........(...=.......m..,....t..........4...(5..'m..+;..<...+;..o5..+O......1...4...D@...%..E@......H4...)..HY..Z...H.......IC...+..J....R..J....j..J.......LD......L....E..PS...j..QR..!...R..._...T.......U.......X.......Zr......[`...0..\.......]x......_......._.......yg..."..1...=....E..?o..............Kf.......G...............(...$..[....[.......,...L...y...9...y...........Y.......Y...........9..\=...E..$T...........z.. k...................%..N....D..................,......_.....0......5....5.......0.......0.......0... ...0.......0..$....5...a...5...).......@......a... D..,... D..Y...+.......<U..._..<U......<....U..H5..-...H5..Z...L.......VE.."c..VE..1...V....7.

C:\Program Files\CloudCompare\translations\qt_ja.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	129911
Entropy (8bit):	5.802855391832282
Encrypted:	false
SSDEEP:
MD5:	608B80932119D86503CDDCB1CA7F98BA
SHA1:	7F440399ABA23120F40F6F4FCAE966D621A1CC67
SHA-256:	CBA382ACC44D3680D400F2C625DE93D0C4BD72A90102769EDFD1FE91CB9B617B
SHA-512:	424618011A7C06748AADFC2295109D2D916289C81B01C669DA4991499B207B781604A03259C546739A3A6CF2F8F6DFA753B23406B2E2812F5407AEE343B5CBDD
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......jaB../....*...'...+..=....@.......A.......B...?...C...c...D......E......F.......G.......H..."...I...F...P.......Q...'...R...r...S......T......U.......V...8...W...\...X......Y......].."k...s...Q...t..A...............I....;.."C...;..#A...;.......;.......;.......M.."....O...B...O..[?......h....}.."........m...=.......m.."....t...........M..(5......+;......+;..WU..+O......1.......D@......E@...K..H4..>=..HY..F...H...Hr..IC..E...J...F...J.......J...E...LD..Gz..L...G...PS..O...QR......R...K!..T...Z...U...[e..X..._f..Zr..e...[`..7...\...i...]x...'.._......._...j...yg..~+..1.../....E..1?.......#......:.......?.......?n......A....$..G....[..Ap...,..B....y.......y..Ew......\|...............E....9..H....E..........F....z...]..............HL...%..=R...D..H.......I!......[......J......M..........5..It...0...3...0.......0...C...0..M....0...a...5..N....5..........N.......L6.. D..#... D..E...+...U%..<U......<U..X ..<...X...H5..#...H5..FK..L...[...VE......VE......V......f.

C:\Program Files\CloudCompare\translations\qt_ko.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	156799
Entropy (8bit):	5.859529082176036
Encrypted:	false
SSDEEP:
MD5:	082E361CBAC2E3A0849F87B76EF6E121
SHA1:	F10E882762DCD2E60041BDD6CC57598FC3DF4343
SHA-256:	0179ED1B136E1CB3F583351EAA2C545BA3D83A6EE3F82C32505926A1A5F5F183
SHA-512:	F378A42116924E30FA0B8FFF1D3C3CB185DC35B2746DCE2818BE7C2AA95C5DE103DF44AAC74DA969C36C557F1D4DE42AC7647EC41066247F8AD2697BDED667EA
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......koB..7...........+.......@...K...A...o...B......C.......D...8...E.......F...U...G...y...H......I.......P......Q.......R.......S...C...T...g...U.......V.......W.......X...-...Y...Q...]..$....s...>...t...................y...;..${...;..%....;...u...;...l...M..$....O.......O...8...........}..$............=...C...m..%!...t...n..........(5...a..+;..E@..+;..l\|..+O......1.......D@.....E@......H4......HY..\...H....]..IC......J.......J....8..J.......LD...a..L.......PS......QR......R...`...T.......U....^..U.......X....y..Zr......[`..y...\....A..]x......_......._....o..yg......1...FJ...E..HE...7..................Q........a.......5...........$..]....[...;...,.......y.......y...V...............!.......\|...9..]....E...R...........z...4.......f.......5...%..Te...D..................D......^................5...S...0.......0.......0.......0.......5.......5...........n......a... D..%... D..[...+.......<?......<U...;..<U...+..<.......H5..&...H5..\...L.......VE......V....A..f.

C:\Program Files\CloudCompare\translations\qt_lv.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	153608
Entropy (8bit):	4.843805801051326
Encrypted:	false
SSDEEP:
MD5:	BD8BDC7BBDB7A80C56DCB61B1108961D
SHA1:	9538C4D8BB9A95C0D9DC57C7708A99DD53A32D1F
SHA-256:	846E047573AE40C83671C3BA7F73E27EFC24B98C82701DA0DF9973E574178BB2
SHA-512:	F040EC410EBFEA21145F944E71ADCAE8E5F60907D1D3716A937A9A59A48F70C6B7EAAC91C2C554F59357A7BC820CDBD17C73A4DECC20B51F68EB79EDD35C5554
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......lv_LVB..........B...+..y....@.......A...=...B......C......D.......E.......F...#...G...G...H...k...I.......P...~...Q......R.......S.......T...5...U...Y...V......W.......X.......Y.......]..%....s.......t...8.......n.......A...;..&....;.......;...!...;...A...;../....M..%....O.......O...............}..%...........=.......m..&....t...(......(g..(5...+..+;..4...+;..d...+O......1...(...D@...a..E@......H4..z...HY..Q...H.......IC......J....6..J.......J.......LD......L....9..PS......QR......R...U...T....S..U.......X...._..Zr......[`..r...\.......]x....._......._....{..yg......1...5v...E..7........(......B.......\|.......\|W......~r...$..R....[..~....,.......y...l...y...............................9..S....E...g...........z...z...................%..F....D........................"Z.....$......)....5.......0...\...0.......0...r...0.......0.......5...a...5..........J......V... D..&... D..P...+.......<U......<U......<.......H5..'"..H5..P...L....~..VE...R..VE..%...V......

C:\Program Files\CloudCompare\translations\qt_pl.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	162982
Entropy (8bit):	4.841899887077422
Encrypted:	false
SSDEEP:
MD5:	F9475A909A0BAF4B6B7A1937D58293C3
SHA1:	76B97225A11DD1F77CAC6EF144812F91BD8734BD
SHA-256:	CE99032A3B0BF8ABAD758895CC22837088EAD99FD2D2514E2D180693081CFE57
SHA-512:	8A4F1B802B6B81FF25C44251FB4A880E93E9A5FE25E36825A24BFE0EFB34E764E7E1EE585D3A56554964B7921E7813C67F12D200D6E0C5EAF4BB76B064B5C890
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......pl_PLB..0......"....+.......@...F...A...j...B......C.......D...3...E.......F...P...G...t...H.......I.......P.......Q.......R.......S...>...T...b...U.......V.......W.......X...(...Y...L...]......s.......t...r.......o.......+...;......;..+....;..."...;... ...M......O...6...O...........a...}..+...........=.......m..+G...t...G......,...(5......+;..:...+;..k...+O......1...-[..D@.....E@......H4...U..HY..WU..H.......IC......J....6..J.......J.......LD......L....%..PS......QR.. ...R...[...T....1..U.......X......Zr......[`......\.......]x...A.._......._....}..yg......1...;W...E..=........%......H....................$..Xp...[.......,.......y...i...y...........}......$R...........9..X....E..+)...........z.. E...................%..K....D...p....................&......(......-....5.......0.......0...e...0.......0..+....5...]...5...........f......]-.. D..,%.. D..V?..+....V..<U......<U......<....-..H5..,M..H5..V...L....Z..VE..!...VE..)...V.......f...P...f....K..f......

C:\Program Files\CloudCompare\translations\qt_ru.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	203767
Entropy (8bit):	5.362347888784502
Encrypted:	false
SSDEEP:
MD5:	7C1D56064AF52DC1C834FF709FC53609
SHA1:	C415A8B1B6B9D40DD68173A0772F32F639CD743A
SHA-256:	B2C601C7DECB9F8D2D6DC3B1929F2EC20656FF21783BF283DF23B02DD022DC5B
SHA-512:	FCBD753BECF6D2FC4B0074440AFBE06ED27B6FDF15D14ABD66DF28EF44272E98DC6DED66BAAE09EC8666BC78E454E20D38F945F4B0F6D0B6899CFD663E1BA1F9
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......ru_RUB..7.......L...+...W...@..,....A..,....B..-1...C..-U...D..-....E...r...F.......G.......H../....I../8...P..1'...Q..1K...R..1....S..1....T..1....U..2....V..2\...W..2....X..2....Y..2....].......s..$c...t...'......%........r...;..-....;.......;..J....;..V....M...C...O.......O..&.......8....}...m......+3...=..+....m.......t..+.......p...(5..]@..+;..[0..+;......+O..H...1...qM..D@..-...E@..1o..H4...p..HY..xm..H......IC...@..J....g..J.......J.......LD......L....p..PS......QR..!...R...}...T...&...U...'...U...ki..X...+...Zr..3...[`......\...:...]x..)..._......._...;...yg..S...1...\....E..__...7.........H.......k................j.......U...$..y....[.......,.......y...k...y...............................9..y....E...O...........z..!*...................%..nW...D.................%w.....g......j~.....qw...5...H...0.......0..I....0..._...0......5.......5..................~... D../k.. D..wa..+....?..<?.."t..<U......<U.."...<...#z..H5../...H5..w...L...&...VE.."...V...F$.

C:\Program Files\CloudCompare\translations\qt_sk.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	125763
Entropy (8bit):	4.803076457235141
Encrypted:	false
SSDEEP:
MD5:	5BBA1E27FCABC34B403CDF11F0A63CEF
SHA1:	EA02695BDBB9C7F55A94F60B306703F0D67B30C3
SHA-256:	B70C6DE694E717FA05C46831B6A11927536AEAD937CCE6BA66665D5C496EED06
SHA-512:	E15DB4397E5388B56B9869080DB06CB3357E3D575C619CB1187F7372AEC5B7F19F14EEC6D2674F174094945AEDB5470AB1CCEC1347B96E8E6BB20279FD038F6C
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......sk_SKB..$x...*.......+..>....@......A......B.......C.......D...3...E...Z...F......G......H.......I.......P.......Q...D...R.......S......T.......U.......V...1...W...X...X.......Y......]...Y...t..D-......K....;...3...;.......;.......;......;...V...M.......O.._ ......l....}.......m...........T..(5...(..+;......+;..%...+O......1......E@...k..F.......H4..?I..HY..@7..H...J...I....,..IC..HT..J...H{..J...H...LD..J"..L...Jv..PS..Q...R...D...Zr..i]..[`..7...\...nB.._...o...1...&....E..(........B......19......A.......A....$..AF...[..C....,..D....y..G.......v........g......G....9..A....E..........IH...%..4.......Kf..............................5..K....0...,...0.......0.......0..Of...0.......5..P....5..........E... D...C.. D..?'..+...Y`..<U......<U..\...<...]...H5...m..H5..?...L...^...VE......f.......f...8...g.......l...aP.......................6......d....D..f(...`..f...............?....`..h5...y..H....5..j........E...e.......e..@....... ......>......oZ......l..

C:\Program Files\CloudCompare\translations\qt_tr.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	194487
Entropy (8bit):	4.877239354585035
Encrypted:	false
SSDEEP:
MD5:	6CBC5D8E1EABEC96C281065ECC51E35E
SHA1:	4E1E6BA3772428227CB033747006B4887E5D9AD1
SHA-256:	6A0BF6E70E7920C2B193E76E92F78F315936955D3B06AC039D917F2E06C43281
SHA-512:	CE1F9EE180176153D5F523D71E0DB06F4DEA65C24E5E2CD56341CFAEE349A8E9A0F606D99F7219A35DD4516D1528C90AEA4BB87548A55392B8F2B36164D478B1
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......tr_TRB..7....*.......+...-...@.......A.......B.......C...%...D.......E...F...F.......G.......H.......I.......P.. ....Q.. ....R..!D...S..!h...T..!....U..!....V.."....W.."0...X.."T...Y.."x...]..,g...s.../...t......................;..,9...;..-I...;..9@...;..E....M..,....O.......O...G...........}..,............=...\...m..,....t.........._3..(5..LJ..+;..Wt..+;...\..+O..7...1..._...D@......E@..!...H4...@..HY..t...H....2..IC...r..J......J....D..J....K..LD...$..L....x..PS......QR..!...R...x...T.......U....q..U...Y...X...."..Zr...%..[`......\....:..]x......_......._.......yg..6...1...X....E..[....7...Z......7Q......f............................$..u....[...:...,...5...y.......y...........7...............!...9..u....E...........P...z.. ........p...........%..j....D..................A.....U......Y......_....5...V...0.......0..8....0...U...0.......5.......5..~b..............z+.. D..-... D..s...+.......<?...8..<U...s..<U...p..<.......H5..-...H5..s...L.......VE.."0..V...4..

C:\Program Files\CloudCompare\translations\qt_uk.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	158241
Entropy (8bit):	5.401819605980093
Encrypted:	false
SSDEEP:
MD5:	ACBE9498B42AE04A8A05DDB08F88DAF0
SHA1:	F847CC1A45A19B5527148BFBC93A3942819F22CD
SHA-256:	4835B26FC4FCCBF4444E4AF1178BA89ADA88D340BA74D61EAE344D81B8A26461
SHA-512:	D488BA62873DF44021B2DF7683B80F6207E998AC14F5DBA85E860949A8A01B4D826CFD574D83C8B1107294197D61F9098210D93729B026F03CEE86CC6B576C45
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......uk_UAB../.......$...+...K...@.......A.......B...&...C...J...D.......E...g...F.......G.......H.......I...-...P.......Q...@...R.......S.......T.......U.......V...Q...W...u...X.......Y.......]..y...s...b...t...~...............M...;..Q...;..+U...;.......;...W...;..!....M......O.......O...`...........}..........$...=.......m......t..........3...(5..&...+;..:...+;..k...+O... ..1...4...D@......E@...d..H4......HY..W...H.......IC...5..J....\..J.......J.......LD......L....Y..PS......QR.. ...R...\...T.......U.......X....y..Zr......[`..~...\.......]x......_......._.......yg...B..1...;....E..=w.......L......I............................$..X....[.......,.......y.......y...........,...................9..Y....E...%.......#...z.. ........P...........%..LB...D.......................-M...../......46...5...%...0...O...0...6...0.......0...J...0.......5.......5..................^... D..+... D..V...+.......<U......<U...e..<.......H5..+...H5..V...L....2..VE..!...VE..0...V......

C:\Program Files\CloudCompare\translations\qt_zh_TW.qm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	Qt Translation file
Category:	dropped
Size (bytes):	127849
Entropy (8bit):	5.83455389078597
Encrypted:	false
SSDEEP:
MD5:	9C6A3721D01ECAF3F952CE96F46CE046
SHA1:	4A944E9E31DF778F7012D8E4A66497583BFD2118
SHA-256:	085D29EAF9BBB788B2F2503D74A1EF963A9411CEB600441254CE49A120E1AB63
SHA-512:	6E2807B8785F42A26C9CCBDBA0327DD40B529B10C468593F0E74113774D1CCDAA4FD9ACE9B259B9040E1475911428ECAEA49425B0F170862CF8147D23DB48E46
Malicious:	false
Reputation:	low
Preview:	<.d....!..`.......zh_TWB..2x..........+..)....@.......A.......B...j...C......D.......E......F.......G...)...H...M...I...q...P...%...Q...I...R......S......T.......U.......V...Z...W...~...X......Y.......]..!....s.......t..-...............4....;..!z...;.."\|...;.......;.......M..!....O.......O..Ay......N)...}..!............=.......m.." ...t...(.........(5......+;..;...+;.._...+O......1.......D@...C..E@...m..H4..W..HY..Pm..H...3...IC..1...J...1...J.......J...1...LD..2...L...38..PS..6...QR...T..R...T...T...A...U...A...X...E...Zr..K...[`..$...\...OW..]x......_......._...P...yg..a^..1...<....E..>....7...>.......;......Fo......+.......+.......-L...$..QR...[..-....,...F...y.......y..1J...............6......1p...9..Q....E..........2....z...........<......3....%..H....D..4W......4}....................Z...... ...5..4....0...?...0...K...0..5....0...L...5..6....5..........6.......U... D.."... D..O...+...<%..<U......<U..>...<...?:..H5..#...H5..O...L...AS..VE...M..VE......V.......f...L..

C:\Program Files\CloudCompare\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	InnoSetup Log 64-bit CloudCompare {4DE0A2C8-03F9-4B3F-BAFC-1D5F2141464B}, version 0x418, 31475 bytes, 305090\37\user\376, C:\Program Files\CloudCompare\376\377\377\
Category:	dropped
Size (bytes):	31475
Entropy (8bit):	3.6020355740227554
Encrypted:	false
SSDEEP:
MD5:	502D4EA794E54380035FEC65778F6722
SHA1:	CB556B65C32EB1A9692B69F353EBF09F0405AABF
SHA-256:	B611F69CDF636E8635BF7B3195D9BE8F936EDC45FF8EA114BB587C04DC08F659
SHA-512:	F8C3B58DB758ABD5F2007B1B3AE8A6A65B97363DB3E2A7672B9F1E75BADB612CF016DAC6C68FD2828C867DF58DD0FBD1C2E4CD58E3252E724F7DE09CC0305C9E
Malicious:	false
Reputation:	low
Preview:	Inno Setup Uninstall Log (b) 64-bit.............................{4DE0A2C8-03F9-4B3F-BAFC-1D5F2141464B}..........................................................................................CloudCompare.............................................................................................................................z....................................................................................................................f.........!V.*......u........3.0.5.0.9.0......j.o.n.e.s......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.l.o.u.d.C.o.m.p.a.r.e..................$.z.. .....2....~...IFPS....$........................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TEXECWAIT.........TSETUPSTEP.........TNEWCHECKLISTBOX....TNEWCH

C:\Program Files\CloudCompare\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3024000
Entropy (8bit):	6.401341683892991
Encrypted:	false
SSDEEP:
MD5:	CA9D0BC1FC3C0AEBE22047A2DCBCD715
SHA1:	8DF8054C0F3A9969493D74001AE6C6815090BB48
SHA-256:	69FEBFE8BB5D272CE0A488B1C4C7BF2C3CEAD22410F7E907681635DDD910EF42
SHA-512:	75D8B8811B736C6AF7802194508979209E34B6357662902456687E83FE348DE422B37A96A52B336448B9EE22F1B43D7C7B7266F67D9000B663F24CFE989F81AE
Malicious:	false
Reputation:	low
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...p.._.................$,.........P6,......@,...@.......................................@......@....................-......`-.49....-...............-..&....................................-......................i-.......-......................text...P.+.......+................. ..`.itext..t(....,..*....+............. ..`.data.......@,......(,.............@....bss.....x....,..........................idata..49...`-..:....,.............@....didata.......-.......,.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-.......-.............@..@.rsrc.........-.......-.............@..@......................-.............@..@........................................................

C:\Program Files\CloudCompare\unins000.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	InnoSetup messages, version 6.0.0, 261 messages (UTF-16), Cancel installation
Category:	dropped
Size (bytes):	24097
Entropy (8bit):	3.2749730459064845
Encrypted:	false
SSDEEP:
MD5:	313D0CC5D1A64D2565E35937991775A6
SHA1:	B8ACB11878C485865C9E4679248E53B83A8F3AD4
SHA-256:	5ED0233C0922E9F20307315E24B4F33C3D56AB9F42B2F75AE91E7A27FD313B66
SHA-512:	7C2DB4A3A4A8DF09F8119A7BA4CA9EBFE562F0A34D431928344E21A5853931EEFBFD910DC4026C6788AC22423BBB125F2B700326D8A1D82B134E2B486C3D0684
Malicious:	false
Reputation:	low
Preview:	Inno Setup Messages (6.0.0) (u)......................................]..+..... .C.a.n.c.e.l. .i.n.s.t.a.l.l.a.t.i.o.n...S.e.l.e.c.t. .a.c.t.i.o.n...&.I.g.n.o.r.e. .t.h.e. .e.r.r.o.r. .a.n.d. .c.o.n.t.i.n.u.e...&.T.r.y. .a.g.a.i.n...&.A.b.o.u.t. .S.e.t.u.p.........%.1. .v.e.r.s.i.o.n. .%.2.....%.3.........%.1. .h.o.m.e. .p.a.g.e.:.....%.4.....A.b.o.u.t. .S.e.t.u.p...Y.o.u. .m.u.s.t. .b.e. .l.o.g.g.e.d. .i.n. .a.s. .a.n. .a.d.m.i.n.i.s.t.r.a.t.o.r. .w.h.e.n. .i.n.s.t.a.l.l.i.n.g. .t.h.i.s. .p.r.o.g.r.a.m.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.c.o.m.m.e.n.d.e.d. .t.h.a.t. .y.o.u. .a.l.l.o.w. .S.e.t.u.p. .t.o. .a.u.t.o.m.a.t.i.c.a.l.l.y. .c.l.o.s.e. .t.h.e.s.e. .a.p.p.l.i.c.a.t.i.o.n.s.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.

C:\Program Files\CloudCompare\vcruntime140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85784
Entropy (8bit):	6.594110245111798
Encrypted:	false
SSDEEP:
MD5:	1453290DB80241683288F33E6DD5E80E
SHA1:	29FB9AF50458DF43EF40BFC8F0F516D0C0A106FD
SHA-256:	2B7602CC1521101D116995E3E2DDFE0943349806378A0D40ADD81BA64E359B6C
SHA-512:	4EA48A11E29EA7AC3957DCAB1A7912F83FD1C922C43D7B7D78523178FE236B4418729455B78AC672BB5632ECD5400746179802C6A9690ADB025270B0ADE84E91
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ZWB..6,..6,..6,.....6,..N...6,..6-.26,.L^/..6,.L^(..6,.L^)..6,.L^,..6,.L^...6,.L^...6,.Rich.6,.........................PE..d.....0].........." .........R...............................................P......<.....`A............................................4............0....... ...........A...@..t...P...8............................................................................text.............................. ..`.rdata...6.......8..................@..@.data... ...........................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc..t....@......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\xerces-c_3_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2488832
Entropy (8bit):	6.160943225546191
Encrypted:	false
SSDEEP:
MD5:	38A03AED710AD5C471F7864E05CBA4E9
SHA1:	E1A0FD42A0BBF5F7F22F9BCCE5C9BE1F4EABB221
SHA-256:	D8690C5E0EA25CA2AB480BCEA830CAAF07CA5BDCB5D81FDF6C5B36ACDEEDF124
SHA-512:	B66B526148E24DF3C8CD7150DEBF83D1D861939866B00B186759F26C75E187257AEFB25D7FAC44788CE04C54981381441C64BE141DA520BAF1EDEF9E9B5C7C11
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|P....................:'..............................yx.....................................................Rich............................PE..d...#:.X.........." .....J...........d.......................................0&.....]\&... ..............................................\....!.P.....$..<....#...............%.\7...d..8...........................PA..p............`..x............................text....I.......J.................. ..`.rdata......`.......N..............@..@.data...(.... !.......!.............@....pdata........#.......#.............@..@.rsrc....<....$..>....$.............@..@.reloc..\7....%..8....%.............@..B................................................................................................................................................................................................................................

C:\Program Files\CloudCompare\zlib1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	6.427052922078226
Encrypted:	false
SSDEEP:
MD5:	977D5FD0F1CE33492336D6D48E4BEF6D
SHA1:	575C7AC6104D3E000B091F8AF343E822DBC53931
SHA-256:	41775B504663392F630CDBA675894A0A65A9C09616D5738B2DF98AEE329F0AF7
SHA-512:	11C4EA625D74D55F1926DC237436784577B8F82523A996843A0357156CCBA6D46EDA56928FF7AC82ED59BD8C131F96A1691D90B3997080B442AADA286DDA2C27
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U-.X4C.X4C.X4C...Z4C.X4B.v4C..e..[4C..e..Z4C..e..S4C..e..Z4C.Uf..T4C.Uf..Y4C.Uf..Y4C.Uf..Y4C.RichX4C.................PE..d...?tWV.........." .........p...............................................`......:.....`......................................... ...].......<....@.......0...............P..`.......................................p............................................text............................... ..`.rdata..,W.......X..................@..@.data...0.... ......................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc..`....P......................@..B........................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CloudCompare\CloudCompare.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Jan 13 06:17:36 2025, mtime=Mon Jan 13 06:17:43 2025, atime=Sun Jan 12 03:09:44 2025, length=3778688, window=hide
Category:	dropped
Size (bytes):	919
Entropy (8bit):	4.546648866222632
Encrypted:	false
SSDEEP:
MD5:	28F93DF863AF5FF169F09A289CDCDD86
SHA1:	8CBE947DB711B3B4EE88EC2DDBDC86D5A16E91D0
SHA-256:	026A4F5E09F9A19F9FCBD0EECEB068986FB961AAE39BE0C19E8614F8E9153419
SHA-512:	F94F91EFE190F1EFF3BC0C1923238851E1B5CB281E6D3CED65BB128A83FCBAB9E7AF25AED01AC2411D8FD03198F43FF8C2B72CD4C403DEEF7C29FAE2A2F12FD9
Malicious:	false
Reputation:	low
Preview:	L..................F.... ....@.8.e..k..<.e...tn.d....9..........................P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDWP`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....b.1.....-Z=:..CLOUDC~1..J......-Z3:-Z=:....=.....................,p..C.l.o.u.d.C.o.m.p.a.r.e.....n.2...9.,Z6! .CLOUDC~1.EXE..R......-Z3:-Z6:....[.........................C.l.o.u.d.C.o.m.p.a.r.e...e.x.e.......]...............-.......\...........4.......C:\Program Files\CloudCompare\CloudCompare.exe..=.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.l.o.u.d.C.o.m.p.a.r.e.\.C.l.o.u.d.C.o.m.p.a.r.e...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.l.o.u.d.C.o.m.p.a.r.e.`.......X.......305090...........hT..CrF.f4... ..X~....,.......hT..CrF.f4... ..X~....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\ProgramData\Package Cache\.unverified\cab2C04DDC374BD96EB5C8EB8208F2C7C92 (copy)

Download File

Process:	C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe
File Type:	Microsoft Cabinet archive data, many, 5691140 bytes, 14 files, at 0x44 +A "mfc140.dll_amd64" +A "mfc140chs.dll_amd64", flags 0x4, number 1, extra bytes 20 in head, 371 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	5701492
Entropy (8bit):	7.997611715541784
Encrypted:	true
SSDEEP:
MD5:	5866203168B27F18C1B47ABFA6823E02
SHA1:	3B696BE0A4CF750965D74263E43B8E302CB1B318
SHA-256:	7D48E0905EBEA9B14A07CFF687705DFDC50D795CD4C32E5ED87A0E344884B430
SHA-512:	037F793F60BE84F1DA005D47E21783E719A85B5C12C4D20050AD9D3254AC99BA8EB30B4B1378BAC69379DBC659427DC1AE4A19062ECD337D47D480D047AFB669
Malicious:	false
Reputation:	low
Preview:	MSCF......V.....D.............................V.p(..........4...s...P.U.......]Y.- .mfc140.dll_amd64.h...P.U...]Y.- .mfc140chs.dll_amd64.P.....V...]Y.- .mfc140cht.dll_amd64.h8...]W...]Y.- .mfc140deu.dll_amd64.p...p.X...]Y.- .mfc140enu.dll_amd64.h4...Y...]Y.- .mfc140esn.dll_amd64.h8..H.Z...]Y.- .mfc140fra.dll_amd64.p0....\...]Y.- .mfc140ita.dll_amd64.P... E]...]Y.- .mfc140jpn.dll_amd64.h...p+^...]Y.- .mfc140kor.dll_amd64.P(...._...]Y.- .mfc140rus.dll_amd64.PVV.(8`...]Y.- .mfc140u.dll_amd64..x..x.....]Y.- .mfcm140.dll_amd64..x........]Y.- .mfcm140u.dll_amd64.'..\|.6..CK.:{\|Se._.M[..4XD....)..........-R..V^....,..@iK...g.]........Y.....-.i+o..D.-7.G..)(w.9_nnn.......{.w.w^.y}.....Y,c,.~d......_...c,..T.#.H...#}'..4cq...J.d..,\.....2..y.3.c..X.h...$s...V.d....)?.G.e...B.y1s.<W.q.{../.^.\N..+..5s&..d;._"..rofJ;.y%.I.w.......2....E...X<..Y.M`.o..W..X....'X[...h..qxO..j....1...#..'w.$rv..I...6e.......Yg...)`.Q@.p6..M x..6......a./.X.".K.;.-.{.g.fV].. ...Xz.3l...<.1....

C:\ProgramData\Package Cache\.unverified\cab5046A8AB272BF37297BB7928664C9503 (copy)

Download File

Process:	C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe
File Type:	Microsoft Cabinet archive data, many, 982083 bytes, 12 files, at 0x44 +A "concrt140.dll_amd64" +A "msvcp140.dll_amd64", flags 0x4, number 1, extra bytes 20 in head, 75 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	992435
Entropy (8bit):	7.996227359354833
Encrypted:	true
SSDEEP:
MD5:	8C302E40FBF614896BA36A75F3F8977E
SHA1:	991AF1495F7783173D0C5691BE38FF8648F2DF12
SHA-256:	B384B812DC59C2081CEE080EA6BBA748E02ECF3C0800D8DCAF9607A20A4F3290
SHA-512:	53B1D7D8AB495931F50B5D815AFE04D52F9E0BBAFA0A5F3E4F6605B6E4F2A85C583ABF9014DEC41481439827BB6BAB23AC439D4FD7D0C3F191F21B2BF5AFB11D
Malicious:	false
Reputation:	low
Preview:	MSCF....C.......D...........................C...p(..............K...P.........]Y.- .concrt140.dll_amd64.h...P.....]Y.- .msvcp140.dll_amd64.h.........]Y.- .msvcp140_1.dll_amd64.h... A....]Y.- .msvcp140_2.dll_amd64.P....W....]Y.- .msvcp140_atomic_wait.dll_amd64.P\|........]Y.- .msvcp140_codecvt_ids.dll_amd64.P<..(.....]Y.- .vcamp140.dll_amd64.P^..x.....]Y.- .vccorlib140.dll_amd64.h....2....]Y.- .vcomp140.dll_amd64.p...0!"...]Y.- .vcruntime140.dll_amd64.P.....#...]Y.- .vcruntime140_1.dll_amd64.h....$...]Y.- .vcruntime140_threads.dll_amd64...r.:3..CK.[}\Te..3..HcI.n.kT,.hY...A ...L-JML.5%......N.Y...~YXV.m..V.X...(o...R.u.[I..B/..<.sg.......7.f..s...s.9.y..>.^...A._.K....1.].Z.....}..j..kRj.N.7?..d..%3.6..h.b...9.%9.L.....&..^<{Nt.>...G.7.7...\|...8o<l.Wm.....V...k..u.X..B.Ayf...i.6$.B.7..VO...?k..U0.'........W..c..&m.{.:. 4h.9c....n.=..p.6....O....1z.cf.B.l..... .w......x.Nh......=...tBz:l.:!.......:...A.Y.:..bt........l...u..o....%.gZg.B%.P..x.6j.e._4.&l..?(........b...

C:\ProgramData\Package Cache\.unverified\vcRuntimeAdditional_x64 (copy)

Download File

Process:	C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2022 X64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2022 X64 Additional Runtime - 14.42.34433., Template: x64;1033, Revision Number: {E04E511C-7D1F-4263-AB6A-F816392FD4D7}, Create Time/Date: Tue Oct 29 06:55:02 2024, Last Saved Time/Date: Tue Oct 29 06:55:02 2024, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.372377887079137
Encrypted:	false
SSDEEP:
MD5:	351D8E8C804F6C6AAB4C718977B1817D
SHA1:	1B680E5E2ED548E5636F9D656C49C87CF9A70DA8
SHA-256:	CF584E5132EF3766A088F824BD038494713A7168CDDDD44E3F8C4AD581E2206E
SHA-512:	D0613C6B1A72C73013C0519619C557811A1D20FCDDC8361D391A31FC4AA9C70173B907957BABB049067111427A81E48A82E5467A15DAE8BEBB55B048993C93A4
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\.unverified\vcRuntimeMinimum_x64 (copy)

Download File

Process:	C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2022 X64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.42.34433., Template: x64;1033, Revision Number: {A75B920C-55CD-4531-932F-CB4C539C41F8}, Create Time/Date: Tue Oct 29 06:50:14 2024, Last Saved Time/Date: Tue Oct 29 06:50:14 2024, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.367262947705725
Encrypted:	false
SSDEEP:
MD5:	09042BA0AF85F4873A68326AB0E704AF
SHA1:	F08C8F9CB63F89A88F5915E6A889B170CE98F515
SHA-256:	47CCEB26DD7B78F0D3D09FDDC419290907FE818979884B2192C834034180E83B
SHA-512:	1C9552A8BF478F9EDDE8ED67A8F40584A757C66AAF297609B4F577283469287992C1F84EBE15DF4DF05B0135E4D67C958A912738F4814440F6FD77804A2CFA7D
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\state.rsm

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	2.5636834423859614
Encrypted:	false
SSDEEP:
MD5:	D340D6DE6BDE261AC065DF85F67F4E09
SHA1:	61532764D05D26F7C85C3BE3152CD0E3616099CE
SHA-256:	5ACA688CFB9C6D1D7910EEA03C9431634104CE1C67FBB4D1DC35C902E97C1136
SHA-512:	8CB49C03441BE64D84A7B90F5568CEB6E6728C10184BD868FBEE3E2E27FD18B2B768E72F3AC79D5D88AC9484B88A068BFE7CB9BF5CD03C529DCAAAEEF7ED37F1
Malicious:	false
Reputation:	low
Preview:	B.......................................................................................................................................................................................................................W.i.x.B.u.n.d.l.e.F.o.r.c.e.d.R.e.s.t.a.r.t.P.a.c.k.a.g.e.................W.i.x.B.u.n.d.l.e.L.a.s.t.U.s.e.d.S.o.u.r.c.e.............................W.i.x.B.u.n.d.l.e.N.a.m.e.....<...M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.3. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e. .(.x.6.4.). .-. .1.2...0...4.0.6.6.4.........W.i.x.B.u.n.d.l.e.O.r.i.g.i.n.a.l.S.o.u.r.c.e.....D...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.i.s.-.U.Q.9.E.2...t.m.p.\.v.c.r.e.d.i.s.t._.2.0.1.3._.x.6.4...e.x.e.........................

C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	465992
Entropy (8bit):	6.923996733031688
Encrypted:	false
SSDEEP:
MD5:	3284088A2D414D65E865004FDB641936
SHA1:	7F3E9180D9025FC14C8A7868B763B0C3E7A900B4
SHA-256:	102F69B5A98352A6A1A6B26BC2C86EE7611C1F45F5A9CA04F5A8841961F191C6
SHA-512:	6786FB431ADDF05DF256D0E1383501F96356AA78F66482DB9772C58334AEAD59838ABB7DB0EA793D4A17627A357598266681C28328485489A21BC2985E751B62
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........-.}}~.}}~.}}~...~.}}~...~.}}~...~.}}~...~.}}~.}\|~.\|}~...~.}}~...~.}}~.}.~.}}~...~.}}~Rich.}}~........PE..L...B.JT.....................6....................@..........................P......V>....@..................................5..@........9..............x>.......3.. ...............................X...@............................................text...$........................... ..`.rdata..L...........................@..@.data....0...`.......:..............@....wixburn8............J..............@..@.tls.................L..............@....rsrc....9.......:...N..............@..@.reloc..rD.......F..................@..B................................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\{382F1166-A409-4C5B-9B1E-85ED538B8291}v14.42.34433\packages\vcRuntimeMinimum_amd64\cab1.cab (copy)

Download File

Process:	C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe
File Type:	Microsoft Cabinet archive data, many, 982083 bytes, 12 files, at 0x44 +A "concrt140.dll_amd64" +A "msvcp140.dll_amd64", flags 0x4, number 1, extra bytes 20 in head, 75 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	992435
Entropy (8bit):	7.996227359354833
Encrypted:	true
SSDEEP:
MD5:	8C302E40FBF614896BA36A75F3F8977E
SHA1:	991AF1495F7783173D0C5691BE38FF8648F2DF12
SHA-256:	B384B812DC59C2081CEE080EA6BBA748E02ECF3C0800D8DCAF9607A20A4F3290
SHA-512:	53B1D7D8AB495931F50B5D815AFE04D52F9E0BBAFA0A5F3E4F6605B6E4F2A85C583ABF9014DEC41481439827BB6BAB23AC439D4FD7D0C3F191F21B2BF5AFB11D
Malicious:	false
Reputation:	low
Preview:	MSCF....C.......D...........................C...p(..............K...P.........]Y.- .concrt140.dll_amd64.h...P.....]Y.- .msvcp140.dll_amd64.h.........]Y.- .msvcp140_1.dll_amd64.h... A....]Y.- .msvcp140_2.dll_amd64.P....W....]Y.- .msvcp140_atomic_wait.dll_amd64.P\|........]Y.- .msvcp140_codecvt_ids.dll_amd64.P<..(.....]Y.- .vcamp140.dll_amd64.P^..x.....]Y.- .vccorlib140.dll_amd64.h....2....]Y.- .vcomp140.dll_amd64.p...0!"...]Y.- .vcruntime140.dll_amd64.P.....#...]Y.- .vcruntime140_1.dll_amd64.h....$...]Y.- .vcruntime140_threads.dll_amd64...r.:3..CK.[}\Te..3..HcI.n.kT,.hY...A ...L-JML.5%......N.Y...~YXV.m..V.X...(o...R.u.[I..B/..<.sg.......7.f..s...s.9.y..>.^...A._.K....1.].Z.....}..j..kRj.N.7?..d..%3.6..h.b...9.%9.L.....&..^<{Nt.>...G.7.7...\|...8o<l.Wm.....V...k..u.X..B.Ayf...i.6$.B.7..VO...?k..U0.'........W..c..&m.{.:. 4h.9c....n.=..p.6....O....1z.cf.B.l..... .w......x.Nh......=...tBz:l.:!.......:...A.Y.:..bt........l...u..o....%.gZg.B%.P..x.6j.e._4.&l..?(........b...

C:\ProgramData\Package Cache\{382F1166-A409-4C5B-9B1E-85ED538B8291}v14.42.34433\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi (copy)

Download File

Process:	C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2022 X64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.42.34433., Template: x64;1033, Revision Number: {A75B920C-55CD-4531-932F-CB4C539C41F8}, Create Time/Date: Tue Oct 29 06:50:14 2024, Last Saved Time/Date: Tue Oct 29 06:50:14 2024, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.367262947705725
Encrypted:	false
SSDEEP:
MD5:	09042BA0AF85F4873A68326AB0E704AF
SHA1:	F08C8F9CB63F89A88F5915E6A889B170CE98F515
SHA-256:	47CCEB26DD7B78F0D3D09FDDC419290907FE818979884B2192C834034180E83B
SHA-512:	1C9552A8BF478F9EDDE8ED67A8F40584A757C66AAF297609B4F577283469287992C1F84EBE15DF4DF05B0135E4D67C958A912738F4814440F6FD77804A2CFA7D
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe

Download File

Process:	C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	686136
Entropy (8bit):	7.251009602832873
Encrypted:	false
SSDEEP:
MD5:	3F32F1A9BD60AE065B89C2223676592E
SHA1:	9D386D394DB87F1EE41252CAC863C80F1C8D6B8B
SHA-256:	270FA05033B8B9455BD0D38924B1F1F3E4D3E32565DA263209D1F9698EFFBC05
SHA-512:	BDDFEAB33A03B0F37CFF9008815E2900CC96BDDAF763007E5F7FDFFD80E56719B81341029431BD9D25C8E74123C1D9CDA0F2AEFAFDC4937095D595093DB823DF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]aN.<...<...<...L...<...L..j<...T...<...T...<...T...<...L...<...L...<...L...<...<...=..PU...<..PU...<...<...<..PU...<..Rich.<..........................PE..L......e..........................................@..................................(....@............................................T;...........O...(...P...>.....T...................4........F..@...................T........................text...>........................... ..`.rdata..&...........................@..@.data...<...........................@....wixburn8...........................@..@.rsrc...T;.......<..................@..@.reloc...>...P...@..................@..B........................................................................................................................................................................................................................................

C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\state.rsm

Download File

Process:	C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	2.63392031327379
Encrypted:	false
SSDEEP:
MD5:	273573392D437967876C9DEB7ED959DD
SHA1:	5F72D8B877F95A3CF24D5528DB1A035577ADE77F
SHA-256:	F3013634DF06FB39DB102BE2A4D6B7FE9FDD8C04557F5E268DE523A74E841027
SHA-512:	E43FCE6FB997797D34E6826FB27130F40E94C5A7ABBF6D1EE10F22DFA00680C7EEFD04AC9B02BE1393101B08235568371D04F5A426692CCB84995AF1B025DD38
Malicious:	false
Reputation:	low
Preview:	O...............................................................................................................................................................................................................................................................W.i.x.B.u.n.d.l.e.F.o.r.c.e.d.R.e.s.t.a.r.t.P.a.c.k.a.g.e.....................W.i.x.B.u.n.d.l.e.L.a.s.t.U.s.e.d.S.o.u.r.c.e.................................W.i.x.B.u.n.d.l.e.N.a.m.e.....B...M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.5.-.2.0.2.2. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e. .(.x.6.4.). .-. .1.4...4.2...3.4.4.3.3.............W.i.x.B.u.n.d.l.e.O.r.i.g.i.n.a.l.S.o.u.r.c.e.....@...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.i.s.-.U.Q.9.E.2...t.m.p.\.V.C._.r.e.d.i.s.t...x.6.4...e.x.e.............W.i.x.B.u.n.d.l.e.O.r.i.g.i.n.a.l.S.o.u.r.c.e.F.o.l.d.e.r...../...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.i.s.-.U.Q.9.E.2...t.m.p.\.....................................

C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\state.rsm

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	2.5622574762223893
Encrypted:	false
SSDEEP:
MD5:	9BA32203A21BB0583763AB40DA877C09
SHA1:	A339764C730E0E6E107F06CE6CA9FFC79B48E72B
SHA-256:	D52C12100BD9F419ECC7D49DD8B7203682F6F96AF23B5D049D18804439FA86DB
SHA-512:	D59969326B6CA7F6372C1145605CEE03FDAA5FEE71D6D0AF9DDDD07E92A107FB9A1E0EF94A5D7F5FA929FF6D37C94E9B64FDF5BA08E1C8C03D71E6F604FA7034
Malicious:	false
Reputation:	low
Preview:	G...................................................................................................................................................................................................................................................W.i.x.B.u.n.d.l.e.F.o.r.c.e.d.R.e.s.t.a.r.t.P.a.c.k.a.g.e.....................W.i.x.B.u.n.d.l.e.L.a.s.t.U.s.e.d.S.o.u.r.c.e.........................W.i.x.B.u.n.d.l.e.N.a.m.e.....B...M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.5.-.2.0.2.2. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e. .(.x.6.4.). .-. .1.4...3.6...3.2.5.3.2.............W.i.x.B.u.n.d.l.e.O.r.i.g.i.n.a.l.S.o.u.r.c.e.....*...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.D.o.w.n.l.o.a.d.s.\.V.C._.r.e.d.i.s.t...x.6.4...e.x.e.............W.i.x.B.u.n.d.l.e.O.r.i.g.i.n.a.l.S.o.u.r.c.e.F.o.l.d.e.r.........C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.D.o.w.n.l.o.a.d.s.\.........................

C:\ProgramData\Package Cache\{E1902FC6-C423-4719-AB8A-AC7B2694B367}v14.42.34433\packages\vcRuntimeAdditional_amd64\cab1.cab (copy)

Download File

Process:	C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe
File Type:	Microsoft Cabinet archive data, many, 5691140 bytes, 14 files, at 0x44 +A "mfc140.dll_amd64" +A "mfc140chs.dll_amd64", flags 0x4, number 1, extra bytes 20 in head, 371 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	5701492
Entropy (8bit):	7.997611715541784
Encrypted:	true
SSDEEP:
MD5:	5866203168B27F18C1B47ABFA6823E02
SHA1:	3B696BE0A4CF750965D74263E43B8E302CB1B318
SHA-256:	7D48E0905EBEA9B14A07CFF687705DFDC50D795CD4C32E5ED87A0E344884B430
SHA-512:	037F793F60BE84F1DA005D47E21783E719A85B5C12C4D20050AD9D3254AC99BA8EB30B4B1378BAC69379DBC659427DC1AE4A19062ECD337D47D480D047AFB669
Malicious:	false
Reputation:	low
Preview:	MSCF......V.....D.............................V.p(..........4...s...P.U.......]Y.- .mfc140.dll_amd64.h...P.U...]Y.- .mfc140chs.dll_amd64.P.....V...]Y.- .mfc140cht.dll_amd64.h8...]W...]Y.- .mfc140deu.dll_amd64.p...p.X...]Y.- .mfc140enu.dll_amd64.h4...Y...]Y.- .mfc140esn.dll_amd64.h8..H.Z...]Y.- .mfc140fra.dll_amd64.p0....\...]Y.- .mfc140ita.dll_amd64.P... E]...]Y.- .mfc140jpn.dll_amd64.h...p+^...]Y.- .mfc140kor.dll_amd64.P(...._...]Y.- .mfc140rus.dll_amd64.PVV.(8`...]Y.- .mfc140u.dll_amd64..x..x.....]Y.- .mfcm140.dll_amd64..x........]Y.- .mfcm140u.dll_amd64.'..\|.6..CK.:{\|Se._.M[..4XD....)..........-R..V^....,..@iK...g.]........Y.....-.i+o..D.-7.G..)(w.9_nnn.......{.w.w^.y}.....Y,c,.~d......_...c,..T.#.H...#}'..4cq...J.d..,\.....2..y.3.c..X.h...$s...V.d....)?.G.e...B.y1s.<W.q.{../.^.\N..+..5s&..d;._"..rofJ;.y%.I.w.......2....E...X<..Y.M`.o..W..X....'X[...h..qxO..j....1...#..'w.$rv..I...6e.......Yg...)`.Q@.p6..M x..6......a./.X.".K.;.-.{.g.fV].. ...Xz.3l...<.1....

C:\ProgramData\Package Cache\{E1902FC6-C423-4719-AB8A-AC7B2694B367}v14.42.34433\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi (copy)

Download File

Process:	C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2022 X64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2022 X64 Additional Runtime - 14.42.34433., Template: x64;1033, Revision Number: {E04E511C-7D1F-4263-AB6A-F816392FD4D7}, Create Time/Date: Tue Oct 29 06:55:02 2024, Last Saved Time/Date: Tue Oct 29 06:55:02 2024, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.372377887079137
Encrypted:	false
SSDEEP:
MD5:	351D8E8C804F6C6AAB4C718977B1817D
SHA1:	1B680E5E2ED548E5636F9D656C49C87CF9A70DA8
SHA-256:	CF584E5132EF3766A088F824BD038494713A7168CDDDD44E3F8C4AD581E2206E
SHA-512:	D0613C6B1A72C73013C0519619C557811A1D20FCDDC8361D391A31FC4AA9C70173B907957BABB049067111427A81E48A82E5467A15DAE8BEBB55B048993C93A4
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Desktop\CloudCompare.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Jan 13 06:17:36 2025, mtime=Mon Jan 13 06:17:58 2025, atime=Sun Jan 12 03:09:44 2025, length=3778688, window=hide
Category:	dropped
Size (bytes):	901
Entropy (8bit):	4.543451941393807
Encrypted:	false
SSDEEP:
MD5:	19029D702C1915DE42ABAACF43AA5B69
SHA1:	6FB5306239A5E930B00CEAA17899AB6C019075A7
SHA-256:	792E57F584234E97F79C1EFE61DCE143AEE610A0F365D8B25616B58E1823B6EA
SHA-512:	17F7F87EF05A834AB971CBA6DC2B82A0F9BD0FCC255ED82616BD284F70909B956B99FB8EF7FC7E9C17C2BC400627F3625DF2801FB8F1C279660EFAF452786C15
Malicious:	false
Reputation:	low
Preview:	L..................F.... ....@.8.e..RE.E.e...tn.d....9..........................P.O. .:i.....+00.../C:\.....................1.....-Z3:..PROGRA~1..t......O.I-Z@:....B...............J.....w"..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....b.1.....-Z=:..CLOUDC~1..J......-Z3:-Z@:....=.........................C.l.o.u.d.C.o.m.p.a.r.e.....n.2...9.,Z6! .CLOUDC~1.EXE..R......-Z3:-Z6:....[.........................C.l.o.u.d.C.o.m.p.a.r.e...e.x.e.......]...............-.......\...........4.......C:\Program Files\CloudCompare\CloudCompare.exe..4.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.l.o.u.d.C.o.m.p.a.r.e.\.C.l.o.u.d.C.o.m.p.a.r.e...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.l.o.u.d.C.o.m.p.a.r.e.`.......X.......305090...........hT..CrF.f4... ..X~....,.......hT..CrF.f4... ..X~....,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20250113021759.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe
File Type:	ASCII text, with very long lines (323), with CRLF line terminators
Category:	dropped
Size (bytes):	9208
Entropy (8bit):	5.557740714596229
Encrypted:	false
SSDEEP:
MD5:	625FDCAFEF9192D0B353ACCFD442F915
SHA1:	C9A3E14395C4BED2F7542CFB182B2CF6BDFCD8B7
SHA-256:	07686FF77FD3045B8480E31714802618D593D478D9BA96E9621F2E1201314C40
SHA-512:	5F1C8BA36532A3FF0C9D4D9369FC114F9020EF3FFAD295F8B2283C4A804E6FA31D0BE11671AC23AF9E471578149F495F7903678A0E87E691A914E5A8D54AA548
Malicious:	false
Reputation:	low
Preview:	[17E8:03FC][2025-01-13T02:17:58]i001: Burn v3.7.3424.0, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe, cmdline: '/install /quiet /norestart -burn.unelevated BurnPipe.{1EB8EC4C-F5D1-4ECA-9DD0-7714AF65556E} {84117F68-D40E-4241-8A1A-B0F8298D254D} 4264'..[17E8:03FC][2025-01-13T02:17:59]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20250113021759.log'..[17E8:03FC][2025-01-13T02:17:59]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe'..[17E8:03FC][2025-01-13T02:17:59]i000: Setting string variable 'WixBundleOriginalSourceFolder' to value 'C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\'..[17E8:03FC][2025-01-13T02:17:59]i000: Setting string variable 'WixBundleName' to value 'Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40664'..[17E8:03FC][2025-01-13T02:17:59]i100: Det

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20250113021759_000_vcRuntimeMinimum_x64.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (588), with CRLF line terminators
Category:	dropped
Size (bytes):	180596
Entropy (8bit):	3.7819024639269903
Encrypted:	false
SSDEEP:
MD5:	F25F626AEEE05F195E3816990FF8E10F
SHA1:	7DDE3554000386AAD7AD7CDFB16A9DC967347088
SHA-256:	81BDEEC4BA21EF444EACBBF0F04FA0BCC91AEF0D4331E5CB814F455FFD305240
SHA-512:	F3724BA2F70120309E93DFD9CA5EC87A543A067B45C14D875B6B4417E9125FA42033D4B07ABAB80042D8060967CC2A9FE12B662F63AEE6D545A82343F95AE5DB
Malicious:	false
Reputation:	low
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .1.3./.0.1./.2.0.2.5. . .0.2.:.1.8.:.1.5. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.i.s.-.U.Q.9.E.2...t.m.p.\.v.c.r.e.d.i.s.t._.2.0.1.3._.x.6.4...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.A.8.:.1.C.). .[.0.2.:.1.8.:.1.5.:.8.8.5.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.A.8.:.1.C.). .[.0.2.:.1.8.:.1.5.:.8.8.5.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.A.8.:.1.C.). .[.0.2.:.1.8.:.1.5.:.8.8.5.].:. ........ .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . ........ .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.5.3.C.F.6.9.3.4.-.A.9.8.D.-.3.D.8.4.-.9.1.4.6.-.F.C.4.E.D.F.3.D.5.6.4.1.}.v.1.2...0...4.0.6.6.4.\.p.a.c.k.a.g.e.s.\.v.c.R.u.n.t.i.m.e.M.i.n.i.m.u.m._.a.

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20250113021759_001_vcRuntimeAdditional_x64.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (588), with CRLF line terminators
Category:	dropped
Size (bytes):	203430
Entropy (8bit):	3.79665890543916
Encrypted:	false
SSDEEP:
MD5:	ACD592CE9F583F2DA75E00A149EC4FFC
SHA1:	1549F6544BF5E4D080147E9873E135876908A21A
SHA-256:	7B78108BD1E27E0E6B11549B43BAFD10FC8492A3197222D612F61CC81B07D0D3
SHA-512:	DAF32A2692221885311FD769564F93EFC1D060E17622ECF9080437A1A4FA67DB8E1A0C8B54BF3533697E17C9CB1B6187E34EA361AF6CD9EFDFE1EB70E905C98F
Malicious:	false
Reputation:	low
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .1.3./.0.1./.2.0.2.5. . .0.2.:.1.8.:.1.8. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.i.s.-.U.Q.9.E.2...t.m.p.\.v.c.r.e.d.i.s.t._.2.0.1.3._.x.6.4...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.A.8.:.C.C.). .[.0.2.:.1.8.:.1.8.:.2.2.9.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.A.8.:.C.C.). .[.0.2.:.1.8.:.1.8.:.2.2.9.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.A.8.:.C.C.). .[.0.2.:.1.8.:.1.8.:.2.2.9.].:. ........ .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . ........ .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.0.1.0.7.9.2.B.A.-.5.5.1.A.-.3.A.C.0.-.A.7.E.F.-.0.F.A.B.4.1.5.6.C.3.8.2.}.v.1.2...0...4.0.6.6.4.\.p.a.c.k.a.g.e.s.\.v.c.R.u.n.t.i.m.e.A.d.d.i.t.i.o.n.a.

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20250113021822.log

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	ASCII text, with very long lines (438), with CRLF line terminators
Category:	modified
Size (bytes):	18997
Entropy (8bit):	5.506319070239555
Encrypted:	false
SSDEEP:
MD5:	3B39E211AD9D7E70281225BC12DA70B4
SHA1:	FD423C4E9AAF3BF9616439861F0B9BD44F074AEF
SHA-256:	08FC11C868E620D7B1FCFF0FEE8314694D5593C592E6A013A11D5249FE021E04
SHA-512:	BB688A24BC68BBED0751204B1FB256987790DDC84F87446F6F767783818760E48716C6C90729794225D5D1DF2CB8B4DC2855DA0514813CC25BE9160D9CFA5FB5
Malicious:	false
Reputation:	low
Preview:	[09BC:1520][2025-01-13T02:18:21]i001: Burn v3.14.1.8722, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe..[09BC:1520][2025-01-13T02:18:21]i009: Command Line: '-burn.clean.room=C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe -burn.filehandle.attached=680 -burn.filehandle.self=684 /install /quiet /norestart'..[09BC:1520][2025-01-13T02:18:21]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe'..[09BC:1520][2025-01-13T02:18:21]i000: Setting string variable 'WixBundleOriginalSourceFolder' to value 'C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\'..[09BC:1520][2025-01-13T02:18:22]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20250113021822.log'..[09BC:1520][2025-01-13T02:18:22]i000: Setting string variable 'WixBundleName' to value 'Microsoft Visual C++ 2015-2

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20250113021822_000_vcRuntimeMinimum_x64.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (319), with CRLF line terminators
Category:	dropped
Size (bytes):	255442
Entropy (8bit):	3.8265347219628634
Encrypted:	false
SSDEEP:
MD5:	17493826D5839C90B939FAC67E814775
SHA1:	4ABEE4BD5FA85FA531AAC6CAB4D477CBADB0A2F1
SHA-256:	387A030A0E537971358858E0DC2E79E7D7739E17E5B4DDD0135DC56538B5530C
SHA-512:	DAC47DA226161B9A8DCAEEF1D63DE03A5EE7AC6D6DE3694BFCD0811159D10FF20F88D7CD5DCB6EA7B2767F4BC553FFFF0C40B3F05D7B8D351BD5F674C8E0E319
Malicious:	false
Reputation:	low
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .1.3./.0.1./.2.0.2.5. . .0.2.:.1.8.:.3.6. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.{.C.E.3.C.8.B.2.F.-.D.D.8.D.-.4.3.8.E.-.8.C.6.B.-.7.3.7.A.6.4.F.8.7.B.6.D.}.\...b.e.\.V.C._.r.e.d.i.s.t...x.6.4...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.9.8.:.E.4.). .[.0.2.:.1.8.:.3.6.:.1.5.9.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.9.8.:.E.4.). .[.0.2.:.1.8.:.3.6.:.1.5.9.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.9.8.:.E.4.). .[.0.2.:.1.8.:.3.6.:.1.5.9.].:. ........ .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . ........ .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.3.8.2.F.1.1.6.6.-.A.4.0.9.-.4.C.5.B.-.9.B.1.E.-.8.5.E.D.5.3.8.B.8.2.9.1.}.v.1.4...4.2...3.4.4.3.3.\.p.a.c.k.a.g.e.s.\.v.c.R.u.n.t.i.m.e.

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20250113021822_001_vcRuntimeAdditional_x64.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (319), with CRLF line terminators
Category:	dropped
Size (bytes):	246938
Entropy (8bit):	3.818531909764429
Encrypted:	false
SSDEEP:
MD5:	940545AFE556CB7D8C90339205377E22
SHA1:	58C2C26DE087F78D97B243E7F391AC11A979DF48
SHA-256:	22A29F5CB9B2A29F0883E1F78310F523A913A7AF1DA696EC182D574109EF4A84
SHA-512:	38A710F293701E5B1B4D060790E4B7FFBCC0B4558B561DD1AFC1D054C9EE47EB550605ADE75952775B0DF958E21AC40054CEE83F654818358F4FFAE625B98F90
Malicious:	false
Reputation:	low
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .1.3./.0.1./.2.0.2.5. . .0.2.:.1.8.:.3.8. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.{.C.E.3.C.8.B.2.F.-.D.D.8.D.-.4.3.8.E.-.8.C.6.B.-.7.3.7.A.6.4.F.8.7.B.6.D.}.\...b.e.\.V.C._.r.e.d.i.s.t...x.6.4...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.9.8.:.9.4.). .[.0.2.:.1.8.:.3.8.:.2.3.7.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.9.8.:.9.4.). .[.0.2.:.1.8.:.3.8.:.2.3.7.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.9.8.:.9.4.). .[.0.2.:.1.8.:.3.8.:.2.3.7.].:. ........ .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . ........ .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.E.1.9.0.2.F.C.6.-.C.4.2.3.-.4.7.1.9.-.A.B.8.A.-.A.C.7.B.2.6.9.4.B.3.6.7.}.v.1.4...4.2...3.4.4.3.3.\.p.a.c.k.a.g.e.s.\.v.c.R.u.n.t.i.m.e.

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20250113021824.log

Download File

Process:	C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	865
Entropy (8bit):	5.392318416741841
Encrypted:	false
SSDEEP:
MD5:	E4F587F4596AE95FE2BDC41559B04933
SHA1:	A0900C29532460FD1CF53962C475EA4B86195F4B
SHA-256:	25134649FA802B3F6397BD9FE91E2B6006BC835960F44DC7112F5345E9BF9446
SHA-512:	5702D535714C3F9DF0D1E3EC5B12B9F3C57CBEFC4020A361EBD75AC8B5A3D35C02F07E526D754800BBFAE44D86767F6DDFC7856A105B9DBDE14DEDFC06950D70
Malicious:	false
Reputation:	low
Preview:	[17BC:15B8][2025-01-13T02:18:24]i001: Burn v3.7.3424.0, Windows v10.0 (Build 19045: Service Pack 0), path: C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe, cmdline: ''..[17BC:15B8][2025-01-13T02:18:24]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20250113021824.log'..[17BC:15B8][2025-01-13T02:18:24]i100: Detect begin, 2 packages..[17BC:15B8][2025-01-13T02:18:24]i101: Detected package: vcRuntimeMinimum_x64, state: Present, cached: Complete..[17BC:15B8][2025-01-13T02:18:24]i101: Detected package: vcRuntimeAdditional_x64, state: Present, cached: Complete..[17BC:15B8][2025-01-13T02:18:24]i052: Condition 'VersionNT64 >= v6.0 OR (VersionNT64 = v5.2 AND ServicePackLevel >= 1)' evaluates to true...[17BC:15B8][2025-01-13T02:18:24]i199: Detect complete, result: 0x0..

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20250113021842.log

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	ASCII text, with very long lines (443), with CRLF line terminators
Category:	dropped
Size (bytes):	13161
Entropy (8bit):	5.449150760256776
Encrypted:	false
SSDEEP:
MD5:	E52FC8661A0925468685FBE086E29F7E
SHA1:	DBE3ACA8D1BA7696F35EC895C9B78ADE5CCFFDD2
SHA-256:	3CE997B8E5CBD84F59D9A2A71A9B743A4C3776604520B7FDE4F42351F09FF415
SHA-512:	CCC736F114C74DD9C0D84473CADECCA998A950E3E3F8A03B50CE2D47704E54937CF7C923F129B24AA06F081C4EF9F050F78848ADB2B8AC5B8F10FFC0BF30DC13
Malicious:	false
Reputation:	low
Preview:	[10B8:14EC][2025-01-13T02:18:41]i001: Burn v3.10.4.4718, Windows v10.0 (Build 19045: Service Pack 0), path: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe..[10B8:14EC][2025-01-13T02:18:41]i003: This bundle is being run by a related bundle as type 'Upgrade'...[10B8:14EC][2025-01-13T02:18:41]i009: Command Line: '"-burn.clean.room=C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.filehandle.attached=508 -burn.filehandle.self=520 -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{3CE290E6-406D-4F39-9839-02C576C54025} {EA2D85BC-101D-4701-8D4D-A4BF8B19AB71} 6552'..[10B8:14EC][2025-01-13T02:18:42]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20250113021842.log'..[10B8:14EC][2025-01-13T02:18:42]i000: Setting string variable 'WixBundleManufacturer' to value 'M

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20250113021849.log

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3982
Entropy (8bit):	5.430069489601231
Encrypted:	false
SSDEEP:
MD5:	94141BDC13A2CF35594BC45C4F2BD577
SHA1:	8FAD085184574958DE6C1B9DD2054A8AD68A65B7
SHA-256:	A2E42B24597FF9815BA111355E75C8D7572BA750F68BFCCD9414D35CA938CA74
SHA-512:	60CFC9981460359F08D8354496F186D417AC68582DFD43C562DF835110DF518D2EAC7E9819DB2C905A00E63EBD883055EE7714E8B3CD6D87A751D045F805EA48
Malicious:	false
Reputation:	low
Preview:	[1350:03B0][2025-01-13T02:18:48]i001: Burn v3.14.1.8722, Windows v10.0 (Build 19045: Service Pack 0), path: C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe..[1350:03B0][2025-01-13T02:18:48]i009: Command Line: '"-burn.clean.room=C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548'..[1350:03B0][2025-01-13T02:18:49]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20250113021849.log'..[1350:03B0][2025-01-13T02:18:49]i000: Setting string variable 'WixBundleManufacturer' to value 'Microsoft Corporation'..[1350:04F8][2025-01-13T02:18:49]i000: Setting version variable 'WixBundleFileVersion' to value '14.42.34433.0'..[1350:03B0][2025-01-13T02:18:49]i100: Detect begin, 11 packages..[1350:03B0][2025-01-13T02:18:49]i000: Setting string variable 'Arm64_Check' to value 'AMD64'..[1350:03B0][2025-01-13T02:18:49]i000:

C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp

Download File

Process:	C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3024000
Entropy (8bit):	6.401341683892991
Encrypted:	false
SSDEEP:
MD5:	CA9D0BC1FC3C0AEBE22047A2DCBCD715
SHA1:	8DF8054C0F3A9969493D74001AE6C6815090BB48
SHA-256:	69FEBFE8BB5D272CE0A488B1C4C7BF2C3CEAD22410F7E907681635DDD910EF42
SHA-512:	75D8B8811B736C6AF7802194508979209E34B6357662902456687E83FE348DE422B37A96A52B336448B9EE22F1B43D7C7B7266F67D9000B663F24CFE989F81AE
Malicious:	false
Reputation:	low
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...p.._.................$,.........P6,......@,...@.......................................@......@....................-......`-.49....-...............-..&....................................-......................i-.......-......................text...P.+.......+................. ..`.itext..t(....,..*....+............. ..`.data.......@,......(,.............@....bss.....x....,..........................idata..49...`-..:....,.............@....didata.......-.......,.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-.......-.............@..@.rsrc.........-.......-.............@..@......................-.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25640112
Entropy (8bit):	7.996901368935702
Encrypted:	true
SSDEEP:
MD5:	223A76CD5AB9E42A5C55731154B85627
SHA1:	38B647D37B42378222856972A1E22FBD8CF4B404
SHA-256:	1821577409C35B2B9505AC833E246376CC68A8262972100444010B57226F0940
SHA-512:	20E2D7437367CB262CE45184EB4D809249FE654AA450D226E376D4057C00B58ECFD8834A8B5153EB148960FFC845BED1F0943D5FF9A6FC1355B1503138562D8D
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]aN.<...<...<...L...<...L..j<...T...<...T...<...T...<...L...<...L...<...L...<...<...=..PU...<..PU...<...<...<..PU...<..Rich.<..........................PE..L......e..........................................@.................................v....@............................................T;...............(...P...>.....T...................4........F..@...................T........................text...>........................... ..`.rdata..&...........................@..@.data...<...........................@....wixburn8...........................@..@.rsrc...T;.......<..................@..@.reloc...>...P...@..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\is-E4N2C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7200744
Entropy (8bit):	7.988821702604525
Encrypted:	false
SSDEEP:
MD5:	49B1164F8E95EC6409EA83CDB352D8DA
SHA1:	1194E6BF4153FA88F20B2A70AC15BC359ADA4EE2
SHA-256:	A4BBA7701E355AE29C403431F871A537897C363E215CAFE706615E270984F17C
SHA-512:	29B65E45CE5233F5AD480673752529026F59A760466A1026BB92FC78D1CCC82396ECB8F07B0E49C9B2315DBEF976CB417273C77F4209475036775FE687DD2D60
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........-.}}~.}}~.}}~...~.}}~...~.}}~...~.}}~...~.}}~.}\|~.\|}~...~.}}~...~.}}~.}.~.}}~...~.}}~Rich.}}~........PE..L...B.JT.....................6....................@..........................P........n...@..................................5..@........9..........p.m.x>.......3.. ...............................X...@............................................text...$........................... ..`.rdata..L...........................@..@.data....0...`.......:..............@....wixburn8............J..............@..@.tls.................L..............@....rsrc....9.......:...N..............@..@.reloc..rD.......F..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\is-F2TE4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25640112
Entropy (8bit):	7.996901368935702
Encrypted:	true
SSDEEP:
MD5:	223A76CD5AB9E42A5C55731154B85627
SHA1:	38B647D37B42378222856972A1E22FBD8CF4B404
SHA-256:	1821577409C35B2B9505AC833E246376CC68A8262972100444010B57226F0940
SHA-512:	20E2D7437367CB262CE45184EB4D809249FE654AA450D226E376D4057C00B58ECFD8834A8B5153EB148960FFC845BED1F0943D5FF9A6FC1355B1503138562D8D
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]aN.<...<...<...L...<...L..j<...T...<...T...<...T...<...L...<...L...<...L...<...<...=..PU...<..PU...<...<...<..PU...<..Rich.<..........................PE..L......e..........................................@.................................v....@............................................T;...............(...P...>.....T...................4........F..@...................T........................text...>........................... ..`.rdata..&...........................@..@.data...<...........................@....wixburn8...........................@..@.rsrc...T;.......<..................@..@.reloc...>...P...@..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7200744
Entropy (8bit):	7.988821702604525
Encrypted:	false
SSDEEP:
MD5:	49B1164F8E95EC6409EA83CDB352D8DA
SHA1:	1194E6BF4153FA88F20B2A70AC15BC359ADA4EE2
SHA-256:	A4BBA7701E355AE29C403431F871A537897C363E215CAFE706615E270984F17C
SHA-512:	29B65E45CE5233F5AD480673752529026F59A760466A1026BB92FC78D1CCC82396ECB8F07B0E49C9B2315DBEF976CB417273C77F4209475036775FE687DD2D60
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........-.}}~.}}~.}}~...~.}}~...~.}}~...~.}}~...~.}}~.}\|~.\|}~...~.}}~...~.}}~.}.~.}}~...~.}}~Rich.}}~........PE..L...B.JT.....................6....................@..........................P........n...@..................................5..@........9..........p.m.x>.......3.. ...............................X...@............................................text...$........................... ..`.rdata..L...........................@..@.data....0...`.......:..............@....wixburn8............J..............@..@.tls.................L..............@....rsrc....9.......:...N..............@..@.reloc..rD.......F..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\BootstrapperApplicationData.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (561), with CRLF line terminators
Category:	dropped
Size (bytes):	5906
Entropy (8bit):	3.743221900318535
Encrypted:	false
SSDEEP:
MD5:	D1439B6CFE105425BCCE1A81954B3417
SHA1:	288E59BD999DCFED5C4C746C1992CFC9BB5F2380
SHA-256:	3AE340BEC4FB68B477F34DBEADAF8CF3EA95550E427A3BB84994B5806485B5B3
SHA-512:	868A9C1706B967F532039F9413BBDE8BA0FCA5CF76915334C1A1BE7D0513D3815F506A766183D85D3595AF2B4928CF5F3AD16703D20B2A5CAA9C9C47B4880086
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.U.x.B.l.o.c.k.e.r. .S.h.o.r.t.N.a.m.e.=.".M.i.n.i.m.u.m.O.S.L.e.v.e.l.". .T.y.p.e.=.".S.t.o.p.". .C.o.n.d.i.t.i.o.n.=.".N.O.T.(.(.V.e.r.s.i.o.n.N.T. .&.g.t.;. .v.6...1.). .O.R. .(.V.e.r.s.i.o.n.N.T. .=. .v.6...1. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .1.).).". .D.i.s.p.l.a.y.T.e.x.t.=.".#.l.o.c...M.i.n.i.m.u.m.O.S.L.e.v.e.l.". ./.>..... . .<.W.i.x.B.a.l.C.o.n.d.i.t.i.o.n. .C.o.n.d.i.t.i.o.n.=.".V.e.r.s.i.o.n.N.T.6.4. .&.g.t.;.=. .v.6...0. .O.R. .(.V.e.r.s.i.o.n.N.T.6.4. .=. .v.5...2. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .1.).". .M.e.s.s.a.g.e.=.".[.W.i.x.B.u.n.d.l.e.N.a.m.e.]. .c.a.n. .o.n.l.y. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .W.i.n.d.o.w.s. .X.P. .S.P.1. .(.

C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\license.rtf

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	6841
Entropy (8bit):	5.231818976502303
Encrypted:	false
SSDEEP:
MD5:	1E47EE7B71B22488068343DF4CE30534
SHA1:	DEAEE13F21AB70B57F44F0AA3128EC7AD9E3816A
SHA-256:	8518F0420972C1DBE8A323FFC6F57863AF0B80C6A3B27FD0C6FC9BDABB7E2D13
SHA-512:	C4C653BFD1FC493B0EFD8F9C75495287818179DC35969D1FB1927FAAC3FF9189FDE1131C5ABBCC3963F707412A7F8AD05A9E6855B7D47D6DF1F80D25D67BE9ED
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\\generator Riched20 6.2.9200}{\\mmathPr\mnaryLim0\mdispDef1\mwrapIndent1440 }\viewkind4\uc1 ..\pard\nowidctlpar\sb120\sa120\b\f0\fs20 MICROSOFT SOFTWARE LICENSE TERMS\par....\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 MICROSOFT VISUAL C++ REDISTRIBUTABLE FOR VISUAL STUDIO 2013 \par....\pard\nowidctlpar\sb120\sa120\b0 These license terms are an agreement between Microsoft Corporation (or based on where you live, one of its affiliates) and you. Please read them. They apply to the software named above, which includes the media on which you received it, if any. The terms also apply to any Microsoft\par....\pard\nowidctlpar\fi-360\li360\sb120\sa120\f1\'b7\tab\f0 updates,\par..\f1\'b7\tab\f0 supplements,\par..\f1\'b7\tab\f0 Internet-based services, and\par..\f1\'b7\tab\f0 support services\pa

C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\logo.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1861
Entropy (8bit):	6.868587546770907
Encrypted:	false
SSDEEP:
MD5:	D6BD210F227442B3362493D046CEA233
SHA1:	FF286AC8370FC655AEA0EF35E9CF0BFCB6D698DE
SHA-256:	335A256D4779EC5DCF283D007FB56FD8211BBCAF47DCD70FE60DED6A112744EF
SHA-512:	464AAAB9E08DE610AD34B97D4076E92DC04C2CDC6669F60BFC50F0F9CE5D71C31B8943BD84CEE1A04FB9AB5BBED3442BD41D9CB21A0DD170EA97C463E1CE2B5B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...@...@.............sRGB.........gAMA......a.....PLTE].q^.r_.r_.s`.s`.s`.ta.ta.ub.ub.vc.vd.vd.vd.we.we.xe.xg.yg yg zh zh"zi"{j#\|i${j$\|n~n.n,.o,.p..q0.r2.s3.t5.x;.x<.y>.z?.\|B.~C.}E..F..F..H..I..J..L..O..P..W..Y..^..a..c..g..i..q..r..}.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S......pHYs..%...%....^.....tEXtSoftware.Paint.NET v3.5.100.r.....IDATXG..iW.@...EJ.$M...`AEpG..7TpWT@\.."....(..(.._;...di:9.c>q..g....T...._...-....F..+..w.

C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\thm.wxl

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2952
Entropy (8bit):	5.052095286906672
Encrypted:	false
SSDEEP:
MD5:	FBFCBC4DACC566A3C426F43CE10907B6
SHA1:	63C45F9A771161740E100FAF710F30EED017D723
SHA-256:	70400F181D00E1769774FF36BCD8B1AB5FBC431418067D31B876D18CC04EF4CE
SHA-512:	063FB6685EE8D2FA57863A74D66A83C819FE848BA3072B6E7D1B4FE397A9B24A1037183BB2FDA776033C0936BE83888A6456AAE947E240521E2AB75D984EE35E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29" />.... <String Id="Caption">[WixBundleName] Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installs, repairs, uninstalls or.. creates a complete local copy of the bundle in directory. Install is the default...../passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt before restart.../log log.txt - logs to a specific file. B

C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\thm.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5881
Entropy (8bit):	5.175177119212422
Encrypted:	false
SSDEEP:
MD5:	0056F10A42638EA8B4BEFC614741DDD6
SHA1:	61D488CFBEA063E028A947CB1610EE372D873C9F
SHA-256:	6B1BA0DEA830E556A58C883290FAA5D49C064E546CBFCD0451596A10CC693F87
SHA-512:	5764EC92F65ACC4EBE4DE1E2B58B8817E81E0A6BC2F6E451317347E28D66E1E6A3773D7F18BE067BBB2CB52EF1FA267754AD2BF2529286CF53730A03409D398E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="485" Height="300" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.... <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png" Visible="yes"/>.. <Text X="80" Y="11" Width="-11" Height="64" FontId="1" Visible="yes" DisablePrefix="yes">#(loc.Title)</Text>.... <Page Name="Help">.. <Text X="11" Y="80" Width="-11" Height="30" FontId="2" DisablePrefix="yes">#(loc.HelpHeader)</T

C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\wixstdba.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	120320
Entropy (8bit):	6.262646414883502
Encrypted:	false
SSDEEP:
MD5:	A52E5220EFB60813B31A82D101A97DCB
SHA1:	56E16E4DF0944CB07E73A01301886644F062D79B
SHA-256:	E7C8E7EDD9112137895820E789BAAAECA41626B01FB99FEDE82968DDB66D02CF
SHA-512:	D6565BA18B5B9795D6BDE3EF94D8F7CD77BF8BB69BA3FE7ADEFB80FC7C5D888CDFDC79238D86A0839846AEA4A1E51FC0CAED3D62F7054885E8B15FAD9F6C654E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................x=....x...... .....0.....n..x.....x8....x9....x>...Rich..........................PE..L......R...........!.....2..........1........P...............................0.......1....@.............................................l...........................0S..............................`...@............P...............................text...M0.......2.................. ..`.rdata..yd...P...f...6..............@..@.data..../..........................@....rsrc...l...........................@..@.reloc..B ......."..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.be\vcredist_x64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	465992
Entropy (8bit):	6.923996733031688
Encrypted:	false
SSDEEP:
MD5:	3284088A2D414D65E865004FDB641936
SHA1:	7F3E9180D9025FC14C8A7868B763B0C3E7A900B4
SHA-256:	102F69B5A98352A6A1A6B26BC2C86EE7611C1F45F5A9CA04F5A8841961F191C6
SHA-512:	6786FB431ADDF05DF256D0E1383501F96356AA78F66482DB9772C58334AEAD59838ABB7DB0EA793D4A17627A357598266681C28328485489A21BC2985E751B62
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........-.}}~.}}~.}}~...~.}}~...~.}}~...~.}}~...~.}}~.}\|~.\|}~...~.}}~...~.}}~.}.~.}}~...~.}}~Rich.}}~........PE..L...B.JT.....................6....................@..........................P......V>....@..................................5..@........9..............x>.......3.. ...............................X...@............................................text...$........................... ..`.rdata..L...........................@..@.data....0...`.......:..............@....wixburn8............J..............@..@.tls.................L..............@....rsrc....9.......:...N..............@..@.reloc..rD.......F..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe
File Type:	Microsoft Cabinet archive data, 5572387 bytes, 14 files, at 0x44 +A "F_CENTRAL_mfc120_x64" +A "F_CENTRAL_mfc120chs_x64", flags 0x4, number 1, extra bytes 20 in head, 369 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	5588515
Entropy (8bit):	7.997584686021991
Encrypted:	true
SSDEEP:
MD5:	F5879F5F3FFA839A280AB853338DE872
SHA1:	3B4366ABB2DA245416531925EBD8C76ADC3E90EF
SHA-256:	1F2F8F5D60DADBC6E4D3D36C88CC54F22AF0A615B609609E748782DC26231174
SHA-512:	96A88601CEDF859C9FCD388D9E8D2FD6139F6E69AB6B05B0E044D1A598CD1A066D27A0F7A7C71BD77576DCDD083DEC7A55F2CD9DE52FF95AAC23171C9F9670DE
Malicious:	false
Reputation:	low
Preview:	MSCF....#.U.....D...........................#.U..?..........l...q.....U........JT~ .F_CENTRAL_mfc120_x64.......U....JT~ .F_CENTRAL_mfc120chs_x64.....HGV....JT~ .F_CENTRAL_mfc120cht_x64..$....V....JT~ .F_CENTRAL_mfc120deu_x64...... X....JT~ .F_CENTRAL_mfc120enu_x64.. ..@.Y....JT~ .F_CENTRAL_mfc120esn_x64..$...?Z....JT~ .F_CENTRAL_mfc120fra_x64......d[....JT~ .F_CENTRAL_mfc120ita_x64.....8.\....JT~ .F_CENTRAL_mfc120jpn_x64......S]....JT~ .F_CENTRAL_mfc120kor_x64......$^....JT~ .F_CENTRAL_mfc120rus_x64...U.09_....JT~ .F_CENTRAL_mfc120u_x64..f...3.....JT~ .F_CENTRAL_mfcm120_x64..f..p......JT~ .F_CENTRAL_mfcm120u_x64.T2.;;;..CK.}.xT....$K.....*(..]...l...I..Y ...$.P..(.......2...XiK...j...#!.$.<....7.....Z.....}$..........;s..s.sf......TI.....J....y....i...._.!.....v..o..4.......#.>.y.y....f9...s<0.Q0~......{...Z.........0L.-;}..).^K..R:l.vH.;-..GT.F...v..Rj.....y.K.V._w..k.......f.t...5Zz.....9...h...t..........H.8..t..'..2..>=.$.e.....HR'H.H..?.."z..S..e&.%=i........

C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab5046A8AB272BF37297BB7928664C9503

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe
File Type:	Microsoft Cabinet archive data, 1018300 bytes, 5 files, at 0x44 +A "F_CENTRAL_msvcp120_x64" +A "F_CENTRAL_msvcr120_x64", flags 0x4, number 1, extra bytes 20 in head, 80 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1034428
Entropy (8bit):	7.9960148065256105
Encrypted:	true
SSDEEP:
MD5:	361903C5FF86511786D7B450301DD640
SHA1:	C9FC04A718A388294658590F1240D8C7E9EE4F82
SHA-256:	E95D29CBB06BB323D9D43FC2CE61D4565B0866622A83D93DF76430A0C252B433
SHA-512:	78CEAAAA7F3E1A40AC2528E2F169416D6EBFABA54301754035F2A62F845421C8CDDAED84770182E51794C9FB32720AEC998D453DE2BEF621DE7A7E2B3B35AF20
Malicious:	false
Reputation:	low
Preview:	MSCF............D................................?..............P..............JT~ .F_CENTRAL_msvcp120_x64............JT~ .F_CENTRAL_msvcr120_x64..Z..P......JT~ .F_CENTRAL_vcamp120_x64..p.... ....JT~ .F_CENTRAL_vccorlib120_x64.......%....JT~ .F_CENTRAL_vcomp120_x64..Id..4..CK.}.\....,.. ...=..(.Kb%..E gcI\|..&f......h!.....v+....u....&...R....C.-.zI.....=3....j.....~>0.....}...>...o..b9.3..p.j..sq'.g5q\.~k{po..\|.j......O..,)....w;.L.9.........3.9#.8....W$%%..}dW............i...3?.k..Cf.....f..=L.r3...4.z..g..:T}..z.#]GO.R..G.. ..n.0.K..........=&..Y8..3={.G...v....}....%.cW.W.@L.xX...2i..K..m..n..K.W20..B.H..Q@.....p.....C..no. Qh...BF....B-....Wx..{...P.C.i7..8..+Jo...q...K}r'.:....:..qu.....7._....(a.D#...p-..._..)...xC..#.M.q.."..W\.....7.........t......m../..Mv...x.;..K.......9.\.....t.\....!....m.....-..}k.....Nl.....W!>.S.o.7../X..\..}9....6o....il.Wx......../z.......c...#.....I.a...w....V.....]....H&\Fi.+Z.t..!..Q.:..u.M.t.J....z..~E!......c..,

C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeAdditional_x64

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664., Template: x64;1033, Revision Number: {A1135D47-2E01-4DE6-AB19-25679EC5D3CF}, Create Time/Date: Thu May 25 00:06:24 2017, Last Saved Time/Date: Thu May 25 00:06:24 2017, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.2804.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.852155639838542
Encrypted:	false
SSDEEP:
MD5:	4F782799F84CD006F7F1C750AFB04D8C
SHA1:	0CD219D326FD40665D2F1B22569E2517792EDFD9
SHA-256:	8909E5C1D917064983595A4E4717F758C2A8DF8F59D7B31A5B79B2F95BD8F7CC
SHA-512:	CFDDAD551AA5A35B032B7006B167FD322AFF46EC8A2934632C087882B24404EE48083EE38B9110ADD9846880B1AE0BED136BB21AE751E1D3CDE9DC27EAED5915
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeMinimum_x64

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40664., Template: x64;1033, Revision Number: {F8853551-4D30-4D6A-B36A-93EFAD4EEE03}, Create Time/Date: Thu May 25 00:06:22 2017, Last Saved Time/Date: Thu May 25 00:06:22 2017, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.2804.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.7941100920635975
Encrypted:	false
SSDEEP:
MD5:	87B74C694F295830FFE516BA20DE0B93
SHA1:	E6996D47BB76AD25954B793F73211524490F55A9
SHA-256:	E88D0915814E622CD1DECA849EFA23A0D58D5D756BE44EBBB4D460D3DAC9E816
SHA-512:	D0FD7F8C8964A99CE7A9D187640ACDBFF4CA3D16F02E44696706D6107B58890E763A18857BEC2B94F92CA559510FEA0AE5515CE3DE20AA4371AEBB38006C05EB
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1028\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	18415
Entropy (8bit):	4.043868285184243
Encrypted:	false
SSDEEP:
MD5:	2B063D92663595DFE4781AE687A03D86
SHA1:	0FB582E756DBC751EA380593AC4DA27DDB4EBB06
SHA-256:	44C76290F7A2E45940E8338912FEB49BCF4E071CFA85D2D34762857743ACBC8D
SHA-512:	94C8FDA6173C7F5740F206190EDCD1F1F1C309596B710D400E23CD363A619D707A5D4576D4FE63AB7CB68947F009EFD29A1FBE04743A294698BF2AE17E92C214
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset134 SimSun;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT \f1\'dc\'9b\'f3\'77\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\f0\par..MICROSOFT VISUAL C++ 2015 - 2022 \f1\'88\'cc\'d0\'d0\'eb\'41\'b6\'ce\f0 \par..\b0\f1\'b1\'be\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\'ca\'c7\'d9\'46\'d3\'c3\'91\'f4\'c5\'63\f0 Microsoft Corporation (\f1\'bb\'f2\'c6\'e4\'ea\'50\'82\'53\'c6\'f3\'98\'49\'a3\'ac\'d2\'95\'d9\'46\'d3\'c3\'91\'f4\'cb\'f9\'be\'d3\'d7\'a1\'b5\'c4\'b5\'d8\'fc\'63\'b6\'f8\'b6\'a8\f0 ) \f1\'d6\'ae\'e9\'67\'b3\'c9\'c1\'a2\'b5\'c4\'ba\'cf\'bc\'73\'a1\'a3\'cb\'fc\'82\'83\'df\'6d\'d3\'c3\'ec\'b6\'c9\'cf\'ca\'f6\'dc\'9b\'f3\'77\'a1\'a3\'b1\'be\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\'d2\'e0\'df\'6d\'d3\'c3\'ec\'b6\'c8\'ce\'ba\'ce\f0 Microsoft \f1\'b7\'fe\'84\'d5\

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1028\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.163758160900388
Encrypted:	false
SSDEEP:
MD5:	472ABBEDCBAD24DBA5B5F5E8D02C340F
SHA1:	974F62B5C2E149C3879DD16E5A9DBB9406C3DB85
SHA-256:	8E2E660DFB66CB453E17F1B6991799678B1C8B350A55F9EBE2BA0028018A15AD
SHA-512:	676E29378AAED25DE6008D213EFA10D1F5AAD107833E218D71F697E728B7B5B57DE42E7A910F121948D7B1B47AB4F7AE63F71196C747E8AE2B4827F754FC2699
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">....</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ................. ......................../passive \| /quiet - .... UI ........... UI.... ........... UI ........../norestart - ................UI ............./log log.txt - .........

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1029\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	13234
Entropy (8bit):	5.125368352290407
Encrypted:	false
SSDEEP:
MD5:	E7DC9CA9474A13FA4529D91BCD2AB8CC
SHA1:	511F5DE8A99C09EC3766C5E2494A79EACCA261C8
SHA-256:	503C433DCDE2F3A9E7D388A5FF2B0612E7D8F90F5188D5B2B60228DB33044FDE
SHA-512:	77108E53CD58E42F847D8EF23A07723C4849DC41DBE1C3EF939B9170E75F525BEC9D210D6C1FBFEB330ECE2E77B8A8E2808730D9E6F72F5B3FE626D58B6068C6
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset0 Garamond;}{\f3\fnil Tahoma;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 LICEN\f1\'c8N\f0\'cd PODM\'cdNKY PRO SOFTWARE SPOLE\f1\'c8NOSTI MICROSOFT\par..\f0 MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0 Tyto licen\f1\'e8n\f0\'ed podm\'ednky p\f1\'f8edstavuj\f0\'ed smlouvu mezi spole\f1\'e8nost\f0\'ed Microsoft Corporation (nebo n\f1\'eckterou z jej\f0\'edch afilac\'ed, v\~z\'e1vislosti na tom, kde bydl\'edte) a v\'e1mi. Vztahuj\'ed se na v\'fd\f1\'9ae uveden\f0\'fd software. Podm\'ednky se rovn\f1\'ec\'9e vztahuj\f0\'ed na jak\'e9koli slu\f1\'9eby Microsoft nebo aktualizace pro software, pokud se na slu\'9eby nebo aktualizace nevztahuj\f0\'ed odli\f1\'9an\f0\'e9 podm\'ednky.\par..\b DODR\f1\'8e\f0\'cdTE-LI

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1029\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3333
Entropy (8bit):	5.370651462060085
Encrypted:	false
SSDEEP:
MD5:	16343005D29EC431891B02F048C7F581
SHA1:	85A14C40C482D9351271F6119D272D19407C3CE9
SHA-256:	07FB3EC174F25DFBE532D9D739234D9DFDA8E9D34F01FE660C5B4D56989FA779
SHA-512:	FF1AE9C21DCFB018DD4EC82A6D43362CB8C591E21F45DD1C25955D83D328B57C8D454BBE33FBC73A70DADF1DFB3AE27502C9B3A8A3FF2DA97085CA0D9A68AB03
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instala.n. program [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Opravdu chcete akci zru.it?</String>.. <String Id="HelpHeader">N.pov.da nastaven.</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [adres..] . Nainstaluje, oprav., odinstaluje nebo.. vytvo.. .plnou m.stn. kopii svazku v adres..i. V.choz. mo.nost. je instalace...../passive \| /quiet . Zobraz. minim.ln. u.ivatelsk. rozhran. bez v.zev nebo nezobraz. ..dn. u.ivatelsk. rozhran. a.. ..dn. v.zvy. V.choz. mo.nost. je zobrazen. u.ivatelsk.ho rozhran. a v.ech v.zev...../noresta

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1031\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	12392
Entropy (8bit):	5.192979871787938
Encrypted:	false
SSDEEP:
MD5:	2DDCA2866D76C850F68ACDFDB696D6DE
SHA1:	C5076F10B0F0654CDE2C990DEEB2772F3CC4844B
SHA-256:	28F63BAD9C2960395106011761993049546607F8A850D344D6A54042176BF03F
SHA-512:	E3A3693B92873E0B42007616FF6916304EDC5C4F2EEE3E9276F87E86DD94C2BF6E1CF4E895CDF9A1AA0CAC0B381B8840EEE1F491123E901DEE75638B8BC5CE1B
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil Tahoma;}{\f3\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT-SOFTWARE-LIZENZBEDINGUNGEN\par..MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0 Diese Lizenzbestimmungen stellen eine Vereinbarung zwischen Ihnen und der Microsoft Corporation (bzw. abh\'e4ngig von Ihrem Wohnsitz einem ihrer Affiliate-Partner) dar. Sie gelten f\'fcr die oben angef\'fchrte Software. Die Bestimmungen gelten ebenso f\'fcr jegliche von Microsoft angebotenen Dienste oder Updates f\'fcr die Software, sofern diesen keine anderen Bestimmungen beiliegen.\par..\b WENN SIE DIESE LIZENZBESTIMMUNGEN EINHALTEN, VERF\'dcGEN SIE \'dcBER DIE NACHFOLGEND AUFGEF\'dcHRTEN RECHTE.\par....\pard{\pntext\f3\'B7\tab}{\\pn\pnlvlblt\pnf3\pnindent360{\pntxtb\'B7}}\

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1031\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3379
Entropy (8bit):	5.094097800535488
Encrypted:	false
SSDEEP:
MD5:	561F3F32DB2453647D1992D4D932E872
SHA1:	109548642FB7C5CC0159BEDDBCF7752B12B264C0
SHA-256:	8E0DCA6E085744BFCBFF46F7DCBCFA6FBD722DFA52013EE8CEEAF682D7509581
SHA-512:	CEF8C80BEF8F88208E0751305DF519C3D2F1C84351A71098DC73392EC06CB61A4ACA35182A0822CF6934E8EE42196E2BCFE810CC859965A9F6F393858A1242DF
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] - Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">M.chten Sie den Vorgang wirklich abbrechen?</String>.. <String Id="HelpHeader">Setup-Hilfe</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [Verzeichnis] - installiert, repariert, deinstalliert oder.. erstellt eine vollst.ndige lokale Kopie des Bundles im Verzeichnis. Installieren ist die Standardeinstellung...../passive \| /quiet - zeigt eine minimale Benutzeroberfl.che ohne Eingabeaufforderungen oder keine.. Benutzeroberfl.che und keine Eingabeaufforderungen an. Standardm..ig werden die Benutzeroberfl.che und alle Eingab

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1036\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	12349
Entropy (8bit):	5.108676965693909
Encrypted:	false
SSDEEP:
MD5:	A6E352E5804313CCDE3E4D5DDDDE122D
SHA1:	834E3AAA07DC675589A9E5FCD23CE5586C2739E8
SHA-256:	5C13A65870D770D1642A4259EECB436257CA39016A0500F747BE9C79BE0C7009
SHA-512:	6578AC6467F61930BC1B20E404441725C63790C65AEC1ACE297429EAD15F50E68D5FE9CC1451AC86AE23DC1A7FE967650166293010D687785FB81FB4492B87C4
Malicious:	false
Reputation:	low
Preview:	{\rtf1\fbidis\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil Tahoma;}{\f2\fnil\fcharset0 Garamond;}{\f3\fnil\fcharset177 Tahoma;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\ltrpar\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 TERMES DU CONTRAT DE LICENCE LOGICIEL MICROSOFT\par..MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0 Les pr\'e9sentes conditions de licence constituent un contrat entre Microsoft Corporation (ou en fonction de votre lieu de r\'e9sidence, l\f1\rquote\f0 un de ses affili\'e9s) et vous. Ils s\f1\rquote\f0 appliquent au logiciel vis\'e9 ci-dessus. Les termes s\f1\rquote\f0 appliquent \'e9galement \'e0 tout service et \'e0 toute mise \'e0 jour Microsoft pour ce logiciel, \'e0 moins que d\f1\rquote\f0 autres termes n\f1\rquote\f0 accompagnent ces \'e9l\'e9ments.\par..\b SI VOUS VOUS CONFORMEZ AUX PR\'c9SENTS TERMES DU CONTRAT D

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1036\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3366
Entropy (8bit):	5.0912204406356905
Encrypted:	false
SSDEEP:
MD5:	7B46AE8698459830A0F9116BC27DE7DF
SHA1:	D9BB14D483B88996A591392AE03E245CAE19C6C3
SHA-256:	704DDF2E60C1F292BE95C7C79EE48FE8BA8534CEB7CCF9A9EA68B1AD788AE9D4
SHA-512:	FC536DFADBCD81B42F611AC996059A6264E36ECF72A4AEE7D1E37B87AEFED290CC5251C09B68ED0C8719F655B163AD0782ACD8CE6332ED4AB4046C12D8E6DBF6
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Installation de [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Voulez-vous vraiment annuler.?</String>.. <String Id="HelpHeader">Aide du programme d'installation</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installe, r.pare, d.sinstalle ou.. cr.e une copie locale compl.te du groupe dans le r.pertoire. Install est l'option par d.faut...../passive \| /quiet - affiche une interface minimale, sans invite, ou n'affiche ni interface.. ni invite. Par d.faut, l'interface et toutes les invites sont affich.es...../norestart - supprime toutes les tentatives de red.

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1040\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	11440
Entropy (8bit):	5.037988271709582
Encrypted:	false
SSDEEP:
MD5:	BC58AD6ABB16B982AEBADC121B37E706
SHA1:	25E3E4127A643DB5DB2A0B62B02DE871359FAE42
SHA-256:	70ECF23C03B66A2B18E173332586AFA8F00F91E02A80628F4F9CB2521E27F6AC
SHA-512:	8340452CB5E196CB1D5DA6DBB3FA8872E519D7903A05331055370B4850D912674F0B6AF3D6E4F94248FE8135EB378EB36969821D711FE1624A04AF13BBE55D70
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 CONDIZIONI DI LICENZA SOFTWARE MICROSOFT\par..RUNTIME MICROSOFT VISUAL C++ 2015 - 2022 \par..\b0 Le presenti condizioni di licenza costituiscono il contratto tra Microsoft Corporation (o, in base al luogo di residenza del licenziatario, una delle sue consociate) e il licenziatario. Tali condizioni si applicano al software Microsoft di cui sopra. Le condizioni si applicano inoltre a qualsiasi servizio o aggiornamento di Microsoft relativo al software, tranne se accompagnato da condizioni differenti.\par..\b QUALORA IL LICENZIATARIO SI ATTENGA ALLE PRESENTI CONDIZIONI DI LICENZA, DISPORR\'c0 DEI DIRITTI INDICATI DI SEGUITO.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1040\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3319
Entropy (8bit):	5.019774955491369
Encrypted:	false
SSDEEP:
MD5:	D90BC60FA15299925986A52861B8E5D5
SHA1:	FADFCA9AB91B1AB4BD7F76132F712357BD6DB760
SHA-256:	0C57F40CC2091554307AA8A7C35DD38E4596E9513E9EFAE00AC30498EF4E9BC2
SHA-512:	11764D0E9F286B5AA7B1A9601170833E462A93A1E569A032FCBA9879174305582BD42794D4131B83FBCFBF1CF868A8D5382B11A4BD21F0F7D9B2E87E3C708C3F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Installazione di [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Annullare?</String>.. <String Id="HelpHeader">Guida alla configurazione</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installa, ripara, disinstalla o.. crea una copia locale completa del bundle nella directory. L'opzione predefinita . Install...../passive \| /quiet - visualizza un'interfaccia utente minima senza prompt oppure non visualizza alcuna interfaccia utente.. n. prompt. Per impostazione predefinita viene visualizzata l'intera interfaccia utente e tutti i prompt...../norestart - annulla quals

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1041\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	30228
Entropy (8bit):	3.785116198512527
Encrypted:	false
SSDEEP:
MD5:	47C315C54B6F2078875119FA7A718499
SHA1:	F650DDB5DF2AF2EE7555C410D034B37B9DFD055B
SHA-256:	C3061A334BFD5F02B7085F8F454D5D3D97D477AF14BAB497BF31A7887BC90C5B
SHA-512:	A0E4B0FCCCFDD93BAF133C2080403E8719E4A6984237F751BD883C0D3C52D818EFD00F8BA7726A2F645F66286305599403470F14D39EEDC526DDE59228A5F261
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset128 MS PGothic;}{\f1\fnil\fcharset0 Tahoma;}{\f2\fnil\fcharset134 SimSun;}{\f3\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9\'83\'7d\'83\'43\'83\'4e\'83\'8d\'83\'5c\'83\'74\'83\'67\f1 \f0\'83\'5c\'83\'74\'83\'67\'83\'45\'83\'46\'83\'41\f1 \f0\'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8d\'80\f1\par..MICROSOFT VISUAL C++ 2015 - 2022 \f0\'83\'89\'83\'93\'83\'5e\'83\'43\'83\'80\f1\par..\b0\f0\'96\'7b\'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8d\'80\'82\'cd\f2\'a1\'a2\f1 Microsoft Corporation\f2\'a3\'a8\f0\'82\'dc\'82\'bd\'82\'cd\'82\'a8\'8b\'71\'97\'6c\'82\'cc\'8f\'8a\'8d\'dd\'92\'6e\'82\'c9\'89\'9e\'82\'b6\'82\'bd\'8a\'d6\'98\'41\'89\'ef\'8e\'d0\f2\'a3\'a9\f0\'82\'c6\'82\'a8\'8b\'71\'97\'6c\'82\'c6\'82\'cc\'8c\'5f\'96\'f1\'82\'f0\'8d\'5c\'90\'ac\'82\'b5\'82\'dc\'82\'b7\f2\'a1\'a3\'b

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1041\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3959
Entropy (8bit):	5.955167044943003
Encrypted:	false
SSDEEP:
MD5:	DC81ED54FD28FC6DB6F139C8DA1BDED6
SHA1:	9C719C32844F78AAE523ADB8EE42A54D019C2B05
SHA-256:	6B9BBF90D75CFA7D943F036C01602945FE2FA786C6173E22ACB7AFE18375C7EA
SHA-512:	FD759C42C7740EE9B42EA910D66B0FA3F813600FD29D074BB592E5E12F5EC09DB6B529680E54F7943821CEFE84CE155A151B89A355D99C25A920BF8F254AA008
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.. <Control Control="InstallButton" X="275" Y="237" Width="110" Height="23"/>.. <Control Control="UninstallButton" X="270" Y="237" Width="120" Height="23"/>.. <Control Control="RepairButton" X="187" Y="237" Width="80" Height="23"/>.. .. <String Id="Caption">[WixBundleName] .......</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">..........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ............ ......... .........................

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1042\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	28393
Entropy (8bit):	3.874126830110936
Encrypted:	false
SSDEEP:
MD5:	641D926354F001034CF3F2F3B0FF33DC
SHA1:	5505107FFF6CF279769A82510276F61EA18637AE
SHA-256:	3D4E9C165CBEAB829D608106F0E96450F839FFA8ADBD755F0B51867E89DA2AE0
SHA-512:	B0339664434B096ABC26D600F7657919EF3689B4E0FDFD4EDD8E479859A51EF51BE8F05FA43E25567FFD6C1C2BCC6EF0D7A857B6D666D264C7783BAD3A383D0E
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset129 Malgun Gothic;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT \f1\'bc\'d2\'c7\'c1\'c6\'ae\'bf\'fe\'be\'ee\f0 \f1\'b6\'f3\'c0\'cc\'bc\'b1\'bd\'ba\f0 \f1\'b0\'e8\'be\'e0\'bc\'ad\f0\par..MICROSOFT VISUAL C++ 2015 - 2022 \f1\'b7\'b1\'c5\'b8\'c0\'d3\f0 \par..\b0\f1\'ba\'bb\f0 \f1\'b6\'f3\'c0\'cc\'bc\'b1\'bd\'ba\f0 \f1\'b0\'e8\'be\'e0\'c0\'ba\f0 Microsoft Corporation(\f1\'b6\'c7\'b4\'c2\f0 \f1\'b0\'c5\'c1\'d6\f0 \f1\'c1\'f6\'bf\'aa\'bf\'a1\f0 \f1\'b5\'fb\'b6\'f3\f0 \f1\'b0\'e8\'bf\'ad\'bb\'e7\f0 \f1\'c1\'df\f0 \f1\'c7\'cf\'b3\'aa\f0 )\f1\'b0\'fa\f0 \f1\'b1\'cd\'c7\'cf\f0 \f1\'b0\'a3\'bf\'a1\f0 \f1\'c3\'bc\'b0\'e1\'b5\'c7\'b4\'c2\f0 \f1\'b0\'e8\'be\'e0\'c0\'d4\'b4\'cf\'b4\'d9\f0 . \f1\'ba\'bb\f0 \f1\'b6\'f3\'c0\'cc\'bc\'b1\'bd\'ba\f0 \f1\'

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1042\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3249
Entropy (8bit):	5.985100495461761
Encrypted:	false
SSDEEP:
MD5:	B3399648C2F30930487F20B50378CEC1
SHA1:	CA7BDAB3BFEF89F6FA3C4AAF39A165D14069FC3D
SHA-256:	AD7608B87A7135F408ABF54A897A0F0920080F76013314B00D301D6264AE90B2
SHA-512:	C5B0ECF11F6DADF2E68BC3AA29CC8B24C0158DAE61FE488042D1105341773166C9EBABE43B2AF691AD4D4B458BF4A4BF9689C5722C536439CA3CDC84C0825965
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] .. ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">.. ...</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ..... ... .. .. .... .., .., .. .... ...... ... .........../passive \| /quiet - .... .. .. UI. ..... UI ... ..... .... ..... ..... UI. .. ..... ........../norestart - .. .... .. .... ...

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1045\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	13352
Entropy (8bit):	5.359561719031494
Encrypted:	false
SSDEEP:
MD5:	F140FD8CA2C63A861D04310257C1B1DB
SHA1:	7BF7EF763A1F80ECACA692908F8F0790A88C3CA1
SHA-256:	6F94A99072061012C5626A6DD069809EC841D6E3102B48394D522A0C2E3AA2B5
SHA-512:	A0BD65AF13CC11E41E5021DF0399E5D21B340EF6C9BBE9B1B56A1766F609CEB031F550A7A0439264B10D67A76A6403E41ABA49B3C9E347CAEDFE9AF0C5BE1EE6
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset0 Garamond;}{\f3\fnil Tahoma;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 POSTANOWIENIA LICENCYJNE DOTYCZ\f1\'a5CE OPROGRAMOWANIA MICROSOFT\par..\f0 MICROSOFT VISUAL C++ \f1\'8cRODOWISKO URUCHOMIENIOWE 2015-2022 \par..\b0\f0 Niniejsze postanowienia licencyjne stanowi\f1\'b9 umow\'ea mi\'eadzy Microsoft Corporation (lub, w zale\'bfno\'9cci od miejsca zamieszkania Licencjobiorcy, jednym z podmiot\f0\'f3w stowarzyszonych Microsoft Corporation) a Licencjobiorc\f1\'b9. Postanowienia te dotycz\'b9 oprogramowania okre\'9clonego powy\'bfej. Niniejsze postanowienia maj\'b9 r\f0\'f3wnie\f1\'bf zastosowanie do wszelkich us\'b3ug i aktualizacji Microsoft dla niniejszego oprogramowania, z wyj\'b9tkiem tych, kt\f0\'f3rym tow

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1045\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3212
Entropy (8bit):	5.268378763359481
Encrypted:	false
SSDEEP:
MD5:	15172EAF5C2C2E2B008DE04A250A62A1
SHA1:	ED60F870C473EE87DF39D1584880D964796E6888
SHA-256:	440B309FCDF61FFC03B269FE3815C60CB52C6AE3FC6ACAD14EAC04D057B6D6EA
SHA-512:	48AA89CF4A0B64FF4DCB82E372A01DFF423C12111D35A4D27B6D8DD793FFDE130E0037AB5E4477818A0939F61F7DB25295E4271B8B03F209D8F498169B1F9BAE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instalator [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Czy na pewno chcesz anulowa.?</String>.. <String Id="HelpHeader">Instalator . Pomoc</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [katalog] - Instaluje, naprawia, odinstalowuje.. lub tworzy pe.n. lokaln. kopi. pakietu w katalogu. Domy.lnie jest u.ywany prze..cznik install...../passive \| /quiet - Wy.wietla ograniczony interfejs u.ytkownika bez monit.w albo nie wy.wietla ani interfejsu u.ytkownika,.. ani monit.w. Domy.lnie jest wy.wietlany interfejs u.ytkownika oraz wszystkie monity...../norestart - Pom

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1046\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	10956
Entropy (8bit):	5.086757849952268
Encrypted:	false
SSDEEP:
MD5:	9A8D2ACF07F3C01E5CBC461AB932D85B
SHA1:	8781A298DCC14C18C6F6DB58B64F50B2FC6E338E
SHA-256:	27891EEC899BE859E3B4D3B29247FC6B535D7E836DEF0329111C48741EC6E701
SHA-512:	A60262A0C18E3BEF7C6D52F242153EBE891F676ED639F2DACFEBBAC86E70EEBF58AA95A7FE1A16E15A553C1BD3ECACCD8677EB9D2761CB79CB9A342C9B4252E2
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 TERMOS DE LICEN\'c7A PARA SOFTWARE MICROSOFT\par..TEMPO DE EXECU\'c7\'c3O DO MICROSOFT VISUAL C++ 2015 - 2022 \par..\b0 Os presentes termos de licen\'e7a constituem um contrato firmado entre a Microsoft Corporation (ou, dependendo do local no qual voc\'ea esteja domiciliado, uma de suas afiliadas) e voc\'ea. Eles se aplicam ao software indicado acima. Os termos tamb\'e9m se aplicam a quaisquer servi\'e7os ou atualiza\'e7\'f5es da Microsoft para o software, exceto at\'e9 a extens\'e3o de que eles tenham termos diferentes.\par..\b SE VOC\'ca CONCORDAR COM ESTES TERMOS DE LICEN\'c7A, TER\'c1 OS DIREITOS INDICADOS ABAIXO.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360{\pn

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1046\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3095
Entropy (8bit):	5.150868216959352
Encrypted:	false
SSDEEP:
MD5:	BE27B98E086D2B8068B16DBF43E18D50
SHA1:	6FAF34A36C8D9DE55650D0466563852552927603
SHA-256:	F52B54A0E0D0E8F12CBA9823D88E9FD6822B669074DD1DC69DAD6553F7CB8913
SHA-512:	3B7C773EF72D40A8B123FDB8FC11C4F354A3B152CF6D247F02E494B0770C28483392C76F3C222E3719CF500FE98F535014192ACDDD2ED9EF971718EA3EC0A73E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] Instala..o</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem certeza de que deseja cancelar?</String>.. <String Id="HelpHeader">Ajuda da Instala..o</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [diret.rio - instala, repara, desinstala ou.. cria uma c.pia local completa do pacote no diret.rio. Install . o padr.o..../passive \| /quiet - exibe a IU m.nima sem nenhum prompt ou n.o exibe nenhuma IU e.. nenhum prompt. Por padr.o, a IU e todos os prompts s.o exibidos...../norestart - suprime qualquer tentativa de reiniciar. Por padr.o, a IU perguntar. antes de reiniciar

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1049\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	31981
Entropy (8bit):	3.6408688850128446
Encrypted:	false
SSDEEP:
MD5:	62229BE4447C349DF353C5D56372D64B
SHA1:	989799ED24913A0E6AE2546EE2A9A8D556E1CB3B
SHA-256:	1BB3FB55B8A13FA3BAFFFE72F5B1ED8B57A63BD4D8654BB6DC5B9011CE803B44
SHA-512:	FA366328C3FD4F683FDB1C5A64F5D554DE79620331086E8B4CCC2BFC2595B1FDED02CEC8AA982FCD8B13CC175D222AF2D7E2CD1A33B52F36AFD692B533FDBF13
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset204 Tahoma;}{\f1\fnil Tahoma;}{\f2\fnil\fcharset0 Tahoma;}{\f3\fnil\fcharset204 Garamond;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang1049\'d3\'d1\'cb\'ce\'c2\'c8\'df \'cb\'c8\'d6\'c5\'cd\'c7\'c8\'c8 \'cd\'c0 \'cf\'d0\'ce\'c3\'d0\'c0\'cc\'cc\'cd\'ce\'c5 \'ce\'c1\'c5\'d1\'cf\'c5\'d7\'c5\'cd\'c8\'c5 MICROSOFT\par..\'d1\'d0\'c5\'c4\'c0 \'c2\'db\'cf\'ce\'cb\'cd\'c5\'cd\'c8\'df MICROSOFT VISUAL C++ 2015\f1\endash\f2 2022 \par..\b0\f0\'cd\'e0\'f1\'f2\'ee\'ff\'f9\'e8\'e5 \'f3\'f1\'eb\'ee\'e2\'e8\'ff \'eb\'e8\'f6\'e5\'ed\'e7\'e8\'e8 \'ff\'e2\'eb\'ff\'fe\'f2\'f1\'ff \'f1\'ee\'e3\'eb\'e0\'f8\'e5\'ed\'e8\'e5\'ec \'ec\'e5\'e6\'e4\'f3 \'ea\'ee\'f0\'ef\'ee\'f0\'e0\'f6\'e8\'e5\'e9 Microsoft (\'e8\'eb\'e8, \'e2 \'e7\'e0\'e2\'e8\'f1\'e8\'ec\'ee\'f1\'f2\'e8 \'ee\'f2 \'ec\'e5\'f1\'f2\'e0

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1049\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	5.444436038992627
Encrypted:	false
SSDEEP:
MD5:	17C652452E5EE930A7F1E5E312C17324
SHA1:	59F3308B87143D8EA0EA319A1F1A1F5DA5759DD3
SHA-256:	7333BC8E52548821D82B53DBD7D7C4AA1703C85155480CB83CEFD78380C95661
SHA-512:	53FD207B96D6BCF0A442E2D90B92E26CBB3ECC6ED71B753A416730E8067E831E9EB32981A9E9368C4CCA16AFBCB2051483FDCFC474EA8F0D652FCA934634FBE8
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.. <Control Control="InstallButton" X="275" Y="237" Width="110" Height="23"/>.... <String Id="Caption">......... ......... [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">....... .. .........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [.......] - ........., .............., ........ ..... ........ ...... ......... ..... ...... . ......... .. ......... - ............../passive \| /quiet - ........... ....

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1055\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	13807
Entropy (8bit):	5.2077828423114045
Encrypted:	false
SSDEEP:
MD5:	9625F3A496DBF5E3E0D2F33D417EDBBF
SHA1:	119376730428812A31B70D58C873866D5307A775
SHA-256:	F80926604E503697247353F56856B31DE0B3FC1319F1C94068363952549CC9B1
SHA-512:	DB91A14FC27E3A62324E024DD44E3B5548AF7E1C021201C3D851BD2F32537885AACFC64ADAE619BAC31B60229D1D5FC653F5301CD7187C69BD0ACECCE817D6A3
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset238 Garamond;}{\f3\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT YAZILIMI L\f1\u304?SANS KO\'aaULLARI\par..\f0 MICROSOFT VISUAL C++ 2015 - 2022 \'c7ALI\f1\'aaMA S\f0\'dcRESI \par..\b0 Bu lisans ko\f1\'baullar\u305?, Microsoft Corporation (veya ya\'baad\u305?\u287?\u305?n\u305?z yere g\f0\'f6re bir ba\f1\u287?l\u305? \'bairketi) ile sizin aran\u305?zda yap\u305?lan s\f0\'f6zle\f1\'bameyi olu\'baturur. Bu ko\'baullar, yukar\u305?da ad\u305? ge\f0\'e7en yaz\f1\u305?l\u305?m i\f0\'e7in ge\'e7erlidir. \f1\'aaartlar, yaz\u305?l\u305?m i\f0\'e7in t\'fcm Microsoft hizmetleri veya g\'fcncelle\f1\'batirmeleri i\f0\'e7in, beraberlerinde farkl\f1\u305? \'baartlar bulunmad\u305?\u287?\u305? s\f0\'fcrece ge\'e7erlidir.\pa

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\1055\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3221
Entropy (8bit):	5.280530692056262
Encrypted:	false
SSDEEP:
MD5:	DEFBEA001DC4EB66553630AC7CE47CCA
SHA1:	90CED64EC7C861F03484B5D5616FDBCDA8F64788
SHA-256:	E5ABE3CB3BF84207DAC4E6F5BBA1E693341D01AEA076DD2D91EAA21C6A6CB925
SHA-512:	B3B7A22D0CDADA21A977F1DCEAF2D73212A4CDDBD298532B1AC97575F36113D45E8D71C60A6D8F8CC2E9DBF18EE1000167CFBF0B2E7ED6F05462D77E0BCA0E90
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] Kurulumu</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.ptal etmek istedi.inizden emin misiniz?</String>.. <String Id="HelpHeader">Kurulum Yard.m.</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [dizin] - y.kler, onar.r, kald.r.r ya da.. dizindeki paketin tam bir yerel kopyas.n. olu.turur. Varsay.lan install de.eridir...../passive \| /quiet - en az d.zeyde istemsiz UI g.sterir ya da hi. UI g.stermez ve.. istem yoktur. Varsay.lan olarak UI ve t.m istemler g.r.nt.lenir...../norestart - yeniden ba.lama denemelerini engeller. Varsay.lan olarak UI yeniden ba.l

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\2052\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	18214
Entropy (8bit):	3.9837154113926356
Encrypted:	false
SSDEEP:
MD5:	D083C7E300928A0C5AEA5ECBD1653836
SHA1:	08F4F1F9F7DFA593BE3977515635967CE7A99E7A
SHA-256:	A808B4933CE3B3E0893504DBEF43EBF90B8B567F94BD6481B6315ED9141E1B11
SHA-512:	8CB3FFAD879BABA36137B7A21B62D9D6C530693F5E16FBB975F3E7C20F1DB5A686F3A6EE406D69B018AA494E4CD185F71B369A378AE3289B8080105157E63FD0
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset134 SimSun;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 Microsoft \f1\'c8\'ed\'bc\'fe\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\f0\par..MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0\f1\'d5\'e2\'d0\'a9\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\'ca\'c7\f0 Microsoft Corporation\f1\'a3\'a8\'bb\'f2\'c4\'fa\'cb\'f9\'d4\'da\'b5\'d8\'b5\'c4\f0 Microsoft \f1\'b9\'d8\'c1\'aa\'b9\'ab\'cb\'be\'a3\'a9\'d3\'eb\'c4\'fa\'d6\'ae\'bc\'e4\'b4\'ef\'b3\'c9\'b5\'c4\'d0\'ad\'d2\'e9\'a1\'a3\'d5\'e2\'d0\'a9\'cc\'f5\'bf\'ee\'ca\'ca\'d3\'c3\'d3\'da\'c9\'cf\'ca\'f6\'c8\'ed\'bc\'fe\'a1\'a3\'d5\'e2\'d0\'a9\'cc\'f5\'bf\'ee\'d2\'b2\'ca\'ca\'d3\'c3\'d3\'da\'d5\'eb\'b6\'d4\'b8\'c3\'c8\'ed\'bc\'fe\'b5\'c4\'c8\'ce\'ba\'ce\f0 Microsoft \f1\'b7\'fe\'ce\'f1\'bb\'f2\'b8\'fc\'d0\'c2\'a3\'ac\'

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\2052\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2978
Entropy (8bit):	6.135205733555905
Encrypted:	false
SSDEEP:
MD5:	3D1E15DEEACE801322E222969A574F17
SHA1:	58074C83775E1A884FED6679ACF9AC78ABB8A169
SHA-256:	2AC8B7C19A5189662DE36A0581C90DBAD96DF259EC00A28F609B644C3F39F9CA
SHA-512:	10797919845C57C5831234E866D730EBD13255E5BF8BA8087D53F1D0FC5D72DC6D5F6945DBEBEE69ACC6A2E20378750C4B78083AE0390632743C184532358E10
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [..] - .......... ..................Install ........../passive \| /quiet - ..... UI ......... UI ... ........ UI ........../norestart - ..................... UI.../log log.txt - ............. %TEMP% ...

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\3082\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	10825
Entropy (8bit):	5.1113252296046126
Encrypted:	false
SSDEEP:
MD5:	873A413D23F830D3E87DAB3B94153E08
SHA1:	24CFC24F22CEF89818718A86F55F27606EB42668
SHA-256:	ABC11BB2B04DFF6AFE2D4D4F40D95A7D62E5AF352928AF90DAA3DADE58DD59BD
SHA-512:	DC1ECCB5CC4D3047401E2BC31F5EB3E21C7881C02744A2E63C10D3C911D1158DCFAC023988E873C33DC381C989304FE1D3CB27ED99D7801285C4C378553CD821
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 T\'c9RMINOS DE LICENCIA DEL SOFTWARE DE MICROSOFT\par..MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0 Los t\'e9rminos de esta licencia son un contrato entre Microsoft Corporation (o, en funci\'f3n de donde viva, una de las sociedades del grupo) y usted. Se aplican al software mencionado anteriormente. Los t\'e9rminos tambi\'e9n se aplican a los servicios o actualizaciones de software de Microsoft, excepto en la medida en que sus t\'e9rminos sean diferentes.\par..\b SI USTED CUMPLE LOS PRESENTES T\'c9RMINOS DE ESTA LICENCIA, DISPONDR\'c1 DE LOS DERECHOS QUE A CONTINUACI\'d3N SE DESCRIBEN.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb1

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\3082\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3265
Entropy (8bit):	5.0491645049584655
Encrypted:	false
SSDEEP:
MD5:	47F9F8D342C9C22D0C9636BC7362FA8F
SHA1:	3922D1589E284CE76AB39800E2B064F71123C1C5
SHA-256:	9CBB2B312C100B309A1B1495E84E2228B937612885F7A642FBBD67969B632C3A
SHA-512:	E458DF875E9B0622AEBE3C1449868AA6A2826A1F851DB71165A872B2897CF870CCF85046944FF51FFC13BB15E54E9D9424EC36CAF5A2F38CE8B7D6DC0E9B2363
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instalaci.n de [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.Est. seguro de que desea cancelar la operaci.n?</String>.. <String Id="HelpHeader">Ayuda de configuraci.n</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - instala, repara, desinstala o.. crea una copia local completa del paquete en el directorio. La opci.n predeterminada es la instalaci.n...../passive \| /quiet - muestra una IU m.nima sin solicitudes o no muestra ninguna IU ni.. solicitud. De forma predeterminada, se muestran la IU y todas las solicitudes...../norestart - elimina cualquier intento

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\BootstrapperApplicationData.xml

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (633), with CRLF line terminators
Category:	dropped
Size (bytes):	15190
Entropy (8bit):	3.738616200218003
Encrypted:	false
SSDEEP:
MD5:	2EE103493F085F0F7C635A430F36E0A0
SHA1:	6148F7B7DF3EDD7FF9E5D2C4B92B93E91223919A
SHA-256:	A884D7460C9E2814382B11B67A63B920E01E711BC7ED61C2D4F2A6AB8FCCA389
SHA-512:	4F870368DE31FBF2026A9390445D093F6A098DF510C6E409564B4AA32E836A41DE4304787824A3B3EFA9A56B05CAC2BF3BB49E3CA8B8BE3D1B1EBFF1B647A29A
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.a.l.C.o.n.d.i.t.i.o.n. .C.o.n.d.i.t.i.o.n.=.".V.e.r.s.i.o.n.N.T. .&.g.t.;.=. .v.6...1.". .M.e.s.s.a.g.e.=.".[.W.i.x.B.u.n.d.l.e.N.a.m.e.]. .c.a.n. .o.n.l.y. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .W.i.n.d.o.w.s. .7. .a.n.d. .n.e.w.e.r. .p.l.a.t.f.o.r.m.s...". ./.>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=.".M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.5.-.2.0.2.2. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e. .(.x.6.4.). .-. .1.4...4.2...3.4.4.3.3.". .L.o.g.P.a.t.h.V.a.r.i.a.b.l.e.=.".W.i.x.B.u.n.d.l.e.L.o.g.". .C.o.m.p.r.e.s.s.e.d.=.".y.e.s.". .I.d.=.".{.8.0.4.e.7.d.6.6.-.c.c.c.2.-.4.c.1.2.-.8.4.b.a.-.4.7.6.d.a.3.1.d.1.0.3.d.}.". .U.p.g.r.a.d.e.C.o.d.e.=.".{.C.1.4.6.E.

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	9235
Entropy (8bit):	5.167332119309966
Encrypted:	false
SSDEEP:
MD5:	04B33F0A9081C10E85D0E495A1294F83
SHA1:	1EFE2FB2D014A731B752672745F9FFECDD716412
SHA-256:	8099DC3CF9502C335DA829E5C755948A12E3E6DE490EB492A99DEB673D883D8B
SHA-512:	D1DBED00DF921169DD61501E2A3E95E6D7807348B188BE9DD8FC63423501E4D848ECE19AC466C3CACFCCC6084E0EB2F457DC957990F6F511DF10FD426E432685
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT SOFTWARE LICENSE TERMS\par..MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0 These license terms are an agreement between Microsoft Corporation (or based on where you live, one of its affiliates) and you. They apply to the software named above. The terms also apply to any Microsoft services or updates for the software, except to the extent those have different terms.\par..\b IF YOU COMPLY WITH THESE LICENSE TERMS, YOU HAVE THE RIGHTS BELOW.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\sa120\sl240\slmult1\tx360 INSTALLATION AND USE RIGHTS. \b0\par....\pard{\pntext\f2\'B7\tab}{\*\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\f

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\logo.png

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1861
Entropy (8bit):	6.868587546770907
Encrypted:	false
SSDEEP:
MD5:	D6BD210F227442B3362493D046CEA233
SHA1:	FF286AC8370FC655AEA0EF35E9CF0BFCB6D698DE
SHA-256:	335A256D4779EC5DCF283D007FB56FD8211BBCAF47DCD70FE60DED6A112744EF
SHA-512:	464AAAB9E08DE610AD34B97D4076E92DC04C2CDC6669F60BFC50F0F9CE5D71C31B8943BD84CEE1A04FB9AB5BBED3442BD41D9CB21A0DD170EA97C463E1CE2B5B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...@...@.............sRGB.........gAMA......a.....PLTE].q^.r_.r_.s`.s`.s`.ta.ta.ub.ub.vc.vd.vd.vd.we.we.xe.xg.yg yg zh zh"zi"{j#\|i${j$\|n~n.n,.o,.p..q0.r2.s3.t5.x;.x<.y>.z?.\|B.~C.}E..F..F..H..I..J..L..O..P..W..Y..^..a..c..g..i..q..r..}.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S......pHYs..%...%....^.....tEXtSoftware.Paint.NET v3.5.100.r.....IDATXG..iW.@...EJ.$M...`AEpG..7TpWT@\.."....(..(.._;...di:9.c>q..g....T...._...-....F..+..w.

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2952
Entropy (8bit):	5.052095286906672
Encrypted:	false
SSDEEP:
MD5:	FBFCBC4DACC566A3C426F43CE10907B6
SHA1:	63C45F9A771161740E100FAF710F30EED017D723
SHA-256:	70400F181D00E1769774FF36BCD8B1AB5FBC431418067D31B876D18CC04EF4CE
SHA-512:	063FB6685EE8D2FA57863A74D66A83C819FE848BA3072B6E7D1B4FE397A9B24A1037183BB2FDA776033C0936BE83888A6456AAE947E240521E2AB75D984EE35E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29" />.... <String Id="Caption">[WixBundleName] Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installs, repairs, uninstalls or.. creates a complete local copy of the bundle in directory. Install is the default...../passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt before restart.../log log.txt - logs to a specific file. B

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\thm.xml

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8332
Entropy (8bit):	5.184632608060528
Encrypted:	false
SSDEEP:
MD5:	F62729C6D2540015E072514226C121C7
SHA1:	C1E189D693F41AC2EAFCC363F7890FC0FEA6979C
SHA-256:	F13BAE0EC08C91B4A315BB2D86EE48FADE597E7A5440DCE6F751F98A3A4D6916
SHA-512:	CBBFBFA7E013A2B85B78D71D32FDF65323534816978E7544CA6CEA5286A0F6E8E7E5FFC4C538200211F11B94373D5658732D5D8AA1D01F9CCFDBF20F154F1471
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="485" Height="300" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.... <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png" Visible="yes"/>.. <Text X="80" Y="11" Width="-11" Heig

C:\Users\user\AppData\Local\Temp\{9CC2C60B-9688-4E94-8D9D-BA74225F9E67}\.ba\wixstdba.dll

Download File

Process:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	220512
Entropy (8bit):	6.754483649907534
Encrypted:	false
SSDEEP:
MD5:	F68F43F809840328F4E993A54B0D5E62
SHA1:	01DA48CE6C81DF4835B4C2ECA7E1D447BE893D39
SHA-256:	E921F69B9FB4B5AD4691809D06896C5F1D655AB75E0CE94A372319C243C56D4E
SHA-512:	A7A799ECF1784FB5E8CD7191BF78B510FF5B07DB07363388D7B32ED21F4FDDC09E34D1160113395F728C0F4E57D13768A0350DBDB207D9224337D2153DC791E1
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N............e......e..............................e......e......e.............................d....................Rich............PE..L......e...........!.........................0...............................@............@.............................................................`W... ..x.......T...........................8...@............0..X............................text............................... ..`.rdata.......0....... ..............@..@.data...............................@....rsrc...............................@..@.reloc..x.... ......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\cmdline.out

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	548918
Entropy (8bit):	2.2673168244353743
Encrypted:	false
SSDEEP:
MD5:	15637A90593889F24EB9DF770633A36B
SHA1:	25DE1303B0742BBB9E73869147B06BD967B34CDE
SHA-256:	5C3B81FB88EF11CFBC40DD55074742920D477BB22BB4B665C82A508E3DC6BEEA
SHA-512:	6C6B6B81DED5B83101A8021F8DF2D424E9522F7E3FEA88D99DBCB69407B9CC24F6D657563AB6B390236517EF2AC6CF0CE6DE6C8E3F5D16AEFED743BE261E9886
Malicious:	false
Reputation:	low
Preview:	--2025-01-13 02:13:01-- https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe..Resolving www.danielgm.net (www.danielgm.net)... 162.241.226.205..Connecting to www.danielgm.net (www.danielgm.net)\|162.241.226.205\|:443... connected...HTTP request sent, awaiting response... 200 OK..Length: 355083480 (339M) [application/x-msdownload]..Saving to: 'C:/Users/user/Desktop/download/CloudCompare_v2.14.alpha_setup_x64.exe'.... 0K .......... .......... .......... .......... .......... 0% 280K 20m39s.. 50K .......... .......... .......... .......... .......... 0% 999K 13m13s.. 100K .......... .......... .......... .......... .......... 0% 1010K 10m43s.. 150K .......... .......... .......... .......... .......... 0% 862K 9m43s.. 200K .......... .......... .......... .......... .......... 0% 1.74M 8m25s.. 250K .......... .......... .......... .......... .......... 0% 1.11M 7m52s.. 300K .......... .......... .......... .......... .......... 0% 1.14M 7m2

C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe

Download File

Process:	C:\Windows\SysWOW64\wget.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	355083480
Entropy (8bit):	7.999789709819808
Encrypted:	true
SSDEEP:
MD5:	4FA9171C45161772572CB136422EA7FD
SHA1:	07E5617C3EFE1AD8AC181043C8F2D4C1B665FF38
SHA-256:	2E51AC90FDA81441AB9671598E2ACD169E001DC2A969E3331FDD38C02B0AFEC8
SHA-512:	A357E2F286B6512D9CAE295B21292595DC59067D89D159A8473CE5FA80247D84E50A407BCD45166B6D42853DBDBC635244B7453292C5D7CED25F3BEF2F9BA8F0
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...n.._.................P...........^.......p....@..................................a*...@......@...................@....... ..6....p...H..........X.)..&...................................`......................."..D....0.......................text....6.......8.................. ..`.itext.......P.......<.............. ..`.data....7...p...8...T..............@....bss.....m...............................idata..6.... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc....H...p...H..................@..@....................................@..@........................................................

C:\Windows\Installer\52ca56.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40664., Template: x64;1033, Revision Number: {F8853551-4D30-4D6A-B36A-93EFAD4EEE03}, Create Time/Date: Thu May 25 00:06:22 2017, Last Saved Time/Date: Thu May 25 00:06:22 2017, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.2804.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.7941100920635975
Encrypted:	false
SSDEEP:
MD5:	87B74C694F295830FFE516BA20DE0B93
SHA1:	E6996D47BB76AD25954B793F73211524490F55A9
SHA-256:	E88D0915814E622CD1DECA849EFA23A0D58D5D756BE44EBBB4D460D3DAC9E816
SHA-512:	D0FD7F8C8964A99CE7A9D187640ACDBFF4CA3D16F02E44696706D6107B58890E763A18857BEC2B94F92CA559510FEA0AE5515CE3DE20AA4371AEBB38006C05EB
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\52ca5c.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40664., Template: x64;1033, Revision Number: {F8853551-4D30-4D6A-B36A-93EFAD4EEE03}, Create Time/Date: Thu May 25 00:06:22 2017, Last Saved Time/Date: Thu May 25 00:06:22 2017, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.2804.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.7941100920635975
Encrypted:	false
SSDEEP:
MD5:	87B74C694F295830FFE516BA20DE0B93
SHA1:	E6996D47BB76AD25954B793F73211524490F55A9
SHA-256:	E88D0915814E622CD1DECA849EFA23A0D58D5D756BE44EBBB4D460D3DAC9E816
SHA-512:	D0FD7F8C8964A99CE7A9D187640ACDBFF4CA3D16F02E44696706D6107B58890E763A18857BEC2B94F92CA559510FEA0AE5515CE3DE20AA4371AEBB38006C05EB
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\52ca5d.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664., Template: x64;1033, Revision Number: {A1135D47-2E01-4DE6-AB19-25679EC5D3CF}, Create Time/Date: Thu May 25 00:06:24 2017, Last Saved Time/Date: Thu May 25 00:06:24 2017, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.2804.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.852155639838542
Encrypted:	false
SSDEEP:
MD5:	4F782799F84CD006F7F1C750AFB04D8C
SHA1:	0CD219D326FD40665D2F1B22569E2517792EDFD9
SHA-256:	8909E5C1D917064983595A4E4717F758C2A8DF8F59D7B31A5B79B2F95BD8F7CC
SHA-512:	CFDDAD551AA5A35B032B7006B167FD322AFF46EC8A2934632C087882B24404EE48083EE38B9110ADD9846880B1AE0BED136BB21AE751E1D3CDE9DC27EAED5915
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\52ca64.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664., Template: x64;1033, Revision Number: {A1135D47-2E01-4DE6-AB19-25679EC5D3CF}, Create Time/Date: Thu May 25 00:06:24 2017, Last Saved Time/Date: Thu May 25 00:06:24 2017, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.2804.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.852155639838542
Encrypted:	false
SSDEEP:
MD5:	4F782799F84CD006F7F1C750AFB04D8C
SHA1:	0CD219D326FD40665D2F1B22569E2517792EDFD9
SHA-256:	8909E5C1D917064983595A4E4717F758C2A8DF8F59D7B31A5B79B2F95BD8F7CC
SHA-512:	CFDDAD551AA5A35B032B7006B167FD322AFF46EC8A2934632C087882B24404EE48083EE38B9110ADD9846880B1AE0BED136BB21AE751E1D3CDE9DC27EAED5915
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\52ca65.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2022 X64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.42.34433., Template: x64;1033, Revision Number: {A75B920C-55CD-4531-932F-CB4C539C41F8}, Create Time/Date: Tue Oct 29 06:50:14 2024, Last Saved Time/Date: Tue Oct 29 06:50:14 2024, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.367262947705725
Encrypted:	false
SSDEEP:
MD5:	09042BA0AF85F4873A68326AB0E704AF
SHA1:	F08C8F9CB63F89A88F5915E6A889B170CE98F515
SHA-256:	47CCEB26DD7B78F0D3D09FDDC419290907FE818979884B2192C834034180E83B
SHA-512:	1C9552A8BF478F9EDDE8ED67A8F40584A757C66AAF297609B4F577283469287992C1F84EBE15DF4DF05B0135E4D67C958A912738F4814440F6FD77804A2CFA7D
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\52ca75.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2022 X64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.42.34433., Template: x64;1033, Revision Number: {A75B920C-55CD-4531-932F-CB4C539C41F8}, Create Time/Date: Tue Oct 29 06:50:14 2024, Last Saved Time/Date: Tue Oct 29 06:50:14 2024, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.367262947705725
Encrypted:	false
SSDEEP:
MD5:	09042BA0AF85F4873A68326AB0E704AF
SHA1:	F08C8F9CB63F89A88F5915E6A889B170CE98F515
SHA-256:	47CCEB26DD7B78F0D3D09FDDC419290907FE818979884B2192C834034180E83B
SHA-512:	1C9552A8BF478F9EDDE8ED67A8F40584A757C66AAF297609B4F577283469287992C1F84EBE15DF4DF05B0135E4D67C958A912738F4814440F6FD77804A2CFA7D
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\52ca76.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2022 X64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2022 X64 Additional Runtime - 14.42.34433., Template: x64;1033, Revision Number: {E04E511C-7D1F-4263-AB6A-F816392FD4D7}, Create Time/Date: Tue Oct 29 06:55:02 2024, Last Saved Time/Date: Tue Oct 29 06:55:02 2024, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.372377887079137
Encrypted:	false
SSDEEP:
MD5:	351D8E8C804F6C6AAB4C718977B1817D
SHA1:	1B680E5E2ED548E5636F9D656C49C87CF9A70DA8
SHA-256:	CF584E5132EF3766A088F824BD038494713A7168CDDDD44E3F8C4AD581E2206E
SHA-512:	D0613C6B1A72C73013C0519619C557811A1D20FCDDC8361D391A31FC4AA9C70173B907957BABB049067111427A81E48A82E5467A15DAE8BEBB55B048993C93A4
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\52ca89.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2022 X64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2022 X64 Additional Runtime - 14.42.34433., Template: x64;1033, Revision Number: {E04E511C-7D1F-4263-AB6A-F816392FD4D7}, Create Time/Date: Tue Oct 29 06:55:02 2024, Last Saved Time/Date: Tue Oct 29 06:55:02 2024, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.372377887079137
Encrypted:	false
SSDEEP:
MD5:	351D8E8C804F6C6AAB4C718977B1817D
SHA1:	1B680E5E2ED548E5636F9D656C49C87CF9A70DA8
SHA-256:	CF584E5132EF3766A088F824BD038494713A7168CDDDD44E3F8C4AD581E2206E
SHA-512:	D0613C6B1A72C73013C0519619C557811A1D20FCDDC8361D391A31FC4AA9C70173B907957BABB049067111427A81E48A82E5467A15DAE8BEBB55B048993C93A4
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1B27.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	6636
Entropy (8bit):	5.7629454880994775
Encrypted:	false
SSDEEP:
MD5:	6A346BF77585D7A3C1B69A0CFC67ABD7
SHA1:	1B943D5BF4FCB0595E64D6602C8942D1A8C11A92
SHA-256:	5CED64775F90A573A075438645660831A741F668ACD1A2BDC271606A41C34A1E
SHA-512:	A57665C95F03B94CFFA24298AC0BA40B7DFCBBC078AD9D8828C65241BEF8636F1C1DF8475213D088048B45A553C7FC884027FB7FCD61C2B9E8FF1A0C05A7F518
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@S.-Z.@.....@.....@.....@.....@.....@......&.{D5D19E2F-7189-42FE-8103-92CD1FA457C2};.Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532..vc_runtimeMinimum_x64.msi.@.....@..$..@.....@........&.{4E8C8C37-B448-4BB0-8A8B-F640B3239F71}.....@.....@.....@.....@.......@.....@.....@.......@....;.Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........InstallInitialize......&.{36F68A90-239C-34DF-B58C-64B30153CE35}....&.{4E8C8C37-B448-4BB0-8A8B-F640B3239F71}c.&.{36F68A90-239C-34DF-B58C-64B30153CE35}............ProcessComponents..Updating component registration.....@.....@.....@.]....&.{3639FCCA-5969-316D-AC18-E0C6B2B532E9}&.{D5D19E2F-7189-42FE-8103-92CD1FA457C2}..&.{3639FCCA-5969-316D-AC18-E0C6B2B532E9}...@.....@......&.{D2959D22-4DB7-32AF-A1B0-8405C4221749}&.{D5D19E2F-7189-42FE-8103-92CD1FA457C2}..&.{D2959D22-4DB7-32AF-A1B0-8405C4221749}...@.....@......&.{B33

C:\Windows\Installer\MSI1C70.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	11166
Entropy (8bit):	5.662782640934212
Encrypted:	false
SSDEEP:
MD5:	DA6BF9A23F0C6B64DEF3546A4E4206BA
SHA1:	CC800ABF158DC84B7C0F0E3B6CECC9059F246592
SHA-256:	3BAD773C2FAD9F237695DFFC9098F949EB95659E04B72B25B67804A4DCDD82E5
SHA-512:	7212427FFD26FE975EFC88256041255F7E1A27456F1E728058CDFF314A4A837D6B0E4E88CE9ED26EBD8829F499DDE138F0FB3855D39A90F65FC6D81820D6F11B
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@S.-Z.@.....@.....@.....@.....@.....@......&.{382F1166-A409-4C5B-9B1E-85ED538B8291};.Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.42.34433..vc_runtimeMinimum_x64.msi.@.....@..*..@.....@........&.{A75B920C-55CD-4531-932F-CB4C539C41F8}.....@.....@.....@.....@.......@.....@.....@.......@....;.Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.42.34433......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{3639FCCA-5969-316D-AC18-E0C6B2B532E9}@.02:\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64\Version.@.......@.....@.....@......&.{D2959D22-4DB7-32AF-A1B0-8405C4221749}@.22:\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64\Version.@.......@.....@.....@......&.{B33258FD-750C-3B42-8BE4-535B48E97DB4}$.C:\Windows\system32\vcruntime140.dll.@.......@.....@.....@......&.{4AF15CBB-F5C1-4468-A694-C5A03A2238D5},.C:\Windows\system32\vcrunti

C:\Windows\Installer\MSI2366.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	8325
Entropy (8bit):	5.769469785448399
Encrypted:	false
SSDEEP:
MD5:	C653C2B7C6FF28FE11F1D5CB233F098D
SHA1:	2563B83F549719093759704ADED94A117C472B17
SHA-256:	AF7635193A31F7829BD8084CF6EB70A3F236DE387BA6454E2C8F047034B8B35F
SHA-512:	2287C0B3F5DF88787772FD1DDDCA2B9F9EDCB6F563517BF6AA925A2E9C3D9CB9E679C3FC2A2199636489C9AE817AD118D17524A407FDAE63066E91B2B4861E3A
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@T.-Z.@.....@.....@.....@.....@.....@......&.{0025DD72-A959-45B5-A0A3-7EFEB15A8050}>.Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532..vc_runtimeAdditional_x64.msi.@.....@..$..@.....@........&.{DD2B5EB1-E08E-45CD-8D47-2D0457D64BA3}.....@.....@.....@.....@.......@.....@.....@.......@....>.Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........InstallInitialize......&.{9B0BAA88-E15F-3A1F-ACC0-B206E9DDF71C}....&.{DD2B5EB1-E08E-45CD-8D47-2D0457D64BA3}c.&.{9B0BAA88-E15F-3A1F-ACC0-B206E9DDF71C}............ProcessComponents..Updating component registration.....@.....@.....@.]....&.{3639FCCA-5969-316D-AC18-E0C6B2B532E9}&.{0025DD72-A959-45B5-A0A3-7EFEB15A8050}..&.{3639FCCA-5969-316D-AC18-E0C6B2B532E9}...@.....@......&.{D2959D22-4DB7-32AF-A1B0-8405C4221749}&.{0025DD72-A959-45B5-A0A3-7EFEB15A8050}..&.{D2959D22-4DB7-32AF-A1B0-8405C4221749}...@.....@...

C:\Windows\Installer\MSI258A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	10152
Entropy (8bit):	5.679682019631511
Encrypted:	false
SSDEEP:
MD5:	C47850CA6BAD99E0B969EEE0E9F05C73
SHA1:	84B6B00DECB2B327AC3D22811EC95007C010D4E2
SHA-256:	B616C520FCE6BF6151FABB5168F0CCC2375E9FA22A950EC724E4772AA65DBAE0
SHA-512:	D4045CCDD47195E0EB5F97EFD8BD6767C638FD603C19369A9FC19DBA04C953A1030600F2B72D75BE15003EE534F00E2F5D40CF29B81688F44B4230F4AD3D6D5D
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@T.-Z.@.....@.....@.....@.....@.....@......&.{E1902FC6-C423-4719-AB8A-AC7B2694B367}>.Microsoft Visual C++ 2022 X64 Additional Runtime - 14.42.34433..vc_runtimeAdditional_x64.msi.@.....@..*..@.....@........&.{E04E511C-7D1F-4263-AB6A-F816392FD4D7}.....@.....@.....@.....@.......@.....@.....@.......@....>.Microsoft Visual C++ 2022 X64 Additional Runtime - 14.42.34433......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{3639FCCA-5969-316D-AC18-E0C6B2B532E9}@.02:\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64\Version.@.......@.....@.....@......&.{D2959D22-4DB7-32AF-A1B0-8405C4221749}@.22:\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64\Version.@.......@.....@.....@......&.{99A922E3-648F-3C37-8AE6-78232F317B1E}..C:\Windows\system32\mfc140.dll.@.......@.....@.....@......&.{8924DA15-E863-388D-A06B-E7A3931AD77B}..C:\Windows\system32\mfc1

C:\Windows\Installer\MSICCC7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	6757
Entropy (8bit):	5.765258202163544
Encrypted:	false
SSDEEP:
MD5:	B6C2E826959836EFF8F8CA27954EFA69
SHA1:	0B680EB3A0CE4D784D8F7AF611F79463C1A1E884
SHA-256:	96912303447C7CC468B9AD7FDAED4BF44404B420C618EB3C3EB5BEB6BDC6CCF8
SHA-512:	717FC2BE74503AC0CBF913A030D55A970D23253FEC27D762D8C98C55E5E0F88903F1077D74808E12D1D0885DD29E95926416E8DBE71B7DC6ACD2862E669B60F3
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@I.-Z.@.....@.....@.....@.....@.....@......&.{53CF6934-A98D-3D84-9146-FC4EDF3D5641}:.Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40664..vc_runtimeMinimum_x64.msi.@.....@....@.....@........&.{F8853551-4D30-4D6A-B36A-93EFAD4EEE03}.....@.....@.....@.....@.......@.....@.....@.......@....:.Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40664......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{BC1F4291-6F0A-38EB-984E-C2E555837FE1}@.02:\SOFTWARE\Microsoft\VisualStudio\12.0\VC\Runtimes\x64\Version.@.......@.....@.....@......&.{E5B92048-5859-4AF1-AEAD-B97EBF00B087} .C:\Windows\system32\msvcr120.dll.@.......@.....@.....@......&.{570C624B-D57C-4CD1-9013-1B80C800093B} .C:\Windows\system32\msvcp120.dll.@.......@.....@.....@......&.{14E8634F-8AEA-4CD1-AC48-BEBFDA18523A}#.C:\Windows\system32\vccorlib120.dll.@.......@.....@.....@......&.

C:\Windows\Installer\MSID3DC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	10712
Entropy (8bit):	5.7249318351695715
Encrypted:	false
SSDEEP:
MD5:	C0D8DCB0E06AEBA067487022B9802A78
SHA1:	8EE5A15EBADF4EE18B1DCAF06ADC839D2C0B5C2F
SHA-256:	44542306DE2FC3C84E9A36BE09F66BB88D117F9A7E220EE5E0343A36863C9979
SHA-512:	32D458A8B21D362A5405242986265395E043DF3BF53153C286776EA15801C3D34C282465F687ACB5240A4AD75C90BBA1BE48C3F3C1338052C79B3C073D953732
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@J.-Z.@.....@.....@.....@.....@.....@......&.{010792BA-551A-3AC0-A7EF-0FAB4156C382}=.Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664..vc_runtimeAdditional_x64.msi.@.....@....@.....@........&.{A1135D47-2E01-4DE6-AB19-25679EC5D3CF}.....@.....@.....@.....@.......@.....@.....@.......@....=.Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{191E6DE4-E7B2-3CE9-B48B-25D0FFF3D88E}@.02:\SOFTWARE\Microsoft\VisualStudio\12.0\VC\Runtimes\x64\Version.@.......@.....@.....@......&.{E70078E7-D25B-421C-A415-0AB472053F72}..C:\Windows\system32\mfc120.dll.@.......@.....@.....@......&.{7D2EA505-A879-4E71-8632-F3DE9B679CE6}..C:\Windows\system32\mfc120u.dll.@.......@.....@.....@......&.{1F74928D-AA17-468C-A7D7-6A730A8DB25B}..C:\Windows\system32\mfcm120.dll.@.......@.....@.....@......

C:\Windows\Installer\SourceHash{010792BA-551A-3AC0-A7EF-0FAB4156C382}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.208365135184898
Encrypted:	false
SSDEEP:
MD5:	BDDBC425D7254A582AC1BD37BC261FD7
SHA1:	3F297B99696B1380D9726AB14307744889A64999
SHA-256:	706086C4DA4E1B3B31F262C6D1E071EC371C05AA5E4EE066EE74C5373595960D
SHA-512:	8A6233FABC5AA46F11F18855C26DCBF168408425F77CD40111F9F12D63A72B5A8A942D088A003C3C8521B75E76558C7A73589C0ED07CF589F99F32E70B1AFA17
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{382F1166-A409-4C5B-9B1E-85ED538B8291}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.2062378611292464
Encrypted:	false
SSDEEP:
MD5:	BF966F1948E194FEFB004B0A5A7D63FD
SHA1:	60EE5B72348138521A9CC482F33D286951880618
SHA-256:	7338DA4C73795E52DB5DAE0B2A365DF46366421E021B31FA6889D6B466FC8A61
SHA-512:	B852E16CA2E8BB825BC19BAB3530B25671A9CB11BB62574831B958E5A1EDDBD126D66C04AAAF3D8382864F40B0C0918E66D91F172DD5168A234ABE1CBE232203
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{53CF6934-A98D-3D84-9146-FC4EDF3D5641}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.2067658949809004
Encrypted:	false
SSDEEP:
MD5:	5C233C42633F48C4D21923FAB5CE7C5B
SHA1:	F592680297BE122AF4667D6441D73DFDEC48784A
SHA-256:	4737166A4CCDC66A474D3A165F520798295CEDFA37A2EAB569C5DF26DB81A887
SHA-512:	43D01C0C376CBAB487A4DA26E2F19183C91F7A07C730B0A184CC9B2570432E79D84F06203C24EE2E5C09C4DE3FC1EC4CDDDDF88238191904BF6D30DC96A00040
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{E1902FC6-C423-4719-AB8A-AC7B2694B367}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.2075235681253338
Encrypted:	false
SSDEEP:
MD5:	27486F00C18469C623A3C5F99C8EF8B0
SHA1:	0CD9DEABB10E89220748EDBC2CFE96DD3F75E404
SHA-256:	E5734792C4DEACDB4975532D9E49818FACBCB770104BD12BB608CE94127A7F5F
SHA-512:	D12F97FA40DE49F437C32DE91331C6F924A5424ACCAB4287132247BEF1D8B55F668B2489E3A73D6B14F653366A0EA8B01ABC7B0C2BB232B746485066EE4382E1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5698541803775374
Encrypted:	false
SSDEEP:
MD5:	986D1D88188EE69706E52C1706991110
SHA1:	734027C715328789BD55026F3E2F9EC385F2CE2C
SHA-256:	178F4539FFB188162A31C5E917F004D184F4A2EFF07C9CAE075344D2CE7A4E4C
SHA-512:	489EBEE5A5BD78D221E71D932B543BCA48BFDC8E703177A10A838E46B479F60899CE52653815CDC9BF4011CE6FB35970E4D327751291B42DAE08E9F4345B7411
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375165954006486
Encrypted:	false
SSDEEP:
MD5:	D44D5B63457B4200E106C12AEF75DCD5
SHA1:	CA5DEBC50CF07E4DB78BBB760C2512438453CB32
SHA-256:	F66033ED03C0628F9C2B55F8910C6BC3979EFC491C4BC1A3FE771E44682C1696
SHA-512:	619BC34AA35745ACF09E07FB2AC016011AF6F4EE2C37ACE1920F109419A7EDB9B14E99027ED27A5D2B859F82EEAB6744824EF4906F25E2D840669748673EB12D
Malicious:	false
Reputation:	low
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\System32\concrt140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	322640
Entropy (8bit):	6.349528011750681
Encrypted:	false
SSDEEP:
MD5:	8FC1C2F2EBB7E46DF30ECD772622B0BC
SHA1:	168BE3B4545DC617B99D0598565A03C0366820E4
SHA-256:	E2E4609C569C69F7B1686F6D0E81CE62187AC5DF05E0247954500053B3C3DE3F
SHA-512:	6F3EC746EC10334692E930B515A37F3D5BD342CA60A49C4298924BE933262D7D782DE8A11D4F865A30A5AA22C5515059E3E39A92A61AE5FAE53622CEAA7D5C4B
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i.H...H...H.......J...A...B...Y\|..O...H.......Y\|..L...Y\|..@...Y\|......Y\|..I...Y\|..I...Y\|..I...RichH...........PE..d....i............" ...*.............................................................?....`A.............................................M...................p...5......PP......p...."..p...........................@!..@...............0............................text............................... ..`.rdata...H.......J..................@..@.data....?...0...:..................@....pdata...5...p...6...V..............@..@.rsrc...............................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................

C:\Windows\System32\mfc120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5608096
Entropy (8bit):	6.663647971077495
Encrypted:	false
SSDEEP:
MD5:	47999145F1B48D94E732420A5F3E405C
SHA1:	29A8A95C4F8824CCD7BC14CC4CADA0545A8DFEF1
SHA-256:	FB83E940B281947CC8659611EF6AFA75C21A6626B1E70565D0A573F22A48B55E
SHA-512:	F13A52E9444AEE274092BE544C8558ED1BDF58046C983AF49815C6D75C4FD41A361917F3CFC07B3FCAEA69A628D23E7684E4BE939904CE473FC9A4D771355733
Malicious:	false
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........o.d...7...7...7..67...7..)7...7..(7...7..77...7.\$7...7<.>7...7.\.7...7.\.7...7..27...7...7...7.\&7...7.\.77..7.\%7...7.\"7...7.\'7...7Rich...7........................PE..d....&Y.........." ........d+.......(...................................... V......:V...`..........................................%:.......;.......?.......<.l:...TU..>....T.pl..p...............................3.p....................:......................text............................. ..`.rdata..$.........................@..@.data...xj...`;......@;.............@....pdata..l:....<..<....<.............@..@.rsrc.........?......N>.............@..@.reloc..pl....T..n....S.............@..B........................................................................................................................................................................................................

C:\Windows\System32\mfc120chs.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46248
Entropy (8bit):	6.136845158865701
Encrypted:	false
SSDEEP:
MD5:	7F9A33DECCBDB7E47C8AB3B748EC4144
SHA1:	88A78F8494489CC12907F530860B3299304DB1FC
SHA-256:	64920E61862E4FEEAF321D2A3F80EAB3438E8CDE38089DBD6AE1AD045F750B2C
SHA-512:	67B329CF7D6AAA3C4DDBB02087F8BCC5B032687F616C8A4A4031FC7F38DC00DD43E96B98AE7C441B48184D3B4323144511379041E94A567945E85F31D2C5676E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U\|.U\|.U\|.X...T\|.X...T\|.RichU\|.................PE..d.....&Y.........." .........t......................................................o.....`.............................................................(s...........v...>...........................................................................................rsrc...(s.......t..................@..@............................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120cht.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46248
Entropy (8bit):	6.179175448870857
Encrypted:	false
SSDEEP:
MD5:	35BDE055469E774C815C7EFF219A08EE
SHA1:	31E02484E626C8475286E8E5DDFCEA2ECD28A279
SHA-256:	E97AD479A4139ADAC6399655551348BFC289D84B1B3F22B2415F1D26BC899BDF
SHA-512:	4810930577159A78D66708E3077DF1794F0C7ADCAD19A9114439ECACD2E8499973BFB632590D8202EA0C087110A70B1A23AEBE9AB34387C4DD259C3543CE36D4
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U\|.U\|.U\|.X...T\|.X...T\|.RichU\|.................PE..d.....&Y.........." .........t......................................................A'....`.............................................................Ps...........v...>...........................................................................................rsrc...Ps.......t..................@..@............................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120deu.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74920
Entropy (8bit):	4.756491883843184
Encrypted:	false
SSDEEP:
MD5:	6B2530874F3E108A4F98DB91446F0724
SHA1:	8E0D8707AEA0ED3DA2EA5CB72CAF6D3A6399259C
SHA-256:	B2772DB0688B3C86134A1969BAE17FD6AAE1C8240A1F5910C0A724522ABCC581
SHA-512:	D29FB6375A1E85CEC3D09C28A8FD121A1A155AE1B51C7D3D6CB2B6C9F5F4AF73EA90CBFF9E8F80A16F90AB66CA907838D4D662300112F8D6110146C4A36EFBB2
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U\|.U\|.U\|.X...T\|.X...T\|.RichU\|.................PE..d.....&Y.........." ......................................................................`.............................................................P................>...........................................................................................rsrc...P...........................@..@............................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120enu.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65192
Entropy (8bit):	4.903639829726367
Encrypted:	false
SSDEEP:
MD5:	740ABD194F5E72E3980CF622E6CB41AF
SHA1:	FB52B9B8ED399AC267C7117A457945305082FF73
SHA-256:	40A552625932701B7D300E36D46B79A352256406F8FE1046D66B8DA06636E421
SHA-512:	0D8226C53E5F3FCF0009EC6CD9B518E276040CE0B367289C118D8FD623440A0583387B2753776BEB83D6588E982DA4093627FAA0A22443DD36868766799DD8B0
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U\|.U\|.U\|.X...T\|.X...T\|.RichU\|.................PE..d.....&Y.........." ......................................................................`..............................................................................>...........................................................................................rsrc...............................@..@............................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120esn.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	73896
Entropy (8bit):	4.729774877721125
Encrypted:	false
SSDEEP:
MD5:	D78CE649777F9E35D2F014A7074BAB72
SHA1:	1739E8362581CD9EB2BA36746823A19718EE8BB8
SHA-256:	418C8454E90E20357A91D0D3256C2E944C8578F65B5DE169823037CAAE1DAFC6
SHA-512:	AAB61F05D05BB9E8CC1523DCB39D8F429A0686194658C41484425B588877BD96A920C07A52113382363F0CDC8BD25CDA60932EF8F074FAEEDE58EDF9B76BB8CA
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U\|.U\|.U\|.X...T\|.X...T\|.RichU\|.................PE..d.....&Y.........." ................................................................[.....`..............................................................................>...........................................................................................rsrc...............................@..@............................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120fra.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74920
Entropy (8bit):	4.743165612876026
Encrypted:	false
SSDEEP:
MD5:	13FA0653A0CF0E5D6E83859E447F2303
SHA1:	8FBFAA952FE68AE9D6A64A487ED41190796E9C29
SHA-256:	55583148630EB2AB63F387AACEBE00562CBFD4068FFE3DBDE234C5F410F7FE24
SHA-512:	BD7158FD33D27A6AFC44E6FDFAEDF4C76D8004FCED11A10688D7E02DD58BAD1A2197121861E387F33E0670296A0565EADDB5A9FD496FA6ED741DC2F9AADF07D7
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U\|.U\|.U\|.X...T\|.X...T\|.RichU\|.................PE..d.....&Y.........." ......................................................................`..............................................................................>...........................................................................................rsrc...............................@..@............................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120ita.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72872
Entropy (8bit):	4.7396852722353655
Encrypted:	false
SSDEEP:
MD5:	3516AE713FE141DF351540D639B8C98D
SHA1:	FBE0B4685ABA672A08146B11DD080D87C803D78F
SHA-256:	8161B0C144A5B243C42A0F7A42075B319495E9E7B0853DE50B239187AF1EBFC1
SHA-512:	559BE2E05F8385C68D693950F417EF8CAE396736B5BA3435DFBEDED5F20942E27E652FC1B9647C0455ACFB69193DFE9A68ADF8D211AE830580FB772F4FA54DB0
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U\|.U\|.U\|.X...T\|.X...T\|.RichU\|.................PE..d.....&Y.........." ................................................................&.....`.............................................................h................>...........................................................................................rsrc...h...........................@..@............................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120jpn.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	53928
Entropy (8bit):	5.973287205154736
Encrypted:	false
SSDEEP:
MD5:	49E6BA38DE51D6FD0F333EF9A6150217
SHA1:	4E780114C1E3C7DC4AB197F1518B50327AFB1616
SHA-256:	97B63B34B59196BAC34A2AD26EEAE5812AFFBC643174F64AA142BE3CA6BBCAD1
SHA-512:	1F7CA2DA137FB7B282C2D55599552B77A9E42E25B6E4FD2071D341D7EA74EB4A6EB7A6826CB5E945689781767FE7E99F818D4696E211809DEC0EBFF66F0F6EAC
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U\|.U\|.U\|.X...T\|.X...T\|.RichU\|.................PE..d.....&Y.........." .................................................................\....`.............................................................................>...........................................................................................rsrc..............................@..@............................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120kor.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	53416
Entropy (8bit):	6.099615087976641
Encrypted:	false
SSDEEP:
MD5:	79114C9DF498F70195DDC93AECAAF726
SHA1:	48B362EDFD4093793A9631463A15825098A18DBA
SHA-256:	4327E89BAF445830750E05F3510E4B84E83F6700E63DB028544107534BCEA783
SHA-512:	EF2B1D58EE75578F4BE123424BC2F73371B85D631985C73308319F6740F73F4790DDD45376C6EF420636576ED279184B8661A2DAC3C8FA3A0FEE1FD39D39834F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U\|.U\|.U\|.X...T\|.X...T\|.RichU\|.................PE..d.....&Y.........." ......................................................................`..............................................................................>...........................................................................................rsrc...............................@..@............................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120rus.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70824
Entropy (8bit):	5.288774786800738
Encrypted:	false
SSDEEP:
MD5:	36FDC1F74D583543E82B17BCC59ACEDE
SHA1:	1387093951C180340FAC724832A0B83834E5700A
SHA-256:	EE413BF57E7FD579003B4FABE5A08E94A9E194A6AD1FBD0FD34DBF7D009BB68A
SHA-512:	5745E4A3C887AEBB5A6FB3FCB198BA313BCE2F231053FA54F906D0BFAB9DB05F5A5AC9835CEE435C6713EF147B5C564DD318E08A51E7F2C79F996DDF03E80359
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U\|.U\|.U\|.X...T\|.X...T\|.RichU\|.................PE..d.....&Y.........." ................................................................A.....`..............................................................................>...........................................................................................rsrc...............................@..@............................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120u.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5634720
Entropy (8bit):	6.648198427709692
Encrypted:	false
SSDEEP:
MD5:	F7D3FC7C0ED92E2DE47F7F85B684A51A
SHA1:	1707DA9AA8460CB65AC7946805CEC12CCA6DB8B3
SHA-256:	D822EC4E09FDF5446E62C09CF5819146F09A4670F77AAA81E4133B912592F1F9
SHA-512:	FBCABF3B8CCE40A9829FB9894CDB751662CC3A3B41F962691075D7E5D18831AD8C43C697E7919B4B1E96288015BE3544637DED1AC0427844F810BE6C2F221A1D
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w................6.......).......(.......7......D$.....<.>......D.......D........2.........Y....D&......D..7....D%......D"......D'.....Rich............PE..d....&Y.........." .........+.....@.).......................................V.....LlV...`...........................................:.,....d;......p?......0=..<....U..>....U..m.................................0.4.p...................s:......................text...L......................... ..`.rdata............................@..@.data...8m....;.......;.............@....pdata...<...0=..>...x<.............@..@.rsrc........p?.......>.............@..@.reloc...m....U..n...NT.............@..B........................................................................................................................................................................................................................

C:\Windows\System32\mfc140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5622864
Entropy (8bit):	6.7472704207598255
Encrypted:	false
SSDEEP:
MD5:	277949968E022B74D4370E94AAA70D76
SHA1:	0902D716F2966DFBC8ED32237F00DB52FB1A9EA9
SHA-256:	3916D6406CBD63B81300989EFF24042FD16A1344EDD9904E6093A1619853B9B8
SHA-512:	3452E7DD91158AE1474DBD838C5AFB4F281F4A0F0D0C9F665506108555DC087C9086257D70643F7281200C19638D4059679E9D1E610F8E935A447428D32B38ED
Malicious:	true
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......7.qs.."s.."s.."8..#r.."8..#r.."8..#i.."z.u"g.."b3.#w.."b3.#{.."8..#`.."s.."a.."b3.#i.."b3.#.."b3.#u.."b3.#r.."b3."r.."b3.#r.."Richs.."........................PE..d......%.........." ...*..,...(......&,...................................... V......\V...`A.........................................C:.d...D.;.......?.`.....<..5...\|U.PP....T.,o...O5.p............................A..@.............-......0:......................text...\.,.......,................. ..`.rdata...u....-..v....,.............@..@.data....4....;......j;.............@....pdata...5....<..6...8<.............@..@.didat..H.....?......n>.............@....rsrc...`.....?......t>.............@..@.reloc..,o....T..p....T.............@..B........................................................................................................................................................................

C:\Windows\System32\mfc140chs.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	51304
Entropy (8bit):	6.319038641792757
Encrypted:	false
SSDEEP:
MD5:	9CBBA8B64FEB8167093BEF01055D4547
SHA1:	4E95E671E9D818764ED76F4AE5D9A4BEB1ED24EA
SHA-256:	1DDE587FEABACF34CE435DB596815563732F3E42E595EE5C0766115483FA22AB
SHA-512:	694BEA161CE3E0E6C17BD8A84E14FA83FFFE122F833808D586BB8D67546553A711B417433AA14D963DF6F82D52118428721F2C8932DE52E324E2CA27CEDFEB80
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d.....v.........." ...*.....v............................................................`A......................................................... ...s...........x..hP..............p............................................................................rdata..t...........................@..@.rsrc....s... ...t..................@..@......v........X.................v........l.................v........$...L...L.........v............p...p...........................RSDS.i}...W...r.......D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140CHS.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1...a...rsrc$02.... ....i}...W...r...S..&7........v........................................................................................................................

C:\Windows\System32\mfc140cht.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	51280
Entropy (8bit):	6.3571761032627
Encrypted:	false
SSDEEP:
MD5:	67AAD6CAC0716E4B9A2ED43319FF3BC4
SHA1:	EEF641F1E2601ADFEEE172F07A51D15FBE8DAA83
SHA-256:	97296F66478F3DDE87565A867F159E98C0B751C067491978D26987EC8609B334
SHA-512:	E0F034831D535DFECAAC8A98454F6A982FE89FE7B14B5F8FE35FF15EBFD4E64AA74830520654DC94CAD46BBFA13F5A32D756789720B564C3791212C6F74C41FC
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d...,/............" ...*.....v............................................................`A......................................................... ..8s...........x..PP..............p............................................................................rdata..t...........................@..@.rsrc...8s... ...t..................@..@....,/..........X...............,/..........l...............,/..........$...L...L.......,/..............p...p...........................RSDSJ.v....y..3.@+....D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140CHT.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1...a...rsrc$02.... ...J.v....y..3.@+...x..9CX...,/..........................................................................................................................

C:\Windows\System32\mfc140deu.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79976
Entropy (8bit):	4.994443234085317
Encrypted:	false
SSDEEP:
MD5:	D97E3D56F2ACBD54671CDC2496AA02B5
SHA1:	D5943EF3E74C98734B43630C9FD7F6B123FD2FA3
SHA-256:	F0D3A39951FCCF41429E087BF87523C261B292AEF2416BAD6C606C3A8EC3799B
SHA-512:	B2C33A9BC9B4D174804C14FE3DB71306149B36CE760C2939D8FB8FB4E6F34DFCB3629FA5CE7F6BADDD6BBA4297D7BE9B84FCA45B5F3BD70CE7893ADC7C05C868
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d...{............." ...*............................................................M.....`A......................................................... ..0...............hP..............p............................................................................rdata..t...........................@..@.rsrc...0.... ......................@..@....{...........X...............{...........l...............{...........$...L...L.......{...............p...p...........................RSDS:.lg..&.9...n....D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140DEU.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1.......rsrc$02.... ...:.lg..&.9...nu..j.[....{K{...........................................................................................................................

C:\Windows\System32\mfc140enu.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70256
Entropy (8bit):	5.150852428474578
Encrypted:	false
SSDEEP:
MD5:	D92BAFE14939B60093AAE336340D4CFD
SHA1:	8E017CF296BAF7D6EB9C47A7C688FC8C3FBB7FE7
SHA-256:	DC7BBA5E343A56E61BBC90DD497ED397339731FCD50F42B0D7825BC787EE16B0
SHA-512:	784FFFAE7A50F6991828C4113719426DE083D60B52490E9034FB29C5C32787C252456ADE1753D493367BBCC06039C620E220C2A4A278AA8057A239C25B7A5152
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d....N.7.........." ...*.............................................................U....`A......................................................... ..................pP..............p............................................................................rdata..t...........................@..@.rsrc........ ......................@..@.....N.7........X................N.7........l................N.7........$...L...L........N.7............p...p...........................RSDS...]n.j..5.K......D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140ENU.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1..0....rsrc$02.... ......]n.j..5.K....}.o.4...{..N.7........................................................................................................................

C:\Windows\System32\mfc140esn.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78952
Entropy (8bit):	4.971589823131607
Encrypted:	false
SSDEEP:
MD5:	5110F40A05DBC4CCC02260ECC2A002CA
SHA1:	DF3B1EAC64186ECB08D7D11966037B879AB3112C
SHA-256:	F8C5517246DE29946CDCFD46EEEE6D021FF9271C2ED806BCD37572C8E44AC9FB
SHA-512:	65F1E857E4B2DEF041B423AA803AAAD6BA5543320085362EB9944ECC2ACEC08007081C5F068550FC3A610AA2B2D7592BF5F5F49BEE80091C7A704CE727460D92
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d.....y..........." ...*..................................................................`A......................................................... ..................hP..............p............................................................................rdata..t...........................@..@.rsrc........ ......................@..@......y.........X.................y.........l.................y.........$...L...L.........y.............p...p...........................RSDSLsK....}...[.......D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140ESN.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1..`....rsrc$02.... ...LsK....}...[.......8..qn....y.........................................................................................................................

C:\Windows\System32\mfc140fra.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79976
Entropy (8bit):	4.975449677987261
Encrypted:	false
SSDEEP:
MD5:	D2A0439EBD5E8CFBFECFDA82C0EF2669
SHA1:	CD8E8639F8B0F8526A7297255FD97DD2CD22BF5C
SHA-256:	F5C53DDF07223DD3DC25276DE42FC3958EC1B9EE6EB4F385680159C056B6F22E
SHA-512:	57C12D3F1F4DA9177165F09477287826BE1C221BBCA18AEAE5D4CC840DE3AEA3CB0C6317A43714FB8DD13E1E186A654275EA62D7C286A8DC2E04A6D17332B7D5
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d...f]............" ...*.............................................................T....`A......................................................... ..x...............hP..............p............................................................................rdata..t...........................@..@.rsrc...x.... ......................@..@....f]..........X...............f]..........l...............f]..........$...L...L.......f]..............p...p...........................RSDS.S8...4..C...+.....D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140FRA.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1.......rsrc$02.... ....S8...4..C...+..O......_...f]..........................................................................................................................

C:\Windows\System32\mfc140ita.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77936
Entropy (8bit):	4.979078290008832
Encrypted:	false
SSDEEP:
MD5:	C081990436336CD6A1FE8E6986FA004C
SHA1:	DCBF030AE874A24AA266C57E0676869ECA9739AE
SHA-256:	37BBAED22D80172C5BD8019DAF95B9C8C051E561AACF232E6C07A09E702B2273
SHA-512:	2C0CBDEF8F8BAF3969FC8FC0345B2E75737FB368AD6D31A030741EDC4168EAB450A6608F783C7CCE81AD77DE1BBF3520D44A1A062458090F02ABCEC08576A0B0
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d...<.wz.........." ...*..................................................................`A......................................................... ..X...............pP..............p............................................................................rdata..t...........................@..@.rsrc...X.... ......................@..@....<.wz........X...............<.wz........l...............<.wz........$...L...L.......<.wz............p...p...........................RSDS...}.....>#..L......D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140ITA.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1.......rsrc$02.... ......}.....>#..L..4...P...Z.H.<.wz........................................................................................................................

C:\Windows\System32\mfc140jpn.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58960
Entropy (8bit):	6.151712284541509
Encrypted:	false
SSDEEP:
MD5:	D9B8C007A3B3D0CAB3B7CE95CD93B4ED
SHA1:	4509FF52489358475BC83D569F0011DB8CBF53A9
SHA-256:	0CFC2226385F2EE8FAC530B1DE72B87B3BCDD14732A23A545F989E38E965A822
SHA-512:	71755ACFD4031F9EAE868431A056C3E37F49926AB78EE7E2EDB956CB42F675A384D416DA6F48D107B0C5D8AD382618C1091E18A4AFF5DFCA757667D56E4C8DDB
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d......_.........." ...*............................................................,.....`A......................................................... ..................PP..............p............................................................................rdata..t...........................@..@.rsrc........ ......................@..@......._........X.................._........l.................._........$...L...L.........._............p...p...........................RSDS.....~.x...!.@....D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140JPN.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1..p....rsrc$02.... ........~.x...!.@. .LL<........_........................................................................................................................

C:\Windows\System32\mfc140kor.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58472
Entropy (8bit):	6.272332121552409
Encrypted:	false
SSDEEP:
MD5:	E10B9371A0746AF285BD2C78931CAB4F
SHA1:	3FA036FB2882C5C9457DD436951CAC12AB6060A7
SHA-256:	3D3E43E6F2E305F7F2FC97E74E4CEF7037A56E075AB41FB359FA445AB5CBB786
SHA-512:	80717FC26B2438955770FED6EDAE0E2FB49AC8FAB57AF3B827275C2FFD1F8A563803983C1A2E206FD5940DF0705FF1EC1526F1C0C9A4E87D750CC8FE1D8F9385
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d..............." ...*..................................................................`A......................................................... ..................hP..............p............................................................................rdata..t...........................@..@.rsrc........ ......................@..@..............X.........................l.........................$...L...L.....................p...p...........................RSDSb)'.]E.r....5C\.....D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140KOR.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1...~...rsrc$02.... ...b)'.]E.r....5C\.4.......FfEB..........................................................................................................................

C:\Windows\System32\mfc140rus.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	75856
Entropy (8bit):	5.502784487678861
Encrypted:	false
SSDEEP:
MD5:	FAAB772287C97342BE72B98443575F04
SHA1:	2296D3CF50C75DEB4DBEFDCE939D9EE1D0FE9E27
SHA-256:	577E3273049C6E4115030B3D2A1977AC4265C246697583CEB28A4E99457199A6
SHA-512:	960D7CACBA0D059E820D39DAFD245CF30203819634521D905B6EF001FDE43A3C9A7876BD95595FACB5F152F4042B1C80E16A04EE05BD41C65464E927569212C8
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!-=.eLS.eLS.eLS.t..dLS.t.Q.dLS.RicheLS.PE..d.....y..........." ...*.............................................................G....`A......................................................... ..................PP..............p............................................................................rdata..t...........................@..@.rsrc........ ......................@..@......y.........X.................y.........l.................y.........$...L...L.........y.............p...p...........................RSDSj.w....W.K...~.....D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFC140RUS.amd64.pdb.........p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..p....rsrc$01....p1.. ....rsrc$02.... ...j.w....W.K...~.:..L...E.YL..y.........................................................................................................................

C:\Windows\System32\mfc140u.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5658192
Entropy (8bit):	6.729941320562663
Encrypted:	false
SSDEEP:
MD5:	3D3FD261916A8327667BBD66C4C53C80
SHA1:	DCE287AD815A91C4F80EA05F565C47A605E0F07A
SHA-256:	DD502923934ED248EC3A1417142306542C8023536637B650AFD8930859A9B2AD
SHA-512:	9E7EFF71B829F24F65B5A4CE5DC429AEB4BC8F5F188F83B17FC8796B610B541E13849AD4A7B98CE11E0E6675F9016D7E6A9D81280D1F7AE054E8AA072B522F08
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.qo.."o.."o.."$..#n.."$..#n.."$..#u.."f.t"{.."~3.#k.."~3.#g.."$..#\|.."o.."o.."~3.#u.."~3.#..."~3.#i.."~3.#n.."~3."n.."~3.#n.."Richo.."................PE..d...g..q.........." ...*..-..P)......N,.......................................V......`V...`A........................................0.:......;.......?.`....@=. 8....V.PP...0U.<p....5.p............................q..@............0-.X.....:......................text.....-.......-................. ..`.rdata..V....0-.......-.............@..@.data....7....<.......;.............@....pdata.. 8...@=..:....<.............@..@.didat..H.....?.......>.............@....rsrc...`.....?.......>.............@..@.reloc..<p...0U..r....T.............@..B................................................................................................................................................................................

C:\Windows\System32\mfcm120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	91808
Entropy (8bit):	6.334619249503521
Encrypted:	false
SSDEEP:
MD5:	480F828BD5B34C59C288F55CB363CAD2
SHA1:	95499B7F1005666FB5D273C1B96E8FD239D95866
SHA-256:	431E7373DEE1EEE2AB86588DEA061394EDF14A364C026DD47582D982BEFB1D78
SHA-512:	C55021AC4B34F32B0C5BDDA842FC52756759723B57DA0F82407291EB928B90C71AA6F61C74B209DE14132530C4BD0DE838C64D34E6F746C76E10342001C67122
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8k..\|.zC\|.zC\|.zC...C~.zCbX.C~.zCqX.Cx.zC.C}.zCqX.C}.zCqX.Cw.zC...Cy.zC\|.{C..zCqX.Cj.zCqX.C}.zCqX.C}.zCqX.C}.zCRich\|.zC........................PE..d.....&Y.........." .....@...........I....................................................`..........................................).......*..x....`.......P.......(...>...p.......d..............................@h..p............`..(...........8e..H............text....:.......<.................. ..`.nep.........P.......@.............. ..`.rdata.......`.......D..............@..@.data........@......................@....pdata.......P....... ..............@..@.rsrc........`......."..............@..@.reloc.......p.......&..............@..B........................................................................................................................................................................................

C:\Windows\System32\mfcm120u.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	91816
Entropy (8bit):	6.335643438000401
Encrypted:	false
SSDEEP:
MD5:	D739C219492AEA851D4B71127B310E83
SHA1:	488401EC9413C025C5A7CE9AEDC0B7629579A4A6
SHA-256:	F0CFCC1A9CD9B246B53FE14FA2F77975763A6DE5FBB3A98CF5EA622BE0C62CEA
SHA-512:	A1DD96D1E3BD21382879C0B68B81B2740C14F5DAE9490800A9BD8534A7CF13030163D4149F56E602B903E4DF23A7F0B0B5B3F0F294E1C30B7BEBC4F89D971D7C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8k..\|.zC\|.zC\|.zC...C~.zCbX.C~.zCqX.Cx.zC.C}.zCqX.C}.zCqX.Cw.zC...Cy.zC\|.{C..zCqX.Cj.zCqX.C}.zCqX.C}.zCqX.C}.zCRich\|.zC........................PE..d.....&Y.........." .....@...........I....................................................`..........................................)......p*..x....`.......P.......(...>...p.......d..............................@h..p............`..(...........8e..H............text....:.......<.................. ..`.nep.........P.......@.............. ..`.rdata.......`.......D..............@..@.data........@......................@....pdata.......P....... ..............@..@.rsrc........`......."..............@..@.reloc.......p.......&..............@..B........................................................................................................................................................................................

C:\Windows\System32\mfcm140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	96416
Entropy (8bit):	6.387028558514212
Encrypted:	false
SSDEEP:
MD5:	58B613899800EB4B690984E1C78BD31F
SHA1:	D827BA4A4E59C78D11C61B9C5BE78C8DDD5B74F4
SHA-256:	9B53E19B5F96DE66CD3992169009146AD08F2F042CC0AED4191E1F0B1068891F
SHA-512:	9767AD3BD377DF7E3818E98FDAC794F5147FAECA9680DB568E96BED173206B71FE59FFA2B031A182BACC37EA440D329BF03FE3EF30EA72CE655EEBE2DDC6B677
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f...f...f...-..d...x.s.d...w\.`...w\.e...w\.n...o.s.b...-..c...f......w\.A...w\..g...w\..g...w\.g...Richf...........................PE..d................." ...*.F...........P....................................................`A........................................./.......0.......p.......`.......(...P...........y..p...........................px..@............p..x............u..H............text....A.......B.................. ..`.nep.........`.......F.............. ..`.rdata.......p.......J..............@..@.data........@......................@....pdata.......`......................@..@.rsrc........p......."..............@..@.reloc...............&..............@..B........................................................................................................................................................................................

C:\Windows\System32\mfcm140u.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	96384
Entropy (8bit):	6.3866070308269265
Encrypted:	false
SSDEEP:
MD5:	76D7D08147A8F109A69C7A9871D3BED7
SHA1:	E7DC5E4AE364998A555875EC7AA1614CEE78D87C
SHA-256:	99328025DD44FBF310280E83CB0F17AA0D0420446A08768A8910D70B6D8C94F7
SHA-512:	BDED655AEFC386ECA685A0B47285CCBBB090DE4D654C88198C7CA87AF4FC9F7C7BDF3268D7E0414263100E03F6B7AD7CD087CDB9DBD6062613BE47AF5B23CF59
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f...f...f...-..d...x.s.d...w\.`...w\.e...w\.n...o.s.b...-..c...f......w\.A...w\..g...w\..g...w\.g...Richf...........................PE..d....o............" ...*.F...........P..............................................v.....`A........................................./.......0.......p.......`.......(...P...........y..p...........................px..@............p..x............u..H............text....A.......B.................. ..`.nep.........`.......F.............. ..`.rdata.......p.......J..............@..@.data........@......................@....pdata.......`......................@..@.rsrc........p......."..............@..@.reloc...............&..............@..B........................................................................................................................................................................................

C:\Windows\System32\msvcp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	659624
Entropy (8bit):	6.34353451383787
Encrypted:	false
SSDEEP:
MD5:	C2028BA6C66363B36EA659CA8816265D
SHA1:	5E2BDA10AD417466290DC08FD6EE8BC5FCF0EBBD
SHA-256:	3B92E964404E3F94531E7D7C4C7419561D9ECA6ACCD98DC3979C9E3596DB444C
SHA-512:	28E87D7360C4BD2EB30152173DA6FDF30340B5FF0186A68F26514088DCC15758851AFD01A179E976A91A9A85F9C1EE0CFA40308ED9D42654739ACF6F6DD773F4
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C..=...n...n...n..*n...n...n...n..<n...n.@&n...n..>n...n...n4..n...nJ..n...n...n..=n...n..:n...n..?n...nRich...n........................PE..d...0.&Y.........." .....>...................................................`.......>....`.........................................PU.. ...p2..<....@...........G.......>...P.......X..................................p............P...............................text....=.......>.................. ..`.rdata.......P.......B..............@..@.data........P...8...@..............@....pdata...G.......H...x..............@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Windows\System32\msvcp140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	575592
Entropy (8bit):	6.535312420736696
Encrypted:	false
SSDEEP:
MD5:	CFDF6EAF5328FECBDEC268B7F9E21F3A
SHA1:	100C8A08DE6544B8554A542AD55AF831F86565E7
SHA-256:	9057D39B36B6C7D054865EE2BF9CDE7A490FE3B01EC4E82514687E24F576269F
SHA-512:	A81FEB56AE3E4939ABB21597F4F60429B704E04E6C20FAC402A0518FE7B29606BF8824347A7570D98F3C44684C15BF6B520E350321BFC2A42EC5597989215782
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r..D...D...D....k..F...Mk!.R...D.......U...A...U...@...U...L...U.......U...E...U.M.E...U...E...RichD...................PE..d................." ...*.:...V...... $..............................................E.....`A........................................p2..h.......,............p...9...x..hP..............p...........................P...@............P..x............................text....9.......:.................. ..`.rdata..z....P.......>..............@..@.data...p8...0......................@....pdata...9...p...:...0..............@..@.rsrc................j..............@..@.reloc...............n..............@..B........................................................................................................................................................................................................................................................

C:\Windows\System32\msvcp140_1.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35944
Entropy (8bit):	6.653057193822569
Encrypted:	false
SSDEEP:
MD5:	6DD04C14A17CAAE50D068FC89D7D01F0
SHA1:	4D2D12D7A0139C8248F9F9266982562ED402B8DA
SHA-256:	A65249861238E1C18B84AE5D112617C438D83A76B67EDDC170AD82DBC2338665
SHA-512:	9C04F015728D0F57E7B91E888505A0A288064529BF72DFB1F2C5FC571DB40C2CC118782B8544BEBC4E26B8BD189667FE65D13289A4F347B2805FF5EC5B9646AE
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.M...#...#...#.4.".}.#.v..{.#.n+ .}.#.n+'.x.#...".U.#.n+".z.#.n+&.k.#.n+#.~.#.n+.~.#.n+!.~.#.Rich..#.........PE..d....4.".........." ...*.....&............................................................`A.........................................@..L...LA..x....p.......`.......<..hP...........4..p...........................`3..@............0..8............................text............................... ..`.rdata..B....0......................@..@.data...P....P......................@....pdata.......`.......2..............@..@.rsrc........p.......6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................

C:\Windows\System32\msvcp140_2.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	267880
Entropy (8bit):	6.5200682286945115
Encrypted:	false
SSDEEP:
MD5:	DDC38BB34DE28E1F42B6DEA9770D4D65
SHA1:	6FC98E48F5E738C82279ED0F445AC1DD9C4D02A3
SHA-256:	89E2E9A163165E20C540F9ADEA081E927DDFE4A556547B0F45F11586D4CCE165
SHA-512:	F4B07D80BE1E64F132DBC1AB2F29E4CA6B2CC589B348328937857CE9B578118497D6F39AFEBE49DD19E3665A8BAB92E441721613D4EBE873254AD0BEAD6F446F
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1U.zu4`)u4`)u4`)>La(w4`)\|L.)y4`)d.c(v4`)d.d(}4`)u4a).4`)d.a(r4`)d.e(`4`)d.`(t4`)d..)t4`)d.b(t4`)Richu4`)........PE..d....\w+.........." .....................................................................`A................................................h...........................hP......x....R..p...........................`Q..@...............h............................text............................... ..`.rdata..............................@..@.data...`.......&..................@....pdata..............................@..@.rsrc...............................@..@.reloc..x...........................@..B................................................................................................................................................................................................................................................................

C:\Windows\System32\msvcp140_atomic_wait.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	50256
Entropy (8bit):	6.650307191256275
Encrypted:	false
SSDEEP:
MD5:	333727166AF151E95B05CB54550342CD
SHA1:	746504C9056B83D9AF6F800905B80E864AAEA5F4
SHA-256:	FBF41E4B53F51BBF73FEE37B6120103FEA6B7D5AE29916F8EF50C50CFDEDEEAD
SHA-512:	2D9FA95A068784A8E799362FAF97B42253DBD614DA504907ED01D1F7F3FDC56D1BB964B2009171EDA87149A595D84EC83D50DAFF30BE9BD6F7A3C76C75226C40
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#B..pB..pB..p...qF..pK.\|pD..pS\.qA..pS\.qJ..pB..p'..pS\.qE..pS\.q_..pS\.qC..pS\.pC..pS\.qC..pRichB..p........PE..d....w............" ...*.:...........>.......................................@............`A........................................0f..D...tk....... ..........8....t..PP...0..X...`X..p........................... W..@............P..H............................text....9.......:.................. ..`.rdata...$...P...&...>..............@..@.data...H............d..............@....pdata..8............f..............@..@.rsrc........ .......l..............@..@.reloc..X....0.......r..............@..B................................................................................................................................................................................................................................................................

C:\Windows\System32\msvcp140_codecvt_ids.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31824
Entropy (8bit):	6.837226224621119
Encrypted:	false
SSDEEP:
MD5:	208CD115A93175DB7A8EE80B97E0CC28
SHA1:	789E0DA53C321D7A64C1435F569FDBFB249DFACD
SHA-256:	0E1D3D76E899A89FB3893FB13ABAE232FF62AD4F573214DD2F02B8398166BCC6
SHA-512:	8E0BF76440D64D2331FA9988F81850F646A91335C02A2028877ADD6190CF4CAC533CF22825D2F0565B854075CF70FF86CD728E2114284F2321E52B1B47004DE6
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w..(3{h{3{h{3{h{x.iz1{h{:..{1{h{".iz0{h{3{i{.{h{".kz1{h{".lz4{h{".mz?{h{".hz2{h{"..{2{h{".jz2{h{Rich3{h{........................PE..d...A..4.........." ...............@........................................p.......p....`A........................................p(..0....)..P....P.......@.......,..PP...`..,...."..p............................!..@............ ...............................text...x........................... ..`.rdata..B.... ......................@..@.data...p....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.....................@..B................................................................................................................................................................................................................................................

C:\Windows\System32\msvcr120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	963240
Entropy (8bit):	6.63315431748134
Encrypted:	false
SSDEEP:
MD5:	B70474FE249402E251A94753B742788C
SHA1:	F53B3C21ADF75DC84977067869253E207F1B9795
SHA-256:	753AC30C30AAE62415CC225E3D057B8B6254AFE280696E0A43F1A7C3132632A6
SHA-512:	7776E05FE58CB3C12A4A020DEF9596ECFB6DC1B1F8CA010EC27A8AE027EADF1EEF901ACBAFE042E2F7B31D1920F62CE163342ACF37F96802EC27D68AC7BF972E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F=&^'Su^'Su^'Su..u]'Su^'Ru.'SuSu.u.%SuSu.uo'SuSu.uh'SuSu.u.'SuSu.u_'SuSu.u_'SuSu.u_'SuRich^'Su........PE..d...$.&Y.........." .....h...:.......)..............................................C.....`.................................................p...(............@..hs...t...>......<...p................................2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@.data...hu.......D..................@....pdata..hs...@...t..................@..@.rsrc................^..............@..@.reloc..<............b..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\vcamp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	481952
Entropy (8bit):	5.988099327257469
Encrypted:	false
SSDEEP:
MD5:	7FA53D11D558D61228A8E0C4D9F71B00
SHA1:	BE78D57D1D5899A3AA77C95F6F9EAA638C3F7DB0
SHA-256:	096A72B8ACED30F604B0DFF52BE3DD1C7354C0D6A528E3060E9F62696FCD843E
SHA-512:	C6616A768B8C18998DFA722D8F0D7FBC6E51CD1BB74B3360343A6A06762A9D6D38DEBF241950FA3ACACF9C5681F7E510B62D346E052C2F3B211DAACF2EDF9DE6
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..\:i..:i..:i..7;#.>i....9.;i..7;!.;i..7;..7i..7;..=i...5.1i..:i...i..7;..0i..7;".;i..7;%.;i..:ii.;i..7; .;i..Rich:i..........................PE..d.....&Y.........." .........B.......A.......................................P............`.........................................0;..$8..Ts..........@$.......:.......>...@......................................@...p............................................text............................... ..`.rdata..............................@..@.data...H=.......8...z..............@....pdata...:.......<..................@..@.rsrc...@$.......&..................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Windows\System32\vcamp140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	408656
Entropy (8bit):	6.395785800442683
Encrypted:	false
SSDEEP:
MD5:	406A784AAA43DC068BA5945119109012
SHA1:	85BAC30E041B6D85C0D7BA89FC8C05C69D264F88
SHA-256:	192E80290753E5A79C56367700A09181321C0984515F4C35E7EA8A0F245877BF
SHA-512:	56C4BA950BAFBB6F818BFF9E70EFE59546912A2B4F331C134C9D98B65C165A4251E7C6D60A58DDE9432E618EA9DEF07C57482AEA460B877C826BA5304E7248E4
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^.e....W...W...W...W...W.D.V...W.D.V...W.D.V...W.D.V...WQ..V...W...W...W.D.V...W.D.V...W.D.W...W..W...W.D.V...WRich...W........................PE..d................." ........F.......H.......................................0......&"....`A............................................,8...T..T........%.......5......PP... ..P....)..p......................(....(..@............................................text............................... ..`.rdata..j...........................@..@.data....4...p.......Z..............@....pdata...5.......6..................@..@.rsrc....%.......&..................@..@.reloc..P.... ......................@..B................................................................................................................................................................................................................................

C:\Windows\System32\vccorlib120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	356528
Entropy (8bit):	5.9171117722289335
Encrypted:	false
SSDEEP:
MD5:	6D62E7D709CAAB4A459EDE82366853C0
SHA1:	D6DE1FAC72BA254538F2C754928CC35B3AB103AC
SHA-256:	5A357A9F10D55B70E50A04B0B6716263E678E877E0934F536CC82AA1C3072C25
SHA-512:	0D478FC2C9C5E7CB6A331A0E11156D85A8ECA2B99B1108DC145680F511051D83547FA56073B377212597B5B94B9A77E661178D2549A59AB251700733ED156CF3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........]j.]j.]j.T.{.[j.P85.Yj.../.\j.P87._j.P8..Pj.P8..Uj..#.Zj.]j..j.P8..Lj.P84.\j.P83.\j.P86.\j.Rich]j.........PE..d.....&Y.........." .....n...........L....................................................`..............................................>...D.......P..........."...2...>...`......................................`...p............................................text....l.......n.................. ..`.rdata...............r..............@..@.data...x....`.......F..............@....pdata...".......$..................@..@minATL.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................

C:\Windows\System32\vccorlib140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	351824
Entropy (8bit):	6.052949543661257
Encrypted:	false
SSDEEP:
MD5:	164561905F701BC680D654232BB5C4D1
SHA1:	ACEF59F34D1245169A671C32D69EB204DC5897D3
SHA-256:	8903B5D88968791D2A93648A54A1AC3D1C708C579A72311FFE194F6D66903043
SHA-512:	5237F7A722100167A0291B215F151F502AE615160E58D2130FB693289D3C87415EDBA3F0A96B11118117A574F58B50A348D21CE4A32987FABB5D9B4BBBC83887
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."n..qn..qn..qg..q~..q.%.ph..q.%.pj..q.%.pf..q.%.pu..q%.pi..qn..q...q.%.p...q.%.po..q.%nqo..qn..qo..q.%.po..qRichn..q........................PE..d................" ...*.....................................................P............`A.............................................>..4 ..,.... ...........!......PP...0......p...p...........................0...@............................................text...F........................... ..`.rdata..............................@..@.data........@.......$..............@....pdata...!......."..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Windows\System32\vcomp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	137888
Entropy (8bit):	6.214673538212
Encrypted:	false
SSDEEP:
MD5:	72A89F606F0EFC608B36288BC32705A2
SHA1:	DC6371903ECE074D792B2AF264FBF2CC49B1CAE2
SHA-256:	7FD73132D9579EEBB2E6EE202BABC6A49B3744DE84C9B34FEDE0B3BE95EC98BB
SHA-512:	8B23C3B4830F261608776C44B2A5D31DB598B1BFB14BCEFD0DA1AB52159AF35E6DA54CB09DDA4A587E7157B10504B54D373A2497292AD5B2E40FFBC552668B57
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r.....L...L...L.A.L...L.A.L...L.A#L...L?.7L...L...L...L.A.L...L.A L...L.A'L...L.A"L...LRich...L........................PE..d.....&Y.........." .................Z.......................................0.......Q....`.....................................................<........................>... ......P3..................................p............0...............................text............................... ..`.rdata...z...0...\|... ..............@..@.data...,:..........................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................

C:\Windows\System32\vcomp140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	192104
Entropy (8bit):	6.460819297931624
Encrypted:	false
SSDEEP:
MD5:	17CF948597BEFC68706E3121BB0ACDE6
SHA1:	D7F13076A2FBDE1F88127118EBD9BAA9C782BC71
SHA-256:	036B9B3F7ECE8DFD48AECCD77113721C5305043AAA9C64D1E72812252727AA7C
SHA-512:	28475DA6F70C355EC113CD41B2DB3CA0676B3F87495BEBFD76D916047D08B9F27DA7B7EC6F3EB9862BE1947DE163F68B96D12C6864EBD0036B997096728A8003
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........l.l.?.l.?.l.?...>.l.?...>.l.?...>.l.?..>.l.?..>.l.?...>.l.?.l.?.l.?..>.l.?..>.l.?..>.l.?..k?.l.?.l.?.l.?..>.l.?Rich.l.?........PE..d...&............." ...*..... .......g...............................................J....`A.........................................`......Hn..(.......................hP......4....C..p............................A..@............................................text.............................. ..`.rdata..............................@..@.data...d%...........`..............@....pdata...............l..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

C:\Windows\System32\vcruntime140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120432
Entropy (8bit):	6.602841735473839
Encrypted:	false
SSDEEP:
MD5:	943FC74C2E39FE803D828CCFA7E62409
SHA1:	4E55D591111316027AE4402DFDFCF8815D541727
SHA-256:	DA72E6677BD1BCD01C453C1998AAA19AEAF6659F4774CF6848409DA8232A95B2
SHA-512:	96E9F32E89AEE6FAEA6E5A3EDC411F467F13B35EE42DD6F071723DAEBA57F611DBD4FF2735BE26BB94223B5EC4EE1DFFEDF8DC744B936C32A27D17B471E37DCF
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w..E3f..3f..3f..x...1f..:.].8f..3f...f..3f..2f.."...#f.."...,f.."...&f.."...2f..".1.2f.."...2f..Rich3f..................PE..d....<............" ...*.$...d......................................................k.....`A........................................0u..4...d}..........................pP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B........................................................................................................................................................................

C:\Windows\System32\vcruntime140_1.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	6.702924040492291
Encrypted:	false
SSDEEP:
MD5:	05052BE2C36166FF9646D7D00BB7413F
SHA1:	D8D7C4B322D76E3A7B591024C62F15934979FE40
SHA-256:	26E470B29BED3D873E0C328186E53F95E9EDBFE0B0FD0CDA44743A0B1A04A828
SHA-512:	0460CC66D06DF9A2941607473F3ECCFD909F2ADAB53A3328FADCEDD1B194B388ECA738C2C6C2E193DE33606925FBED1FE39EFA160015128E93F5E3A03C62170D
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\..\..\...]..\...]..\..O\..\..\...\...]..\...]..\...]..\...]..\..#\..\...]..\Rich..\........PE..d...=............." ...*.<...8.......@..............................................U0....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

C:\Windows\System32\vcruntime140_threads.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38504
Entropy (8bit):	6.805311319192725
Encrypted:	false
SSDEEP:
MD5:	997C522F929B39D93B1D179BC94B0486
SHA1:	28EF3ADEE6A2DFD5D4B62B46FF6811EB47F7D510
SHA-256:	326110C8C5CAC836CFED1643304CB6BDC4A8737A7A535D6B1EFF4D63878AEF9D
SHA-512:	6BC4360321EC13D8C7CD9D17FBAD628874D45DD9F02BEBAEBDCD9BB4C7074C4B864DD65BC4EDA756F988B38ECA6217CE3AB3D5A697202DB8D5D5C1E3BB96A25D
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.N... E.. E.. E[.!D.. E..!D.. E..E.. E..!EP. E..#D.. E..$D.. E..%D.. E.. D.. E...E.. E.."D.. ERich.. E................PE..d................." ...*. ...(......@#....................................................`A.........................................;......$>..x....p.......`..$....F..hP......0....4..p...........................p3..@............0...............................text............ .................. ..`.rdata..X....0.......$..............@..@.data........P.......:..............@....pdata..$....`.......<..............@..@.rsrc........p.......@..............@..@.reloc..0............D..............@..B........................................................................................................................................................................................................................................................

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1028\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	18415
Entropy (8bit):	4.043868285184243
Encrypted:	false
SSDEEP:
MD5:	2B063D92663595DFE4781AE687A03D86
SHA1:	0FB582E756DBC751EA380593AC4DA27DDB4EBB06
SHA-256:	44C76290F7A2E45940E8338912FEB49BCF4E071CFA85D2D34762857743ACBC8D
SHA-512:	94C8FDA6173C7F5740F206190EDCD1F1F1C309596B710D400E23CD363A619D707A5D4576D4FE63AB7CB68947F009EFD29A1FBE04743A294698BF2AE17E92C214
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset134 SimSun;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT \f1\'dc\'9b\'f3\'77\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\f0\par..MICROSOFT VISUAL C++ 2015 - 2022 \f1\'88\'cc\'d0\'d0\'eb\'41\'b6\'ce\f0 \par..\b0\f1\'b1\'be\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\'ca\'c7\'d9\'46\'d3\'c3\'91\'f4\'c5\'63\f0 Microsoft Corporation (\f1\'bb\'f2\'c6\'e4\'ea\'50\'82\'53\'c6\'f3\'98\'49\'a3\'ac\'d2\'95\'d9\'46\'d3\'c3\'91\'f4\'cb\'f9\'be\'d3\'d7\'a1\'b5\'c4\'b5\'d8\'fc\'63\'b6\'f8\'b6\'a8\f0 ) \f1\'d6\'ae\'e9\'67\'b3\'c9\'c1\'a2\'b5\'c4\'ba\'cf\'bc\'73\'a1\'a3\'cb\'fc\'82\'83\'df\'6d\'d3\'c3\'ec\'b6\'c9\'cf\'ca\'f6\'dc\'9b\'f3\'77\'a1\'a3\'b1\'be\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\'d2\'e0\'df\'6d\'d3\'c3\'ec\'b6\'c8\'ce\'ba\'ce\f0 Microsoft \f1\'b7\'fe\'84\'d5\

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1028\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.163758160900388
Encrypted:	false
SSDEEP:
MD5:	472ABBEDCBAD24DBA5B5F5E8D02C340F
SHA1:	974F62B5C2E149C3879DD16E5A9DBB9406C3DB85
SHA-256:	8E2E660DFB66CB453E17F1B6991799678B1C8B350A55F9EBE2BA0028018A15AD
SHA-512:	676E29378AAED25DE6008D213EFA10D1F5AAD107833E218D71F697E728B7B5B57DE42E7A910F121948D7B1B47AB4F7AE63F71196C747E8AE2B4827F754FC2699
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">....</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ................. ......................../passive \| /quiet - .... UI ........... UI.... ........... UI ........../norestart - ................UI ............./log log.txt - .........

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1029\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	13234
Entropy (8bit):	5.125368352290407
Encrypted:	false
SSDEEP:
MD5:	E7DC9CA9474A13FA4529D91BCD2AB8CC
SHA1:	511F5DE8A99C09EC3766C5E2494A79EACCA261C8
SHA-256:	503C433DCDE2F3A9E7D388A5FF2B0612E7D8F90F5188D5B2B60228DB33044FDE
SHA-512:	77108E53CD58E42F847D8EF23A07723C4849DC41DBE1C3EF939B9170E75F525BEC9D210D6C1FBFEB330ECE2E77B8A8E2808730D9E6F72F5B3FE626D58B6068C6
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset0 Garamond;}{\f3\fnil Tahoma;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 LICEN\f1\'c8N\f0\'cd PODM\'cdNKY PRO SOFTWARE SPOLE\f1\'c8NOSTI MICROSOFT\par..\f0 MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0 Tyto licen\f1\'e8n\f0\'ed podm\'ednky p\f1\'f8edstavuj\f0\'ed smlouvu mezi spole\f1\'e8nost\f0\'ed Microsoft Corporation (nebo n\f1\'eckterou z jej\f0\'edch afilac\'ed, v\~z\'e1vislosti na tom, kde bydl\'edte) a v\'e1mi. Vztahuj\'ed se na v\'fd\f1\'9ae uveden\f0\'fd software. Podm\'ednky se rovn\f1\'ec\'9e vztahuj\f0\'ed na jak\'e9koli slu\f1\'9eby Microsoft nebo aktualizace pro software, pokud se na slu\'9eby nebo aktualizace nevztahuj\f0\'ed odli\f1\'9an\f0\'e9 podm\'ednky.\par..\b DODR\f1\'8e\f0\'cdTE-LI

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1029\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3333
Entropy (8bit):	5.370651462060085
Encrypted:	false
SSDEEP:
MD5:	16343005D29EC431891B02F048C7F581
SHA1:	85A14C40C482D9351271F6119D272D19407C3CE9
SHA-256:	07FB3EC174F25DFBE532D9D739234D9DFDA8E9D34F01FE660C5B4D56989FA779
SHA-512:	FF1AE9C21DCFB018DD4EC82A6D43362CB8C591E21F45DD1C25955D83D328B57C8D454BBE33FBC73A70DADF1DFB3AE27502C9B3A8A3FF2DA97085CA0D9A68AB03
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instala.n. program [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Opravdu chcete akci zru.it?</String>.. <String Id="HelpHeader">N.pov.da nastaven.</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [adres..] . Nainstaluje, oprav., odinstaluje nebo.. vytvo.. .plnou m.stn. kopii svazku v adres..i. V.choz. mo.nost. je instalace...../passive \| /quiet . Zobraz. minim.ln. u.ivatelsk. rozhran. bez v.zev nebo nezobraz. ..dn. u.ivatelsk. rozhran. a.. ..dn. v.zvy. V.choz. mo.nost. je zobrazen. u.ivatelsk.ho rozhran. a v.ech v.zev...../noresta

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1031\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	12392
Entropy (8bit):	5.192979871787938
Encrypted:	false
SSDEEP:
MD5:	2DDCA2866D76C850F68ACDFDB696D6DE
SHA1:	C5076F10B0F0654CDE2C990DEEB2772F3CC4844B
SHA-256:	28F63BAD9C2960395106011761993049546607F8A850D344D6A54042176BF03F
SHA-512:	E3A3693B92873E0B42007616FF6916304EDC5C4F2EEE3E9276F87E86DD94C2BF6E1CF4E895CDF9A1AA0CAC0B381B8840EEE1F491123E901DEE75638B8BC5CE1B
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil Tahoma;}{\f3\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT-SOFTWARE-LIZENZBEDINGUNGEN\par..MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0 Diese Lizenzbestimmungen stellen eine Vereinbarung zwischen Ihnen und der Microsoft Corporation (bzw. abh\'e4ngig von Ihrem Wohnsitz einem ihrer Affiliate-Partner) dar. Sie gelten f\'fcr die oben angef\'fchrte Software. Die Bestimmungen gelten ebenso f\'fcr jegliche von Microsoft angebotenen Dienste oder Updates f\'fcr die Software, sofern diesen keine anderen Bestimmungen beiliegen.\par..\b WENN SIE DIESE LIZENZBESTIMMUNGEN EINHALTEN, VERF\'dcGEN SIE \'dcBER DIE NACHFOLGEND AUFGEF\'dcHRTEN RECHTE.\par....\pard{\pntext\f3\'B7\tab}{\\pn\pnlvlblt\pnf3\pnindent360{\pntxtb\'B7}}\

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1031\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3379
Entropy (8bit):	5.094097800535488
Encrypted:	false
SSDEEP:
MD5:	561F3F32DB2453647D1992D4D932E872
SHA1:	109548642FB7C5CC0159BEDDBCF7752B12B264C0
SHA-256:	8E0DCA6E085744BFCBFF46F7DCBCFA6FBD722DFA52013EE8CEEAF682D7509581
SHA-512:	CEF8C80BEF8F88208E0751305DF519C3D2F1C84351A71098DC73392EC06CB61A4ACA35182A0822CF6934E8EE42196E2BCFE810CC859965A9F6F393858A1242DF
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] - Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">M.chten Sie den Vorgang wirklich abbrechen?</String>.. <String Id="HelpHeader">Setup-Hilfe</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [Verzeichnis] - installiert, repariert, deinstalliert oder.. erstellt eine vollst.ndige lokale Kopie des Bundles im Verzeichnis. Installieren ist die Standardeinstellung...../passive \| /quiet - zeigt eine minimale Benutzeroberfl.che ohne Eingabeaufforderungen oder keine.. Benutzeroberfl.che und keine Eingabeaufforderungen an. Standardm..ig werden die Benutzeroberfl.che und alle Eingab

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1036\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	12349
Entropy (8bit):	5.108676965693909
Encrypted:	false
SSDEEP:
MD5:	A6E352E5804313CCDE3E4D5DDDDE122D
SHA1:	834E3AAA07DC675589A9E5FCD23CE5586C2739E8
SHA-256:	5C13A65870D770D1642A4259EECB436257CA39016A0500F747BE9C79BE0C7009
SHA-512:	6578AC6467F61930BC1B20E404441725C63790C65AEC1ACE297429EAD15F50E68D5FE9CC1451AC86AE23DC1A7FE967650166293010D687785FB81FB4492B87C4
Malicious:	false
Reputation:	low
Preview:	{\rtf1\fbidis\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil Tahoma;}{\f2\fnil\fcharset0 Garamond;}{\f3\fnil\fcharset177 Tahoma;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\ltrpar\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 TERMES DU CONTRAT DE LICENCE LOGICIEL MICROSOFT\par..MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0 Les pr\'e9sentes conditions de licence constituent un contrat entre Microsoft Corporation (ou en fonction de votre lieu de r\'e9sidence, l\f1\rquote\f0 un de ses affili\'e9s) et vous. Ils s\f1\rquote\f0 appliquent au logiciel vis\'e9 ci-dessus. Les termes s\f1\rquote\f0 appliquent \'e9galement \'e0 tout service et \'e0 toute mise \'e0 jour Microsoft pour ce logiciel, \'e0 moins que d\f1\rquote\f0 autres termes n\f1\rquote\f0 accompagnent ces \'e9l\'e9ments.\par..\b SI VOUS VOUS CONFORMEZ AUX PR\'c9SENTS TERMES DU CONTRAT D

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1036\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3366
Entropy (8bit):	5.0912204406356905
Encrypted:	false
SSDEEP:
MD5:	7B46AE8698459830A0F9116BC27DE7DF
SHA1:	D9BB14D483B88996A591392AE03E245CAE19C6C3
SHA-256:	704DDF2E60C1F292BE95C7C79EE48FE8BA8534CEB7CCF9A9EA68B1AD788AE9D4
SHA-512:	FC536DFADBCD81B42F611AC996059A6264E36ECF72A4AEE7D1E37B87AEFED290CC5251C09B68ED0C8719F655B163AD0782ACD8CE6332ED4AB4046C12D8E6DBF6
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Installation de [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Voulez-vous vraiment annuler.?</String>.. <String Id="HelpHeader">Aide du programme d'installation</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installe, r.pare, d.sinstalle ou.. cr.e une copie locale compl.te du groupe dans le r.pertoire. Install est l'option par d.faut...../passive \| /quiet - affiche une interface minimale, sans invite, ou n'affiche ni interface.. ni invite. Par d.faut, l'interface et toutes les invites sont affich.es...../norestart - supprime toutes les tentatives de red.

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1040\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	11440
Entropy (8bit):	5.037988271709582
Encrypted:	false
SSDEEP:
MD5:	BC58AD6ABB16B982AEBADC121B37E706
SHA1:	25E3E4127A643DB5DB2A0B62B02DE871359FAE42
SHA-256:	70ECF23C03B66A2B18E173332586AFA8F00F91E02A80628F4F9CB2521E27F6AC
SHA-512:	8340452CB5E196CB1D5DA6DBB3FA8872E519D7903A05331055370B4850D912674F0B6AF3D6E4F94248FE8135EB378EB36969821D711FE1624A04AF13BBE55D70
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 CONDIZIONI DI LICENZA SOFTWARE MICROSOFT\par..RUNTIME MICROSOFT VISUAL C++ 2015 - 2022 \par..\b0 Le presenti condizioni di licenza costituiscono il contratto tra Microsoft Corporation (o, in base al luogo di residenza del licenziatario, una delle sue consociate) e il licenziatario. Tali condizioni si applicano al software Microsoft di cui sopra. Le condizioni si applicano inoltre a qualsiasi servizio o aggiornamento di Microsoft relativo al software, tranne se accompagnato da condizioni differenti.\par..\b QUALORA IL LICENZIATARIO SI ATTENGA ALLE PRESENTI CONDIZIONI DI LICENZA, DISPORR\'c0 DEI DIRITTI INDICATI DI SEGUITO.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1040\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3319
Entropy (8bit):	5.019774955491369
Encrypted:	false
SSDEEP:
MD5:	D90BC60FA15299925986A52861B8E5D5
SHA1:	FADFCA9AB91B1AB4BD7F76132F712357BD6DB760
SHA-256:	0C57F40CC2091554307AA8A7C35DD38E4596E9513E9EFAE00AC30498EF4E9BC2
SHA-512:	11764D0E9F286B5AA7B1A9601170833E462A93A1E569A032FCBA9879174305582BD42794D4131B83FBCFBF1CF868A8D5382B11A4BD21F0F7D9B2E87E3C708C3F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Installazione di [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Annullare?</String>.. <String Id="HelpHeader">Guida alla configurazione</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installa, ripara, disinstalla o.. crea una copia locale completa del bundle nella directory. L'opzione predefinita . Install...../passive \| /quiet - visualizza un'interfaccia utente minima senza prompt oppure non visualizza alcuna interfaccia utente.. n. prompt. Per impostazione predefinita viene visualizzata l'intera interfaccia utente e tutti i prompt...../norestart - annulla quals

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1041\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	30228
Entropy (8bit):	3.785116198512527
Encrypted:	false
SSDEEP:
MD5:	47C315C54B6F2078875119FA7A718499
SHA1:	F650DDB5DF2AF2EE7555C410D034B37B9DFD055B
SHA-256:	C3061A334BFD5F02B7085F8F454D5D3D97D477AF14BAB497BF31A7887BC90C5B
SHA-512:	A0E4B0FCCCFDD93BAF133C2080403E8719E4A6984237F751BD883C0D3C52D818EFD00F8BA7726A2F645F66286305599403470F14D39EEDC526DDE59228A5F261
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset128 MS PGothic;}{\f1\fnil\fcharset0 Tahoma;}{\f2\fnil\fcharset134 SimSun;}{\f3\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9\'83\'7d\'83\'43\'83\'4e\'83\'8d\'83\'5c\'83\'74\'83\'67\f1 \f0\'83\'5c\'83\'74\'83\'67\'83\'45\'83\'46\'83\'41\f1 \f0\'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8d\'80\f1\par..MICROSOFT VISUAL C++ 2015 - 2022 \f0\'83\'89\'83\'93\'83\'5e\'83\'43\'83\'80\f1\par..\b0\f0\'96\'7b\'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8d\'80\'82\'cd\f2\'a1\'a2\f1 Microsoft Corporation\f2\'a3\'a8\f0\'82\'dc\'82\'bd\'82\'cd\'82\'a8\'8b\'71\'97\'6c\'82\'cc\'8f\'8a\'8d\'dd\'92\'6e\'82\'c9\'89\'9e\'82\'b6\'82\'bd\'8a\'d6\'98\'41\'89\'ef\'8e\'d0\f2\'a3\'a9\f0\'82\'c6\'82\'a8\'8b\'71\'97\'6c\'82\'c6\'82\'cc\'8c\'5f\'96\'f1\'82\'f0\'8d\'5c\'90\'ac\'82\'b5\'82\'dc\'82\'b7\f2\'a1\'a3\'b

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1041\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3959
Entropy (8bit):	5.955167044943003
Encrypted:	false
SSDEEP:
MD5:	DC81ED54FD28FC6DB6F139C8DA1BDED6
SHA1:	9C719C32844F78AAE523ADB8EE42A54D019C2B05
SHA-256:	6B9BBF90D75CFA7D943F036C01602945FE2FA786C6173E22ACB7AFE18375C7EA
SHA-512:	FD759C42C7740EE9B42EA910D66B0FA3F813600FD29D074BB592E5E12F5EC09DB6B529680E54F7943821CEFE84CE155A151B89A355D99C25A920BF8F254AA008
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.. <Control Control="InstallButton" X="275" Y="237" Width="110" Height="23"/>.. <Control Control="UninstallButton" X="270" Y="237" Width="120" Height="23"/>.. <Control Control="RepairButton" X="187" Y="237" Width="80" Height="23"/>.. .. <String Id="Caption">[WixBundleName] .......</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">..........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ............ ......... .........................

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1042\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	28393
Entropy (8bit):	3.874126830110936
Encrypted:	false
SSDEEP:
MD5:	641D926354F001034CF3F2F3B0FF33DC
SHA1:	5505107FFF6CF279769A82510276F61EA18637AE
SHA-256:	3D4E9C165CBEAB829D608106F0E96450F839FFA8ADBD755F0B51867E89DA2AE0
SHA-512:	B0339664434B096ABC26D600F7657919EF3689B4E0FDFD4EDD8E479859A51EF51BE8F05FA43E25567FFD6C1C2BCC6EF0D7A857B6D666D264C7783BAD3A383D0E
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset129 Malgun Gothic;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT \f1\'bc\'d2\'c7\'c1\'c6\'ae\'bf\'fe\'be\'ee\f0 \f1\'b6\'f3\'c0\'cc\'bc\'b1\'bd\'ba\f0 \f1\'b0\'e8\'be\'e0\'bc\'ad\f0\par..MICROSOFT VISUAL C++ 2015 - 2022 \f1\'b7\'b1\'c5\'b8\'c0\'d3\f0 \par..\b0\f1\'ba\'bb\f0 \f1\'b6\'f3\'c0\'cc\'bc\'b1\'bd\'ba\f0 \f1\'b0\'e8\'be\'e0\'c0\'ba\f0 Microsoft Corporation(\f1\'b6\'c7\'b4\'c2\f0 \f1\'b0\'c5\'c1\'d6\f0 \f1\'c1\'f6\'bf\'aa\'bf\'a1\f0 \f1\'b5\'fb\'b6\'f3\f0 \f1\'b0\'e8\'bf\'ad\'bb\'e7\f0 \f1\'c1\'df\f0 \f1\'c7\'cf\'b3\'aa\f0 )\f1\'b0\'fa\f0 \f1\'b1\'cd\'c7\'cf\f0 \f1\'b0\'a3\'bf\'a1\f0 \f1\'c3\'bc\'b0\'e1\'b5\'c7\'b4\'c2\f0 \f1\'b0\'e8\'be\'e0\'c0\'d4\'b4\'cf\'b4\'d9\f0 . \f1\'ba\'bb\f0 \f1\'b6\'f3\'c0\'cc\'bc\'b1\'bd\'ba\f0 \f1\'

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1042\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3249
Entropy (8bit):	5.985100495461761
Encrypted:	false
SSDEEP:
MD5:	B3399648C2F30930487F20B50378CEC1
SHA1:	CA7BDAB3BFEF89F6FA3C4AAF39A165D14069FC3D
SHA-256:	AD7608B87A7135F408ABF54A897A0F0920080F76013314B00D301D6264AE90B2
SHA-512:	C5B0ECF11F6DADF2E68BC3AA29CC8B24C0158DAE61FE488042D1105341773166C9EBABE43B2AF691AD4D4B458BF4A4BF9689C5722C536439CA3CDC84C0825965
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] .. ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">.. ...</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ..... ... .. .. .... .., .., .. .... ...... ... .........../passive \| /quiet - .... .. .. UI. ..... UI ... ..... .... ..... ..... UI. .. ..... ........../norestart - .. .... .. .... ...

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1045\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	13352
Entropy (8bit):	5.359561719031494
Encrypted:	false
SSDEEP:
MD5:	F140FD8CA2C63A861D04310257C1B1DB
SHA1:	7BF7EF763A1F80ECACA692908F8F0790A88C3CA1
SHA-256:	6F94A99072061012C5626A6DD069809EC841D6E3102B48394D522A0C2E3AA2B5
SHA-512:	A0BD65AF13CC11E41E5021DF0399E5D21B340EF6C9BBE9B1B56A1766F609CEB031F550A7A0439264B10D67A76A6403E41ABA49B3C9E347CAEDFE9AF0C5BE1EE6
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset0 Garamond;}{\f3\fnil Tahoma;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 POSTANOWIENIA LICENCYJNE DOTYCZ\f1\'a5CE OPROGRAMOWANIA MICROSOFT\par..\f0 MICROSOFT VISUAL C++ \f1\'8cRODOWISKO URUCHOMIENIOWE 2015-2022 \par..\b0\f0 Niniejsze postanowienia licencyjne stanowi\f1\'b9 umow\'ea mi\'eadzy Microsoft Corporation (lub, w zale\'bfno\'9cci od miejsca zamieszkania Licencjobiorcy, jednym z podmiot\f0\'f3w stowarzyszonych Microsoft Corporation) a Licencjobiorc\f1\'b9. Postanowienia te dotycz\'b9 oprogramowania okre\'9clonego powy\'bfej. Niniejsze postanowienia maj\'b9 r\f0\'f3wnie\f1\'bf zastosowanie do wszelkich us\'b3ug i aktualizacji Microsoft dla niniejszego oprogramowania, z wyj\'b9tkiem tych, kt\f0\'f3rym tow

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1045\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3212
Entropy (8bit):	5.268378763359481
Encrypted:	false
SSDEEP:
MD5:	15172EAF5C2C2E2B008DE04A250A62A1
SHA1:	ED60F870C473EE87DF39D1584880D964796E6888
SHA-256:	440B309FCDF61FFC03B269FE3815C60CB52C6AE3FC6ACAD14EAC04D057B6D6EA
SHA-512:	48AA89CF4A0B64FF4DCB82E372A01DFF423C12111D35A4D27B6D8DD793FFDE130E0037AB5E4477818A0939F61F7DB25295E4271B8B03F209D8F498169B1F9BAE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instalator [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Czy na pewno chcesz anulowa.?</String>.. <String Id="HelpHeader">Instalator . Pomoc</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [katalog] - Instaluje, naprawia, odinstalowuje.. lub tworzy pe.n. lokaln. kopi. pakietu w katalogu. Domy.lnie jest u.ywany prze..cznik install...../passive \| /quiet - Wy.wietla ograniczony interfejs u.ytkownika bez monit.w albo nie wy.wietla ani interfejsu u.ytkownika,.. ani monit.w. Domy.lnie jest wy.wietlany interfejs u.ytkownika oraz wszystkie monity...../norestart - Pom

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1046\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	10956
Entropy (8bit):	5.086757849952268
Encrypted:	false
SSDEEP:
MD5:	9A8D2ACF07F3C01E5CBC461AB932D85B
SHA1:	8781A298DCC14C18C6F6DB58B64F50B2FC6E338E
SHA-256:	27891EEC899BE859E3B4D3B29247FC6B535D7E836DEF0329111C48741EC6E701
SHA-512:	A60262A0C18E3BEF7C6D52F242153EBE891F676ED639F2DACFEBBAC86E70EEBF58AA95A7FE1A16E15A553C1BD3ECACCD8677EB9D2761CB79CB9A342C9B4252E2
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 TERMOS DE LICEN\'c7A PARA SOFTWARE MICROSOFT\par..TEMPO DE EXECU\'c7\'c3O DO MICROSOFT VISUAL C++ 2015 - 2022 \par..\b0 Os presentes termos de licen\'e7a constituem um contrato firmado entre a Microsoft Corporation (ou, dependendo do local no qual voc\'ea esteja domiciliado, uma de suas afiliadas) e voc\'ea. Eles se aplicam ao software indicado acima. Os termos tamb\'e9m se aplicam a quaisquer servi\'e7os ou atualiza\'e7\'f5es da Microsoft para o software, exceto at\'e9 a extens\'e3o de que eles tenham termos diferentes.\par..\b SE VOC\'ca CONCORDAR COM ESTES TERMOS DE LICEN\'c7A, TER\'c1 OS DIREITOS INDICADOS ABAIXO.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360{\pn

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1046\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3095
Entropy (8bit):	5.150868216959352
Encrypted:	false
SSDEEP:
MD5:	BE27B98E086D2B8068B16DBF43E18D50
SHA1:	6FAF34A36C8D9DE55650D0466563852552927603
SHA-256:	F52B54A0E0D0E8F12CBA9823D88E9FD6822B669074DD1DC69DAD6553F7CB8913
SHA-512:	3B7C773EF72D40A8B123FDB8FC11C4F354A3B152CF6D247F02E494B0770C28483392C76F3C222E3719CF500FE98F535014192ACDDD2ED9EF971718EA3EC0A73E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] Instala..o</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem certeza de que deseja cancelar?</String>.. <String Id="HelpHeader">Ajuda da Instala..o</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [diret.rio - instala, repara, desinstala ou.. cria uma c.pia local completa do pacote no diret.rio. Install . o padr.o..../passive \| /quiet - exibe a IU m.nima sem nenhum prompt ou n.o exibe nenhuma IU e.. nenhum prompt. Por padr.o, a IU e todos os prompts s.o exibidos...../norestart - suprime qualquer tentativa de reiniciar. Por padr.o, a IU perguntar. antes de reiniciar

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1049\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	31981
Entropy (8bit):	3.6408688850128446
Encrypted:	false
SSDEEP:
MD5:	62229BE4447C349DF353C5D56372D64B
SHA1:	989799ED24913A0E6AE2546EE2A9A8D556E1CB3B
SHA-256:	1BB3FB55B8A13FA3BAFFFE72F5B1ED8B57A63BD4D8654BB6DC5B9011CE803B44
SHA-512:	FA366328C3FD4F683FDB1C5A64F5D554DE79620331086E8B4CCC2BFC2595B1FDED02CEC8AA982FCD8B13CC175D222AF2D7E2CD1A33B52F36AFD692B533FDBF13
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset204 Tahoma;}{\f1\fnil Tahoma;}{\f2\fnil\fcharset0 Tahoma;}{\f3\fnil\fcharset204 Garamond;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang1049\'d3\'d1\'cb\'ce\'c2\'c8\'df \'cb\'c8\'d6\'c5\'cd\'c7\'c8\'c8 \'cd\'c0 \'cf\'d0\'ce\'c3\'d0\'c0\'cc\'cc\'cd\'ce\'c5 \'ce\'c1\'c5\'d1\'cf\'c5\'d7\'c5\'cd\'c8\'c5 MICROSOFT\par..\'d1\'d0\'c5\'c4\'c0 \'c2\'db\'cf\'ce\'cb\'cd\'c5\'cd\'c8\'df MICROSOFT VISUAL C++ 2015\f1\endash\f2 2022 \par..\b0\f0\'cd\'e0\'f1\'f2\'ee\'ff\'f9\'e8\'e5 \'f3\'f1\'eb\'ee\'e2\'e8\'ff \'eb\'e8\'f6\'e5\'ed\'e7\'e8\'e8 \'ff\'e2\'eb\'ff\'fe\'f2\'f1\'ff \'f1\'ee\'e3\'eb\'e0\'f8\'e5\'ed\'e8\'e5\'ec \'ec\'e5\'e6\'e4\'f3 \'ea\'ee\'f0\'ef\'ee\'f0\'e0\'f6\'e8\'e5\'e9 Microsoft (\'e8\'eb\'e8, \'e2 \'e7\'e0\'e2\'e8\'f1\'e8\'ec\'ee\'f1\'f2\'e8 \'ee\'f2 \'ec\'e5\'f1\'f2\'e0

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1049\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	5.444436038992627
Encrypted:	false
SSDEEP:
MD5:	17C652452E5EE930A7F1E5E312C17324
SHA1:	59F3308B87143D8EA0EA319A1F1A1F5DA5759DD3
SHA-256:	7333BC8E52548821D82B53DBD7D7C4AA1703C85155480CB83CEFD78380C95661
SHA-512:	53FD207B96D6BCF0A442E2D90B92E26CBB3ECC6ED71B753A416730E8067E831E9EB32981A9E9368C4CCA16AFBCB2051483FDCFC474EA8F0D652FCA934634FBE8
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.. <Control Control="InstallButton" X="275" Y="237" Width="110" Height="23"/>.... <String Id="Caption">......... ......... [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">....... .. .........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [.......] - ........., .............., ........ ..... ........ ...... ......... ..... ...... . ......... .. ......... - ............../passive \| /quiet - ........... ....

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1055\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	13807
Entropy (8bit):	5.2077828423114045
Encrypted:	false
SSDEEP:
MD5:	9625F3A496DBF5E3E0D2F33D417EDBBF
SHA1:	119376730428812A31B70D58C873866D5307A775
SHA-256:	F80926604E503697247353F56856B31DE0B3FC1319F1C94068363952549CC9B1
SHA-512:	DB91A14FC27E3A62324E024DD44E3B5548AF7E1C021201C3D851BD2F32537885AACFC64ADAE619BAC31B60229D1D5FC653F5301CD7187C69BD0ACECCE817D6A3
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset238 Garamond;}{\f3\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT YAZILIMI L\f1\u304?SANS KO\'aaULLARI\par..\f0 MICROSOFT VISUAL C++ 2015 - 2022 \'c7ALI\f1\'aaMA S\f0\'dcRESI \par..\b0 Bu lisans ko\f1\'baullar\u305?, Microsoft Corporation (veya ya\'baad\u305?\u287?\u305?n\u305?z yere g\f0\'f6re bir ba\f1\u287?l\u305? \'bairketi) ile sizin aran\u305?zda yap\u305?lan s\f0\'f6zle\f1\'bameyi olu\'baturur. Bu ko\'baullar, yukar\u305?da ad\u305? ge\f0\'e7en yaz\f1\u305?l\u305?m i\f0\'e7in ge\'e7erlidir. \f1\'aaartlar, yaz\u305?l\u305?m i\f0\'e7in t\'fcm Microsoft hizmetleri veya g\'fcncelle\f1\'batirmeleri i\f0\'e7in, beraberlerinde farkl\f1\u305? \'baartlar bulunmad\u305?\u287?\u305? s\f0\'fcrece ge\'e7erlidir.\pa

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\1055\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3221
Entropy (8bit):	5.280530692056262
Encrypted:	false
SSDEEP:
MD5:	DEFBEA001DC4EB66553630AC7CE47CCA
SHA1:	90CED64EC7C861F03484B5D5616FDBCDA8F64788
SHA-256:	E5ABE3CB3BF84207DAC4E6F5BBA1E693341D01AEA076DD2D91EAA21C6A6CB925
SHA-512:	B3B7A22D0CDADA21A977F1DCEAF2D73212A4CDDBD298532B1AC97575F36113D45E8D71C60A6D8F8CC2E9DBF18EE1000167CFBF0B2E7ED6F05462D77E0BCA0E90
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] Kurulumu</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.ptal etmek istedi.inizden emin misiniz?</String>.. <String Id="HelpHeader">Kurulum Yard.m.</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [dizin] - y.kler, onar.r, kald.r.r ya da.. dizindeki paketin tam bir yerel kopyas.n. olu.turur. Varsay.lan install de.eridir...../passive \| /quiet - en az d.zeyde istemsiz UI g.sterir ya da hi. UI g.stermez ve.. istem yoktur. Varsay.lan olarak UI ve t.m istemler g.r.nt.lenir...../norestart - yeniden ba.lama denemelerini engeller. Varsay.lan olarak UI yeniden ba.l

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\2052\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	18214
Entropy (8bit):	3.9837154113926356
Encrypted:	false
SSDEEP:
MD5:	D083C7E300928A0C5AEA5ECBD1653836
SHA1:	08F4F1F9F7DFA593BE3977515635967CE7A99E7A
SHA-256:	A808B4933CE3B3E0893504DBEF43EBF90B8B567F94BD6481B6315ED9141E1B11
SHA-512:	8CB3FFAD879BABA36137B7A21B62D9D6C530693F5E16FBB975F3E7C20F1DB5A686F3A6EE406D69B018AA494E4CD185F71B369A378AE3289B8080105157E63FD0
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset134 SimSun;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 Microsoft \f1\'c8\'ed\'bc\'fe\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\f0\par..MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0\f1\'d5\'e2\'d0\'a9\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\'ca\'c7\f0 Microsoft Corporation\f1\'a3\'a8\'bb\'f2\'c4\'fa\'cb\'f9\'d4\'da\'b5\'d8\'b5\'c4\f0 Microsoft \f1\'b9\'d8\'c1\'aa\'b9\'ab\'cb\'be\'a3\'a9\'d3\'eb\'c4\'fa\'d6\'ae\'bc\'e4\'b4\'ef\'b3\'c9\'b5\'c4\'d0\'ad\'d2\'e9\'a1\'a3\'d5\'e2\'d0\'a9\'cc\'f5\'bf\'ee\'ca\'ca\'d3\'c3\'d3\'da\'c9\'cf\'ca\'f6\'c8\'ed\'bc\'fe\'a1\'a3\'d5\'e2\'d0\'a9\'cc\'f5\'bf\'ee\'d2\'b2\'ca\'ca\'d3\'c3\'d3\'da\'d5\'eb\'b6\'d4\'b8\'c3\'c8\'ed\'bc\'fe\'b5\'c4\'c8\'ce\'ba\'ce\f0 Microsoft \f1\'b7\'fe\'ce\'f1\'bb\'f2\'b8\'fc\'d0\'c2\'a3\'ac\'

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\2052\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2978
Entropy (8bit):	6.135205733555905
Encrypted:	false
SSDEEP:
MD5:	3D1E15DEEACE801322E222969A574F17
SHA1:	58074C83775E1A884FED6679ACF9AC78ABB8A169
SHA-256:	2AC8B7C19A5189662DE36A0581C90DBAD96DF259EC00A28F609B644C3F39F9CA
SHA-512:	10797919845C57C5831234E866D730EBD13255E5BF8BA8087D53F1D0FC5D72DC6D5F6945DBEBEE69ACC6A2E20378750C4B78083AE0390632743C184532358E10
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [..] - .......... ..................Install ........../passive \| /quiet - ..... UI ......... UI ... ........ UI ........../norestart - ..................... UI.../log log.txt - ............. %TEMP% ...

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\3082\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	10825
Entropy (8bit):	5.1113252296046126
Encrypted:	false
SSDEEP:
MD5:	873A413D23F830D3E87DAB3B94153E08
SHA1:	24CFC24F22CEF89818718A86F55F27606EB42668
SHA-256:	ABC11BB2B04DFF6AFE2D4D4F40D95A7D62E5AF352928AF90DAA3DADE58DD59BD
SHA-512:	DC1ECCB5CC4D3047401E2BC31F5EB3E21C7881C02744A2E63C10D3C911D1158DCFAC023988E873C33DC381C989304FE1D3CB27ED99D7801285C4C378553CD821
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 T\'c9RMINOS DE LICENCIA DEL SOFTWARE DE MICROSOFT\par..MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0 Los t\'e9rminos de esta licencia son un contrato entre Microsoft Corporation (o, en funci\'f3n de donde viva, una de las sociedades del grupo) y usted. Se aplican al software mencionado anteriormente. Los t\'e9rminos tambi\'e9n se aplican a los servicios o actualizaciones de software de Microsoft, excepto en la medida en que sus t\'e9rminos sean diferentes.\par..\b SI USTED CUMPLE LOS PRESENTES T\'c9RMINOS DE ESTA LICENCIA, DISPONDR\'c1 DE LOS DERECHOS QUE A CONTINUACI\'d3N SE DESCRIBEN.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb1

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\3082\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3265
Entropy (8bit):	5.0491645049584655
Encrypted:	false
SSDEEP:
MD5:	47F9F8D342C9C22D0C9636BC7362FA8F
SHA1:	3922D1589E284CE76AB39800E2B064F71123C1C5
SHA-256:	9CBB2B312C100B309A1B1495E84E2228B937612885F7A642FBBD67969B632C3A
SHA-512:	E458DF875E9B0622AEBE3C1449868AA6A2826A1F851DB71165A872B2897CF870CCF85046944FF51FFC13BB15E54E9D9424EC36CAF5A2F38CE8B7D6DC0E9B2363
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instalaci.n de [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.Est. seguro de que desea cancelar la operaci.n?</String>.. <String Id="HelpHeader">Ayuda de configuraci.n</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - instala, repara, desinstala o.. crea una copia local completa del paquete en el directorio. La opci.n predeterminada es la instalaci.n...../passive \| /quiet - muestra una IU m.nima sin solicitudes o no muestra ninguna IU ni.. solicitud. De forma predeterminada, se muestran la IU y todas las solicitudes...../norestart - elimina cualquier intento

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\BootstrapperApplicationData.xml

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (633), with CRLF line terminators
Category:	dropped
Size (bytes):	15190
Entropy (8bit):	3.7409382498403283
Encrypted:	false
SSDEEP:
MD5:	BF582D7DDE516B304F9C065D5C7C14D0
SHA1:	C7469C443BDE7F981AFEB2B8915D6552D74DF578
SHA-256:	E3BECB81EF61964E7D969653B6DAC7C9873A46E58BAE4400AEB7656A04EAF5BE
SHA-512:	F9B7A054FF0F8C31DA1EFA5695B70FDCDF69E7EAE34854F08242FDB8AD30D7EFA5E3D118370FB7C91FE7C8D115C7AA77A98EEDA6EA2E2A3BAA665BE018A946CF
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.a.l.C.o.n.d.i.t.i.o.n. .C.o.n.d.i.t.i.o.n.=.".V.e.r.s.i.o.n.N.T. .&.g.t.;.=. .v.6...1.". .M.e.s.s.a.g.e.=.".[.W.i.x.B.u.n.d.l.e.N.a.m.e.]. .c.a.n. .o.n.l.y. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .W.i.n.d.o.w.s. .7. .a.n.d. .n.e.w.e.r. .p.l.a.t.f.o.r.m.s...". ./.>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=.".M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.5.-.2.0.2.2. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e. .(.x.6.4.). .-. .1.4...3.6...3.2.5.3.2.". .L.o.g.P.a.t.h.V.a.r.i.a.b.l.e.=.".W.i.x.B.u.n.d.l.e.L.o.g.". .C.o.m.p.r.e.s.s.e.d.=.".y.e.s.". .I.d.=.".{.8.b.d.f.e.6.6.9.-.9.7.0.5.-.4.1.8.4.-.9.3.6.8.-.d.b.9.c.e.5.8.1.e.0.e.7.}.". .U.p.g.r.a.d.e.C.o.d.e.=.".{.C.1.4.6.E.

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\license.rtf

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	9235
Entropy (8bit):	5.167332119309966
Encrypted:	false
SSDEEP:
MD5:	04B33F0A9081C10E85D0E495A1294F83
SHA1:	1EFE2FB2D014A731B752672745F9FFECDD716412
SHA-256:	8099DC3CF9502C335DA829E5C755948A12E3E6DE490EB492A99DEB673D883D8B
SHA-512:	D1DBED00DF921169DD61501E2A3E95E6D7807348B188BE9DD8FC63423501E4D848ECE19AC466C3CACFCCC6084E0EB2F457DC957990F6F511DF10FD426E432685
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT SOFTWARE LICENSE TERMS\par..MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0 These license terms are an agreement between Microsoft Corporation (or based on where you live, one of its affiliates) and you. They apply to the software named above. The terms also apply to any Microsoft services or updates for the software, except to the extent those have different terms.\par..\b IF YOU COMPLY WITH THESE LICENSE TERMS, YOU HAVE THE RIGHTS BELOW.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\sa120\sl240\slmult1\tx360 INSTALLATION AND USE RIGHTS. \b0\par....\pard{\pntext\f2\'B7\tab}{\*\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\f

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\logo.png

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1861
Entropy (8bit):	6.868587546770907
Encrypted:	false
SSDEEP:
MD5:	D6BD210F227442B3362493D046CEA233
SHA1:	FF286AC8370FC655AEA0EF35E9CF0BFCB6D698DE
SHA-256:	335A256D4779EC5DCF283D007FB56FD8211BBCAF47DCD70FE60DED6A112744EF
SHA-512:	464AAAB9E08DE610AD34B97D4076E92DC04C2CDC6669F60BFC50F0F9CE5D71C31B8943BD84CEE1A04FB9AB5BBED3442BD41D9CB21A0DD170EA97C463E1CE2B5B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...@...@.............sRGB.........gAMA......a.....PLTE].q^.r_.r_.s`.s`.s`.ta.ta.ub.ub.vc.vd.vd.vd.we.we.xe.xg.yg yg zh zh"zi"{j#\|i${j$\|n~n.n,.o,.p..q0.r2.s3.t5.x;.x<.y>.z?.\|B.~C.}E..F..F..H..I..J..L..O..P..W..Y..^..a..c..g..i..q..r..}.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S......pHYs..%...%....^.....tEXtSoftware.Paint.NET v3.5.100.r.....IDATXG..iW.@...EJ.$M...`AEpG..7TpWT@\.."....(..(.._;...di:9.c>q..g....T...._...-....F..+..w.

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\thm.wxl

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2952
Entropy (8bit):	5.052095286906672
Encrypted:	false
SSDEEP:
MD5:	FBFCBC4DACC566A3C426F43CE10907B6
SHA1:	63C45F9A771161740E100FAF710F30EED017D723
SHA-256:	70400F181D00E1769774FF36BCD8B1AB5FBC431418067D31B876D18CC04EF4CE
SHA-512:	063FB6685EE8D2FA57863A74D66A83C819FE848BA3072B6E7D1B4FE397A9B24A1037183BB2FDA776033C0936BE83888A6456AAE947E240521E2AB75D984EE35E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29" />.... <String Id="Caption">[WixBundleName] Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installs, repairs, uninstalls or.. creates a complete local copy of the bundle in directory. Install is the default...../passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt before restart.../log log.txt - logs to a specific file. B

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\thm.xml

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8332
Entropy (8bit):	5.184632608060528
Encrypted:	false
SSDEEP:
MD5:	F62729C6D2540015E072514226C121C7
SHA1:	C1E189D693F41AC2EAFCC363F7890FC0FEA6979C
SHA-256:	F13BAE0EC08C91B4A315BB2D86EE48FADE597E7A5440DCE6F751F98A3A4D6916
SHA-512:	CBBFBFA7E013A2B85B78D71D32FDF65323534816978E7544CA6CEA5286A0F6E8E7E5FFC4C538200211F11B94373D5658732D5D8AA1D01F9CCFDBF20F154F1471
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="485" Height="300" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.... <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png" Visible="yes"/>.. <Text X="80" Y="11" Width="-11" Heig

C:\Windows\Temp\{B69FEE28-8D22-4324-8AA7-89A4537BAC86}\.ba\wixstdba.dll

Download File

Process:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	195600
Entropy (8bit):	6.682530937585544
Encrypted:	false
SSDEEP:
MD5:	EAB9CAF4277829ABDF6223EC1EFA0EDD
SHA1:	74862ECF349A9BEDD32699F2A7A4E00B4727543D
SHA-256:	A4EFBDB2CE55788FFE92A244CB775EFD475526EF5B61AD78DE2BCDFADDAC7041
SHA-512:	45B15ADE68E0A90EA7300AEB6DCA9BC9E347A63DBA5CE72A635957564D1BDF0B1584A5E34191916498850FC7B3B7ECFBCBFCB246B39DBF59D47F66BC825C6FD2
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3..R...R...R..h.N..R..h.L.R..h.M..R.......R.......R.......R...<..R...,..R...R...S..K....R..K....R..N.@..R...R(..R..K....R..Rich.R..................PE..L......Z...........!................d.....................................................@..............................................................D......,.......T...............................@...............X............................text............................... ..`.rdata.............................@..@.data...............................@....gfids..............................@..@.rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1028\license.rtf

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	18415
Entropy (8bit):	4.043868285184243
Encrypted:	false
SSDEEP:
MD5:	2B063D92663595DFE4781AE687A03D86
SHA1:	0FB582E756DBC751EA380593AC4DA27DDB4EBB06
SHA-256:	44C76290F7A2E45940E8338912FEB49BCF4E071CFA85D2D34762857743ACBC8D
SHA-512:	94C8FDA6173C7F5740F206190EDCD1F1F1C309596B710D400E23CD363A619D707A5D4576D4FE63AB7CB68947F009EFD29A1FBE04743A294698BF2AE17E92C214
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset134 SimSun;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT \f1\'dc\'9b\'f3\'77\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\f0\par..MICROSOFT VISUAL C++ 2015 - 2022 \f1\'88\'cc\'d0\'d0\'eb\'41\'b6\'ce\f0 \par..\b0\f1\'b1\'be\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\'ca\'c7\'d9\'46\'d3\'c3\'91\'f4\'c5\'63\f0 Microsoft Corporation (\f1\'bb\'f2\'c6\'e4\'ea\'50\'82\'53\'c6\'f3\'98\'49\'a3\'ac\'d2\'95\'d9\'46\'d3\'c3\'91\'f4\'cb\'f9\'be\'d3\'d7\'a1\'b5\'c4\'b5\'d8\'fc\'63\'b6\'f8\'b6\'a8\f0 ) \f1\'d6\'ae\'e9\'67\'b3\'c9\'c1\'a2\'b5\'c4\'ba\'cf\'bc\'73\'a1\'a3\'cb\'fc\'82\'83\'df\'6d\'d3\'c3\'ec\'b6\'c9\'cf\'ca\'f6\'dc\'9b\'f3\'77\'a1\'a3\'b1\'be\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\'d2\'e0\'df\'6d\'d3\'c3\'ec\'b6\'c8\'ce\'ba\'ce\f0 Microsoft \f1\'b7\'fe\'84\'d5\

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1028\thm.wxl

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.163758160900388
Encrypted:	false
SSDEEP:
MD5:	472ABBEDCBAD24DBA5B5F5E8D02C340F
SHA1:	974F62B5C2E149C3879DD16E5A9DBB9406C3DB85
SHA-256:	8E2E660DFB66CB453E17F1B6991799678B1C8B350A55F9EBE2BA0028018A15AD
SHA-512:	676E29378AAED25DE6008D213EFA10D1F5AAD107833E218D71F697E728B7B5B57DE42E7A910F121948D7B1B47AB4F7AE63F71196C747E8AE2B4827F754FC2699
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">....</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ................. ......................../passive \| /quiet - .... UI ........... UI.... ........... UI ........../norestart - ................UI ............./log log.txt - .........

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1029\license.rtf

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	13234
Entropy (8bit):	5.125368352290407
Encrypted:	false
SSDEEP:
MD5:	E7DC9CA9474A13FA4529D91BCD2AB8CC
SHA1:	511F5DE8A99C09EC3766C5E2494A79EACCA261C8
SHA-256:	503C433DCDE2F3A9E7D388A5FF2B0612E7D8F90F5188D5B2B60228DB33044FDE
SHA-512:	77108E53CD58E42F847D8EF23A07723C4849DC41DBE1C3EF939B9170E75F525BEC9D210D6C1FBFEB330ECE2E77B8A8E2808730D9E6F72F5B3FE626D58B6068C6
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset0 Garamond;}{\f3\fnil Tahoma;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 LICEN\f1\'c8N\f0\'cd PODM\'cdNKY PRO SOFTWARE SPOLE\f1\'c8NOSTI MICROSOFT\par..\f0 MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0 Tyto licen\f1\'e8n\f0\'ed podm\'ednky p\f1\'f8edstavuj\f0\'ed smlouvu mezi spole\f1\'e8nost\f0\'ed Microsoft Corporation (nebo n\f1\'eckterou z jej\f0\'edch afilac\'ed, v\~z\'e1vislosti na tom, kde bydl\'edte) a v\'e1mi. Vztahuj\'ed se na v\'fd\f1\'9ae uveden\f0\'fd software. Podm\'ednky se rovn\f1\'ec\'9e vztahuj\f0\'ed na jak\'e9koli slu\f1\'9eby Microsoft nebo aktualizace pro software, pokud se na slu\'9eby nebo aktualizace nevztahuj\f0\'ed odli\f1\'9an\f0\'e9 podm\'ednky.\par..\b DODR\f1\'8e\f0\'cdTE-LI

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1029\thm.wxl

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3333
Entropy (8bit):	5.370651462060085
Encrypted:	false
SSDEEP:
MD5:	16343005D29EC431891B02F048C7F581
SHA1:	85A14C40C482D9351271F6119D272D19407C3CE9
SHA-256:	07FB3EC174F25DFBE532D9D739234D9DFDA8E9D34F01FE660C5B4D56989FA779
SHA-512:	FF1AE9C21DCFB018DD4EC82A6D43362CB8C591E21F45DD1C25955D83D328B57C8D454BBE33FBC73A70DADF1DFB3AE27502C9B3A8A3FF2DA97085CA0D9A68AB03
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instala.n. program [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Opravdu chcete akci zru.it?</String>.. <String Id="HelpHeader">N.pov.da nastaven.</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [adres..] . Nainstaluje, oprav., odinstaluje nebo.. vytvo.. .plnou m.stn. kopii svazku v adres..i. V.choz. mo.nost. je instalace...../passive \| /quiet . Zobraz. minim.ln. u.ivatelsk. rozhran. bez v.zev nebo nezobraz. ..dn. u.ivatelsk. rozhran. a.. ..dn. v.zvy. V.choz. mo.nost. je zobrazen. u.ivatelsk.ho rozhran. a v.ech v.zev...../noresta

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1031\license.rtf

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	12392
Entropy (8bit):	5.192979871787938
Encrypted:	false
SSDEEP:
MD5:	2DDCA2866D76C850F68ACDFDB696D6DE
SHA1:	C5076F10B0F0654CDE2C990DEEB2772F3CC4844B
SHA-256:	28F63BAD9C2960395106011761993049546607F8A850D344D6A54042176BF03F
SHA-512:	E3A3693B92873E0B42007616FF6916304EDC5C4F2EEE3E9276F87E86DD94C2BF6E1CF4E895CDF9A1AA0CAC0B381B8840EEE1F491123E901DEE75638B8BC5CE1B
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil Tahoma;}{\f3\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT-SOFTWARE-LIZENZBEDINGUNGEN\par..MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0 Diese Lizenzbestimmungen stellen eine Vereinbarung zwischen Ihnen und der Microsoft Corporation (bzw. abh\'e4ngig von Ihrem Wohnsitz einem ihrer Affiliate-Partner) dar. Sie gelten f\'fcr die oben angef\'fchrte Software. Die Bestimmungen gelten ebenso f\'fcr jegliche von Microsoft angebotenen Dienste oder Updates f\'fcr die Software, sofern diesen keine anderen Bestimmungen beiliegen.\par..\b WENN SIE DIESE LIZENZBESTIMMUNGEN EINHALTEN, VERF\'dcGEN SIE \'dcBER DIE NACHFOLGEND AUFGEF\'dcHRTEN RECHTE.\par....\pard{\pntext\f3\'B7\tab}{\\pn\pnlvlblt\pnf3\pnindent360{\pntxtb\'B7}}\

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1031\thm.wxl

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3379
Entropy (8bit):	5.094097800535488
Encrypted:	false
SSDEEP:
MD5:	561F3F32DB2453647D1992D4D932E872
SHA1:	109548642FB7C5CC0159BEDDBCF7752B12B264C0
SHA-256:	8E0DCA6E085744BFCBFF46F7DCBCFA6FBD722DFA52013EE8CEEAF682D7509581
SHA-512:	CEF8C80BEF8F88208E0751305DF519C3D2F1C84351A71098DC73392EC06CB61A4ACA35182A0822CF6934E8EE42196E2BCFE810CC859965A9F6F393858A1242DF
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] - Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">M.chten Sie den Vorgang wirklich abbrechen?</String>.. <String Id="HelpHeader">Setup-Hilfe</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [Verzeichnis] - installiert, repariert, deinstalliert oder.. erstellt eine vollst.ndige lokale Kopie des Bundles im Verzeichnis. Installieren ist die Standardeinstellung...../passive \| /quiet - zeigt eine minimale Benutzeroberfl.che ohne Eingabeaufforderungen oder keine.. Benutzeroberfl.che und keine Eingabeaufforderungen an. Standardm..ig werden die Benutzeroberfl.che und alle Eingab

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1036\license.rtf

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	12349
Entropy (8bit):	5.108676965693909
Encrypted:	false
SSDEEP:
MD5:	A6E352E5804313CCDE3E4D5DDDDE122D
SHA1:	834E3AAA07DC675589A9E5FCD23CE5586C2739E8
SHA-256:	5C13A65870D770D1642A4259EECB436257CA39016A0500F747BE9C79BE0C7009
SHA-512:	6578AC6467F61930BC1B20E404441725C63790C65AEC1ACE297429EAD15F50E68D5FE9CC1451AC86AE23DC1A7FE967650166293010D687785FB81FB4492B87C4
Malicious:	false
Reputation:	low
Preview:	{\rtf1\fbidis\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil Tahoma;}{\f2\fnil\fcharset0 Garamond;}{\f3\fnil\fcharset177 Tahoma;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\ltrpar\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 TERMES DU CONTRAT DE LICENCE LOGICIEL MICROSOFT\par..MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0 Les pr\'e9sentes conditions de licence constituent un contrat entre Microsoft Corporation (ou en fonction de votre lieu de r\'e9sidence, l\f1\rquote\f0 un de ses affili\'e9s) et vous. Ils s\f1\rquote\f0 appliquent au logiciel vis\'e9 ci-dessus. Les termes s\f1\rquote\f0 appliquent \'e9galement \'e0 tout service et \'e0 toute mise \'e0 jour Microsoft pour ce logiciel, \'e0 moins que d\f1\rquote\f0 autres termes n\f1\rquote\f0 accompagnent ces \'e9l\'e9ments.\par..\b SI VOUS VOUS CONFORMEZ AUX PR\'c9SENTS TERMES DU CONTRAT D

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1036\thm.wxl

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3366
Entropy (8bit):	5.0912204406356905
Encrypted:	false
SSDEEP:
MD5:	7B46AE8698459830A0F9116BC27DE7DF
SHA1:	D9BB14D483B88996A591392AE03E245CAE19C6C3
SHA-256:	704DDF2E60C1F292BE95C7C79EE48FE8BA8534CEB7CCF9A9EA68B1AD788AE9D4
SHA-512:	FC536DFADBCD81B42F611AC996059A6264E36ECF72A4AEE7D1E37B87AEFED290CC5251C09B68ED0C8719F655B163AD0782ACD8CE6332ED4AB4046C12D8E6DBF6
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Installation de [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Voulez-vous vraiment annuler.?</String>.. <String Id="HelpHeader">Aide du programme d'installation</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installe, r.pare, d.sinstalle ou.. cr.e une copie locale compl.te du groupe dans le r.pertoire. Install est l'option par d.faut...../passive \| /quiet - affiche une interface minimale, sans invite, ou n'affiche ni interface.. ni invite. Par d.faut, l'interface et toutes les invites sont affich.es...../norestart - supprime toutes les tentatives de red.

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1040\license.rtf

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	11440
Entropy (8bit):	5.037988271709582
Encrypted:	false
SSDEEP:
MD5:	BC58AD6ABB16B982AEBADC121B37E706
SHA1:	25E3E4127A643DB5DB2A0B62B02DE871359FAE42
SHA-256:	70ECF23C03B66A2B18E173332586AFA8F00F91E02A80628F4F9CB2521E27F6AC
SHA-512:	8340452CB5E196CB1D5DA6DBB3FA8872E519D7903A05331055370B4850D912674F0B6AF3D6E4F94248FE8135EB378EB36969821D711FE1624A04AF13BBE55D70
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 CONDIZIONI DI LICENZA SOFTWARE MICROSOFT\par..RUNTIME MICROSOFT VISUAL C++ 2015 - 2022 \par..\b0 Le presenti condizioni di licenza costituiscono il contratto tra Microsoft Corporation (o, in base al luogo di residenza del licenziatario, una delle sue consociate) e il licenziatario. Tali condizioni si applicano al software Microsoft di cui sopra. Le condizioni si applicano inoltre a qualsiasi servizio o aggiornamento di Microsoft relativo al software, tranne se accompagnato da condizioni differenti.\par..\b QUALORA IL LICENZIATARIO SI ATTENGA ALLE PRESENTI CONDIZIONI DI LICENZA, DISPORR\'c0 DEI DIRITTI INDICATI DI SEGUITO.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1040\thm.wxl

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3319
Entropy (8bit):	5.019774955491369
Encrypted:	false
SSDEEP:
MD5:	D90BC60FA15299925986A52861B8E5D5
SHA1:	FADFCA9AB91B1AB4BD7F76132F712357BD6DB760
SHA-256:	0C57F40CC2091554307AA8A7C35DD38E4596E9513E9EFAE00AC30498EF4E9BC2
SHA-512:	11764D0E9F286B5AA7B1A9601170833E462A93A1E569A032FCBA9879174305582BD42794D4131B83FBCFBF1CF868A8D5382B11A4BD21F0F7D9B2E87E3C708C3F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Installazione di [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Annullare?</String>.. <String Id="HelpHeader">Guida alla configurazione</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installa, ripara, disinstalla o.. crea una copia locale completa del bundle nella directory. L'opzione predefinita . Install...../passive \| /quiet - visualizza un'interfaccia utente minima senza prompt oppure non visualizza alcuna interfaccia utente.. n. prompt. Per impostazione predefinita viene visualizzata l'intera interfaccia utente e tutti i prompt...../norestart - annulla quals

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1041\license.rtf

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	30228
Entropy (8bit):	3.785116198512527
Encrypted:	false
SSDEEP:
MD5:	47C315C54B6F2078875119FA7A718499
SHA1:	F650DDB5DF2AF2EE7555C410D034B37B9DFD055B
SHA-256:	C3061A334BFD5F02B7085F8F454D5D3D97D477AF14BAB497BF31A7887BC90C5B
SHA-512:	A0E4B0FCCCFDD93BAF133C2080403E8719E4A6984237F751BD883C0D3C52D818EFD00F8BA7726A2F645F66286305599403470F14D39EEDC526DDE59228A5F261
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset128 MS PGothic;}{\f1\fnil\fcharset0 Tahoma;}{\f2\fnil\fcharset134 SimSun;}{\f3\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9\'83\'7d\'83\'43\'83\'4e\'83\'8d\'83\'5c\'83\'74\'83\'67\f1 \f0\'83\'5c\'83\'74\'83\'67\'83\'45\'83\'46\'83\'41\f1 \f0\'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8d\'80\f1\par..MICROSOFT VISUAL C++ 2015 - 2022 \f0\'83\'89\'83\'93\'83\'5e\'83\'43\'83\'80\f1\par..\b0\f0\'96\'7b\'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8d\'80\'82\'cd\f2\'a1\'a2\f1 Microsoft Corporation\f2\'a3\'a8\f0\'82\'dc\'82\'bd\'82\'cd\'82\'a8\'8b\'71\'97\'6c\'82\'cc\'8f\'8a\'8d\'dd\'92\'6e\'82\'c9\'89\'9e\'82\'b6\'82\'bd\'8a\'d6\'98\'41\'89\'ef\'8e\'d0\f2\'a3\'a9\f0\'82\'c6\'82\'a8\'8b\'71\'97\'6c\'82\'c6\'82\'cc\'8c\'5f\'96\'f1\'82\'f0\'8d\'5c\'90\'ac\'82\'b5\'82\'dc\'82\'b7\f2\'a1\'a3\'b

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1041\thm.wxl

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3959
Entropy (8bit):	5.955167044943003
Encrypted:	false
SSDEEP:
MD5:	DC81ED54FD28FC6DB6F139C8DA1BDED6
SHA1:	9C719C32844F78AAE523ADB8EE42A54D019C2B05
SHA-256:	6B9BBF90D75CFA7D943F036C01602945FE2FA786C6173E22ACB7AFE18375C7EA
SHA-512:	FD759C42C7740EE9B42EA910D66B0FA3F813600FD29D074BB592E5E12F5EC09DB6B529680E54F7943821CEFE84CE155A151B89A355D99C25A920BF8F254AA008
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.. <Control Control="InstallButton" X="275" Y="237" Width="110" Height="23"/>.. <Control Control="UninstallButton" X="270" Y="237" Width="120" Height="23"/>.. <Control Control="RepairButton" X="187" Y="237" Width="80" Height="23"/>.. .. <String Id="Caption">[WixBundleName] .......</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">..........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ............ ......... .........................

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1042\license.rtf

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	28393
Entropy (8bit):	3.874126830110936
Encrypted:	false
SSDEEP:
MD5:	641D926354F001034CF3F2F3B0FF33DC
SHA1:	5505107FFF6CF279769A82510276F61EA18637AE
SHA-256:	3D4E9C165CBEAB829D608106F0E96450F839FFA8ADBD755F0B51867E89DA2AE0
SHA-512:	B0339664434B096ABC26D600F7657919EF3689B4E0FDFD4EDD8E479859A51EF51BE8F05FA43E25567FFD6C1C2BCC6EF0D7A857B6D666D264C7783BAD3A383D0E
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset129 Malgun Gothic;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT \f1\'bc\'d2\'c7\'c1\'c6\'ae\'bf\'fe\'be\'ee\f0 \f1\'b6\'f3\'c0\'cc\'bc\'b1\'bd\'ba\f0 \f1\'b0\'e8\'be\'e0\'bc\'ad\f0\par..MICROSOFT VISUAL C++ 2015 - 2022 \f1\'b7\'b1\'c5\'b8\'c0\'d3\f0 \par..\b0\f1\'ba\'bb\f0 \f1\'b6\'f3\'c0\'cc\'bc\'b1\'bd\'ba\f0 \f1\'b0\'e8\'be\'e0\'c0\'ba\f0 Microsoft Corporation(\f1\'b6\'c7\'b4\'c2\f0 \f1\'b0\'c5\'c1\'d6\f0 \f1\'c1\'f6\'bf\'aa\'bf\'a1\f0 \f1\'b5\'fb\'b6\'f3\f0 \f1\'b0\'e8\'bf\'ad\'bb\'e7\f0 \f1\'c1\'df\f0 \f1\'c7\'cf\'b3\'aa\f0 )\f1\'b0\'fa\f0 \f1\'b1\'cd\'c7\'cf\f0 \f1\'b0\'a3\'bf\'a1\f0 \f1\'c3\'bc\'b0\'e1\'b5\'c7\'b4\'c2\f0 \f1\'b0\'e8\'be\'e0\'c0\'d4\'b4\'cf\'b4\'d9\f0 . \f1\'ba\'bb\f0 \f1\'b6\'f3\'c0\'cc\'bc\'b1\'bd\'ba\f0 \f1\'

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1042\thm.wxl

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3249
Entropy (8bit):	5.985100495461761
Encrypted:	false
SSDEEP:
MD5:	B3399648C2F30930487F20B50378CEC1
SHA1:	CA7BDAB3BFEF89F6FA3C4AAF39A165D14069FC3D
SHA-256:	AD7608B87A7135F408ABF54A897A0F0920080F76013314B00D301D6264AE90B2
SHA-512:	C5B0ECF11F6DADF2E68BC3AA29CC8B24C0158DAE61FE488042D1105341773166C9EBABE43B2AF691AD4D4B458BF4A4BF9689C5722C536439CA3CDC84C0825965
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] .. ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">.. ...</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ..... ... .. .. .... .., .., .. .... ...... ... .........../passive \| /quiet - .... .. .. UI. ..... UI ... ..... .... ..... ..... UI. .. ..... ........../norestart - .. .... .. .... ...

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1045\license.rtf

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	13352
Entropy (8bit):	5.359561719031494
Encrypted:	false
SSDEEP:
MD5:	F140FD8CA2C63A861D04310257C1B1DB
SHA1:	7BF7EF763A1F80ECACA692908F8F0790A88C3CA1
SHA-256:	6F94A99072061012C5626A6DD069809EC841D6E3102B48394D522A0C2E3AA2B5
SHA-512:	A0BD65AF13CC11E41E5021DF0399E5D21B340EF6C9BBE9B1B56A1766F609CEB031F550A7A0439264B10D67A76A6403E41ABA49B3C9E347CAEDFE9AF0C5BE1EE6
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset0 Garamond;}{\f3\fnil Tahoma;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 POSTANOWIENIA LICENCYJNE DOTYCZ\f1\'a5CE OPROGRAMOWANIA MICROSOFT\par..\f0 MICROSOFT VISUAL C++ \f1\'8cRODOWISKO URUCHOMIENIOWE 2015-2022 \par..\b0\f0 Niniejsze postanowienia licencyjne stanowi\f1\'b9 umow\'ea mi\'eadzy Microsoft Corporation (lub, w zale\'bfno\'9cci od miejsca zamieszkania Licencjobiorcy, jednym z podmiot\f0\'f3w stowarzyszonych Microsoft Corporation) a Licencjobiorc\f1\'b9. Postanowienia te dotycz\'b9 oprogramowania okre\'9clonego powy\'bfej. Niniejsze postanowienia maj\'b9 r\f0\'f3wnie\f1\'bf zastosowanie do wszelkich us\'b3ug i aktualizacji Microsoft dla niniejszego oprogramowania, z wyj\'b9tkiem tych, kt\f0\'f3rym tow

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1045\thm.wxl

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3212
Entropy (8bit):	5.268378763359481
Encrypted:	false
SSDEEP:
MD5:	15172EAF5C2C2E2B008DE04A250A62A1
SHA1:	ED60F870C473EE87DF39D1584880D964796E6888
SHA-256:	440B309FCDF61FFC03B269FE3815C60CB52C6AE3FC6ACAD14EAC04D057B6D6EA
SHA-512:	48AA89CF4A0B64FF4DCB82E372A01DFF423C12111D35A4D27B6D8DD793FFDE130E0037AB5E4477818A0939F61F7DB25295E4271B8B03F209D8F498169B1F9BAE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instalator [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Czy na pewno chcesz anulowa.?</String>.. <String Id="HelpHeader">Instalator . Pomoc</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [katalog] - Instaluje, naprawia, odinstalowuje.. lub tworzy pe.n. lokaln. kopi. pakietu w katalogu. Domy.lnie jest u.ywany prze..cznik install...../passive \| /quiet - Wy.wietla ograniczony interfejs u.ytkownika bez monit.w albo nie wy.wietla ani interfejsu u.ytkownika,.. ani monit.w. Domy.lnie jest wy.wietlany interfejs u.ytkownika oraz wszystkie monity...../norestart - Pom

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1046\license.rtf

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	10956
Entropy (8bit):	5.086757849952268
Encrypted:	false
SSDEEP:
MD5:	9A8D2ACF07F3C01E5CBC461AB932D85B
SHA1:	8781A298DCC14C18C6F6DB58B64F50B2FC6E338E
SHA-256:	27891EEC899BE859E3B4D3B29247FC6B535D7E836DEF0329111C48741EC6E701
SHA-512:	A60262A0C18E3BEF7C6D52F242153EBE891F676ED639F2DACFEBBAC86E70EEBF58AA95A7FE1A16E15A553C1BD3ECACCD8677EB9D2761CB79CB9A342C9B4252E2
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 TERMOS DE LICEN\'c7A PARA SOFTWARE MICROSOFT\par..TEMPO DE EXECU\'c7\'c3O DO MICROSOFT VISUAL C++ 2015 - 2022 \par..\b0 Os presentes termos de licen\'e7a constituem um contrato firmado entre a Microsoft Corporation (ou, dependendo do local no qual voc\'ea esteja domiciliado, uma de suas afiliadas) e voc\'ea. Eles se aplicam ao software indicado acima. Os termos tamb\'e9m se aplicam a quaisquer servi\'e7os ou atualiza\'e7\'f5es da Microsoft para o software, exceto at\'e9 a extens\'e3o de que eles tenham termos diferentes.\par..\b SE VOC\'ca CONCORDAR COM ESTES TERMOS DE LICEN\'c7A, TER\'c1 OS DIREITOS INDICADOS ABAIXO.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360{\pn

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1046\thm.wxl

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3095
Entropy (8bit):	5.150868216959352
Encrypted:	false
SSDEEP:
MD5:	BE27B98E086D2B8068B16DBF43E18D50
SHA1:	6FAF34A36C8D9DE55650D0466563852552927603
SHA-256:	F52B54A0E0D0E8F12CBA9823D88E9FD6822B669074DD1DC69DAD6553F7CB8913
SHA-512:	3B7C773EF72D40A8B123FDB8FC11C4F354A3B152CF6D247F02E494B0770C28483392C76F3C222E3719CF500FE98F535014192ACDDD2ED9EF971718EA3EC0A73E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] Instala..o</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem certeza de que deseja cancelar?</String>.. <String Id="HelpHeader">Ajuda da Instala..o</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [diret.rio - instala, repara, desinstala ou.. cria uma c.pia local completa do pacote no diret.rio. Install . o padr.o..../passive \| /quiet - exibe a IU m.nima sem nenhum prompt ou n.o exibe nenhuma IU e.. nenhum prompt. Por padr.o, a IU e todos os prompts s.o exibidos...../norestart - suprime qualquer tentativa de reiniciar. Por padr.o, a IU perguntar. antes de reiniciar

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1049\license.rtf

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	31981
Entropy (8bit):	3.6408688850128446
Encrypted:	false
SSDEEP:
MD5:	62229BE4447C349DF353C5D56372D64B
SHA1:	989799ED24913A0E6AE2546EE2A9A8D556E1CB3B
SHA-256:	1BB3FB55B8A13FA3BAFFFE72F5B1ED8B57A63BD4D8654BB6DC5B9011CE803B44
SHA-512:	FA366328C3FD4F683FDB1C5A64F5D554DE79620331086E8B4CCC2BFC2595B1FDED02CEC8AA982FCD8B13CC175D222AF2D7E2CD1A33B52F36AFD692B533FDBF13
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset204 Tahoma;}{\f1\fnil Tahoma;}{\f2\fnil\fcharset0 Tahoma;}{\f3\fnil\fcharset204 Garamond;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang1049\'d3\'d1\'cb\'ce\'c2\'c8\'df \'cb\'c8\'d6\'c5\'cd\'c7\'c8\'c8 \'cd\'c0 \'cf\'d0\'ce\'c3\'d0\'c0\'cc\'cc\'cd\'ce\'c5 \'ce\'c1\'c5\'d1\'cf\'c5\'d7\'c5\'cd\'c8\'c5 MICROSOFT\par..\'d1\'d0\'c5\'c4\'c0 \'c2\'db\'cf\'ce\'cb\'cd\'c5\'cd\'c8\'df MICROSOFT VISUAL C++ 2015\f1\endash\f2 2022 \par..\b0\f0\'cd\'e0\'f1\'f2\'ee\'ff\'f9\'e8\'e5 \'f3\'f1\'eb\'ee\'e2\'e8\'ff \'eb\'e8\'f6\'e5\'ed\'e7\'e8\'e8 \'ff\'e2\'eb\'ff\'fe\'f2\'f1\'ff \'f1\'ee\'e3\'eb\'e0\'f8\'e5\'ed\'e8\'e5\'ec \'ec\'e5\'e6\'e4\'f3 \'ea\'ee\'f0\'ef\'ee\'f0\'e0\'f6\'e8\'e5\'e9 Microsoft (\'e8\'eb\'e8, \'e2 \'e7\'e0\'e2\'e8\'f1\'e8\'ec\'ee\'f1\'f2\'e8 \'ee\'f2 \'ec\'e5\'f1\'f2\'e0

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1049\thm.wxl

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	5.444436038992627
Encrypted:	false
SSDEEP:
MD5:	17C652452E5EE930A7F1E5E312C17324
SHA1:	59F3308B87143D8EA0EA319A1F1A1F5DA5759DD3
SHA-256:	7333BC8E52548821D82B53DBD7D7C4AA1703C85155480CB83CEFD78380C95661
SHA-512:	53FD207B96D6BCF0A442E2D90B92E26CBB3ECC6ED71B753A416730E8067E831E9EB32981A9E9368C4CCA16AFBCB2051483FDCFC474EA8F0D652FCA934634FBE8
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.. <Control Control="InstallButton" X="275" Y="237" Width="110" Height="23"/>.... <String Id="Caption">......... ......... [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">....... .. .........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [.......] - ........., .............., ........ ..... ........ ...... ......... ..... ...... . ......... .. ......... - ............../passive \| /quiet - ........... ....

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1055\license.rtf

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	13807
Entropy (8bit):	5.2077828423114045
Encrypted:	false
SSDEEP:
MD5:	9625F3A496DBF5E3E0D2F33D417EDBBF
SHA1:	119376730428812A31B70D58C873866D5307A775
SHA-256:	F80926604E503697247353F56856B31DE0B3FC1319F1C94068363952549CC9B1
SHA-512:	DB91A14FC27E3A62324E024DD44E3B5548AF7E1C021201C3D851BD2F32537885AACFC64ADAE619BAC31B60229D1D5FC653F5301CD7187C69BD0ACECCE817D6A3
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset238 Garamond;}{\f3\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT YAZILIMI L\f1\u304?SANS KO\'aaULLARI\par..\f0 MICROSOFT VISUAL C++ 2015 - 2022 \'c7ALI\f1\'aaMA S\f0\'dcRESI \par..\b0 Bu lisans ko\f1\'baullar\u305?, Microsoft Corporation (veya ya\'baad\u305?\u287?\u305?n\u305?z yere g\f0\'f6re bir ba\f1\u287?l\u305? \'bairketi) ile sizin aran\u305?zda yap\u305?lan s\f0\'f6zle\f1\'bameyi olu\'baturur. Bu ko\'baullar, yukar\u305?da ad\u305? ge\f0\'e7en yaz\f1\u305?l\u305?m i\f0\'e7in ge\'e7erlidir. \f1\'aaartlar, yaz\u305?l\u305?m i\f0\'e7in t\'fcm Microsoft hizmetleri veya g\'fcncelle\f1\'batirmeleri i\f0\'e7in, beraberlerinde farkl\f1\u305? \'baartlar bulunmad\u305?\u287?\u305? s\f0\'fcrece ge\'e7erlidir.\pa

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\1055\thm.wxl

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3221
Entropy (8bit):	5.280530692056262
Encrypted:	false
SSDEEP:
MD5:	DEFBEA001DC4EB66553630AC7CE47CCA
SHA1:	90CED64EC7C861F03484B5D5616FDBCDA8F64788
SHA-256:	E5ABE3CB3BF84207DAC4E6F5BBA1E693341D01AEA076DD2D91EAA21C6A6CB925
SHA-512:	B3B7A22D0CDADA21A977F1DCEAF2D73212A4CDDBD298532B1AC97575F36113D45E8D71C60A6D8F8CC2E9DBF18EE1000167CFBF0B2E7ED6F05462D77E0BCA0E90
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] Kurulumu</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.ptal etmek istedi.inizden emin misiniz?</String>.. <String Id="HelpHeader">Kurulum Yard.m.</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [dizin] - y.kler, onar.r, kald.r.r ya da.. dizindeki paketin tam bir yerel kopyas.n. olu.turur. Varsay.lan install de.eridir...../passive \| /quiet - en az d.zeyde istemsiz UI g.sterir ya da hi. UI g.stermez ve.. istem yoktur. Varsay.lan olarak UI ve t.m istemler g.r.nt.lenir...../norestart - yeniden ba.lama denemelerini engeller. Varsay.lan olarak UI yeniden ba.l

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\2052\license.rtf

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	18214
Entropy (8bit):	3.9837154113926356
Encrypted:	false
SSDEEP:
MD5:	D083C7E300928A0C5AEA5ECBD1653836
SHA1:	08F4F1F9F7DFA593BE3977515635967CE7A99E7A
SHA-256:	A808B4933CE3B3E0893504DBEF43EBF90B8B567F94BD6481B6315ED9141E1B11
SHA-512:	8CB3FFAD879BABA36137B7A21B62D9D6C530693F5E16FBB975F3E7C20F1DB5A686F3A6EE406D69B018AA494E4CD185F71B369A378AE3289B8080105157E63FD0
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset134 SimSun;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 Microsoft \f1\'c8\'ed\'bc\'fe\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\f0\par..MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0\f1\'d5\'e2\'d0\'a9\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\'ca\'c7\f0 Microsoft Corporation\f1\'a3\'a8\'bb\'f2\'c4\'fa\'cb\'f9\'d4\'da\'b5\'d8\'b5\'c4\f0 Microsoft \f1\'b9\'d8\'c1\'aa\'b9\'ab\'cb\'be\'a3\'a9\'d3\'eb\'c4\'fa\'d6\'ae\'bc\'e4\'b4\'ef\'b3\'c9\'b5\'c4\'d0\'ad\'d2\'e9\'a1\'a3\'d5\'e2\'d0\'a9\'cc\'f5\'bf\'ee\'ca\'ca\'d3\'c3\'d3\'da\'c9\'cf\'ca\'f6\'c8\'ed\'bc\'fe\'a1\'a3\'d5\'e2\'d0\'a9\'cc\'f5\'bf\'ee\'d2\'b2\'ca\'ca\'d3\'c3\'d3\'da\'d5\'eb\'b6\'d4\'b8\'c3\'c8\'ed\'bc\'fe\'b5\'c4\'c8\'ce\'ba\'ce\f0 Microsoft \f1\'b7\'fe\'ce\'f1\'bb\'f2\'b8\'fc\'d0\'c2\'a3\'ac\'

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\2052\thm.wxl

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2978
Entropy (8bit):	6.135205733555905
Encrypted:	false
SSDEEP:
MD5:	3D1E15DEEACE801322E222969A574F17
SHA1:	58074C83775E1A884FED6679ACF9AC78ABB8A169
SHA-256:	2AC8B7C19A5189662DE36A0581C90DBAD96DF259EC00A28F609B644C3F39F9CA
SHA-512:	10797919845C57C5831234E866D730EBD13255E5BF8BA8087D53F1D0FC5D72DC6D5F6945DBEBEE69ACC6A2E20378750C4B78083AE0390632743C184532358E10
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [..] - .......... ..................Install ........../passive \| /quiet - ..... UI ......... UI ... ........ UI ........../norestart - ..................... UI.../log log.txt - ............. %TEMP% ...

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\3082\license.rtf

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	10825
Entropy (8bit):	5.1113252296046126
Encrypted:	false
SSDEEP:
MD5:	873A413D23F830D3E87DAB3B94153E08
SHA1:	24CFC24F22CEF89818718A86F55F27606EB42668
SHA-256:	ABC11BB2B04DFF6AFE2D4D4F40D95A7D62E5AF352928AF90DAA3DADE58DD59BD
SHA-512:	DC1ECCB5CC4D3047401E2BC31F5EB3E21C7881C02744A2E63C10D3C911D1158DCFAC023988E873C33DC381C989304FE1D3CB27ED99D7801285C4C378553CD821
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 T\'c9RMINOS DE LICENCIA DEL SOFTWARE DE MICROSOFT\par..MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0 Los t\'e9rminos de esta licencia son un contrato entre Microsoft Corporation (o, en funci\'f3n de donde viva, una de las sociedades del grupo) y usted. Se aplican al software mencionado anteriormente. Los t\'e9rminos tambi\'e9n se aplican a los servicios o actualizaciones de software de Microsoft, excepto en la medida en que sus t\'e9rminos sean diferentes.\par..\b SI USTED CUMPLE LOS PRESENTES T\'c9RMINOS DE ESTA LICENCIA, DISPONDR\'c1 DE LOS DERECHOS QUE A CONTINUACI\'d3N SE DESCRIBEN.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb1

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\3082\thm.wxl

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3265
Entropy (8bit):	5.0491645049584655
Encrypted:	false
SSDEEP:
MD5:	47F9F8D342C9C22D0C9636BC7362FA8F
SHA1:	3922D1589E284CE76AB39800E2B064F71123C1C5
SHA-256:	9CBB2B312C100B309A1B1495E84E2228B937612885F7A642FBBD67969B632C3A
SHA-512:	E458DF875E9B0622AEBE3C1449868AA6A2826A1F851DB71165A872B2897CF870CCF85046944FF51FFC13BB15E54E9D9424EC36CAF5A2F38CE8B7D6DC0E9B2363
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instalaci.n de [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.Est. seguro de que desea cancelar la operaci.n?</String>.. <String Id="HelpHeader">Ayuda de configuraci.n</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - instala, repara, desinstala o.. crea una copia local completa del paquete en el directorio. La opci.n predeterminada es la instalaci.n...../passive \| /quiet - muestra una IU m.nima sin solicitudes o no muestra ninguna IU ni.. solicitud. De forma predeterminada, se muestran la IU y todas las solicitudes...../norestart - elimina cualquier intento

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\BootstrapperApplicationData.xml

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (633), with CRLF line terminators
Category:	dropped
Size (bytes):	15190
Entropy (8bit):	3.738616200218003
Encrypted:	false
SSDEEP:
MD5:	2EE103493F085F0F7C635A430F36E0A0
SHA1:	6148F7B7DF3EDD7FF9E5D2C4B92B93E91223919A
SHA-256:	A884D7460C9E2814382B11B67A63B920E01E711BC7ED61C2D4F2A6AB8FCCA389
SHA-512:	4F870368DE31FBF2026A9390445D093F6A098DF510C6E409564B4AA32E836A41DE4304787824A3B3EFA9A56B05CAC2BF3BB49E3CA8B8BE3D1B1EBFF1B647A29A
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.a.l.C.o.n.d.i.t.i.o.n. .C.o.n.d.i.t.i.o.n.=.".V.e.r.s.i.o.n.N.T. .&.g.t.;.=. .v.6...1.". .M.e.s.s.a.g.e.=.".[.W.i.x.B.u.n.d.l.e.N.a.m.e.]. .c.a.n. .o.n.l.y. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .W.i.n.d.o.w.s. .7. .a.n.d. .n.e.w.e.r. .p.l.a.t.f.o.r.m.s...". ./.>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=.".M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.5.-.2.0.2.2. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e. .(.x.6.4.). .-. .1.4...4.2...3.4.4.3.3.". .L.o.g.P.a.t.h.V.a.r.i.a.b.l.e.=.".W.i.x.B.u.n.d.l.e.L.o.g.". .C.o.m.p.r.e.s.s.e.d.=.".y.e.s.". .I.d.=.".{.8.0.4.e.7.d.6.6.-.c.c.c.2.-.4.c.1.2.-.8.4.b.a.-.4.7.6.d.a.3.1.d.1.0.3.d.}.". .U.p.g.r.a.d.e.C.o.d.e.=.".{.C.1.4.6.E.

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\license.rtf

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	9235
Entropy (8bit):	5.167332119309966
Encrypted:	false
SSDEEP:
MD5:	04B33F0A9081C10E85D0E495A1294F83
SHA1:	1EFE2FB2D014A731B752672745F9FFECDD716412
SHA-256:	8099DC3CF9502C335DA829E5C755948A12E3E6DE490EB492A99DEB673D883D8B
SHA-512:	D1DBED00DF921169DD61501E2A3E95E6D7807348B188BE9DD8FC63423501E4D848ECE19AC466C3CACFCCC6084E0EB2F457DC957990F6F511DF10FD426E432685
Malicious:	false
Reputation:	low
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.19041}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT SOFTWARE LICENSE TERMS\par..MICROSOFT VISUAL C++ 2015 - 2022 RUNTIME \par..\b0 These license terms are an agreement between Microsoft Corporation (or based on where you live, one of its affiliates) and you. They apply to the software named above. The terms also apply to any Microsoft services or updates for the software, except to the extent those have different terms.\par..\b IF YOU COMPLY WITH THESE LICENSE TERMS, YOU HAVE THE RIGHTS BELOW.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\sa120\sl240\slmult1\tx360 INSTALLATION AND USE RIGHTS. \b0\par....\pard{\pntext\f2\'B7\tab}{\*\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\f

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\logo.png

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1861
Entropy (8bit):	6.868587546770907
Encrypted:	false
SSDEEP:
MD5:	D6BD210F227442B3362493D046CEA233
SHA1:	FF286AC8370FC655AEA0EF35E9CF0BFCB6D698DE
SHA-256:	335A256D4779EC5DCF283D007FB56FD8211BBCAF47DCD70FE60DED6A112744EF
SHA-512:	464AAAB9E08DE610AD34B97D4076E92DC04C2CDC6669F60BFC50F0F9CE5D71C31B8943BD84CEE1A04FB9AB5BBED3442BD41D9CB21A0DD170EA97C463E1CE2B5B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...@...@.............sRGB.........gAMA......a.....PLTE].q^.r_.r_.s`.s`.s`.ta.ta.ub.ub.vc.vd.vd.vd.we.we.xe.xg.yg yg zh zh"zi"{j#\|i${j$\|n~n.n,.o,.p..q0.r2.s3.t5.x;.x<.y>.z?.\|B.~C.}E..F..F..H..I..J..L..O..P..W..Y..^..a..c..g..i..q..r..}.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S......pHYs..%...%....^.....tEXtSoftware.Paint.NET v3.5.100.r.....IDATXG..iW.@...EJ.$M...`AEpG..7TpWT@\.."....(..(.._;...di:9.c>q..g....T...._...-....F..+..w.

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\thm.wxl

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2952
Entropy (8bit):	5.052095286906672
Encrypted:	false
SSDEEP:
MD5:	FBFCBC4DACC566A3C426F43CE10907B6
SHA1:	63C45F9A771161740E100FAF710F30EED017D723
SHA-256:	70400F181D00E1769774FF36BCD8B1AB5FBC431418067D31B876D18CC04EF4CE
SHA-512:	063FB6685EE8D2FA57863A74D66A83C819FE848BA3072B6E7D1B4FE397A9B24A1037183BB2FDA776033C0936BE83888A6456AAE947E240521E2AB75D984EE35E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29" />.... <String Id="Caption">[WixBundleName] Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installs, repairs, uninstalls or.. creates a complete local copy of the bundle in directory. Install is the default...../passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt before restart.../log log.txt - logs to a specific file. B

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\thm.xml

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8332
Entropy (8bit):	5.184632608060528
Encrypted:	false
SSDEEP:
MD5:	F62729C6D2540015E072514226C121C7
SHA1:	C1E189D693F41AC2EAFCC363F7890FC0FEA6979C
SHA-256:	F13BAE0EC08C91B4A315BB2D86EE48FADE597E7A5440DCE6F751F98A3A4D6916
SHA-512:	CBBFBFA7E013A2B85B78D71D32FDF65323534816978E7544CA6CEA5286A0F6E8E7E5FFC4C538200211F11B94373D5658732D5D8AA1D01F9CCFDBF20F154F1471
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="485" Height="300" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.... <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png" Visible="yes"/>.. <Text X="80" Y="11" Width="-11" Heig

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.ba\wixstdba.dll

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	220512
Entropy (8bit):	6.754483649907534
Encrypted:	false
SSDEEP:
MD5:	F68F43F809840328F4E993A54B0D5E62
SHA1:	01DA48CE6C81DF4835B4C2ECA7E1D447BE893D39
SHA-256:	E921F69B9FB4B5AD4691809D06896C5F1D655AB75E0CE94A372319C243C56D4E
SHA-512:	A7A799ECF1784FB5E8CD7191BF78B510FF5B07DB07363388D7B32ED21F4FDDC09E34D1160113395F728C0F4E57D13768A0350DBDB207D9224337D2153DC791E1
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N............e......e..............................e......e......e.............................d....................Rich............PE..L......e...........!.........................0...............................@............@.............................................................`W... ..x.......T...........................8...@............0..X............................text............................... ..`.rdata.......0....... ..............@..@.data...............................@....rsrc...............................@..@.reloc..x.... ......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	686136
Entropy (8bit):	7.251009602832873
Encrypted:	false
SSDEEP:
MD5:	3F32F1A9BD60AE065B89C2223676592E
SHA1:	9D386D394DB87F1EE41252CAC863C80F1C8D6B8B
SHA-256:	270FA05033B8B9455BD0D38924B1F1F3E4D3E32565DA263209D1F9698EFFBC05
SHA-512:	BDDFEAB33A03B0F37CFF9008815E2900CC96BDDAF763007E5F7FDFFD80E56719B81341029431BD9D25C8E74123C1D9CDA0F2AEFAFDC4937095D595093DB823DF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]aN.<...<...<...L...<...L..j<...T...<...T...<...T...<...L...<...L...<...L...<...<...=..PU...<..PU...<...<...<..PU...<..Rich.<..........................PE..L......e..........................................@..................................(....@............................................T;...........O...(...P...>.....T...................4........F..@...................T........................text...>........................... ..`.rdata..&...........................@..@.data...<...........................@....wixburn8...........................@..@.rsrc...T;.......<..................@..@.reloc...>...P...@..................@..B........................................................................................................................................................................................................................................

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Microsoft Cabinet archive data, many, 5691140 bytes, 14 files, at 0x44 +A "mfc140.dll_amd64" +A "mfc140chs.dll_amd64", flags 0x4, number 1, extra bytes 20 in head, 371 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	5701492
Entropy (8bit):	7.997611715541784
Encrypted:	true
SSDEEP:
MD5:	5866203168B27F18C1B47ABFA6823E02
SHA1:	3B696BE0A4CF750965D74263E43B8E302CB1B318
SHA-256:	7D48E0905EBEA9B14A07CFF687705DFDC50D795CD4C32E5ED87A0E344884B430
SHA-512:	037F793F60BE84F1DA005D47E21783E719A85B5C12C4D20050AD9D3254AC99BA8EB30B4B1378BAC69379DBC659427DC1AE4A19062ECD337D47D480D047AFB669
Malicious:	false
Reputation:	low
Preview:	MSCF......V.....D.............................V.p(..........4...s...P.U.......]Y.- .mfc140.dll_amd64.h...P.U...]Y.- .mfc140chs.dll_amd64.P.....V...]Y.- .mfc140cht.dll_amd64.h8...]W...]Y.- .mfc140deu.dll_amd64.p...p.X...]Y.- .mfc140enu.dll_amd64.h4...Y...]Y.- .mfc140esn.dll_amd64.h8..H.Z...]Y.- .mfc140fra.dll_amd64.p0....\...]Y.- .mfc140ita.dll_amd64.P... E]...]Y.- .mfc140jpn.dll_amd64.h...p+^...]Y.- .mfc140kor.dll_amd64.P(...._...]Y.- .mfc140rus.dll_amd64.PVV.(8`...]Y.- .mfc140u.dll_amd64..x..x.....]Y.- .mfcm140.dll_amd64..x........]Y.- .mfcm140u.dll_amd64.'..\|.6..CK.:{\|Se._.M[..4XD....)..........-R..V^....,..@iK...g.]........Y.....-.i+o..D.-7.G..)(w.9_nnn.......{.w.w^.y}.....Y,c,.~d......_...c,..T.#.H...#}'..4cq...J.d..,\.....2..y.3.c..X.h...$s...V.d....)?.G.e...B.y1s.<W.q.{../.^.\N..+..5s&..d;._"..rofJ;.y%.I.w.......2....E...X<..Y.M`.o..W..X....'X[...h..qxO..j....1...#..'w.$rv..I...6e.......Yg...)`.Q@.p6..M x..6......a./.X.".K.;.-.{.g.fV].. ...Xz.3l...<.1....

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\cab5046A8AB272BF37297BB7928664C9503

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Microsoft Cabinet archive data, many, 982083 bytes, 12 files, at 0x44 +A "concrt140.dll_amd64" +A "msvcp140.dll_amd64", flags 0x4, number 1, extra bytes 20 in head, 75 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	992435
Entropy (8bit):	7.996227359354833
Encrypted:	true
SSDEEP:
MD5:	8C302E40FBF614896BA36A75F3F8977E
SHA1:	991AF1495F7783173D0C5691BE38FF8648F2DF12
SHA-256:	B384B812DC59C2081CEE080EA6BBA748E02ECF3C0800D8DCAF9607A20A4F3290
SHA-512:	53B1D7D8AB495931F50B5D815AFE04D52F9E0BBAFA0A5F3E4F6605B6E4F2A85C583ABF9014DEC41481439827BB6BAB23AC439D4FD7D0C3F191F21B2BF5AFB11D
Malicious:	false
Reputation:	low
Preview:	MSCF....C.......D...........................C...p(..............K...P.........]Y.- .concrt140.dll_amd64.h...P.....]Y.- .msvcp140.dll_amd64.h.........]Y.- .msvcp140_1.dll_amd64.h... A....]Y.- .msvcp140_2.dll_amd64.P....W....]Y.- .msvcp140_atomic_wait.dll_amd64.P\|........]Y.- .msvcp140_codecvt_ids.dll_amd64.P<..(.....]Y.- .vcamp140.dll_amd64.P^..x.....]Y.- .vccorlib140.dll_amd64.h....2....]Y.- .vcomp140.dll_amd64.p...0!"...]Y.- .vcruntime140.dll_amd64.P.....#...]Y.- .vcruntime140_1.dll_amd64.h....$...]Y.- .vcruntime140_threads.dll_amd64...r.:3..CK.[}\Te..3..HcI.n.kT,.hY...A ...L-JML.5%......N.Y...~YXV.m..V.X...(o...R.u.[I..B/..<.sg.......7.f..s...s.9.y..>.^...A._.K....1.].Z.....}..j..kRj.N.7?..d..%3.6..h.b...9.%9.L.....&..^<{Nt.>...G.7.7...\|...8o<l.Wm.....V...k..u.X..B.Ayf...i.6$.B.7..VO...?k..U0.'........W..c..&m.{.:. 4h.9c....n.=..p.6....O....1z.cf.B.l..... .w......x.Nh......=...tBz:l.:!.......:...A.Y.:..bt........l...u..o....%.gZg.B%.P..x.6j.e._4.&l..?(........b...

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\vcRuntimeAdditional_x64

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2022 X64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2022 X64 Additional Runtime - 14.42.34433., Template: x64;1033, Revision Number: {E04E511C-7D1F-4263-AB6A-F816392FD4D7}, Create Time/Date: Tue Oct 29 06:55:02 2024, Last Saved Time/Date: Tue Oct 29 06:55:02 2024, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.372377887079137
Encrypted:	false
SSDEEP:
MD5:	351D8E8C804F6C6AAB4C718977B1817D
SHA1:	1B680E5E2ED548E5636F9D656C49C87CF9A70DA8
SHA-256:	CF584E5132EF3766A088F824BD038494713A7168CDDDD44E3F8C4AD581E2206E
SHA-512:	D0613C6B1A72C73013C0519619C557811A1D20FCDDC8361D391A31FC4AA9C70173B907957BABB049067111427A81E48A82E5467A15DAE8BEBB55B048993C93A4
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\vcRuntimeMinimum_x64

Download File

Process:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2022 X64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.42.34433., Template: x64;1033, Revision Number: {A75B920C-55CD-4531-932F-CB4C539C41F8}, Create Time/Date: Tue Oct 29 06:50:14 2024, Last Saved Time/Date: Tue Oct 29 06:50:14 2024, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.367262947705725
Encrypted:	false
SSDEEP:
MD5:	09042BA0AF85F4873A68326AB0E704AF
SHA1:	F08C8F9CB63F89A88F5915E6A889B170CE98F515
SHA-256:	47CCEB26DD7B78F0D3D09FDDC419290907FE818979884B2192C834034180E83B
SHA-512:	1C9552A8BF478F9EDDE8ED67A8F40584A757C66AAF297609B4F577283469287992C1F84EBE15DF4DF05B0135E4D67C958A912738F4814440F6FD77804A2CFA7D
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	686136
Entropy (8bit):	7.251009602832873
Encrypted:	false
SSDEEP:
MD5:	3F32F1A9BD60AE065B89C2223676592E
SHA1:	9D386D394DB87F1EE41252CAC863C80F1C8D6B8B
SHA-256:	270FA05033B8B9455BD0D38924B1F1F3E4D3E32565DA263209D1F9698EFFBC05
SHA-512:	BDDFEAB33A03B0F37CFF9008815E2900CC96BDDAF763007E5F7FDFFD80E56719B81341029431BD9D25C8E74123C1D9CDA0F2AEFAFDC4937095D595093DB823DF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]aN.<...<...<...L...<...L..j<...T...<...T...<...T...<...L...<...L...<...L...<...<...=..PU...<..PU...<...<...<..PU...<..Rich.<..........................PE..L......e..........................................@..................................(....@............................................T;...........O...(...P...>.....T...................4........F..@...................T........................text...>........................... ..`.rdata..&...........................@..@.data...<...........................@....wixburn8...........................@..@.rsrc...T;.......<..................@..@.reloc...>...P...@..................@..B........................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0238B745789ABAA5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0C684BE87C48DB14.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5698541803775374
Encrypted:	false
SSDEEP:
MD5:	986D1D88188EE69706E52C1706991110
SHA1:	734027C715328789BD55026F3E2F9EC385F2CE2C
SHA-256:	178F4539FFB188162A31C5E917F004D184F4A2EFF07C9CAE075344D2CE7A4E4C
SHA-512:	489EBEE5A5BD78D221E71D932B543BCA48BFDC8E703177A10A838E46B479F60899CE52653815CDC9BF4011CE6FB35970E4D327751291B42DAE08E9F4345B7411
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF177B2274DB695003.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2547895172190402
Encrypted:	false
SSDEEP:
MD5:	5ED933657FF28B9DF22BDAB78CE1C465
SHA1:	9890088AAAD996924BEB6121C55746EC465CCC4D
SHA-256:	C666537CB51619E364A06286DEAC2BAE28D6A4CEB020CBF5DCD4921EFAEAFB07
SHA-512:	208391EECD9DF5C41DDA80BCEA563CF8D0A1EA1B3B3A9FD5EC1462C8A743B162F3C0685B122C1AE19619D32089EFD604164682059DD4854F84E2A7929D7E7AEE
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF19F7299275841B87.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1BEEF774B43C5B90.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2510082805855611
Encrypted:	false
SSDEEP:
MD5:	ACA41F3C3084900ABAE2BE8AEC96D57B
SHA1:	2C96C5F97667759AADF792AB27C55FCD4887D46C
SHA-256:	44D30AC7AF3FA8428CBCC2D253CAE6C51D42883808B8CEF729E873D834D75581
SHA-512:	2B81B8E9CD7EB6F568DF82A3A85CCD712C59FA2F29A3E177A129C867E239651CF8A673B8A3985D4135FD49A8E99F3ED7A48C10723DF8F0B901477F9157278CAC
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF20D5E6870F7F7F06.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2510082805855611
Encrypted:	false
SSDEEP:
MD5:	ACA41F3C3084900ABAE2BE8AEC96D57B
SHA1:	2C96C5F97667759AADF792AB27C55FCD4887D46C
SHA-256:	44D30AC7AF3FA8428CBCC2D253CAE6C51D42883808B8CEF729E873D834D75581
SHA-512:	2B81B8E9CD7EB6F568DF82A3A85CCD712C59FA2F29A3E177A129C867E239651CF8A673B8A3985D4135FD49A8E99F3ED7A48C10723DF8F0B901477F9157278CAC
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF23758F8BC31ED6C9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.240517286020654
Encrypted:	false
SSDEEP:
MD5:	2700B1AFEE293A0C2BB185968A649FB0
SHA1:	60F599191F3CD1F860AB42C3BE22329C1802602C
SHA-256:	E8C970041447FF7E9A7E5F734A7E60C5563772113F2BCEF9076271B004F978F4
SHA-512:	6F18EE92A2B785EB74BAA6C77DD818925F4554A01F43380AD2DBF26766144413F5CC26CE5F4707A6709578EE843F8CEBB5AB399DA184F12E80DD0D9A5B75C081
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF24D3C83309A272CC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF27697CEC3627B4DB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.240517286020654
Encrypted:	false
SSDEEP:
MD5:	2700B1AFEE293A0C2BB185968A649FB0
SHA1:	60F599191F3CD1F860AB42C3BE22329C1802602C
SHA-256:	E8C970041447FF7E9A7E5F734A7E60C5563772113F2BCEF9076271B004F978F4
SHA-512:	6F18EE92A2B785EB74BAA6C77DD818925F4554A01F43380AD2DBF26766144413F5CC26CE5F4707A6709578EE843F8CEBB5AB399DA184F12E80DD0D9A5B75C081
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2AC873B39CC04547.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5555574126402247
Encrypted:	false
SSDEEP:
MD5:	9F0F3890502DFF125D73C63AD1087C6B
SHA1:	CF53C0F5ED53DBD09759F9235DCE477E6E4A4CCE
SHA-256:	1813296B708C130D6FEB045B7EE51873D0C84997DEE5164E83F252F4F4785E80
SHA-512:	841931D2D9DA6EE2C4CA928872DE0DC4F6A7B1616A152A3E1D9A6E9CBEB1FEE8647A483D9007CCE19BF5ED4B80915EE9D9F386F9DACA00CDE05D1B08DA99F002
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2B01A6A31FEFB781.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF357A6562D6DECD2B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2547895172190402
Encrypted:	false
SSDEEP:
MD5:	5ED933657FF28B9DF22BDAB78CE1C465
SHA1:	9890088AAAD996924BEB6121C55746EC465CCC4D
SHA-256:	C666537CB51619E364A06286DEAC2BAE28D6A4CEB020CBF5DCD4921EFAEAFB07
SHA-512:	208391EECD9DF5C41DDA80BCEA563CF8D0A1EA1B3B3A9FD5EC1462C8A743B162F3C0685B122C1AE19619D32089EFD604164682059DD4854F84E2A7929D7E7AEE
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3A2BFF489FC73C3E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5555574126402247
Encrypted:	false
SSDEEP:
MD5:	9F0F3890502DFF125D73C63AD1087C6B
SHA1:	CF53C0F5ED53DBD09759F9235DCE477E6E4A4CCE
SHA-256:	1813296B708C130D6FEB045B7EE51873D0C84997DEE5164E83F252F4F4785E80
SHA-512:	841931D2D9DA6EE2C4CA928872DE0DC4F6A7B1616A152A3E1D9A6E9CBEB1FEE8647A483D9007CCE19BF5ED4B80915EE9D9F386F9DACA00CDE05D1B08DA99F002
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF48EF9AA916DD5D10.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10193845076784563
Encrypted:	false
SSDEEP:
MD5:	5288D9DDD9712395CFC8E20E03DE496E
SHA1:	1F2A91B410C41E3F5C941EF5E045F2E71ACE106E
SHA-256:	A7782501328B1C45DFDD286F9D4479E55F96041F936DA3599B7E767666AD5789
SHA-512:	3464E7D43BF91DF444CAD78C4F3DBF64344EC681A3A4EFF7889C2B4FD54AF4E08CE2A23F05AB9D77B67602073DF9B2055F5E084D459C0D73AE8A03A7202550B6
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4B945B5C4D06D9E3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.565430960184872
Encrypted:	false
SSDEEP:
MD5:	28C1192542613DA0A607E02150C53650
SHA1:	7D96EE3D0D3C9905642F69D98B17BD41902E4173
SHA-256:	3048153B3AB50AEF889DBCDE3448F9359D992E415642CAF73389AEB8581FC8E8
SHA-512:	8BB795EFB6FB7874A9AF7923EA78A6B567836DA133FD8E36F66C1D45EA023C169CA56408C274261BA067C217ACA8E5AA037997F9150CB8E979A46B008D6CB769
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4BABAC4FC66E9CEB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4C41788452F6981B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2547895172190402
Encrypted:	false
SSDEEP:
MD5:	5ED933657FF28B9DF22BDAB78CE1C465
SHA1:	9890088AAAD996924BEB6121C55746EC465CCC4D
SHA-256:	C666537CB51619E364A06286DEAC2BAE28D6A4CEB020CBF5DCD4921EFAEAFB07
SHA-512:	208391EECD9DF5C41DDA80BCEA563CF8D0A1EA1B3B3A9FD5EC1462C8A743B162F3C0685B122C1AE19619D32089EFD604164682059DD4854F84E2A7929D7E7AEE
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4D6CD19498452A95.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4F4CCD078987D732.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.14416794548950693
Encrypted:	false
SSDEEP:
MD5:	DAE9951DAA3D18FF112DCAC346244797
SHA1:	A1DCABE92FC0CB53CE55089F9F9D49F1F1244D55
SHA-256:	ED1251D695D9A54E20A3B8424F9BA28EF0776FF4C62322B4BE5088F7851B34AE
SHA-512:	6948A74687F7D8E8648876A56C835964BF1DD29ACB5BFEF557A8E00F2EFB85C2B57B6CF984366BFB1F4F99DC48E202384BC6B92471542772376B075FB789BEB5
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5190695E1A6EAFE8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5268EC4DC2306E49.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5501657475449502
Encrypted:	false
SSDEEP:
MD5:	5ABD2DBF0D4B4BBFE344B560EEB6F482
SHA1:	E3F72D68FED230370D68EFAEDF4A7F87B90E793F
SHA-256:	8D46C33321FBC0116C66C766E41AE3EC04F348822C4E93651249A466CD1675C4
SHA-512:	180C43E80AD5C6FBE66635AB409FF3884ACBA438E47D516AD0E62FAC38C3FBFC20B7524598F6DBEF1520605D74ABE64658C1BFBDFD6BC357652C2B9C1B0FD452
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF56225B11AB8CDFD9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.240517286020654
Encrypted:	false
SSDEEP:
MD5:	2700B1AFEE293A0C2BB185968A649FB0
SHA1:	60F599191F3CD1F860AB42C3BE22329C1802602C
SHA-256:	E8C970041447FF7E9A7E5F734A7E60C5563772113F2BCEF9076271B004F978F4
SHA-512:	6F18EE92A2B785EB74BAA6C77DD818925F4554A01F43380AD2DBF26766144413F5CC26CE5F4707A6709578EE843F8CEBB5AB399DA184F12E80DD0D9A5B75C081
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF56951E8EFE10121F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2510082805855611
Encrypted:	false
SSDEEP:
MD5:	ACA41F3C3084900ABAE2BE8AEC96D57B
SHA1:	2C96C5F97667759AADF792AB27C55FCD4887D46C
SHA-256:	44D30AC7AF3FA8428CBCC2D253CAE6C51D42883808B8CEF729E873D834D75581
SHA-512:	2B81B8E9CD7EB6F568DF82A3A85CCD712C59FA2F29A3E177A129C867E239651CF8A673B8A3985D4135FD49A8E99F3ED7A48C10723DF8F0B901477F9157278CAC
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5833008B2B2E9391.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF59329B3AF430D3A4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6261FFBE0FE987EB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5501657475449502
Encrypted:	false
SSDEEP:
MD5:	5ABD2DBF0D4B4BBFE344B560EEB6F482
SHA1:	E3F72D68FED230370D68EFAEDF4A7F87B90E793F
SHA-256:	8D46C33321FBC0116C66C766E41AE3EC04F348822C4E93651249A466CD1675C4
SHA-512:	180C43E80AD5C6FBE66635AB409FF3884ACBA438E47D516AD0E62FAC38C3FBFC20B7524598F6DBEF1520605D74ABE64658C1BFBDFD6BC357652C2B9C1B0FD452
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF72B993C15578F965.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7F9682FEDFFC87D1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.13161353892575345
Encrypted:	false
SSDEEP:
MD5:	DA3B3C7EA1A5B05A83E9D52164FC45CD
SHA1:	A87D53F7965E6E0C75137C04D61C87F3CE9E4A25
SHA-256:	4709C367C9658C8C81948C7BE446986591B7310427EB8701FD0B2232AD8EEB98
SHA-512:	2DB8602FCFD285F9F15E567DFE8422811D0414D0FE4C922995ADAACFF388F61B17017ED7763ECBB683D01C22F297E2785A4C1621EDD61D97C77A6AB5AD7D04F6
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF89544BE4D5F97F96.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2547895172190402
Encrypted:	false
SSDEEP:
MD5:	5ED933657FF28B9DF22BDAB78CE1C465
SHA1:	9890088AAAD996924BEB6121C55746EC465CCC4D
SHA-256:	C666537CB51619E364A06286DEAC2BAE28D6A4CEB020CBF5DCD4921EFAEAFB07
SHA-512:	208391EECD9DF5C41DDA80BCEA563CF8D0A1EA1B3B3A9FD5EC1462C8A743B162F3C0685B122C1AE19619D32089EFD604164682059DD4854F84E2A7929D7E7AEE
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8C56246B6BDEE6AD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10340253801680628
Encrypted:	false
SSDEEP:
MD5:	7B470BE37941C08E86CC5EED707A5B59
SHA1:	26E5FC7D0DAAA9EAD7141B85AFBB5CC3703AD3EE
SHA-256:	AC4ABC1480EAB8940840F4334FAB916D372E8F3A1069C4998DE3EA46FED3B03F
SHA-512:	48734CFE51142820A436B0B7AA1F7161673BC9756AF07FF6A904E85F4EFA32B3188066DA631A082011006CF17B963AD05C5C58A6531A0E0147EA2440CF6F39E6
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8C7581E45BAE78D0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9063208AE254D6E4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.14193137085956684
Encrypted:	false
SSDEEP:
MD5:	6EC010A487548A63FB46029A8977FB50
SHA1:	84EC80DE74C44A371B1258F0D19469E1637DFAE3
SHA-256:	C854D85904068782C5AD48193CC102CBB5A4296A02E5BD432F441A4AAE3A22A8
SHA-512:	185FA550D800624C1251656BB6376DCA2E06A22953346F4C496982B77409AB41536A1ED3B3630D2DB550E27FBF5ECF07FBF0EED20D04999D3F2D27B40B966577
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF918196A30E23A481.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5698541803775374
Encrypted:	false
SSDEEP:
MD5:	986D1D88188EE69706E52C1706991110
SHA1:	734027C715328789BD55026F3E2F9EC385F2CE2C
SHA-256:	178F4539FFB188162A31C5E917F004D184F4A2EFF07C9CAE075344D2CE7A4E4C
SHA-512:	489EBEE5A5BD78D221E71D932B543BCA48BFDC8E703177A10A838E46B479F60899CE52653815CDC9BF4011CE6FB35970E4D327751291B42DAE08E9F4345B7411
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF93601D70B647B3B7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2445688675035496
Encrypted:	false
SSDEEP:
MD5:	E41C25EFE77CECB304CE8B1DAA24FB13
SHA1:	A0B5DD4C37E25FDE291DA56D07E0712299FF280C
SHA-256:	836F4E916406517BBD597079BD3CE6A1E52F9EBFA547A00AD793D80C5272CA6D
SHA-512:	086B199779EC40BEA7DFBDCC3FCEB15F6320CBFBA659129DB22C964C73CAC3EE4E583B8C45F19A6E130287E9ECD91FA4C6A186CA3F9BC77CD3E93F2AEC7A0F4B
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF97675F15250569D7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2445688675035496
Encrypted:	false
SSDEEP:
MD5:	E41C25EFE77CECB304CE8B1DAA24FB13
SHA1:	A0B5DD4C37E25FDE291DA56D07E0712299FF280C
SHA-256:	836F4E916406517BBD597079BD3CE6A1E52F9EBFA547A00AD793D80C5272CA6D
SHA-512:	086B199779EC40BEA7DFBDCC3FCEB15F6320CBFBA659129DB22C964C73CAC3EE4E583B8C45F19A6E130287E9ECD91FA4C6A186CA3F9BC77CD3E93F2AEC7A0F4B
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA6058512DF87F6A2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAC087480DC0147DB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAC8C350148F11A35.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.12941128475374122
Encrypted:	false
SSDEEP:
MD5:	D749E044B38CD8410AA0D4E1A1AB7204
SHA1:	5BC2991E037C6586B7970373899AA9FC48430621
SHA-256:	7FEC5D8BEA5E6502294FDE1DCCD93C6598A2AEA44F99E71467A98F9694BCF8C2
SHA-512:	16024FF627786D558AAE2F5B5734CD41EC6DC32540F1213625BFACFCDE29D597F595A022A4D5D7793D03C6D9DF1B5AC37847DB53DA923A3F8E7E872D978F1B13
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAEDC2258FDCC87B2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB70D5905F9D12B13.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB89A65B8FFD43E38.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.565430960184872
Encrypted:	false
SSDEEP:
MD5:	28C1192542613DA0A607E02150C53650
SHA1:	7D96EE3D0D3C9905642F69D98B17BD41902E4173
SHA-256:	3048153B3AB50AEF889DBCDE3448F9359D992E415642CAF73389AEB8581FC8E8
SHA-512:	8BB795EFB6FB7874A9AF7923EA78A6B567836DA133FD8E36F66C1D45EA023C169CA56408C274261BA067C217ACA8E5AA037997F9150CB8E979A46B008D6CB769
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBA6733B6F6A7A7C5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBAF94C795FB9E909.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10232782618336174
Encrypted:	false
SSDEEP:
MD5:	E0A315D7F3562E59B9DBA6FB3661B54A
SHA1:	7AF53004042EE570954CB9DDB709C5E44A4D914E
SHA-256:	D0EBFD10C59A0967952383CE554E2B60EC9D02EE04B45D84B52DADEBC67E089A
SHA-512:	F4FDD567DBB28DB87461A49FD6C2F5B44215A894ACABB996DC0F70BA44EE64A2806FC9F86CA7C79EF49B46BA73BDFE53A6BDD232E52E44CC3961F699BED5EC5F
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCA47C2A4679E0169.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD0E63ADFAAF86DD0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD3558004380F4375.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD38A201A3844D710.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2510082805855611
Encrypted:	false
SSDEEP:
MD5:	ACA41F3C3084900ABAE2BE8AEC96D57B
SHA1:	2C96C5F97667759AADF792AB27C55FCD4887D46C
SHA-256:	44D30AC7AF3FA8428CBCC2D253CAE6C51D42883808B8CEF729E873D834D75581
SHA-512:	2B81B8E9CD7EB6F568DF82A3A85CCD712C59FA2F29A3E177A129C867E239651CF8A673B8A3985D4135FD49A8E99F3ED7A48C10723DF8F0B901477F9157278CAC
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD66EB07DE8F7A01D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2547895172190402
Encrypted:	false
SSDEEP:
MD5:	5ED933657FF28B9DF22BDAB78CE1C465
SHA1:	9890088AAAD996924BEB6121C55746EC465CCC4D
SHA-256:	C666537CB51619E364A06286DEAC2BAE28D6A4CEB020CBF5DCD4921EFAEAFB07
SHA-512:	208391EECD9DF5C41DDA80BCEA563CF8D0A1EA1B3B3A9FD5EC1462C8A743B162F3C0685B122C1AE19619D32089EFD604164682059DD4854F84E2A7929D7E7AEE
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD7894377266691B0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD8F3A74E3127075F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDA16CCA831DCB890.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2547895172190402
Encrypted:	false
SSDEEP:
MD5:	5ED933657FF28B9DF22BDAB78CE1C465
SHA1:	9890088AAAD996924BEB6121C55746EC465CCC4D
SHA-256:	C666537CB51619E364A06286DEAC2BAE28D6A4CEB020CBF5DCD4921EFAEAFB07
SHA-512:	208391EECD9DF5C41DDA80BCEA563CF8D0A1EA1B3B3A9FD5EC1462C8A743B162F3C0685B122C1AE19619D32089EFD604164682059DD4854F84E2A7929D7E7AEE
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE2BD533F50D6A798.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE3F3924AD86B6233.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2510082805855611
Encrypted:	false
SSDEEP:
MD5:	ACA41F3C3084900ABAE2BE8AEC96D57B
SHA1:	2C96C5F97667759AADF792AB27C55FCD4887D46C
SHA-256:	44D30AC7AF3FA8428CBCC2D253CAE6C51D42883808B8CEF729E873D834D75581
SHA-512:	2B81B8E9CD7EB6F568DF82A3A85CCD712C59FA2F29A3E177A129C867E239651CF8A673B8A3985D4135FD49A8E99F3ED7A48C10723DF8F0B901477F9157278CAC
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE46CA975652E7399.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEADC3D37F92E5D51.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10317546984807693
Encrypted:	false
SSDEEP:
MD5:	61C0E72E97C831721016EEF01BC314A5
SHA1:	AF78F5F7B054660650464940D2EF2173B3D75613
SHA-256:	8D20DA0D8D26EC629F052DBE872F46EEFC24EF0412594DDFFA166095CF991F70
SHA-512:	B1EDF62D47EBC767C425B29BE00A8FEB36F528298299087765C6FB77E05F8A5A2898C2EC820716FE726048B9D2C8FC019BA43CE5C3637D9D942A6033A132AECE
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFED41DCB99793ED44.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2445688675035496
Encrypted:	false
SSDEEP:
MD5:	E41C25EFE77CECB304CE8B1DAA24FB13
SHA1:	A0B5DD4C37E25FDE291DA56D07E0712299FF280C
SHA-256:	836F4E916406517BBD597079BD3CE6A1E52F9EBFA547A00AD793D80C5272CA6D
SHA-512:	086B199779EC40BEA7DFBDCC3FCEB15F6320CBFBA659129DB22C964C73CAC3EE4E583B8C45F19A6E130287E9ECD91FA4C6A186CA3F9BC77CD3E93F2AEC7A0F4B
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF1ECA8A3D59B3C66.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF2C5934024C96568.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF9A5E08F9D621F1D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFCB53E8E09D31605.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2510082805855611
Encrypted:	false
SSDEEP:
MD5:	ACA41F3C3084900ABAE2BE8AEC96D57B
SHA1:	2C96C5F97667759AADF792AB27C55FCD4887D46C
SHA-256:	44D30AC7AF3FA8428CBCC2D253CAE6C51D42883808B8CEF729E873D834D75581
SHA-512:	2B81B8E9CD7EB6F568DF82A3A85CCD712C59FA2F29A3E177A129C867E239651CF8A673B8A3985D4135FD49A8E99F3ED7A48C10723DF8F0B901477F9157278CAC
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Target ID:	0
Start time:	02:13:00
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe" > cmdline.out 2>&1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:13:00
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:13:01
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\wget.exe
Wow64 process (32bit):	true
Commandline:	wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe"
Imagebase:	0x400000
File size:	3'895'184 bytes
MD5 hash:	3DADB6E2ECE9C4B3E1E322E617658B60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:17:22
Start date:	13/01/2025
Path:	C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe"
Imagebase:	0x400000
File size:	355'083'480 bytes
MD5 hash:	4FA9171C45161772572CB136422EA7FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:17:23
Start date:	13/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-DL9N7.tmp\CloudCompare_v2.14.alpha_setup_x64.tmp" /SL5="$B01CE,353634964,780800,C:\Users\user\Desktop\download\CloudCompare_v2.14.alpha_setup_x64.exe"
Imagebase:	0x400000
File size:	3'024'000 bytes
MD5 hash:	CA9D0BC1FC3C0AEBE22047A2DCBCD715
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:17:58
Start date:	13/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe" /install /quiet /norestart
Imagebase:	0xfb0000
File size:	7'200'744 bytes
MD5 hash:	49B1164F8E95EC6409EA83CDB352D8DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:17:58
Start date:	13/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\vcredist_2013_x64.exe" /install /quiet /norestart -burn.unelevated BurnPipe.{1EB8EC4C-F5D1-4ECA-9DD0-7714AF65556E} {84117F68-D40E-4241-8A1A-B0F8298D254D} 4264
Imagebase:	0xfb0000
File size:	7'200'744 bytes
MD5 hash:	49B1164F8E95EC6409EA83CDB352D8DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:18:14
Start date:	13/01/2025
Path:	C:\Windows\System32\SrTasks.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1
Imagebase:	0x7ff6093c0000
File size:	59'392 bytes
MD5 hash:	2694D2D28C368B921686FE567BD319EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:18:15
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:18:15
Start date:	13/01/2025
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff7ace60000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	02:18:21
Start date:	13/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe" /install /quiet /norestart
Imagebase:	0x4a0000
File size:	25'640'112 bytes
MD5 hash:	223A76CD5AB9E42A5C55731154B85627
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:18:21
Start date:	13/01/2025
Path:	C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\{D8943984-F9C2-4E4C-B1F7-BE52C05F00EB}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\is-UQ9E2.tmp\VC_redist.x64.exe" -burn.filehandle.attached=680 -burn.filehandle.self=684 /install /quiet /norestart
Imagebase:	0xa40000
File size:	686'136 bytes
MD5 hash:	3F32F1A9BD60AE065B89C2223676592E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:18:22
Start date:	13/01/2025
Path:	C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\{CE3C8B2F-DD8D-438E-8C6B-737A64F87B6D}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5DEBEB27-EE90-4179-8801-9F2879D6FF33} {CFB915F2-7D0C-4BB0-A831-01B27FBD1688} 2492
Imagebase:	0xe40000
File size:	686'136 bytes
MD5 hash:	3F32F1A9BD60AE065B89C2223676592E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	02:18:24
Start date:	13/01/2025
Path:	C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /burn.runonce
Imagebase:	0x530000
File size:	465'992 bytes
MD5 hash:	3284088A2D414D65E865004FDB641936
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	02:18:24
Start date:	13/01/2025
Path:	C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe"
Imagebase:	0x530000
File size:	465'992 bytes
MD5 hash:	3284088A2D414D65E865004FDB641936
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	02:18:34
Start date:	13/01/2025
Path:	C:\Windows\System32\SrTasks.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
Imagebase:	0x7ff6093c0000
File size:	59'392 bytes
MD5 hash:	2694D2D28C368B921686FE567BD319EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	02:18:35
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: VC_redist.x64.exePID: 2488, Parent PID: 6552

General

Target ID:	28
Start time:	02:18:41
Start date:	13/01/2025
Path:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{3CE290E6-406D-4F39-9839-02C576C54025} {EA2D85BC-101D-4701-8D4D-A4BF8B19AB71} 6552
Imagebase:	0x390000
File size:	650'592 bytes
MD5 hash:	35E545DAC78234E4040A99CBB53000AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	02:18:41
Start date:	13/01/2025
Path:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.filehandle.attached=508 -burn.filehandle.self=520 -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{3CE290E6-406D-4F39-9839-02C576C54025} {EA2D85BC-101D-4701-8D4D-A4BF8B19AB71} 6552
Imagebase:	0x390000
File size:	650'592 bytes
MD5 hash:	35E545DAC78234E4040A99CBB53000AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	02:18:42
Start date:	13/01/2025
Path:	C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5A86F4D1-A9EC-4B64-B083-BE7A62BB96B8} {9AF4D465-6A98-4E12-88F2-BC1C1719DF24} 4280
Imagebase:	0x390000
File size:	650'592 bytes
MD5 hash:	35E545DAC78234E4040A99CBB53000AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	02:18:47
Start date:	13/01/2025
Path:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" /burn.runonce
Imagebase:	0x980000
File size:	686'136 bytes
MD5 hash:	3F32F1A9BD60AE065B89C2223676592E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	02:18:48
Start date:	13/01/2025
Path:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe"
Imagebase:	0x980000
File size:	686'136 bytes
MD5 hash:	3F32F1A9BD60AE065B89C2223676592E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	02:18:48
Start date:	13/01/2025
Path:	C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548
Imagebase:	0x980000
File size:	686'136 bytes
MD5 hash:	3F32F1A9BD60AE065B89C2223676592E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	02:18:51
Start date:	13/01/2025
Path:	C:\Windows\System32\LogonUI.exe
Wow64 process (32bit):	false
Commandline:	"LogonUI.exe" /flags:0x4 /state0:0xa3f5a855 /state1:0x41c64e6d
Imagebase:	0x7ff75ff10000
File size:	13'824 bytes
MD5 hash:	893144FE49AA16124B5BD3034E79BBC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Function 00FE3123 Relevance: 49.4, APIs: 27, Strings: 1, Instructions: 351
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00FE3163
_memset.LIBCMT ref: 00FE3186
_memset.LIBCMT ref: 00FE31A0
_memset.LIBCMT ref: 00FE31BA
_memset.LIBCMT ref: 00FE31D4
_memset.LIBCMT ref: 00FE31EE
InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 00FE3205
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00FE320F
CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 00FE3256
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00FE325C
CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 00FE329D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00FE32A3
CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 00FE32E4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00FE32EA
CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 00FE332B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00FE3331
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 00FE3372
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00FE3378
SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 00FE346A
SetSecurityDescriptorOwner.ADVAPI32(?,?,00000000), ref: 00FE34A5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00FE34AF
SetSecurityDescriptorGroup.ADVAPI32(?,?,00000000), ref: 00FE34E5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00FE34EF
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00FE3526
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00FE3530
CoInitializeSecurity.COMBASE(?,000000FF,00000000,00000000,00000006,00000002,00000000,00003000,00000000), ref: 00FE3576
LocalFree.KERNEL32(?), ref: 00FE358C

Strings

srputil.cpp, xrefs: 00FE3555

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$_memset$CreateKnownSecurityWell$Descriptor$Initialize$DaclEntriesFreeGroupLocalOwner
String ID: srputil.cpp
API String ID: 3642641498-4105181634
Opcode ID: c8d2c69c4cad967800b83d647056ea433089a3e5a3f827ffd40a981063166a8e
Instruction ID: 3732dfb5729092934c23824ffe5b6702555d284ac05aebb48270c31906c9372d
Opcode Fuzzy Hash: c8d2c69c4cad967800b83d647056ea433089a3e5a3f827ffd40a981063166a8e
Instruction Fuzzy Hash: 3BD153B2D4026EAEDB20DF56CC8CBEEBAB8AB04310F1445BAE619E7140D7745F849F51

Function 00FE6CB2 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 325
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00FE6D27
_memset.LIBCMT ref: 00FE6D35
GetFileAttributesW.KERNELBASE(?,?,?,?,00000000,?,00000000), ref: 00FE6D3E
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00FE6D59
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000000,?,00000000), ref: 00FE6DAB
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00FE6DB5
GetTempPathW.KERNEL32(00000104,?,?,?,?,00000000,?,00000000), ref: 00FE6E00
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00FE6E0A
FindFirstFileW.KERNELBASE(?,?,?,*.*,?,?,?,?,00000000,?,00000000), ref: 00FE6E5C
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00FE6E6D
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000000,?,00000000), ref: 00FE6F4F
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00000000,?,00000000), ref: 00FE6F63
GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000000,?,00000000), ref: 00FE6F8D
MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000000,?,00000000), ref: 00FE6FB0
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000000,?,00000000), ref: 00FE6FC9
FindNextFileW.KERNELBASE(000000FF,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00FE6FD8
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00FE6FEC
RemoveDirectoryW.KERNELBASE(?,?,?,?,00000000,?,00000000), ref: 00FE6FFF
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00FE700D
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000000,?,00000000), ref: 00FE7038
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00FE7061
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00FE7082
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00FE70A3
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00FE70C4
FindClose.KERNEL32(000000FF,?,?,?,00000000,?,00000000), ref: 00FE70F8

Strings

dirutil.cpp, xrefs: 00FE6D7B, 00FE7052
*.*, xrefs: 00FE6E35
DEL, xrefs: 00FE6F81

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLast$AttributesFindMove$Temp_memset$CloseDeleteDirectoryFirstNameNextPathRemove
String ID: *.*$DEL$dirutil.cpp
API String ID: 4152325254-1252831301
Opcode ID: 9e51ef3fff9c0e1f58cc97c8b0eccdccd335a35a9252d30b7d4d336ea95f832f
Instruction ID: 5b177c3dbf0e7b16a6d3c8a54d2b1bdd6f99355542c15908529c878f6c224327
Opcode Fuzzy Hash: 9e51ef3fff9c0e1f58cc97c8b0eccdccd335a35a9252d30b7d4d336ea95f832f
Instruction Fuzzy Hash: 21B10872A0439D9ADB319B36CC49B9B76B6AFD0760F1401A9E618D6190EB36CD81FF10

Function 00FB1B46 Relevance: 42.3, APIs: 7, Strings: 17, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00FB1BA5
_memset.LIBCMT ref: 00FB1BC9

Part of subcall function 00FB1033: InitializeCriticalSection.KERNEL32(?,?,0000011C), ref: 00FB1057
Part of subcall function 00FB1033: InitializeCriticalSection.KERNEL32(?,?,0000011C), ref: 00FB1060
Part of subcall function 00FB1033: GetCurrentProcess.KERNEL32(00000000,?,?,?,0000011C), ref: 00FB107E

CoInitializeEx.COMBASE(00000000,00000000,00000003,00000000), ref: 00FB1C04
CoUninitialize.COMBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00FB1F08

Part of subcall function 00FB1226: CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000000,?,?,?,?), ref: 00FB12AC

Part of subcall function 00FB157C: ReleaseMutex.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00FB174B
Part of subcall function 00FB157C: CloseHandle.KERNEL32(00000000,?,?,?,00FB1DEA,?,?), ref: 00FB1754

Part of subcall function 00FB18B9: IsWindow.USER32(?), ref: 00FB1AC3
Part of subcall function 00FB18B9: PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00FB1AD6
Part of subcall function 00FB18B9: CloseHandle.KERNEL32(00000000,?,?,?,00FB1E12,?), ref: 00FB1AE5

Strings

Failed to initialize XML util., xrefs: 00FB1C7F
txt, xrefs: 00FB1E5E
Invalid run mode., xrefs: 00FB1D82
_Failed, xrefs: 00FB1E63
Failed to initialize Regutil., xrefs: 00FB1C41
Failed to run RunOnce mode., xrefs: 00FB1DA9
Failed to initialize engine state., xrefs: 00FB1BE2
3.7.3424.0, xrefs: 00FB1D1C
engine.cpp, xrefs: 00FB1CCC
Failed to initialize core., xrefs: 00FB1D5C
Failed to run embedded mode., xrefs: 00FB1DD1
Failed to initialize COM., xrefs: 00FB1C10
Failed to initialize Wiutil., xrefs: 00FB1C60
Failed to run per-machine mode., xrefs: 00FB1DF0
Failed to run per-user mode., xrefs: 00FB1E18
Failed to get OS info., xrefs: 00FB1CD6
Setup, xrefs: 00FB1E68

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseHandleInitialize$CriticalSection_memset$CurrentMessageMutexPostProcessReleaseUninitializeWindow
String ID: 3.7.3424.0$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Invalid run mode.$Setup$_Failed$engine.cpp$txt
API String ID: 3466682788-859551277
Opcode ID: 93b8d39a6a387739f88853ce9b56a9396522d329e58a5c3b1a6efd22e61aafe1
Instruction ID: c3da4db47c4d7e822703e35a32609877d92f24d7e21aa03fcd5df6b6aafeb0cd
Opcode Fuzzy Hash: 93b8d39a6a387739f88853ce9b56a9396522d329e58a5c3b1a6efd22e61aafe1
Instruction Fuzzy Hash: A591B5B1D0026D9BCF20AF66CC91BEE76B5BB48310F9400EAE508A7141DB759E91FF51

Function 00FE7BC4 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 184
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00FE7C1B
CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000000,F0000040,00000000,?,00000000,00000000,?,?,00FC9C26,00000000,?,?,00000000), ref: 00FE7C40
GetLastError.KERNEL32(?,?,00FC9C26,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 00FE7C4A
CryptCreateHash.ADVAPI32(?,?,00000000,00000000,?,?,?,00FC9C26,00000000,?,?,00000000,?,?,00000000,00000000), ref: 00FE7C86
GetLastError.KERNEL32(?,?,00FC9C26,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 00FE7C90
CryptHashData.ADVAPI32(?,?,?,00000000,?,?,00FC9C26,00000000,?,?,00000000,?,?,00000000,00000000,?), ref: 00FE7CE1
ReadFile.KERNELBASE(?,?,00001000,?,00000000,?,?,00FC9C26,00000000,?,?,00000000,?,?,00000000,00000000), ref: 00FE7D06
GetLastError.KERNEL32(?,?,00FC9C26,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 00FE7D0C
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,?,00FC9C26,00000000,?,?,00000000,?,?,00000000,00000000), ref: 00FE7D48
GetLastError.KERNEL32(?,?,00FC9C26,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 00FE7D52
SetFilePointerEx.KERNELBASE(?,?,?,?,00000001,?,?,00FC9C26,00000000,?,?,00000000,?,?,00000000,00000000), ref: 00FE7D9B
GetLastError.KERNEL32(?,?,00FC9C26,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 00FE7DA5
GetLastError.KERNEL32(?,?,00FC9C26,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 00FE7DCC
CryptDestroyHash.ADVAPI32(?,?,?,00FC9C26,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 00FE7E0B
CryptReleaseContext.ADVAPI32(?,00000000,?,?,00FC9C26,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000), ref: 00FE7E20

Strings

cryputil.cpp, xrefs: 00FE7DF1

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CryptErrorLast$Hash$ContextFile$AcquireCreateDataDestroyParamPointerReadRelease_memset
String ID: cryputil.cpp
API String ID: 961722652-2185294990
Opcode ID: 83c95f9c1f096cfe0c808b4b1c17f1d9a1d7a8b53341012a8568ff70e9e57e79
Instruction ID: c3b38a9b8b2c172d4833da004f02b4c254141bb60082eeb5f40eb2f052bfdaf0
Opcode Fuzzy Hash: 83c95f9c1f096cfe0c808b4b1c17f1d9a1d7a8b53341012a8568ff70e9e57e79
Instruction Fuzzy Hash: 5F51B371A043DAABEB319B66CC84BEB76B8AF08741F1000B5B648E5150D7B98EC4BF50

Function 00FC9065 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 112filestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC909E
FindFirstFileW.KERNEL32(?,?,?,*.*,?,?,.unverified,?,?,?), ref: 00FC9117
lstrlenW.KERNEL32(?,?,?), ref: 00FC913E
FindNextFileW.KERNEL32(00000000,00000010,?,?), ref: 00FC91A0
FindClose.KERNEL32(00000000,?,?), ref: 00FC91AF

Part of subcall function 00FE6CB2: _memset.LIBCMT ref: 00FE6D27
Part of subcall function 00FE6CB2: _memset.LIBCMT ref: 00FE6D35
Part of subcall function 00FE6CB2: GetFileAttributesW.KERNELBASE(?,?,?,?,00000000,?,00000000), ref: 00FE6D3E
Part of subcall function 00FE6CB2: GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00FE6D59

Strings

*.*, xrefs: 00FC90F2
.unverified, xrefs: 00FC90AD

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: FileFind_memset$AttributesCloseErrorFirstLastNextlstrlen
String ID: *.*$.unverified
API String ID: 2873512992-2528915496
Opcode ID: de9d9e89aed70545110688ef0851d9fa2a3cdc478b1abe20044123f59218eec8
Instruction ID: d5cce45b452b00f23a868c7669416de7f57a30e0f0e67775f6b1ae453a5670ec
Opcode Fuzzy Hash: de9d9e89aed70545110688ef0851d9fa2a3cdc478b1abe20044123f59218eec8
Instruction Fuzzy Hash: 8041847190466E9ECB20AF60DD4EFEE7778AF44315F5400E9E908A1090DBB49EC4EF54

Function 00FDF835 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(01007E3C,00000000,00000000,0000FFFF,?,?,00FE0138,?,00FD6AA0,?,?,00FD6AA0,?,Failed to extract all files from container.), ref: 00FDF86B
GetCurrentProcessId.KERNEL32(?,?,00FE0138,?,00FD6AA0,?,?,00FD6AA0,?,Failed to extract all files from container.), ref: 00FDF87A
GetCurrentThreadId.KERNEL32 ref: 00FDF883
GetLocalTime.KERNEL32(?,?,?,00FE0138,?,00FD6AA0,?,?,00FD6AA0,?,Failed to extract all files from container.), ref: 00FDF899
LeaveCriticalSection.KERNEL32(01007E3C,00FD6AA0,?,00000000,0000FDE9,?,?,00FE0138,?,00FD6AA0,?,?,00FD6AA0,?,Failed to extract all files from container.), ref: 00FDF993

Strings

%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 00FDF938

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls
API String ID: 296830338-59366893
Opcode ID: 6abe3589118300df23d56c0b494d8de73f02ec44719b4154f16035a17ee7080f
Instruction ID: 837368a40172290c6ad33faa531993c2636198ca265cdfdc92b734e3edf31a25
Opcode Fuzzy Hash: 6abe3589118300df23d56c0b494d8de73f02ec44719b4154f16035a17ee7080f
Instruction Fuzzy Hash: 19416E72D00249AFDB119F95CC94EBEB7B6AB48321F18003AF642A7250D7399D45EB62

Function 00FDF9C6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,00000000,?,00000000,?,00000000,?,00000000,00000000,?,00FDFB87,00000000,?,00000000,?,00000001), ref: 00FDF9E5
GetLastError.KERNEL32(?,00FDFB87,00000000,?,00000000,?,00000001,?,00FB157A,00000000,00000000,00000000,?,?,00FC9D5B,00000002), ref: 00FDF9EF
LocalFree.KERNEL32(00000000,00000000,?,00000000,?,00FDFB87,00000000,?,00000000,?,00000001,?,00FB157A,00000000,00000000,00000000), ref: 00FDFA5A

Strings

logutil.cpp, xrefs: 00FDFA0F

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: logutil.cpp
API String ID: 1365068426-3545173039
Opcode ID: c0d46e1f180ce1d8ca41c871d709c4e1c949b0661641f7d49049a530a3b0593f
Instruction ID: f6d0a4b746c74e78f63e1f38acca03a6bd9ec0d732b99973354effaf0c0e7bb9
Opcode Fuzzy Hash: c0d46e1f180ce1d8ca41c871d709c4e1c949b0661641f7d49049a530a3b0593f
Instruction Fuzzy Hash: 9311C13660024AEBDB21DF95CC41EAF377AEF85720F184026F50AD6260D735DA54F720

Function 00FE726D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.COMBASE(Microsoft.Update.AutoUpdate,00FB1DEA,00000000,00FB1DEA,?,?), ref: 00FE7290
CoCreateInstance.OLE32(00000000,00000000,00000001,01002978,00000000), ref: 00FE72A9

Strings

Microsoft.Update.AutoUpdate, xrefs: 00FE728B

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID: Microsoft.Update.AutoUpdate
API String ID: 2151042543-675569418
Opcode ID: 9e4c2fb8531586a98933a6f5d75561e92d6f091f011f4ebea28b7d5efa57c72b
Instruction ID: 69869a148cd450ab705a49bedae4cce96cbae5fb581beac86f1e34b996c179fc
Opcode Fuzzy Hash: 9e4c2fb8531586a98933a6f5d75561e92d6f091f011f4ebea28b7d5efa57c72b
Instruction Fuzzy Hash: 68F0A73160020DBFEB01DBB9CC4AEEFB7B8AB08704F000025F601E7191D660AA049662

Function 00FE5D1F Relevance: 4.5, APIs: 3, Instructions: 43fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE5D4A
FindFirstFileW.KERNELBASE(00000000,?,00000000,?,80070002), ref: 00FE5D5A
FindClose.KERNEL32(00000000), ref: 00FE5D66

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Find$CloseFileFirst_memset
String ID:
API String ID: 3141757445-0
Opcode ID: 096c458eb588f434805ff83fd1bcd22b3218990c25f43383e994dfb5ba090e5f
Instruction ID: 178cbd43fb34a194730e2e7d9426d627494eb0e1f9b34f4d7bd7b471ed1d06d5
Opcode Fuzzy Hash: 096c458eb588f434805ff83fd1bcd22b3218990c25f43383e994dfb5ba090e5f
Instruction Fuzzy Hash: 3801F972A006089FC720EFA8DCC99AEF3BCEB44729F040066E945D3280D738AD499750

Function 00FE28F3 Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00FD6AA0,?,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000), ref: 00FE2904
RtlAllocateHeap.NTDLL(00000000,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000), ref: 00FE290B

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 3c7e0fa31d0cef392877e237d352b08380a3e2fd5027d937ee5c3ee313dfa77f
Instruction ID: 66e51a612bda5f0133c5c9c8b2a963c4079646beb861039d4a29e12b15612cb1
Opcode Fuzzy Hash: 3c7e0fa31d0cef392877e237d352b08380a3e2fd5027d937ee5c3ee313dfa77f
Instruction Fuzzy Hash: 6BC012321A020CABCF006FF8EC4AC8A3BACAB28622B008401B905CA020C73CE050AB60

Function 00FBC7F3 Relevance: 211.0, APIs: 57, Strings: 63, Instructions: 1021stringCOMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(00FB2142,00FB2146,00FB2142,?,00000000,00FB2142,ignored ,00000000,00000000,00FB1D56,00FB2142,00FB2146,00FB1E8E,00FB2222,00FB1F0E,00000000), ref: 00FBC864
GetLastError.KERNEL32 ref: 00FBC871
CompareStringW.KERNELBASE(0000007F,00000001,00FB1E8C,000000FF,00FF2BBC,000000FF,00FB21DE,00000000,00FB1D56,00FB2142,00FB2146,00FB1E8E,00FB2222,00FB1F0E,00000000,?), ref: 00FBC8F5
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,log,000000FF), ref: 00FBC911
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,00FF2BB0,000000FF), ref: 00FBC92D
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,00FF2BAC,000000FF), ref: 00FBC949
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,help,000000FF), ref: 00FBC965
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,00FF2B9C,000000FF), ref: 00FBC981
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,quiet,000000FF), ref: 00FBC99D
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,00FF2B8C,000000FF), ref: 00FBC9B9
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,silent,000000FF), ref: 00FBC9D5
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,passive,000000FF), ref: 00FBC9F1
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,norestart,000000FF), ref: 00FBCA29
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,forcerestart,000000FF), ref: 00FBCA50
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,promptrestart,000000FF), ref: 00FBCA77
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,layout,000000FF), ref: 00FBCA9A
lstrlenW.KERNEL32(00000000), ref: 00FBD0FC
lstrlenW.KERNEL32(burn.), ref: 00FBD109
lstrlenW.KERNEL32(burn.), ref: 00FBD11D
lstrlenW.KERNEL32(burn.,burn.,00000000), ref: 00FBD126
CompareStringW.KERNEL32(0000007F,00000001,00000000,00000000), ref: 00FBD139
LocalFree.KERNEL32(00000000,00000000,00FB1D56,00FB2142,00FB2146), ref: 00FBD21C

Strings

burn.related.patch, xrefs: 00FBCF71
Failed to copy append log file path., xrefs: 00FBD293
Failed to get command line., xrefs: 00FBC8A5
originalsource, xrefs: 00FBCCA1
uninstall, xrefs: 00FBCAFF
parent:none, xrefs: 00FBCD3B
Failed to initialize command line., xrefs: 00FBC832
burn.embedded, xrefs: 00FBCE6E
burn.embedded.async, xrefs: 00FBCEC6
Must specify the elevated name, token and parent process id., xrefs: 00FBD2B2
parallelcacheandexecute, xrefs: 00FBCC12
burn.related.upgrade, xrefs: 00FBCF33
modify, xrefs: 00FBCB5D
serialcacheandexecute, xrefs: 00FBCC38
burn.related.detect, xrefs: 00FBCEF8
Must specify a path for log., xrefs: 00FBD370
Must specify a path for append log., xrefs: 00FBD28C
burn.related.addon, xrefs: 00FBCF54
package, xrefs: 00FBCB8C
Failed to copy log file path., xrefs: 00FBD19E
parent, xrefs: 00FBCCEE
Failed to copy command line., xrefs: 00FBC856
burn.passthrough, xrefs: 00FBCFA9
Failed to copy last used source., xrefs: 00FBCCE0
log, xrefs: 00FBC903
burn.log.append, xrefs: 00FBCD77
burn.unelevated, xrefs: 00FBCE1C
burn.ignoredependencies, xrefs: 00FBD00C, 00FBD018, 00FBD01D, 00FBD01E, 00FBD035, 00FBD324
Failed to initialize parent to none., xrefs: 00FBCD69
Must specify a value for parent., xrefs: 00FBD26D
burn.runonce, xrefs: 00FBCFF0
Failed to parse unelevated connection., xrefs: 00FBCE63
burn.ancestors, xrefs: 00FBD07C, 00FBD088, 00FBD08D, 00FBD08E, 00FBD0A5, 00FBD340
Failed to parse elevated connection., xrefs: 00FBD2B9
update, xrefs: 00FBCBA8
Failed to allocate the list of dependencies to ignore., xrefs: 00FBD075
passive, xrefs: 00FBC9E3
Failed to allocate the list of ancestors., xrefs: 00FBD0E5
Missing required parameter for switch: %ls, xrefs: 00FBD345
core.cpp, xrefs: 00FBC89B, 00FBD244, 00FBD263, 00FBD282, 00FBD2A8, 00FBD2CE, 00FBD2F7, 00FBD31A, 00FBD336, 00FBD366
burn.elevated, xrefs: 00FBCDC5
forcerestart, xrefs: 00FBCA42
burn.disable.unelevate, xrefs: 00FBCFD0
Must specify a path for original source., xrefs: 00FBD24E
quiet, xrefs: 00FBC98F
keepaupaused, xrefs: 00FBCBE7
help, xrefs: 00FBC957
Must specify the embedded name, token and parent process id., xrefs: 00FBD301
silent, xrefs: 00FBC9C7
Failed to parse embedded connection., xrefs: 00FBCEB5
burn.related.update, xrefs: 00FBCF8D
repair, xrefs: 00FBCB2E
promptrestart, xrefs: 00FBCA69
burn., xrefs: 00FBD102, 00FBD117, 00FBD11C, 00FBD124, 00FBD125
layout, xrefs: 00FBCA8C
noaupause, xrefs: 00FBCBC4
cache, xrefs: 00FBCC55
disablesystemrestore, xrefs: 00FBCC84
norestart, xrefs: 00FBCA1B
ignored , xrefs: 00FBC81D
Must specify the unelevated name, token and parent process id., xrefs: 00FBD2D8
Failed to copy parent., xrefs: 00FBCD2D
Failed to copy path for layout directory., xrefs: 00FBCAF1

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CompareString$lstrlen$ArgvCommandErrorFreeLastLineLocal
String ID: Failed to allocate the list of ancestors.$Failed to allocate the list of dependencies to ignore.$Failed to copy append log file path.$Failed to copy command line.$Failed to copy last used source.$Failed to copy log file path.$Failed to copy parent.$Failed to copy path for layout directory.$Failed to get command line.$Failed to initialize command line.$Failed to initialize parent to none.$Failed to parse elevated connection.$Failed to parse embedded connection.$Failed to parse unelevated connection.$Missing required parameter for switch: %ls$Must specify a path for append log.$Must specify a path for log.$Must specify a path for original source.$Must specify a value for parent.$Must specify the elevated name, token and parent process id.$Must specify the embedded name, token and parent process id.$Must specify the unelevated name, token and parent process id.$burn.$burn.ancestors$burn.disable.unelevate$burn.elevated$burn.embedded$burn.embedded.async$burn.ignoredependencies$burn.log.append$burn.passthrough$burn.related.addon$burn.related.detect$burn.related.patch$burn.related.update$burn.related.upgrade$burn.runonce$burn.unelevated$cache$core.cpp$disablesystemrestore$forcerestart$help$ignored $keepaupaused$layout$log$modify$noaupause$norestart$originalsource$package$parallelcacheandexecute$parent$parent:none$passive$promptrestart$quiet$repair$serialcacheandexecute$silent$uninstall$update
API String ID: 1440157973-175168873
Opcode ID: d3ec2ba45b48c954d45d4e001f372ab37f0e96c91207982dbe0ad98cbbd43f4d
Instruction ID: c2f0958ac99fce27bf1c7f823078abfbc42e167fe49554a690d1f27e43ac7aba
Opcode Fuzzy Hash: d3ec2ba45b48c954d45d4e001f372ab37f0e96c91207982dbe0ad98cbbd43f4d
Instruction Fuzzy Hash: 57728071B44249BBEB109E49CC82FB937A4AF10774F240625F660EB2E1D6B4DC81BF52

Function 00FB621F Relevance: 112.4, APIs: 3, Strings: 61, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to get @Publisher., xrefs: 00FB6412
Failed to get @Classification., xrefs: 00FB672B
Failed to get @Name., xrefs: 00FB670A
registration.cpp, xrefs: 00FB65BC
PerMachine, xrefs: 00FB6345
Publisher, xrefs: 00FB63FB
Failed to get @ProviderKey., xrefs: 00FB6319
Failed to get @Tag., xrefs: 00FB629E
Failed to get @AboutUrl., xrefs: 00FB6481
Contact, xrefs: 00FB6504
Failed to get @Id., xrefs: 00FB627D
Failed to get @PerMachine., xrefs: 00FB6358
Failed to get @DisableRemove., xrefs: 00FB6614
Registration, xrefs: 00FB622E
Failed to parse software tag., xrefs: 00FB6644
Failed to set registration paths., xrefs: 00FB673F
Failed to get @Contact., xrefs: 00FB651B
Failed to get @HelpTelephone., xrefs: 00FB645C
DisplayVersion, xrefs: 00FB63D6
yes, xrefs: 00FB6568
Failed to select registration node., xrefs: 00FB6259
Name, xrefs: 00FB66F7
Invalid modify disabled type: %ls, xrefs: 00FB65C9
UpdateUrl, xrefs: 00FB648F
HelpLink, xrefs: 00FB6420
AboutUrl, xrefs: 00FB646A
button, xrefs: 00FB6542
Register, xrefs: 00FB6390
Failed to get @ParentDisplayName., xrefs: 00FB64CB
Failed to get @Department., xrefs: 00FB66C4
Comments, xrefs: 00FB64DC
Failed to get @Version., xrefs: 00FB62D7
Arp, xrefs: 00FB6366
ParentDisplayName, xrefs: 00FB64B4
ProviderKey, xrefs: 00FB6306
Failed to get @ExecutableName., xrefs: 00FB633A
Classification, xrefs: 00FB6718
Failed to parse @Version: %ls, xrefs: 00FB62F8
Failed to select ARP node., xrefs: 00FB6382
Manufacturer, xrefs: 00FB667F
HelpTelephone, xrefs: 00FB6445
Department, xrefs: 00FB66AD
ProductFamily, xrefs: 00FB66D2
Failed to get @Comments., xrefs: 00FB64F3
DisplayName, xrefs: 00FB63B1
ExecutableName, xrefs: 00FB6327
Failed to get @DisableModify., xrefs: 00FB65EC
Failed to get @ProductFamily., xrefs: 00FB66E9
Failed to get @Register., xrefs: 00FB63A3
Failed to get @DisplayName., xrefs: 00FB63C8
Failed to get @HelpLink., xrefs: 00FB6437
Update, xrefs: 00FB6652
Failed to get @Manufacturer., xrefs: 00FB669C
Version, xrefs: 00FB62C4
Tag, xrefs: 00FB628B
Failed to parse related bundles, xrefs: 00FB62B6
Failed to select Update node., xrefs: 00FB666E
DisableModify, xrefs: 00FB6529
DisableRemove, xrefs: 00FB65FD
Failed to get @UpdateUrl., xrefs: 00FB64A6
Failed to get @DisplayVersion., xrefs: 00FB63ED

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$registration.cpp$yes
API String ID: 760788290-2956246334
Opcode ID: 6db0d0f58d7b03a1247c1fe66acae813c355127b1430312507daa4cb0fa4089f
Instruction ID: dd98e01a72bd63d7c764e2e0d61865320110e9dd00d804395584f0751736bb42
Opcode Fuzzy Hash: 6db0d0f58d7b03a1247c1fe66acae813c355127b1430312507daa4cb0fa4089f
Instruction Fuzzy Hash: 05D1E733640A85BACF11DA53CD56EEE36AAAB80B24F350425F415E7290DF7DE905BB02

Function 00FB20A7 Relevance: 96.8, APIs: 28, Strings: 27, Instructions: 576
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00FB20EB
_memset.LIBCMT ref: 00FB20FD

Part of subcall function 00FE202C: GetModuleFileNameW.KERNEL32(00FB213E,?,00000104,?,00000104,?,00000000,?,?,00FB213E,?,00000000,?,?,?,76EEC3F0), ref: 00FE204D

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000,?,?,?,76EEC3F0,?,00000000), ref: 00FB216E
GetLastError.KERNEL32(?,?,?,76EEC3F0,?,00000000), ref: 00FB217B

Strings

Failed to allocate buffer for section info., xrefs: 00FB265D
Failed to read signature offset., xrefs: 00FB2400
Failed to seek to start of file., xrefs: 00FB2209
Failed to get total size of bundle., xrefs: 00FB278D
Failed to read section info, data to short: %u, xrefs: 00FB2629
Failed to read complete image section header, index: %u, xrefs: 00FB25A2
PE, xrefs: 00FB2337
.wixburn, xrefs: 00FB24ED
Failed to find valid NT image header in buffer., xrefs: 00FB2355
Failed to read DOS header., xrefs: 00FB225C
section.cpp, xrefs: 00FB219D, 00FB21FF, 00FB2252, 00FB2282, 00FB22CA, 00FB231A, 00FB234B, 00FB23A6, 00FB23F6, 00FB2449, 00FB249E, 00FB256D, 00FB2592, 00FB25B7, 00FB2619, 00FB2653, 00FB26A4, 00FB270D, 00FB2737, 00FB275C, 00FB2830
Failed to read NT header., xrefs: 00FB2324
Failed to find valid DOS image header in buffer., xrefs: 00FB228C
Failed to read section info., xrefs: 00FB2717
Failed to allocate memory for container sizes., xrefs: 00FB283A
4, xrefs: 00FB2605
Failed to read section info, unsupported version: %08x, xrefs: 00FB2769
Failed to get path to engine process., xrefs: 00FB2144
Failed to read complete section info., xrefs: 00FB2741
(, xrefs: 00FB24DD
Failed to seek past optional headers., xrefs: 00FB24A8
Failed to read image section header, index: %u, xrefs: 00FB257D
Failed to find Burn section., xrefs: 00FB25C1
Failed to seek to section info., xrefs: 00FB23B0, 00FB26AE
Failed to open handle to engine process path: %ls, xrefs: 00FB21AD
Failed to seek to NT header., xrefs: 00FB22D4
Failed to read signature size., xrefs: 00FB2453

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: File_memset$CreateErrorLastModuleName
String ID: ($.wixburn$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get path to engine process.$Failed to get total size of bundle.$Failed to open handle to engine process path: %ls$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$section.cpp
API String ID: 3151910114-3305245485
Opcode ID: 43ba09445fa0f31eb6a756db3248459d37b25bc698bd8e3acbbf734cd00e548d
Instruction ID: 2d3ea5694e8010903e414ecb95ea6b35b062edb919fc0b815652dc3ff79ec3b7
Opcode Fuzzy Hash: 43ba09445fa0f31eb6a756db3248459d37b25bc698bd8e3acbbf734cd00e548d
Instruction Fuzzy Hash: 8612E932E40266EBD7719B66CC46FEB77B9AF04750F0001A5B908EA190EB78DD40BF95

Function 00FB6C39 Relevance: 82.7, APIs: 1, Strings: 46, Instructions: 444
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000000,F08B8007,057CF33B,00020006,00000000), ref: 00FB7190

Strings

ParentDisplayName, xrefs: 00FB6F30, 00FB6F35
Failed to write %ls value., xrefs: 00FB712F
Publisher, xrefs: 00FB6E90, 00FB6E95
"%ls" /modify, xrefs: 00FB70AA
Failed to write software tags., xrefs: 00FB708F
/uninstall, xrefs: 00FB704A, 00FB704F
SystemComponent, xrefs: 00FB7001, 00FB7006
QuietUninstallString, xrefs: 00FB701C, 00FB7026
DisplayIcon, xrefs: 00FB6E17, 00FB6E21
ParentKeyName, xrefs: 00FB6F4B, 00FB6F50
Failed to cache bundle from path: %ls, xrefs: 00FB6C90
BundleTag, xrefs: 00FB6DD7, 00FB6DDC
Contact, xrefs: 00FB6F91, 00FB6F96
engine.cpp, xrefs: 00FB6E4F
Failed to write update registration., xrefs: 00FB70E4
/modify, xrefs: 00FB7043
HelpTelephone, xrefs: 00FB6ED0, 00FB6ED5
URLUpdateInfo, xrefs: 00FB6F10, 00FB6F15
%hu.%hu.%hu.%hu, xrefs: 00FB6D8C
BundleVersion, xrefs: 00FB6D91, 00FB6D96
Failed to create registration key., xrefs: 00FB6CBD
ModifyPath, xrefs: 00FB70A5, 00FB70AF
DisplayName, xrefs: 00FB6E50, 00FB6E55
NoModify, xrefs: 00FB6FB8, 00FB6FBF
DisplayVersion, xrefs: 00FB6E70, 00FB6E75
EstimatedSize, xrefs: 00FB711A, 00FB711F, 00FB712E
"%ls" /uninstall /quiet, xrefs: 00FB7021
NoRemove, xrefs: 00FB6FE1, 00FB6FE6
BundleUpgradeCode, xrefs: 00FB6CF8, 00FB6D00
BundleAddonCode, xrefs: 00FB6D16, 00FB6D1E
URLInfoAbout, xrefs: 00FB6EF0, 00FB6EF5
"%ls" %ls, xrefs: 00FB7058
EngineVersion, xrefs: 00FB6DF9, 00FB6DFE
NoElevateOnModify, xrefs: 00FB70C1
Failed to register the bundle dependency key., xrefs: 00FB7151
BundleDetectCode, xrefs: 00FB6D34, 00FB6D3C
3.7.3424.0, xrefs: 00FB6DEF
Failed to update resume mode., xrefs: 00FB716B
HelpLink, xrefs: 00FB6EB0, 00FB6EB5
%hs, xrefs: 00FB6DF4
BundleProviderKey, xrefs: 00FB6DB7, 00FB6DBC
BundlePatchCode, xrefs: 00FB6D52, 00FB6D5A
%s,0, xrefs: 00FB6E1C
BundleCachePath, xrefs: 00FB6CDD, 00FB6CE2
UninstallString, xrefs: 00FB7053, 00FB705D
Comments, xrefs: 00FB6F6E, 00FB6F73

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Close
String ID: /uninstall$"%ls" %ls$"%ls" /modify$"%ls" /uninstall /quiet$%hs$%hu.%hu.%hu.%hu$%s,0$/modify$3.7.3424.0$BundleAddonCode$BundleCachePath$BundleDetectCode$BundlePatchCode$BundleProviderKey$BundleTag$BundleUpgradeCode$BundleVersion$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EngineVersion$EstimatedSize$Failed to cache bundle from path: %ls$Failed to create registration key.$Failed to register the bundle dependency key.$Failed to update resume mode.$Failed to write %ls value.$Failed to write software tags.$Failed to write update registration.$HelpLink$HelpTelephone$ModifyPath$NoElevateOnModify$NoModify$NoRemove$ParentDisplayName$ParentKeyName$Publisher$QuietUninstallString$SystemComponent$URLInfoAbout$URLUpdateInfo$UninstallString$engine.cpp
API String ID: 3535843008-3299706022
Opcode ID: 0941382ffbb54f9314e4288dbb96f1691f1478bc0c4467e472ddcba7d826f7d6
Instruction ID: 4fec4d2b871055cc849bd4b0d22b2a7449969323d2ac261a739673d1ff2d89c8
Opcode Fuzzy Hash: 0941382ffbb54f9314e4288dbb96f1691f1478bc0c4467e472ddcba7d826f7d6
Instruction Fuzzy Hash: 38E1CA30704786ABDF22BAABCD85F9B7AEA9F94314F100038B50496652DB79ED54FF10

Function 00FD5B46 Relevance: 54.5, APIs: 20, Strings: 11, Instructions: 287
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,?,00FD6370), ref: 00FD5B58
GetLastError.KERNEL32(?,?,?,00FD6370), ref: 00FD5B62
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00FD6370), ref: 00FD5BA0
GetLastError.KERNEL32(?,?,?,00FD6370), ref: 00FD5BAB
ResetEvent.KERNEL32(?,?,?,?,00FD6370), ref: 00FD5BE7
GetLastError.KERNEL32(?,?,?,00FD6370), ref: 00FD5BF1

Strings

Failed to reset begin operation event., xrefs: 00FD5C20
Invalid operation for this state., xrefs: 00FD5C4A
Failed to set file pointer to beginning of file., xrefs: 00FD5ED1
Failed to set end of file., xrefs: 00FD5E8A
Failed to set operation complete event., xrefs: 00FD5B91
Failed to wait for begin operation event., xrefs: 00FD5BDA
Failed to set file pointer to end of file., xrefs: 00FD5E44
Failed to allocate buffer for stream., xrefs: 00FD5D86
Failed to create file: %ls, xrefs: 00FD5DF5
cabextract.cpp, xrefs: 00FD5B87, 00FD5BD0, 00FD5C16, 00FD5C40, 00FD5D7C, 00FD5DE8, 00FD5E3A, 00FD5E80, 00FD5EC7
Failed to copy stream name: %ls, xrefs: 00FD5C79

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$Event$ObjectResetSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 1865021742-2104912459
Opcode ID: 21ca73cb4f9439e5fdfbf24df60a58d2c0c1085d96ac10ca78e0a3fd7c2bd13e
Instruction ID: 7e936864c5b1bcfe075530c718e02e5dfa20876c4b47973604ce353cf40ab17a
Opcode Fuzzy Hash: 21ca73cb4f9439e5fdfbf24df60a58d2c0c1085d96ac10ca78e0a3fd7c2bd13e
Instruction Fuzzy Hash: AD91C432E54B67B7E32117618C4AB273E56AF00F70F190236BA14EE7E0E799DD0076A5

Function 00FCD28D Relevance: 53.0, APIs: 1, Strings: 29, Instructions: 465
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00FCD2EB

Part of subcall function 00FE530D: _memset.LIBCMT ref: 00FE531E

Strings

REINSTALL=ALL, xrefs: 00FCD63D, 00FCD6B4
Failed to add reinstall mode and reboot suppression properties on minor upgrade., xrefs: 00FCD676
IGNOREDEPENDENCIES, xrefs: 00FCD70B, 00FCD7E6
Failed to enable logging for package: %ls to: %ls, xrefs: 00FCD492
Failed to install MSI package., xrefs: 00FCD7AA
Failed to add obfuscated properties to argument string., xrefs: 00FCD50C
Failed to get cached path for package: %ls, xrefs: 00FCD3F4
Failed to add feature action properties to obfuscated argument string., xrefs: 00FCD550
Failed to add feature action properties to argument string., xrefs: 00FCD52E
Failed to add reboot suppression property on install., xrefs: 00FCD627
Failed to uninstall MSI package., xrefs: 00FCD851
ACTION=ADMIN, xrefs: 00FCD767
Failed to add reinstall all property on minor upgrade., xrefs: 00FCD654
Failed to add patch properties to argument string., xrefs: 00FCD572
Failed to add ADMIN property on admin install., xrefs: 00FCD782
REINSTALLMODE="vomus" REBOOT=ReallySuppress, xrefs: 00FCD65F
Failed to add properties to argument string., xrefs: 00FCD4D3
VersionString, xrefs: 00FCD336, 00FCD36B
%ls %ls=ALL, xrefs: 00FCD71C, 00FCD7F7
Failed to initialize external UI handler., xrefs: 00FCD461
Failed to add the list of dependencies to ignore to the properties., xrefs: 00FCD730
Failed to add reinstall mode and reboot suppression properties on repair., xrefs: 00FCD701
Failed to run maintanance mode for MSI package., xrefs: 00FCD75C
Failed to perform minor upgrade of MSI package., xrefs: 00FCD6A2
Failed to add patch properties to obfuscated argument string., xrefs: 00FCD594
%ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress, xrefs: 00FCD6ED
Failed to build MSI path., xrefs: 00FCD42A
REBOOT=ReallySuppress, xrefs: 00FCD60C, 00FCD7C8
Failed to add reboot suppression property on uninstall., xrefs: 00FCD7DF

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset
String ID: ACTION=ADMIN$ REBOOT=ReallySuppress$ REINSTALL=ALL$ REINSTALLMODE="vomus" REBOOT=ReallySuppress$%ls %ls=ALL$%ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress$Failed to add ADMIN property on admin install.$Failed to add feature action properties to argument string.$Failed to add feature action properties to obfuscated argument string.$Failed to add obfuscated properties to argument string.$Failed to add patch properties to argument string.$Failed to add patch properties to obfuscated argument string.$Failed to add properties to argument string.$Failed to add reboot suppression property on install.$Failed to add reboot suppression property on uninstall.$Failed to add reinstall all property on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on repair.$Failed to add the list of dependencies to ignore to the properties.$Failed to build MSI path.$Failed to enable logging for package: %ls to: %ls$Failed to get cached path for package: %ls$Failed to initialize external UI handler.$Failed to install MSI package.$Failed to perform minor upgrade of MSI package.$Failed to run maintanance mode for MSI package.$Failed to uninstall MSI package.$IGNOREDEPENDENCIES$VersionString
API String ID: 2102423945-2112609193
Opcode ID: 73ccdcb06e64b0f331aa21b2dded4c21bfb236871229b6e9f443779d0f240d2d
Instruction ID: 734bcccd743ad4af68d28c327db9defa2fe8b9e3a22b383fdbb705eae493f238
Opcode Fuzzy Hash: 73ccdcb06e64b0f331aa21b2dded4c21bfb236871229b6e9f443779d0f240d2d
Instruction Fuzzy Hash: 5C02B471A0061AAFDB219F51CE83FADB3B6AF94310F1400BDF20996161E7769E90FB51

Function 00FBA94F Relevance: 44.1, APIs: 6, Strings: 19, Instructions: 398
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000,00000000,?,00FB8B91,?,?,?,?,?,?,?,?,00000001), ref: 00FBA972
lstrlenW.KERNEL32(?,?,00FB8B91,?,?,?,?,?,?,?,?,00000001,00000000), ref: 00FBA97B
_wcschr.LIBCMT ref: 00FBA9A2
_wcschr.LIBCMT ref: 00FBA9B9
_wcschr.LIBCMT ref: 00FBAB2A
LeaveCriticalSection.KERNEL32(?,00000000,00000000,00FEB5F8,00000000,00000000,00000000,00FB8B91,?,00FB8B91,?,00000000,00FB8B91,00000001,?,00FB8B91), ref: 00FBAD83

Strings

variable.cpp, xrefs: 00FBAB88, 00FBABC7, 00FBAC3E, 00FBAC6F, 00FBACD8, 00FBAD25, 00FBAD41
Failed to get formatted length., xrefs: 00FBAC48
Failed to format record., xrefs: 00FBACE2
Failed to get variable name., xrefs: 00FBAD13
Failed to set record format string., xrefs: 00FBABD1
Failed to copy string., xrefs: 00FBACFE
Failed to reallocate variable array., xrefs: 00FBAD2F
*****, xrefs: 00FBAAB2
Failed to append placeholder., xrefs: 00FBAD73
Failed to set record string., xrefs: 00FBAC79
Failed to allocate variable array., xrefs: 00FBAD4B
Failed to allocate record., xrefs: 00FBAB92
Failed to allocate string., xrefs: 00FBAC9F
Failed to determine variable visibility: '%ls'., xrefs: 00FBAD55
Failed to format placeholder string., xrefs: 00FBAD6C
Failed to set variable value., xrefs: 00FBAD65
Failed to allocate buffer for format string., xrefs: 00FBA992
[%d], xrefs: 00FBAAF1
Failed to append string., xrefs: 00FBAB4E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _wcschr$CriticalSection$EnterLeavelstrlen
String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$variable.cpp
API String ID: 144789458-2050445661
Opcode ID: 341ee4611c694c8fb9689a5adf132105255805cfdbfc9b72139f299ac337b5e0
Instruction ID: c26789f048a83e6c5c45128bc0afb5983221e5dae51a7b9a3d3b18c3de41d653
Opcode Fuzzy Hash: 341ee4611c694c8fb9689a5adf132105255805cfdbfc9b72139f299ac337b5e0
Instruction Fuzzy Hash: 8BC12572E0021AFBCB219BA6CC41EFE7769AF04760F154125FA10B7191D678DE40BFA2

Function 00FD6889 Relevance: 35.2, APIs: 11, Strings: 9, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00FD68AE
#20.CABINET(00FD5FA2,00FD5FB1,00FD6374,00FD657B,00FD5FBE,00FD6749,00FD6610,000000FF,?), ref: 00FD690A
CoUninitialize.COMBASE ref: 00FD6AB6

Strings

Failed to reset begin operation event., xrefs: 00FD6A6E
Failed to extract all files from container., xrefs: 00FD69A8
Failed to initialize cabinet.dll., xrefs: 00FD692E
Invalid operation for this state., xrefs: 00FD6A95
Failed to set operation complete event., xrefs: 00FD69EB
Failed to wait for begin operation event., xrefs: 00FD6A31
Failed to initialize COM., xrefs: 00FD68BA
cabextract.cpp, xrefs: 00FD6924, 00FD69E1, 00FD6A27, 00FD6A64, 00FD6A8B
<the>.cab, xrefs: 00FD694C

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container.$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 3442037557-3821814080
Opcode ID: 8a95d9c3b8bdbb516c190728df9a93351efd1ecb61986a5aff3f1f4630c338f4
Instruction ID: feda71b8216d38cb6232d9e4e240b90564c0bbd9e3dd5f261c20ceb8db8f1d3c
Opcode Fuzzy Hash: 8a95d9c3b8bdbb516c190728df9a93351efd1ecb61986a5aff3f1f4630c338f4
Instruction Fuzzy Hash: 4C510B33E40266A7C7219B658C45E6B7B669F00B30B1D412BFA51FB3E1D678DC00B696

Function 00FB315E Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 183
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(8000FFFF,00000000,74DF3140,?,00FB398B,?,?,00000008,00000000,?), ref: 00FB3175
ReadFile.KERNELBASE(00000008,00000008,00000004,?,00000000,?,00FB398B,?,?,00000008,00000000,?), ref: 00FB3195
GetLastError.KERNEL32(?,00FB398B,?,?,00000008,00000000,?), ref: 00FB319B
ReadFile.KERNELBASE(00000008,00000000,00000008,?,00000000,00000000,00000009,?,00FB398B,?,?,00000008,00000000,?), ref: 00FB322B
GetLastError.KERNEL32(?,00FB398B,?,?,00000008,00000000,?), ref: 00FB3231

Strings

pipe.cpp, xrefs: 00FB31C0, 00FB31EB, 00FB3256, 00FB328C, 00FB32DB, 00FB3337, 00FB3374
Failed to read verification process id from parent pipe., xrefs: 00FB32E5
Verification secret from parent does not match., xrefs: 00FB3298
Failed to read size of verification secret from parent pipe., xrefs: 00FB31CA
Verification process id from parent does not match., xrefs: 00FB3380
Failed to allocate buffer for verification secret., xrefs: 00FB3213
Failed to inform parent process that child is running., xrefs: 00FB3341
Failed to read verification secret from parent pipe., xrefs: 00FB3260
Verification secret from parent is too big., xrefs: 00FB31F7

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLastRead$CurrentProcess
String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$pipe.cpp
API String ID: 1233551569-826945260
Opcode ID: 047c7c3c2a169941cc545060ca876e638c92adc70f6bb388013109ae5abe96f1
Instruction ID: 99c1e826ab608e9350eb84e94edbcec0a98d540cdf6a485ca9699206a32a766f
Opcode Fuzzy Hash: 047c7c3c2a169941cc545060ca876e638c92adc70f6bb388013109ae5abe96f1
Instruction Fuzzy Hash: 6451EB72EC424ABBD7115F96CC86EEF3A69AB40760F250035F911E6180DB78CB41BFA1

Function 00FB689B Relevance: 31.7, APIs: 3, Strings: 15, Instructions: 166
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCloseKey.KERNELBASE(00000000,?,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,00020006,00000000,00000000,00000000,?,?), ref: 00FB6A9F

Part of subcall function 00FE3C39: RegSetValueExW.KERNELBASE(?,00020006,00000000,00000004,00FB68EA,00000004,00000001,?,00FB68EA,00020006,Resume,00FB13BB,00000000,00000000,?,?), ref: 00FE3C4E

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00FB6969, 00FB69D1
Failed to write Installed value., xrefs: 00FB6914
Failed to write run key value., xrefs: 00FB699A
Failed to write Resume value., xrefs: 00FB68F0
registration.cpp, xrefs: 00FB6A26, 00FB6A71
Failed to format resume command line for RunOnce., xrefs: 00FB6956
Installed, xrefs: 00FB6901
Failed to create run key., xrefs: 00FB697C
Failed to delete run key value., xrefs: 00FB6A30
"%ls" /%ls, xrefs: 00FB6942
BundleResumeCommandLine, xrefs: 00FB69A7, 00FB6A3F
Failed to write resume command line value., xrefs: 00FB69BE
burn.runonce, xrefs: 00FB6937
Failed to delete resume command line value., xrefs: 00FB6A7B
Resume, xrefs: 00FB68DD

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseValue
String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce$burn.runonce$registration.cpp
API String ID: 3132538880-3648537543
Opcode ID: cffba52e26c4a5d41fb88874a5e3fd2e724f045d23463ccefacfff507ac8690c
Instruction ID: de3b45c8e780e57c292df559a6f752f571f91c60cf1aed8d9433fed2205a937d
Opcode Fuzzy Hash: cffba52e26c4a5d41fb88874a5e3fd2e724f045d23463ccefacfff507ac8690c
Instruction Fuzzy Hash: 1C513C32A40385BADF225A53CC46FEE7A7AAF80760F208025F505F6191DB7DDE41BE12

Function 00FBAE5F Relevance: 30.3, APIs: 1, Strings: 19, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00FB2222,00000000,00FB1D56,00FB21DE), ref: 00FBAE7F

Strings

9, xrefs: 00FBB5A1
#, xrefs: 00FBAEDE
Date, xrefs: 00FBAF7A
WixBundleManufacturer, xrefs: 00FBB539
WixBundleAction, xrefs: 00FBB4C1
$, xrefs: 00FBB484
WixBundleActiveParent, xrefs: 00FBB512
WixBundleInstalled, xrefs: 00FBB4F3
InstallerVersion, xrefs: 00FBB03C
WixBundleProviderKey, xrefs: 00FBB528
WixBundleVersion, xrefs: 00FBB55E
WixBundleForcedRestartPackage, xrefs: 00FBB4E3
', xrefs: 00FBB0AF
WixBundleTag, xrefs: 00FBB54A
InstallerName, xrefs: 00FBB021
WixBundleElevated, xrefs: 00FBB504
0, xrefs: 00FBAE91
LogonUser, xrefs: 00FBB07E
Failed to add built-in variable: %ls., xrefs: 00FBB5AF

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$9$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleManufacturer$WixBundleProviderKey$WixBundleTag$WixBundleVersion
API String ID: 32694325-3014018290
Opcode ID: 6cf0d29cc39f7ea7ff14451c76bab2418a26f565617f76fe1025a8e9c00b94cc
Instruction ID: 8c6e7de00bbeccdde7c0ef8bc73977f31720549dd3c028fd2cfa42aac93184be
Opcode Fuzzy Hash: 6cf0d29cc39f7ea7ff14451c76bab2418a26f565617f76fe1025a8e9c00b94cc
Instruction Fuzzy Hash: 13127AB5C056689BDB22DF06C9493E9FBB6BF88304F4085D9920C7B625C7B11B89DF81

Function 00FC1380 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 139registryCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 00FC13CA
RegisterClassW.USER32(?), ref: 00FC13F8
GetLastError.KERNEL32 ref: 00FC1403
CreateWindowExW.USER32(00000080,00FF4EE8,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 00FC1473
GetLastError.KERNEL32 ref: 00FC147D
SetEvent.KERNEL32(?), ref: 00FC14C0
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 00FC14FF
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 00FC1524

Strings

WixBurnMessageWindow, xrefs: 00FC13F1, 00FC151F
Failed to register window., xrefs: 00FC1437
Failed to create window., xrefs: 00FC14B1
Unexpected return value from message pump., xrefs: 00FC150C
uithread.cpp, xrefs: 00FC142D, 00FC14A7

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ClassErrorLast$CallbackCreateDispatcherEventRegisterUnregisterUserValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
API String ID: 4252647486-288575659
Opcode ID: 9fb4e1d7dfbd7bee69ae4f11b516e29523cc9ce831b4bd068c72d2222b389154
Instruction ID: e9bbfc4533b1cb33ef947459d560b21a9b216e129122f179c0f5467cd6156a2e
Opcode Fuzzy Hash: 9fb4e1d7dfbd7bee69ae4f11b516e29523cc9ce831b4bd068c72d2222b389154
Instruction Fuzzy Hash: 1C417072A0024AFFDB11CFA0CD86FEEBBB9FF05310F204429E211EA151D774A954AB51

Function 00FB38BE Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 158sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?), ref: 00FB391F
GetLastError.KERNEL32 ref: 00FB3929
Sleep.KERNELBASE(00000064), ref: 00FB394E

Strings

Failed to verify parent pipe: %ls, xrefs: 00FB3994
\\.\pipe\%ls.Cache, xrefs: 00FB39AD
Failed to open companion process with PID: %u, xrefs: 00FB3A77
pipe.cpp, xrefs: 00FB3965, 00FB3A6A
Failed to allocate name of parent cache pipe., xrefs: 00FB39C3
\\.\pipe\%ls, xrefs: 00FB38D0
Failed to allocate name of parent pipe., xrefs: 00FB38E4
Failed to open parent pipe: %ls, xrefs: 00FB3972

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CreateErrorFileLastSleep
String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$pipe.cpp
API String ID: 408151869-645222887
Opcode ID: 9724e6269461c588affc892cfc01d148b59ea39093fe603ff9e345fa58604a07
Instruction ID: 8040680d0b893a9b9bfe199cce772688d5a6c7ff9c9ca8e14a5571c83d425da0
Opcode Fuzzy Hash: 9724e6269461c588affc892cfc01d148b59ea39093fe603ff9e345fa58604a07
Instruction Fuzzy Hash: 89411B36980346BADB219B53CC46FAB7A6AAB80720F310128F554D6190EBBDD640BE51

Function 00FC07C7 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 233COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC07E5

Strings

Failed to read slipstream action., xrefs: 00FC09D2
Failed to read parent hwnd., xrefs: 00FC085D
Failed to read UI level., xrefs: 00FC089F
Failed to read action., xrefs: 00FC0811
elevation.cpp, xrefs: 00FC08F0, 00FC0960
Failed to execute MSI package., xrefs: 00FC0A1D
Failed to read rollback flag., xrefs: 00FC09F2
Failed to allocate memory for feature actions., xrefs: 00FC08FA
Failed to read feature action., xrefs: 00FC0974
Failed to allocate memory for slipstream patch actions., xrefs: 00FC096A
Failed to read variables., xrefs: 00FC09CB
Failed to read package log., xrefs: 00FC087E
Failed to find package: %ls, xrefs: 00FC0833

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset
String ID: Failed to allocate memory for feature actions.$Failed to allocate memory for slipstream patch actions.$Failed to execute MSI package.$Failed to find package: %ls$Failed to read UI level.$Failed to read action.$Failed to read feature action.$Failed to read package log.$Failed to read parent hwnd.$Failed to read rollback flag.$Failed to read slipstream action.$Failed to read variables.$elevation.cpp
API String ID: 2102423945-2584093861
Opcode ID: 08821dbb9e8a0e4f47a947283d0836a30d6e7a5da524efd0f11719d9f2971ad7
Instruction ID: 0dd01482d64856c6bc7aab4aee89665ac95219525ee5f6cc40fb3588385ae739
Opcode Fuzzy Hash: 08821dbb9e8a0e4f47a947283d0836a30d6e7a5da524efd0f11719d9f2971ad7
Instruction Fuzzy Hash: B9718132D0011EFEDB11EF94CE82EEEB7B8AF44350F100166F615A7151EA759E42BBA1

Function 00FBD76D Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 200COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FBD788

Strings

Failed to open attached UX container., xrefs: 00FBD879
Failed to extract bootstrapper application payloads., xrefs: 00FBD94E
Failed to get manifest stream from container., xrefs: 00FBD8B7
Failed to open manifest stream., xrefs: 00FBD896
Failed to load catalog files., xrefs: 00FBD96E
Failed to get unique temporary folder for bootstrapper application., xrefs: 00FBD92D
Failed to load manifest., xrefs: 00FBD8D3
Failed to overwrite the %ls built-in variable., xrefs: 00FBD853
WixBundleElevated, xrefs: 00FBD83A, 00FBD83F, 00FBD852
WixBundleOriginalSource, xrefs: 00FBD8EE
Failed to parse command line., xrefs: 00FBD807
Failed to set original source variable., xrefs: 00FBD8FF
Failed to initialize variables., xrefs: 00FBD825

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$WixBundleElevated$WixBundleOriginalSource
API String ID: 2102423945-1257586656
Opcode ID: 1222cc6844566c88e47acd893cdba91081a7068fcca1a8a178cd6642bd1de8dc
Instruction ID: 43be46b706b46d1e2a9cea301fb36f5274d9c2abbf7772ac3df465e6d0f52f06
Opcode Fuzzy Hash: 1222cc6844566c88e47acd893cdba91081a7068fcca1a8a178cd6642bd1de8dc
Instruction Fuzzy Hash: FB6170B3900A09AACB12DAA1CC81FEF73BDAF44750F14442AF21AD3140FF74E645AB52

Function 00FE56D9 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 151libraryloadercomCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00000000,?,?,00FE58C1,00000000,?,00000000), ref: 00FE56F7
GetLastError.KERNEL32(?,?,00FE58C1,00000000,?,00000000,?,?,?,?,?,?,?,?,00FD3EC5,00FB2222), ref: 00FE5703
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00FE5767
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00FE5773
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 00FE577D
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00FE5788
CoCreateInstance.OLE32(01007EF8,00000000,00000001,00FEBCE0,?,?,?,00FE58C1,00000000,?,00000000), ref: 00FE57C2
ExitProcess.KERNEL32 ref: 00FE5877

Strings

Wow64EnableWow64FsRedirection, xrefs: 00FE5775
IsWow64Process, xrefs: 00FE5761
Wow64DisableWow64FsRedirection, xrefs: 00FE576D
Wow64RevertWow64FsRedirection, xrefs: 00FE577F
kernel32.dll, xrefs: 00FE56E3
xmlutil.cpp, xrefs: 00FE572D

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
API String ID: 2124981135-499589564
Opcode ID: 593ecc8f6965104dda008b6851bc01755702dc6d4f625e7b66fed922daeaf432
Instruction ID: 7f7051c8fb09b2305baf6bffe12e53da53f316bc9167ab727287e67e831991ff
Opcode Fuzzy Hash: 593ecc8f6965104dda008b6851bc01755702dc6d4f625e7b66fed922daeaf432
Instruction Fuzzy Hash: 46516031E0025EEBEB119FA6CC44BAE7BB8AF04B25F104569E514EB181E774CA40EB90

Function 00FB157C Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 147synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00FB174B
CloseHandle.KERNEL32(00000000,?,?,?,00FB1DEA,?,?), ref: 00FB1754

Part of subcall function 00FB28E3: UuidCreate.RPCRT4(?), ref: 00FB291A
Part of subcall function 00FB28E3: StringFromGUID2.OLE32(?,?,00000027), ref: 00FB292D

Strings

Failed to create the message window., xrefs: 00FB16A1
Failed to pump messages from parent process., xrefs: 00FB171D
Failed to set elevated pipe into thread local storage for logging., xrefs: 00FB1688
Failed to create implicit elevated connection name and secret., xrefs: 00FB15AD
Failed to launch unelevated process., xrefs: 00FB15D6
Failed to connect to unelevated process., xrefs: 00FB15F4
Failed to allocate thread local storage for logging., xrefs: 00FB163E
engine.cpp, xrefs: 00FB1634, 00FB167E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseCreateFromHandleMutexReleaseStringUuid
String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create implicit elevated connection name and secret.$Failed to create the message window.$Failed to launch unelevated process.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$engine.cpp
API String ID: 3991521885-93479633
Opcode ID: 91715b1c7060da2ea2ab2108a80647fe7e1281d14bdae6129af2e81bd3eefc29
Instruction ID: fe30a6ee5c053fcd856b8425d48a6cf8981cc4b2d5712bad1268b9382add3a81
Opcode Fuzzy Hash: 91715b1c7060da2ea2ab2108a80647fe7e1281d14bdae6129af2e81bd3eefc29
Instruction Fuzzy Hash: C541F973540606AAC7229BA2CC95FDB77AEFF84350F644429F216D6150EF34E904BF61

Function 00FD0A7D Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 136fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,00000000,00000000), ref: 00FD0ACF
GetLastError.KERNEL32 ref: 00FD0AE0
GetCurrentProcess.KERNEL32(00FB1D72,00000000,00000000,00000002,00000000,00000000), ref: 00FD0B29
GetCurrentProcess.KERNEL32(000000FF,00000000), ref: 00FD0B2F
DuplicateHandle.KERNELBASE(00000000), ref: 00FD0B32
GetLastError.KERNEL32 ref: 00FD0B3C
SetFilePointerEx.KERNELBASE(00FB1D72,00FB2142,00FB1D72,00000000,00000000), ref: 00FD0BA3
GetLastError.KERNEL32 ref: 00FD0BAD

Strings

Failed to duplicate handle to container: %ls, xrefs: 00FD0B73
container.cpp, xrefs: 00FD0B0A, 00FD0B66, 00FD0BD7
Failed to open file: %ls, xrefs: 00FD0B17
Failed to open container., xrefs: 00FD0BFE
Failed to move file pointer to container offset., xrefs: 00FD0BE1

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp
API String ID: 2619879409-2168299741
Opcode ID: b45c3528116730f935018de69d0118c193bf205ee0972ae31141f867275eb14f
Instruction ID: 3c0a4cf158cbb736e972ec162653d230f930f8e671a67dd1a06964d912e166c3
Opcode Fuzzy Hash: b45c3528116730f935018de69d0118c193bf205ee0972ae31141f867275eb14f
Instruction Fuzzy Hash: 4A419C71A0060AFFDB209F64CD85B6EBBB6EF04314F14452AF611E62A0D774EA40BB51

Function 00FB9DAB Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 151COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000001,00FB1D56,00000000,00000000,?,00FBA737,00FB2222,00FB1E8E,00000000,00000001), ref: 00FB9DB8

Part of subcall function 00FB8E6B: CompareStringW.KERNEL32(0000007F,00001000,?,000000FF,?,000000FF,?,00000000,00000030,00FB9837,?,00FBADF8,?,00000030,00000000,00000030), ref: 00FB8EA4

LeaveCriticalSection.KERNEL32(00000001,00000008,WixBundleElevated,00000001,00000000,00000000,?,00FBA737,00FB2222,00FB1E8E,00000000,00000001), ref: 00FB9F3A

Strings

Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 00FB9EC0
variable.cpp, xrefs: 00FB9E40
Failed to set value of variable: %ls, xrefs: 00FB9F28
Failed to find variable value '%ls'., xrefs: 00FB9DD6
Failed to insert variable '%ls'., xrefs: 00FB9E08
Setting hidden variable '%ls', xrefs: 00FB9E7F
Setting numeric variable '%ls' to value %lld, xrefs: 00FB9EFF
Attempt to set built-in variable value: %ls, xrefs: 00FB9E4D
WixBundleElevated, xrefs: 00FB9DE9
Setting string variable '%ls' to value '%ls', xrefs: 00FB9EE6
Unsetting variable '%ls', xrefs: 00FB9EDB
Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 00FB9F4E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalSection$CompareEnterLeaveString
String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$WixBundleElevated$variable.cpp
API String ID: 2612025200-3866887438
Opcode ID: 5cca9cf36bdb01ec5073e82e05cfb6d8679e37c721822e4483878fcd1c8ad2de
Instruction ID: 45acd6c8d7154f59ef2688f6a08084ea1752cd692a038adb70aa3122b1c2335e
Opcode Fuzzy Hash: 5cca9cf36bdb01ec5073e82e05cfb6d8679e37c721822e4483878fcd1c8ad2de
Instruction Fuzzy Hash: C251E631908119BBCF219F51CC46EBA7B66EF04760F008119FE099A2A2D7B5DE50FFA1

Function 00FD6374 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,000000FF,?,000000FF), ref: 00FD63A6
GetCurrentProcess.KERNEL32(000000FF,00000000,00000000,00000000), ref: 00FD63BE
GetCurrentProcess.KERNEL32(?,00000000), ref: 00FD63C3
DuplicateHandle.KERNELBASE(00000000), ref: 00FD63C6
GetLastError.KERNEL32 ref: 00FD63D0
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000), ref: 00FD643F
GetLastError.KERNEL32 ref: 00FD644D

Strings

Failed to open cabinet file: %hs, xrefs: 00FD647F
Failed to add virtual file pointer for cab container., xrefs: 00FD641D
cabextract.cpp, xrefs: 00FD63F5, 00FD6472
<the>.cab, xrefs: 00FD639D
Failed to duplicate handle to cab container., xrefs: 00FD63FF

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
API String ID: 3030546534-3446344238
Opcode ID: 85638f32072e4f3f0e224049586adf3b4be0823d5336ae07dd84049737a27c20
Instruction ID: 472723f639015a90def920e18bf651ca76c6410b7d7b399d48bad13df29a0e76
Opcode Fuzzy Hash: 85638f32072e4f3f0e224049586adf3b4be0823d5336ae07dd84049737a27c20
Instruction Fuzzy Hash: 33310672A0011ABBD7209F64DC85EAA7B69EF01374F240325F620E72E0D7699C00B695

Function 00FD6ACF Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 105COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00FB1D72,00000000,00FB2142,00FB1D72,00000000,?,00FD0BF7,00FB1D72,?), ref: 00FD6B06
GetLastError.KERNEL32(?,00FD0BF7,00FB1D72,?), ref: 00FD6B0F

Strings

Failed to create operation complete event., xrefs: 00FD6B85
Failed to wait for operation complete., xrefs: 00FD6BE4
Failed to copy file name., xrefs: 00FD6AF1
cabextract.cpp, xrefs: 00FD6B34, 00FD6B7B, 00FD6BC8
Failed to create extraction thread., xrefs: 00FD6BD2
Failed to create begin operation event., xrefs: 00FD6B3E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp
API String ID: 545576003-1680384675
Opcode ID: e59c5696913960e00c35a1aa972666b2d95272d415d1c181ecf3737814136fcd
Instruction ID: f7418538083425332e242b158ed72824f6b4f5a573e97266797a35de9c3df8f4
Opcode Fuzzy Hash: e59c5696913960e00c35a1aa972666b2d95272d415d1c181ecf3737814136fcd
Instruction Fuzzy Hash: DF210E7264430A79D3202A218CC6E3B369EDFC0764B1D093BF202D7291D979DC497626

Function 00FB9C16 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FB9D2A
_memset.LIBCMT ref: 00FB9D39

Strings

Overflow while dealing with variable array buffer allocation, xrefs: 00FB9CF0
Overflow while calculating size of variable array buffer, xrefs: 00FB9C91
Failed to copy variable name., xrefs: 00FB9D5C
variable.cpp, xrefs: 00FB9C4A, 00FB9C87, 00FB9CB7, 00FB9CE3, 00FB9D94
Failed to allocate room for variables., xrefs: 00FB9DA1
Overflow while growing variable array size, xrefs: 00FB9C54
Failed to allocate room for more variables., xrefs: 00FB9CC4

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memmove_memset
String ID: Failed to allocate room for more variables.$Failed to allocate room for variables.$Failed to copy variable name.$Overflow while calculating size of variable array buffer$Overflow while dealing with variable array buffer allocation$Overflow while growing variable array size$variable.cpp
API String ID: 3555123492-2816863117
Opcode ID: fdfd7ff255196fb4ead5cc21e98c54d9ec992de32d1177601ffd26c56fa6fb9b
Instruction ID: 5f2f9d4a29d82bbe17cfda4efcd35142385b8163a9b39f4c96d14b8b69a24493
Opcode Fuzzy Hash: fdfd7ff255196fb4ead5cc21e98c54d9ec992de32d1177601ffd26c56fa6fb9b
Instruction Fuzzy Hash: F9412AB1B44305BBE7209B62CC03FAE77ADAF44754F10451AF341EA1C1EAB8E900BA58

Function 00FC7D7A Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 126COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC7DA8
LocalFree.KERNEL32(?,?,00000001,80000005,?,00000000,?,00000000,00000003,000007D0), ref: 00FC7EE2

Strings

Failed to create ACL to secure cache path: %ls, xrefs: 00FC7E8F
cache.cpp, xrefs: 00FC7E7F
Failed to allocate access for Users group to path: %ls, xrefs: 00FC7E3D
Failed to allocate access for Everyone group to path: %ls, xrefs: 00FC7E1C
Failed to secure cache path: %ls, xrefs: 00FC7EC6
Failed to allocate access for SYSTEM group to path: %ls, xrefs: 00FC7DF6
Failed to allocate access for Administrators group to path: %ls, xrefs: 00FC7DD5

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: FreeLocal_memset
String ID: Failed to allocate access for Administrators group to path: %ls$Failed to allocate access for Everyone group to path: %ls$Failed to allocate access for SYSTEM group to path: %ls$Failed to allocate access for Users group to path: %ls$Failed to create ACL to secure cache path: %ls$Failed to secure cache path: %ls$cache.cpp
API String ID: 3302596199-4113288589
Opcode ID: 6813cde4ac5de264a688f97d4e751e8fca43a1dad19894c4df0055b581355376
Instruction ID: 0332201bdce9b0337b03ff6d4dc16211b19ff6b56587b66a832b6d1175e2b519
Opcode Fuzzy Hash: 6813cde4ac5de264a688f97d4e751e8fca43a1dad19894c4df0055b581355376
Instruction Fuzzy Hash: C741C373E0432AAADF20BA508D82FEAB675AF04740F4180A9F745B7090DE754D85BF91

Function 00FC1534 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 100threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,?,?,?,00FB1E12,?), ref: 00FC1556
GetLastError.KERNEL32(?,?,00FB1E12,?), ref: 00FC1563
CreateThread.KERNELBASE(00000000,00000000,Function_00011380,?,00000000,00000000), ref: 00FC15B7
GetLastError.KERNEL32(?,?,00FB1E12,?), ref: 00FC15C4
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,00FB1E12,?), ref: 00FC160F
CloseHandle.KERNEL32(00000001,?,?,00FB1E12,?), ref: 00FC162F
CloseHandle.KERNELBASE(?,?,?,00FB1E12,?), ref: 00FC163C

Strings

Failed to create the UI thread., xrefs: 00FC15F5
Failed to create initialization event., xrefs: 00FC1594
uithread.cpp, xrefs: 00FC158A, 00FC15EB

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
API String ID: 2351989216-3599963359
Opcode ID: b65065731ffd461913ccf8ccb3a85ef6da0f5beb54386e21c41ec076bcb3ef36
Instruction ID: 53208f0034be938a95c1bb00bd1c03bb1470dfc078480566b4450f038cc54846
Opcode Fuzzy Hash: b65065731ffd461913ccf8ccb3a85ef6da0f5beb54386e21c41ec076bcb3ef36
Instruction Fuzzy Hash: 673180B2D0020AFFDB109F98CD86AAEBBB8FB05310F20446AE211F6151D7749A54AB51

Function 00FC8E97 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 155COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC8EF1

Part of subcall function 00FE5C4F: SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,?,00FC81A9,?,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00FE5C65
Part of subcall function 00FE5C4F: GetLastError.KERNEL32(?,00FC81A9,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,00FC9C26,00000000,?), ref: 00FE5C6F

Strings

Failed to get signer chain from authenticode certificate., xrefs: 00FC902D
Failed to get provider state from authenticode certificate., xrefs: 00FC8FEA
cache.cpp, xrefs: 00FC8F8D, 00FC8FE0, 00FC9023
Failed to move file pointer to beginning of file., xrefs: 00FC8F09
Failed to verify expected payload against actual certificate chain., xrefs: 00FC9045
Failed authenticode verification of payload: %ls, xrefs: 00FC8F9A

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLastPointer_memset
String ID: Failed authenticode verification of payload: %ls$Failed to get provider state from authenticode certificate.$Failed to get signer chain from authenticode certificate.$Failed to move file pointer to beginning of file.$Failed to verify expected payload against actual certificate chain.$cache.cpp
API String ID: 3998764941-4294895434
Opcode ID: 508170383ea92fd2ddb07fa278c26e341979e2a4cdc1dee5d719880ab6a0cca6
Instruction ID: 6b1f6543557a3c78ab5446802375f877628a8dfcb83772b36905f70ee5378550
Opcode Fuzzy Hash: 508170383ea92fd2ddb07fa278c26e341979e2a4cdc1dee5d719880ab6a0cca6
Instruction Fuzzy Hash: 55412972D4021AAAC721DBA9CD46FDFBBB9EF05360F10012AF515F7290DA78C901E7A1

Function 00FBA7DA Relevance: 15.1, APIs: 2, Strings: 8, Instructions: 139COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,000000F9,00000001,00000000,000000F9,00000031,000000F9,00000105,00000000,?,?,?), ref: 00FBA7F8
LeaveCriticalSection.KERNEL32(00000000), ref: 00FBA929

Strings

Failed to read variable included flag., xrefs: 00FBA8FD
Failed to read variable count., xrefs: 00FBA817
Failed to read variable name., xrefs: 00FBA904
Failed to set variable., xrefs: 00FBA919
Failed to read variable value as string., xrefs: 00FBA8EA
Unsupported variable type., xrefs: 00FBA8F6
Failed to read variable value type., xrefs: 00FBA90B
Failed to read variable value as number., xrefs: 00FBA912

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to read variable count.$Failed to read variable included flag.$Failed to read variable name.$Failed to read variable value as number.$Failed to read variable value as string.$Failed to read variable value type.$Failed to set variable.$Unsupported variable type.
API String ID: 3168844106-1201737872
Opcode ID: bf602ac8d19c789c4a09ee86200a3b2b3090900a60475e78d5b0727de89ad27f
Instruction ID: 00893f48637c4e408026aead23cd198bfa1f1adf44d55f0d6ff897fb5f02ff54
Opcode Fuzzy Hash: bf602ac8d19c789c4a09ee86200a3b2b3090900a60475e78d5b0727de89ad27f
Instruction Fuzzy Hash: 1A41603290065EFBDB129E66CC45EFE7B79EB40750F118121F900A6161D734DE51BEA2

Function 00FB3006 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 120fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,?,00000008,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00FB3034
GetLastError.KERNEL32(?,?,?,00000000), ref: 00FB303E
ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,?,?,00000000), ref: 00FB30EB
GetLastError.KERNEL32(?,?,?,00000000), ref: 00FB30F5

Strings

Failed to allocate data for message., xrefs: 00FB30AE
pipe.cpp, xrefs: 00FB30A1, 00FB30CE, 00FB311F
Failed to read data for message., xrefs: 00FB3129
Failed to read message from pipe., xrefs: 00FB30D8

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$pipe.cpp
API String ID: 1948546556-3912962418
Opcode ID: cb4a70fd1897b7a4d264b344c69eba7be78f67b70a5c14282f1f2c784a07023b
Instruction ID: 1df25357f6a3af769c38fe8616168cc9f4eff79eeaceff309c41373aa30b3b99
Opcode Fuzzy Hash: cb4a70fd1897b7a4d264b344c69eba7be78f67b70a5c14282f1f2c784a07023b
Instruction Fuzzy Hash: 6441C272E80259FADB11EFA6CC85BEEBB78EF00750F104465E901EA151D378CB40BB91

Function 00FC959B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,?,?,00FC9C26,00000000,?,?,00000000,?), ref: 00FC95B5
GetLastError.KERNEL32(?,?,00FC9C26,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 00FC95C3

Part of subcall function 00FC828F: _memset.LIBCMT ref: 00FC82B9

CloseHandle.KERNEL32(000000FF,?,?,00FC9C26,00000000,?,?,00000000,?,?,00000000,00000000), ref: 00FC968F

Strings

Failed to verify catalog signature of payload: %ls, xrefs: 00FC9653
cache.cpp, xrefs: 00FC95FB
Failed to verify signature of payload: %ls, xrefs: 00FC9632
Failed to open payload at path: %ls, xrefs: 00FC9608
Failed to verify hash of payload: %ls, xrefs: 00FC9678

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast_memset
String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$cache.cpp
API String ID: 1470872789-2757871984
Opcode ID: e5eaf1a2fa79ceafa32585677d7facdd36d7697dd66c4fe8fb2e5ac85d531bbd
Instruction ID: 6f143b8272cd85ad72358ab36e8d81283b36d7f40a0a046df6b62929ff313d94
Opcode Fuzzy Hash: e5eaf1a2fa79ceafa32585677d7facdd36d7697dd66c4fe8fb2e5ac85d531bbd
Instruction Fuzzy Hash: FD212632A04207BBCB225A54CE0FF6E3A76AFC1760F20011CFA159A1E0DBB5D541FB55

Function 00FC0E43 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 00FC0E59
GetLastError.KERNEL32 ref: 00FC0E63
CoInitializeEx.OLE32(00000000,00000000), ref: 00FC0EA5
CoUninitialize.OLE32(?,00FC0350,?,?), ref: 00FC0EE2

Strings

elevation.cpp, xrefs: 00FC0E88
Failed to pump messages in child process., xrefs: 00FC0ED0
Failed to set elevated cache pipe into thread local storage for logging., xrefs: 00FC0E92
Failed to initialize COM., xrefs: 00FC0EB1

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorInitializeLastUninitializeValue
String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$elevation.cpp
API String ID: 876858697-113251691
Opcode ID: c4baecd002ace7d484e33015191855fc7c88c996bbce0f0d7d8ceaa664833684
Instruction ID: a13bc3a72e966d6b73a5d8495be8a69733cdf2fdc67e99cf6b5c7afbef3896d3
Opcode Fuzzy Hash: c4baecd002ace7d484e33015191855fc7c88c996bbce0f0d7d8ceaa664833684
Instruction Fuzzy Hash: B4119433A8066BBBD3115655DD07F9B7B64AF00B61F100129FA00AA1A1EFA5E901B6D5

Function 00FB7203 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 133registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000000,?,?,00020006,00000000,00000000,00000000,?,00000000,00000001), ref: 00FB7333
RegCloseKey.ADVAPI32(00000001,00000000,00000000,?,?,00020006,00000000,00000000,00000000,?,00000000,00000001), ref: 00FB7340

Part of subcall function 00FE3D2A: RegCreateKeyExW.KERNELBASE(00000001,00000000,00000000,00000000,00000000,00000001,00FB13BB,?,?,00000001,?,00FB727D,?,00FB13BB,00020006,00000001), ref: 00FE3D4E

Strings

Failed to open registration key., xrefs: 00FB7371
%ls.RebootRequired, xrefs: 00FB7257
Failed to delete registration key: %ls, xrefs: 00FB72E3
Failed to write volatile reboot required registry key., xrefs: 00FB7281
Failed to update resume mode., xrefs: 00FB7318

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Close$Create
String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.
API String ID: 359002179-2517785395
Opcode ID: cff483700d514dd18ec28b5adfbd53ceb934d620427e31aa5808e798ac08cb69
Instruction ID: d2ca37deb80e02634a13459e7f736be73f6c9912abcedaec3497319366386d7e
Opcode Fuzzy Hash: cff483700d514dd18ec28b5adfbd53ceb934d620427e31aa5808e798ac08cb69
Instruction Fuzzy Hash: D9414A72D04349BFCF217EA2DC86DAEBBBAEF84314B14442DF501A2012D6799A50BF51

Function 00FE05E9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE0600
CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00FB2A9B,?,?,?,?,00000000,00000000), ref: 00FE0657
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 00FE0661
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 00FE06AB
CloseHandle.KERNEL32(00FB2A9B,?,?,?,?,00000000,00000000,00000000), ref: 00FE06B8

Strings

procutil.cpp, xrefs: 00FE0686
"%ls" %ls, xrefs: 00FE0624

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcess_memset
String ID: "%ls" %ls$procutil.cpp
API String ID: 1393943095-4145822745
Opcode ID: 8107332f452ec306603070c87a19b3aa10335c5e519cc59a75a4e3bdfae2392f
Instruction ID: 8409183fb6b9e7d859cca446bf6ebf7e98bedab9609c0afe703e84ea03b8adeb
Opcode Fuzzy Hash: 8107332f452ec306603070c87a19b3aa10335c5e519cc59a75a4e3bdfae2392f
Instruction Fuzzy Hash: C0216F71D0028AABDB11DFE6CC85AEF7B79EB44314F14043AE601E6110DB748E54EBA2

Function 00FB2A21 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?), ref: 00FB2A35

Part of subcall function 00FE202C: GetModuleFileNameW.KERNEL32(00FB213E,?,00000104,?,00000104,?,00000000,?,?,00FB213E,?,00000000,?,?,?,76EEC3F0), ref: 00FE204D

CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,00000000), ref: 00FB2ABA

Part of subcall function 00FE05E9: _memset.LIBCMT ref: 00FE0600
Part of subcall function 00FE05E9: CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00FB2A9B,?,?,?,?,00000000,00000000), ref: 00FE0657
Part of subcall function 00FE05E9: GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 00FE0661
Part of subcall function 00FE05E9: CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 00FE06AB
Part of subcall function 00FE05E9: CloseHandle.KERNEL32(00FB2A9B,?,?,?,?,00000000,00000000,00000000), ref: 00FE06B8

Strings

Failed to get current process path., xrefs: 00FB2A4D
Failed to launch parent process with unelevate disabled: %ls, xrefs: 00FB2AA4
Failed to allocate parameters for elevated process., xrefs: 00FB2A7A
%ls -%ls %ls %ls %u, xrefs: 00FB2A66
burn.unelevated, xrefs: 00FB2A5E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseHandle$Process$CreateCurrentErrorFileLastModuleName_memset
String ID: %ls -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to get current process path.$Failed to launch parent process with unelevate disabled: %ls$burn.unelevated
API String ID: 1951228193-688900554
Opcode ID: 86e62961c2b95e747e2f54e08a25f3f6465384c14977ca7612e5c368263972e1
Instruction ID: abd344d92b482e8c174d06427f47f9bf08ab837b8ec841b271e609cd5b2d29dd
Opcode Fuzzy Hash: 86e62961c2b95e747e2f54e08a25f3f6465384c14977ca7612e5c368263972e1
Instruction Fuzzy Hash: 82216F32D40248FACF21AFE69C428DEFBB8AF50350B104162F910B2111E7794A91BF91

Function 00FBE8AC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,00FC123F,00000000,?,00FC0EF0,?,00000000,?,?,?,00FB1DEA,?), ref: 00FBE8BE
GetLastError.KERNEL32(?,?,00FC123F,00000000,?,00FC0EF0,?,00000000,?,?,?,00FB1DEA,?,?), ref: 00FBE8C8
GetExitCodeThread.KERNELBASE(?,?,?,?,00FC123F,00000000,?,00FC0EF0,?,00000000,?,?,?,00FB1DEA,?,?), ref: 00FBE905
GetLastError.KERNEL32(?,?,00FC123F,00000000,?,00FC0EF0,?,00000000,?,?,?,00FB1DEA,?,?), ref: 00FBE90F

Strings

Failed to wait for cache thread to terminate., xrefs: 00FBE8F7
elevation.cpp, xrefs: 00FBE8ED, 00FBE934
Failed to get cache thread exit code., xrefs: 00FBE93E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$elevation.cpp
API String ID: 3686190907-1954264426
Opcode ID: f87ec72afd19bdcf0889126e9ab0c310cfe9e6aea964e9dcd0219282f2650d3c
Instruction ID: d00a2bb1b6f4e2fbc9c9ffd080035e190dcaae9cee2dd7b576758068454fbd5a
Opcode Fuzzy Hash: f87ec72afd19bdcf0889126e9ab0c310cfe9e6aea964e9dcd0219282f2650d3c
Instruction Fuzzy Hash: 8501F972B4462677973167628C46FEB3A589F00BF1B050134BA04E9191E76CDE04F6D9

Function 00FE41F9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 111stringregistryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(F08B8007,057CF33B,BundleUpgradeCode,00FB13BB,00000000,00000000,F08B8007,057CF33B,00020006,00000000,?,?,C5330100), ref: 00FE4236
lstrlenW.KERNEL32(F08B8007,00020006,00000001,F08B8007,00020006,00000001,BundleUpgradeCode,00FB13BB,00000000), ref: 00FE4297
lstrlenW.KERNEL32(F08B8007), ref: 00FE429E
RegSetValueExW.KERNELBASE(00020006,00000000,00000000,00000007,00020006,00000000,00000001,00000000,00000000,00020006,00000001,BundleUpgradeCode,00FB13BB,00000000), ref: 00FE42DA

Strings

BundleUpgradeCode, xrefs: 00FE4201
regutil.cpp, xrefs: 00FE4306

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: lstrlen$Value
String ID: BundleUpgradeCode$regutil.cpp
API String ID: 198323757-1648651458
Opcode ID: b0d64f52f0828e2d37a145b85d9513fb09176e23748e718e9b9e652b267094fb
Instruction ID: 958cbdf9946033c792453294471f961ef6cd845025825b4f349fde961785c848
Opcode Fuzzy Hash: b0d64f52f0828e2d37a145b85d9513fb09176e23748e718e9b9e652b267094fb
Instruction Fuzzy Hash: 7E414C71D0024AEFDF01DF96CD81AAE7BB9FF44354F10446AEA10A7251D774EA50AFA0

Function 00FC113C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 111threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00010E43,?,00000000,00000000), ref: 00FC11C5
GetLastError.KERNEL32(?,?,?,00FB1DEA,?,?), ref: 00FC11D1

Part of subcall function 00FBE8AC: WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,00FC123F,00000000,?,00FC0EF0,?,00000000,?,?,?,00FB1DEA,?), ref: 00FBE8BE
Part of subcall function 00FBE8AC: GetLastError.KERNEL32(?,?,00FC123F,00000000,?,00FC0EF0,?,00000000,?,?,?,00FB1DEA,?,?), ref: 00FBE8C8

CloseHandle.KERNEL32(00000000,00000000,?,00FC0EF0,?,00000000,?,?,?,00FB1DEA,?,?), ref: 00FC1250

Strings

elevation.cpp, xrefs: 00FC11F6
Failed to pump messages in child process., xrefs: 00FC122A
Failed to create elevated cache thread., xrefs: 00FC1200

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleObjectSingleThreadWait
String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$elevation.cpp
API String ID: 3606931770-4134175193
Opcode ID: ef5275752acfe2cd451d8d2ddd40637ed684d06e0f119df7bdd1b795f319dd4e
Instruction ID: ec9a715a9686b150ddd568bf58374815ff3f06f72eaab46994f66db0d0bac6cd
Opcode Fuzzy Hash: ef5275752acfe2cd451d8d2ddd40637ed684d06e0f119df7bdd1b795f319dd4e
Instruction Fuzzy Hash: 6B415675A0021EAFCB00DF99D8819EEBBF9FF49710F10402AF904E7351D778A9419BA0

Function 00FCCBA8 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00FCCC0A

Strings

Failed to escape string., xrefs: 00FCCC71
Failed to append property string part., xrefs: 00FCCC7F
Failed to format property value., xrefs: 00FCCC6A
%s%="%s", xrefs: 00FCCC30
Failed to format property string part., xrefs: 00FCCC78

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Open@16
String ID: %s%="%s"$Failed to append property string part.$Failed to escape string.$Failed to format property string part.$Failed to format property value.
API String ID: 3613110473-515423128
Opcode ID: 36cc7127ea313448ca97331d734e0fae1bf219f280721ac9d634fc4bebd8aea7
Instruction ID: 7ef0bb0ef4d1c1f7dbcf50fe9cb5c502c830d005765f00d8e6641e5b1a8415ea
Opcode Fuzzy Hash: 36cc7127ea313448ca97331d734e0fae1bf219f280721ac9d634fc4bebd8aea7
Instruction Fuzzy Hash: C4314A72D0029AABCF10EF95CE82EAEB7B4BE00310B14416EE519A2111D7759E91FB92

Function 00FBF457 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FBF46E

Strings

Failed to read bundle dependency key from message buffer., xrefs: 00FBF4B9
Failed to execute package dependency action., xrefs: 00FBF532
Failed to read package id from message buffer., xrefs: 00FBF496
Failed to read action., xrefs: 00FBF4D9
Failed to find package: %ls, xrefs: 00FBF511

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset
String ID: Failed to execute package dependency action.$Failed to find package: %ls$Failed to read action.$Failed to read bundle dependency key from message buffer.$Failed to read package id from message buffer.
API String ID: 2102423945-4197210911
Opcode ID: 8d8ffe6c95bfc50f906b552e5b58c5521b64513558412c253661e80db6b6bbd2
Instruction ID: 0b4d75fdf54c53f0fac2732ca31c690a8fcc724fad708613ee3a1080ab4b988f
Opcode Fuzzy Hash: 8d8ffe6c95bfc50f906b552e5b58c5521b64513558412c253661e80db6b6bbd2
Instruction Fuzzy Hash: AF314B72D0016DBBCF12EE95DC42EEEBA78AF04760F140061F901B6191EB75DB58BBA1

Function 00FE04B3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,00000000,76EEC3F0,?,00000000), ref: 00FE04D5
GetLastError.KERNEL32 ref: 00FE04DF
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00FE0512
GetLastError.KERNEL32 ref: 00FE052B
CloseHandle.KERNELBASE(00000000), ref: 00FE056B

Strings

procutil.cpp, xrefs: 00FE0559

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLastToken$CloseHandleInformationOpenProcess
String ID: procutil.cpp
API String ID: 4040495316-1178289305
Opcode ID: a2b41c35550ab643507ab550193beda6f7b886238061a5088836dac4f008be6a
Instruction ID: 77d4dcf982899ab9afef2e5ad2299b349c5e0e77bd079a6cfc9c7897d242e812
Opcode Fuzzy Hash: a2b41c35550ab643507ab550193beda6f7b886238061a5088836dac4f008be6a
Instruction Fuzzy Hash: D321C972E40259EFDB20DFA6DCC5AAFBB78EB04320F154435F611EA050D6B49E84BB90

Function 00FC7C65 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

InitializeAcl.ADVAPI32(00000000,00000008,00000002,0000001A,00000000,00000000,00000000,00000000,00000000), ref: 00FC7CA3
GetLastError.KERNEL32 ref: 00FC7CAD
SetFileAttributesW.KERNELBASE(00000000,00000080,00000000,00000001,20000004,00000000,00000000,00000000,00000000,00000003,000007D0,00000000,00000000,00000000,00000000), ref: 00FC7D15

Strings

Failed to initialize ACL., xrefs: 00FC7CDC
Failed to allocate administrator SID., xrefs: 00FC7C94
cache.cpp, xrefs: 00FC7CD2

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: AttributesErrorFileInitializeLast
String ID: Failed to allocate administrator SID.$Failed to initialize ACL.$cache.cpp
API String ID: 669721577-1117388985
Opcode ID: 6721dde097aa35e3a515abd6c9c3e8bf6989a30344927ed763ef27bed4831235
Instruction ID: 8f11dfe28ee1de80f0839df724ddb746a83e03ccd51051c276471c426a58140a
Opcode Fuzzy Hash: 6721dde097aa35e3a515abd6c9c3e8bf6989a30344927ed763ef27bed4831235
Instruction Fuzzy Hash: 3411E032E44306BAEB21B755CD47FAFB769AF40750F104165F605FA0D0E6788E40BB91

Function 00FE360E Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE303C: _memset.LIBCMT ref: 00FE3063
Part of subcall function 00FE303C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00FE3078
Part of subcall function 00FE303C: LoadLibraryW.KERNELBASE(?,?,00000104,00FB1C3B), ref: 00FE30C6
Part of subcall function 00FE303C: GetLastError.KERNEL32 ref: 00FE30D2

GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 00FE3639
GetLastError.KERNEL32(?,00FB16AF,00000001,00000000,?,?,?,?,00FB1DEA,?,?), ref: 00FE3648

Strings

srputil.cpp, xrefs: 00FE366A
`Den, xrefs: 00FE363F
srclient.dll, xrefs: 00FE3617
SRSetRestorePointW, xrefs: 00FE362E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$AddressDirectoryLibraryLoadProcSystem_memset
String ID: SRSetRestorePointW$`Den$srclient.dll$srputil.cpp
API String ID: 2131201312-1484873585
Opcode ID: c6404cac5942001a81c0dde126638b396012adfe88b101844eba18d29ebabfe1
Instruction ID: 35f461282f4ed10fd23055f0efb6a4673fc7f1cfb2f51f3cebd7daa762b00e8f
Opcode Fuzzy Hash: c6404cac5942001a81c0dde126638b396012adfe88b101844eba18d29ebabfe1
Instruction Fuzzy Hash: 5C01F232E412E2B6D73213B78C0DF163A145B047A0F020138AA84AF390DA6EDD00BA91

Function 00FE53D2 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00FE53E1
InterlockedIncrement.KERNEL32(01007F08), ref: 00FE53FE
CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,01007EF8), ref: 00FE5419
CLSIDFromProgID.OLE32(MSXML.DOMDocument,01007EF8), ref: 00FE5425

Strings

Msxml2.DOMDocument, xrefs: 00FE5414
MSXML.DOMDocument, xrefs: 00FE5420

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: e5d2a064dcc96a10abb44bc1b2e958aa369738a53df8c8d758e7b89b523b5fe8
Instruction ID: 04b4b9140f058d3f3c577ff47320e967449db3b9f631ae6b8ae24b0bcfeb2eb7
Opcode Fuzzy Hash: e5d2a064dcc96a10abb44bc1b2e958aa369738a53df8c8d758e7b89b523b5fe8
Instruction Fuzzy Hash: FDF0A7347406B65BE3229767AC48B1B3965D7C0F66F10042DE990C54D4D799D8C196B0

Function 00FC12A0 Relevance: 9.1, APIs: 6, Instructions: 84windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 00FC12CB
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00FC12DA
SetWindowLongW.USER32(?,000000EB,?), ref: 00FC12EE
DefWindowProcW.USER32(?,?,?,?), ref: 00FC12FE
GetWindowLongW.USER32(?,000000EB), ref: 00FC1318
PostQuitMessage.USER32(00000000), ref: 00FC1373

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: 25ccb204e241c2d9b5c55c2730222b63cf92d1f6819f8af52d5c96dfab2def57
Instruction ID: 705a4c1449c1c8b47aa890f619503aa93ffdbee4f29c2afeab67163c345d9ea3
Opcode Fuzzy Hash: 25ccb204e241c2d9b5c55c2730222b63cf92d1f6819f8af52d5c96dfab2def57
Instruction Fuzzy Hash: CA21C53250420ABFDB119F64DE8AF6B3B66FF46325F148618F9169A1B6C7318D20FB50

Function 00FC0EF0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 161synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(?), ref: 00FC0F47
CloseHandle.KERNEL32(?), ref: 00FC0F4F

Strings

elevation.cpp, xrefs: 00FC10CD
Unexpected elevated message sent to child process, msg: %u, xrefs: 00FC10DC
Failed to save state., xrefs: 00FC0FB5

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseHandleMutexRelease
String ID: Failed to save state.$Unexpected elevated message sent to child process, msg: %u$elevation.cpp
API String ID: 4207627910-1576875097
Opcode ID: 4ad9aa1f73e7749c86048dbd7b04d84818556d0465dd23e3e31542a0d14bb4bb
Instruction ID: 830fea9861e0e7655bb29a54fa9ca5ea1fd7774a06989645c1dd08e12cb7ec16
Opcode Fuzzy Hash: 4ad9aa1f73e7749c86048dbd7b04d84818556d0465dd23e3e31542a0d14bb4bb
Instruction Fuzzy Hash: A851C77A104606EFCB25AF44CE42E56BBB1FF08320B11C459FA5A5B662CB35E911FF11

Function 00FD6610 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?), ref: 00FD66D3
GetLastError.KERNEL32 ref: 00FD66DD

Strings

Invalid seek type., xrefs: 00FD664C
Failed to move file pointer 0x%x bytes., xrefs: 00FD6714
cabextract.cpp, xrefs: 00FD6707

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
API String ID: 2976181284-417918914
Opcode ID: 9af496648b392fcdf6a6e45cfa58d6eb1ba7dd97020c78926a6f453601845196
Instruction ID: a7d8b1b10ef5112891df314461048747ab7c51a764046056f4fd97463f0d9548
Opcode Fuzzy Hash: 9af496648b392fcdf6a6e45cfa58d6eb1ba7dd97020c78926a6f453601845196
Instruction Fuzzy Hash: 36413E76900209EFCB10DF69C884A9AB7B6FF44364F1981A6E918DB361DB34ED50EF50

Function 00FE607F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

MoveFileExW.KERNELBASE(00000003,00000001,000007D0,?,00000000,?,?,?,00FE61A6,00000003,00000001,00000001,00000000,00000000,00000000), ref: 00FE60AC
GetLastError.KERNEL32(?,?,?,00FE61A6,00000003,00000001,00000001,00000000,00000000,00000000,?,00FC787B,?,00000000,00000001,00000001), ref: 00FE60BA
MoveFileExW.KERNELBASE(00000003,00000001,000007D0,00000001,00000000,?,?,?,00FE61A6,00000003,00000001,00000001,00000000,00000000,00000000), ref: 00FE611E
GetLastError.KERNEL32(?,?,?,00FE61A6,00000003,00000001,00000001,00000000,00000000,00000000,?,00FC787B,?,00000000,00000001,00000001), ref: 00FE6128

Strings

fileutil.cpp, xrefs: 00FE6148

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLastMove
String ID: fileutil.cpp
API String ID: 55378915-2967768451
Opcode ID: 769ad2a61a33bb6098ba7273a023199a9b05e2d7cbd0ecafac8ee31f4cfd77b6
Instruction ID: 0a4d74cc7c46ffebf1196112d94ad1f1d458b9631b3eb33b50cf3941c7dba96c
Opcode Fuzzy Hash: 769ad2a61a33bb6098ba7273a023199a9b05e2d7cbd0ecafac8ee31f4cfd77b6
Instruction Fuzzy Hash: 3621D336A006AEEBDF224A578C41B7F7664EF60BE1F200429F905C6161D738CD51B291

Function 00FE5F4C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(00000000,00000000,00000000,?,?,00000000,?,00FE6059,00000000,00000000,?,?,?,00FC7B9B,00000000,?), ref: 00FE5F66
GetLastError.KERNEL32(?,00FE6059,00000000,00000000,?,?,?,00FC7B9B,00000000,?,00000001,00000003,000007D0,?,?,00FC9CB4), ref: 00FE5F74
CopyFileW.KERNEL32(00000000,00000000,?,00000000,00000000,?,00FE6059,00000000,00000000,?,?,?,00FC7B9B,00000000,?,00000001), ref: 00FE5FD8
GetLastError.KERNEL32(?,00FE6059,00000000,00000000,?,?,?,00FC7B9B,00000000,?,00000001,00000003,000007D0,?,?,00FC9CB4), ref: 00FE5FE2

Strings

fileutil.cpp, xrefs: 00FE6002

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CopyErrorFileLast
String ID: fileutil.cpp
API String ID: 374144340-2967768451
Opcode ID: b5f0755b2a6d1d25a84c57833b3377ebe11ae23a47309e78d56acdbecd9d4028
Instruction ID: f46fd9b5d491e2082d0077f084cdbb948b3b8db0b23db27154dd46fb822171c1
Opcode Fuzzy Hash: b5f0755b2a6d1d25a84c57833b3377ebe11ae23a47309e78d56acdbecd9d4028
Instruction Fuzzy Hash: 2521CC369006EA9BDB224F578C44B3B3E59EFD0BF4B24043AFA54CA151EB35CC41B255

Function 00FD13F4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 79registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE3D9A: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00FE7ABC,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00FE3DAE

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,?,?,?,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,?,?,?,00000000), ref: 00FD1473
RegCloseKey.ADVAPI32(?,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,?,?,?,00000000,?,?,?,?,00000001,00000000), ref: 00FD14BD

Strings

Failed to open uninstall registry key., xrefs: 00FD143C
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00FD1410
Failed to enumerate uninstall key for related bundles., xrefs: 00FD1497

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseCompareOpenString
String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2817536665-2531018330
Opcode ID: 7e81b3a132a9e1d23b11faa446310762e396351e8f279bd27ead01639f3c316f
Instruction ID: 6ed2f326c3dc48e638f76fedf9250d1bd34208099e35fdee43f16fe3ec4f372e
Opcode Fuzzy Hash: 7e81b3a132a9e1d23b11faa446310762e396351e8f279bd27ead01639f3c316f
Instruction Fuzzy Hash: 61219237D00119FBCF21AFD4CC859DDBB76FF06320F29826AE91066250D2755E90B790

Function 00FE6BE2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000003,00000001,00000000,00000001,?,00FE610B,00000001,00000000,?,?,?,00FE61A6,00000003,00000001,00000001,00000000), ref: 00FE6BF0
GetLastError.KERNEL32(?,00FE610B,00000001,00000000,?,?,?,00FE61A6,00000003,00000001,00000001,00000000,00000000,00000000,?,00FC787B), ref: 00FE6BFE

Part of subcall function 00FE6BB7: GetFileAttributesW.KERNEL32(00000003,00000000,?,00FE6C1B,00000003,00000000,?,00FE610B,00000001,00000000,?,?,?,00FE61A6,00000003,00000001), ref: 00FE6BC0

Part of subcall function 00FE6BE2: CreateDirectoryW.KERNELBASE(00000003,00000001,00000000,?,00FE610B,00000001,00000000,?,?,?,00FE61A6,00000003,00000001,00000001,00000000,00000000), ref: 00FE6C79
Part of subcall function 00FE6BE2: GetLastError.KERNEL32(?,00FE610B,00000001,00000000,?,?,?,00FE61A6,00000003,00000001,00000001,00000000,00000000,00000000,?,00FC787B), ref: 00FE6C83

Strings

dirutil.cpp, xrefs: 00FE6C4F

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CreateDirectoryErrorLast$AttributesFile
String ID: dirutil.cpp
API String ID: 925696554-2193988115
Opcode ID: 8c4dc3ae576e768365f579333dfdb6290f536513a906b2ed292c599e3425a0a4
Instruction ID: efc66ea47d305858f7871e59b4a2742f1bc2c828430dbbfc17eabf63075ed9ec
Opcode Fuzzy Hash: 8c4dc3ae576e768365f579333dfdb6290f536513a906b2ed292c599e3425a0a4
Instruction Fuzzy Hash: E91106766102CED6DF201A6B9C45B3B3659EFF43F2F310429F98ACA010E635C841B361

Function 00FD0C17 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FD0C29

Strings

Failed to open attached container., xrefs: 00FD0C95
Failed to get path for executing module., xrefs: 00FD0C77
Failed to get container information for UX container., xrefs: 00FD0C60
WixBundleElevated, xrefs: 00FD0C1D

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset
String ID: Failed to get container information for UX container.$Failed to get path for executing module.$Failed to open attached container.$WixBundleElevated
API String ID: 2102423945-2733515141
Opcode ID: c74b3b88f1102b21652a78fd093d4cdf9c7c5f927ba0689b87bca04798ce9d97
Instruction ID: 584225fe52293154c5951f9d84f6babc834cf88c4c3d06641c4d0d6f449213d2
Opcode Fuzzy Hash: c74b3b88f1102b21652a78fd093d4cdf9c7c5f927ba0689b87bca04798ce9d97
Instruction Fuzzy Hash: B211B172D0011CBACB11EBE5DD41DEEBBB9AA54300F104226F516A7140EA745E01EBA0

Function 00FB1033 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,0000011C), ref: 00FB1057
InitializeCriticalSection.KERNEL32(?,?,0000011C), ref: 00FB1060
GetCurrentProcess.KERNEL32(00000000,?,?,?,0000011C), ref: 00FB107E

Part of subcall function 00FE04B3: OpenProcessToken.ADVAPI32(?,00000008,00000000,76EEC3F0,?,00000000), ref: 00FE04D5
Part of subcall function 00FE04B3: GetLastError.KERNEL32 ref: 00FE04DF
Part of subcall function 00FE04B3: CloseHandle.KERNELBASE(00000000), ref: 00FE056B

Part of subcall function 00FE044D: _memset.LIBCMT ref: 00FE0475

Strings

Failed to initialize engine section., xrefs: 00FB10C9
Failed to verify elevation state., xrefs: 00FB10B0

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalInitializeProcessSection$CloseCurrentErrorHandleLastOpenToken_memset
String ID: Failed to initialize engine section.$Failed to verify elevation state.
API String ID: 3456115775-3203524654
Opcode ID: e8696c3729d9ca188261d8a8c8b37fb796022be3df3910a9968bb5fe7abdc17f
Instruction ID: 692c4579829626a57fc024034934fdddf66c0fe63a85f5d408965cfcac118564
Opcode Fuzzy Hash: e8696c3729d9ca188261d8a8c8b37fb796022be3df3910a9968bb5fe7abdc17f
Instruction Fuzzy Hash: 101182B2900755AAD720A7B6CC06BCB72DCAF01361F14451AE916E7180EA78E940AFA5

Function 00FE3945 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 153registrystringCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,?,?), ref: 00FE396E
RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,?), ref: 00FE39A6
lstrlenW.KERNEL32(00000000,?,00000000,00000000,?,?,00000004,00000000,?,?,?,?,?,00020019,00000000,?), ref: 00FE3AB0

Strings

regutil.cpp, xrefs: 00FE3A19

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: QueryValue$lstrlen
String ID: regutil.cpp
API String ID: 3790715954-955085611
Opcode ID: 3342e08a3ae39ba667975b5e911559ce85aebd7083d2b1c78790e1570e079076
Instruction ID: 1edfa2026f5f3c12cbb8c20940240ea4ad4ed3ad0ac92a8f6204fcb8153c415c
Opcode Fuzzy Hash: 3342e08a3ae39ba667975b5e911559ce85aebd7083d2b1c78790e1570e079076
Instruction Fuzzy Hash: 6F51947AD00199FFCB21DF96CC8C9AEB7B9AB04720F244579E941A7241D3399F40EB91

Function 00FE3E01 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNELBASE(?,?,?,00000000,00000000,00000000,00000000,00000000,?,00000002,?,00000000,00000000,?,?,00FD1458), ref: 00FE3E5B
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00FD1458,?), ref: 00FE3E7D
RegEnumKeyExW.KERNELBASE(?,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00FD1458,?,?,?), ref: 00FE3EC8

Strings

regutil.cpp, xrefs: 00FE3EEF

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: regutil.cpp
API String ID: 73471667-955085611
Opcode ID: 0d2074387b98ac7982f76288e076d2e86f4aba039b3c4177ed5211d4b72145eb
Instruction ID: 1a6edda5c215f5390f859c441e8e76b5ac9db2cf1c9a58d804ec94179c53d781
Opcode Fuzzy Hash: 0d2074387b98ac7982f76288e076d2e86f4aba039b3c4177ed5211d4b72145eb
Instruction Fuzzy Hash: A031A471A021A5BBDB218B92CC8DDAFBB7DEF49760F200425F505D7011D2B95F44EBA0

Function 00FD1334 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE3D9A: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00FE7ABC,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00FE3DAE

RegCloseKey.KERNELBASE(00000000,00000000,00000000,?,?,00020019,00000000,?,?,?,?,00FD1490,?,?,?), ref: 00FD13E7

Strings

Failed to ensure there is space for related bundles., xrefs: 00FD1393
Failed to initialize package from related bundle id: %ls, xrefs: 00FD13C4
Failed to open uninstall key for potential related bundle: %ls, xrefs: 00FD135B

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
API String ID: 47109696-1717420724
Opcode ID: ec4824d2c20e01c78406472c7f97e6b5ed18d7ad7acf208651e2889703b03134
Instruction ID: a7da4efff55600ee875ad20e590797738e573fa9407e004275e0d0e5cfba9c6f
Opcode Fuzzy Hash: ec4824d2c20e01c78406472c7f97e6b5ed18d7ad7acf208651e2889703b03134
Instruction Fuzzy Hash: 0421C07664020DFBDB118A91CC45FBE77BAEB40750F244026F905E6691EA78DE00B710

Function 00FE369C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE36C1

Strings

srputil.cpp, xrefs: 00FE374D
`Den, xrefs: 00FE36C6
d, xrefs: 00FE3706

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset
String ID: `Den$d$srputil.cpp
API String ID: 2102423945-3695789955
Opcode ID: 5362a35be9cc96cd925e36e5ac69a5439dd8f5553066faaf3f568c0168d6018f
Instruction ID: 44bc727ff795f3a4d69cda2de96cfa12b845ad4e7076bbf4ddba2360318dc13c
Opcode Fuzzy Hash: 5362a35be9cc96cd925e36e5ac69a5439dd8f5553066faaf3f568c0168d6018f
Instruction Fuzzy Hash: DF110AB2B4025EBADB24DAB5CC8DEEB73A8FB08704F040579A601DB141DA79DE089B50

Function 00FD657B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD64A1: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,00000000,?,?,00FD65A9,?,?), ref: 00FD64C6
Part of subcall function 00FD64A1: GetLastError.KERNEL32(?,00FD65A9,?,?), ref: 00FD64D0

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?), ref: 00FD65B7
GetLastError.KERNEL32 ref: 00FD65C1

Strings

Failed to read during cabinet extraction., xrefs: 00FD65F0
cabextract.cpp, xrefs: 00FD65E6

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$cabextract.cpp
API String ID: 2170121939-2426083571
Opcode ID: 49a84fe18dd9b2bc187d36b8b1ffc1245c48fdd581be0546a2bd48777b22f39a
Instruction ID: ba886e3ccde5f94cf66ca4483b67db5bfd5b8774a6ba8c7ea4f7f1da2503a67d
Opcode Fuzzy Hash: 49a84fe18dd9b2bc187d36b8b1ffc1245c48fdd581be0546a2bd48777b22f39a
Instruction Fuzzy Hash: B101E136600249ABCB21CF25EC45E9B3BF9EF84764F140229F914D7290DB75E900FA14

Function 00FE6791 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(E900FEF2,40000000,00000001,00000000,00000002,00000080,00000000,00000000,00FB7089,?,00FB5F7A,00FB7089,00000080,E900FEF2,00000000), ref: 00FE67A9
GetLastError.KERNEL32(?,00FB5F7A,00FB7089,00000080,E900FEF2,00000000,?,?,00FB7089,00FB13BB,?,?,?,?,?,DisplayName), ref: 00FE67B6
CloseHandle.KERNELBASE(00000000,00000000,00FB7089,00FB5F7A,?,00FB5F7A,00FB7089,00000080,E900FEF2,00000000,?,?,00FB7089,00FB13BB), ref: 00FE680B

Strings

fileutil.cpp, xrefs: 00FE67DB

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: fileutil.cpp
API String ID: 2528220319-2967768451
Opcode ID: bfb9d2382e2331b8d2589cb289754fecb141453427c33e6da404eb9d0414db05
Instruction ID: 4b8977197578b6d39380bce62efc3a9f46821ea18f1a7adc4ac4ae39d876517b
Opcode Fuzzy Hash: bfb9d2382e2331b8d2589cb289754fecb141453427c33e6da404eb9d0414db05
Instruction Fuzzy Hash: F8014732600199A7DB211E269C09F4B3B15AF81BB0F114231FF70EA1E0EF35CC00B2A0

Function 00FD64A1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,00000000,?,?,00FD65A9,?,?), ref: 00FD64C6
GetLastError.KERNEL32(?,00FD65A9,?,?), ref: 00FD64D0

Strings

Failed to move to virtual file pointer., xrefs: 00FD64FF
cabextract.cpp, xrefs: 00FD64F5

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$cabextract.cpp
API String ID: 2976181284-3005670968
Opcode ID: 9c94d8e2b5f1836fd97f37ec1b9609edb282d8d1fef05cbf8b08473345915125
Instruction ID: e18c447e112fbde9a7a791b8cd5b3abbb30c6407128d0db18b7b2096604a91a0
Opcode Fuzzy Hash: 9c94d8e2b5f1836fd97f37ec1b9609edb282d8d1fef05cbf8b08473345915125
Instruction Fuzzy Hash: 240126336007066BD3315B16DC05F177BA6DF80B70F18803AF604CA2A1EA6AD850B754

Function 00FE303C Relevance: 6.1, APIs: 4, Instructions: 68libraryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE3063
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00FE3078
LoadLibraryW.KERNELBASE(?,?,00000104,00FB1C3B), ref: 00FE30C6
GetLastError.KERNEL32 ref: 00FE30D2

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem_memset
String ID:
API String ID: 1376650706-0
Opcode ID: fb880e290a617cfb39a38fb70d264c718b3bd29c77a25f7b02446021967430d1
Instruction ID: fe222e61bc859b2e99483e03bab8d1e388bb11f6dc67c034b1a722ceea01842b
Opcode Fuzzy Hash: fb880e290a617cfb39a38fb70d264c718b3bd29c77a25f7b02446021967430d1
Instruction Fuzzy Hash: DE112976A00359A7DB209B669C5DF8B77ACAF80324F140075FA14DB281EE35DA44AB50

Function 00FE8C8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE88C8: lstrlenW.KERNEL32(?,?,?,00FE89E8,?,?,?,00000000,?,?,?,00FCFB81,?,?,?,00000000), ref: 00FE88EB

RegCloseKey.ADVAPI32(00000000,00FB13BB,?,?,00FB13BB,00000000,00000000,?,00FB13BB,00000001,00000000), ref: 00FE8D71
RegCloseKey.ADVAPI32(00000001,00FB13BB,?,?,00FB13BB,00000000,00000000,?,00FB13BB,00000001,00000000), ref: 00FE8D8B

Part of subcall function 00FE3D2A: RegCreateKeyExW.KERNELBASE(00000001,00000000,00000000,00000000,00000000,00000001,00FB13BB,?,?,00000001,?,00FB727D,?,00FB13BB,00020006,00000001), ref: 00FE3D4E

Part of subcall function 00FE4111: RegSetValueExW.KERNELBASE(00020006,?,00000000,00000001,?,00000000,?,000000FF,00000000,00000001,?,?,00FB6994,00000000,?,00020006), ref: 00FE4144

Part of subcall function 00FE4111: RegDeleteValueW.KERNELBASE(00020006,?,00000001,?,?,00FB6994,00000000,?,00020006,?,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,00020006,00000000), ref: 00FE4173

Part of subcall function 00FE3C39: RegSetValueExW.KERNELBASE(?,00020006,00000000,00000004,00FB68EA,00000004,00000001,?,00FB68EA,00020006,Resume,00FB13BB,00000000,00000000,?,?), ref: 00FE3C4E

Strings

%ls\%ls, xrefs: 00FE8CED

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Value$Close$CreateDeletelstrlen
String ID: %ls\%ls
API String ID: 3924016894-2125769799
Opcode ID: 5588e45eb0bb39e9a13cb75adec120f9d8f20d94c1f86db84f5936a99c0d1894
Instruction ID: 41fd50f452f2882b7b9f028599fafb14924aa6983690c1295131de50d1381934
Opcode Fuzzy Hash: 5588e45eb0bb39e9a13cb75adec120f9d8f20d94c1f86db84f5936a99c0d1894
Instruction Fuzzy Hash: 5931E971D0126CBFCF22AFD6DC858DEBBB9EB18B40B104466F514A2121D7764B52BBA0

Function 00FE4111 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(00020006,?,00000000,00000001,?,00000000,?,000000FF,00000000,00000001,?,?,00FB6994,00000000,?,00020006), ref: 00FE4144
RegDeleteValueW.KERNELBASE(00020006,?,00000001,?,?,00FB6994,00000000,?,00020006,?,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,00020006,00000000), ref: 00FE4173

Strings

regutil.cpp, xrefs: 00FE41A6

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Value$Delete
String ID: regutil.cpp
API String ID: 1738766685-955085611
Opcode ID: f115724b0912e1c813342fbb6ec6a06dd67e311cd53222f0c4929aefd3357c54
Instruction ID: 6a6fb3f2f4359f8b053d28dc059691d810d7d4a770e0876bbdac77198c8bde29
Opcode Fuzzy Hash: f115724b0912e1c813342fbb6ec6a06dd67e311cd53222f0c4929aefd3357c54
Instruction Fuzzy Hash: 2F11A032D512A6B7EF334E528C05BAB7E65AB11B70F140229F910EA090D77DED50B6D0

Function 00FE013A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,20000004,?,00FC7D0B,00000000,00000001,20000004,00000000,00000000,00000000,00000000), ref: 00FE016B
SetNamedSecurityInfoW.ADVAPI32(00000000,000007D0,00000003,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,20000004,?,00FC7D0B,00000000), ref: 00FE0186

Strings

aclutil.cpp, xrefs: 00FE01AC

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: InfoNamedSecuritySleep
String ID: aclutil.cpp
API String ID: 2352087905-2159165307
Opcode ID: ff099b5159a9672062a23bd8fdbd3a2a476e9d04a7fe304388fdea25a9c0fe87
Instruction ID: 0b5357102b4b09a73f688c13ee611510073e7337eed4549eb3b7a5aab5a33c63
Opcode Fuzzy Hash: ff099b5159a9672062a23bd8fdbd3a2a476e9d04a7fe304388fdea25a9c0fe87
Instruction Fuzzy Hash: 1F01A53390019AFBDF125E86CC05F9F7A75AF407A4F050124BE04AA160C7B9DD51FB90

Function 00FE5D92 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00FE5EC1,?,?,00000000), ref: 00FE5DB4
GetLastError.KERNEL32(?,?,00FE5EC1,?,?,00000000), ref: 00FE5DBE

Strings

fileutil.cpp, xrefs: 00FE5DE8

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: fileutil.cpp
API String ID: 442123175-2967768451
Opcode ID: ea21cc10e39896d2a7f1cebc0262eb1549a90094017f7f5b0e6af0ef218ffae0
Instruction ID: 2090c1f39156852192a21d4ddf2c7441fb86f786ed2fd538eb29e2b71a54fe70
Opcode Fuzzy Hash: ea21cc10e39896d2a7f1cebc0262eb1549a90094017f7f5b0e6af0ef218ffae0
Instruction Fuzzy Hash: F8F0AF72B0055AABDB219E5BCC09F9F7B6DEF80B74F100124B918D7140EA34E900A7A0

Function 00FE5C4F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,?,00FC81A9,?,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00FE5C65
GetLastError.KERNEL32(?,00FC81A9,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,00FC9C26,00000000,?), ref: 00FE5C6F

Strings

fileutil.cpp, xrefs: 00FE5C94

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: fileutil.cpp
API String ID: 2976181284-2967768451
Opcode ID: 63f6e9e1ed375208fc1794383b7740ae71a4d6d79d23fa627356292165cb506f
Instruction ID: 88249bc82be5d52f6658ec877fe82a0896cfff032dcc0ff6febb3922e5d0b9a4
Opcode Fuzzy Hash: 63f6e9e1ed375208fc1794383b7740ae71a4d6d79d23fa627356292165cb506f
Instruction Fuzzy Hash: 54F0A43160075AABCB118F6ADC55E977F68EF00B64F114025FD18DF260E731D810A7E0

Function 00FC125F Relevance: 4.5, APIs: 3, Instructions: 21synchronizationwindowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00FC126D
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00FC1283
WaitForSingleObject.KERNEL32(?,00003A98,?,00FB1A88,?,00000000,?,?,?,?,?,00000001,?,?,?,?), ref: 00FC1294

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: MessageObjectPostSingleWaitWindow
String ID:
API String ID: 1391784381-0
Opcode ID: 50984d99b2bb6c823ecb7af12919b0eb97a1292212625f667131ae00892408fb
Instruction ID: 58d11577c20fd5622f4627ed4c34e81872938d52df4349c292b77950230a5381
Opcode Fuzzy Hash: 50984d99b2bb6c823ecb7af12919b0eb97a1292212625f667131ae00892408fb
Instruction Fuzzy Hash: D0E0E631340309BBD6151B55ED0AFD7FB2DFB55BA1F040026F209A90B0C7B16520A794

Function 00FE2AAE Relevance: 4.5, APIs: 3, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,?,00FDFDBF,?,?,00FD6AA0,00000000,00000000,80070000,?,?,?,?,00FE0138,?), ref: 00FE2AB6
RtlFreeHeap.NTDLL(00000000,?,00FDFDBF,?,?,00FD6AA0,00000000,00000000,80070000,?,?,?,?,00FE0138,?,00FD6AA0), ref: 00FE2ABD
GetLastError.KERNEL32(?,00FDFDBF,?,?,00FD6AA0,00000000,00000000,80070000,?,?,?,?,00FE0138,?,00FD6AA0,?), ref: 00FE2ACB

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: 1e330d7e9e3979b93f263724605cea19ff460fa9923d1297db219f2cd972b2c4
Instruction ID: 3069e6ad70659acaca83e1893060a9f01c51c1c49fa6094867650feb760e37fb
Opcode Fuzzy Hash: 1e330d7e9e3979b93f263724605cea19ff460fa9923d1297db219f2cd972b2c4
Instruction Fuzzy Hash: DFD05E3264428AABD7A11BB2AC4AB273E5CDF04B65F144534F616CC060EB2DC890B775

Function 00FE587E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FE58B0

Part of subcall function 00FE56D9: GetModuleHandleA.KERNEL32(kernel32.dll,?,00000000,?,?,00FE58C1,00000000,?,00000000), ref: 00FE56F7
Part of subcall function 00FE56D9: GetLastError.KERNEL32(?,?,00FE58C1,00000000,?,00000000,?,?,?,?,?,?,?,?,00FD3EC5,00FB2222), ref: 00FE5703

Strings

WixBundleElevated, xrefs: 00FE5891

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID: WixBundleElevated
API String ID: 52713655-4097796520
Opcode ID: 82baa1f74b2154b8f330309fa783499ef88bf5f17e62431979e0b8234fed5174
Instruction ID: 09e2698b6109d12dd92b4e9528ae08ed56cdedbd945c59c7fbf5a0f2f69756d9
Opcode Fuzzy Hash: 82baa1f74b2154b8f330309fa783499ef88bf5f17e62431979e0b8234fed5174
Instruction Fuzzy Hash: 2D316F72A00619DFCB00DFA9C8C4ADEB7FAFF48720F150469E919EB341EA35D9049B60

Function 00FE3D2A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000001,00000000,00000000,00000000,00000000,00000001,00FB13BB,?,?,00000001,?,00FB727D,?,00FB13BB,00020006,00000001), ref: 00FE3D4E

Strings

regutil.cpp, xrefs: 00FE3D75

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Create
String ID: regutil.cpp
API String ID: 2289755597-955085611
Opcode ID: 5b3f2a23b1c978d7983f8c565e31e11f9ca847f7d1ce04bad0a0bfe79a4960c6
Instruction ID: 1b9bd67683b33bbdf4cfe9c89eef681732ead9bead7c066f7042b91381bd8654
Opcode Fuzzy Hash: 5b3f2a23b1c978d7983f8c565e31e11f9ca847f7d1ce04bad0a0bfe79a4960c6
Instruction Fuzzy Hash: DEF03172A0126AABDB324E5A9C0DAAB7B99EF05760F014035BD15D6150D279DE20EBE0

Function 00FE3D9A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00FE7ABC,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00FE3DAE

Strings

regutil.cpp, xrefs: 00FE3DEF

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Open
String ID: regutil.cpp
API String ID: 71445658-955085611
Opcode ID: 19221d1b729a4bcd986489b1a6a3d5d941058d0ee72f9062f2b59b19346e2f2d
Instruction ID: bb62d46112cc33694f0a295d12641b20d0a4f002cdfaf4a0544b05ee743ff73c
Opcode Fuzzy Hash: 19221d1b729a4bcd986489b1a6a3d5d941058d0ee72f9062f2b59b19346e2f2d
Instruction Fuzzy Hash: 16F0E232B0129E6FEB360E978CCEB3A3A9EAF08374F144139FA45CB151D56ACD107290

Function 00FE3CDA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00020006,?,00000000,00000000,00000000,?,00000000,00FB6976,00000000,00000000,00000001,?,00FB6976,?,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,00020006), ref: 00FE3CF4

Strings

regutil.cpp, xrefs: 00FE3D18

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Create
String ID: regutil.cpp
API String ID: 2289755597-955085611
Opcode ID: 4d156fb9d0c53e4fc650f10a7291f859b898c3f8a259d70ce27f863e38d523fd
Instruction ID: 35520095e5c9b789c74b0f23d6dc6806bb76742fc07deeb39cf0f362638dee75
Opcode Fuzzy Hash: 4d156fb9d0c53e4fc650f10a7291f859b898c3f8a259d70ce27f863e38d523fd
Instruction Fuzzy Hash: 7DF065339400E976D7321E579C0DE977E2EDBC6F70F154529F918DB050D26A8D10E6E0

Function 00FE3C39 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00020006,00000000,00000004,00FB68EA,00000004,00000001,?,00FB68EA,00020006,Resume,00FB13BB,00000000,00000000,?,?), ref: 00FE3C4E

Strings

regutil.cpp, xrefs: 00FE3C75

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Value
String ID: regutil.cpp
API String ID: 3702945584-955085611
Opcode ID: 69dd1304eabc9023641cce7e6a2061b7424ec8baa658314039d4c1da524027ba
Instruction ID: 7df947e0514f1e325d9bb0bc929986d10e2791aff4a0ecb7baa0f3d76ebaf16c
Opcode Fuzzy Hash: 69dd1304eabc9023641cce7e6a2061b7424ec8baa658314039d4c1da524027ba
Instruction Fuzzy Hash: 7AE06D72A4127677D6225A9A8C0EFA77E48AF00BB0F008024BB04EB080D66ADD10A2E0

Function 00FE2915 Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00FD6AA0,?,00FE0F36,?,00FD6AA0,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?), ref: 00FE2929
RtlReAllocateHeap.NTDLL(00000000,?,00FE0F36,?,00FD6AA0,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000), ref: 00FE2930

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 81654fee4df39250623bf9fd22fdbacbd4984ae2617993c3eb8412eb3328c499
Instruction ID: ee128962e22f29c2b8fc0cd5e986d22dd65ce80930eb1dcc7963c6dcd78d86bc
Opcode Fuzzy Hash: 81654fee4df39250623bf9fd22fdbacbd4984ae2617993c3eb8412eb3328c499
Instruction Fuzzy Hash: F6D0C93219024DABCF015FB4DC4AC9B7B6CEB14212B048405F915CA120C739D020AB60

Function 00FD911B Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00FD9123

Part of subcall function 00FD90F0: GetModuleHandleW.KERNEL32(mscoree.dll,?,00FD9128,00000000,?,00FDBB9F,000000FF,0000001E,00000001,00000000,00000000,?,00FDC627,00000000,00000001,00000000), ref: 00FD90FA
Part of subcall function 00FD90F0: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00FD910A

ExitProcess.KERNEL32 ref: 00FD912C

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: ee6f4b5d64b64201c4951b168e4b125a017920975e5b90d8d0f90117b3f08351
Instruction ID: 66c560dae5a535293ebd4d0790b7bae31c2264c91617677f4b8e050f1510b54a
Opcode Fuzzy Hash: ee6f4b5d64b64201c4951b168e4b125a017920975e5b90d8d0f90117b3f08351
Instruction Fuzzy Hash: 8CB09B3100414C7BCB112F56DC4D84D3F26DF403517148021F50409131DF719D51E584

Function 00FE4E96 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE4F4D

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 09c8aad963d0da2988b171c622a1bfd523fe97a0ffa538174feb25c6d6ff2523
Instruction ID: f15bab42c6196a281def69ae0a33a8802bb70c963cdbdb616b96639cd4bfba98
Opcode Fuzzy Hash: 09c8aad963d0da2988b171c622a1bfd523fe97a0ffa538174feb25c6d6ff2523
Instruction Fuzzy Hash: 0821E4729001C0ABDB288F2ADC94B7A7765EB80B35F24832EF5168B5D5D730ED40E791

Function 00FE8BC4 Relevance: 1.6, APIs: 1, Instructions: 73registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE88C8: lstrlenW.KERNEL32(?,?,?,00FE89E8,?,?,?,00000000,?,?,?,00FCFB81,?,?,?,00000000), ref: 00FE88EB

RegCloseKey.KERNELBASE(00000000,?,8000FFFF,?,?,?,8000FFFF,00000000,?,?,?,00000000,000000B9,00FD3E1D,?,?), ref: 00FE8C6E

Part of subcall function 00FE3D2A: RegCreateKeyExW.KERNELBASE(00000001,00000000,00000000,00000000,00000000,00000001,00FB13BB,?,?,00000001,?,00FB727D,?,00FB13BB,00020006,00000001), ref: 00FE3D4E

Part of subcall function 00FE4111: RegSetValueExW.KERNELBASE(00020006,?,00000000,00000001,?,00000000,?,000000FF,00000000,00000001,?,?,00FB6994,00000000,?,00020006), ref: 00FE4144

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 7930bd75c0288fb40f2cbcf9ecc0fb33260c5ddcc8e4e644802034b4685eec20
Instruction ID: e7a735ed591d1a2d7a06ed5c0512a4e454cd30fd14cd1663ae9df32accf9150f
Opcode Fuzzy Hash: 7930bd75c0288fb40f2cbcf9ecc0fb33260c5ddcc8e4e644802034b4685eec20
Instruction Fuzzy Hash: BD212F72C01158FECF22BF9ACD458DDFAB5AB89780B204166F914B2120D6365F61BBA0

Function 00FE7B31 Relevance: 1.6, APIs: 1, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000000,01007044,00000000,00000000,?,?,00FC7A2A,WiX\Burn,PackageCache,00000000,01007044,00000000,00000000,00000000), ref: 00FE7B83

Part of subcall function 00FE37DF: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,80070002,80070003,00000000,00000000,00000000), ref: 00FE3850
Part of subcall function 00FE37DF: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00FE3889

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: ecec28eaa4ae616c350da7c8d1fe3caf5ce4a17bd704931b5e1265b0222bdb9c
Instruction ID: 26ebdb94c0b058e9744dc130a74d9c583fb0768e7e677c48138d66858f4ae3a9
Opcode Fuzzy Hash: ecec28eaa4ae616c350da7c8d1fe3caf5ce4a17bd704931b5e1265b0222bdb9c
Instruction Fuzzy Hash: 2711A077905289EFCF20BE96CC85D9E76BAEBC0364B254579E90193128C7358E50F760

Function 00FE25A1 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00FC7AE2,0000001C,00000000,00000000,00000000,00000000), ref: 00FE25C2

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 11de2ad6fab398841bfd205c681489bf997a600a2aadff0f2c1c84a2b64f64c5
Instruction ID: 194810994309b41c0b9997dd37fc707ee9437c10af56273be7834ac3f5cfcf89
Opcode Fuzzy Hash: 11de2ad6fab398841bfd205c681489bf997a600a2aadff0f2c1c84a2b64f64c5
Instruction Fuzzy Hash: C3E0123134136477D6412A935D42FCB7B5C5F15751F448011FF44A90C1DAA5A5906BA9

Function 00FB1000 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000), ref: 00FB100C

Part of subcall function 00FB1B46: _memset.LIBCMT ref: 00FB1BA5
Part of subcall function 00FB1B46: _memset.LIBCMT ref: 00FB1BC9
Part of subcall function 00FB1B46: CoUninitialize.COMBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00FB1F08

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset$HeapInformationUninitialize
String ID:
API String ID: 1504587645-0
Opcode ID: 84c2eb45f357831965d3fe21ca3ce32b519f7be44f4bc56710148760b05f1a90
Instruction ID: 28e659120be5fd59082204b3a0ff154480abbbe5b7a38f20a15106c07f81ae30
Opcode Fuzzy Hash: 84c2eb45f357831965d3fe21ca3ce32b519f7be44f4bc56710148760b05f1a90
Instruction Fuzzy Hash: F4E08C3120020DBBEB00EF81DD42FDE7A6AAB00749F104014BA00A90D0D3B1EA20AB60

Function 00FD9373 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00FD937F

Part of subcall function 00FD9233: __lock.LIBCMT ref: 00FD9241
Part of subcall function 00FD9233: DecodePointer.KERNEL32(01003350,00000020,00FD939A,00000000,00000001,00000000,?,00FD93DA,000000FF,?,00FDBE72,00000011,00000000,?,00FD9E0F,0000000D), ref: 00FD927D
Part of subcall function 00FD9233: DecodePointer.KERNEL32(?,00FD93DA,000000FF,?,00FDBE72,00000011,00000000,?,00FD9E0F,0000000D,?,00FE924C,00FD6AA0), ref: 00FD928E
Part of subcall function 00FD9233: DecodePointer.KERNEL32(-00000004,?,00FD93DA,000000FF,?,00FDBE72,00000011,00000000,?,00FD9E0F,0000000D,?,00FE924C,00FD6AA0), ref: 00FD92B4
Part of subcall function 00FD9233: DecodePointer.KERNEL32(?,00FD93DA,000000FF,?,00FDBE72,00000011,00000000,?,00FD9E0F,0000000D,?,00FE924C,00FD6AA0), ref: 00FD92C7
Part of subcall function 00FD9233: DecodePointer.KERNEL32(?,00FD93DA,000000FF,?,00FDBE72,00000011,00000000,?,00FD9E0F,0000000D,?,00FE924C,00FD6AA0), ref: 00FD92D1

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: DecodePointer$__lock_doexit
String ID:
API String ID: 3343572566-0
Opcode ID: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction ID: a3efcc566decb7ffd537c29ed7a346fb0f52f2ad6a7d6de828f3816e6230a788
Opcode Fuzzy Hash: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction Fuzzy Hash: FBB0123298430C33DA203582EC03F063F0E87C0B60F680066FA0C1D2F1A9E3BB6194C9

Function 00FB131F Relevance: 1.3, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?), ref: 00FB1350

Part of subcall function 00FE2EB5: lstrlenA.KERNEL32(?,00000000,00000000,00000000,?,00FB1371,?,?,?), ref: 00FE2EBE
Part of subcall function 00FE2EB5: _memcpy_s.LIBCMT ref: 00FE2EF2

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Value_memcpy_slstrlen
String ID:
API String ID: 32415546-0
Opcode ID: 9d4dc6195f09238e3a588ab68f5534994fe71eff870c0fb4a9a78a5cbbcfc3c9
Instruction ID: a54dd1b9cf62e89237f64386284db133c49135775330cb75551d68b25cd25cec
Opcode Fuzzy Hash: 9d4dc6195f09238e3a588ab68f5534994fe71eff870c0fb4a9a78a5cbbcfc3c9
Instruction Fuzzy Hash: 4C117376D00118FFCB21AF96CD548DEBBFCBB84360F5446A6E511A7214F2364E44AF90

Function 00FE1729 Relevance: 1.3, APIs: 1, Instructions: 52stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,?,00FE2CFE,?,00FEB5F8,00000000,?,00000000,00000004,00000000,00000004,?,00000000), ref: 00FE175A

Part of subcall function 00FE293A: GetProcessHeap.KERNEL32(00000000,?,?,00FE0E95,?,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000), ref: 00FE2942
Part of subcall function 00FE293A: HeapSize.KERNEL32(00000000,?,00FE0E95,?,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000,80070000), ref: 00FE2949

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: fdf170e9cabfc7daa8fb49231e5a65d35c2d2d2956aec3b6b0366b2521780a9c
Instruction ID: 6f4084ced7525c80d738fbd69f60e26f7f0395a7e9087b59b7e0f44f617c3482
Opcode Fuzzy Hash: fdf170e9cabfc7daa8fb49231e5a65d35c2d2d2956aec3b6b0366b2521780a9c
Instruction Fuzzy Hash: C001D632300285BBEB105E67DC85F9F3B5EBF84BB0F114111FE14DB191D675E840A6A4

Function 00FE6174 Relevance: 1.3, APIs: 1, Instructions: 34sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00FC787B,00000000,00000000,?,00FC787B,?,00000000,00000001,00000001,00000003,000007D0,?,?,00000000), ref: 00FE618F

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 55f61be9cb8f96c6b556ff575fffa849c840186f586970fa58973fe84b8cec36
Instruction ID: 94ee34118c48074772279205a89d57ecdb820289d96bce87f772a7c7769c24aa
Opcode Fuzzy Hash: 55f61be9cb8f96c6b556ff575fffa849c840186f586970fa58973fe84b8cec36
Instruction Fuzzy Hash: E3F0E27640039EA7CF275E5A8C04A5E7E54AB60BF0B384116FE08D9032C26ED8A1B7D6

Function 00FE602E Relevance: 1.3, APIs: 1, Instructions: 29sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00FC7B9B,00000000,?,00000001,00000003,000007D0,?,?,00FC9CB4,00000000,00000000,00000000,00000000), ref: 00FE6045

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 583cbe00e084420fc91911307ce2204bebc4cd70b2a2385d36c9a52cd13f081c
Instruction ID: 63daf4bee5668b4d4bbce21f16ee9aef826acb7fd135463d26a9abf913f92f82
Opcode Fuzzy Hash: 583cbe00e084420fc91911307ce2204bebc4cd70b2a2385d36c9a52cd13f081c
Instruction Fuzzy Hash: 50E030328411BED68B356E4A9C44B5E7A659B207F4B148515BF04D9030C32AE8A1BAD5

Function 00FD6749 Relevance: 1.3, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?), ref: 00FD6784

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 544a00a7a5088bd85e1f997befb9756171cce9a528750d1958fc3840f4188501
Instruction ID: 802582884872a3e2b56fb1c3cbe4d89f129ef02b86d7d72d5a31fd8098d04785
Opcode Fuzzy Hash: 544a00a7a5088bd85e1f997befb9756171cce9a528750d1958fc3840f4188501
Instruction Fuzzy Hash: 3DF06D31500208CFDB108F68C848B157BE5AB04739F098361EA298B3E2C735E811DE10

Non-executed Functions

Function 00FB13BA Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 142sleepshutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?), ref: 00FB13E4
OpenProcessToken.ADVAPI32(00000000), ref: 00FB13EB
GetLastError.KERNEL32 ref: 00FB13F5
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00FB1445
GetLastError.KERNEL32 ref: 00FB144F
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 00FB1494
GetLastError.KERNEL32 ref: 00FB149E
Sleep.KERNEL32(000003E8), ref: 00FB14DB
InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,80040002), ref: 00FB14EB
GetLastError.KERNEL32 ref: 00FB14F5
CloseHandle.KERNEL32(?), ref: 00FB154F

Strings

Failed to get shutdown privilege LUID., xrefs: 00FB147E
Failed to adjust token to add shutdown privileges., xrefs: 00FB14CD
Failed to get process token., xrefs: 00FB1424
Failed to schedule restart., xrefs: 00FB153A
SeShutdownPrivilege, xrefs: 00FB1434
engine.cpp, xrefs: 00FB141A, 00FB1474, 00FB14C3, 00FB1530

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSleepSystemValue
String ID: Failed to adjust token to add shutdown privileges.$Failed to get process token.$Failed to get shutdown privilege LUID.$Failed to schedule restart.$SeShutdownPrivilege$engine.cpp
API String ID: 2241679041-1583736410
Opcode ID: 8e1bd12b8f940458f0a45651b4f25ed1ddd40d05ad88ac07bad0bac686f1a4a3
Instruction ID: 946461dc5293eda8f49e417176ab89404ff138a0058c8c637b07e742bba04f94
Opcode Fuzzy Hash: 8e1bd12b8f940458f0a45651b4f25ed1ddd40d05ad88ac07bad0bac686f1a4a3
Instruction Fuzzy Hash: 0041F872E4019AEAD7309BA79C89AFF7A68BB40350F540035F612FA051D7688D407BA2

Function 00FB35AD Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 174pipeCOMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 00FB35DA
GetLastError.KERNEL32(00000000,00FB17A1,00FBBD45,00FB130D,?), ref: 00FB35E3
CreateNamedPipeW.KERNEL32(00FB130D,00080003,00000000,00000001,00010000,00010000,00000001,?,00FB130D,00000000,00FB17A1,00FBBD45,00FB130D,?), ref: 00FB3696
GetLastError.KERNEL32 ref: 00FB36A0
CloseHandle.KERNEL32(?,pipe.cpp,0000014E,000000FF), ref: 00FB3726
LocalFree.KERNEL32(?,00FB130D), ref: 00FB3746
CreateNamedPipeW.KERNEL32(00FB130D,00080003,00000000,00000001,00010000,00010000,00000001,00000000), ref: 00FB3761
GetLastError.KERNEL32 ref: 00FB3768

Strings

\\.\pipe\%ls.Cache, xrefs: 00FB36FB
pipe.cpp, xrefs: 00FB360D, 00FB36CA, 00FB3792
\\.\pipe\%ls, xrefs: 00FB3644
Failed to allocate full name of pipe: %ls, xrefs: 00FB365B
D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD), xrefs: 00FB35D5
Failed to allocate full name of cache pipe: %ls, xrefs: 00FB3715
Failed to create pipe: %ls, xrefs: 00FB36D7, 00FB379F
Failed to create the security descriptor for the connection event and pipe., xrefs: 00FB3617

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$CreateDescriptorNamedPipeSecurity$CloseConvertFreeHandleLocalString
String ID: D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD)$Failed to allocate full name of cache pipe: %ls$Failed to allocate full name of pipe: %ls$Failed to create pipe: %ls$Failed to create the security descriptor for the connection event and pipe.$\\.\pipe\%ls$\\.\pipe\%ls.Cache$pipe.cpp
API String ID: 1214480349-3253666091
Opcode ID: 8e1ecab6bfd1813c96d7850bf2b5e6e0bd0f6b292cfa6d99a0d1137f8ad89720
Instruction ID: 20ff4e906b60ad56d55f75457b4a391874599bba0ddc9e3ee38552dbd0df2f96
Opcode Fuzzy Hash: 8e1ecab6bfd1813c96d7850bf2b5e6e0bd0f6b292cfa6d99a0d1137f8ad89720
Instruction Fuzzy Hash: 3A517FB1E8024AFADF119FA6CC46ADEBB75EF04350F204069F510AA191D7799B40BF91

Function 00FD6FEC Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 148filenetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE5C4F: SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,?,00FC81A9,?,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00FE5C65
Part of subcall function 00FE5C4F: GetLastError.KERNEL32(?,00FC81A9,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,00FC9C26,00000000,?), ref: 00FE5C6F

InternetReadFile.WININET(?,00000000,?,?), ref: 00FD702E
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00FD705D

Strings

UX aborted on cache progress., xrefs: 00FD717F
Failed to write data from internet., xrefs: 00FD7178
Failed to seek to start point in file., xrefs: 00FD700E, 00FD709A
downloadengine.cpp, xrefs: 00FD7130, 00FD716E
Failed while reading from internet., xrefs: 00FD713A

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: File$ErrorInternetLastPointerReadWrite
String ID: Failed to seek to start point in file.$Failed to write data from internet.$Failed while reading from internet.$UX aborted on cache progress.$downloadengine.cpp
API String ID: 1734627056-3175886020
Opcode ID: 3237cd706019fbdda8e18d1e5cecbbe16559a18fe087769b8bc1741fb62ac1ea
Instruction ID: 4002255c1acfd8454cb86ad6be6e3b10b9fee2e90bb79f510013d6c11181dfc3
Opcode Fuzzy Hash: 3237cd706019fbdda8e18d1e5cecbbe16559a18fe087769b8bc1741fb62ac1ea
Instruction Fuzzy Hash: EF41647290434AFFDF10AF95CC85DAE7BBAEF04314B28452AF511EA2A0E7749D54BB10

Function 00FE01CB Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00FE28F3: GetProcessHeap.KERNEL32(00FD6AA0,?,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000), ref: 00FE2904
Part of subcall function 00FE28F3: RtlAllocateHeap.NTDLL(00000000,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000), ref: 00FE290B

LookupAccountNameW.ADVAPI32(00000000,000000FF,?,?,00000000,000000FF,?), ref: 00FE0242
GetLastError.KERNEL32 ref: 00FE0252
GetLastError.KERNEL32(?,00000044,00000001), ref: 00FE0274

Strings

D, xrefs: 00FE025D
aclutil.cpp, xrefs: 00FE01FD, 00FE031A

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorHeapLast$AccountAllocateLookupNameProcess
String ID: D$aclutil.cpp
API String ID: 1410359055-2185417647
Opcode ID: e5e39c9034e486d2bd14fa23058984ea0eccb0059dc7c90da35c8620995ad8a3
Instruction ID: 4bbbfbee0967abba90bee064fc4f05317517f51009133bce565c27c040d51931
Opcode Fuzzy Hash: e5e39c9034e486d2bd14fa23058984ea0eccb0059dc7c90da35c8620995ad8a3
Instruction Fuzzy Hash: 3E418772D0025BFBDF219A96CC45BAE7BB9AF00754F114175AA10F6150EBB8CE40FB90

Function 00FC8566 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 137encryptionCOMMON

Download Yara Rule

APIs

CryptHashPublicKeyInfo.CRYPT32(00000000,00008004,00000000,00000001,?,?,00000014), ref: 00FC85D5
GetLastError.KERNEL32 ref: 00FC8671

Strings

Failed to get certificate public key identifier., xrefs: 00FC86A0
Failed to find expected public key in certificate chain., xrefs: 00FC86B9
cache.cpp, xrefs: 00FC8696
Failed to read certificate thumbprint., xrefs: 00FC86A7

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CryptErrorHashInfoLastPublic
String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$cache.cpp
API String ID: 823482589-3408201827
Opcode ID: 0a1801a710db0a7f862625b36510c464ecfbebe80323af8803db7dbb81225987
Instruction ID: c441d83a5ddf7a9d28c51b86ca51b32cd5ddcac570481c596fcfc473f693b6c5
Opcode Fuzzy Hash: 0a1801a710db0a7f862625b36510c464ecfbebe80323af8803db7dbb81225987
Instruction Fuzzy Hash: DD419F71E0021A9BCB10CF65C982FEEB7B4BF48365F154169E510BB290DB78DC42EB90

Function 00FE0358 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

CheckTokenMembership.ADVAPI32(?,?,?,?,?,?,00FE04A2,?,?,76EEC3F0,?,00000000), ref: 00FE039E
GetLastError.KERNEL32(?,?,?,00FE04A2,?,?,76EEC3F0,?,00000000), ref: 00FE03AC
AllocateAndInitializeSid.ADVAPI32(00FE0496,EC83EC8B,FFFFFEB6,5FFC4D8B,5BCD335E,FF809BE8,04C2C9FF,EC8B5500,FC5D89F6,FFF45D89,?,?,?), ref: 00FE03FF
GetLastError.KERNEL32(?,?,?,00FE04A2,?,?,76EEC3F0,?,00000000), ref: 00FE0409
FreeSid.ADVAPI32(?,?,?,?,00FE04A2,?,?,76EEC3F0,?,00000000), ref: 00FE043F

Strings

aclutil.cpp, xrefs: 00FE03CE

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$AllocateCheckFreeInitializeMembershipToken
String ID: aclutil.cpp
API String ID: 1125035699-2159165307
Opcode ID: 3c08dfac1840b1881f60af818fd721c9a67ffe4f7af9bbb7ab3701bbc3316ecf
Instruction ID: 40b5e3f1fa5be16d90431bd10bf893403be532fc8923ff8f0fdfbc2771757f88
Opcode Fuzzy Hash: 3c08dfac1840b1881f60af818fd721c9a67ffe4f7af9bbb7ab3701bbc3316ecf
Instruction Fuzzy Hash: 2A210932900155FFCB219B96CC48DAE7A69EF44360F250565F605EB071E775CE80FB60

Function 00FD854A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00FDA5EF
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00FDA604
UnhandledExceptionFilter.KERNEL32(01000A28), ref: 00FDA60F
GetCurrentProcess.KERNEL32(C0000409), ref: 00FDA62B
TerminateProcess.KERNEL32(00000000), ref: 00FDA632

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 568f05a03af5b2872be4a891297907d9a8e7cd20878f94e7d489d81511291f78
Instruction ID: 041352aad9cce013cd0127f5f7a6ab6aa31cf9243f68b56d2372ee432f74f395
Opcode Fuzzy Hash: 568f05a03af5b2872be4a891297907d9a8e7cd20878f94e7d489d81511291f78
Instruction Fuzzy Hash: F3212FB4802388DFC723DF68F885A453BB0BB49310F10446AE5C88B358E7BE6A808F55

Function 00FE851E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,01001F04,?), ref: 00FE8573
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00FE8585

Strings

%04hu-%02hu-%02huT%02hu:%02hu:%02huZ, xrefs: 00FE855C
%04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u, xrefs: 00FE85CD

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Time$InformationLocalSpecificSystemZone
String ID: %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u$%04hu-%02hu-%02huT%02hu:%02hu:%02huZ
API String ID: 1772835396-395410266
Opcode ID: 290bb7dd323fb57ebca5e3a55e839e7eb6bdfa969366e1123357d7fb25ae0f00
Instruction ID: 1b749cbf3160b81037cb680987e38550db1577ed38d8ea7a82a3363ea4e74840
Opcode Fuzzy Hash: 290bb7dd323fb57ebca5e3a55e839e7eb6bdfa969366e1123357d7fb25ae0f00
Instruction Fuzzy Hash: C0210CA2900128EAD720DF9ACC45EBBB3FDBB4C711F04455AB945D6180E73CDA80E770

Function 00FC86E7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

Failed create working folder., xrefs: 00FC871A
Failed to calculate working folder to ensure it exists., xrefs: 00FC8704
Failed to copy working folder., xrefs: 00FC8742

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLastPathTemp_memset
String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
API String ID: 623060366-2072961686
Opcode ID: 810f7bc791404238620abe9bcb1af27a74357fbb418d51904652c08850fed575
Instruction ID: 0757a4bc6108aba632659c3ec206e92249cdb9ea80c7794a74a104cd0b2f827f
Opcode Fuzzy Hash: 810f7bc791404238620abe9bcb1af27a74357fbb418d51904652c08850fed575
Instruction Fuzzy Hash: 4D01B17290011EFACF11BE959DC6DAEB768EE403E4730446AF60177050EB395E02BA50

Function 00FCEDC2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

ChangeServiceConfigW.ADVAPI32(?,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,?,00FCEFF9,?), ref: 00FCEDDC
GetLastError.KERNEL32(?,00FCEFF9,?,00000003,?,?), ref: 00FCEDE6

Strings

Failed to set service start type., xrefs: 00FCEE15
msuengine.cpp, xrefs: 00FCEE0B

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ChangeConfigErrorLastService
String ID: Failed to set service start type.$msuengine.cpp
API String ID: 1456623077-1628545019
Opcode ID: 79eef43cea627453bd7410ceb335051cef76466f5fce7db1f5f2488a57e6762c
Instruction ID: 958f83f9e29657b60c844d7b79ec40317ad4edbe9650549b705309595a37a4af
Opcode Fuzzy Hash: 79eef43cea627453bd7410ceb335051cef76466f5fce7db1f5f2488a57e6762c
Instruction Fuzzy Hash: 73F0AE3274415B76C73116179C0AE6B3E59DFC1BB17214239F635D91E0DB69C801B1A1

Function 00FD90E2 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000290A0), ref: 00FD90E7

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2cfbe1ecde0b327793f8609d8dc9b80b6379bda2f0048f2ffe7532612d344093
Instruction ID: 6009e00ce4b2ca67878e3985a57c1b440c995bf42e361fb1e0458e4f835fe851
Opcode Fuzzy Hash: 2cfbe1ecde0b327793f8609d8dc9b80b6379bda2f0048f2ffe7532612d344093
Instruction Fuzzy Hash: 1390026125514D4A464017B06C8E50A35A3AE496067958451B001C8155DB919000B552

Function 00FCA48D Relevance: 79.1, APIs: 7, Strings: 38, Instructions: 365COMMON

Download Yara Rule

Strings

Failed to get @AsyncInstall., xrefs: 00FCA5BF
exeengine.cpp, xrefs: 00FCA6DA
Failed to get @Type., xrefs: 00FCA8D2
forceReboot, xrefs: 00FCA7A8
AsyncRepair, xrefs: 00FCA623
Type, xrefs: 00FCA72F
none, xrefs: 00FCA5E9
burn, xrefs: 00FCA57F
Failed to get @DetectCondition., xrefs: 00FCA4C2
Failed to get @InstallArguments., xrefs: 00FCA4E4
Failed to get @UninstallArguments., xrefs: 00FCA506
success, xrefs: 00FCA74A
Failed to get exit code node count., xrefs: 00FCA6A8
Invalid exit code type: %ls, xrefs: 00FCA8AC
Failed to get @RepairArguments., xrefs: 00FCA528
Failed to parse @Code value: %ls, xrefs: 00FCA8EB
DetectCondition, xrefs: 00FCA4B1
AsyncUninstall, xrefs: 00FCA64F
AsyncInstall, xrefs: 00FCA5A4
Failed to get @Code., xrefs: 00FCA8D9
netfx4, xrefs: 00FCA5CA
Failed to get @AsyncUninstall., xrefs: 00FCA66A
Failed to convert @Code value: %ls, xrefs: 00FCA8BB
ExitCode, xrefs: 00FCA678
Failed to get next node., xrefs: 00FCA8CB
Failed to select exit code nodes., xrefs: 00FCA68B
Failed to allocate memory for exit code structs., xrefs: 00FCA6E4
scheduleReboot, xrefs: 00FCA788
Code, xrefs: 00FCA7CD
Failed to get @Repairable., xrefs: 00FCA552
Failed to get @Protocol., xrefs: 00FCA612
error, xrefs: 00FCA76A
InstallArguments, xrefs: 00FCA4D3
RepairArguments, xrefs: 00FCA517
Failed to get @AsyncRepair., xrefs: 00FCA63E
Repairable, xrefs: 00FCA539
UninstallArguments, xrefs: 00FCA4F5
Protocol, xrefs: 00FCA560

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AsyncInstall$AsyncRepair$AsyncUninstall$Code$DetectCondition$ExitCode$Failed to allocate memory for exit code structs.$Failed to convert @Code value: %ls$Failed to get @AsyncInstall.$Failed to get @AsyncRepair.$Failed to get @AsyncUninstall.$Failed to get @Code.$Failed to get @DetectCondition.$Failed to get @InstallArguments.$Failed to get @Protocol.$Failed to get @RepairArguments.$Failed to get @Repairable.$Failed to get @Type.$Failed to get @UninstallArguments.$Failed to get exit code node count.$Failed to get next node.$Failed to parse @Code value: %ls$Failed to select exit code nodes.$InstallArguments$Invalid exit code type: %ls$Protocol$RepairArguments$Repairable$Type$UninstallArguments$burn$error$exeengine.cpp$forceReboot$netfx4$none$scheduleReboot$success
API String ID: 760788290-4137368201
Opcode ID: 90cb58093a5da7d96f70f9ff1c423ff488ff7ec9c3e64a8edaef4f90acfbc5cd
Instruction ID: 0377a6af52425432461d7bf33aa4fe295e82887c52f391e28cfde143d1e2c456
Opcode Fuzzy Hash: 90cb58093a5da7d96f70f9ff1c423ff488ff7ec9c3e64a8edaef4f90acfbc5cd
Instruction Fuzzy Hash: 84C1A572E4421FBBDB119A60CE42FAE7664AF00B28F144129F914EB2D1D7B4E941F792

Function 00FB4D79 Relevance: 75.6, APIs: 3, Strings: 40, Instructions: 363COMMON

Download Yara Rule

APIs

Part of subcall function 00FE5A1A: VariantInit.OLEAUT32(?), ref: 00FE5A30
Part of subcall function 00FE5A1A: SysAllocString.OLEAUT32(?), ref: 00FE5A4C
Part of subcall function 00FE5A1A: VariantClear.OLEAUT32(?), ref: 00FE5AD3
Part of subcall function 00FE5A1A: SysFreeString.OLEAUT32(00000000), ref: 00FE5ADE

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,download,000000FF,00000001,Packaging,00000000,00000001,FilePath,?,00000001,00FECBE0,?,00000000), ref: 00FB4EA5
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,embedded,000000FF), ref: 00FB4EC5
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,external,000000FF), ref: 00FB4EE3

Strings

embedded, xrefs: 00FB4EB7
Failed to select payload nodes., xrefs: 00FB4DA6
download, xrefs: 00FB4E97
Failed to get @DownloadUrl., xrefs: 00FB513D
FileSize, xrefs: 00FB4FA6
Failed to get @Catalog., xrefs: 00FB517C
Failed to get @Container., xrefs: 00FB5115
Failed to get @LayoutOnly., xrefs: 00FB512F
external, xrefs: 00FB4ED5
Failed to get @Id., xrefs: 00FB50FD
Failed to get @FileSize., xrefs: 00FB5144
Container, xrefs: 00FB4EFF
CertificateRootThumbprint, xrefs: 00FB5016
SourcePath, xrefs: 00FB4F5C
X, xrefs: 00FB50CF
Failed to hex decode the Payload/@Hash., xrefs: 00FB5175
DownloadUrl, xrefs: 00FB4F81
Hash, xrefs: 00FB504F
Failed to get payload node count., xrefs: 00FB4DC0
Failed to get @SourcePath., xrefs: 00FB5136
Failed to hex decode @CertificateRootThumbprint., xrefs: 00FB5167
Failed to find catalog., xrefs: 00FB5183
Failed to to find container: %ls, xrefs: 00FB511F
Failed to get next node., xrefs: 00FB50F3
Failed to get @FilePath., xrefs: 00FB5107
LayoutOnly, xrefs: 00FB4F3D
Failed to hex decode @CertificateRootPublicKeyIdentifier., xrefs: 00FB5159
Failed to get @Hash., xrefs: 00FB516E
Packaging, xrefs: 00FB4E78
Failed to allocate memory for payload structs., xrefs: 00FB4DF8
payload.cpp, xrefs: 00FB4DEE
Catalog, xrefs: 00FB5084
Payload, xrefs: 00FB4D87
Failed to get @Packaging., xrefs: 00FB510E
Failed to parse @FileSize., xrefs: 00FB514B
Failed to get @CertificateRootThumbprint., xrefs: 00FB5160
CertificateRootPublicKeyIdentifier, xrefs: 00FB4FDD
Invalid value for @Packaging: %ls, xrefs: 00FB50EC
Failed to get @CertificateRootPublicKeyIdentifier., xrefs: 00FB5152
FilePath, xrefs: 00FB4E5D

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: String$Compare$Variant$AllocClearFreeInit
String ID: Catalog$CertificateRootPublicKeyIdentifier$CertificateRootThumbprint$Container$DownloadUrl$Failed to allocate memory for payload structs.$Failed to find catalog.$Failed to get @Catalog.$Failed to get @CertificateRootPublicKeyIdentifier.$Failed to get @CertificateRootThumbprint.$Failed to get @Container.$Failed to get @DownloadUrl.$Failed to get @FilePath.$Failed to get @FileSize.$Failed to get @Hash.$Failed to get @Id.$Failed to get @LayoutOnly.$Failed to get @Packaging.$Failed to get @SourcePath.$Failed to get next node.$Failed to get payload node count.$Failed to hex decode @CertificateRootPublicKeyIdentifier.$Failed to hex decode @CertificateRootThumbprint.$Failed to hex decode the Payload/@Hash.$Failed to parse @FileSize.$Failed to select payload nodes.$Failed to to find container: %ls$FilePath$FileSize$Hash$Invalid value for @Packaging: %ls$LayoutOnly$Packaging$Payload$SourcePath$X$download$embedded$external$payload.cpp
API String ID: 937563602-2914604125
Opcode ID: bba366e2351883d618e1004a9ccda59b06b08374dcbc1e2316bf6e9bd66a3276
Instruction ID: ef6366fec36a39ad06bfa196b01d2b47a0ab32bea5a7a7032be5d7f42b6e16e2
Opcode Fuzzy Hash: bba366e2351883d618e1004a9ccda59b06b08374dcbc1e2316bf6e9bd66a3276
Instruction Fuzzy Hash: 6DC1C372D40A65BFCB21AA56CD41FEEB768AB14F20F100261F910BB191D779EE01BF91

Function 00FCA8F2 Relevance: 67.0, APIs: 11, Strings: 27, Instructions: 461COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FCA947
_memset.LIBCMT ref: 00FCA980
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,?,00FD3E1D), ref: 00FCAF75
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,?,00FD3E1D), ref: 00FCAF8B

Strings

exeengine.cpp, xrefs: 00FCADC3, 00FCAE6F, 00FCAEA3
%ls -%ls=%ls, xrefs: 00FCAB57, 00FCAB72, 00FCABAA, 00FCABDA, 00FCAC05
"%ls" %s, xrefs: 00FCAA91, 00FCAAEA
Failed to append the list of dependencies to ignore to the command line., xrefs: 00FCAB82
Failed to get cached path for package: %ls, xrefs: 00FCA9C6
Failed to append the list of dependencies to ignore to the obfuscated command line., xrefs: 00FCABBA
D, xrefs: 00FCAD84
Failed to append the list of ancestors to the obfuscated command line., xrefs: 00FCAC15
Failed to run bundle asynchronously from path: %ls, xrefs: 00FCACE6
Process returned error: 0x%x, xrefs: 00FCAE7F
2, xrefs: 00FCAE12
Failed to get bundle element., xrefs: 00FCAB60
Failed to run bundle as embedded from path: %ls, xrefs: 00FCAC9F
Failed to get action arguments for executable package., xrefs: 00FCAA21
Failed to format obfuscated argument string., xrefs: 00FCAACE
"%ls", xrefs: 00FCAB06, 00FCAB26
Failed to run netfx chainer: %ls, xrefs: 00FCAD34
Failed to create executable command., xrefs: 00FCAAA5
Failed to build executable path., xrefs: 00FCA9FC
burn.ignoredependencies, xrefs: 00FCAB61, 00FCAB9F
Failed to format argument string., xrefs: 00FCAA78
burn.ancestors, xrefs: 00FCABC9, 00FCABFA
Failed to create obfuscated executable command., xrefs: 00FCAB3A
Bootstrapper application aborted during EXE progress., xrefs: 00FCAEAD
Failed to CreateProcess on path: %ls, xrefs: 00FCADD3
Failed to wait for executable to complete: %ls, xrefs: 00FCAEC2
Failed to append the list of ancestors to the command line., xrefs: 00FCABEA

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseHandle_memset
String ID: "%ls"$"%ls" %s$%ls -%ls=%ls$2$Bootstrapper application aborted during EXE progress.$D$Failed to CreateProcess on path: %ls$Failed to append the list of ancestors to the command line.$Failed to append the list of ancestors to the obfuscated command line.$Failed to append the list of dependencies to ignore to the command line.$Failed to append the list of dependencies to ignore to the obfuscated command line.$Failed to build executable path.$Failed to create executable command.$Failed to create obfuscated executable command.$Failed to format argument string.$Failed to format obfuscated argument string.$Failed to get action arguments for executable package.$Failed to get bundle element.$Failed to get cached path for package: %ls$Failed to run bundle as embedded from path: %ls$Failed to run bundle asynchronously from path: %ls$Failed to run netfx chainer: %ls$Failed to wait for executable to complete: %ls$Process returned error: 0x%x$burn.ancestors$burn.ignoredependencies$exeengine.cpp
API String ID: 900656945-2335447641
Opcode ID: 5b0645ccbf0c77affb092ba8cfc3509634e5eca5fa4c0a26b6f7d11577481568
Instruction ID: a28555b3b61d43dcbc34ea300b8a3882b623c1c56ef945b8b28df132345887c3
Opcode Fuzzy Hash: 5b0645ccbf0c77affb092ba8cfc3509634e5eca5fa4c0a26b6f7d11577481568
Instruction Fuzzy Hash: 2F02907294021EAFCF20AF55CD8AFE9B7B5AB54304F1404E9E109A2160DB75AEC1FF52

Function 00FCF058 Relevance: 58.1, APIs: 8, Strings: 25, Instructions: 378processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FCF088
GetCurrentProcess.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,00FC0DF6,00000007,?,?,Function_0000F685,?,?), ref: 00FCF0B1

Part of subcall function 00FE057A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,00000000,?,?,00FB9127,00000000), ref: 00FE058E
Part of subcall function 00FE057A: GetProcAddress.KERNEL32(00000000), ref: 00FE0595
Part of subcall function 00FE057A: GetLastError.KERNEL32(?,?,00FB9127,00000000), ref: 00FE05AC

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?), ref: 00FCF2E4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,wusa.exe,?,00000025,?,00000000), ref: 00FCF2EE
GetExitCodeProcess.KERNEL32(?,?), ref: 00FCF37B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,wusa.exe,?,00000025,?,00000000), ref: 00FCF385
CloseHandle.KERNEL32(?,?,000001F4,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025,?), ref: 00FCF497
CloseHandle.KERNEL32(?,?,000001F4,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025,?), ref: 00FCF4A4

Strings

Failed to find System32 directory., xrefs: 00FCF11F
Bootstrapper application aborted during MSU progress., xrefs: 00FCF3DB
Failed to get cached path for package: %ls, xrefs: 00FCF185
Failed to determine WOW64 status., xrefs: 00FCF0C3
"%ls" /uninstall /kb:%ls /quiet /norestart, xrefs: 00FCF1F2
Failed to format MSU uninstall command., xrefs: 00FCF206
Failed to get action arguments for MSU package., xrefs: 00FCF15F
Failed to get process exit code., xrefs: 00FCF3B4
"%ls" "%ls" /quiet /norestart, xrefs: 00FCF1C8
Failed to ensure WU service was enabled to install MSU package., xrefs: 00FCF2AD
Failed to append log path to MSU command-line., xrefs: 00FCF248
2, xrefs: 00FCF343
Failed to append SysNative directory., xrefs: 00FCF104
wusa.exe, xrefs: 00FCF12D
msuengine.cpp, xrefs: 00FCF313, 00FCF3AA, 00FCF3D1
Failed to format MSU install command., xrefs: 00FCF1DC
D, xrefs: 00FCF2D7
Failed to append log switch to MSU command-line., xrefs: 00FCF22E
Failed to build MSU path., xrefs: 00FCF1B5
/log:, xrefs: 00FCF21A
Failed to CreateProcess on path: %ls, xrefs: 00FCF320
SysNative\, xrefs: 00FCF0F1
Failed to wait for executable to complete: %ls, xrefs: 00FCF3E8
Failed to allocate WUSA.exe path., xrefs: 00FCF140
Failed to find Windows directory., xrefs: 00FCF0E3

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorHandleLastProcess$Close$AddressCodeCreateCurrentExitModuleProc_memset
String ID: /log:$"%ls" "%ls" /quiet /norestart$"%ls" /uninstall /kb:%ls /quiet /norestart$2$Bootstrapper application aborted during MSU progress.$D$Failed to CreateProcess on path: %ls$Failed to allocate WUSA.exe path.$Failed to append SysNative directory.$Failed to append log path to MSU command-line.$Failed to append log switch to MSU command-line.$Failed to build MSU path.$Failed to determine WOW64 status.$Failed to ensure WU service was enabled to install MSU package.$Failed to find System32 directory.$Failed to find Windows directory.$Failed to format MSU install command.$Failed to format MSU uninstall command.$Failed to get action arguments for MSU package.$Failed to get cached path for package: %ls$Failed to get process exit code.$Failed to wait for executable to complete: %ls$SysNative\$msuengine.cpp$wusa.exe
API String ID: 3952624013-2978926632
Opcode ID: 5449b6f8a47e5e46b3219a38cd0758d7b290543d2a777283a3632ee8dfe01abe
Instruction ID: cc310f3d5d270a525592972a8c8e3845b0d1815b4ecdb1ee1c1877a4ffc3558a
Opcode Fuzzy Hash: 5449b6f8a47e5e46b3219a38cd0758d7b290543d2a777283a3632ee8dfe01abe
Instruction Fuzzy Hash: 0DC19072D4015AEFCB11DFA4CD82FAEBB7AAF44710F544039F600A7151DB788989BBA1

Function 00FBA0CB Relevance: 58.1, APIs: 5, Strings: 28, Instructions: 307COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,80070490,?,?,?,?,?,?,?,?,00FD4077,?,?,?), ref: 00FBA0FA
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,00FD4077,?,?,?,?,?,Chain), ref: 00FBA410

Strings

Failed to get @Type., xrefs: 00FBA3D2
variable.cpp, xrefs: 00FBA394
Failed to set variant value., xrefs: 00FBA3CB
Failed to insert variable '%ls'., xrefs: 00FBA3F5
Type, xrefs: 00FBA1FA
Attempt to set built-in variable value: %ls, xrefs: 00FBA3A1
Initializing numeric variable '%ls' to value '%ls', xrefs: 00FBA233
Failed to get @Id., xrefs: 00FBA3AF
numeric, xrefs: 00FBA215
Failed to set value of variable: %ls, xrefs: 00FBA3FF
Initializing version variable '%ls' to value '%ls', xrefs: 00FBA29A
Initializing string variable '%ls' to value '%ls', xrefs: 00FBA265
Failed to get @Value., xrefs: 00FBA3C4
Variable, xrefs: 00FBA104
Initializing hidden variable '%ls', xrefs: 00FBA2B7
Failed to get @Hidden., xrefs: 00FBA3B6
Failed to select variable nodes., xrefs: 00FBA117
Failed to get @Persisted., xrefs: 00FBA3BD
Invalid value for @Type: %ls, xrefs: 00FBA382
Failed to get next node., xrefs: 00FBA3A8
Failed to get variable node count., xrefs: 00FBA134
string, xrefs: 00FBA247
Persisted, xrefs: 00FBA1A1
Hidden, xrefs: 00FBA186
Failed to find variable value '%ls'., xrefs: 00FBA3EB
Value, xrefs: 00FBA1BC
Failed to change variant type., xrefs: 00FBA3D9
version, xrefs: 00FBA278

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Attempt to set built-in variable value: %ls$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$numeric$string$variable.cpp$version
API String ID: 3168844106-1657652604
Opcode ID: 038f1827d86a6ab6329c95a9f466c22fdd02198a49000c46445047998a8fd77b
Instruction ID: fd0e42d8560608d36ac7449a492e043307e69e0f68534ea1257cf7e720b9fa5a
Opcode Fuzzy Hash: 038f1827d86a6ab6329c95a9f466c22fdd02198a49000c46445047998a8fd77b
Instruction Fuzzy Hash: BFA17C72D00229FBCB10AFD2CC85DEEBBB9AF04710B144566F611B7161D67A9E41BF82

Function 00FD5363 Relevance: 51.0, APIs: 13, Strings: 16, Instructions: 294COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FD53BE
UuidCreate.RPCRT4(?), ref: 00FD53D6
StringFromGUID2.OLE32(?,?,00000027), ref: 00FD53F7
CloseHandle.KERNEL32(?,NetFxChainer.cpp,000001A8,00000000,?,?,?,?), ref: 00FD56F9
CloseHandle.KERNEL32(?,NetFxChainer.cpp,000001A8,00000000,?,?,?,?), ref: 00FD570F

Strings

Failed to send internal error message from netfx chainer., xrefs: 00FD5672
Failed to allocate event name., xrefs: 00FD5462
Failed to create netfx chainer., xrefs: 00FD5481
%ls /pipe %ls, xrefs: 00FD549D
NetFxSection.%ls, xrefs: 00FD5427
D, xrefs: 00FD54D3
NetFxEvent.%ls, xrefs: 00FD544E
Failed to allocate netfx chainer arguments., xrefs: 00FD54B1
Failed to wait for netfx chainer process to complete, xrefs: 00FD56A8
NetFxChainer.cpp, xrefs: 00FD540C, 00FD550F, 00FD5615, 00FD569E
Failed to process netfx chainer message., xrefs: 00FD5570
Failed to create netfx chainer guid., xrefs: 00FD53E3
Failed to CreateProcess on path: %ls, xrefs: 00FD551C
Failed to convert netfx chainer guid into string., xrefs: 00FD5416
Failed to allocate section name., xrefs: 00FD543D
Failed to get netfx return code., xrefs: 00FD561F

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseHandle$CreateFromStringUuid_memset
String ID: %ls /pipe %ls$D$Failed to CreateProcess on path: %ls$Failed to allocate event name.$Failed to allocate netfx chainer arguments.$Failed to allocate section name.$Failed to convert netfx chainer guid into string.$Failed to create netfx chainer guid.$Failed to create netfx chainer.$Failed to get netfx return code.$Failed to process netfx chainer message.$Failed to send internal error message from netfx chainer.$Failed to wait for netfx chainer process to complete$NetFxChainer.cpp$NetFxEvent.%ls$NetFxSection.%ls
API String ID: 2223292257-4284037740
Opcode ID: afcbc66b3ae05301efae06ca887119e85fc174609667e7e53774deb907a9a136
Instruction ID: fa2bd0b675ce825f67d4683ed02fd519929d445ad885959e70dc45787b48fd5c
Opcode Fuzzy Hash: afcbc66b3ae05301efae06ca887119e85fc174609667e7e53774deb907a9a136
Instruction Fuzzy Hash: 5FA1A331E40709AFDB219FA5CC85BAEB7BABF04B10F184066E605E7261E775D940AF11

Function 00FB79A7 Relevance: 44.1, APIs: 8, Strings: 17, Instructions: 313registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00FB79E4
_MREFOpen@16.MSPDB140-MSVCRT ref: 00FB7A0A
RegCloseKey.ADVAPI32(00FB8B48,?,00000000,?,00000000,?,?,?,?,00000000), ref: 00FB7D0F

Strings

Failed to read registry value., xrefs: 00FB7C90
Failed to query registry key value size., xrefs: 00FB7AEF
Failed to query registry key value., xrefs: 00FB7B73
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 00FB7AAB
Failed to set variable., xrefs: 00FB7CC7
Failed to change value type., xrefs: 00FB7CA9
RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 00FB7CDC
Failed to get expand environment string., xrefs: 00FB7C75
Failed to format value string., xrefs: 00FB7A15
Failed to clear variable., xrefs: 00FB7A65
Failed to format key string., xrefs: 00FB79EF
Failed to allocate memory registry value., xrefs: 00FB7B23
Unsupported registry key value type. Type = '%u', xrefs: 00FB7B9B
Registry key not found. Key = '%ls'; variable = '%ls', xrefs: 00FB7A3F
search.cpp, xrefs: 00FB7AE5, 00FB7B19, 00FB7B69, 00FB7C6B
Failed to open registry key., xrefs: 00FB7A7A
Failed to allocate string buffer., xrefs: 00FB7C00

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Open@16$Close
String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'; variable = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$search.cpp
API String ID: 2348241696-822975546
Opcode ID: da0bdd4e4361ee5b2595a35186689f2ae855b13f30322f881f2e3b1456bf8865
Instruction ID: efd5f298ef61e1d713be37f9901161f24e194f0081e3469c298e48a2e884d1e5
Opcode Fuzzy Hash: da0bdd4e4361ee5b2595a35186689f2ae855b13f30322f881f2e3b1456bf8865
Instruction Fuzzy Hash: A7A1C672D0435ABBDF22ABA6CC01EEE7E79AF84710F144165F900BA291D675DE00BF91

Function 00FB2BC3 Relevance: 44.0, APIs: 17, Strings: 8, Instructions: 232filepipesleepCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(CAE5E856,00000000,00FB130D,80070642,?,00FBBD45,00FB130D,?,75C0B390,?,?,00FB130D), ref: 00FB2BE4
GetCurrentProcessId.KERNEL32(?,00FBBD45,00FB130D,?,75C0B390,?,?,00FB130D), ref: 00FB2BEF
SetNamedPipeHandleState.KERNEL32(?,?,00000000,00000000,?,00FBBD45,00FB130D,?,75C0B390,?), ref: 00FB2C2B
ConnectNamedPipe.KERNEL32(?,00000000,?,00FBBD45,00FB130D,?,75C0B390,?), ref: 00FB2C46
GetLastError.KERNEL32(?,00FBBD45,00FB130D,?,75C0B390,?), ref: 00FB2C50
Sleep.KERNEL32(00000064,?,00FBBD45,00FB130D,?,75C0B390,?), ref: 00FB2C7B
SetNamedPipeHandleState.KERNEL32(?,00000001,00000000,00000000,?,00FBBD45,00FB130D,?,75C0B390,?), ref: 00FB2CB3
WriteFile.KERNEL32(?,?,00000004,000000FF,00000000,?,00FBBD45,00FB130D,?,75C0B390,?), ref: 00FB2CD4
WriteFile.KERNEL32(?,75C0B390,?,000000FF,00000000,?,00FBBD45,00FB130D,?,75C0B390,?), ref: 00FB2CF5
WriteFile.KERNEL32(?,?,00000004,000000FF,00000000,?,00FBBD45,00FB130D,?,75C0B390,?), ref: 00FB2D16
ReadFile.KERNEL32(?,00FB130D,00000004,000000FF,00000000,?,00FBBD45,00FB130D,?,75C0B390,?), ref: 00FB2D37
GetLastError.KERNEL32(?,00FBBD45,00FB130D,?,75C0B390,?), ref: 00FB2D76
GetLastError.KERNEL32(?,00FBBD45,00FB130D,?,75C0B390,?), ref: 00FB2DA9
GetLastError.KERNEL32(?,00FBBD45,00FB130D,?,75C0B390,?), ref: 00FB2DDC
GetLastError.KERNEL32(?,00FBBD45,00FB130D,?,75C0B390,?), ref: 00FB2E0F
GetLastError.KERNEL32(?,00FBBD45,00FB130D,?,75C0B390,?), ref: 00FB2E3F
GetLastError.KERNEL32(?,00FBBD45,00FB130D,?,75C0B390,?), ref: 00FB2E6F

Strings

pipe.cpp, xrefs: 00FB2D62, 00FB2D95, 00FB2DC8, 00FB2DFB, 00FB2E2E, 00FB2E5E, 00FB2E8E
Failed to write secret length to pipe., xrefs: 00FB2E05
Failed to wait for child to connect to pipe., xrefs: 00FB2D6C
Failed to set pipe to non-blocking., xrefs: 00FB2D9F
Failed to write secret to pipe., xrefs: 00FB2E38
Failed to write our process id to pipe., xrefs: 00FB2E68
Failed to read ACK from pipe., xrefs: 00FB2E98
Failed to reset pipe to blocking., xrefs: 00FB2DD2

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
String ID: Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$pipe.cpp
API String ID: 2944378912-2009266399
Opcode ID: 184c63b8454bc5b72c86c59b41f07109bff7b501b2b03ffb2ef83242649cc051
Instruction ID: eefe259c7d20de635607960a3537e20d5d0d69db4787f2769cf6c1ba28c63492
Opcode Fuzzy Hash: 184c63b8454bc5b72c86c59b41f07109bff7b501b2b03ffb2ef83242649cc051
Instruction Fuzzy Hash: 5471A472B4025AABD7509F9BCC49FDF7BA8AF08761F154025BE14EA190D774C900BFA1

Function 00FDA03B Relevance: 42.1, APIs: 18, Strings: 6, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00FD83D7), ref: 00FDA043
__mtterm.LIBCMT ref: 00FDA04F

Part of subcall function 00FD9D88: DecodePointer.KERNEL32(00000005,00FDA1B1,?,00FD83D7), ref: 00FD9D99
Part of subcall function 00FD9D88: TlsFree.KERNEL32(00000011,00FDA1B1,?,00FD83D7), ref: 00FD9DB3
Part of subcall function 00FD9D88: DeleteCriticalSection.KERNEL32(00000000,00000000,76EF5810,?,00FDA1B1,?,00FD83D7), ref: 00FDBD38
Part of subcall function 00FD9D88: _free.LIBCMT ref: 00FDBD3B
Part of subcall function 00FD9D88: DeleteCriticalSection.KERNEL32(00000011,76EF5810,?,00FDA1B1,?,00FD83D7), ref: 00FDBD62

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00FDA065
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00FDA072
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00FDA07F
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00FDA08C
TlsAlloc.KERNEL32(?,00FD83D7), ref: 00FDA0DC
TlsSetValue.KERNEL32(00000000,?,00FD83D7), ref: 00FDA0F7
__init_pointers.LIBCMT ref: 00FDA101
EncodePointer.KERNEL32(?,00FD83D7), ref: 00FDA112
EncodePointer.KERNEL32(?,00FD83D7), ref: 00FDA11F
EncodePointer.KERNEL32(?,00FD83D7), ref: 00FDA12C
EncodePointer.KERNEL32(?,00FD83D7), ref: 00FDA139
DecodePointer.KERNEL32(00FD9F0C,?,00FD83D7), ref: 00FDA15A
__calloc_crt.LIBCMT ref: 00FDA16F
DecodePointer.KERNEL32(00000000,?,00FD83D7), ref: 00FDA189
GetCurrentThreadId.KERNEL32 ref: 00FDA19B

Strings

FlsGetValue, xrefs: 00FDA067
PNv, xrefs: 00FDA149
FlsSetValue, xrefs: 00FDA074
FlsFree, xrefs: 00FDA081
FlsAlloc, xrefs: 00FDA05F
KERNEL32.DLL, xrefs: 00FDA03E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL$PNv
API String ID: 3698121176-2259100434
Opcode ID: c7733892b0b35108f51432a5b203de79a0b5f9c020942e3d417db77e74d82404
Instruction ID: 55fc6e83d96217b451cc592664303f3e68fec369161a9d31ad6ca4704c40b23b
Opcode Fuzzy Hash: c7733892b0b35108f51432a5b203de79a0b5f9c020942e3d417db77e74d82404
Instruction Fuzzy Hash: 2031BF31D803559ED723AFB5AC0864A3EE6EB44320F18012BE4D4873A9EB7EA541FF51

Function 00FD5098 Relevance: 40.5, APIs: 12, Strings: 11, Instructions: 232synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE28F3: GetProcessHeap.KERNEL32(00FD6AA0,?,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000), ref: 00FE2904
Part of subcall function 00FE28F3: RtlAllocateHeap.NTDLL(00000000,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000), ref: 00FE290B

CreateEventW.KERNEL32(00000000,00000000,00000000,?,00000018,00000001,00000000,00000000,00000000,?,?,00FD547B,?,?,?), ref: 00FD50D6
GetLastError.KERNEL32(?,?,00FD547B,?,?,?), ref: 00FD50E3
ReleaseMutex.KERNEL32(?), ref: 00FD534F

Strings

NetFxChainer.cpp, xrefs: 00FD50BB, 00FD5105, 00FD516D, 00FD51DD, 00FD5230, 00FD5279
Failed to memory map cabinet file: %ls, xrefs: 00FD523D
Failed to MapViewOfFile for %ls., xrefs: 00FD5286
Failed to create mutex: %ls, xrefs: 00FD51EA
failed to allocate memory for event name, xrefs: 00FD512E
%ls_mutex, xrefs: 00FD518A
Failed to allocate memory for NetFxChainer struct., xrefs: 00FD50C5
Failed to create event: %ls, xrefs: 00FD517A
failed to allocate memory for mutex name, xrefs: 00FD519E
failed to copy event name to shared memory structure., xrefs: 00FD52B2
%ls_send, xrefs: 00FD511A

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Heap$AllocateCreateErrorEventLastMutexProcessRelease
String ID: %ls_mutex$%ls_send$Failed to MapViewOfFile for %ls.$Failed to allocate memory for NetFxChainer struct.$Failed to create event: %ls$Failed to create mutex: %ls$Failed to memory map cabinet file: %ls$NetFxChainer.cpp$failed to allocate memory for event name$failed to allocate memory for mutex name$failed to copy event name to shared memory structure.
API String ID: 3944734951-2991465304
Opcode ID: e173e7c6919685cd5bff78bd5de3bbe5ac08c709d87923a1e5c6524ec032856c
Instruction ID: 3193c1a431d1ba1af58aaab8aa86e788ef6f3ab4b8acde4cc32d6957c20ca16c
Opcode Fuzzy Hash: e173e7c6919685cd5bff78bd5de3bbe5ac08c709d87923a1e5c6524ec032856c
Instruction Fuzzy Hash: 4E71E5B264074AEFC730AF60CCC9E6E3BA6AF14B50F184839F6159B360D679D844B721

Function 00FD4677 Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 337COMMON

Download Yara Rule

Strings

Failed to copy display name for pseudo bundle., xrefs: 00FD4A49
-%ls, xrefs: 00FD468F
Failed to append relation type to install arguments for related bundle package, xrefs: 00FD48E1
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 00FD46F9
Failed to allocate memory for pseudo bundle payload hash., xrefs: 00FD47EF
Failed to append relation type to repair arguments for related bundle package, xrefs: 00FD4929
Failed to copy key for pseudo bundle payload., xrefs: 00FD473B
pseudobundle.cpp, xrefs: 00FD46BC, 00FD46EF, 00FD47E5, 00FD49D8
Failed to copy key for pseudo bundle., xrefs: 00FD4881
Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 00FD46C6
Failed to copy repair arguments for related bundle package, xrefs: 00FD4908
Failed to copy uninstall arguments for related bundle package, xrefs: 00FD495A
Failed to copy download source for pseudo bundle., xrefs: 00FD47AF
Failed to copy version for pseudo bundle., xrefs: 00FD4A28
Failed to copy filename for pseudo bundle., xrefs: 00FD475E
Failed to copy local source path for pseudo bundle., xrefs: 00FD4781
Failed to copy cache id for pseudo bundle., xrefs: 00FD489F
Failed to copy install arguments for related bundle package, xrefs: 00FD48C0
Failed to allocate memory for dependency providers., xrefs: 00FD49E2
Failed to append relation type to uninstall arguments for related bundle package, xrefs: 00FD497B

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$pseudobundle.cpp
API String ID: 1357844191-2832335422
Opcode ID: b8e97428c6b44c14ca8c510dce7b707b89aa9411407d9f75a7cdb48bcc85d914
Instruction ID: 46ccff4fd0296bdd24506a63bd9c5d9478240cf272fd7368458b9457f980839c
Opcode Fuzzy Hash: b8e97428c6b44c14ca8c510dce7b707b89aa9411407d9f75a7cdb48bcc85d914
Instruction Fuzzy Hash: 19C1C036640785EBDB22DF66CC41F6A76A6AF84710F18441AF61A973A1DB78F800FB11

Function 00FCE0ED Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 320COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FCE15B

Strings

Failed to append patch., xrefs: 00FCE2CC
PATCH=", xrefs: 00FCE3BA
IGNOREDEPENDENCIES, xrefs: 00FCE468
Failed to enable logging for package: %ls to: %ls, xrefs: 00FCE2F9
Failed to semi-colon delimit patches., xrefs: 00FCE2C5
Failed to get cached path for MSP package: %ls, xrefs: 00FCE29E
Failed to build MSP path., xrefs: 00FCE2B3
Failed to add PATCH property on install., xrefs: 00FCE3D1
Failed to add reboot suppression property on install., xrefs: 00FCE416
Failed to install MSP package., xrefs: 00FCE442
Failed to uninstall MSP package., xrefs: 00FCE4B5
Failed to add properties to obfuscated argument string., xrefs: 00FCE36D
REBOOT=ReallySuppress, xrefs: 00FCE44A
Failed to add reboot suppression property on uninstall., xrefs: 00FCE461
" REBOOT=ReallySuppress, xrefs: 00FCE3FF
Failed to add properties to argument string., xrefs: 00FCE337
%ls %ls=ALL, xrefs: 00FCE479
Failed to initialize external UI handler., xrefs: 00FCE1C0
Failed to add the list of dependencies to ignore to the properties., xrefs: 00FCE48D
Failed to add patches to PATCH property on install., xrefs: 00FCE3F4

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset
String ID: PATCH="$ REBOOT=ReallySuppress$" REBOOT=ReallySuppress$%ls %ls=ALL$Failed to add PATCH property on install.$Failed to add patches to PATCH property on install.$Failed to add properties to argument string.$Failed to add properties to obfuscated argument string.$Failed to add reboot suppression property on install.$Failed to add reboot suppression property on uninstall.$Failed to add the list of dependencies to ignore to the properties.$Failed to append patch.$Failed to build MSP path.$Failed to enable logging for package: %ls to: %ls$Failed to get cached path for MSP package: %ls$Failed to initialize external UI handler.$Failed to install MSP package.$Failed to semi-colon delimit patches.$Failed to uninstall MSP package.$IGNOREDEPENDENCIES
API String ID: 2102423945-1976012679
Opcode ID: 79fe99bc6856abb9734df0abb77707080c8e34384fb253d3062a2fdf55b414eb
Instruction ID: 67e7e8984d6ed323b85af10821a0ad5e4d1b549e0cc1a25204b167f9153b986e
Opcode Fuzzy Hash: 79fe99bc6856abb9734df0abb77707080c8e34384fb253d3062a2fdf55b414eb
Instruction Fuzzy Hash: BBC1B171A0061AAFCB20DF95CD82FA9B7B6BF88310F1440E9F109A3151D6769EA0FF41

Function 00FC67FB Relevance: 35.4, APIs: 8, Strings: 12, Instructions: 416COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,?,00000001,00FC75FF,?,?,00000000,?,?,?,?,00FC75FF,00000000,?,?), ref: 00FC682E

Strings

AND, xrefs: 00FC6B10
Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d., xrefs: 00FC6C2B
Failed to parse condition "%ls". Invalid version format, at position %d., xrefs: 00FC6A94
@, xrefs: 00FC6834
NOT, xrefs: 00FC6B30
Failed to parse condition "%ls". Unterminated literal at position %d., xrefs: 00FC68F7
Failed to set symbol value., xrefs: 00FC6B74
Failed to parse condition "%ls". Unexpected '~' operator at position %d., xrefs: 00FC6C7C
condition.cpp, xrefs: 00FC68DD, 00FC6999, 00FC6A1B, 00FC6A7A, 00FC6BE2, 00FC6C11, 00FC6C62
Failed to parse condition "%ls". Unexpected character at position %d., xrefs: 00FC69B3
Failed to parse condition "%ls". Constant too big, at position %d., xrefs: 00FC6BFC
Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d., xrefs: 00FC6A35

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: StringType
String ID: @$AND$Failed to parse condition "%ls". Constant too big, at position %d.$Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d.$Failed to parse condition "%ls". Invalid version format, at position %d.$Failed to parse condition "%ls". Unexpected '~' operator at position %d.$Failed to parse condition "%ls". Unexpected character at position %d.$Failed to parse condition "%ls". Unterminated literal at position %d.$Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d.$Failed to set symbol value.$NOT$condition.cpp
API String ID: 4177115715-289295652
Opcode ID: 19c46408c0b857fe232a640cb862cf02a66228911cbbfe44e238b6eb32b3174f
Instruction ID: 800967ec89054c1d0c2143ff0944aee30ee3947e3e54d8e67ea452d1900ebb53
Opcode Fuzzy Hash: 19c46408c0b857fe232a640cb862cf02a66228911cbbfe44e238b6eb32b3174f
Instruction Fuzzy Hash: F7E1E471A0874AEBDB318F50CA4AFBABBB4FF44714F20451DE182DA590D7B89984F750

Function 00FB5BC5 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 222COMMON

Download Yara Rule

Strings

Addon, xrefs: 00FB5D10
Detect, xrefs: 00FB5C80
Invalid value for @Action: %ls, xrefs: 00FB5DB0
Failed to resize Patch code array in registration, xrefs: 00FB5E26
Failed to get next RelatedBundle element., xrefs: 00FB5DFC
Failed to resize Detect code array in registration, xrefs: 00FB5E11
Patch, xrefs: 00FB5D55
Failed to resize Upgrade code array in registration, xrefs: 00FB5E18
Failed to get @Action., xrefs: 00FB5E03
Failed to get @Id., xrefs: 00FB5E0A
Failed to resize Addon code array in registration, xrefs: 00FB5E1F
RelatedBundle, xrefs: 00FB5BD3
Upgrade, xrefs: 00FB5CC8
Failed to get RelatedBundle element count., xrefs: 00FB5C12
Action, xrefs: 00FB5C44
Failed to get RelatedBundle nodes, xrefs: 00FB5BF5

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID:
String ID: Action$Addon$Detect$Failed to get @Action.$Failed to get @Id.$Failed to get RelatedBundle element count.$Failed to get RelatedBundle nodes$Failed to get next RelatedBundle element.$Failed to resize Addon code array in registration$Failed to resize Detect code array in registration$Failed to resize Patch code array in registration$Failed to resize Upgrade code array in registration$Invalid value for @Action: %ls$Patch$RelatedBundle$Upgrade
API String ID: 0-3660206225
Opcode ID: 01fce7503329e9992b1055d9740c05ba99f10779a1f65ef0fe6b76b9873eac3b
Instruction ID: 652b511a8deeaa46346bf809f5907f8dc2ba81fa45ec01df90935fa008cbf099
Opcode Fuzzy Hash: 01fce7503329e9992b1055d9740c05ba99f10779a1f65ef0fe6b76b9873eac3b
Instruction Fuzzy Hash: 71718371940B05AFDB10DE52CC85FAE77B5EB48B54F204518F641AB281D679EA02FF11

Function 00FBC344 Relevance: 33.6, APIs: 6, Strings: 13, Instructions: 354synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBBB67: EnterCriticalSection.KERNEL32(?,?,?,00000000,?,00FBD9EF,?,00000000,75C0B390,?,00000000), ref: 00FBBB76
Part of subcall function 00FBBB67: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 00FBBB83
Part of subcall function 00FBBB67: LeaveCriticalSection.KERNEL32(?,?,00FBD9EF,?,00000000,75C0B390,?,00000000), ref: 00FBBB98

ReleaseMutex.KERNEL32(?,00FB138B,00000000,?,00FB13BB,00000001,00000000), ref: 00FBC727
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00FB1303,?,?,00FB180F), ref: 00FBC730
CloseHandle.KERNEL32(?,00FB138B,00000000,?,00FB13BB,00000001,00000000), ref: 00FBC74F

Part of subcall function 00FD17E8: SetThreadExecutionState.KERNEL32(80000001), ref: 00FD17ED

Strings

core.cpp, xrefs: 00FBC3E8, 00FBC60D
Engine cannot start apply because it is busy with another action., xrefs: 00FBC3A2
Failed to create cache thread., xrefs: 00FBC617
Failed to set initial apply variables., xrefs: 00FBC45D
UX aborted apply begin., xrefs: 00FBC3F2
Another per-machine setup is already executing., xrefs: 00FBC523
Failed to register bundle., xrefs: 00FBC548
Failed to elevate., xrefs: 00FBC4E9
Failed to cache engine to working directory., xrefs: 00FBC4C5
Another per-user setup is already executing., xrefs: 00FBC433
Failed while caching, aborting execution., xrefs: 00FBC633
Failed to send completion over the pipe., xrefs: 00FBC58F
Posted message to parent process to signal that the parent process can stop waiting, xrefs: 00FBC599

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseCriticalHandleSection$CompareEnterExchangeExecutionInterlockedLeaveMutexReleaseStateThread
String ID: Another per-machine setup is already executing.$Another per-user setup is already executing.$Engine cannot start apply because it is busy with another action.$Failed to cache engine to working directory.$Failed to create cache thread.$Failed to elevate.$Failed to register bundle.$Failed to send completion over the pipe.$Failed to set initial apply variables.$Failed while caching, aborting execution.$Posted message to parent process to signal that the parent process can stop waiting$UX aborted apply begin.$core.cpp
API String ID: 1740103319-3198874528
Opcode ID: 8ca9cdad832ed0dde335f70846398fedc46ecd3a005d60734299e3a477213ab3
Instruction ID: 390348d7b1f12ba57651c609eaca86c4ea240bb53f341bce3c32041133b9dd4c
Opcode Fuzzy Hash: 8ca9cdad832ed0dde335f70846398fedc46ecd3a005d60734299e3a477213ab3
Instruction Fuzzy Hash: E9C18572900209EFCB20AFA5CC85EEF77B9BB44310F14442EF21AA6151DB759A45FF91

Function 00FD58D5 Relevance: 33.4, APIs: 8, Strings: 11, Instructions: 189COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,00FD3ED5,00000000), ref: 00FD58E1
_memset.LIBCMT ref: 00FD58FC
CloseHandle.KERNEL32(00FCACD6,00000000,00FD5839,00FD5B2C,?,?,?,?,00000000,?,?,00000001,?), ref: 00FD5AA1
CloseHandle.KERNEL32(?,00000000,00FD5839,00FD5B2C,?,?,?,?,00000000,?,?,00000001,?), ref: 00FD5AAE
CloseHandle.KERNEL32(?,00000000,00FD5839,00FD5B2C,?,?,?,?,00000000,?,?,00000001,?), ref: 00FD5AC8

Part of subcall function 00FB35AD: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 00FB35DA
Part of subcall function 00FB35AD: GetLastError.KERNEL32(00000000,00FB17A1,00FBBD45,00FB130D,?), ref: 00FB35E3
Part of subcall function 00FB35AD: LocalFree.KERNEL32(?,00FB130D), ref: 00FB3746

Strings

Failed to create embedded process atpath: %ls, xrefs: 00FD5A09
Failed to process messages from embedded message., xrefs: 00FD5A56
Failed to create embedded pipe name and client token., xrefs: 00FD595C
Failed to wait for embedded executable: %ls, xrefs: 00FD5A85
embedded.cpp, xrefs: 00FD59FC
Failed to wait for embedded process to connect to pipe., xrefs: 00FD5A34
%ls -%ls %ls %ls %u, xrefs: 00FD5994
Failed to create embedded pipe., xrefs: 00FD597A
Failed to allocate embedded command., xrefs: 00FD59A8
burn.embedded, xrefs: 00FD5944
burn.embedded.async, xrefs: 00FD593A, 00FD5990

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseHandle$DescriptorSecurity$ConvertCurrentErrorFreeLastLocalProcessString_memset
String ID: %ls -%ls %ls %ls %u$Failed to allocate embedded command.$Failed to create embedded pipe name and client token.$Failed to create embedded pipe.$Failed to create embedded process atpath: %ls$Failed to process messages from embedded message.$Failed to wait for embedded executable: %ls$Failed to wait for embedded process to connect to pipe.$burn.embedded$burn.embedded.async$embedded.cpp
API String ID: 1195026954-3691304899
Opcode ID: 8f8f38143d572ebe18f18ed572185d7251cca93c57bc8ab4def7d4659a5510db
Instruction ID: 855d2171d509a6f2c02598cc4e7b7b3be472ab140c9fd90583f44b08472561bc
Opcode Fuzzy Hash: 8f8f38143d572ebe18f18ed572185d7251cca93c57bc8ab4def7d4659a5510db
Instruction Fuzzy Hash: BE518572D0062DFBCF11DFE5DC81DEEBBB9AF08B10F144523F601A6260D6798A45AB91

Function 00FC7F13 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 206fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00FB130D,40000000,00000005,00000000,00000002,08000080,00000000,00000000,00000000,00000000,00FB130D,00FB179D,?,00FB1355,?,00000000), ref: 00FC7F52
GetLastError.KERNEL32(?,00FB130D,?,?,00FB180F,?,?,?,00FB1E12,?), ref: 00FC7F60

Part of subcall function 00FE5DFA: ReadFile.KERNEL32(?,?,?,?,00000000,00000000,75C0B390,00000000,?,00FC7FDD,?,?,?,00000000,00000000,?), ref: 00FE5E96

SetFilePointerEx.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00FC800F
GetLastError.KERNEL32(?,00FB130D,?,?,00FB180F,?,?,?,00FB1E12,?), ref: 00FC8019
CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00FB130D,?,?,00FB180F), ref: 00FC8153

Strings

Failed to seek to signature table in exe header., xrefs: 00FC80B3
Failed to create engine file at path: %ls, xrefs: 00FC7F92
Failed to copy engine from: %ls to: %ls, xrefs: 00FC7FE9
Failed to seek to beginning of engine file: %ls, xrefs: 00FC7FBA
cache.cpp, xrefs: 00FC7F85, 00FC803E, 00FC80A9, 00FC811E
Failed to seek to original data in exe burn section header., xrefs: 00FC8128
Failed to zero out original data offset., xrefs: 00FC8143
Failed to seek to checksum in exe header., xrefs: 00FC8048
Failed to update signature offset., xrefs: 00FC8066

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: File$ErrorLast$CloseCreateHandlePointerRead
String ID: Failed to copy engine from: %ls to: %ls$Failed to create engine file at path: %ls$Failed to seek to beginning of engine file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$cache.cpp
API String ID: 3456208997-3092846023
Opcode ID: 903c43485be1d7b1019345c3c65f5a6a09014d17f2ddebade9132ba18e04e7d2
Instruction ID: 53d77430c24a8724fb625a32748a24e0f3182c11c066967fd589e34fa1aecfa9
Opcode Fuzzy Hash: 903c43485be1d7b1019345c3c65f5a6a09014d17f2ddebade9132ba18e04e7d2
Instruction Fuzzy Hash: B351C472A4014BBED7106B64CD87F7F76B9EB44790F15042CF201E71A0DA799C46B762

Function 00FC6467 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 172windowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE7A58: GdiplusStartup.GDIPLUS(?,?,?,00000000,?,00FC64BE,?,?,?), ref: 00FE7A65

LoadCursorW.USER32(00000000,00007F00), ref: 00FC6506
RegisterClassW.USER32(?), ref: 00FC651A
GetLastError.KERNEL32 ref: 00FC6525
CreateWindowExW.USER32(00000080,00FF758C,?,90000000,?,?,?,?,00000000,00000000,?,?), ref: 00FC658B
GetLastError.KERNEL32 ref: 00FC6598
SetEvent.KERNEL32(?), ref: 00FC65DB
IsDialogMessageW.USER32(?,?), ref: 00FC65F5
TranslateMessage.USER32(?), ref: 00FC6603
DispatchMessageW.USER32(?), ref: 00FC660D
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00FC661A
UnregisterClassW.USER32(WixBurnSplashScreen,?), ref: 00FC6640

Strings

splashscreen.cpp, xrefs: 00FC654F, 00FC65C2
WixBurnSplashScreen, xrefs: 00FC6513, 00FC663B
Failed to load splash screen., xrefs: 00FC64EC
Failed to register window., xrefs: 00FC6559
Failed to create window., xrefs: 00FC65CC
Unexpected return value from message pump., xrefs: 00FC6627
Failed to initialize GDI+., xrefs: 00FC64C8

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Message$ClassErrorLast$CreateCursorDialogDispatchEventGdiplusLoadRegisterStartupTranslateUnregisterWindow
String ID: Failed to create window.$Failed to initialize GDI+.$Failed to load splash screen.$Failed to register window.$Unexpected return value from message pump.$WixBurnSplashScreen$splashscreen.cpp
API String ID: 515895837-4030304179
Opcode ID: 1990557d36f9b037ddb00806f217fdf7276aedbc1ac19734c88221d0eb6c939b
Instruction ID: 5f97b4878f61489e3df12ab1f4626ae3e12f85ec057ea93bfe80aa705b9ccd97
Opcode Fuzzy Hash: 1990557d36f9b037ddb00806f217fdf7276aedbc1ac19734c88221d0eb6c939b
Instruction Fuzzy Hash: 745149B2D0821AEFDB11DFE4CD46EAEBBB9FF08710F204419E215EA150D7759A40EB90

Function 00FD38F1 Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 210threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000001,?,00000000,000000FF,00000001,00000000,?,?,?,?,00FD3E1D,00000001,00000000,000000B9,00000000,?), ref: 00FD394A
GetExitCodeThread.KERNEL32(?,00000001,?,?,?,?,00FD3E1D,00000001,00000000,000000B9,00000000,?,?,?,000000B9,00000000), ref: 00FD3966
GetLastError.KERNEL32(?,?,?,?,00FD3E1D,00000001,00000000,000000B9,00000000,?,?,?,000000B9,00000000,00000001,00000000), ref: 00FD3974
GetLastError.KERNEL32(?,?,?,?,00FD3E1D,00000001,00000000,000000B9,00000000,?,?,?,000000B9,00000000,00000001,00000000), ref: 00FD3B3A

Strings

Failed to execute MSU package., xrefs: 00FD3A62
Failed to execute dependency action., xrefs: 00FD3A98
Failed to wait for cache check-point., xrefs: 00FD3B6E
Failed to load compatible package on per-machine package., xrefs: 00FD3ABE
Cache thread exited unexpectedly., xrefs: 00FD3B30
Failed to execute MSP package., xrefs: 00FD3A2D
Failed to execute package provider registration action., xrefs: 00FD3A7D
Failed to execute MSI package., xrefs: 00FD3A02
Failed to get cache thread exit code., xrefs: 00FD39A8
Failed to execute EXE package., xrefs: 00FD39D7
Invalid execute action., xrefs: 00FD3B0D
apply.cpp, xrefs: 00FD399E, 00FD3B64
Failed to execute compatible package action., xrefs: 00FD3AD2

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$CodeExitMultipleObjectsThreadWait
String ID: Cache thread exited unexpectedly.$Failed to execute EXE package.$Failed to execute MSI package.$Failed to execute MSP package.$Failed to execute MSU package.$Failed to execute compatible package action.$Failed to execute dependency action.$Failed to execute package provider registration action.$Failed to get cache thread exit code.$Failed to load compatible package on per-machine package.$Failed to wait for cache check-point.$Invalid execute action.$apply.cpp
API String ID: 3703294532-2662572847
Opcode ID: 43e2933a3df7be796690dbbe74e3217a3c0d89fe71701daee6b991595cb363ea
Instruction ID: 1c60def1602bce25f0c3edacd16e775531ed81b1ad599fe16bf970e6256027d6
Opcode Fuzzy Hash: 43e2933a3df7be796690dbbe74e3217a3c0d89fe71701daee6b991595cb363ea
Instruction Fuzzy Hash: 4E712B76B0420AEB9B05DF94CC419BE7BBAAF44350B14406BFA05EB350E779DB40BB52

Function 00FB8019 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 208COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00FB808E
_MREFOpen@16.MSPDB140-MSVCRT ref: 00FB81B4

Strings

Failed to format product code string., xrefs: 00FB81C3
Failed to format upgrade code string., xrefs: 00FB8099
Failed to find product for UpgradeCode: %ls, xrefs: 00FB80C0
Trying per-user extended info for property '%ls' for product: %ls, xrefs: 00FB8141
Failed to set variable., xrefs: 00FB8227
Failed to change value type., xrefs: 00FB8209
Language, xrefs: 00FB8065
No products found for UpgradeCode: %ls, xrefs: 00FB80D6
Product not found: %ls, xrefs: 00FB816C
MsiProductSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 00FB8237
State, xrefs: 00FB805C
VersionString, xrefs: 00FB806E
Trying per-machine extended info for property '%ls' for product: %ls, xrefs: 00FB8113
Failed to get product info., xrefs: 00FB81A0
Unsupported product search type: %u, xrefs: 00FB804C

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Open@16
String ID: Failed to change value type.$Failed to find product for UpgradeCode: %ls$Failed to format product code string.$Failed to format upgrade code string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$No products found for UpgradeCode: %ls$Product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
API String ID: 3613110473-2367264253
Opcode ID: 2432b829a945dbf1fd7f51f21a2a71db95b0ebc0adf23fe96605089668b904fa
Instruction ID: 482082ec59ab6759e26dcf775a71cbb4b0bc9669cd9970ba952e4a79798396e5
Opcode Fuzzy Hash: 2432b829a945dbf1fd7f51f21a2a71db95b0ebc0adf23fe96605089668b904fa
Instruction Fuzzy Hash: 8A610272D01159FADF11AF96CC02FEEBA79AB843D0F144065E900BA191DB798A06FF91

Function 00FD75F8 Relevance: 30.0, APIs: 10, Strings: 7, Instructions: 205networkfilememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000004,00000000,00000004,00000080,00000000,?,00000000,?,?,?,000000FF,?), ref: 00FD7630
GetLastError.KERNEL32 ref: 00FD763E
VirtualAlloc.KERNEL32(00000000,00010000,00003000,00000004), ref: 00FD7690
GetLastError.KERNEL32 ref: 00FD769D
InternetCloseHandle.WININET(00000000), ref: 00FD772C
InternetCloseHandle.WININET(?), ref: 00FD773D
InternetCloseHandle.WININET(?), ref: 00FD7820
InternetCloseHandle.WININET(00000000), ref: 00FD782E
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00FD784F
CloseHandle.KERNEL32(000000FF), ref: 00FD785E

Strings

Failed to create download destination file: %ls, xrefs: 00FD7670
Failed to allocate buffer to download files into., xrefs: 00FD76CC
Failed to request URL for download: %ls, xrefs: 00FD77FF
Failed to allocate range request header., xrefs: 00FD77EE
downloadengine.cpp, xrefs: 00FD7663, 00FD76C2
GET, xrefs: 00FD775E
Failed while reading from internet and writing to: %ls, xrefs: 00FD7809

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseHandle$Internet$ErrorLastVirtual$AllocCreateFileFree
String ID: Failed to allocate buffer to download files into.$Failed to allocate range request header.$Failed to create download destination file: %ls$Failed to request URL for download: %ls$Failed while reading from internet and writing to: %ls$GET$downloadengine.cpp
API String ID: 424062026-2629732388
Opcode ID: 9ab0ae82fef1fc56222d015269800d6618a9e1b3e79e3f110552769ddbf04666
Instruction ID: 2ffce5afcec468f8a8e87d28ed0229579f38f2e339320b1edafb63752d01511e
Opcode Fuzzy Hash: 9ab0ae82fef1fc56222d015269800d6618a9e1b3e79e3f110552769ddbf04666
Instruction Fuzzy Hash: 3D714C72D0424AEFCF11AF94CC859EE7B76BF08314F18413AFA11AA260E3759940FB91

Function 00FB6AAD Relevance: 29.9, APIs: 1, Strings: 16, Instructions: 144registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 00FB6C1B

Part of subcall function 00FE4111: RegSetValueExW.KERNELBASE(00020006,?,00000000,00000001,?,00000000,?,000000FF,00000000,00000001,?,?,00FB6994,00000000,?,00020006), ref: 00FE4144

Strings

Failed to create the key for update registration., xrefs: 00FB6AEE
Failed to write %ls value., xrefs: 00FB6C02
PackageVersion, xrefs: 00FB6B3A, 00FB6B3F
Publisher, xrefs: 00FB6B51, 00FB6B56
Date, xrefs: 00FB6BC1
ThisVersionInstalled, xrefs: 00FB6B06, 00FB6B0B, 00FB6B1A
InstalledBy, xrefs: 00FB6BA1, 00FB6BA6
PackageName, xrefs: 00FB6B23, 00FB6B28
InstalledDate, xrefs: 00FB6BBB, 00FB6BC0
PublishingGroup, xrefs: 00FB6B70, 00FB6B75
ReleaseType, xrefs: 00FB6B8A, 00FB6B8F
InstallerVersion, xrefs: 00FB6BEB, 00FB6BF0, 00FB6BF1, 00FB6C01
UninstallString, xrefs: 00FB6ABD
InstallerName, xrefs: 00FB6BD5, 00FB6BDA, 00FB6BDB
LogonUser, xrefs: 00FB6BA7
Failed to get the formatted key path for update registration., xrefs: 00FB6ACD

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseValue
String ID: Date$Failed to create the key for update registration.$Failed to get the formatted key path for update registration.$Failed to write %ls value.$InstalledBy$InstalledDate$InstallerName$InstallerVersion$LogonUser$PackageName$PackageVersion$Publisher$PublishingGroup$ReleaseType$ThisVersionInstalled$UninstallString
API String ID: 3132538880-2375234059
Opcode ID: 8a883ddc95efdb93773c94df7f58f1edbfd710480dd4c5dc75128a7d2f0b41e7
Instruction ID: 7dcad6c032871bcbe80d74db05b6d7455a708aa4cadbb1fbf156dc0eef6a1ed2
Opcode Fuzzy Hash: 8a883ddc95efdb93773c94df7f58f1edbfd710480dd4c5dc75128a7d2f0b41e7
Instruction Fuzzy Hash: E2418376900659BBCB126A538C42EDFBE7ADF847A4B254034F904E7752DF39EE00BA50

Function 00FB18B9 Relevance: 28.2, APIs: 4, Strings: 12, Instructions: 185windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00FB1AC3
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00FB1AD6
CloseHandle.KERNEL32(00000000,?,?,?,00FB1E12,?), ref: 00FB1AE5

Strings

WixBundleLayoutDirectory, xrefs: 00FB1A40
Failed while running , xrefs: 00FB1A75
Failed to open log., xrefs: 00FB18ED
Failed to create the message window., xrefs: 00FB19E3
Failed to connect to elevated parent process., xrefs: 00FB194B
Failed to set layout directory variable to value provided from command-line., xrefs: 00FB1A51
Failed to check global conditions, xrefs: 00FB1997
Failed to initialize internal cache functionality., xrefs: 00FB190A
Failed to create pipes to connect to elevated parent process., xrefs: 00FB1935
Failed to query registration., xrefs: 00FB19F9
Failed to set action variables., xrefs: 00FB1A0F
Failed to set registration variables., xrefs: 00FB1A29

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseHandleMessagePostWindow
String ID: Failed to check global conditions$Failed to connect to elevated parent process.$Failed to create pipes to connect to elevated parent process.$Failed to create the message window.$Failed to initialize internal cache functionality.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3586352542-3026528549
Opcode ID: 0977f3e0340a4eae4266dbd15ba7e4916d9590d7c3970adaa9aebf148dfae3c1
Instruction ID: bf1f6fe43591fae81d014a3427993f67f8e568db9c41f159782c0c07b9897b28
Opcode Fuzzy Hash: 0977f3e0340a4eae4266dbd15ba7e4916d9590d7c3970adaa9aebf148dfae3c1
Instruction Fuzzy Hash: 2C51F732541706FADB21DA22CD65FEB72ADBB40350FA04429F11A92181EF78FA48FF11

Function 00FD786C Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 171networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(Burn,00000000,00000000,00000000,00000000), ref: 00FD78CA
GetLastError.KERNEL32 ref: 00FD78D7
InternetCloseHandle.WININET(00000000), ref: 00FD7A30

Part of subcall function 00FE7AC0: RegCloseKey.ADVAPI32(00000000,?,00000000,?,00000000,00000000), ref: 00FE7B11

InternetSetOptionW.WININET(00000000,00000002,?,00000004), ref: 00FD7943
InternetSetOptionW.WININET(00000000,00000006,?,00000004), ref: 00FD7950
InternetSetOptionW.WININET(00000000,00000005,?,00000004), ref: 00FD795D

Part of subcall function 00FD75F8: CreateFileW.KERNEL32(?,C0000000,00000004,00000000,00000004,00000080,00000000,?,00000000,?,?,?,000000FF,?), ref: 00FD7630
Part of subcall function 00FD75F8: GetLastError.KERNEL32 ref: 00FD763E
Part of subcall function 00FD75F8: VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00FD784F
Part of subcall function 00FD75F8: CloseHandle.KERNEL32(000000FF), ref: 00FD785E

DeleteFileW.KERNEL32(?,?,000000FF,00000000,?,00000001,?,?,?,?,?,?,?,00000078,000000FF,?), ref: 00FD7A06
CloseHandle.KERNEL32(000000FF,?,000000FF,00000000,?,00000001,?,?,?,?,?,?,?,00000078,000000FF,?), ref: 00FD7A15

Strings

Failed to get size and time for URL: %ls, xrefs: 00FD7987
Failed to copy download source URL., xrefs: 00FD78AF
Failed to download URL: %ls, xrefs: 00FD79E9
downloadengine.cpp, xrefs: 00FD78FC
Failed to open internet session, xrefs: 00FD7906
WiX\Burn, xrefs: 00FD7918
Burn, xrefs: 00FD78C5
DownloadTimeout, xrefs: 00FD7913

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Internet$Close$HandleOption$ErrorFileLast$CreateDeleteFreeOpenVirtual
String ID: Burn$DownloadTimeout$Failed to copy download source URL.$Failed to download URL: %ls$Failed to get size and time for URL: %ls$Failed to open internet session$WiX\Burn$downloadengine.cpp
API String ID: 328221957-1870125225
Opcode ID: 97f5ae39f03ca174dc9fd947729ba1b74956513d29d21d5d50ad17a7159d14a9
Instruction ID: c8f87d184052fbdbd0144667a7437999f16706d87f4ebec24775650e33bb71d0
Opcode Fuzzy Hash: 97f5ae39f03ca174dc9fd947729ba1b74956513d29d21d5d50ad17a7159d14a9
Instruction Fuzzy Hash: 12514672D0025ABACF11AFD0CC859EEBB7AEF08310F144166F614BA1A0E3759A54BB91

Function 00FD4A6D Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 266COMMON

Download Yara Rule

APIs

Part of subcall function 00FE28F3: GetProcessHeap.KERNEL32(00FD6AA0,?,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000), ref: 00FE2904
Part of subcall function 00FE28F3: RtlAllocateHeap.NTDLL(00000000,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000), ref: 00FE290B

_memcpy_s.LIBCMT ref: 00FD4BE7

Strings

Failed to copy uninstall arguments for passthrough bundle package, xrefs: 00FD4D90
Failed to allocate space for burn package payload inside of passthrough bundle., xrefs: 00FD4AB1
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 00FD4C86
Failed to copy related arguments for passthrough bundle package, xrefs: 00FD4D6C
Failed to copy key for passthrough pseudo bundle., xrefs: 00FD4C64
Failed to copy key for passthrough pseudo bundle payload., xrefs: 00FD4C8D
Failed to copy cache id for passthrough pseudo bundle., xrefs: 00FD4CED
Failed to copy download source for passthrough pseudo bundle., xrefs: 00FD4CAB
Failed to allocate memory for pseudo bundle payload hash., xrefs: 00FD4CCD
Failed to copy local source path for passthrough pseudo bundle., xrefs: 00FD4CA1
pseudobundle.cpp, xrefs: 00FD4AA4, 00FD4C79, 00FD4CC0
Failed to recreate command-line arguments., xrefs: 00FD4D30
Failed to copy filename for passthrough pseudo bundle., xrefs: 00FD4C97
Failed to copy install arguments for passthrough bundle package, xrefs: 00FD4D4E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Heap$AllocateProcess_memcpy_s
String ID: Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of passthrough bundle.$Failed to allocate space for burn payload inside of related bundle struct$Failed to copy cache id for passthrough pseudo bundle.$Failed to copy download source for passthrough pseudo bundle.$Failed to copy filename for passthrough pseudo bundle.$Failed to copy install arguments for passthrough bundle package$Failed to copy key for passthrough pseudo bundle payload.$Failed to copy key for passthrough pseudo bundle.$Failed to copy local source path for passthrough pseudo bundle.$Failed to copy related arguments for passthrough bundle package$Failed to copy uninstall arguments for passthrough bundle package$Failed to recreate command-line arguments.$pseudobundle.cpp
API String ID: 1343786421-115096447
Opcode ID: edb57e224bbb98d3d5fa440fc6343c823175b2055583a415f31c84d1c15ea944
Instruction ID: 141d63a84fe0db31769956fda2f02c465f4293b38e090900573218448296336b
Opcode Fuzzy Hash: edb57e224bbb98d3d5fa440fc6343c823175b2055583a415f31c84d1c15ea944
Instruction Fuzzy Hash: 6DB13475600A45EFDB11CF65C881F66BBE6BF08300F18841AEA5ADB361E734F951EB50

Function 00FC0A65 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 236COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC0A81

Strings

Failed to read ordered patch order number., xrefs: 00FC0C3D
Failed to read count of ordered patches., xrefs: 00FC0B7B
Failed to read parent hwnd., xrefs: 00FC0AE9
Failed to read UI level., xrefs: 00FC0B43
Failed to read action., xrefs: 00FC0AA8
Failed to execute MSP package., xrefs: 00FC0C9E
elevation.cpp, xrefs: 00FC0BAD
Failed to allocate memory for ordered patches., xrefs: 00FC0BB7
Failed to read rollback flag., xrefs: 00FC0C73
Failed to read ordered patch package id., xrefs: 00FC0C44
Failed to find ordered patch package: %ls, xrefs: 00FC0C4E
Failed to read variables., xrefs: 00FC0C36
Failed to read package log., xrefs: 00FC0B0F
Failed to find package: %ls, xrefs: 00FC0ACA

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset
String ID: Failed to allocate memory for ordered patches.$Failed to execute MSP package.$Failed to find ordered patch package: %ls$Failed to find package: %ls$Failed to read UI level.$Failed to read action.$Failed to read count of ordered patches.$Failed to read ordered patch order number.$Failed to read ordered patch package id.$Failed to read package log.$Failed to read parent hwnd.$Failed to read rollback flag.$Failed to read variables.$elevation.cpp
API String ID: 2102423945-908036492
Opcode ID: 586e2a25444b9398ae682c7ec63eaad4d668384f38e8dc22380956b0072e0452
Instruction ID: c600e95634cd1b36eee84f63ebbb0615fdf8cb4a946dd5ab35cc2c644d47abea
Opcode Fuzzy Hash: 586e2a25444b9398ae682c7ec63eaad4d668384f38e8dc22380956b0072e0452
Instruction Fuzzy Hash: 95715072D0066EFACB11DA91CE52EEF77BCAF44710F110269F901B6241DB74DE05ABA1

Function 00FD80B2 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 207stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,?,?,?,?,00000000,?,?,?,00000000,?,00000000), ref: 00FD80CE

Strings

Failed to initialize BITS job callback., xrefs: 00FD81F9
Falied to start BITS job., xrefs: 00FD8274
Failed to create BITS job., xrefs: 00FD8160
bitsengine.cpp, xrefs: 00FD80E4, 00FD81E0
Invalid BITS engine URL: %ls, xrefs: 00FD80F0
Failed to download BITS job., xrefs: 00FD826D
Failed to copy download URL., xrefs: 00FD8115
Failed to set credentials for BITS job., xrefs: 00FD8186
Failed to create BITS job callback., xrefs: 00FD81EA
Failed to set callback interface for BITS job., xrefs: 00FD8210
Failed to add file to BITS job., xrefs: 00FD81A2
Failed to complete BITS job., xrefs: 00FD828E
Failed while waiting for BITS download., xrefs: 00FD827B

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: lstrlen
String ID: Failed to add file to BITS job.$Failed to complete BITS job.$Failed to copy download URL.$Failed to create BITS job callback.$Failed to create BITS job.$Failed to download BITS job.$Failed to initialize BITS job callback.$Failed to set callback interface for BITS job.$Failed to set credentials for BITS job.$Failed while waiting for BITS download.$Falied to start BITS job.$Invalid BITS engine URL: %ls$bitsengine.cpp
API String ID: 1659193697-2382896028
Opcode ID: 120ddbe39b7067eae05aa6e8ea90d09fbab5ed2dde212993febaee550e342ca2
Instruction ID: e33884505a5b91b9253db65ce5da30157f1b4960d75996d21dc2d2f40070d690
Opcode Fuzzy Hash: 120ddbe39b7067eae05aa6e8ea90d09fbab5ed2dde212993febaee550e342ca2
Instruction Fuzzy Hash: FB612632E40624EBCB119F54CC85E6EBB76AF44B91B180157F904AB3A1DB74DD02BB91

Function 00FD7363 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 173networkstringCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(00000000), ref: 00FD7388
InternetCloseHandle.WININET(00000000), ref: 00FD7396
InternetConnectW.WININET(?,00000000,?,00000000,?,?,00000000,00000000), ref: 00FD73F5
lstrlenW.KERNEL32(00000000), ref: 00FD7420
InternetSetOptionW.WININET(00000000,0000002B,00000000,00000000), ref: 00FD742D
lstrlenW.KERNEL32(00000001), ref: 00FD7436
InternetSetOptionW.WININET(00000000,0000002C,00000001,00000000), ref: 00FD743F
InternetCloseHandle.WININET(00000000), ref: 00FD74B4
InternetCloseHandle.WININET(00000000), ref: 00FD74BF
GetLastError.KERNEL32 ref: 00FD74DC

Strings

Failed to break URL into server and resource parts., xrefs: 00FD74CD
Failed to send request to URL: %ls, xrefs: 00FD7528
downloadengine.cpp, xrefs: 00FD7501
Failed to connect to URL: %ls, xrefs: 00FD7510
Failed to open internet URL: %ls, xrefs: 00FD751C

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Internet$CloseHandle$Optionlstrlen$ConnectErrorLast
String ID: Failed to break URL into server and resource parts.$Failed to connect to URL: %ls$Failed to open internet URL: %ls$Failed to send request to URL: %ls$downloadengine.cpp
API String ID: 1028609564-2897276973
Opcode ID: fe14329e59db134db81ed617cd1f1b50fdd0ebcb4c25137df05870ae2a0fbe37
Instruction ID: abd5dcbcedd19db56a6e90276cce02ca0041af48f3d353a6e66b16fdeda6a725
Opcode Fuzzy Hash: fe14329e59db134db81ed617cd1f1b50fdd0ebcb4c25137df05870ae2a0fbe37
Instruction Fuzzy Hash: 2F51943290425AEFCB12EF94CC859AEBBB6EF89710F194026F900AB250E7759D41BB51

Function 00FB58D8 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 163COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00FB5A4F

Part of subcall function 00FE28F3: GetProcessHeap.KERNEL32(00FD6AA0,?,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000), ref: 00FE2904
Part of subcall function 00FE28F3: RtlAllocateHeap.NTDLL(00000000,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000), ref: 00FE290B

SysFreeString.OLEAUT32(?), ref: 00FB5A09

Strings

registration.cpp, xrefs: 00FB595D
Filename, xrefs: 00FB59A0
Regid, xrefs: 00FB59BB
Failed to get next node., xrefs: 00FB5A84
Failed to get software tag count., xrefs: 00FB5922
Failed to get @Filename., xrefs: 00FB5A8B
Failed to convert SoftwareTag text to UTF-8, xrefs: 00FB5AA0
`<u, xrefs: 00FB5A09, 00FB5A4F
SoftwareTag, xrefs: 00FB58E6
Failed to select software tag nodes., xrefs: 00FB5908
Failed to allocate memory for software tag structs., xrefs: 00FB5967
Failed to get @Regid., xrefs: 00FB5A92
Failed to get SoftwareTag text., xrefs: 00FB5A99

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Failed to allocate memory for software tag structs.$Failed to convert SoftwareTag text to UTF-8$Failed to get @Filename.$Failed to get @Regid.$Failed to get SoftwareTag text.$Failed to get next node.$Failed to get software tag count.$Failed to select software tag nodes.$Filename$Regid$SoftwareTag$`<u$registration.cpp
API String ID: 336948655-2653194374
Opcode ID: 6c73b9ce669965753c78af9c07fbe11e727c6951682e046fc6c3ee9dde601bee
Instruction ID: 9b1046199e2d1300f946322fa46acd708515f5aee315cc66f54709206e6be8dd
Opcode Fuzzy Hash: 6c73b9ce669965753c78af9c07fbe11e727c6951682e046fc6c3ee9dde601bee
Instruction Fuzzy Hash: 2C518E72E00659EFCB10EFA6CCC59EDBBB9AF04B14B144569E901BB240D63D8E41BF51

Function 00FCEEA6 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 144serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,00000000,00000002,?,?,?,?,?,?,?,?,?,00FCF2A5,?), ref: 00FCEED7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00FCF2A5,?,?), ref: 00FCEEE4
OpenServiceW.ADVAPI32(00000000,wuauserv,00000027,?,?,?,?,?,?,?,?,?,00FCF2A5,?,?), ref: 00FCEF25
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00FCF2A5,?,?), ref: 00FCEF32
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,00FCF2A5,?,?), ref: 00FCEF70
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00FCF2A5,?,?), ref: 00FCEF7A

Part of subcall function 00FCEDC2: ChangeServiceConfigW.ADVAPI32(?,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,?,00FCEFF9,?), ref: 00FCEDDC
Part of subcall function 00FCEDC2: GetLastError.KERNEL32(?,00FCEFF9,?,00000003,?,?), ref: 00FCEDE6

CloseServiceHandle.ADVAPI32(00000000), ref: 00FCF039
CloseServiceHandle.ADVAPI32(00000000), ref: 00FCF044

Strings

Failed to query status of WU service., xrefs: 00FCEFA9
Failed to mark WU service to start on demand., xrefs: 00FCEFFF
wuauserv, xrefs: 00FCEF1F
Failed to open service control manager., xrefs: 00FCEF13
Failed to open WU service., xrefs: 00FCEF61
msuengine.cpp, xrefs: 00FCEF09, 00FCEF57, 00FCEF9F
Failed to read configuration for WU service., xrefs: 00FCEFDF

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandleOpen$ChangeConfigManagerQueryStatus
String ID: Failed to mark WU service to start on demand.$Failed to open WU service.$Failed to open service control manager.$Failed to query status of WU service.$Failed to read configuration for WU service.$msuengine.cpp$wuauserv
API String ID: 2017831661-301359130
Opcode ID: 333163ce6fdc9124aa5e70bde3ed3866ce4074a78c7a7e0488347910fdaed6c0
Instruction ID: f342faed92c971cddd4635571930bce712f615a8bd354d45bf5be6103a6226b2
Opcode Fuzzy Hash: 333163ce6fdc9124aa5e70bde3ed3866ce4074a78c7a7e0488347910fdaed6c0
Instruction Fuzzy Hash: 9741D332E4022ADBDB219B65CD06FAEBAB5AF04B20F15407CE500BA1A0D779DC04FB95

Function 00FE4328 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 66libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE303C: _memset.LIBCMT ref: 00FE3063
Part of subcall function 00FE303C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00FE3078
Part of subcall function 00FE303C: LoadLibraryW.KERNELBASE(?,?,00000104,00FB1C3B), ref: 00FE30C6
Part of subcall function 00FE303C: GetLastError.KERNEL32 ref: 00FE30D2

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,0000011C), ref: 00FE4357
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00FE4376
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00FE4395
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00FE43B4
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00FE43D3
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00FE43F2
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00FE4411

Strings

MsiGetPatchInfoExW, xrefs: 00FE43A9
Msi.dll, xrefs: 00FE432F
MsiSetExternalUIRecord, xrefs: 00FE43E7
MsiEnumProductsExW, xrefs: 00FE438A
MsiGetProductInfoExW, xrefs: 00FE43C8
MsiDetermineApplicablePatchesW, xrefs: 00FE436B
MsiDeterminePatchSequenceW, xrefs: 00FE434C
MsiSourceListAddSourceExW, xrefs: 00FE4406

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: AddressProc$DirectoryErrorLastLibraryLoadSystem_memset
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 3669249573-1735120554
Opcode ID: 433d7834c3293474194a4c8e0badc081448ddf5ab9bed038bd0c915d76aeeda5
Instruction ID: ab05d50e2d709f29c17f675e0cacd8c097f6e6a37e2d04ec327d4ee149936c17
Opcode Fuzzy Hash: 433d7834c3293474194a4c8e0badc081448ddf5ab9bed038bd0c915d76aeeda5
Instruction Fuzzy Hash: 7E21DD709622D09EE733EF26AD459253AA5F35D314F21446BE4C0962A8E7FF3C41AF50

Function 00FC828F Relevance: 23.0, APIs: 3, Strings: 10, Instructions: 239COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC82B9

Strings

Failed to get file hash., xrefs: 00FC83AF
Could not close verify handle., xrefs: 00FC851F
cache.cpp, xrefs: 00FC83A5, 00FC84C5, 00FC8515
$, xrefs: 00FC8469
Failed to encode file hash., xrefs: 00FC8417
Failed to move file pointer to beginning of file., xrefs: 00FC8340
0, xrefs: 00FC844E
Failed to allocate string., xrefs: 00FC83F6
Failed to allocate memory, xrefs: 00FC830F
Could not verify file %ls., xrefs: 00FC84D2

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset
String ID: $$0$Could not close verify handle.$Could not verify file %ls.$Failed to allocate memory$Failed to allocate string.$Failed to encode file hash.$Failed to get file hash.$Failed to move file pointer to beginning of file.$cache.cpp
API String ID: 2102423945-1888235766
Opcode ID: a9c2040e91cdfd68411f7e63bc018683c27e46a5b7ca4800b3911cd312cb0faa
Instruction ID: 7a95699c1eec020686697dddc16a186fa4f62adddf49cd5b67fec0c10315155b
Opcode Fuzzy Hash: a9c2040e91cdfd68411f7e63bc018683c27e46a5b7ca4800b3911cd312cb0faa
Instruction Fuzzy Hash: A38185B2D0025A9FCB10DF94CD82EEEBBF4AF04760F14013AE605F7251DA799D42AB91

Function 00FC6110 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 151memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00FC6130

Part of subcall function 00FC60E0: GdipCreateBitmapFromResource.GDIPLUS(?,?,00000000), ref: 00FC60FB

GetCursorPos.USER32(?), ref: 00FC61C8
MonitorFromPoint.USER32(?,?,00000002), ref: 00FC61DE
_memset.LIBCMT ref: 00FC61F8
GetMonitorInfoW.USER32(00000000,?), ref: 00FC6208
CreateDCW.GDI32(DISPLAY,?,00000000,00000000), ref: 00FC621F
GetDeviceCaps.GDI32(00000000,00000058), ref: 00FC6234
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FC623C
ReleaseDC.USER32(00000000,00000000), ref: 00FC6263

Strings

splashscreen.cpp, xrefs: 00FC6158, 00FC6189
Failed to load the splash screen bitmap., xrefs: 00FC6193
DISPLAY, xrefs: 00FC621A
Failed to find the splash screen bitmap., xrefs: 00FC6165

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CapsCreateDeviceFromGdipMonitor$AllocBitmapCursorInfoPointReleaseResource_memset
String ID: DISPLAY$Failed to find the splash screen bitmap.$Failed to load the splash screen bitmap.$splashscreen.cpp
API String ID: 1792097070-2523976841
Opcode ID: 8d2a0313effe595660ef973432e0d9af965211b7229fb4085a28d9327951e7ab
Instruction ID: e2ab32f5b47a277c9fccf0749cda99ae22817831ac8d713f1534f3c74b4d609b
Opcode Fuzzy Hash: 8d2a0313effe595660ef973432e0d9af965211b7229fb4085a28d9327951e7ab
Instruction Fuzzy Hash: 0D41AE71A0470A9FDB20DFB9CD86F9FB7F9AB44710F14882DA515EB291EB75E8009B40

Function 00FB780F Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 140registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00FB7843
RegCloseKey.ADVAPI32(?,00000000,?,?,00FB8B52,?), ref: 00FB7999

Part of subcall function 00FE3D9A: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00FE7ABC,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00FE3DAE

_MREFOpen@16.MSPDB140-MSVCRT ref: 00FB788B
RegQueryValueExW.ADVAPI32(?,?,00000000,00FB8B52,00000000,00000000,?,?,?,00000000,?,?,00000001,?,?,?), ref: 00FB78D8

Strings

Failed to format value string., xrefs: 00FB7896
Failed to format key string., xrefs: 00FB784E
Failed to query registry key value., xrefs: 00FB7913
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 00FB7920
Failed to set variable., xrefs: 00FB7953
Registry key not found. Key = '%ls'; variable = '%ls', xrefs: 00FB78AE
Failed to open registry key. Key = '%ls', xrefs: 00FB78B8
search.cpp, xrefs: 00FB7909
RegistrySearchExists failed: ID '%ls', HRESULT 0x%x, xrefs: 00FB7968

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Open@16$CloseOpenQueryValue
String ID: Failed to format key string.$Failed to format value string.$Failed to open registry key. Key = '%ls'$Failed to query registry key value.$Failed to set variable.$Registry key not found. Key = '%ls'; variable = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchExists failed: ID '%ls', HRESULT 0x%x$search.cpp
API String ID: 3932663376-1654530643
Opcode ID: 1f17af65865f9f7bc77e56a0a4880327a1dd1482c73276e97d175812f444fbc5
Instruction ID: 78e882549275d2f55dd61ab9d872603626699df073de3579c1e5aaf122cc1b83
Opcode Fuzzy Hash: 1f17af65865f9f7bc77e56a0a4880327a1dd1482c73276e97d175812f444fbc5
Instruction Fuzzy Hash: 5A417C72D04349FBCF11BFA6CC85DEEBBBAAB84300F144479F201A6161D6798A45BF61

Function 00FC1D65 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 118COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC1D89
GetTempPathW.KERNEL32(00000104,?,?,00000001,00000009), ref: 00FC1DB6
GetLastError.KERNEL32(?,00000001,00000009), ref: 00FC1DC0
GetCurrentProcessId.KERNEL32(?,?,00000104,?,?,00000001,00000009), ref: 00FC1E24
ProcessIdToSessionId.KERNEL32(00000000,?,00000001,00000009), ref: 00FC1E2B

Strings

%u\, xrefs: 00FC1E45
Failed to format session id as a string., xrefs: 00FC1E59
Failed to get length of session id string., xrefs: 00FC1E7D
Failed to get temp folder., xrefs: 00FC1DEF
Failed to copy temp folder., xrefs: 00FC1ED6
Failed to get length of temp folder., xrefs: 00FC1E13
logging.cpp, xrefs: 00FC1DE5

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Process$CurrentErrorLastPathSessionTemp_memset
String ID: %u\$Failed to copy temp folder.$Failed to format session id as a string.$Failed to get length of session id string.$Failed to get length of temp folder.$Failed to get temp folder.$logging.cpp
API String ID: 1047854834-1016737523
Opcode ID: b22c617b95a3a2d3d2a5bdb90a5e499af9376f0aca036ba7684e49d820342124
Instruction ID: d0029b9ba4e7662b30656aa9d66421c4edee0bd191715bba969693f4d44c8217
Opcode Fuzzy Hash: b22c617b95a3a2d3d2a5bdb90a5e499af9376f0aca036ba7684e49d820342124
Instruction Fuzzy Hash: BB412B71C8012D9ACB30AB658C8EFEEB778BF11750F1006D5E918E3151E7749E90AF91

Function 00FC05A4 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 200COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC05BE

Strings

Failed to read rollback., xrefs: 00FC062F
Failed to read exe package execution mode., xrefs: 00FC0650
Failed to allocate the list of ancestors., xrefs: 00FC073E
Failed to read the list of dependencies to ignore., xrefs: 00FC0671
Failed to execute EXE package., xrefs: 00FC0766
Failed to allocate the list of dependencies to ignore., xrefs: 00FC071A
Failed to read action., xrefs: 00FC060E
Failed to read the list of ancestors., xrefs: 00FC0692
Failed to read variables., xrefs: 00FC06B2
Failed to find package: %ls, xrefs: 00FC06ED
Failed to read exe package., xrefs: 00FC05ED

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset
String ID: Failed to allocate the list of ancestors.$Failed to allocate the list of dependencies to ignore.$Failed to execute EXE package.$Failed to find package: %ls$Failed to read action.$Failed to read exe package execution mode.$Failed to read exe package.$Failed to read rollback.$Failed to read the list of ancestors.$Failed to read the list of dependencies to ignore.$Failed to read variables.
API String ID: 2102423945-2912315823
Opcode ID: 5083cdf1acad4504a2d20625ceef7176b9438fb0c15914cf306e0d7f2b59e3df
Instruction ID: c36c1995c39d7395c349031b287e3531313c81172218db6f9265dc40311cba94
Opcode Fuzzy Hash: 5083cdf1acad4504a2d20625ceef7176b9438fb0c15914cf306e0d7f2b59e3df
Instruction Fuzzy Hash: A2516072C4051EEECF11EE94CE42DFEB7BCAE54750B100156F911A3050EA75AE92BFA1

Function 00FC945B Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 120fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000000,?,?,00FC9B9C,00000000,?,00000000,?), ref: 00FC9476
GetLastError.KERNEL32(?,?,00FC9B9C,00000000,?,00000000,?,?,00000000,00000000,?,?,?,00FBF210,?,?), ref: 00FC9484

Part of subcall function 00FC828F: _memset.LIBCMT ref: 00FC82B9

Part of subcall function 00FE602E: Sleep.KERNEL32(00000000,?,?,00FC7B9B,00000000,?,00000001,00000003,000007D0,?,?,00FC9CB4,00000000,00000000,00000000,00000000), ref: 00FE6045

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000003,000007D0,?,?), ref: 00FC958D

Strings

Failed to verify payload signature: %ls, xrefs: 00FC94ED
Failed to verify payload hash: %ls, xrefs: 00FC9511
%ls payload from working path '%ls' to path '%ls', xrefs: 00FC9537
Copying, xrefs: 00FC952C, 00FC9536
cache.cpp, xrefs: 00FC94A9
Failed to open payload in working path: %ls, xrefs: 00FC94B4
Failed to move %ls to %ls, xrefs: 00FC9566
Moving, xrefs: 00FC9525
Failed to copy %ls to %ls, xrefs: 00FC957C

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep_memset
String ID: %ls payload from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open payload in working path: %ls$Failed to verify payload hash: %ls$Failed to verify payload signature: %ls$Moving$cache.cpp
API String ID: 2828417756-1604654059
Opcode ID: da96fcd017976c9ef9957872a95ef56f6433b55810929966197cd94eadf78ba6
Instruction ID: 6bf5b07d796f06c6c8c778537b8c18e8440cc14229f1bee7876bca38e6f0b032
Opcode Fuzzy Hash: da96fcd017976c9ef9957872a95ef56f6433b55810929966197cd94eadf78ba6
Instruction Fuzzy Hash: F6314872E4462777DB3256118D4BF7F7A6CDF41BA0F044118B900AA2C1DAF8DE01B6E1

Function 00FC43B2 Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 280COMMON

Download Yara Rule

Strings

plan.cpp, xrefs: 00FC46B0
Failed to copy self to related bundle ancestors., xrefs: 00FC46A3
UX aborted plan related bundle., xrefs: 00FC46BA
Failed to add the package provider key "%ls" to the planned list., xrefs: 00FC46CB
%ls;%ls, xrefs: 00FC44AA
Failed to create dictionary from ancestors array., xrefs: 00FC440F
Failed to create string array from ancestors., xrefs: 00FC43EE
Failed to copy ancestors and self to related bundle ancestors., xrefs: 00FC44C2
Failed to lookup the bundle ID in the ancestors dictionary., xrefs: 00FC469C
Unexpected relation type encountered during plan: %d, xrefs: 00FC4692

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID:
String ID: %ls;%ls$Failed to add the package provider key "%ls" to the planned list.$Failed to copy ancestors and self to related bundle ancestors.$Failed to copy self to related bundle ancestors.$Failed to create dictionary from ancestors array.$Failed to create string array from ancestors.$Failed to lookup the bundle ID in the ancestors dictionary.$UX aborted plan related bundle.$Unexpected relation type encountered during plan: %d$plan.cpp
API String ID: 0-489706565
Opcode ID: 2ba70a0b8b4949830f1d89660ebd9e0a5838c080f1d207d05cb43ce56a2092aa
Instruction ID: 7923402bad4769664087a2ea6842496f599114a0efad4750c7279c678a6323b8
Opcode Fuzzy Hash: 2ba70a0b8b4949830f1d89660ebd9e0a5838c080f1d207d05cb43ce56a2092aa
Instruction Fuzzy Hash: D2A1BC71A0030BEBDB209F94CA92FAAB7B5FF14314F244829E902A7261D775A950FB11

Function 00FB9051 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 165COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FB907F

Part of subcall function 00FB8FDA: _memset.LIBCMT ref: 00FB8FF2
Part of subcall function 00FB8FDA: GetVersionExW.KERNEL32(?,?,00000000,00FB909E), ref: 00FB9001
Part of subcall function 00FB8FDA: GetLastError.KERNEL32 ref: 00FB900B

GetLastError.KERNEL32 ref: 00FB90A2

Strings

variable.cpp, xrefs: 00FB90C7
Failed to set variant value., xrefs: 00FB9227
Failed to get OS info., xrefs: 00FB90D1

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast_memset$Version
String ID: Failed to get OS info.$Failed to set variant value.$variable.cpp
API String ID: 3644159973-1971907631
Opcode ID: 1f7158b2350e2946aec8656d38674f51953b5078fc9776c455e6731bef1a0d07
Instruction ID: 4d651d84d3653a0bdb4b5ff82dd318c5a887d0a202f1c72b7535a6e18112b563
Opcode Fuzzy Hash: 1f7158b2350e2946aec8656d38674f51953b5078fc9776c455e6731bef1a0d07
Instruction Fuzzy Hash: 3B51FE71E0821DAADB209B7A8C89FEB7A78EB49710F104499F645E7141D6B48E81FF50

Function 00FC9350 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000005,00000000,00000003,08000000,00000000,00000000,?,?,00FC9ADD,?,?,?,?,00000000), ref: 00FC936A
GetLastError.KERNEL32(?,?,00FC9ADD,?,?,?,?,00000000,00000000,00000000,?,?,00FBF1F1,?,?,?), ref: 00FC937A

Part of subcall function 00FE602E: Sleep.KERNEL32(00000000,?,?,00FC7B9B,00000000,?,00000001,00000003,000007D0,?,?,00FC9CB4,00000000,00000000,00000000,00000000), ref: 00FE6045

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000003,000007D0,?,?,?), ref: 00FC944E

Strings

Failed to verify container hash: %ls, xrefs: 00FC93D5
%ls container from working path '%ls' to path '%ls', xrefs: 00FC93F8
Copying, xrefs: 00FC93F0, 00FC93F7
cache.cpp, xrefs: 00FC939F
Failed to move %ls to %ls, xrefs: 00FC9427
Failed to open container in working path: %ls, xrefs: 00FC93AA
Moving, xrefs: 00FC93E9
Failed to copy %ls to %ls, xrefs: 00FC943D

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls container from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open container in working path: %ls$Failed to verify container hash: %ls$Moving$cache.cpp
API String ID: 1275171361-1187406825
Opcode ID: 23deec044e27d687851115b06226b046a03137576371ccac05d43cd1a59037fc
Instruction ID: 6e24f934ea660a9330a9efe10e09688578b31203ce5e02b4e7f432e018e98a52
Opcode Fuzzy Hash: 23deec044e27d687851115b06226b046a03137576371ccac05d43cd1a59037fc
Instruction Fuzzy Hash: 1C21F771E487A676D63162154D4BF3B396CCF41F90F104128BA04BE2D1EAE8ED01B1B6

Function 00FE64B9 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 252fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000080,00000000,00000001,000000F9,00000000,00000000,?,?,?), ref: 00FE6537
GetLastError.KERNEL32 ref: 00FE6545
GetFileSizeEx.KERNEL32(?,?), ref: 00FE65AC
GetLastError.KERNEL32 ref: 00FE65B6
SetFilePointer.KERNEL32(?,?,?,00000001), ref: 00FE660D
GetLastError.KERNEL32 ref: 00FE6618
ReadFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,?,00000001), ref: 00FE66E4
GetLastError.KERNEL32 ref: 00FE6729
CloseHandle.KERNEL32(000000FF), ref: 00FE6782

Strings

fileutil.cpp, xrefs: 00FE64DA, 00FE658C, 00FE65D7, 00FE674E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandlePointerReadSize
String ID: fileutil.cpp
API String ID: 1273122604-2967768451
Opcode ID: 033033950eaea920d0c140b14ad088762f92c471acd0e9bf2950ac9d6edcf9da
Instruction ID: 7ba8d7c06cb899e7bdb38959fcc99528f07b6a898345637cb14e0face304fbbd
Opcode Fuzzy Hash: 033033950eaea920d0c140b14ad088762f92c471acd0e9bf2950ac9d6edcf9da
Instruction Fuzzy Hash: 2781E972A502CEEBDB209F268C49B6F3665AB607A4F254139F911DB1D0EA74CC01B761

Function 00FC546B Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 203COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,?,000000FF,00FB16FB,000000FF,?,00000000,00FB16FB), ref: 00FC54A5
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00FB139F,00FB139F,00FB139F,00FB139F,?,00000000), ref: 00FC564E
GetLastError.KERNEL32 ref: 00FC565B

Strings

Failed to append payload cache action., xrefs: 00FC5639
plan.cpp, xrefs: 00FC5685
Failed to append rollback cache action., xrefs: 00FC557D
Failed to create syncpoint event., xrefs: 00FC568F
Failed to append cache action., xrefs: 00FC5631
(, xrefs: 00FC54B2
Failed to append package start action., xrefs: 00FC5522

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CompareCreateErrorEventLastString
String ID: ($Failed to append cache action.$Failed to append package start action.$Failed to append payload cache action.$Failed to append rollback cache action.$Failed to create syncpoint event.$plan.cpp
API String ID: 801187047-794669014
Opcode ID: 1c13512cd8c34d5d43d27b50defee491870be939af889d32e549c6d1927a17b2
Instruction ID: c3af601303cb61344f0aedb183e9dd2463c76c776c7b04beeb2834f06f03239b
Opcode Fuzzy Hash: 1c13512cd8c34d5d43d27b50defee491870be939af889d32e549c6d1927a17b2
Instruction Fuzzy Hash: D9813A75A00706EFCB14DFA4C982EAABBB5FF08714F5085ADE501DB291D774EA80EB50

Function 00FE263E Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 195sleepfiletimeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE268D
GetTempPathW.KERNEL32(00000104,?,00000001,00000009,00000000), ref: 00FE26DC
GetLastError.KERNEL32 ref: 00FE26E6
GetLocalTime.KERNEL32(?,?,?,?,00000000,?), ref: 00FE277F
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 00FE280F
GetLastError.KERNEL32 ref: 00FE2820
Sleep.KERNEL32(00000064), ref: 00FE2832
CloseHandle.KERNEL32(000000FF), ref: 00FE28A1

Strings

%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 00FE27E1
pathutil.cpp, xrefs: 00FE270B

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime_memset
String ID: %ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
API String ID: 820914711-1101990113
Opcode ID: f1ed9a3c97bd32470fd4803b4062cd7b651e6b286a40a1ee7903f2c995b59ad5
Instruction ID: cfd9e3194fc769de64efc306ba56cb04d4ca262e0aa4b52fc6e33ea679faa367
Opcode Fuzzy Hash: f1ed9a3c97bd32470fd4803b4062cd7b651e6b286a40a1ee7903f2c995b59ad5
Instruction Fuzzy Hash: 8071A671D00168AACB719FA6DC89BAEB7B8BB48310F1406E5F559E6150E7348EC0EF50

Function 00FB51C5 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 147COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,40680003,000000FF,00FB2146,000000FF,00FB2146,00FB1F0E,00FB2146,00FB21D2,00FB1E8E,00000000,00FB21D2,00FB1E8E,00FB1E22,00FFFF25), ref: 00FB5233

Strings

Failed to get next stream., xrefs: 00FB531D
Failed to find embedded payload: %ls, xrefs: 00FB5327
Failed to ensure directory exists, xrefs: 00FB533D
payload.cpp, xrefs: 00FB52FF
X, xrefs: 00FB5242
Failed to get directory portion of local file path, xrefs: 00FB5336
Payload was not found in container: %ls, xrefs: 00FB530D
Failed to concat file paths., xrefs: 00FB532F
Failed to extract file., xrefs: 00FB5344

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CompareString
String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$X$payload.cpp
API String ID: 1825529933-3888727562
Opcode ID: e7749f5ff17facecddae1f7daecc007f2bcda01e9d88cecbfda826711efce36b
Instruction ID: 1f2b42912609fe8e6e52d8d09ce1c88b1cfceba3f8a6ad4d2e44445be6cf419e
Opcode Fuzzy Hash: e7749f5ff17facecddae1f7daecc007f2bcda01e9d88cecbfda826711efce36b
Instruction Fuzzy Hash: EB41A232900A45EBCF119F57CC41BDE77B2AF80BA0F294065E914AB291DBB9D940FF51

Function 00FB28E3 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 118COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 00FB291A
StringFromGUID2.OLE32(?,?,00000027), ref: 00FB292D

Strings

BurnPipe.%s, xrefs: 00FB294B
pipe.cpp, xrefs: 00FB2979, 00FB29A9
Failed to convert pipe guid into string., xrefs: 00FB29B3
Failed to create pipe guid., xrefs: 00FB2983
Failed to allocate pipe name., xrefs: 00FB295F
Failed to allocate pipe secret., xrefs: 00FB29D0

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CreateFromStringUuid
String ID: BurnPipe.%s$Failed to allocate pipe name.$Failed to allocate pipe secret.$Failed to convert pipe guid into string.$Failed to create pipe guid.$pipe.cpp
API String ID: 4041566446-2510341293
Opcode ID: 20d65206a9268e21c428c7abe32bf7871cfd89bd68d5e6c8b675f84364580fa9
Instruction ID: 41fec37c9af82ec37155ac50e294826b35f98ae2768f197dc136cdeb4e0e7450
Opcode Fuzzy Hash: 20d65206a9268e21c428c7abe32bf7871cfd89bd68d5e6c8b675f84364580fa9
Instruction Fuzzy Hash: 2E316D32E00359AADB51DBE6CC45FDEB7BCAB04760F200126E509FB241DA789945FB91

Function 00FD6C82 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 117networkCOMMON

Download Yara Rule

APIs

HttpOpenRequestW.WININET(84400200,?,00000000,00000000,00000000,010060D8,84400200,00000000), ref: 00FD6CFF
GetLastError.KERNEL32(?,?,?,00FD745A,00000000,00000000), ref: 00FD6D0B
HttpAddRequestHeadersW.WININET(00000000,00000000,000000FF,40000000), ref: 00FD6D59
GetLastError.KERNEL32(?,?,?,00FD745A,00000000,00000000), ref: 00FD6D63
InternetCloseHandle.WININET(00000000), ref: 00FD6DAD

Strings

Failed to open internet request., xrefs: 00FD6D3A
Failed to add header to HTTP request., xrefs: 00FD6D92
downloadengine.cpp, xrefs: 00FD6D30, 00FD6D88
Failed to allocate string for resource URI., xrefs: 00FD6CB8
Failed to append query strong to resource from URI., xrefs: 00FD6CE4

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorHttpLastRequest$CloseHandleHeadersInternetOpen
String ID: Failed to add header to HTTP request.$Failed to allocate string for resource URI.$Failed to append query strong to resource from URI.$Failed to open internet request.$downloadengine.cpp
API String ID: 3883690129-2273796897
Opcode ID: d54aa2d6f3163e9925595b440ff72e06f92aec1380ac85e3eab9cc980eb770f7
Instruction ID: f4246f70502323a553995948b2cc111d57d60b2fcc01208c00fb3ca95082570c
Opcode Fuzzy Hash: d54aa2d6f3163e9925595b440ff72e06f92aec1380ac85e3eab9cc980eb770f7
Instruction Fuzzy Hash: 1B313A71B40219BFCB229F91EC89D6F7A7BEF44B61B240026F111E6291D6788D40B7A1

Function 00FB988D Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 107timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00FB98B8
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 00FB98D3
GetLastError.KERNEL32 ref: 00FB98DC
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,?,?,?), ref: 00FB9935
GetLastError.KERNEL32 ref: 00FB993B

Strings

Failed to get the Date., xrefs: 00FB9965
Failed to allocate the buffer for the Date., xrefs: 00FB991F
variable.cpp, xrefs: 00FB98FC, 00FB995B
Failed to set variant value., xrefs: 00FB9980
Failed to get the required buffer length for the Date., xrefs: 00FB9906

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: DateErrorFormatLast$SystemTime
String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$variable.cpp
API String ID: 2700948981-3682088697
Opcode ID: ff0a4263ab8c787895c1dd6e8c86d5ea3689b291b499f888d17fda4e2105fde7
Instruction ID: 57b68bdc8a353f5143b8e5647356073c1843def3e5cbf967a5e9dc7318d9a82b
Opcode Fuzzy Hash: ff0a4263ab8c787895c1dd6e8c86d5ea3689b291b499f888d17fda4e2105fde7
Instruction Fuzzy Hash: 8C318571B0430FAADB519BA6CCC2FFF7678AF04754F100039F710E5191EAA9D944AB51

Function 00FC6669 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 98threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,?,?,?,00FB1E12,?), ref: 00FC668B
GetLastError.KERNEL32(?,?,?,00FB1E12,?), ref: 00FC6698
CreateThread.KERNEL32(00000000,00000000,00FC6467,?,00000000,00000000), ref: 00FC66F0
GetLastError.KERNEL32(?,?,?,00FB1E12,?), ref: 00FC66FD
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,?,00FB1E12,?), ref: 00FC6741
CloseHandle.KERNEL32(00000001,?,?,?,00FB1E12,?), ref: 00FC6755
CloseHandle.KERNEL32(?,?,?,?,00FB1E12,?), ref: 00FC6762

Strings

splashscreen.cpp, xrefs: 00FC66BA, 00FC671F
Failed to create UI thread., xrefs: 00FC6729
Failed to create modal event., xrefs: 00FC66C4

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create UI thread.$Failed to create modal event.$splashscreen.cpp
API String ID: 2351989216-1977201954
Opcode ID: 96ea4c6ea0272eb1b8d96e8bd8ca606e794481afe43cb0cd88b2d2563cd124fa
Instruction ID: 3aafb3370a9f6f889b5ac0996ccc6cd40b60ebf0181ab07544dfa8c3d3e01345
Opcode Fuzzy Hash: 96ea4c6ea0272eb1b8d96e8bd8ca606e794481afe43cb0cd88b2d2563cd124fa
Instruction Fuzzy Hash: CD310A71D4420AFEDB11AFA8CC46EAFBBB4EF84720F104529E515F6150E7389900EB91

Function 00FB94F7 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FB951D
GetSystemWow64DirectoryW.KERNEL32(?,00000104), ref: 00FB9538
GetLastError.KERNEL32 ref: 00FB9542
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00FB9581
GetLastError.KERNEL32 ref: 00FB958B

Strings

Failed to get 32-bit system folder., xrefs: 00FB957A
Failed to backslash terminate system folder., xrefs: 00FB95DE
variable.cpp, xrefs: 00FB9570, 00FB95B0
Failed to get 64-bit system folder., xrefs: 00FB95BA
Failed to set system folder variant value., xrefs: 00FB95FA

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: DirectoryErrorLastSystem$Wow64_memset
String ID: Failed to backslash terminate system folder.$Failed to get 32-bit system folder.$Failed to get 64-bit system folder.$Failed to set system folder variant value.$variable.cpp
API String ID: 3186313095-1590374846
Opcode ID: d18f871cec920bc88372000122ad7921376a5954b910be3e8afd0b52dd6628f8
Instruction ID: add38f86a6f79ec6914b144c00c2148c91aeb99cd2c1f7da6a3e50d2906142e7
Opcode Fuzzy Hash: d18f871cec920bc88372000122ad7921376a5954b910be3e8afd0b52dd6628f8
Instruction Fuzzy Hash: 6D218C72E8532A66D73297628C49BEB37E85F00760F184160FB14EB1C2EEA8DD007AD1

Function 00FD620B Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 90threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,00FB1D72,00000000,000000FF,74DF2F60,00000000,00FB1D72,?), ref: 00FD6234
GetLastError.KERNEL32 ref: 00FD6247
GetExitCodeThread.KERNEL32(?,000000FF), ref: 00FD6296
GetLastError.KERNEL32 ref: 00FD62A4
ResetEvent.KERNEL32(?), ref: 00FD62E2
GetLastError.KERNEL32 ref: 00FD62EC

Strings

Failed to reset operation complete event., xrefs: 00FD6320
cabextract.cpp, xrefs: 00FD6271, 00FD62CE, 00FD6316
Failed to get extraction thread exit code., xrefs: 00FD62D8
Failed to wait for operation complete event., xrefs: 00FD627B

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
API String ID: 2979751695-3400260300
Opcode ID: a7bdf0229862d8ad804d76116556eb60ab3db25cd55e751bc7fa5eb6639acf51
Instruction ID: 8c25a12e15727cc0f861bc063bb685d4b25832f75587a838de68bd1fd1f84783
Opcode Fuzzy Hash: a7bdf0229862d8ad804d76116556eb60ab3db25cd55e751bc7fa5eb6639acf51
Instruction Fuzzy Hash: 6931C571E40249FFDB109F94CD85A6E7BB2FF04311F24053AE211E6260E778DA08BB05

Function 00FD6101 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 89synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(0578F685,00FB2222,00FB1E22,?,?,00FD0739,00FB2222,00000000,00FB1AAE,?,00FBD984,?,00FB1AAE,00FB1E12,00FB1E12,00000000), ref: 00FD6122
GetLastError.KERNEL32(?,?,00FD0739,00FB2222,00000000,00FB1AAE,?,00FBD984,?,00FB1AAE,00FB1E12,00FB1E12,00000000,?,00FB1E22,FEBB4868), ref: 00FD612C
WaitForSingleObject.KERNEL32(F08B8007,000000FF,?,?,00FD0739,00FB2222,00000000,00FB1AAE,?,00FBD984,?,00FB1AAE,00FB1E12,00FB1E12,00000000,?), ref: 00FD616C
GetLastError.KERNEL32(?,?,00FD0739,00FB2222,00000000,00FB1AAE,?,00FBD984,?,00FB1AAE,00FB1E12,00FB1E12,00000000,?,00FB1E22,FEBB4868), ref: 00FD6176
CloseHandle.KERNEL32(F08B8007,00000000,00FB2222,00FB1E22,?,?,00FD0739,00FB2222,00000000,00FB1AAE,?,00FBD984,?,00FB1AAE,00FB1E12,00FB1E12), ref: 00FD61C8
CloseHandle.KERNEL32(0578F685,00000000,00FB2222,00FB1E22,?,?,00FD0739,00FB2222,00000000,00FB1AAE,?,00FBD984,?,00FB1AAE,00FB1E12,00FB1E12), ref: 00FD61D5
CloseHandle.KERNEL32(004005BE,00000000,00FB2222,00FB1E22,?,?,00FD0739,00FB2222,00000000,00FB1AAE,?,00FBD984,?,00FB1AAE,00FB1E12,00FB1E12), ref: 00FD61E2

Strings

Failed to set begin operation event., xrefs: 00FD6160
cabextract.cpp, xrefs: 00FD6156, 00FD61A0
Failed to wait for thread to terminate., xrefs: 00FD61AA

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseHandle$ErrorLast$EventObjectSingleWait
String ID: Failed to set begin operation event.$Failed to wait for thread to terminate.$cabextract.cpp
API String ID: 1206859064-226982402
Opcode ID: 806260660c3ba14f4b0bc944b9620a1299efb83948a022b8ec1eccd6344bd8fd
Instruction ID: f470c59e4775c362558c803691afe2cf59230378a7cc0b74b4a137cb6e627894
Opcode Fuzzy Hash: 806260660c3ba14f4b0bc944b9620a1299efb83948a022b8ec1eccd6344bd8fd
Instruction Fuzzy Hash: 10318472A00245EBCB209F95CC8595EB7F5BF04720B28493EE245E7651D778ED44BB10

Function 00FB9619 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FB9640
_memset.LIBCMT ref: 00FB964F
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00FB9664
GetLastError.KERNEL32 ref: 00FB966E
GetVolumePathNameW.KERNEL32(?,?,00000104), ref: 00FB96B3
GetLastError.KERNEL32 ref: 00FB96BD

Strings

Failed to get windows directory., xrefs: 00FB969D
variable.cpp, xrefs: 00FB9693, 00FB96E2
Failed to set variant value., xrefs: 00FB9708
Failed to get volume path name., xrefs: 00FB96EC

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast_memset$DirectoryNamePathVolumeWindows
String ID: Failed to get volume path name.$Failed to get windows directory.$Failed to set variant value.$variable.cpp
API String ID: 2690897267-4026719079
Opcode ID: b79cbd3e1d910d890e514238362866710752d3233dbd234d6f380810b30deac3
Instruction ID: 281d7693c28b25c8729efa2c2eb241fdd8980c2f90f7063eace8298d043f6be5
Opcode Fuzzy Hash: b79cbd3e1d910d890e514238362866710752d3233dbd234d6f380810b30deac3
Instruction Fuzzy Hash: DE2107B2E0032967D7209B129C49FEB339C9F00760F150075BB05F7181EAB8EA406AE5

Function 00FB8F23 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE303C: _memset.LIBCMT ref: 00FE3063
Part of subcall function 00FE303C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00FE3078
Part of subcall function 00FE303C: LoadLibraryW.KERNELBASE(?,?,00000104,00FB1C3B), ref: 00FE30C6
Part of subcall function 00FE303C: GetLastError.KERNEL32 ref: 00FE30D2

GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 00FB8F51
GetLastError.KERNEL32 ref: 00FB8F5E
_memset.LIBCMT ref: 00FB8F9C
FreeLibrary.KERNEL32(00000000), ref: 00FB8FCF

Strings

Failed to get RtlGetVersion entry point, xrefs: 00FB8F8D
Failed to load ntdll.dll, xrefs: 00FB8F41
ntdll.dll, xrefs: 00FB8F31
variable.cpp, xrefs: 00FB8F83
RtlGetVersion, xrefs: 00FB8F49
Failed to get OS version from RtlGetVersion, xrefs: 00FB8FB7

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLastLibrary_memset$AddressDirectoryFreeLoadProcSystem
String ID: Failed to get OS version from RtlGetVersion$Failed to get RtlGetVersion entry point$Failed to load ntdll.dll$RtlGetVersion$ntdll.dll$variable.cpp
API String ID: 1538852321-2659798697
Opcode ID: 85393c00c68d7d2aa5826633b811740ba4ef5f41298aac2173d41ccc41e1ebc9
Instruction ID: 8e6250552428104fba9975aa15421cc128718ee7635dbbbf5582cdaafb3370a8
Opcode Fuzzy Hash: 85393c00c68d7d2aa5826633b811740ba4ef5f41298aac2173d41ccc41e1ebc9
Instruction Fuzzy Hash: D511AC75B4430ABBE7115796CC86BBB76AD9F40794F140025B701E51A2FFF8C904BE15

Function 00FC4063 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 279COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,00FB1317,00FB1717,00FB1333,00FB16FB,?,00FB139F,00FB1717,00FB15CF,00FB13CF), ref: 00FC40D8

Strings

Failed to add self-dependent to ignore dependents., xrefs: 00FC4160
Failed to allocate registration action., xrefs: 00FC4147
Failed to add registration action for dependent related bundle., xrefs: 00FC43A8
Failed to check for remaining dependents during planning., xrefs: 00FC426C
Failed to create the string dictionary., xrefs: 00FC4116
Failed to add dependent bundle provider key to ignore dependents., xrefs: 00FC422A
Failed to add dependents ignored from command-line., xrefs: 00FC4190
Failed to add registration action for self dependent., xrefs: 00FC4372

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CompareString
String ID: Failed to add dependent bundle provider key to ignore dependents.$Failed to add dependents ignored from command-line.$Failed to add registration action for dependent related bundle.$Failed to add registration action for self dependent.$Failed to add self-dependent to ignore dependents.$Failed to allocate registration action.$Failed to check for remaining dependents during planning.$Failed to create the string dictionary.
API String ID: 1825529933-2086987450
Opcode ID: f2afcdd21287fc47f223ee5a19a29b9ee5ab4378e3f135240588f31cb2151fcf
Instruction ID: c34eab5eaf6946854435714aff52778d452ee473d99c75d35f00b1830feed020
Opcode Fuzzy Hash: f2afcdd21287fc47f223ee5a19a29b9ee5ab4378e3f135240588f31cb2151fcf
Instruction Fuzzy Hash: 87B14671D0024BEFCF219FA0CA92BADBBB5BF14314F10452EEA15A6151D331AA94FB91

Function 00FE20C8 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000), ref: 00FE210F
GetLastError.KERNEL32 ref: 00FE2115
ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00FE2164
GetLastError.KERNEL32 ref: 00FE216A
GetFullPathNameW.KERNEL32(00000000,00000040,00000000,00000000,00000000,00000040,00000000,00000000,00000000), ref: 00FE222B
GetLastError.KERNEL32 ref: 00FE2231
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00FE2287
GetLastError.KERNEL32 ref: 00FE228D

Strings

pathutil.cpp, xrefs: 00FE22C3

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
String ID: pathutil.cpp
API String ID: 1547313835-741606033
Opcode ID: 081a40889a6cfd48c8be2f04a48de300fc9c385c20132c34a90e40cbf89a715d
Instruction ID: a21110fbc92745f0b39aed2aa97a3e4ddb5b971c4ecf6da0341d1ca28e6fd12b
Opcode Fuzzy Hash: 081a40889a6cfd48c8be2f04a48de300fc9c385c20132c34a90e40cbf89a715d
Instruction Fuzzy Hash: 4761DA72D0029AABDB619B96CC45F9E7BACAF04760F114571EA10F7150F378DE00BB90

Function 00FD2294 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 126COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,000000FE,?,00000000,?,?,?,?,?), ref: 00FD231E
GetLastError.KERNEL32(?,?,?,?,?), ref: 00FD2328
CopyFileExW.KERNEL32(?,?,00FD1AB7,?,?,00000000,?,00000000,?,?,?,?,?,00000000,00000000), ref: 00FD237F
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000,?,?,00FD277A,?,00000000,?,00000000,00000001,00000000), ref: 00FD23B2

Strings

Failed to clear readonly bit on payload destination path: %ls, xrefs: 00FD235A
copy, xrefs: 00FD22EC
Failed attempt to copy payload from: '%ls' to: %ls., xrefs: 00FD23E7
BA aborted copy of payload from: '%ls' to: %ls., xrefs: 00FD23AA
apply.cpp, xrefs: 00FD234D, 00FD2398, 00FD23D7

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLast$AttributesCopy
String ID: BA aborted copy of payload from: '%ls' to: %ls.$Failed attempt to copy payload from: '%ls' to: %ls.$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$copy
API String ID: 1969131206-836986073
Opcode ID: b91526ddd2cf9b03d2b1bb953e442540084b4666c5db680ef0ae8a800143d3a7
Instruction ID: b22375c9e1f948203b01792e9ff548d085f7049f6c2fbd16d57f9147a164254c
Opcode Fuzzy Hash: b91526ddd2cf9b03d2b1bb953e442540084b4666c5db680ef0ae8a800143d3a7
Instruction Fuzzy Hash: D3412A32B4030BBBEB105E96CC81E6B37ABBF64711F188129B605DA390D779DD00B791

Function 00FD6EA9 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 108fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,000000FF,?,00000000,?,?,?,00FD79AD,?), ref: 00FD6EF9
GetLastError.KERNEL32(?,?,?,00FD79AD,?,?,000000FF,?,000000FF,00000000,?,00000001,?,?,WiX\Burn,DownloadTimeout), ref: 00FD6F07
ReadFile.KERNEL32(00000000,00000008,00000008,00000000,00000000,?,?,?,00FD79AD,?,?,000000FF,?,000000FF,00000000,?), ref: 00FD6F5C
CloseHandle.KERNEL32(000000FF,000000FF), ref: 00FD6F92
GetLastError.KERNEL32(?,?,?,00FD79AD,?,?,000000FF,?,000000FF,00000000,?,00000001,?,?,WiX\Burn,DownloadTimeout), ref: 00FD6FA1

Strings

Failed to calculate resume path from working path: %ls, xrefs: 00FD6ED1
Failed to create resume file: %ls, xrefs: 00FD6F40
downloadengine.cpp, xrefs: 00FD6F31, 00FD6FCB
Failed to read resume file: %ls, xrefs: 00FD6FDA

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleRead
String ID: Failed to calculate resume path from working path: %ls$Failed to create resume file: %ls$Failed to read resume file: %ls$downloadengine.cpp
API String ID: 3160720760-919322122
Opcode ID: 3100429ea9d58dda89f2baf8380f02025666a197778642cfa375e7240ef13fd8
Instruction ID: 630c64484acc9683af0fbd592cdf77f713e20e17e2da20fe245f7537b32117cb
Opcode Fuzzy Hash: 3100429ea9d58dda89f2baf8380f02025666a197778642cfa375e7240ef13fd8
Instruction Fuzzy Hash: B24166B290060AFFDB109F55DC85A6E7F76FF04310F24852AF615DA2A0E375DA44BB11

Function 00FB8C36 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 00FB8C49
_wcscspn.LIBCMT ref: 00FB8C79

Strings

[\%c], xrefs: 00FB8CA8
Failed to append characters., xrefs: 00FB8CD5
[]{}, xrefs: 00FB8C73
Failed to copy string., xrefs: 00FB8CEF
Failed to allocate buffer for escaped string., xrefs: 00FB8C60
Failed to append escape sequence., xrefs: 00FB8CFD
Failed to format escape sequence., xrefs: 00FB8CF6

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _wcscspnlstrlen
String ID: Failed to allocate buffer for escaped string.$Failed to append characters.$Failed to append escape sequence.$Failed to copy string.$Failed to format escape sequence.$[\%c]$[]{}
API String ID: 2089742776-3250950999
Opcode ID: 9ae20f29d7e7c285230c1ff7efb35f5c5ac2e6e57ccd7df7258050cc57b19902
Instruction ID: 7f19ab1f12660a185e07db4f9f2641b0199f18a4011aeda1ae002fc39b5e8d47
Opcode Fuzzy Hash: 9ae20f29d7e7c285230c1ff7efb35f5c5ac2e6e57ccd7df7258050cc57b19902
Instruction Fuzzy Hash: 1721D7B3D01219BBDB126692CC42FEE7AAC9F407A0F200156F501761D1DE78DE41FAA1

Function 00FB2AE6 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 81COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,00FB130D,80070642,?,?,00FB130D), ref: 00FB2AEF
CloseHandle.KERNEL32(000000FF), ref: 00FB2BA4

Strings

-q -%ls %ls %ls %u, xrefs: 00FB2B08
runas, xrefs: 00FB2B4A
open, xrefs: 00FB2B54, 00FB2B62
burn.elevated, xrefs: 00FB2B03
Failed to allocate parameters for elevated process., xrefs: 00FB2B28
Failed to launch elevated child process: %ls, xrefs: 00FB2B77

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseCurrentHandleProcess
String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
API String ID: 2391145178-1352204306
Opcode ID: 1058b5f0223ff44e3751f7f0ec097b212784d7bb528a35755f39f090868a6fb9
Instruction ID: c56246e2adbcedc34eed207782a6489c367ea9f89c3a2f9bb8c70dc82c1eaa68
Opcode Fuzzy Hash: 1058b5f0223ff44e3751f7f0ec097b212784d7bb528a35755f39f090868a6fb9
Instruction Fuzzy Hash: 96214871D00289FBCF11DF96CC858EEBBB8EB98310B10846AF515A6211DB799A41BF51

Function 00FB931C Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(msi,DllGetVersion), ref: 00FB9346
GetProcAddress.KERNEL32(00000000), ref: 00FB934D
GetLastError.KERNEL32 ref: 00FB9357

Strings

DllGetVersion, xrefs: 00FB933B
variable.cpp, xrefs: 00FB937C
Failed to set variant value., xrefs: 00FB93C4
msi, xrefs: 00FB9340
Failed to get msi.dll version info., xrefs: 00FB93A0
Failed to find DllGetVersion entry point in msi.dll., xrefs: 00FB9386

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: DllGetVersion$Failed to find DllGetVersion entry point in msi.dll.$Failed to get msi.dll version info.$Failed to set variant value.$msi$variable.cpp
API String ID: 4275029093-842451892
Opcode ID: 617d3f0201cff0439c4574c126c6be3f937d03123606fe8847657f5238012a8b
Instruction ID: ecce764579bad2724e01d9bf034c7c40163052a994cc2a1fa792d2718330deb0
Opcode Fuzzy Hash: 617d3f0201cff0439c4574c126c6be3f937d03123606fe8847657f5238012a8b
Instruction Fuzzy Hash: 5A112C32A04729B6D7105BBACC42AFF77E8AF44720F080015F701E71D1DAA8D80476A1

Function 00FBBA4F Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,00FB17CA,?,00000000,?,?,00000000,00000000,?,?,?,00FB1E12,?), ref: 00FBBA5C
GetLastError.KERNEL32(?,00FB17CA,?,00000000,?,?,00000000,00000000,?,?,?,00FB1E12,?), ref: 00FBBA69
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 00FBBAA2
GetLastError.KERNEL32(?,00FB17CA,?,00000000,?,?,00000000,00000000,?,?,?,00FB1E12,?), ref: 00FBBAAC

Strings

userexperience.cpp, xrefs: 00FBBA8B, 00FBBACE
Failed to load UX DLL., xrefs: 00FBBA95
BootstrapperApplicationCreate, xrefs: 00FBBA9C
Failed to get BootstrapperApplicationCreate entry-point, xrefs: 00FBBAD8
Failed to create UX., xrefs: 00FBBAF1

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp
API String ID: 1866314245-2276003667
Opcode ID: c5a9fb3d4593173ba39b2c97fc94da2ffba4c5d2854ffa26812f10d20f4cd60c
Instruction ID: edf9b88ce98182d6e1180bff7cc989540b032835834a017d31ef59b89fac0c8e
Opcode Fuzzy Hash: c5a9fb3d4593173ba39b2c97fc94da2ffba4c5d2854ffa26812f10d20f4cd60c
Instruction Fuzzy Hash: 8A11C432E4162BE793214A578C19AAB3A48AF00BA1B050064FE14FA2A0E79DDC107A91

Function 00FC2563 Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 156COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00FC2579
LeaveCriticalSection.KERNEL32(?), ref: 00FC26EC

Strings

UX did not provide container or payload id., xrefs: 00FC265E
Failed to set download password., xrefs: 00FC26A9
Failed to set download URL., xrefs: 00FC260B
Engine is active, cannot change engine state., xrefs: 00FC2593
UX denied while trying to set download URL on embedded payload: %ls, xrefs: 00FC25DC
Failed to set download user., xrefs: 00FC2685
UX requested unknown payload with id: %ls, xrefs: 00FC25C6
UX requested unknown container with id: %ls, xrefs: 00FC263E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set download URL.$Failed to set download password.$Failed to set download user.$UX denied while trying to set download URL on embedded payload: %ls$UX did not provide container or payload id.$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-2615595102
Opcode ID: 5307e2c691bc32cc99c738404573e55f7b50e1fc3b9db6379ed0baeb9316355a
Instruction ID: 4acbb60faef5b9c13af20b5720dec979beb80dc3797f098aa578d0c38f792153
Opcode Fuzzy Hash: 5307e2c691bc32cc99c738404573e55f7b50e1fc3b9db6379ed0baeb9316355a
Instruction Fuzzy Hash: 1D410631A00B06EBC760EB59CE86E6BB7E8EF447607284409F501D7210E3B9EC80B7B0

Function 00FB8D2F Relevance: 15.1, APIs: 2, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,00FBFBF0,00000001,00000000,?,00FD3ED5,?,00FD3ED5,?,?,00FD3ED5), ref: 00FB8D3A
LeaveCriticalSection.KERNEL32(?,?,00FD3ED5,?,?,?,?,00FBFBF0,00000001,00000000,?,00FD3ED5,?,00FD3ED5,?,?), ref: 00FB8E5D

Strings

Failed to write variable value as number., xrefs: 00FB8E4C
0, xrefs: 00FB8E02
Unsupported variable type., xrefs: 00FB8E30
Failed to write variable value as string., xrefs: 00FB8E24
Failed to write included flag., xrefs: 00FB8E37
Failed to write variable value type., xrefs: 00FB8E45
Failed to write variable count., xrefs: 00FB8D56
Failed to write variable name., xrefs: 00FB8E3E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: 0$Failed to write included flag.$Failed to write variable count.$Failed to write variable name.$Failed to write variable value as number.$Failed to write variable value as string.$Failed to write variable value type.$Unsupported variable type.
API String ID: 3168844106-1107513445
Opcode ID: 74a1caafbd36ca569b9660c30f3bd86d16af6c3390dc875048b3d285e45f2c30
Instruction ID: 5c987acd73be48d384f6edfe44cc0be31db9de79bcdde662f53117feb620e7df
Opcode Fuzzy Hash: 74a1caafbd36ca569b9660c30f3bd86d16af6c3390dc875048b3d285e45f2c30
Instruction Fuzzy Hash: 2A318F3650064AEFCB119FA6CC519EA7B7AEFC47A07204429FA15572A1DE31DD12FF10

Function 00FB7D36 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 148COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00FB7D57
_MREFOpen@16.MSPDB140-MSVCRT ref: 00FB7D7C

Strings

Failed to format product code string., xrefs: 00FB7D87
Failed to get component path: %d, xrefs: 00FB7DDF
Failed to set variable., xrefs: 00FB7E5D
MsiComponentSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 00FB7E6D
Failed to format component id string., xrefs: 00FB7D62

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Open@16
String ID: Failed to format component id string.$Failed to format product code string.$Failed to get component path: %d$Failed to set variable.$MsiComponentSearch failed: ID '%ls', HRESULT 0x%x
API String ID: 3613110473-1671347822
Opcode ID: a36c0950b5a3598c626b0402ad5e5f3edc222e5d0b9c5ce8e802a4cbae3929b0
Instruction ID: bfa1a1156855b9f4d273667c8a23866051928ac612c91b966f38c720d3eac3a8
Opcode Fuzzy Hash: a36c0950b5a3598c626b0402ad5e5f3edc222e5d0b9c5ce8e802a4cbae3929b0
Instruction Fuzzy Hash: 03419572D08345ABCF257A96CC829FE7676EFC4360F24496AF101E5191DB35CE40BE11

Function 00FC0CE5 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 130COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC0D02

Strings

Failed to read package id., xrefs: 00FC0D2B
Failed to read rollback., xrefs: 00FC0D8E
Failed to execute MSU package., xrefs: 00FC0DFC
Failed to read action., xrefs: 00FC0D6D
Failed to read StopWusaService., xrefs: 00FC0DAC
Failed to find package: %ls, xrefs: 00FC0DCB
Failed to read package log., xrefs: 00FC0D4C

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset
String ID: Failed to execute MSU package.$Failed to find package: %ls$Failed to read StopWusaService.$Failed to read action.$Failed to read package id.$Failed to read package log.$Failed to read rollback.
API String ID: 2102423945-2413426928
Opcode ID: 8920cf57bb15e36cf3dc57eb803c1fe8b043ec9892d3eb0babceb834d063f395
Instruction ID: 7606ac1404415da03106c5c28a78bfbdee08b6b400c227846fedde321c2e6d63
Opcode Fuzzy Hash: 8920cf57bb15e36cf3dc57eb803c1fe8b043ec9892d3eb0babceb834d063f395
Instruction Fuzzy Hash: E5418D72C4011EFECF11EE90CE42DEEB7BCAF54310B10056AF912A2150EA759F46BBA1

Function 00FB1762 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 123windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 00FB1789
GetCurrentThreadId.KERNEL32 ref: 00FB178F
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00FB1816

Strings

Failed to create engine for UX., xrefs: 00FB17A7
Failed to start bootstrapper application., xrefs: 00FB17EB
Unexpected return value from message pump., xrefs: 00FB186F
Failed to load UX., xrefs: 00FB17D1
engine.cpp, xrefs: 00FB1862

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$engine.cpp
API String ID: 673430819-3216346975
Opcode ID: 0a38636598bc111d88e5dc39767e4e47911913f70b9d8fed356073ec3bc222f7
Instruction ID: c1b86c0f11d34c7d8de0bb4cad88af14586839e7cea98568666c3d64c43ebd75
Opcode Fuzzy Hash: 0a38636598bc111d88e5dc39767e4e47911913f70b9d8fed356073ec3bc222f7
Instruction Fuzzy Hash: F34171B1900209AFDB10EFA2CC95EEA77BCBB44314F604429F506E7290DB79DE45AB20

Function 00FD7AEE Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 116comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00FFFB30,00000000,00000017,00FFFB40,?,00000000,00000000,?,?,?,?,?,?,?,00FD8157,?), ref: 00FD7B29

Strings

Failed to set progress timeout., xrefs: 00FD7BA4
Failed to create BITS job., xrefs: 00FD7B5C
WixBurn, xrefs: 00FD7B4D
Failed to create IBackgroundCopyManager., xrefs: 00FD7B35
Failed to set BITS job to foreground., xrefs: 00FD7BBB
Failed to set notification flags for BITS job., xrefs: 00FD7B74
Failed to set BITS job to low priority., xrefs: 00FD7B91

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CreateInstance
String ID: Failed to create BITS job.$Failed to create IBackgroundCopyManager.$Failed to set BITS job to foreground.$Failed to set BITS job to low priority.$Failed to set notification flags for BITS job.$Failed to set progress timeout.$WixBurn
API String ID: 542301482-4242919803
Opcode ID: 8ad1ed760eca03ef9d9092a294727b58eb391eaa4f935278f92f705fca3f5f84
Instruction ID: ddb22639d3305ed9406d64b9e9fa7b90d1f26d7a1d8e07c77fc861df7be4b910
Opcode Fuzzy Hash: 8ad1ed760eca03ef9d9092a294727b58eb391eaa4f935278f92f705fca3f5f84
Instruction Fuzzy Hash: 21319671E04319AFCB10EFB4C8C5DBEB7B5AF88314B14456BE602EB350E6799C459B90

Function 00FB37C6 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 92synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0002BF20,?,F0000003,00000000,00000000,00000000,?,00000000,00000000,00FB1E12,00000000,00000000,?,?), ref: 00FB386E
GetLastError.KERNEL32(?,?,?,00FB1AC0,?,?,00000000,?,?,00000000,?,?,?,?,?,00000001), ref: 00FB3879

Strings

pipe.cpp, xrefs: 00FB389E
Failed to write exit code to message buffer., xrefs: 00FB37EA
Failed to write restart to message buffer., xrefs: 00FB3807
Failed to post terminate message to child process cache thread., xrefs: 00FB383E
Failed to wait for child process exit., xrefs: 00FB38A8
Failed to post terminate message to child process., xrefs: 00FB385A

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: Failed to post terminate message to child process cache thread.$Failed to post terminate message to child process.$Failed to wait for child process exit.$Failed to write exit code to message buffer.$Failed to write restart to message buffer.$pipe.cpp
API String ID: 1211598281-2161881128
Opcode ID: 780dacbf59c2336617ab3d8fa46361ee7615a7f8cd37317a7ab57d7577b17ee3
Instruction ID: 0181fc41951a388a264feb669ad9a908c19c3f8cb0e6a07df7584c2730cd8ebd
Opcode Fuzzy Hash: 780dacbf59c2336617ab3d8fa46361ee7615a7f8cd37317a7ab57d7577b17ee3
Instruction Fuzzy Hash: 1E21B633A80266B7DB115A97CC45EDF7B689F00730F110165F910FA191E678DB047A96

Function 00FB75B5 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 83COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00FB75CB
GetFileAttributesW.KERNEL32(?,?,?,?,00000000,?,?,00000000,?,00FB8B78,?,?,?,?,?,?), ref: 00FB75E3
GetLastError.KERNEL32(?,00FB8B78,?,?,?,?,?,?,?,?,00000001,00000000), ref: 00FB75EE

Strings

Failed to format variable string., xrefs: 00FB75D6
Failed to set variable., xrefs: 00FB7674
File search: %ls, did not find path: %ls, xrefs: 00FB7641
search.cpp, xrefs: 00FB761F
Failed get to file attributes. '%ls', xrefs: 00FB762C

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$search.cpp
API String ID: 1811509786-2053429945
Opcode ID: e962d3db21118d8fe36e5ab221d4ceded6d42b407d38ca9c486b9610d4d87543
Instruction ID: 4a810666b66e9d2ea8c2251975884bda5ce306d513b75f828af63d6a6f46d8eb
Opcode Fuzzy Hash: e962d3db21118d8fe36e5ab221d4ceded6d42b407d38ca9c486b9610d4d87543
Instruction Fuzzy Hash: 1B216BB2D04B56BADB123A9ECC46FEE7726DF40360F140131F900E51D0E764DD10BAA1

Function 00FB9B01 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 53registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00FB9B87

Part of subcall function 00FE37DF: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,80070002,80070003,00000000,00000000,00000000), ref: 00FE3850
Part of subcall function 00FE37DF: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00FE3889

Strings

Failed to open Windows folder key., xrefs: 00FB9B39
Failed to read folder path for '%ls'., xrefs: 00FB9B53
CommonFilesDir, xrefs: 00FB9B0F, 00FB9B43, 00FB9B52
+, xrefs: 00FB9B09
ProgramFilesDir, xrefs: 00FB9B16
SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 00FB9B24
Failed to ensure path was backslash terminated., xrefs: 00FB9B71

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: QueryValue$Close
String ID: +$CommonFilesDir$Failed to ensure path was backslash terminated.$Failed to open Windows folder key.$Failed to read folder path for '%ls'.$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
API String ID: 1979452859-3209209246
Opcode ID: 37405aaa55335add7a0be19ece5a68df25a1018599d8ad45154754a781c79101
Instruction ID: 1a92ace67fd736ea5e44c4f8a3de566ab4de7fa8b7226a33bd78167507f8e539
Opcode Fuzzy Hash: 37405aaa55335add7a0be19ece5a68df25a1018599d8ad45154754a781c79101
Instruction Fuzzy Hash: 9401B932A4426CF7DB215656EC06EDEB668DF91760F108125FA0576272DAF8CF00FA92

Function 00FC1F06 Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 222sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC1BC4: RegCloseKey.ADVAPI32(?,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,?,00000001,?,?,?,00FC1F22,00000000,?,?,?), ref: 00FC1C51

Sleep.KERNEL32(000007D0,00000001,00000000,Setup,00000000,log,0000000D,00000000,00000000,?,?,?), ref: 00FC1FB1

Strings

Failed to copy full log path to prefix., xrefs: 00FC2125
Failed to get non-session specific TEMP folder., xrefs: 00FC2063
log, xrefs: 00FC1F60
Failed to open log: %ls, xrefs: 00FC202B
Failed to get current directory., xrefs: 00FC1F9D
Failed to copy log extension to extension., xrefs: 00FC210A
Failed to copy log path to prefix., xrefs: 00FC20EB
Setup, xrefs: 00FC1F66

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseSleep
String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$log
API String ID: 2834455192-2818506709
Opcode ID: 33492b64c1f4040b8d39a989b2ebb1f736ce5c49aef44852dd031c51c33c430b
Instruction ID: febc5c1df359abb4efaf43a123318f24e8af8ee329cae0b86b8b971e0f6fe134
Opcode Fuzzy Hash: 33492b64c1f4040b8d39a989b2ebb1f736ce5c49aef44852dd031c51c33c430b
Instruction Fuzzy Hash: 65716D7290024BEFCB20AFA0CE82EADBBB9FF01354B24442EE60197151D7759A94FB51

Function 00FC6393 Relevance: 13.6, APIs: 9, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00FC63AF
DefWindowProcW.USER32(?,00000082,?,?), ref: 00FC63E7
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00FC63F4
SetWindowLongW.USER32(?,000000EB,?), ref: 00FC6403
DefWindowProcW.USER32(?,?,?,?), ref: 00FC6411
_memset.LIBCMT ref: 00FC6426
BeginPaint.USER32(?,?), ref: 00FC6433
EndPaint.USER32(?,?), ref: 00FC6444
PostQuitMessage.USER32(00000000), ref: 00FC644E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Window$Long$PaintProc$BeginMessagePostQuit_memset
String ID:
API String ID: 527712210-0
Opcode ID: adc3b83011d1f88c5ed9ed0fd534028c6021a952472c51e8304f38e3c0188f4f
Instruction ID: 91e0406d5859b4494874ce21110ce374b1290024bad00017dbcd019e8cfbecd4
Opcode Fuzzy Hash: adc3b83011d1f88c5ed9ed0fd534028c6021a952472c51e8304f38e3c0188f4f
Instruction Fuzzy Hash: D821AC3290824EABDB15DFA89E8AF7F37A8EB09760F140519F602DA1A1C7349901B721

Function 00FC89D5 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 174COMMON

Download Yara Rule

APIs

Part of subcall function 00FE209C: lstrlenW.KERNEL32(00000000,00000000,?,00FE25FD,?,00000000,00000000,?,?,00FC783B,?,00000000,00000000,00000000), ref: 00FE20A4

Part of subcall function 00FE5D1F: _memset.LIBCMT ref: 00FE5D4A
Part of subcall function 00FE5D1F: FindFirstFileW.KERNELBASE(00000000,?,00000000,?,80070002), ref: 00FE5D5A
Part of subcall function 00FE5D1F: FindClose.KERNEL32(00000000), ref: 00FE5D66

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 00FC8AF1

Strings

WixBundleLastUsedSource, xrefs: 00FC8A1C
Failed to get current process directory., xrefs: 00FC8A92
Failed to copy source path., xrefs: 00FC8B3F, 00FC8B66
WixBundleOriginalSource, xrefs: 00FC8A37
Failed to combine last source with source., xrefs: 00FC8AAD
Failed to get path to current process., xrefs: 00FC8A74

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Find$CloseCompareFileFirstString_memsetlstrlen
String ID: Failed to combine last source with source.$Failed to copy source path.$Failed to get current process directory.$Failed to get path to current process.$WixBundleLastUsedSource$WixBundleOriginalSource
API String ID: 263632599-10224182
Opcode ID: 629d055c74abf74b962aa9270317777f21b86acb1147b2a40cd3ec330eb163ff
Instruction ID: 5e21a25f05fe888eedabd7a5edfa76d992d3c6beed7fadce540bd63e49e3d727
Opcode Fuzzy Hash: 629d055c74abf74b962aa9270317777f21b86acb1147b2a40cd3ec330eb163ff
Instruction Fuzzy Hash: B4512EB1D0025AFECF10EF91CD82EEEBBB4AF44350F24446EE511A2150DB799E86EB51

Function 00FD7195 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 161networkCOMMON

Download Yara Rule

APIs

HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FD71A8
GetLastError.KERNEL32(?,?,?,00FD747C,00000000,?,00000000,?,00000000,00000000,00000001,?), ref: 00FD71B2

Strings

Failed to send request to URL: %ls, trying to process HTTP status code anyway., xrefs: 00FD71CA
Failed to get HTTP status code for failed request to URL: %ls, xrefs: 00FD71EA
Failed to get redirect url: %ls, xrefs: 00FD734E
Failed to get HTTP status code for request to URL: %ls, xrefs: 00FD7345
Unknown HTTP status code %d, returned from URL: %ls, xrefs: 00FD724C

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorHttpLastRequestSend
String ID: Failed to get HTTP status code for failed request to URL: %ls$Failed to get HTTP status code for request to URL: %ls$Failed to get redirect url: %ls$Failed to send request to URL: %ls, trying to process HTTP status code anyway.$Unknown HTTP status code %d, returned from URL: %ls
API String ID: 4088757929-2903077892
Opcode ID: ca37944de754f6f2a2e7ab3fc320207150999e00e522ace8c8c06b3bd0452ba4
Instruction ID: d03f8fc15baea508faeff5a17bbdb47d00de93627af54d53d69c6f68c04ac274
Opcode Fuzzy Hash: ca37944de754f6f2a2e7ab3fc320207150999e00e522ace8c8c06b3bd0452ba4
Instruction Fuzzy Hash: 9641F572D0836BA7DB267A998C05B7E7A5AEF00365F1C0127BC01EF390F6688D40B6D5

Function 00FDFDC7 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,00000000,01007E3C), ref: 00FDFE0B
_memset.LIBCMT ref: 00FDFE23
GetComputerNameW.KERNEL32(?,?), ref: 00FDFE63

Strings

Executable: %ls v%d.%d.%d.%d, xrefs: 00FDFEBD
Computer : %ls, xrefs: 00FDFECF
--- logging level: %hs ---, xrefs: 00FDFF19
=== Logging started: %ls ===, xrefs: 00FDFE8C

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Name$ComputerFileModule_memset
String ID: --- logging level: %hs ---$=== Logging started: %ls ===$Computer : %ls$Executable: %ls v%d.%d.%d.%d
API String ID: 1941974936-3153207428
Opcode ID: 095b1d4c63b8596d11ca83d1e8d68c6f2094a1ac585d52126b105b06e9ac9ba9
Instruction ID: 7028b5018ccc9f69d57f05f0dfc8be678ccb516d6ba79a07b0675b28364b7ecd
Opcode Fuzzy Hash: 095b1d4c63b8596d11ca83d1e8d68c6f2094a1ac585d52126b105b06e9ac9ba9
Instruction Fuzzy Hash: 7141C6B290011C9BDB21DB55DC84EEA73BEEB04310F8441BBF646E7242D7359E89DBA4

Function 00FB5693 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 120registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,00000000,00000001,?,000000F9,00000001,?,00000105,00000000,?,?), ref: 00FB57AB
RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,00000000,00000001,?,000000F9,00000001,?,00000105,00000000,?,?), ref: 00FB57B8

Strings

Failed to open registration key., xrefs: 00FB571B
Failed to read Resume value., xrefs: 00FB5746
%ls.RebootRequired, xrefs: 00FB56A7
Failed to format pending restart registry key to read., xrefs: 00FB56C7
Resume, xrefs: 00FB5726

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: 4e06dc0113a933dd2ab76088da6cadedb725b01e16302a21ac1590839b1efb37
Instruction ID: 3c53e4ba23f8841b68de278d5ac494bdab63c14d33936746d8348205dbbdddd1
Opcode Fuzzy Hash: 4e06dc0113a933dd2ab76088da6cadedb725b01e16302a21ac1590839b1efb37
Instruction Fuzzy Hash: F8416276A00A0DFFCB119F96CC80BEEB7B5FB44720F614066E90597250DA789E41BF21

Function 00FC9974 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 113COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,?,7FFFFFFF,?,?,7FFFFFFF,?,00000000,?,00000000), ref: 00FC99F5
CompareStringW.KERNEL32(00000000,00000001,?,000000FF,00FD2AA7,000000FF,00FD2AA7,WixBundleLastUsedSource,00FD2AA7,?,?,?,?,?,00FD2AA7,?), ref: 00FC9A3C

Strings

WixBundleLastUsedSource, xrefs: 00FC9A19, 00FC9A1E, 00FC9A58
Failed to trim source folder., xrefs: 00FC9A0E
Failed to set last source., xrefs: 00FC9A68
Failed to determine length of source path., xrefs: 00FC99A5
Failed to determine length of relative path., xrefs: 00FC99C4

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CompareString
String ID: Failed to determine length of relative path.$Failed to determine length of source path.$Failed to set last source.$Failed to trim source folder.$WixBundleLastUsedSource
API String ID: 1825529933-660234312
Opcode ID: 7da2b671c6a48afa9f4f5bcbf27f97e3428ff7c12801422ef4a0a279bda2a8f3
Instruction ID: 798d9e0d12220c15d1f7f70973f414233bfbcdd736fedd05f5983a47efd761b2
Opcode Fuzzy Hash: 7da2b671c6a48afa9f4f5bcbf27f97e3428ff7c12801422ef4a0a279bda2a8f3
Instruction Fuzzy Hash: 6B31937190821AFBCF11DF95CD4AFAEBBB9AF40320F208519F524E61D0DAB8D641EB50

Function 00FBF55D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 106COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FBF574

Strings

Failed to read installed version from message buffer., xrefs: 00FBF60A
Failed to load compatible package., xrefs: 00FBF65A
Failed to read package id from message buffer., xrefs: 00FBF59C
Failed to read installed ProductCode from message buffer., xrefs: 00FBF5EA
Failed to copy installed ProductCode., xrefs: 00FBF629
Failed to find package: %ls, xrefs: 00FBF5BE

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset
String ID: Failed to copy installed ProductCode.$Failed to find package: %ls$Failed to load compatible package.$Failed to read installed ProductCode from message buffer.$Failed to read installed version from message buffer.$Failed to read package id from message buffer.
API String ID: 2102423945-2628348887
Opcode ID: 941a94ba58e738846ef18f857563fe3ed46d243fb8a98a992a138b22e9eb20c4
Instruction ID: 8e7a47054c5883aa2b3676c3794d83551cbb8c6ba058d88f2942ce2fda6e583e
Opcode Fuzzy Hash: 941a94ba58e738846ef18f857563fe3ed46d243fb8a98a992a138b22e9eb20c4
Instruction Fuzzy Hash: C7317732D00128BBCF11EEA6DC41DEEBBB9AF58350F244026FD10B3161EB358A55BB91

Function 00FB3D1B Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 93fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB4D26: CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,?,000000FF,00000000,00000000,?,?,?,00FBF15B,?,?,?,?), ref: 00FB4D4B

CreateFileW.KERNEL32(00FB222A,80000000,00000005,00000000,00000003,08000000,00000000,00FB222A,E8530674,00000000,00FB1E8E,33FF50BC,00FB1F0E,00FB1AAE,00FB1E22,00000000), ref: 00FB3D83

Part of subcall function 00FC8E97: _memset.LIBCMT ref: 00FC8EF1

GetLastError.KERNEL32 ref: 00FB3DCC

Strings

Failed to find payload for catalog file., xrefs: 00FB3DB6
Failed to get catalog local file path, xrefs: 00FB3DBD
Failed to verify catalog signature: %ls, xrefs: 00FB3E05
Failed to open catalog in working path: %ls, xrefs: 00FB3DFB
catalog.cpp, xrefs: 00FB3DEE

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CompareCreateErrorFileLastString_memset
String ID: Failed to find payload for catalog file.$Failed to get catalog local file path$Failed to open catalog in working path: %ls$Failed to verify catalog signature: %ls$catalog.cpp
API String ID: 3205693548-48089280
Opcode ID: 68ef2ddb18df510732e7457a305b3661654d153c4c2411238c165e834054b30f
Instruction ID: 16a8c5fbd3f3581d3c24160d8d6a128656b171d6d04b6b1c33ca4b12bbcf2085
Opcode Fuzzy Hash: 68ef2ddb18df510732e7457a305b3661654d153c4c2411238c165e834054b30f
Instruction Fuzzy Hash: D8315832940649BBCB119B5BCC42F8EBBB5EF84710F204015F905AB290E770EA02BF40

Function 00FD4F97 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 91synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,74DF30B0,?,00000000), ref: 00FD4FB5
ReleaseMutex.KERNEL32(?), ref: 00FD4FD5
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00FD5017
ReleaseMutex.KERNEL32(?), ref: 00FD502A
SetEvent.KERNEL32(?), ref: 00FD5033

Strings

Failed to send files in use message from netfx chainer., xrefs: 00FD5074
Failed to get message from netfx chainer., xrefs: 00FD504E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait$Event
String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
API String ID: 2608678126-3424578679
Opcode ID: 276bc2f756724a7e098957ce9653cbe88bd969228c242df1017a0263068102f6
Instruction ID: 0e6cf72b4c5fc9d278966a5f27304c953358675a328fb21dcfd58e57fe00ce46
Opcode Fuzzy Hash: 276bc2f756724a7e098957ce9653cbe88bd969228c242df1017a0263068102f6
Instruction Fuzzy Hash: 83313931900609BFCF229B65CC48EEEFFB2FF44320F14862AE525A62A1D775E545EB50

Function 00FB74E5 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00FB74FA
GetFileAttributesW.KERNEL32(00000000,?,?,00000000,00000000,?,00000000,?,00FB8B89,?,?,?), ref: 00FB750F
GetLastError.KERNEL32(?,00FB8B89,?,?,?), ref: 00FB751A

Strings

Failed to set directory search path variable., xrefs: 00FB754C
Directory search: %ls, did not find path: %ls, reason: 0x%x, xrefs: 00FB758F
Failed while searching directory search: %ls, for path: %ls, xrefs: 00FB7579
Failed to format variable string., xrefs: 00FB7505

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Directory search: %ls, did not find path: %ls, reason: 0x%x$Failed to format variable string.$Failed to set directory search path variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-2966038646
Opcode ID: 7939da88ff069590c335629852889f85f000fdb8d5f3873ab6a300f4468eed6d
Instruction ID: 53ca7faa9f8e22da97425eaa53ce3d9419d0bbbdbf587c1c1bb121064bd554ba
Opcode Fuzzy Hash: 7939da88ff069590c335629852889f85f000fdb8d5f3873ab6a300f4468eed6d
Instruction Fuzzy Hash: E621C372D48266FBCB327696CD06FDE7A259F80360F290120F904A91A1E7299F50BAD5

Function 00FB7747 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00FB775C
GetFileAttributesW.KERNEL32(00000000,?,?,00000000,00000000,?,00000000,?,00FB8B66,?,?,?), ref: 00FB7771
GetLastError.KERNEL32(?,00FB8B66,?,?,?), ref: 00FB777C

Strings

Failed while searching file search: %ls, for path: %ls, xrefs: 00FB77AB
Failed to format variable string., xrefs: 00FB7767
Failed to set variable to file search path., xrefs: 00FB77D5
File search: %ls, did not find path: %ls, xrefs: 00FB77E9

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable to file search path.$Failed while searching file search: %ls, for path: %ls$File search: %ls, did not find path: %ls
API String ID: 1811509786-3425311760
Opcode ID: 979fb20a00b6d58c1164872ed0d6c99b07967f11d8c9818d94adeedae08a66d0
Instruction ID: 47853704c94df51491b31f4dc31eb357092052544c1009df0a4f97973b3d5cba
Opcode Fuzzy Hash: 979fb20a00b6d58c1164872ed0d6c99b07967f11d8c9818d94adeedae08a66d0
Instruction Fuzzy Hash: 30112432D48266FACB1276A2CE02FDE7A25AF50321F300121F900A91E1DF698E50BBD1

Function 00FC78D8 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC78FC
GetTempPathW.KERNEL32(00000104,?,?,?,?), ref: 00FC7910
GetLastError.KERNEL32(?,?,?), ref: 00FC791A

Strings

Failed to get temp path for working folder., xrefs: 00FC7949
%ls%ls\, xrefs: 00FC7958
cache.cpp, xrefs: 00FC793F
Failed to append bundle id on to temp path for working folder., xrefs: 00FC796C

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLastPathTemp_memset
String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to get temp path for working folder.$cache.cpp
API String ID: 623060366-3390808230
Opcode ID: fd3c82339052f9c6c7d20dc1ef13df9a04da25e9e732f9c6ef49951bc81552e1
Instruction ID: f23440aee6f8af335884acf2b92e89a07dd1538c5238de47d338fdf667c51802
Opcode Fuzzy Hash: fd3c82339052f9c6c7d20dc1ef13df9a04da25e9e732f9c6ef49951bc81552e1
Instruction Fuzzy Hash: A9012B72E4532A67D320B7659C47FAB77A89F00760F140169FA04E72C2EA78DD0076D5

Function 00FBC1E9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 51synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000000FF,?,?,00FBC692,?,00FB138B,00000000,?,00FB13BB,00000001), ref: 00FBC1F6
GetLastError.KERNEL32(?,?,00FBC692,?,00FB138B,00000000,?,00FB13BB,00000001), ref: 00FBC200
GetExitCodeThread.KERNEL32(00000001,00000000,?,?,00FBC692,?,00FB138B,00000000,?,00FB13BB,00000001), ref: 00FBC242
GetLastError.KERNEL32(?,?,00FBC692,?,00FB138B,00000000,?,00FB13BB,00000001), ref: 00FBC24C

Strings

Failed to wait for cache thread to terminate., xrefs: 00FBC234
core.cpp, xrefs: 00FBC22A, 00FBC276
Failed to get cache thread exit code., xrefs: 00FBC280

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$core.cpp
API String ID: 3686190907-2546940223
Opcode ID: fcd9485c2a48d867e798e381766384425334e173499270c85751e4eeaa228ec3
Instruction ID: 4b9cb13bb1ff624d674b4f1dac414a37a68e77cb67a87eb7d28684f014d72f84
Opcode Fuzzy Hash: fcd9485c2a48d867e798e381766384425334e173499270c85751e4eeaa228ec3
Instruction Fuzzy Hash: 50115271A4424AFFDB20DFE2DD46BAF7A74AF00751F204164A510E91A1E7B9CA00BB55

Function 00FB5EC7 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 105stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE25A1: SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00FC7AE2,0000001C,00000000,00000000,00000000,00000000), ref: 00FE25C2

lstrlenA.KERNEL32(E900FEF2,00000000,00FB13BB,00000000,00FB13BB,00FB7089,00FB7089,?,0C683C79,00FB13BB,00FB706D,?,UninstallString,00FB13BB), ref: 00FB5F63

Strings

Failed to allocate regid folder path., xrefs: 00FB5F91
Failed to write tag xml to file: %ls, xrefs: 00FB5FAD
Failed to create regid folder: %ls, xrefs: 00FB5FA3
per-machine, xrefs: 00FB5EF7
per-user, xrefs: 00FB5F01, 00FB5F06
UninstallString, xrefs: 00FB5ECE
Failed to find local %hs appdata directory., xrefs: 00FB5F07

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: FolderPathlstrlen
String ID: Failed to allocate regid folder path.$Failed to create regid folder: %ls$Failed to find local %hs appdata directory.$Failed to write tag xml to file: %ls$UninstallString$per-machine$per-user
API String ID: 3664928333-3308940114
Opcode ID: c9870c11eaf111c634b6df2ec50fd6de8bed4e460b800c88f8180f65ff264f44
Instruction ID: b313edd7faa7fc6a3369b1cd7e511e8e30f8bdaa4069f8578a367c036c9a7826
Opcode Fuzzy Hash: c9870c11eaf111c634b6df2ec50fd6de8bed4e460b800c88f8180f65ff264f44
Instruction Fuzzy Hash: 69319E76800A19FBCF12AB96CC41AADFBB5EF44B50F248065F910A6150DB39DA90BF91

Function 00FD23FE Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 164COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,000000FE,?,00000000,?,?,?,00000000,?,00000000), ref: 00FD24C0
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00FD24CA

Strings

Failed to clear readonly bit on payload destination path: %ls, xrefs: 00FD24FA
download, xrefs: 00FD248B
Failed attempt to download URL: '%ls' to: '%ls', xrefs: 00FD258F
apply.cpp, xrefs: 00FD24EF

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: Failed attempt to download URL: '%ls' to: '%ls'$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$download
API String ID: 1799206407-2688335605
Opcode ID: cec1820e72c1c1f33cff8772259a8095ee91ad3564329eb5192157893231a7b1
Instruction ID: 5f3453105d5591b37895326910c2414ef173ca7577b89bb736095ce2cad6ff76
Opcode Fuzzy Hash: cec1820e72c1c1f33cff8772259a8095ee91ad3564329eb5192157893231a7b1
Instruction Fuzzy Hash: 8E51D232E0021AEBDB21DF95DC41FAAB7B6BF25720F18405AE505AA351E375DA40FB90

Function 00FB7EAB Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FB7ED6

Strings

Failed to enum related products., xrefs: 00FB7FC1
Failed to get version for product in machine context: %ls, xrefs: 00FB7FD4
Failed to convert version: %ls to DWORD64 for ProductCode: %ls, xrefs: 00FB7FEB
VersionString, xrefs: 00FB7F16, 00FB7F4F
Failed to get version for product in user unmanaged context: %ls, xrefs: 00FB7F41

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset
String ID: Failed to convert version: %ls to DWORD64 for ProductCode: %ls$Failed to enum related products.$Failed to get version for product in machine context: %ls$Failed to get version for product in user unmanaged context: %ls$VersionString
API String ID: 2102423945-1979147598
Opcode ID: 5c123ab465a21fff18671bf703dc7f4a44f4ce6c121c20ae6211898e479e7471
Instruction ID: 985051fde4664f80a550631746dfc87eb52b5f8035da0bf70e3ae198b71b24c3
Opcode Fuzzy Hash: 5c123ab465a21fff18671bf703dc7f4a44f4ce6c121c20ae6211898e479e7471
Instruction Fuzzy Hash: FE418F72D0439DAFCB20EEDACC818FDF7B9EB44350F204026E515BB105D6389E44AB95

Function 00FC969C Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 126sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0,?,00000000,00000000,?), ref: 00FC9719

Part of subcall function 00FE6CB2: _memset.LIBCMT ref: 00FE6D27
Part of subcall function 00FE6CB2: _memset.LIBCMT ref: 00FE6D35
Part of subcall function 00FE6CB2: GetFileAttributesW.KERNELBASE(?,?,?,?,00000000,?,00000000), ref: 00FE6D3E
Part of subcall function 00FE6CB2: GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00FE6D59

Strings

Failed to calculate cache path., xrefs: 00FC96BE
Failed to ensure cache directory to remove was backslash terminated., xrefs: 00FC96D4
per-machine, xrefs: 00FC976E, 00FC97A4
per-user, xrefs: 00FC9777, 00FC977C, 00FC97AD, 00FC97B2
Failed to get old %hs package cache root directory., xrefs: 00FC97B3
Failed to get %hs package cache root directory., xrefs: 00FC977D

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset$AttributesErrorFileLastSleep
String ID: Failed to calculate cache path.$Failed to ensure cache directory to remove was backslash terminated.$Failed to get %hs package cache root directory.$Failed to get old %hs package cache root directory.$per-machine$per-user
API String ID: 6426718-1559687374
Opcode ID: 71492037b53ce5f17829cd37b45d9e5f84cdb9dde221bc61c1aaaf68184e6163
Instruction ID: a80c1545352a60a25b10bef5761923f4e7ca34e986e22aab2c63cb092fd75658
Opcode Fuzzy Hash: 71492037b53ce5f17829cd37b45d9e5f84cdb9dde221bc61c1aaaf68184e6163
Instruction Fuzzy Hash: AF319D32D14125BADF21BE558D8BFBEB6A8DF54710F240029F805F6151E5BC8E80B791

Function 00FD18C1 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FD18D2

Part of subcall function 00FE202C: GetModuleFileNameW.KERNEL32(00FB213E,?,00000104,?,00000104,?,00000000,?,?,00FB213E,?,00000000,?,?,?,76EEC3F0), ref: 00FE204D

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?), ref: 00FD194D

Part of subcall function 00FE232A: CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,00000000,000000FF,00000000,00000000,00000003,00000000,00000000,00000003,00000000,00000000), ref: 00FE236E

Strings

Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 00FD19F4
Failed to extract all payloads from container: %ls, xrefs: 00FD1998
Failed to extract payload: %ls from container: %ls, xrefs: 00FD19E8
Failed to open container: %ls., xrefs: 00FD192B

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CompareString$FileModuleName_memset
String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
API String ID: 3323778125-3891707333
Opcode ID: 11371dbe3bf74710dbfb480bff309c3c97465c34d52f13b48fdc419ca942e939
Instruction ID: 650b96b5bf12e2fccc6d8b4aa47fd5b7c4e9fd4050b093f7800ff10a233109ff
Opcode Fuzzy Hash: 11371dbe3bf74710dbfb480bff309c3c97465c34d52f13b48fdc419ca942e939
Instruction Fuzzy Hash: 56419232C00218BBCF11EA94CC65D9EB7BABF45360F184262F914A7251E6359B50FB52

Function 00FE2436 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00FB2142,00000000,?,?,?,?,00FB1E8E,00FB2222), ref: 00FE24CE
GetLastError.KERNEL32(?,?,?,?,00FB1E8E,00FB2222), ref: 00FE24DC
GetTempPathW.KERNEL32(00000104,00000000,00000000,00000104,00000000,00000000,00FB1E22,?,?,?,00FBB793,00000000,.ba%d,000F423F,00FB1E8E,00FB2222), ref: 00FE2512
GetLastError.KERNEL32(?,?,?,00FBB793,00000000,.ba%d,000F423F,00FB1E8E,00FB2222,00000000,00FB1D56,?,?,00FBD927,FEBB4868,00FB1E22), ref: 00FE2520

Strings

%s%s, xrefs: 00FE24B1
pathutil.cpp, xrefs: 00FE2545

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryPathTemp
String ID: %s%s$pathutil.cpp
API String ID: 2804724334-3961969462
Opcode ID: 84c8083507c3a14daf0c84592439f96e5cd4e7e56e408edf201580240e2d5c01
Instruction ID: 74f0f39f57bb841756ea098df37d8f513aaffa466e3fbe7df4809f8ddb812c78
Opcode Fuzzy Hash: 84c8083507c3a14daf0c84592439f96e5cd4e7e56e408edf201580240e2d5c01
Instruction Fuzzy Hash: 6A312E32D413A5E7CB61ABA78D85B9E7AACAF04360F190574F900E7011F3788E40FB91

Function 00FE0D26 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0000FDE9), ref: 00FE0D77
GetLastError.KERNEL32(?,?,00FE0138,?,00FD6AA0,?,?,00FD6AA0,?,Failed to extract all files from container.), ref: 00FE0D7D

Part of subcall function 00FE293A: GetProcessHeap.KERNEL32(00000000,?,?,00FE0E95,?,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000), ref: 00FE2942
Part of subcall function 00FE293A: HeapSize.KERNEL32(00000000,?,00FE0E95,?,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000,80070000), ref: 00FE2949

Strings

W, xrefs: 00FE0D54
strutil.cpp, xrefs: 00FE0E55

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: W$strutil.cpp
API String ID: 3662877508-3697633219
Opcode ID: 601c0430e33f5e4175085cd642de76835c422ac33d46b92510add1ef9e38f29a
Instruction ID: 2d9698b7e9bc719de74fd0fde3a239cde36a5f9bfa5999dac809624dfce90712
Opcode Fuzzy Hash: 601c0430e33f5e4175085cd642de76835c422ac33d46b92510add1ef9e38f29a
Instruction Fuzzy Hash: 47414271A0018DFFDB219F959C809AE7BB9EB04324F204979F515E7190DAB49E80BB51

Function 00FDFF4B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(01007E3C,00000001,00000000,00000001,?,?,00FC208C,00000001,?,00000000,?,00000000,00000000,0000000D,00000000,Setup), ref: 00FDFF5D
CreateFileW.KERNEL32(40000000,00000001,00000000,?,00000080,00000000,?,00000000,?,?,00000000,01007E34,?,?,00FC208C,00000001), ref: 00FDFFFE
GetLastError.KERNEL32(?,?,00FC208C,00000001,?,00000000,?,00000000,00000000,0000000D,00000000,Setup,00000000,log,0000000D,00000000), ref: 00FE000E
SetFilePointer.KERNEL32(00000000,00000000,00000002,?,?,00FC208C,00000001,?,00000000,?,00000000,00000000,0000000D,00000000,Setup,00000000), ref: 00FE0049

Part of subcall function 00FE263E: _memset.LIBCMT ref: 00FE268D
Part of subcall function 00FE263E: GetLocalTime.KERNEL32(?,?,?,?,00000000,?), ref: 00FE277F

LeaveCriticalSection.KERNEL32(01007E3C,?,00000000,01007E34,?,?,00FC208C,00000001,?,00000000,?,00000000,00000000,0000000D,00000000,Setup), ref: 00FE009E

Strings

logutil.cpp, xrefs: 00FE002E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime_memset
String ID: logutil.cpp
API String ID: 654766419-3545173039
Opcode ID: 26756e10e77c36de9eaf8eea02f9234a69767507914a57f95da39d80922a3917
Instruction ID: 35e3399d0554fef5ebe94765c7d816b949aa84bf65bae41522fbbaec8dd6ef35
Opcode Fuzzy Hash: 26756e10e77c36de9eaf8eea02f9234a69767507914a57f95da39d80922a3917
Instruction Fuzzy Hash: D831B5315021A8ABC7236F22DC49E6E7B26AB45B60F540425F285D7164CFBD8D90F7E0

Function 00FC70CC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,0000000E,?,00000000,00000002,?,00FC72FF,0000000E,?,?,?,?), ref: 00FC70E9
lstrlenW.KERNEL32(?,?,00FC72FF,0000000E,?,?,?,?), ref: 00FC70F0
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00FC72FF,0000000E,?,?,?,?), ref: 00FC7137
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00FC72FF,0000000E,?,?,?,?), ref: 00FC7190
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00FC72FF,0000000E,?,?,?,?), ref: 00FC71C1

Strings

W, xrefs: 00FC7164

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CompareString$lstrlen
String ID: W
API String ID: 1657112622-655174618
Opcode ID: ebe0c1f45d9e901f4f41da59f325304748d596123659803ed3d60b4aaeb3d563
Instruction ID: 03375d77eee38010219bb5f87fd2201c5c8d26b2fcb3b3c6f40157b38aae6a20
Opcode Fuzzy Hash: ebe0c1f45d9e901f4f41da59f325304748d596123659803ed3d60b4aaeb3d563
Instruction Fuzzy Hash: 0331847290834ABBCF21AF55CE46F9F3B69EB85360F288419F905DB110D275C980EF60

Function 00FBF9D3 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 108COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,8900011A,00FB17A1,00000001,?,00FB17A1,00000001,000000FF,00FB17A1,00FB17A5,00000000,00FB13C5,00000001,00000000,?,00FBBD45), ref: 00FBFAE3

Strings

Failed to create pipe name and client token., xrefs: 00FBFA3D
Failed to connect to elevated child process., xrefs: 00FBFAC1
elevation.cpp, xrefs: 00FBFA07
Failed to create pipe and cache pipe., xrefs: 00FBFA59
Failed to elevate., xrefs: 00FBFACC
UX aborted elevation requirement., xrefs: 00FBFA11

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseHandle
String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$elevation.cpp
API String ID: 2962429428-3003415917
Opcode ID: e86fc0992a0a18d496c67da7ddbf2c2fa3789245d165f4fbe35b7a11e50c29f5
Instruction ID: d9cf1278b858d71fac7aa1dafd54dbd5c52cc6aef67ee4148ebda720151e1330
Opcode Fuzzy Hash: e86fc0992a0a18d496c67da7ddbf2c2fa3789245d165f4fbe35b7a11e50c29f5
Instruction Fuzzy Hash: AB31F577640705BADB15E666CC41FEB32ADDB80360F204039F60ED7191EE7CE949BA25

Function 00FE5A1A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FE5A30
SysAllocString.OLEAUT32(?), ref: 00FE5A4C
VariantClear.OLEAUT32(?), ref: 00FE5AD3
SysFreeString.OLEAUT32(00000000), ref: 00FE5ADE

Strings

`<u, xrefs: 00FE5ADE
xmlutil.cpp, xrefs: 00FE5A63

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: `<u$xmlutil.cpp
API String ID: 760788290-3482516102
Opcode ID: 0e08f05c996838a4a0df78d5d2130948d720f2c985358fab25f1e2c825135130
Instruction ID: 7ee163bd2c7325839bf3fd6d7bbed0c540458677550469d03a71f69220c814d4
Opcode Fuzzy Hash: 0e08f05c996838a4a0df78d5d2130948d720f2c985358fab25f1e2c825135130
Instruction Fuzzy Hash: EB215371A00659AFCB10EFE5CC89AAE7779AF44B28F154564E901AB250D734DD01AB90

Function 00FD5FBE Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 75fileCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00FD600B
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00FD602B
GetLastError.KERNEL32 ref: 00FD6035

Strings

Unexpected call to CabWrite()., xrefs: 00FD5FED
Failed to write during cabinet extraction., xrefs: 00FD6064
cabextract.cpp, xrefs: 00FD605A

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLastWrite_memcpy_s
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
API String ID: 1970631241-3111339858
Opcode ID: e3b8184bb366077cb7c6acc3df903eb39f142ff2ae943e082c7b4a93ac38140f
Instruction ID: 576ff0d5642cf2b27ae16438bd329efd4c6c045767cf564aa6773b7ea990da86
Opcode Fuzzy Hash: e3b8184bb366077cb7c6acc3df903eb39f142ff2ae943e082c7b4a93ac38140f
Instruction Fuzzy Hash: 1921B036600645EFCB20CF69DC84E6A77B9EF84724B18012EF615C7791DA75E900A624

Function 00FD5EF1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00FD5F52
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00FD5F64
SetFileTime.KERNEL32(?,?,?,?), ref: 00FD5F77
CloseHandle.KERNEL32(?), ref: 00FD5F86

Strings

Invalid operation for this state., xrefs: 00FD5F2E
cabextract.cpp, xrefs: 00FD5F22

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Time$File$CloseDateHandleLocal
String ID: Invalid operation for this state.$cabextract.cpp
API String ID: 609741386-1751360545
Opcode ID: 31a83b236ab4ed2ba935eb8d618d75c7772fd115d8f295acade66f22f5105340
Instruction ID: e61d019a0cbe21867911fa74f020e43cad3144bbd21778fa2681d9d8c1c2358c
Opcode Fuzzy Hash: 31a83b236ab4ed2ba935eb8d618d75c7772fd115d8f295acade66f22f5105340
Instruction Fuzzy Hash: 2511D671610F09AEA7109BA8CC8997BB7BDEF04711754052BF611DA1A0EB74E905EB20

Function 00FB7423 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00FB743D
GetFileAttributesW.KERNEL32(?,?,?,?,00000000,?,?,00000000,00000000,?,00FB8B91,?,?,?,?,?), ref: 00FB7452
GetLastError.KERNEL32(?,00FB8B91,?,?,?,?,?,?,?,?,00000001,00000000), ref: 00FB745D

Strings

Failed while searching directory search: %ls, for path: %ls, xrefs: 00FB749B
Failed to format variable string., xrefs: 00FB7448
Failed to set variable., xrefs: 00FB74C3

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-402580132
Opcode ID: 6fa75d742d9db2217f232ed69ae68d8b88bcc38f499096e74733223ce575f603
Instruction ID: 89e2100ab0360f90d38f720fdd2b4b85f42f9573ab94c1dd353e65f98192641e
Opcode Fuzzy Hash: 6fa75d742d9db2217f232ed69ae68d8b88bcc38f499096e74733223ce575f603
Instruction Fuzzy Hash: D51106B2D08219FECB11FEA6CC829EEBE39DB80361F204135F901A6050D3795E80BE91

Function 00FC676A Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 56COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00FC67E1

Strings

Condition, xrefs: 00FC677C
Failed to select condition node., xrefs: 00FC6798
Failed to get Condition inner text., xrefs: 00FC67B1
`<u, xrefs: 00FC67E1
Failed to copy condition string from BSTR, xrefs: 00FC67CB

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: FreeString
String ID: Condition$Failed to copy condition string from BSTR$Failed to get Condition inner text.$Failed to select condition node.$`<u
API String ID: 3341692771-266405526
Opcode ID: f12963c66a8b409196e57f0212d4bb430f600e5b20952181086f573d80693557
Instruction ID: ba18a76016603250769173747de3c72f2096efca47feee09b18926b6354f1f46
Opcode Fuzzy Hash: f12963c66a8b409196e57f0212d4bb430f600e5b20952181086f573d80693557
Instruction Fuzzy Hash: 3D11A572D4467ABBCB11AB94CD46FADB7A89F14729F100558F801F6190DF74DE40F680

Function 00FB944B Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FB9470
GetTempPathW.KERNEL32(00000104,?), ref: 00FB9484
GetLastError.KERNEL32 ref: 00FB948E

Strings

variable.cpp, xrefs: 00FB94B3
Failed to set variant value., xrefs: 00FB94D9
Failed to get temp path., xrefs: 00FB94BD

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLastPathTemp_memset
String ID: Failed to get temp path.$Failed to set variant value.$variable.cpp
API String ID: 623060366-2915113195
Opcode ID: 63f9790af8b4dcf5023e98bdc9e9977b03298fa3889500013829974015cad675
Instruction ID: 0d1c05b739fa7c7c335a428756cd969c9a99443ad99a5273bda9872a4a683be4
Opcode Fuzzy Hash: 63f9790af8b4dcf5023e98bdc9e9977b03298fa3889500013829974015cad675
Instruction Fuzzy Hash: 79012B72F05329A7E721DB519C06FAA33A85F00720F144161FA10EB2C2EEA9DE016BD5

Function 00FD9DC5 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,01003370,00000008,00FD9ECD,00000000,00000000,?,00FE924C,00FD6AA0,?,00000000,00000000), ref: 00FD9DD6
__lock.LIBCMT ref: 00FD9E0A

Part of subcall function 00FDBE4B: __mtinitlocknum.LIBCMT ref: 00FDBE61
Part of subcall function 00FDBE4B: __amsg_exit.LIBCMT ref: 00FDBE6D
Part of subcall function 00FDBE4B: EnterCriticalSection.KERNEL32(00000000,00000000,?,00FD9E0F,0000000D,?,00FE924C,00FD6AA0,?,00000000,00000000), ref: 00FDBE75

InterlockedIncrement.KERNEL32(?), ref: 00FD9E17
__lock.LIBCMT ref: 00FD9E2B
___addlocaleref.LIBCMT ref: 00FD9E49

Strings

KERNEL32.DLL, xrefs: 00FD9DD1

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 7b22f76deee59b4b2704932deae914d69af7c4e69c77bc55fbafaa56fd3bc2dc
Instruction ID: 321602509b65b6f43468a69a387b3ce781f638cb79a77710972b62bf47b51905
Opcode Fuzzy Hash: 7b22f76deee59b4b2704932deae914d69af7c4e69c77bc55fbafaa56fd3bc2dc
Instruction Fuzzy Hash: CA01AD71444701DFE721EF66D84A74ABBE1BF40320F10890EE0DA973A0CBB9EA40DB25

Function 00FE057A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,00000000,?,?,00FB9127,00000000), ref: 00FE058E
GetProcAddress.KERNEL32(00000000), ref: 00FE0595
GetLastError.KERNEL32(?,?,00FB9127,00000000), ref: 00FE05AC

Strings

IsWow64Process, xrefs: 00FE057F
procutil.cpp, xrefs: 00FE05CE
kernel32, xrefs: 00FE0589

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: IsWow64Process$kernel32$procutil.cpp
API String ID: 4275029093-1586155540
Opcode ID: f25e83b610647db442bc9269eeb6d31821760b348f430ccae0527a55b0b97b93
Instruction ID: a01d994104f6ed72204c07035dbf9f4404f2bc581895239e0c8a2e96262b04fc
Opcode Fuzzy Hash: f25e83b610647db442bc9269eeb6d31821760b348f430ccae0527a55b0b97b93
Instruction Fuzzy Hash: 34F0C232E00356BBE721DB96CC4DA6B7B68EF00760F040029B941EB191EFB4DD00FAA0

Function 00FC22B5 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 135COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00FC22CD
LeaveCriticalSection.KERNEL32(?,?), ref: 00FC2414

Part of subcall function 00FBB6FB: _memset.LIBCMT ref: 00FBB720

Strings

update\%ls, xrefs: 00FC2328
Failed to recreate command-line for update bundle., xrefs: 00FC238D
Failed to set update bundle., xrefs: 00FC23E5
Failed to default local update source, xrefs: 00FC233C

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalSection$EnterLeave_memset
String ID: Failed to default local update source$Failed to recreate command-line for update bundle.$Failed to set update bundle.$update\%ls
API String ID: 3751686142-1266646976
Opcode ID: e430825d4aa6953ef1929d71f91e1fee21b528b694a512fedb8129adb8de275f
Instruction ID: 1a1868ad9eb2585474ab216ab6153413eb87f4978493fe02486412f81c9d2485
Opcode Fuzzy Hash: e430825d4aa6953ef1929d71f91e1fee21b528b694a512fedb8129adb8de275f
Instruction Fuzzy Hash: F141AC31940686EFCF228F85CD8AEAA7BA5FB48720F14406AF64957161D3B9DD90EB10

Function 00FE0E73 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,00FD6AA0,000000FF,00000000,00000000,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000), ref: 00FE0EC1
GetLastError.KERNEL32(?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000,80070000,?,?,?,?,00FE0138,?,00FD6AA0), ref: 00FE0EC7

Part of subcall function 00FE293A: GetProcessHeap.KERNEL32(00000000,?,?,00FE0E95,?,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000), ref: 00FE2942
Part of subcall function 00FE293A: HeapSize.KERNEL32(00000000,?,00FE0E95,?,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000,80070000), ref: 00FE2949

Strings

W, xrefs: 00FE0E9C
strutil.cpp, xrefs: 00FE0F9D

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: W$strutil.cpp
API String ID: 3662877508-3697633219
Opcode ID: 0899bd6064912b4f29e289f9b6032f2f15c767b51fa4622890cbdf965bf3a702
Instruction ID: 29f93f4cd6cfaeded9c25bc05523d6b7b3be68e4ad9e5d3af3bb0ee18a7b1d1c
Opcode Fuzzy Hash: 0899bd6064912b4f29e289f9b6032f2f15c767b51fa4622890cbdf965bf3a702
Instruction Fuzzy Hash: 70414471A0028AEFDB20CFA68C85A6E77A8EF04320F204529F554DB290DBB5D950BB50

Function 00FE6262 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,01001F04,00000208,00000000,?,00FDFE45,?,?,?), ref: 00FE6293
GlobalAlloc.KERNEL32(00000000,?,?,?,01001F04,00000208,00000000,?,00FDFE45,?,?,?), ref: 00FE62C1
GetLastError.KERNEL32(?,?,?,00000000,?,00FDFE45,?,?,?), ref: 00FE62EE
GetLastError.KERNEL32(00FDFE45,010022E4,?,?,?,?,?,00000000,?,00FDFE45,?,?,?), ref: 00FE6323
GlobalFree.KERNEL32(00FDFE45), ref: 00FE635F

Strings

fileutil.cpp, xrefs: 00FE62AD, 00FE633D

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: fileutil.cpp
API String ID: 1145190524-2967768451
Opcode ID: 2ae69b83e7c6675cd3ddea188f20ee0ad5cbe123979ab230572516ae88f8c358
Instruction ID: 3c2c64b04cbe95397442e0f553ab89bb6155de8f2d5f0748e99eb9f7f52db30f
Opcode Fuzzy Hash: 2ae69b83e7c6675cd3ddea188f20ee0ad5cbe123979ab230572516ae88f8c358
Instruction Fuzzy Hash: 23317572F0029DABDB119F96CC45EAFBBA9EF247A0F144025FA15E6291E771C900B790

Function 00FDCC51 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00FDCC5D

Part of subcall function 00FD9EF2: __getptd_noexit.LIBCMT ref: 00FD9EF5
Part of subcall function 00FD9EF2: __amsg_exit.LIBCMT ref: 00FD9F02

__amsg_exit.LIBCMT ref: 00FDCC7D
__lock.LIBCMT ref: 00FDCC8D
InterlockedDecrement.KERNEL32(?), ref: 00FDCCAA
_free.LIBCMT ref: 00FDCCBD
InterlockedIncrement.KERNEL32(00B92D58), ref: 00FDCCD5

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: d0b67b560d19499e541275fbf826cb415f037dcf9ab38d16b1d8f957224087f2
Instruction ID: e7d4c8e5bcf129ee2712c47c4482675519bbe4fd56bb183171a6c54e51baf763
Opcode Fuzzy Hash: d0b67b560d19499e541275fbf826cb415f037dcf9ab38d16b1d8f957224087f2
Instruction Fuzzy Hash: D901A132D00A539BD722AB65E84578E77A2BF04730F1D0007E94867380C73AA951EFD6

Function 00FCDC71 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 211COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,?,000000FF,00000008,000000FF,00000000,00000000,00000000), ref: 00FCDCD6

Strings

Failed to insert execute action., xrefs: 00FCDDF1
Failed to plan action for target product., xrefs: 00FCDD23
Failed grow array of ordered patches., xrefs: 00FCDE32
Failed to copy target product code., xrefs: 00FCDD9A

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CompareString
String ID: Failed grow array of ordered patches.$Failed to copy target product code.$Failed to insert execute action.$Failed to plan action for target product.
API String ID: 1825529933-3432308488
Opcode ID: 065f1dbedc60d7e9e26a743f5a475a1ffd2146f3a1875f7b70fc6d3fb906e113
Instruction ID: 07d021ef53201bc548b8cc7fa0f0da4d1c81dad9df76378f7415f471a3168b33
Opcode Fuzzy Hash: 065f1dbedc60d7e9e26a743f5a475a1ffd2146f3a1875f7b70fc6d3fb906e113
Instruction Fuzzy Hash: EF81F7B5A00206EFCB05DF54CA82EADB7B5EF48320B2181ADE8159B361D734EE51EF50

Function 00FD4349 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,?,?,?,?,?,?,00000001,00000000), ref: 00FD437C
CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF), ref: 00FD4401

Strings

Failed to initialize update bundle., xrefs: 00FD4498
detect.cpp, xrefs: 00FD445C
BA aborted detect forward compatible bundle., xrefs: 00FD4466

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CompareString
String ID: BA aborted detect forward compatible bundle.$Failed to initialize update bundle.$detect.cpp
API String ID: 1825529933-918857910
Opcode ID: 41e3f1fbd1beb79ec50c255b292892671936fd541873ac688f718b0119de316b
Instruction ID: 01389674c42256eed8c8d375cb77150f3e771bbedfc634e316c64edd4e634be6
Opcode Fuzzy Hash: 41e3f1fbd1beb79ec50c255b292892671936fd541873ac688f718b0119de316b
Instruction Fuzzy Hash: 09518D30900616FBDB25DF58CC81FAAB7BAFF05320F14460AF925966A1C771B9A0FB50

Function 00FB60D5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 86registryCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,?,000000FF,00FB72B8,PackageVersion,?,?,00000001,00000001,00FB72B8,00000001,00020006,00000001), ref: 00FB614A
RegCloseKey.ADVAPI32(00FB72B8,00FB72B8,PackageVersion,?,?,00000001,00000001,00FB72B8,00000001,00020006,00000001,00000000), ref: 00FB6160

Strings

PackageVersion, xrefs: 00FB612C
Failed to remove update registration key: %ls, xrefs: 00FB618E
Failed to format key for update registration., xrefs: 00FB6101

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseCompareString
String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
API String ID: 446873843-3222553582
Opcode ID: 8736afab4b5d1e95780313abb0a28a414cd93d8c497965661b621cfc7eccbd42
Instruction ID: 87d2d0863c2415e37579bbe1373440c1255084c805f08c1fe0e0219d9ad3e28e
Opcode Fuzzy Hash: 8736afab4b5d1e95780313abb0a28a414cd93d8c497965661b621cfc7eccbd42
Instruction Fuzzy Hash: A9219F35D00258FFCF11AF9ADC469DEBBB9AF80B10F204566F110A21A2D7BA5A40FF50

Function 00FB5FEC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00FE25A1: SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00FC7AE2,0000001C,00000000,00000000,00000000,00000000), ref: 00FE25C2

RemoveDirectoryW.KERNEL32(00000001,00000001,00000001,00000001,00000001,00FB72C5,?,00000001,-0000001B,00FB72C5,00000001,00000000,?,00FB72C5,00000001,00000001), ref: 00FB6080

Strings

Failed to allocate regid folder path., xrefs: 00FB6097
per-machine, xrefs: 00FB601C
per-user, xrefs: 00FB6026, 00FB602B
Failed to find local %hs appdata directory., xrefs: 00FB602C

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: DirectoryFolderPathRemove
String ID: Failed to allocate regid folder path.$Failed to find local %hs appdata directory.$per-machine$per-user
API String ID: 293476170-2037127396
Opcode ID: f956593842dc39a5422a0bdd1c3da8b72e039973b4da86bb781569e8790b424a
Instruction ID: bf0e5d8abd6425d7e5e00f31dc2543ecfc4c26a99174bd2a270cbb5b6a8df658
Opcode Fuzzy Hash: f956593842dc39a5422a0bdd1c3da8b72e039973b4da86bb781569e8790b424a
Instruction Fuzzy Hash: 7F214FB2D00259FBCF11BF96DD8189DBBB8EF04784B108066F510E6151DB799A90EF91

Function 00FE7E39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateContextProperty.CRYPT32(?,00FC861C,00000000,00000003), ref: 00FE7E55
GetLastError.KERNEL32(?,00FC861C,?,00000003,00AAC56B,?), ref: 00FE7E5B
CertGetCertificateContextProperty.CRYPT32(?,00FC861C,00000000,00000003), ref: 00FE7EBE
GetLastError.KERNEL32(?,00FC861C,?,00000003,00AAC56B,?), ref: 00FE7EC4

Strings

certutil.cpp, xrefs: 00FE7E7D, 00FE7EA5, 00FE7EE6

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CertCertificateContextErrorLastProperty
String ID: certutil.cpp
API String ID: 980632616-2692845373
Opcode ID: a40fc6e730e97d87a08e551cb3857da856038ce00afc134a39733ece513e81b8
Instruction ID: 4d4cb8b2db5b5e96fea5fc57b42fc6396e4610b8f469c79d0595e6419d7fcee2
Opcode Fuzzy Hash: a40fc6e730e97d87a08e551cb3857da856038ce00afc134a39733ece513e81b8
Instruction Fuzzy Hash: FF21837274838AABEB11ABA78C85F6B3AADEF44750F110075B600DB251EBB9DD007760

Function 00FE7F18 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

QueryServiceConfigW.ADVAPI32(?,00000000,00000000,?,00000001,00000000,?,?,?,?,00FCEFD9,?,?), ref: 00FE7F37
GetLastError.KERNEL32(?,?,?,00FCEFD9,?,?), ref: 00FE7F47

Part of subcall function 00FE28F3: GetProcessHeap.KERNEL32(00FD6AA0,?,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000), ref: 00FE2904
Part of subcall function 00FE28F3: RtlAllocateHeap.NTDLL(00000000,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000), ref: 00FE290B

QueryServiceConfigW.ADVAPI32(?,00000000,?,?,?,00000001,?,?,?,00FCEFD9,?,?), ref: 00FE7F80
GetLastError.KERNEL32(?,?,?,00FCEFD9,?,?), ref: 00FE7F86

Strings

svcutil.cpp, xrefs: 00FE7F69, 00FE7FA4

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ConfigErrorHeapLastQueryService$AllocateProcess
String ID: svcutil.cpp
API String ID: 355237494-1746323212
Opcode ID: 7775876bc43ea27acacb00b2f593f76fee4c44a687f8be6f81e7d37ed1ce4368
Instruction ID: 735666bc257e48c0f822de370ea0d47a54f870664086cbadc50950fc84f56286
Opcode Fuzzy Hash: 7775876bc43ea27acacb00b2f593f76fee4c44a687f8be6f81e7d37ed1ce4368
Instruction Fuzzy Hash: E6216871B043CABEEB11AB96DD85FAE7AACEB14754F100439B600EA151E674DE4076E0

Function 00FBF376 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FBF38D

Strings

Failed to read package id from message buffer., xrefs: 00FBF3B5
Failed to read action., xrefs: 00FBF3D5
Failed to execute package provider action., xrefs: 00FBF42C
Failed to find package: %ls, xrefs: 00FBF40D

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset
String ID: Failed to execute package provider action.$Failed to find package: %ls$Failed to read action.$Failed to read package id from message buffer.
API String ID: 2102423945-384206569
Opcode ID: b78de250d811e944a913bfc613bdc0b63f1f4535fbfaf7aabfe24a5da7e4109a
Instruction ID: 89c759ce33eb773d33cf6af112eff7651153587d4c8e810f841e884224a11adf
Opcode Fuzzy Hash: b78de250d811e944a913bfc613bdc0b63f1f4535fbfaf7aabfe24a5da7e4109a
Instruction Fuzzy Hash: 23216972D0012DFBCF12EAA1DC02EEE7A78AF14360F140061F900B6191EB79DB18BB91

Function 00FE8112 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80networkCOMMON

Download Yara Rule

APIs

HttpQueryInfoW.WININET(?,?,00000001,00000000,?), ref: 00FE8166
GetLastError.KERNEL32(?,00FD7300,00000000,00000033,?,00000000,00000013,00000000,?,?,?,00FD747C,00000000,?,00000000,?), ref: 00FE816C
HttpQueryInfoW.WININET(?,?,00000001,00000000,?), ref: 00FE819F
GetLastError.KERNEL32(?,00FD7300,00000000,00000033,?,00000000,00000013,00000000,?,?,?,00FD747C,00000000,?,00000000,?), ref: 00FE81A5

Strings

inetutil.cpp, xrefs: 00FE81C6

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorHttpInfoLastQuery
String ID: inetutil.cpp
API String ID: 4218848986-2900720265
Opcode ID: 110f61d504a78ed8f1f9d93b17bd2add2f5c436bcdb63af05cb990626d949326
Instruction ID: 294f45468ed361f2b9cddf95dc64ce422bc6aca494dde77d92a28d607d21bceb
Opcode Fuzzy Hash: 110f61d504a78ed8f1f9d93b17bd2add2f5c436bcdb63af05cb990626d949326
Instruction Fuzzy Hash: 3A218471600249FBDB02AF96CC81EAF77ADEF54390F100465F905D6150EBB9EE42AB60

Function 00FE7125 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(?,00000000,00000001,00000009,00000000,?,?,?,00FC1F96,00000001,00000000,Setup,00000000,log,0000000D,00000000), ref: 00FE716C
GetLastError.KERNEL32(?,?,?,00FC1F96,00000001,00000000,Setup,00000000,log,0000000D,00000000,00000000,?,?,?), ref: 00FE7174
GetCurrentDirectoryW.KERNEL32(00000000,?,?,00000000,?,?,?,00FC1F96,00000001,00000000,Setup,00000000,log,0000000D,00000000,00000000), ref: 00FE71B6
GetLastError.KERNEL32(?,?,?,00FC1F96,00000001,00000000,Setup,00000000,log,0000000D,00000000,00000000,?,?,?), ref: 00FE71BC

Strings

dirutil.cpp, xrefs: 00FE71E6

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CurrentDirectoryErrorLast
String ID: dirutil.cpp
API String ID: 152501406-2193988115
Opcode ID: c13b5a32f7586f4f11de4f84ed439d4ac610e32f9e3c85802bd54d99254a2b6e
Instruction ID: 7997ff9855cfd74f21aaa5bf601f813f3ca0d72352e0ce605c6138a7bd36b7cd
Opcode Fuzzy Hash: c13b5a32f7586f4f11de4f84ed439d4ac610e32f9e3c85802bd54d99254a2b6e
Instruction Fuzzy Hash: 95218D71E04396FBDB11DB96CD45A9E7BB8EF04750F200469E500D7110E77CDA40BB54

Function 00FD4EB4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE28F3: GetProcessHeap.KERNEL32(00FD6AA0,?,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000), ref: 00FE2904
Part of subcall function 00FE28F3: RtlAllocateHeap.NTDLL(00000000,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000), ref: 00FE290B

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00FD4F4A
ReleaseMutex.KERNEL32(?), ref: 00FD4F79
SetEvent.KERNEL32(?), ref: 00FD4F82

Strings

NetFxChainer.cpp, xrefs: 00FD4EEE
Failed to allocate buffer., xrefs: 00FD4EFB

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Heap$AllocateEventMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate buffer.$NetFxChainer.cpp
API String ID: 944053411-3611226795
Opcode ID: 9c414869d7ebe389ff846ac4fcf60f1bbbd3db9d37a111783617d61ea130d8c0
Instruction ID: f7f81f86c8c2e75f2a5c509548590b36bdcb7cabbd8e9330671ebc3ebf1c676e
Opcode Fuzzy Hash: 9c414869d7ebe389ff846ac4fcf60f1bbbd3db9d37a111783617d61ea130d8c0
Instruction Fuzzy Hash: DC210571900249EFDB10DF64C889B9EBBB6FF44324F148069F810AF361D7799901EB90

Function 00FB2F4A Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 74fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,00000000,?,80070057,F0000002), ref: 00FB2FA0

Strings

Failed to allocate message to write., xrefs: 00FB2F75
pipe.cpp, xrefs: 00FB2FD9
Failed to write message type to pipe., xrefs: 00FB2FE3

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: FileWrite
String ID: Failed to allocate message to write.$Failed to write message type to pipe.$pipe.cpp
API String ID: 3934441357-1996674626
Opcode ID: 13d8f111c3fce7adfbcd8040825165ae0c0125492a18ed9c954a8da3a9f02507
Instruction ID: 310c80c4f7d1b9a254eeafe52bce2671de7ba3224934f32b37b84642d406729b
Opcode Fuzzy Hash: 13d8f111c3fce7adfbcd8040825165ae0c0125492a18ed9c954a8da3a9f02507
Instruction Fuzzy Hash: 2211AF72B0420AFEDB119F96DD85DFFBBB9EB44750B200026F901B6141EA799E40BB61

Function 00FD753B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73networktimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD7363: InternetCloseHandle.WININET(00000000), ref: 00FD7388
Part of subcall function 00FD7363: InternetCloseHandle.WININET(00000000), ref: 00FD7396
Part of subcall function 00FD7363: InternetConnectW.WININET(?,00000000,?,00000000,?,?,00000000,00000000), ref: 00FD73F5
Part of subcall function 00FD7363: lstrlenW.KERNEL32(00000000), ref: 00FD7420
Part of subcall function 00FD7363: InternetSetOptionW.WININET(00000000,0000002B,00000000,00000000), ref: 00FD742D
Part of subcall function 00FD7363: lstrlenW.KERNEL32(00000001), ref: 00FD7436
Part of subcall function 00FD7363: InternetSetOptionW.WININET(00000000,0000002C,00000001,00000000), ref: 00FD743F

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,00000000,000000FF,?,00000000,HEAD,00000000,00000000,?,00000000,?,?), ref: 00FD75CD
InternetCloseHandle.WININET(?), ref: 00FD75E3
InternetCloseHandle.WININET(00000000), ref: 00FD75ED

Strings

HEAD, xrefs: 00FD755E
Failed to connect to URL: %ls, xrefs: 00FD7588

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Internet$CloseHandle$OptionTimelstrlen$ConnectFileSystem
String ID: Failed to connect to URL: %ls$HEAD
API String ID: 1677864904-290634988
Opcode ID: 1940a8c2db70547209db9b4ee311a50ec4376491b1486c277f9cd38050364264
Instruction ID: 05f14872d4ab30623b0d297ffc9adbc5c4572d328aa3b6819bf73bb13f177ad8
Opcode Fuzzy Hash: 1940a8c2db70547209db9b4ee311a50ec4376491b1486c277f9cd38050364264
Instruction Fuzzy Hash: 00212A7190022DFFCF02AF95DC859DEBFB9FF08750B144066F915A6220E7759A20EB91

Function 00FE596E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00FE5981
VariantInit.OLEAUT32(?), ref: 00FE598D
VariantClear.OLEAUT32(?), ref: 00FE5A01
SysFreeString.OLEAUT32(00000000), ref: 00FE5A0C

Part of subcall function 00FE5551: SysAllocString.OLEAUT32(?), ref: 00FE5566

Strings

`<u, xrefs: 00FE5A0C

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: String$AllocVariant$ClearFreeInit
String ID: `<u
API String ID: 347726874-3367579956
Opcode ID: 81d3aea0af43d9256f1241d0e9ce5e2f8ec4cfc1ee4d6ea1a485c74c92f0784a
Instruction ID: 1c7bda6b7dec642e328a1929454e337a37badf78a1bf685db5e0d93e81645057
Opcode Fuzzy Hash: 81d3aea0af43d9256f1241d0e9ce5e2f8ec4cfc1ee4d6ea1a485c74c92f0784a
Instruction Fuzzy Hash: A1215071E00669EFCB10DFA5CC89AEEBBB8AF44B29F044554E901DB251DB30ED00DB90

Function 00FE8057 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70timenetworkCOMMON

Download Yara Rule

APIs

HttpQueryInfoW.WININET(00000000,4000000B,?,00000000,00000000), ref: 00FE8096
GetLastError.KERNEL32 ref: 00FE80A0
SystemTimeToFileTime.KERNEL32(?,?), ref: 00FE80C9
GetLastError.KERNEL32 ref: 00FE80D3

Strings

inetutil.cpp, xrefs: 00FE80F5

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLastTime$FileHttpInfoQuerySystem
String ID: inetutil.cpp
API String ID: 3487154604-2900720265
Opcode ID: 1422e889ac589b2c269d5d94fafe9512c2e7ddfc9fbf7cb1f8ec01a4a656706a
Instruction ID: 1c7985109179a7c7a20e11492f51254c11b489c56e3ab611395088f50d0aefdf
Opcode Fuzzy Hash: 1422e889ac589b2c269d5d94fafe9512c2e7ddfc9fbf7cb1f8ec01a4a656706a
Instruction Fuzzy Hash: 8511BC72A0015BABD711DBAACC45BAFBBACAF047A0F010135EB05EB151EB64DD04A7D5

Function 00FC6FB6 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00FC703D

Strings

Failed to read next symbol., xrefs: 00FC7056
Failed to find variable., xrefs: 00FC702B
condition.cpp, xrefs: 00FC6FD9, 00FC7021
Failed to parse condition '%ls' at position: %u, xrefs: 00FC6FF0

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memcpy_s
String ID: Failed to find variable.$Failed to parse condition '%ls' at position: %u$Failed to read next symbol.$condition.cpp
API String ID: 2001391462-1605196437
Opcode ID: bfca0bf651bee679670603361132b812272c4c8cbcc5fee11cb855480b751500
Instruction ID: 384d0160ac96fbc3becd7c11fb0bc61728eb894327d6e8df378f9eb86f084892
Opcode Fuzzy Hash: bfca0bf651bee679670603361132b812272c4c8cbcc5fee11cb855480b751500
Instruction Fuzzy Hash: 551180326C874676D331361DCD03F67B665DBC4BA0F10081CF341961E1DBA6E411B7A2

Function 00FC7BB8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00FE28F3: GetProcessHeap.KERNEL32(00FD6AA0,?,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000), ref: 00FE2904
Part of subcall function 00FE28F3: RtlAllocateHeap.NTDLL(00000000,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000), ref: 00FE290B

CreateWellKnownSid.ADVAPI32(00000000,00000000,00000000,00000000,00000044,00000001,00000000,00000000,20000004,?,00FC7C8E,0000001A,00000000,00000000,00000000,00000000), ref: 00FC7C04
GetLastError.KERNEL32(?,00FC7C8E,0000001A,00000000,00000000,00000000,00000000,00000000), ref: 00FC7C0E

Strings

Failed to allocate memory for well known SID., xrefs: 00FC7BEB
cache.cpp, xrefs: 00FC7BDF, 00FC7C33
Failed to create well known SID., xrefs: 00FC7C3D

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Heap$AllocateCreateErrorKnownLastProcessWell
String ID: Failed to allocate memory for well known SID.$Failed to create well known SID.$cache.cpp
API String ID: 2186923214-2110050797
Opcode ID: 187ec68affb701c29c8b1ab8813e3186bf44e9072f4e8533c27e63d6b26ef1bb
Instruction ID: 5398ef185117f1948e0cdde1f81930e3c6ed520cca6c0427edd2acd5fe66668a
Opcode Fuzzy Hash: 187ec68affb701c29c8b1ab8813e3186bf44e9072f4e8533c27e63d6b26ef1bb
Instruction Fuzzy Hash: 3A112C33A4939776D23077128D03F6B76189F81F60F114029F600AF1C0EA6CCD0176E5

Function 00FD7D84 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000003E8,000004FF), ref: 00FD7DB5
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00FD7DDD
GetLastError.KERNEL32 ref: 00FD7DE5

Strings

Failed while waiting for download., xrefs: 00FD7E19
bitsengine.cpp, xrefs: 00FD7E0F

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLastMessageMultipleObjectsPeekWait
String ID: Failed while waiting for download.$bitsengine.cpp
API String ID: 435350009-228655868
Opcode ID: dd6e21f43d0045f7d50907127eb22609274e11e8fa56345c77a00468c3c71880
Instruction ID: 9fe7420b740fd1410f9778d1e24167068b872aacd49df89e7e3c85268463170f
Opcode Fuzzy Hash: dd6e21f43d0045f7d50907127eb22609274e11e8fa56345c77a00468c3c71880
Instruction Fuzzy Hash: 83119872A0834DBFD701AFA4DDC5DAE77BADF04354F140076F201EA290E6B59E44B651

Function 00FB2EAE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00FB2F01
_memcpy_s.LIBCMT ref: 00FB2F14
_memcpy_s.LIBCMT ref: 00FB2F2F

Part of subcall function 00FD88C1: _memmove.LIBCMT ref: 00FD88FD
Part of subcall function 00FD88C1: _memset.LIBCMT ref: 00FD890F

Strings

pipe.cpp, xrefs: 00FB2EDE
Failed to allocate memory for message., xrefs: 00FB2EEA

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memcpy_s$_memmove_memset
String ID: Failed to allocate memory for message.$pipe.cpp
API String ID: 3316475362-1914209504
Opcode ID: 7a03c7f5e4ce2b57ebe3e69bb739aaeb12c150d365d91b358a00d927e0a550d9
Instruction ID: 1c6dbd2531379eb19723874553d139baece0b185ac85bdc0e6fb739aa5a4b469
Opcode Fuzzy Hash: 7a03c7f5e4ce2b57ebe3e69bb739aaeb12c150d365d91b358a00d927e0a550d9
Instruction Fuzzy Hash: 0711A776904259ABDB11AE96CC81CEB37ACFF04760B000027FA1497200E779DA15ABE1

Function 00FB7697 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00FB76B5

Strings

Failed to format path string., xrefs: 00FB76C0
Failed to set variable., xrefs: 00FB770D
Failed get file version., xrefs: 00FB76ED
File search: %ls, did not find path: %ls, xrefs: 00FB7721

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Open@16
String ID: Failed get file version.$Failed to format path string.$Failed to set variable.$File search: %ls, did not find path: %ls
API String ID: 3613110473-2458530209
Opcode ID: 17b35d2e332ed7daa75310465a2c3d37ef2cfe35d8ddf0ed3a37171071cb4fb8
Instruction ID: fd89c9ebad2464d4f7e180cb279b6fc29d00e8ef881cf3070afb8b36e2754c42
Opcode Fuzzy Hash: 17b35d2e332ed7daa75310465a2c3d37ef2cfe35d8ddf0ed3a37171071cb4fb8
Instruction Fuzzy Hash: 7511C137A44208FACB02BA96CD02FEE7776ABD0710F304065F600A61A1DE759B45BB51

Function 00FB927D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,?), ref: 00FB92AB
GetLastError.KERNEL32 ref: 00FB92B5

Strings

variable.cpp, xrefs: 00FB92DA
Failed to set variant value., xrefs: 00FB92FD
Failed to get computer name., xrefs: 00FB92E4

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ComputerErrorLastName
String ID: Failed to get computer name.$Failed to set variant value.$variable.cpp
API String ID: 3560734967-484636765
Opcode ID: 31972a73c948291393798c4842600eb48a0bf5798faaa50ed5dab75ef9f41eeb
Instruction ID: 44bcbd19256bdb901e4638783c813f570ea3631da3b5416f7bb24e5c104af53d
Opcode Fuzzy Hash: 31972a73c948291393798c4842600eb48a0bf5798faaa50ed5dab75ef9f41eeb
Instruction Fuzzy Hash: F501E932F0521D67D711DA669C41BDF77ECAF05720F090025F600F7181EEA8ED0467A5

Function 00FB9FD7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 58COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 00FB9FEA

Part of subcall function 00FE057A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,00000000,?,?,00FB9127,00000000), ref: 00FE058E
Part of subcall function 00FE057A: GetProcAddress.KERNEL32(00000000), ref: 00FE0595
Part of subcall function 00FE057A: GetLastError.KERNEL32(?,?,00FB9127,00000000), ref: 00FE05AC

Part of subcall function 00FE6835: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00FE6862

Strings

variable.cpp, xrefs: 00FBA013
Failed to set variant value., xrefs: 00FBA04C
Failed to get 64-bit folder., xrefs: 00FBA033
Failed to get shell folder., xrefs: 00FBA01D

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: AddressCurrentErrorFolderHandleLastModulePathProcProcess
String ID: Failed to get 64-bit folder.$Failed to get shell folder.$Failed to set variant value.$variable.cpp
API String ID: 2084161155-3906113122
Opcode ID: fb96483b5ddc394abf09055564c6c5e7a7f2aa3701a64a46700146a3d0109852
Instruction ID: ad5160902d97b125f08b93f751ce62707e4990be95c86908368fc3c7aab70315
Opcode Fuzzy Hash: fb96483b5ddc394abf09055564c6c5e7a7f2aa3701a64a46700146a3d0109852
Instruction Fuzzy Hash: AF01C872D00658BA8B21BB66CC46CEEBAB8DF943D0F104112F515B6051EA799E40BA51

Function 00FE61CD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE5D1F: _memset.LIBCMT ref: 00FE5D4A
Part of subcall function 00FE5D1F: FindFirstFileW.KERNELBASE(00000000,?,00000000,?,80070002), ref: 00FE5D5A
Part of subcall function 00FE5D1F: FindClose.KERNEL32(00000000), ref: 00FE5D66

SetFileAttributesW.KERNEL32(00000000,00000080,00000000,?,00000000,000000FF,00000000,?,?,00FC9D35,?,00000000,E0000136,00000000,?,?), ref: 00FE6202
GetLastError.KERNEL32(?,?,00FC9D35,?,00000000,E0000136,00000000,?,?,00000000,?,00000000,?,?,00000000,00000000), ref: 00FE620C
DeleteFileW.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,?,?,00FC9D35,?,00000000,E0000136,00000000,?,?,00000000), ref: 00FE622B
GetLastError.KERNEL32(?,?,00FC9D35,?,00000000,E0000136,00000000,?,?,00000000,?,00000000,?,?,00000000,00000000), ref: 00FE6235

Strings

fileutil.cpp, xrefs: 00FE624F

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: File$ErrorFindLast$AttributesCloseDeleteFirst_memset
String ID: fileutil.cpp
API String ID: 1255660700-2967768451
Opcode ID: df8341e3dee88dc3837877b85897011e2799cdf2baeb451f0e84271c2c02a38c
Instruction ID: 50d851164c51cefea4939aad3f0b4ff1cf969cdad53bd8f8d044146f70ab825a
Opcode Fuzzy Hash: df8341e3dee88dc3837877b85897011e2799cdf2baeb451f0e84271c2c02a38c
Instruction Fuzzy Hash: B601F571B0438EA6EF211FABDC85B6B3A9C9FB47B9F140135BB01D50A1E768DD047650

Function 00FE06D3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000001F4,?,00FD3ED5,?,?,00FCAE41,?,000001F4,?,?,?,?,?,?,?,?), ref: 00FE06E3
GetLastError.KERNEL32(?,?,00FCAE41,?,000001F4,?,?,?,?,?,?,?,?), ref: 00FE06F1
GetExitCodeProcess.KERNEL32(000001F4,?), ref: 00FE072D
GetLastError.KERNEL32(?,?,00FCAE41,?,000001F4,?,?,?,?,?,?,?,?), ref: 00FE0737

Strings

procutil.cpp, xrefs: 00FE075C

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectProcessSingleWait
String ID: procutil.cpp
API String ID: 590199018-1178289305
Opcode ID: 921fa4a24e0a0bc84657176370584669097ea34a2652dfc5f01724e7d7cd2552
Instruction ID: a413f063eda7d85df04efd831b7c90f2b7548cf6713897151c649c4c6035dcae
Opcode Fuzzy Hash: 921fa4a24e0a0bc84657176370584669097ea34a2652dfc5f01724e7d7cd2552
Instruction Fuzzy Hash: 9D11E932E00266EBD7118B56CC09B9B7E65DF00770F110124FC14DB190EBB8ED40BAD4

Function 00FD4E11 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000002,?,?,00FD5048), ref: 00FD4E21
ReleaseMutex.KERNEL32(?,?,?,00FD5048), ref: 00FD4EA6

Part of subcall function 00FE28F3: GetProcessHeap.KERNEL32(00FD6AA0,?,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000), ref: 00FE2904
Part of subcall function 00FE28F3: RtlAllocateHeap.NTDLL(00000000,?,00FE0F41,?,00000001,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000), ref: 00FE290B

_memmove.LIBCMT ref: 00FD4E8D

Strings

NetFxChainer.cpp, xrefs: 00FD4E60
Failed to allocate memory for message data, xrefs: 00FD4E6D

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Heap$AllocateMutexObjectProcessReleaseSingleWait_memmove
String ID: Failed to allocate memory for message data$NetFxChainer.cpp
API String ID: 2689949979-1624333943
Opcode ID: 7021bd09faeaea575e2c063679ff95d4fbf5f77a52934631e6e414afea6ab968
Instruction ID: 22d8dc80503703101d638823e4bb66a2fc0acfad5b772c16a90d0ed21cf3bf4e
Opcode Fuzzy Hash: 7021bd09faeaea575e2c063679ff95d4fbf5f77a52934631e6e414afea6ab968
Instruction Fuzzy Hash: 2F1158B1600305AFDB209F24C886E6A77F5FF49324F244569F5119B3A1EB75A800EB14

Function 00FB9A62 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00FB9A92
GetLastError.KERNEL32 ref: 00FB9A9C

Strings

variable.cpp, xrefs: 00FB9ABC
Failed to set variant value., xrefs: 00FB9AE2
Failed to get the user name., xrefs: 00FB9AC6

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLastNameUser
String ID: Failed to get the user name.$Failed to set variant value.$variable.cpp
API String ID: 2054405381-1522884404
Opcode ID: c6d4173c3ca48a0f05542be5dbaf475f89fef6b212cb3131f6ddac1bac2b2e84
Instruction ID: ec791bf311765f824fd3f2260aa82fdea8e5ec3b0125608dfbba8a3c3681df0b
Opcode Fuzzy Hash: c6d4173c3ca48a0f05542be5dbaf475f89fef6b212cb3131f6ddac1bac2b2e84
Instruction Fuzzy Hash: CE01F532B04329ABC721EB16CC45FEF77AC9F00760F140165F614E6292DEACEA44AB91

Function 00FD8035 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00FD804A
LeaveCriticalSection.KERNEL32(?), ref: 00FD808F
SetEvent.KERNEL32(?,?,?,?), ref: 00FD80A3

Strings

Failed to get state during job modification., xrefs: 00FD8063
Failure while sending progress during BITS job modification., xrefs: 00FD807E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get state during job modification.$Failure while sending progress during BITS job modification.
API String ID: 3094578987-1258544340
Opcode ID: 0b0abf366f69a5982613826d1c2157c5e31ead11bb2e0cf15c285925d2361268
Instruction ID: 7b6983b3fafe403312d8eed2c07b3de37d54a0c5c530e9957098bd9260c70f8c
Opcode Fuzzy Hash: 0b0abf366f69a5982613826d1c2157c5e31ead11bb2e0cf15c285925d2361268
Instruction Fuzzy Hash: E001DE36200309EFCB11EB51C899EAB73B9EF84360B14001EE50AD7350EB38E905A750

Function 00FD7E32 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000008,00000000,?,?,00FD81C3,?,?,?,?,?,00000000,?,00000000), ref: 00FD7E4C
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00FD81C3,?,?,?,?,?,00000000,?,00000000), ref: 00FD7E59
GetLastError.KERNEL32(?,00FD81C3,?,?,?,?,?,00000000,?,00000000), ref: 00FD7E66

Strings

bitsengine.cpp, xrefs: 00FD7E8B
Failed to create BITS job complete event., xrefs: 00FD7E95

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CreateCriticalErrorEventInitializeLastSection
String ID: Failed to create BITS job complete event.$bitsengine.cpp
API String ID: 3069647169-3441864216
Opcode ID: 636e63dad09bcb4e663d719fc17d1577296b77bd2e195e9bb469e22821efb33c
Instruction ID: 8983f290949a62c63200f5a36c3f0e6c77608c72659ad24ea197a4567b9df40b
Opcode Fuzzy Hash: 636e63dad09bcb4e663d719fc17d1577296b77bd2e195e9bb469e22821efb33c
Instruction Fuzzy Hash: 1101757164431AAFD3109F69DCC5A63B7DCEF08751B10453EBA49CA290EBB8EC446754

Function 00FD7C69 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000008,?,00000000,00000000,00000000,?,00FD7DD3), ref: 00FD7C7D
LeaveCriticalSection.KERNEL32(00000008,?,00FD7DD3), ref: 00FD7CC2
SetEvent.KERNEL32(?,?,00FD7DD3), ref: 00FD7CD6

Strings

Failed to get BITS job state., xrefs: 00FD7C96
Failure while sending progress., xrefs: 00FD7CB1

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get BITS job state.$Failure while sending progress.
API String ID: 3094578987-2876445054
Opcode ID: e8982ab7ad7f7acf769f9a2fcc927bc8e3b6ccefab092f8de31ae106c112c00e
Instruction ID: 9810a790c69ade1c58d7e42ad9579b2a77e6996a0687399387530dd22adae579
Opcode Fuzzy Hash: e8982ab7ad7f7acf769f9a2fcc927bc8e3b6ccefab092f8de31ae106c112c00e
Instruction Fuzzy Hash: 9E01D876104719AFC711EB55C999D6B73B9EF84720B14001FF50ADB350EB78E900A725

Function 00FBBB67 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000,?,00FBD9EF,?,00000000,75C0B390,?,00000000), ref: 00FBBB76
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 00FBBB83
LeaveCriticalSection.KERNEL32(?,?,00FBD9EF,?,00000000,75C0B390,?,00000000), ref: 00FBBB98

Strings

userexperience.cpp, xrefs: 00FBBBB1
Engine active cannot be changed because it was already in that state., xrefs: 00FBBBBB

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalSection$CompareEnterExchangeInterlockedLeave
String ID: Engine active cannot be changed because it was already in that state.$userexperience.cpp
API String ID: 3376869089-1544469594
Opcode ID: 491f9cb4e05cfbf8d903b3779df883c75654b8e8b9166762c9c773d87a32b81b
Instruction ID: a4e4414b175892685a4312360d5d134b29e0e267de3762ba47ccd4c9af808090
Opcode Fuzzy Hash: 491f9cb4e05cfbf8d903b3779df883c75654b8e8b9166762c9c773d87a32b81b
Instruction Fuzzy Hash: DAF0FC7260431AAFA3101F579CC5DA7379CEF94B617004029FA019A194DBA9EC00A6B0

Function 00FB8FDA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00FB8F23: FreeLibrary.KERNEL32(00000000), ref: 00FB8FCF

_memset.LIBCMT ref: 00FB8FF2
GetVersionExW.KERNEL32(?,?,00000000,00FB909E), ref: 00FB9001
GetLastError.KERNEL32 ref: 00FB900B

Strings

variable.cpp, xrefs: 00FB9030
Failed to get OS version from GetVersionExW, xrefs: 00FB903A

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFreeLastLibraryVersion_memset
String ID: Failed to get OS version from GetVersionExW$variable.cpp
API String ID: 2453953334-413229814
Opcode ID: b77d3623a9ddc98c68e5f690aa08e773ad139e0c526bf35bd079ac33bdf21bc5
Instruction ID: 2286e4164f8db7b5cab19d9f2ba215286c3e492021b2d11f74612cf156096892
Opcode Fuzzy Hash: b77d3623a9ddc98c68e5f690aa08e773ad139e0c526bf35bd079ac33bdf21bc5
Instruction Fuzzy Hash: 73F05EA17883076AF3113AB75CD7AB766AC9F61798B140039F700DA2A2FEDCCC053915

Function 00FE8625 Relevance: 7.6, APIs: 5, Instructions: 119registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE3D9A: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00FE7ABC,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00FE3DAE

RegCloseKey.ADVAPI32(00000001,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019,00000001,00FB13BB,00FB13BB,00020019,00000000,00000001), ref: 00FE86EE
RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019), ref: 00FE872F
RegCloseKey.ADVAPI32(00000001,00000001,00020019,00FB13BB,?,00FB13BB,00000000,00000000,?,00FB13BB,00000001,00000000), ref: 00FE8750
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00FB13BB,?,00FB13BB,00000000,00000000,?,00FB13BB,00000001,00000000), ref: 00FE8761
RegCloseKey.ADVAPI32(00FB13BB,?,00FB13BB,00000000,00000000,?,00FB13BB,00000001,00000000), ref: 00FE8775

Part of subcall function 00FE3F7C: RegCloseKey.ADVAPI32(00000000), ref: 00FE40E2

Part of subcall function 00FE3C86: RegQueryInfoKeyW.ADVAPI32(00FB13BB,00000000,00000000,00000000,?,00000000,00000000,00FB13BB,00000000,00000000,00000000,00000000,80070002,00000000,?,00FE86DA), ref: 00FE3CA1

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Close$InfoOpenQuery
String ID:
API String ID: 796878624-0
Opcode ID: 5f4f177bbdf2792257a3e2ebc5f61a461b3dd572358f6b2872d67af076f13a39
Instruction ID: e6e1f99e0bf556be782a36bcfc703de88c67ebd276c6be546b589f74c332fcb6
Opcode Fuzzy Hash: 5f4f177bbdf2792257a3e2ebc5f61a461b3dd572358f6b2872d67af076f13a39
Instruction Fuzzy Hash: 7341BA75C0126CFFCF22AF95DC8889EBFB9EB04B91F208466F518A6120D7354B51EB90

Function 00FB10DC Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,?,?,00FB1ED9,?,?,?,?,?), ref: 00FB1120
DeleteCriticalSection.KERNEL32(?,00000000,?,?,00FB1ED9,?,?,?,?,?), ref: 00FB113A
TlsFree.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00FB120B
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00FB1212
_memset.LIBCMT ref: 00FB121C

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalDeleteSection$CloseFreeHandle_memset
String ID:
API String ID: 3611737199-0
Opcode ID: 3d14baad4078d7603def307170750a82332f132170dd3fcb62650474f3879c5f
Instruction ID: f8349fd9f2836f4dc44819c633914e58829ca32d102909726164387c07c7e4ea
Opcode Fuzzy Hash: 3d14baad4078d7603def307170750a82332f132170dd3fcb62650474f3879c5f
Instruction Fuzzy Hash: 4531EAB1A0074597DA60EBB6CC8AFDB73ECAF04350F844819B299D7041DF78F645AB60

Function 00FBA643 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000001,00000000,00000000,00000000,?,?,00FBAAC8,?,?,00000000,?,00000001,?,00000002,-00000001,00FB8B91), ref: 00FBA653
LeaveCriticalSection.KERNEL32(-00000001,00000002,00FB8B91,?,00FBAAC8,?,?,00000000,?,00000001,?,00000002,-00000001,00FB8B91,00000001), ref: 00FBA6EE

Strings

Failed to get variable: %ls, xrefs: 00FBA689
Failed to get value as string for variable: %ls, xrefs: 00FBA6DD
Failed to format value '%ls' of variable: %ls, xrefs: 00FBA6B8

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to format value '%ls' of variable: %ls$Failed to get value as string for variable: %ls$Failed to get variable: %ls
API String ID: 3168844106-1273532094
Opcode ID: 01a39bfb4156c3bcf9f427353bd625d8fa1232082a9ef99d8d8d40d9a5b022f5
Instruction ID: fd3c3149902b1b62840fb14d482b587db8046faf43066b8bd3720266e7a24e31
Opcode Fuzzy Hash: 01a39bfb4156c3bcf9f427353bd625d8fa1232082a9ef99d8d8d40d9a5b022f5
Instruction Fuzzy Hash: EA11D6B2500709FFCF219F52CC85CEF7BAAFB583207288515FA0556121D7799950BF62

Function 00FDE215 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00FDE223

Part of subcall function 00FDBB70: __FF_MSGBANNER.LIBCMT ref: 00FDBB89
Part of subcall function 00FDBB70: __NMSG_WRITE.LIBCMT ref: 00FDBB90
Part of subcall function 00FDBB70: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,00FDC627,00000000,00000001,00000000,?,00FDBDD6,00000018,01003420,0000000C,00FDBE66), ref: 00FDBBB5

_free.LIBCMT ref: 00FDE236

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: ffad20cee81b1ecd79df794da3c3f1bfa4adfad06f366bce24b7526a726e5775
Instruction ID: 997f3226f3e8fed212d08364add2914e31fd4be2e7559282ee7e680094f4718b
Opcode Fuzzy Hash: ffad20cee81b1ecd79df794da3c3f1bfa4adfad06f366bce24b7526a726e5775
Instruction Fuzzy Hash: D6119333D00615EACB223F74AC05B5A365A9B40372B2D0527F9689F350DB38D980B795

Function 00FD4DBA Relevance: 7.5, APIs: 5, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,00FD535A), ref: 00FD4DCC
CloseHandle.KERNEL32(?,00000000,00FD535A), ref: 00FD4DD9
CloseHandle.KERNEL32(?,00000000,00FD535A), ref: 00FD4DE7
CloseHandle.KERNEL32(?,00000000,00FD535A), ref: 00FD4DF5
UnmapViewOfFile.KERNEL32(?,00FD535A), ref: 00FD4E04

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseHandle$FileUnmapView
String ID:
API String ID: 260491571-0
Opcode ID: ebddba02911f5b3bd55d43b0228063108de00aeccb3abdbc3f250a8d8a7ec38d
Instruction ID: 0230a9fc29adf75538a9b8adbcf8ac37c75b5fe4091db66d5c52570e097e84f7
Opcode Fuzzy Hash: ebddba02911f5b3bd55d43b0228063108de00aeccb3abdbc3f250a8d8a7ec38d
Instruction Fuzzy Hash: 2BF0A971A007069BDB309F66CC44B5BB3EEBF44761F09881DE495D7640DB39F8009E60

Function 00FDC9B5 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00FDC9C1

Part of subcall function 00FD9EF2: __getptd_noexit.LIBCMT ref: 00FD9EF5
Part of subcall function 00FD9EF2: __amsg_exit.LIBCMT ref: 00FD9F02

__getptd.LIBCMT ref: 00FDC9D8
__amsg_exit.LIBCMT ref: 00FDC9E6
__lock.LIBCMT ref: 00FDC9F6
__updatetlocinfoEx_nolock.LIBCMT ref: 00FDCA0A

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 358cc97ee10bbc72020e4916c3b05149926ed0903cdf6d81ce0be8e1303d2805
Instruction ID: b77a833a7d4981293429a8da6ae62ed3a6b3d4f55857b3f96947ad57d95ef17c
Opcode Fuzzy Hash: 358cc97ee10bbc72020e4916c3b05149926ed0903cdf6d81ce0be8e1303d2805
Instruction Fuzzy Hash: FBF06D329452129AD722BBA89C0375D3BA26B00724F19424BE490AB3C2CB6E5940FB96

Function 00FE8296 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE8300
InternetCrackUrlW.WININET(?,00000000,90000000,?), ref: 00FE83AF
GetLastError.KERNEL32 ref: 00FE83B9

Strings

uriutil.cpp, xrefs: 00FE83E9

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CrackErrorInternetLast_memset
String ID: uriutil.cpp
API String ID: 2372571340-476456875
Opcode ID: ec1400123572c6114132f01557ff7e1acdf610978040b47e23ad9ba197f056a4
Instruction ID: 80db3d9a3006efa19763f683b5ca34b62b8c7177c0a92447aa3ca694fa7dc59f
Opcode Fuzzy Hash: ec1400123572c6114132f01557ff7e1acdf610978040b47e23ad9ba197f056a4
Instruction Fuzzy Hash: 8361F171D01268DFCB22EF56CC88A9DB7B4FB08B50F4444EAE409A2251DB345EDAAF51

Function 00FE6894 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE68A4
ShellExecuteExW.SHELL32(?), ref: 00FE68E2
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00FE6973

Strings

<, xrefs: 00FE68D4

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseExecuteHandleShell_memset
String ID: <
API String ID: 1378689676-4251816714
Opcode ID: 5edee6149e3bef5df26badd56e8c145998440857956a5182805c357f213f8c35
Instruction ID: 5a785681f66b1bc1cd11593cfa1dd0f64ec1461e0e6eed29e04cd47ede99ade5
Opcode Fuzzy Hash: 5edee6149e3bef5df26badd56e8c145998440857956a5182805c357f213f8c35
Instruction Fuzzy Hash: 4B316476D1029EDBCB10CFA6C4447ADBBB4E7247F4F148066E845FB246D6388D41EBA4

Function 00FC75CB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC75DD

Strings

Failed to read next symbol., xrefs: 00FC7605
Failed to parse expression., xrefs: 00FC761F
Failed to expect end symbol., xrefs: 00FC7636

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memset
String ID: Failed to expect end symbol.$Failed to parse expression.$Failed to read next symbol.
API String ID: 2102423945-1316734955
Opcode ID: a8042c6747ffab8e526b532ba870eae5c6f5156eab1d40e05f60bd6ca8f79173
Instruction ID: 3c450701b7d716ed1cb0b504e9ed2827c9c39bb9b090bc9d815fe1aef1a4d9e9
Opcode Fuzzy Hash: a8042c6747ffab8e526b532ba870eae5c6f5156eab1d40e05f60bd6ca8f79173
Instruction Fuzzy Hash: 59119372D05619BADB11FAA8DE82E9FB7ACAF54744F10002AF901B7141E6745F01ABD1

Function 00FB8E6B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00001000,?,000000FF,?,000000FF,?,00000000,00000030,00FB9837,?,00FBADF8,?,00000030,00000000,00000030), ref: 00FB8EA4
GetLastError.KERNEL32(?,00FBADF8,?,00000030,00000000,00000030,00FB9837,?,00FBB592,?,?,00000030), ref: 00FB8EDA

Strings

Failed to compare strings., xrefs: 00FB8F09
variable.cpp, xrefs: 00FB8EFF

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CompareErrorLastString
String ID: Failed to compare strings.$variable.cpp
API String ID: 1733990998-1686915864
Opcode ID: 45e4200ae67fe2f0fba7742ed86d4e1291b375883b6b6763457e19845f381631
Instruction ID: 354b502f85b29ca8f3905aeff1ce25b60b26484f712c478d74abdc38455fcd97
Opcode Fuzzy Hash: 45e4200ae67fe2f0fba7742ed86d4e1291b375883b6b6763457e19845f381631
Instruction Fuzzy Hash: E6219632E05216EBCB118F9ACC41A9AB7A8AF857B0B114255F915EB2D0DA74DD01EF90

Function 00FDF79A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00FDF98C,00FD6AA0,00FD6AA0,?,00000000,0000FDE9,?,?,00FE0138,?), ref: 00FDF7AC
WriteFile.KERNEL32(00000000,00000000,0000FDE9,00000000,?,?,00FDF98C,00FD6AA0,00FD6AA0,?,00000000,0000FDE9,?,?,00FE0138,?), ref: 00FDF7EE
GetLastError.KERNEL32(?,?,00FDF98C,00FD6AA0,00FD6AA0,?,00000000,0000FDE9,?,?,00FE0138,?,00FD6AA0,?,?,00FD6AA0), ref: 00FDF7F8

Strings

logutil.cpp, xrefs: 00FDF822

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: logutil.cpp
API String ID: 606256338-3545173039
Opcode ID: 278d8aaff734beef9ea46aae0624444a450f0eabd6ce1f90fe02a4899ca3402d
Instruction ID: bd7ce6d680e3d0d844222d7b2fe86c5f58dce0b296586fff3ea3098e5259b567
Opcode Fuzzy Hash: 278d8aaff734beef9ea46aae0624444a450f0eabd6ce1f90fe02a4899ca3402d
Instruction Fuzzy Hash: CC11E972700205AAD7115FA6DCC4EAB7BAEEB05774B14013AF506D6240D774ED08B6E1

Function 00FE1AD4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(000011FF,00000000,00000000,00000000,00000000,00000000,?,00000001,00000000,?,?,?,00FC6042,00000000,00000000,00000000), ref: 00FE1B06
GetLastError.KERNEL32(?,?,?,00FC6042,00000000,00000000,00000000,00000000,?,?,00FC201E,?,?,80070656,00000001,?), ref: 00FE1B13
LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,00FC6042,00000000,00000000,00000000,00000000,?,?,00FC201E,?), ref: 00FE1B5A

Strings

strutil.cpp, xrefs: 00FE1B38

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: strutil.cpp
API String ID: 1365068426-3612885251
Opcode ID: e0af35c4f4771f599e3c71ab454fb0c22d3f6fa6d96b01be8cb5ab1aa4a1cac8
Instruction ID: 7713aae667f696e4706426b8c6ec488dea5718f9ba90c5064f4e21671ef4a24b
Opcode Fuzzy Hash: e0af35c4f4771f599e3c71ab454fb0c22d3f6fa6d96b01be8cb5ab1aa4a1cac8
Instruction Fuzzy Hash: FB118B72900198FFDB129F87CC498EEBA7AFB80760F204169F901E6150F2749E10EB60

Function 00FE642B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000080,00000000,?,00000000,?,00FD0D9D,00000000,?,?,BundleCachePath,00000000), ref: 00FE6461
GetLastError.KERNEL32(?,00FD0D9D,00000000,?,?,BundleCachePath,00000000,?,BundleVersion,?,?,EngineVersion,?,00000000), ref: 00FE646E

Strings

fileutil.cpp, xrefs: 00FE6440, 00FE6493

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: fileutil.cpp
API String ID: 1214770103-2967768451
Opcode ID: 34d177ba99ea90a200dd12d45dc09c45a54b2585cef5b78eada0eea5016ff662
Instruction ID: 477c22690c47620519ab6b29242db3492e39f85ac8f0a50a0f6326ddbc1d788b
Opcode Fuzzy Hash: 34d177ba99ea90a200dd12d45dc09c45a54b2585cef5b78eada0eea5016ff662
Instruction Fuzzy Hash: 5301A732640295B6E7316A669C4AF6B755C9B10BB0F104125BA14EE1E0D679DC0072E4

Function 00FE54B6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00FE54FB
SysFreeString.OLEAUT32(00000000), ref: 00FE5530

Strings

`<u, xrefs: 00FE5530
xmlutil.cpp, xrefs: 00FE54CC, 00FE5512

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$xmlutil.cpp
API String ID: 344208780-3482516102
Opcode ID: 997e8a81b02cacda160f6fe40b30da710af7dc755a3c78eba4710f803221d044
Instruction ID: 78a988218e5cf5e3ba6fe313ba05b99a237a6cd0eb049d6fb4a7747cedcbe30e
Opcode Fuzzy Hash: 997e8a81b02cacda160f6fe40b30da710af7dc755a3c78eba4710f803221d044
Instruction Fuzzy Hash: B001A731640785A7EB219A6B5C09E7B37ADEF94B75F15002AF904DB350EB74CC40B660

Function 00FE55AD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00FE55F2
SysFreeString.OLEAUT32(00000000), ref: 00FE5627

Strings

`<u, xrefs: 00FE5627
xmlutil.cpp, xrefs: 00FE55C3, 00FE5609

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$xmlutil.cpp
API String ID: 344208780-3482516102
Opcode ID: 0367b341d4e24fe2f1879d5aa231ef35d6c6330939ff03c9e510343b94a04ad3
Instruction ID: fda456510629fb611fdae20d82a78b6f5820e329720be5c70d4e4a2a22b4a941
Opcode Fuzzy Hash: 0367b341d4e24fe2f1879d5aa231ef35d6c6330939ff03c9e510343b94a04ad3
Instruction Fuzzy Hash: 24014472640789ABEB215A674C09F7737ADAF94B69F150036F904DB251EB74CC40B6A0

Function 00FCEE2A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,00000001,?,00000001,00000000,?,?,?,?,?,?,?,00FCEFC5), ref: 00FCEE4F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00FCEFC5), ref: 00FCEE59

Strings

Failed to stop wusa service., xrefs: 00FCEE88
msuengine.cpp, xrefs: 00FCEE7E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ControlErrorLastService
String ID: Failed to stop wusa service.$msuengine.cpp
API String ID: 4114567744-2259829683
Opcode ID: 10fc3f6d6b7e4943bc30b60c93f33aa5ed7629d48ef217d80e573b5d67589508
Instruction ID: 72066589533e1fef1a052098d9fe231f6bbfd3c185a74a98a0bd843304b48e00
Opcode Fuzzy Hash: 10fc3f6d6b7e4943bc30b60c93f33aa5ed7629d48ef217d80e573b5d67589508
Instruction Fuzzy Hash: 25F0D632B0426A67D7209A65DC46FAF7BA99F04BA0F01002DFA00EA290EB59D9006295

Function 00FC28E6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009002,00000000,?), ref: 00FC290F
GetLastError.KERNEL32 ref: 00FC2919

Strings

Failed to post elevate message., xrefs: 00FC2948
EngineForApplication.cpp, xrefs: 00FC293E

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post elevate message.
API String ID: 2609174426-4098423239
Opcode ID: 166ef8eac8dbb5ed1c385eb7e3a80de2bd3e8b6d913c2a73e4b5c8aae40f8ccf
Instruction ID: c5bd5f8b78a453541f9c624e85676159d7af99b1e4ec8b45d6a094e6e763b209
Opcode Fuzzy Hash: 166ef8eac8dbb5ed1c385eb7e3a80de2bd3e8b6d913c2a73e4b5c8aae40f8ccf
Instruction Fuzzy Hash: ABF0C232B4062B6BD3201A948C0BF567798EF05B70F154238BB54AF5E1E679DC01B7D5

Function 00FBBB05 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 00FBBB2C
FreeLibrary.KERNEL32(?,?,00FB18A2,?,?,?,?,00FB1E12,?), ref: 00FBBB3B
GetLastError.KERNEL32(?,00FB18A2,?,?,?,?,00FB1E12,?), ref: 00FBBB45

Strings

BootstrapperApplicationDestroy, xrefs: 00FBBB26

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: AddressErrorFreeLastLibraryProc
String ID: BootstrapperApplicationDestroy
API String ID: 1144718084-3186005537
Opcode ID: a669c8a044dd3ab62fc9a66f6125c0d0d7a5b956739337c5ce5cdb650cc25882
Instruction ID: 179b467fbaf038920f5bc1be3a402f2279808f310c2ce293380cd21c44056fcc
Opcode Fuzzy Hash: a669c8a044dd3ab62fc9a66f6125c0d0d7a5b956739337c5ce5cdb650cc25882
Instruction Fuzzy Hash: 6AF049327003059BD7209F6BDC54FA7B7E8AFC07B2B048429E955C7564DBA9E800AB61

Function 00FE545A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 00FE546F
SysFreeString.OLEAUT32(00000000), ref: 00FE54A1

Strings

`<u, xrefs: 00FE54A1
xmlutil.cpp, xrefs: 00FE5483

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$xmlutil.cpp
API String ID: 344208780-3482516102
Opcode ID: 0a85b60d70169612a7846da01c372222c252697d580295900d96077f1b34d198
Instruction ID: a955cdb41c7a2cf6df17b1dd973da0f3806cbfb4d9f4becf6e7d328fc57d9f08
Opcode Fuzzy Hash: 0a85b60d70169612a7846da01c372222c252697d580295900d96077f1b34d198
Instruction Fuzzy Hash: 73F0BB325006D4DBC7619F959C08F6B77A9AF80F71F254019FD049B251D774CC50AA90

Function 00FE5551 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00FE5566
SysFreeString.OLEAUT32(00000000), ref: 00FE5598

Strings

`<u, xrefs: 00FE5598
xmlutil.cpp, xrefs: 00FE557D

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$xmlutil.cpp
API String ID: 344208780-3482516102
Opcode ID: dd3d84382a99655d593fbb738c4d0b603501563440be85a3fcb5411972913994
Instruction ID: 8e77faae2e1988f42e7b35442c360e201ecad86f2b521f3ab2f5d5c2ca678b56
Opcode Fuzzy Hash: dd3d84382a99655d593fbb738c4d0b603501563440be85a3fcb5411972913994
Instruction Fuzzy Hash: 12F0B432640798ABCB224F969C08E5A77AAAF84B78F194019F8049B220D774CD00AB90

Function 00FC2884 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 00FC2899
GetLastError.KERNEL32 ref: 00FC28A3

Strings

Failed to post plan message., xrefs: 00FC28D2
EngineForApplication.cpp, xrefs: 00FC28C8

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post plan message.
API String ID: 2609174426-2952114608
Opcode ID: ddbe6804e219c81637b870983071979598e9bfd41bb8e12138624e63e99affe0
Instruction ID: 7baf01083c1dcba85dd36d01ad7694cec77f3eacf412c2dff44a5335fa7eb0f6
Opcode Fuzzy Hash: ddbe6804e219c81637b870983071979598e9bfd41bb8e12138624e63e99affe0
Instruction Fuzzy Hash: 52F08232B4566B6A96701A559C0AE577F98EF10BA1B010029BA08EE1E1E659D800B6D4

Function 00FC2824 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009000,00000000,00000000), ref: 00FC2837
GetLastError.KERNEL32 ref: 00FC2841

Strings

Failed to post detect message., xrefs: 00FC2870
EngineForApplication.cpp, xrefs: 00FC2866

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post detect message.
API String ID: 2609174426-598219917
Opcode ID: 1df02e9b003ca97625bdeb2749bd4b04b07da4cfc5b9ee7193ac8e802badb4a8
Instruction ID: 1b82e9a05467690eeaef1a14806a278f74f08c7691fa63358d95765d2cf17b0a
Opcode Fuzzy Hash: 1df02e9b003ca97625bdeb2749bd4b04b07da4cfc5b9ee7193ac8e802badb4a8
Instruction Fuzzy Hash: 91F03732B8566B6A92301A569C0AF577E58EF01FF1F110139B604DA1D1DA59D800F6D9

Function 00FC29BE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009004,?,00000000), ref: 00FC29D3
GetLastError.KERNEL32 ref: 00FC29DD

Strings

EngineForApplication.cpp, xrefs: 00FC2A02
Failed to post shutdown message., xrefs: 00FC2A0C

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post shutdown message.
API String ID: 2609174426-188808143
Opcode ID: c14e107949b6702447aa6132a8028462a43ae4d158f77a41dbb72aabdd6faadc
Instruction ID: 8deb5f6ba3a2799d7ef63698e14e7a837a7d932300cf8cae77685e65197d036c
Opcode Fuzzy Hash: c14e107949b6702447aa6132a8028462a43ae4d158f77a41dbb72aabdd6faadc
Instruction Fuzzy Hash: 59F0A73274562B6A97705A999C06F677B58EF00FB0F014128BB04EE1A1E668D900B7D8

Function 00FC295C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 00FC2971
GetLastError.KERNEL32 ref: 00FC297B

Strings

EngineForApplication.cpp, xrefs: 00FC29A0
Failed to post apply message., xrefs: 00FC29AA

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post apply message.
API String ID: 2609174426-1304321051
Opcode ID: aa6eaedbc00f49ee73ccc783838d842f28d0f0fe75cbf052134348024ddc86e5
Instruction ID: 9844ce48e0548870ffeea51103b46dc57f3a135affc433617cfcc7e58f04f6d0
Opcode Fuzzy Hash: aa6eaedbc00f49ee73ccc783838d842f28d0f0fe75cbf052134348024ddc86e5
Instruction Fuzzy Hash: 56F0A73274072B6AD2312A559C0AF977F98DF00FB1F014124FA08DE1A1EA68D800F6D4

Function 00FD6522 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(0578F685,00FB1D56,00FD67A7,00FB1D56,?,00FD06CE,00FB2222,00FB1E8E,?,00FBD890,?,00FB1D56,00FB1D9E,?,00FB1DDE,WixBundleElevated), ref: 00FD6528
GetLastError.KERNEL32(?,00FD06CE,00FB2222,00FB1E8E,?,00FBD890,?,00FB1D56,00FB1D9E,?,00FB1DDE,WixBundleElevated,00000000,00000000,00000001,00FB1DDE), ref: 00FD6532

Strings

Failed to set begin operation event., xrefs: 00FD6561
cabextract.cpp, xrefs: 00FD6557

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$cabextract.cpp
API String ID: 3848097054-4159625223
Opcode ID: 74252913384d9b9fa0f0e765df6d87d8f9b8e32d6697225217ada24b7d3c2431
Instruction ID: a5ac9b4a0db224a0b0b093b7d519d9c0fc970bc2e621c13c4c4a1ef2400f32d0
Opcode Fuzzy Hash: 74252913384d9b9fa0f0e765df6d87d8f9b8e32d6697225217ada24b7d3c2431
Instruction Fuzzy Hash: A8E09273E8567756933127657C4AB6739A59F00BB170D017AF905EA391FA4CCC4033D5

Function 00FDEE2E Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00FDEE62
__isleadbyte_l.LIBCMT ref: 00FDEE95
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,00000000,00000000,?,?,?,?,?,00000000), ref: 00FDEEC6
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,00000000,00000000,?,?,?,?,?,00000000), ref: 00FDEF34

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: f95e7f51be8bbe67563c1c30c5b5d32b42663f7edf1ac70268815e1419dc7366
Instruction ID: 0b79cee5ab8b658ec47bd048f11e14722d282155c020e1ec4befecd67e2adf2d
Opcode Fuzzy Hash: f95e7f51be8bbe67563c1c30c5b5d32b42663f7edf1ac70268815e1419dc7366
Instruction Fuzzy Hash: 9731B332900295EFDB21EF64C8909BE7BA6AF01320F1E456AE4659F2A1D730DD40FB50

Function 00FB1226 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00FB587B: RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,?,?,?,00FB1245,?,?,00000000), ref: 00FB58CB

CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000000,?,?,?,?), ref: 00FB12AC

Strings

Failed to re-launch bundle process after RunOnce: %ls, xrefs: 00FB1296
Unable to get resume command line from the registry, xrefs: 00FB124B
Failed to get current process path., xrefs: 00FB1262

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Close$Handle
String ID: Failed to get current process path.$Failed to re-launch bundle process after RunOnce: %ls$Unable to get resume command line from the registry
API String ID: 187904097-642631345
Opcode ID: e337de1f3fe9b2675daae1c81b4aa1002560f0890d3d3dfacae0826787dc415b
Instruction ID: 23d210f29620ace3bc686492db1f66fee2fa1bb64332ab865fa07b154f81f7fc
Opcode Fuzzy Hash: e337de1f3fe9b2675daae1c81b4aa1002560f0890d3d3dfacae0826787dc415b
Instruction Fuzzy Hash: 9F117C72C00558FACF12ABA69C428EEFBB8AF90710B644166F911B6114EB798F41FF51

Function 00FBA4DA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,00000000,?,?,00FC98BD,?,WixBundleOriginalSource,?,00000000,?,?,00000001,?,?,00000001), ref: 00FBA4E8
LeaveCriticalSection.KERNEL32(?,00000000,00000000,?,?,00FC98BD,?,WixBundleOriginalSource,?,00000000,?,?,00000001,?,?,00000001), ref: 00FBA54A

Strings

Failed to get value of variable: %ls, xrefs: 00FBA51F
Failed to get value as string for variable: %ls, xrefs: 00FBA53B

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as string for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-2100416246
Opcode ID: 3c08718af3384a760967d234e5cb3334ac207e0773c3cf82469fad4360601775
Instruction ID: d3048f321fe5e32e7395ac62d341a1a543c1427464270994e8c7ecb94e5b16b1
Opcode Fuzzy Hash: 3c08718af3384a760967d234e5cb3334ac207e0773c3cf82469fad4360601775
Instruction Fuzzy Hash: E4018472940229FBCB215E55DC86AEF7768EB00374F144511FD05AB251DB78DB007BA6

Function 00FBA45C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00FBA46A
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 00FBA4CC

Strings

Failed to get value of variable: %ls, xrefs: 00FBA4A1
Failed to get value as numeric for variable: %ls, xrefs: 00FBA4BD

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as numeric for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-4270472870
Opcode ID: ac2817bad314d5c5f7b5ae46a2084f4b65b642fc2c7eea125825a3a44946c09c
Instruction ID: 1ccaa4eb38543e14cd622d3aba808ead9d2db4a948824beff86cac0290603a30
Opcode Fuzzy Hash: ac2817bad314d5c5f7b5ae46a2084f4b65b642fc2c7eea125825a3a44946c09c
Instruction Fuzzy Hash: 4801B132940129FBCB11DA55CC49ADF7718EF00361F108511BD08AB261D6B8DD00BAA2

Function 00FBA558 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00FBA566
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 00FBA5C8

Strings

Failed to get value of variable: %ls, xrefs: 00FBA59D
Failed to get value as version for variable: %ls, xrefs: 00FBA5B9

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as version for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-1851729331
Opcode ID: 8304e682c490ba026c2908615dbbd88e6c157a5dd90131c4e93ab7cbb2c108c6
Instruction ID: 5829e4336d5a8145f0ec65ad970145dd0990023da8bf5b39fcd46763ae12ffe9
Opcode Fuzzy Hash: 8304e682c490ba026c2908615dbbd88e6c157a5dd90131c4e93ab7cbb2c108c6
Instruction Fuzzy Hash: 9C01BC73940229BBCB215A95CC45ADE7B68AF00324F084050BE00AA251D738EB00BBA2

Function 00FD9A59 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(00000000,00FD840C), ref: 00FD9A5C
__malloc_crt.LIBCMT ref: 00FD9A8B
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00FD9A98

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: EnvironmentStrings$Free__malloc_crt
String ID:
API String ID: 237123855-0
Opcode ID: 2d7eae0f767682b8bf31c4df0924f2e9b370fbeedbcaf6713908ba5834230518
Instruction ID: 6f7e3356422d2d6c654a517c816dc97b2d22747eb9b0eb2d9ab011fdb7b3da1f
Opcode Fuzzy Hash: 2d7eae0f767682b8bf31c4df0924f2e9b370fbeedbcaf6713908ba5834230518
Instruction Fuzzy Hash: EAF0A7779091116BCB31BBB4BC468AB7B2ADED277532E4417F402C3300FA688E41A2A5

Function 00FBA5D6 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,?,?,00FC700D,?,?,?,?,?,?,00FC74FC,?,?,?), ref: 00FBA5E4
LeaveCriticalSection.KERNEL32(?,?,00000000,?,?,00FC700D,?,?,?,?,?,?,00FC74FC,?,?,?), ref: 00FBA635

Strings

Failed to get value of variable: %ls, xrefs: 00FBA607
Failed to copy value of variable: %ls, xrefs: 00FBA626

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to copy value of variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-2936390398
Opcode ID: 136f53f4f8625a44ddaf20aa68f3e7e57b533c7120a61100272f3826bc25c45d
Instruction ID: e127f773bf0b5f06d9c1489487009dcf7d26f4a7f8f0699a455a6ce52c34a92f
Opcode Fuzzy Hash: 136f53f4f8625a44ddaf20aa68f3e7e57b533c7120a61100272f3826bc25c45d
Instruction Fuzzy Hash: 4BF022B294022DBBCB016B95CC89DCFBB69EF14361F048010FD00AB251CA3CDA00BBA1

Function 00FD8E8C Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00FD8EA6

Part of subcall function 00FDBB70: __FF_MSGBANNER.LIBCMT ref: 00FDBB89
Part of subcall function 00FDBB70: __NMSG_WRITE.LIBCMT ref: 00FDBB90
Part of subcall function 00FDBB70: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,00FDC627,00000000,00000001,00000000,?,00FDBDD6,00000018,01003420,0000000C,00FDBE66), ref: 00FDBBB5

std::exception::exception.LIBCMT ref: 00FD8EDB
std::exception::exception.LIBCMT ref: 00FD8EF5
__CxxThrowException@8.LIBCMT ref: 00FD8F06

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: std::exception::exception$AllocException@8HeapThrow_malloc
String ID:
API String ID: 1414122017-0
Opcode ID: dac974e18914a253ad9dbe01ad476a587d04ace38529f2f7f6db079727456da7
Instruction ID: 7d98e179d0a2e57c12d7d047118041ba7bf60c136369d47b85ad84bfc6f909b3
Opcode Fuzzy Hash: dac974e18914a253ad9dbe01ad476a587d04ace38529f2f7f6db079727456da7
Instruction Fuzzy Hash: ADF0F935C0020DEEDB15EF54EC12A6D37AAAF40750F49022BF540A63D2CFB9AA45E751

Function 00FE3F7C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 00FE40E2

Part of subcall function 00FE3D9A: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00FE7ABC,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00FE3DAE

Strings

regutil.cpp, xrefs: 00FE40CF

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseOpen
String ID: regutil.cpp
API String ID: 47109696-955085611
Opcode ID: 7859542ed0e60c560e7cbea11f40d4e87ef53224e480879168822669cbaced52
Instruction ID: da0c4b7ca0591750a099fab4d547d415eb7b946c4f9a7b52b1e4934e1d17ebf4
Opcode Fuzzy Hash: 7859542ed0e60c560e7cbea11f40d4e87ef53224e480879168822669cbaced52
Instruction Fuzzy Hash: 9D41E637D0019AEBDF219E568C05BAEB6B6AF80320F25403DE711E7150EB79EE10B751

Function 00FE37DF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,80070002,80070003,00000000,00000000,00000000), ref: 00FE3850
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00FE3889

Strings

regutil.cpp, xrefs: 00FE38EE

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: QueryValue
String ID: regutil.cpp
API String ID: 3660427363-955085611
Opcode ID: 3b561a8e8095d7ca6b265c004173866f5a0569d364d28aa7cd15db24f7aa8aef
Instruction ID: 36d2f02fd061d346eecd4ee119e72bba7baf501f192e950a5c6201accc833666
Opcode Fuzzy Hash: 3b561a8e8095d7ca6b265c004173866f5a0569d364d28aa7cd15db24f7aa8aef
Instruction Fuzzy Hash: 924146B2E0028AABDF109FA6CC899AEB7B9FF44300F14486AF551D7111D7B49B44EB50

Function 00FE5DFA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000,00000000,75C0B390,00000000,?,00FC7FDD,?,?,?,00000000,00000000,?), ref: 00FE5E96
GetLastError.KERNEL32(?,00FC7FDD,?,?,?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00FB130D,?,?), ref: 00FE5F0D

Strings

fileutil.cpp, xrefs: 00FE5F40

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: fileutil.cpp
API String ID: 1948546556-2967768451
Opcode ID: 1b1737dfbaeabc52a0303a67dd193360740bf48fe986cdd82edb5295f9a26079
Instruction ID: c67e80ee31df41e1b58c025c94aa78f13f23bef2d6e3f6d0d57c82b4bf36c3f2
Opcode Fuzzy Hash: 1b1737dfbaeabc52a0303a67dd193360740bf48fe986cdd82edb5295f9a26079
Instruction Fuzzy Hash: 2531AF31D005E9DBDF22CF16CD407DAB7B9EB08B09F0480EAA549E6250D6B49EC4AF60

Function 00FE1817 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FE18B7
_memmove.LIBCMT ref: 00FE18C2

Part of subcall function 00FE293A: GetProcessHeap.KERNEL32(00000000,?,?,00FE0E95,?,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000), ref: 00FE2942
Part of subcall function 00FE293A: HeapSize.KERNEL32(00000000,?,00FE0E95,?,80070000,00000000,0000FFFF,?,?,?,00FDFD73,?,00FD6AA0,00000000,00000000,80070000), ref: 00FE2949

Strings

W, xrefs: 00FE183D

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: Heap_memmove$ProcessSize
String ID: W
API String ID: 3606272560-655174618
Opcode ID: f8cad168358a3cbd509edd30e23fbcf2136698108d57d8aad7bf8aae5303dd7e
Instruction ID: d7a3f1b7337392f31e7d37285d611f363349049819daebf8c3aa9d492060df15
Opcode Fuzzy Hash: f8cad168358a3cbd509edd30e23fbcf2136698108d57d8aad7bf8aae5303dd7e
Instruction Fuzzy Hash: EA2174B1E0024AFBDB10DFA7CC81EAE77ADFF44364B144269E95097241EB74DB14AB60

Function 00FE1F87 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 00FE2009

Strings

\\?\UNC, xrefs: 00FE2013
\\?\, xrefs: 00FE1FCE

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: _memmove_s
String ID: \\?\$\\?\UNC
API String ID: 800865076-2523517826
Opcode ID: 57b579ea94448c7f7ebfef02ccda3b81a00950bdce98670f21c1b99ef8e392a3
Instruction ID: 80a9414606288cb101ee124fd7879e935af6e78c00f9bf9ea1fa92bf04e53964
Opcode Fuzzy Hash: 57b579ea94448c7f7ebfef02ccda3b81a00950bdce98670f21c1b99ef8e392a3
Instruction Fuzzy Hash: 7C119372640284B5E6319A47DC02FFA7B6DFB54B74F804026F6495A0C1F3A56681E3A5

Function 00FB40C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,IGNOREDEPENDENCIES,00000000,?,?,?,00FCFF26,00000000,IGNOREDEPENDENCIES,00000000,?), ref: 00FB4116

Strings

IGNOREDEPENDENCIES, xrefs: 00FB40D2
Failed to copy the property value., xrefs: 00FB4146

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CompareString
String ID: Failed to copy the property value.$IGNOREDEPENDENCIES
API String ID: 1825529933-1412343224
Opcode ID: 96efa7aaab4d657ab5e040352ec314de3db5a5c338a909dfc54e9d3dc01dce63
Instruction ID: 06a260c6b25305c6882cad0846a61e0030159ace1892390c1598d1b6e0e3b688
Opcode Fuzzy Hash: 96efa7aaab4d657ab5e040352ec314de3db5a5c338a909dfc54e9d3dc01dce63
Instruction Fuzzy Hash: 7F11B272D04219EFCF118F5ACD84AEE7769EB54370F22417AF92567262C6306D80EB50

Function 00FC1BC4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE3D9A: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00FE7ABC,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00FE3DAE

RegCloseKey.ADVAPI32(?,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,?,00000001,?,?,?,00FC1F22,00000000,?,?,?), ref: 00FC1C51

Part of subcall function 00FE37DF: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,80070002,80070003,00000000,00000000,00000000), ref: 00FE3850
Part of subcall function 00FE37DF: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00FE3889

Strings

SOFTWARE\Policies\Microsoft\Windows\Installer, xrefs: 00FC1BD3
Logging, xrefs: 00FC1BF2

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer
API String ID: 1586453840-387823766
Opcode ID: b30e83a6747e4eb4259487970c59cdaf06d8463098595145d0353510b5a249c1
Instruction ID: 2edac779b08eeef383e2fedcd0b28ea122afe8c6215f412fa62e9efa73b491d5
Opcode Fuzzy Hash: b30e83a6747e4eb4259487970c59cdaf06d8463098595145d0353510b5a249c1
Instruction Fuzzy Hash: C5117371A8061EAADB20DB818F47FFEB6B4FB91711FD04059F141A6051D2719BA1B610

Function 00FBC160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00FBC179
CoUninitialize.OLE32(?,?,?,?,?,?), ref: 00FBC1DC

Strings

Failed to initialize COM on cache thread., xrefs: 00FBC186

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: InitializeUninitialize
String ID: Failed to initialize COM on cache thread.
API String ID: 3442037557-3629645316
Opcode ID: 7bbf350fbc0e9abe7565613caa1749a913a9bb5a61fc1b12d947ef33af7f7659
Instruction ID: 6b1f6e1296bf86f3fbd2639719f50e9b91f569d30c87c298a27a4ee10f3c381c
Opcode Fuzzy Hash: 7bbf350fbc0e9abe7565613caa1749a913a9bb5a61fc1b12d947ef33af7f7659
Instruction Fuzzy Hash: 710121B2500209BFDB11DF99D844EDB77ECEF04354F10802AFA09E7161D775E9449BA5

Function 00FE6AAB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE3D9A: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00FE7ABC,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00FE3DAE

RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,?,?,?,00000000,?,?,?,00FE6B57,?), ref: 00FE6B19

Part of subcall function 00FE3BAC: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000105,00000000,00000000,?,?,?,?,00FB565B,00000000,Installed,00000000,?), ref: 00FE3BD1

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00FE6AC9
EnableLUA, xrefs: 00FE6AEB

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 3677997916-3551287084
Opcode ID: a7c8141caa72dfbf72850fca187636f18a0efaef69a867f8c4309074f4d9f0ef
Instruction ID: 4b6db03d7270d5c2b9d688ea86bda9842ce5203c3b0181e8f2b6fd889eb1b699
Opcode Fuzzy Hash: a7c8141caa72dfbf72850fca187636f18a0efaef69a867f8c4309074f4d9f0ef
Instruction Fuzzy Hash: A6018476A0021CFFD7119BA6CC4AA9EB7B9EBD4750F214476E605E7140EA705E40A750

Function 00FE1CAD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00FE1D5C,00000000,?,00000200), ref: 00FE1CF1
GetLastError.KERNEL32(?,00FE1D5C,00000000,?,00000200,?,00FE744D,00000000,00000000,00000000,00000000,?,00000000,?,00FE7829,00000000), ref: 00FE1CFB

Strings

strutil.cpp, xrefs: 00FE1D20

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorLastString
String ID: strutil.cpp
API String ID: 3728238275-3612885251
Opcode ID: e0adf2e4a31ec2e4ddb85f88b2a4653a4785be0ed5f3e46b4f2f91f2b86a5414
Instruction ID: f66249a03384629b2581305c43efc795e0159d2bc129b4c4bedf16d6a9a9d762
Opcode Fuzzy Hash: e0adf2e4a31ec2e4ddb85f88b2a4653a4785be0ed5f3e46b4f2f91f2b86a5414
Instruction Fuzzy Hash: A101713664019AB7DB225E538C05F9B7B6AFF81770F254029FE28DB250EA35D910B750

Function 00FB9F64 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 00FB9F79

Part of subcall function 00FE057A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,00000000,?,?,00FB9127,00000000), ref: 00FE058E
Part of subcall function 00FE057A: GetProcAddress.KERNEL32(00000000), ref: 00FE0595
Part of subcall function 00FE057A: GetLastError.KERNEL32(?,?,00FB9127,00000000), ref: 00FE05AC

Part of subcall function 00FB9B01: RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00FB9B87

Strings

Failed to set variant value., xrefs: 00FB9FB5
Failed to get 64-bit folder., xrefs: 00FB9F9C

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: AddressCloseCurrentErrorHandleLastModuleProcProcess
String ID: Failed to get 64-bit folder.$Failed to set variant value.
API String ID: 3109562764-2681622189
Opcode ID: 4b0f0793fe376df9a76af472a316d4e35e69f2924bb5d2e1bbf91795c8cb9585
Instruction ID: cd64642362e6c581bbbd80e9c773f7c00fc0c47c5dec9ef2310a8d6cd6dd9697
Opcode Fuzzy Hash: 4b0f0793fe376df9a76af472a316d4e35e69f2924bb5d2e1bbf91795c8cb9585
Instruction Fuzzy Hash: 8B01D672D04158FE8B11AB96DC06CEEFABCEF90720B258156F610A6150EAF59F40FA50

Function 00FE202C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00FB213E,?,00000104,?,00000104,?,00000000,?,?,00FB213E,?,00000000,?,?,?,76EEC3F0), ref: 00FE204D
GetLastError.KERNEL32(?,00FB213E,?,00000000,?,?,?,76EEC3F0,?,00000000), ref: 00FE2064

Strings

pathutil.cpp, xrefs: 00FE2089

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: pathutil.cpp
API String ID: 2776309574-741606033
Opcode ID: 0c80205e7449662d9f136ace14eed772c94f3e0f52b3fc69e29e0df587a20806
Instruction ID: 02450d7bd48a8ea8f4205ae5db77479a6fdc8b3d4e676ce9724dc22608b8a794
Opcode Fuzzy Hash: 0c80205e7449662d9f136ace14eed772c94f3e0f52b3fc69e29e0df587a20806
Instruction Fuzzy Hash: 4CF02832A0026A6BD36117578C84F6BBA1CAF007B0B110130FF00DB190F754DC00F6E0

Function 00FB719E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE3D9A: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00FE7ABC,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00FE3DAE

RegCloseKey.ADVAPI32(00000000,00000000,00000000,?,?,00020006,00000000,00000000,00000001,?,?,00FD1E8F,000000F9,00000000,000000B9,00000000), ref: 00FB71F5

Strings

Failed to open registration key., xrefs: 00FB71C5
Failed to update resume mode., xrefs: 00FB71DF

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to open registration key.$Failed to update resume mode.
API String ID: 47109696-3366686031
Opcode ID: 1ce26128d416ad527c97b403e55838f9cc1953ae87b4ea694ef0e24816064e4d
Instruction ID: ca705bbeb6260c9d005367e9c148a54288261dfad47456ebfc54a4c4a51a2883
Opcode Fuzzy Hash: 1ce26128d416ad527c97b403e55838f9cc1953ae87b4ea694ef0e24816064e4d
Instruction Fuzzy Hash: E9F0C233644314FBCB12AAAADC06BEB77B9DBC1325F204025F501E6190DA78EA00BA20

Function 00FE5CB9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00FB2787,?,?,?,00000000,00000000), ref: 00FE5CD1
GetLastError.KERNEL32(?,?,?,00FB2787,?,?,?,00000000,00000000,?,?,?,76EEC3F0,?,00000000), ref: 00FE5CDB

Strings

fileutil.cpp, xrefs: 00FE5D00

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorFileLastSize
String ID: fileutil.cpp
API String ID: 464720113-2967768451
Opcode ID: c773afed8a7595f9b90793c028825ad4a5b8aebfa066ca065d0dc3c92cc4bd72
Instruction ID: d29a5254766705732aa4163d5cc012cd02cc114eda73bdc252d598f6c24bf8ef
Opcode Fuzzy Hash: c773afed8a7595f9b90793c028825ad4a5b8aebfa066ca065d0dc3c92cc4bd72
Instruction Fuzzy Hash: 32F0C876610645ABD7109F6ACC05EAF77F9EF84B25B104029E955DB200F634E900AB20

Function 00FE81D9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

HttpQueryInfoW.WININET(?,?,00000001,?,00000000), ref: 00FE8202
GetLastError.KERNEL32(?,?,?,00FD7201,00000000,00000013,00000000,?,?,?,00FD747C,00000000,?,00000000,?,00000000), ref: 00FE820C

Strings

inetutil.cpp, xrefs: 00FE8231

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorHttpInfoLastQuery
String ID: inetutil.cpp
API String ID: 4218848986-2900720265
Opcode ID: cdafd30e8c441a5d8d7d9a333a574a396fff066b84fc639d5360005528c4f62c
Instruction ID: 755cfba3b9d013077baf065a54d05f18c0a4c4312b3f7541136f85b1258da806
Opcode Fuzzy Hash: cdafd30e8c441a5d8d7d9a333a574a396fff066b84fc639d5360005528c4f62c
Instruction Fuzzy Hash: DCF096B2A1025ABBE7109B91DC45FDB7BACFF007A0F014125FA04EA140E674DA00A7E0

Function 00FE7FF2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

HttpQueryInfoW.WININET(00000000,20000005,00000000,00000000,00000000), ref: 00FE8011
GetLastError.KERNEL32(?,?,00FD75A4,?,?,00000000,000000FF,?,00000000,HEAD,00000000,00000000,?,00000000,?,?), ref: 00FE801B

Strings

inetutil.cpp, xrefs: 00FE8038

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: ErrorHttpInfoLastQuery
String ID: inetutil.cpp
API String ID: 4218848986-2900720265
Opcode ID: e3c9f35a82ebdb4006eec9b2c4ef958994591faecb93ace1024a09b3b444cd42
Instruction ID: e3d13459cb126c0957b0451352b781740e41daf378300a412b150268300849a2
Opcode Fuzzy Hash: e3c9f35a82ebdb4006eec9b2c4ef958994591faecb93ace1024a09b3b444cd42
Instruction Fuzzy Hash: D8F09672601259AFD7219F52CC49F9B7FACEF017A1F004025FA09DB240E774DA04A7E0

Function 00FD0723 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00FFFF24,00000000,00FB1AAE,?,00FBD984,?,00FB1AAE,00FB1E12,00FB1E12,00000000,?,00FB1E22,FEBB4868,00FB1E22,?,?), ref: 00FD0754
_memset.LIBCMT ref: 00FD0766

Part of subcall function 00FD6101: SetEvent.KERNEL32(0578F685,00FB2222,00FB1E22,?,?,00FD0739,00FB2222,00000000,00FB1AAE,?,00FBD984,?,00FB1AAE,00FB1E12,00FB1E12,00000000), ref: 00FD6122
Part of subcall function 00FD6101: GetLastError.KERNEL32(?,?,00FD0739,00FB2222,00000000,00FB1AAE,?,00FBD984,?,00FB1AAE,00FB1E12,00FB1E12,00000000,?,00FB1E22,FEBB4868), ref: 00FD612C
Part of subcall function 00FD6101: CloseHandle.KERNEL32(F08B8007,00000000,00FB2222,00FB1E22,?,?,00FD0739,00FB2222,00000000,00FB1AAE,?,00FBD984,?,00FB1AAE,00FB1E12,00FB1E12), ref: 00FD61C8
Part of subcall function 00FD6101: CloseHandle.KERNEL32(0578F685,00000000,00FB2222,00FB1E22,?,?,00FD0739,00FB2222,00000000,00FB1AAE,?,00FBD984,?,00FB1AAE,00FB1E12,00FB1E12), ref: 00FD61D5
Part of subcall function 00FD6101: CloseHandle.KERNEL32(004005BE,00000000,00FB2222,00FB1E22,?,?,00FD0739,00FB2222,00000000,00FB1AAE,?,00FBD984,?,00FB1AAE,00FB1E12,00FB1E12), ref: 00FD61E2

Strings

Failed to close cabinet., xrefs: 00FD073F

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: CloseHandle$ErrorEventLast_memset
String ID: Failed to close cabinet.
API String ID: 1352847294-2920093955
Opcode ID: 49c8e23f44c63d9dde045c6e127fdf62e9559fa6bc6cc983e4b2e2f04851db9a
Instruction ID: 50cd5a28fdc5d7dc4f816c91364ff969e331891464743b82e484720554383711
Opcode Fuzzy Hash: 49c8e23f44c63d9dde045c6e127fdf62e9559fa6bc6cc983e4b2e2f04851db9a
Instruction Fuzzy Hash: C8F02E3260061562C72165199C86F5B335A8FC1770F140216F668DB3C1DF24F80236A4

Function 00FE5B4A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 00FE596E: SysAllocString.OLEAUT32(?), ref: 00FE5981
Part of subcall function 00FE596E: VariantInit.OLEAUT32(?), ref: 00FE598D
Part of subcall function 00FE596E: VariantClear.OLEAUT32(?), ref: 00FE5A01
Part of subcall function 00FE596E: SysFreeString.OLEAUT32(00000000), ref: 00FE5A0C

_wcstoul.LIBCMT ref: 00FE5B72

Part of subcall function 00FE910F: wcstoxl.LIBCMT ref: 00FE911F

SysFreeString.OLEAUT32(00000000), ref: 00FE5B88

Strings

`<u, xrefs: 00FE5B88

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: String$FreeVariant$AllocClearInit_wcstoulwcstoxl
String ID: `<u
API String ID: 935627439-3367579956
Opcode ID: b6f3a503400465d303185d350d886dd4dec101b5220b233254db7f80d5e0a297
Instruction ID: 62473b86558a8152661cf5575249aac8777fb0f3a27b248f783cc5671cb86999
Opcode Fuzzy Hash: b6f3a503400465d303185d350d886dd4dec101b5220b233254db7f80d5e0a297
Instruction Fuzzy Hash: 28F05832901258FBCF129FA5DD06B9E7B69EF40B28F100060F902AA160C3759F20FB94

Function 00FDA89A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,00FDA8D3,00000000,00000000,00000000,00000000,00000000,00FDC611,?,00FD95B7,00000003,00FDBB8E,00000001,00000000,00000000), ref: 00FDA8A5
__invoke_watson.LIBCMT ref: 00FDA8C1

Strings

PNv, xrefs: 00FDA8A5

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: DecodePointer__invoke_watson
String ID: PNv
API String ID: 4034010525-4070351811
Opcode ID: 26c0e81268aa33e92954cee9b002e41cfe992da6082c54af3b5c14b3a21ecc61
Instruction ID: 3f6a38a3566b5ab4fbbdb1a30098342c2c09420e1f137e314ed4302f39798668
Opcode Fuzzy Hash: 26c0e81268aa33e92954cee9b002e41cfe992da6082c54af3b5c14b3a21ecc61
Instruction Fuzzy Hash: 6BE0B632440109BBDF162F619C0586A7B6AAF44250B584821FE1485121EB3AC872BB9A

Function 00FE376A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE303C: _memset.LIBCMT ref: 00FE3063
Part of subcall function 00FE303C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00FE3078
Part of subcall function 00FE303C: LoadLibraryW.KERNELBASE(?,?,00000104,00FB1C3B), ref: 00FE30C6
Part of subcall function 00FE303C: GetLastError.KERNEL32 ref: 00FE30D2

GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00FE378B

Strings

RegDeleteKeyExW, xrefs: 00FE3780
AdvApi32.dll, xrefs: 00FE3770

Memory Dump Source

Source File: 0000000B.00000002.4863062208.0000000000FB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00FB0000, based on PE: true

Associated: 0000000B.00000002.4862974702.0000000000FB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863161318.0000000000FEB000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863266796.0000000001006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.4863345897.000000000100C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_vcredist_2013_x64.jbxd

Similarity

API ID: AddressDirectoryErrorLastLibraryLoadProcSystem_memset
String ID: AdvApi32.dll$RegDeleteKeyExW
API String ID: 2769571726-850864035
Opcode ID: e083183ea9f2f957383421ad64e7342ce9db8ee19bfc943473330bd2da185deb
Instruction ID: a69a066b07a01ed87412ae1759744c8fef18f8719a54bfdc48f103d9ead4b5ae
Opcode Fuzzy Hash: e083183ea9f2f957383421ad64e7342ce9db8ee19bfc943473330bd2da185deb
Instruction Fuzzy Hash: D8E08CB19032E19BD3A39F12FC0D7023B50A709754F510069E5C89B298CBFFAC80A7A2

Analysis Process: VC_redist.x64.exePID: 4592, Parent PID: 6908COMMON

Executed Functions

Function 004A1700 Relevance: 45.8, APIs: 23, Strings: 3, Instructions: 313
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 004A175F
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 004A1772
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000001,00000000,?), ref: 004A17BD
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 004A17C7
GetTempPathW.KERNEL32(00000104,?,?,?,?,00000001,00000000,?), ref: 004A181A
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 004A1824
FindFirstFileW.KERNELBASE(?,?,?,*.*,?,?,?,?,00000001,00000000,?), ref: 004A1878
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 004A1889
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000001,00000000,?), ref: 004A195B
DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,00000001,00000000,?), ref: 004A196F
GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000001,00000000,?), ref: 004A1998
MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000001,00000000,?), ref: 004A19BB
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 004A19D4
FindNextFileW.KERNELBASE(000000FF,?,?,?,?,?,?,?,00000001,00000000,?), ref: 004A19E4
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 004A19F9
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 004A1A28
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 004A1A4A
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 004A1A6C
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 004A1A77
RemoveDirectoryW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 004A1AA0
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 004A1AAA
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 004A1ACE
FindClose.KERNEL32(000000FF,?,?,?,00000001,00000000,?), ref: 004A1AFA

Strings

*.*, xrefs: 004A1856
c:\agent\_work\36\s\wix\src\libs\dutil\dirutil.cpp, xrefs: 004A1795, 004A1A19
DEL, xrefs: 004A198C

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorFileLast$AttributesFindMove$Temp$CloseDeleteDirectoryFirstNameNextPathRemove
String ID: *.*$DEL$c:\agent\_work\36\s\wix\src\libs\dutil\dirutil.cpp
API String ID: 1544372074-374933037
Opcode ID: fa10c3bfabff47854ba1c491e1a4b8d1bee426e36d6bb0e68f6b9d86b4afd6ed
Instruction ID: 7b8fa5c4eb6883d26acffa34da99985579d2ddfebfc882161c53b3f67f479848
Opcode Fuzzy Hash: fa10c3bfabff47854ba1c491e1a4b8d1bee426e36d6bb0e68f6b9d86b4afd6ed
Instruction Fuzzy Hash: 13A14C77D0223957DB3056A68C44BEBB6695F62720F0542A7ED04BB2A1D63D8D80CBEC

Function 004A10E1 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 79fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004A4E3A: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,004A114E,?,00000000), ref: 004A4E5B

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 004A1167

Part of subcall function 004A14FE: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,004A118B,cabinet.dll,00000009,?,?,00000000), ref: 004A150F
Part of subcall function 004A14FE: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,004A118B,cabinet.dll,00000009,?,?,00000000), ref: 004A151A
Part of subcall function 004A14FE: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 004A1528
Part of subcall function 004A14FE: GetLastError.KERNEL32(?,?,?,?,?,004A118B,cabinet.dll,00000009,?,?,00000000), ref: 004A1543
Part of subcall function 004A14FE: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 004A154B
Part of subcall function 004A14FE: GetLastError.KERNEL32(?,?,?,?,?,004A118B,cabinet.dll,00000009,?,?,00000000), ref: 004A1560

CloseHandle.KERNELBASE(?,?,?,?,004EE4D0,?,cabinet.dll,00000009,?,?,00000000), ref: 004A11AA

Strings

version.dll, xrefs: 004A1118
comres.dll, xrefs: 004A1126
wininet.dll, xrefs: 004A111F
xN, xrefs: 004A1111
feclient.dll, xrefs: 004A1142
N, xrefs: 004A1134
`N, xrefs: 004A110A
clbcatq.dll, xrefs: 004A112D
cabinet.dll, xrefs: 004A1185
crypt32.dll, xrefs: 004A113B

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
String ID: `N$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$version.dll$wininet.dll$xN$N
API String ID: 3687706282-1674247141
Opcode ID: 5bf1c8ffaf25c47b1927aaa0809d0a8ade70d747e549f66115c92f3877791957
Instruction ID: 45ef644920504c7635dc2a4683c5df0387e5e82f7119aae76cf2bb27855bab2f
Opcode Fuzzy Hash: 5bf1c8ffaf25c47b1927aaa0809d0a8ade70d747e549f66115c92f3877791957
Instruction Fuzzy Hash: BA219471900258ABDB109FA7CC45BDFBBB8EF1A319F54851AF910B72D0D77899048BB8

Function 004BBD11 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 104fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004B9EF0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000), ref: 004B9F4F
Part of subcall function 004B9EF0: GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 004B9F75
Part of subcall function 004B9EF0: GetLastError.KERNEL32 ref: 004B9F7F

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:PAI(A;;FA;;;BA)(A;OICIIO;GA;;;BA)(A;;FA;;;SY)(A;OICIIO;GA;;;SY),00000001,?,00000000), ref: 004BBD60
GetLastError.KERNEL32(?,00000000,840F01E8,004A7083,00000000,004A714F,840F01E8), ref: 004BBD69
LocalFree.KERNEL32(?), ref: 004BBE0C

Part of subcall function 004A50E9: GetProcessHeap.KERNEL32(?,000001C7,?,004A2D50,?,00000001,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A50FA
Part of subcall function 004A50E9: RtlAllocateHeap.NTDLL(00000000,?,004A2D50,?,00000001,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A5101

Part of subcall function 004A1B27: CreateDirectoryW.KERNELBASE(00000000,004A7083,00000000,00000000,?,004BBDBF,00000000,00000000,?,00000000,840F01E8,004A7083,00000000,004A714F,840F01E8), ref: 004A1B35
Part of subcall function 004A1B27: GetLastError.KERNEL32(?,004BBDBF,00000000,00000000,?,00000000,840F01E8,004A7083,00000000,004A714F,840F01E8), ref: 004A1B43

DecryptFileW.ADVAPI32(00000000,00000000), ref: 004BBDD0

Strings

Failed to copy working folder., xrefs: 004BBDED
c:\agent\_work\36\s\wix\src\burn\engine\cache.cpp, xrefs: 004BBD8D
Failed create working folder., xrefs: 004BBDC5
Failed to calculate working folder to ensure it exists., xrefs: 004BBD3D
D:PAI(A;;FA;;;BA)(A;OICIIO;GA;;;BA)(A;;FA;;;SY)(A;OICIIO;GA;;;SY), xrefs: 004BBD5B
Failed to create the security descriptor for the working folder., xrefs: 004BBD97

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorLast$DescriptorDirectoryHeapProcessSecurity$AllocateConvertCreateCurrentDecryptFileFreeLocalStringWindows
String ID: D:PAI(A;;FA;;;BA)(A;OICIIO;GA;;;BA)(A;;FA;;;SY)(A;OICIIO;GA;;;SY)$Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.$Failed to create the security descriptor for the working folder.$c:\agent\_work\36\s\wix\src\burn\engine\cache.cpp
API String ID: 1593575373-1634687223
Opcode ID: 31dacd0de7d3c8e7abba44f5ec642237814728ced55f1795dd8082ac46668500
Instruction ID: 48fec88afe6d751100784a3217ad0ad7a46a8ba65a3e63db052340cba15d7d0e
Opcode Fuzzy Hash: 31dacd0de7d3c8e7abba44f5ec642237814728ced55f1795dd8082ac46668500
Instruction Fuzzy Hash: 1931C832D00669BBCB216F968D81AEFBA79DF11755F10412BF90176251DBBC8E00D6E8

Function 004A3B2C Relevance: 3.0, APIs: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,?,?,00000000), ref: 004A3B67
FindClose.KERNEL32(00000000,?,00000000), ref: 004A3B73

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 78723cf473752921cfdf607610795752800680cdaf4da2320f8b5d74c766e11a
Instruction ID: aa41a4379d9e2e30a1c733f2e328e96ef6bf34a5caca6b972f9155ee230ddda7
Opcode Fuzzy Hash: 78723cf473752921cfdf607610795752800680cdaf4da2320f8b5d74c766e11a
Instruction Fuzzy Hash: 0E018B716001085BDB10EF66DC89E6FB7ADDBD5325F000466F514D7241D634AE498668

Function 004B16B9 Relevance: 114.2, APIs: 3, Strings: 62, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to get @Tag., xrefs: 004B1740
Failed to get @HelpTelephone., xrefs: 004B18FF
Update, xrefs: 004B1AF4
DisableModify, xrefs: 004B19CC
c:\agent\_work\36\s\wix\src\burn\engine\registration.cpp, xrefs: 004B1A5D
ExecutableName, xrefs: 004B17CA
Failed to get @DisableModify., xrefs: 004B1A8E
Failed to get @Id., xrefs: 004B171F
Failed to parse software tag., xrefs: 004B1AE6
, xrefs: 004B1BB7
Failed to get @Manufacturer., xrefs: 004B1B3C
Failed to set registration paths., xrefs: 004B1BDE
DisableRemove, xrefs: 004B1A9F
Failed to select registration node., xrefs: 004B16F2
Tag, xrefs: 004B172D
Failed to get @DisplayVersion., xrefs: 004B1890
Failed to get @PerMachine., xrefs: 004B17FB
Failed to get @Version., xrefs: 004B177A
Failed to get @ExecutableName., xrefs: 004B17DD
Failed to get @Contact., xrefs: 004B19BE
HelpLink, xrefs: 004B18C3
Invalid modify disabled type: %ls, xrefs: 004B1A6A
Failed to get @ParentDisplayName., xrefs: 004B196E
DisplayVersion, xrefs: 004B1879
PerMachine, xrefs: 004B17E8
button, xrefs: 004B19EB
Failed to get @Department., xrefs: 004B1B64
Name, xrefs: 004B1B97
HelpTelephone, xrefs: 004B18E8
Failed to get @AboutUrl., xrefs: 004B1924
Department, xrefs: 004B1B4D
Failed to get @DisableRemove., xrefs: 004B1AB6
Failed to parse related bundles, xrefs: 004B1759
Failed to parse @Version: %ls, xrefs: 004B179B
Failed to select Update node., xrefs: 004B1B12
Classification, xrefs: 004B1BB8
ProductFamily, xrefs: 004B1B72
Comments, xrefs: 004B197F
Failed to get @ProductFamily., xrefs: 004B1B89
Failed to get @DisplayName., xrefs: 004B186B
Failed to get @Name., xrefs: 004B1BAA
Failed to get @Classification., xrefs: 004B1BCB
ParentDisplayName, xrefs: 004B1957
Registration, xrefs: 004B16D3
Failed to get @HelpLink., xrefs: 004B18DA
AboutUrl, xrefs: 004B190D
Manufacturer, xrefs: 004B1B29
UpdateUrl, xrefs: 004B1932
yes, xrefs: 004B1A0C
Failed to get @ProviderKey., xrefs: 004B17BC
Register, xrefs: 004B1833
Failed to select ARP node., xrefs: 004B1825
Failed to get @Register., xrefs: 004B1846
Failed to get @UpdateUrl., xrefs: 004B1949
Failed to get @Publisher., xrefs: 004B18B5
Arp, xrefs: 004B1809
Failed to get @Comments., xrefs: 004B1996
Version, xrefs: 004B1767
Contact, xrefs: 004B19A7
ProviderKey, xrefs: 004B17A9
Publisher, xrefs: 004B189E
DisplayName, xrefs: 004B1854

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$c:\agent\_work\36\s\wix\src\burn\engine\registration.cpp$yes$
API String ID: 760788290-4060943106
Opcode ID: 81250337c2f3b0a2460736e613729bffc5f24601d49d7c5ee3ae81a57fd3b018
Instruction ID: 61ea2a170f50a91250bd1b32cf91b6b75742e07e5750dd90f70da41b801e410a
Opcode Fuzzy Hash: 81250337c2f3b0a2460736e613729bffc5f24601d49d7c5ee3ae81a57fd3b018
Instruction Fuzzy Hash: 0EE1D973E48279BBDB1165A1CCA1FFE76A46B00710F610667FA10B7270DB6CAE0056AD

Function 004AD197 Relevance: 95.1, APIs: 24, Strings: 30, Instructions: 577
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 004AD20E
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD25C
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 004AD262
ReadFile.KERNELBASE(00000000,9aJH,00000040,?,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD2AA
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 004AD2B0
SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD30D
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD313
ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD35C
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD362
SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD3D3
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD3D9
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD422
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD428
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD471
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD477
SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD4C3
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD4C9

Part of subcall function 004A50E9: GetProcessHeap.KERNEL32(?,000001C7,?,004A2D50,?,00000001,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A50FA
Part of subcall function 004A50E9: RtlAllocateHeap.NTDLL(00000000,?,004A2D50,?,00000001,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A5101

ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD51C
ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD57E
SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD608
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004AD612

Strings

PE, xrefs: 004AD3A4
Failed to read section info, unsupported version: %08x, xrefs: 004AD701
c:\agent\_work\36\s\wix\src\burn\engine\section.cpp, xrefs: 004AD22F, 004AD283, 004AD2D1, 004AD334, 004AD383, 004AD3FA, 004AD449, 004AD498, 004AD4ED, 004AD5A4, 004AD5E4, 004AD636, 004AD69B, 004AD6C5, 004AD6EC, 004AD7D3, 004AD832, 004AD86F, 004AD8AD, 004AD8D0, 004AD8EB
Failed to open handle to engine process path., xrefs: 004AD239
Failed to seek to NT header., xrefs: 004AD33E
.wix, xrefs: 004AD53C
Failed to find Burn section., xrefs: 004AD83E
Failed to read complete image section header, index: %u, xrefs: 004AD881
Failed to read signature size., xrefs: 004AD4A2
Failed to find valid DOS image header in buffer., xrefs: 004AD8F7
Failed to read section info, data to short: %u, xrefs: 004AD5B6
h\!O, xrefs: 004AD813
Failed to read signature offset., xrefs: 004AD453
Failed to read NT header., xrefs: 004AD38D
burn, xrefs: 004AD544
Failed to find valid NT image header in buffer., xrefs: 004AD8DC
Failed to allocate memory for container sizes., xrefs: 004AD7DF
4, xrefs: 004AD590
Failed to seek past optional headers., xrefs: 004AD4F7
Failed to get total size of bundle., xrefs: 004AD72F
(, xrefs: 004AD529
Failed to seek to start of file., xrefs: 004AD28D
Failed to read DOS header., xrefs: 004AD2DB
PE Header from file didn't match PE Header in memory., xrefs: 004AD81D
Failed to read complete section info., xrefs: 004AD6D1
Failed to read image section header, index: %u, xrefs: 004AD8B8
Failed to read section info., xrefs: 004AD6A5
9aJH, xrefs: 004AD1AE, 004AD2A4, 004AD2F7, 004AD1B8, 004AD2A7
Failed to seek to section info., xrefs: 004AD404, 004AD640
Failed to allocate buffer for section info., xrefs: 004AD5F0

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
String ID: ($.wix$4$9aJH$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$c:\agent\_work\36\s\wix\src\burn\engine\section.cpp$h\!O
API String ID: 3411815225-1098239714
Opcode ID: fac8297e5fbd6a4ce851abce977e511890b6b0c87beac41a893075d98027e4fd
Instruction ID: 9842a831ca2c940aa61a1bf67015187640294a33fcda77e03135590503e2cb09
Opcode Fuzzy Hash: fac8297e5fbd6a4ce851abce977e511890b6b0c87beac41a893075d98027e4fd
Instruction Fuzzy Hash: E8121672D40235ABDB209A158E46FAB76B4AF12710F11019BFE05AB680D77CDD41CBED

Function 004C28E5 Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,?,004C2495,?,?), ref: 004C28F4
GetLastError.KERNEL32(?,?,?,?,004C2495,?,?), ref: 004C28FE
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,004C2495,?,?), ref: 004C2943
GetLastError.KERNEL32(?,?,?,?,004C2495,?,?), ref: 004C294E
ResetEvent.KERNEL32(?,?,?,?,?,004C2495,?,?), ref: 004C2986
GetLastError.KERNEL32(?,?,?,?,004C2495,?,?), ref: 004C2990

Strings

c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp, xrefs: 004C2922, 004C2972, 004C29B4, 004C29E0, 004C2A63, 004C2AAB, 004C2AF0, 004C2B58, 004C2BC3, 004C2C14, 004C2C59, 004C2C9D
Failed to set end of file., xrefs: 004C2C63
Failed to set file pointer to beginning of file., xrefs: 004C2CA7
Failed to reset begin operation event., xrefs: 004C29BE, 004C2AFA
Failed to set file pointer to end of file., xrefs: 004C2C1E
Failed to wait for begin operation event., xrefs: 004C297C, 004C2AB5
Failed to copy stream name: %ls, xrefs: 004C2A1F
Invalid operation for this state., xrefs: 004C29EC
Failed to create file: %ls, xrefs: 004C2BD0
Failed to set operation complete event., xrefs: 004C292C, 004C2A6D
Failed to allocate buffer for stream., xrefs: 004C2B62

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorLast$Event$ObjectResetSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp
API String ID: 1865021742-3295966698
Opcode ID: 1873c5114dad5dd048d616d7795b620d68cd3d9c369ee3d2a7915cdd5fdace81
Instruction ID: 684bf60f3f5759ad6c2912cde34f6e989e661bfeaa3d3a8c86c372f76e82e497
Opcode Fuzzy Hash: 1873c5114dad5dd048d616d7795b620d68cd3d9c369ee3d2a7915cdd5fdace81
Instruction Fuzzy Hash: 85911C7BA84732B7E2711A664F49F276954AF10B21F11022BBE40BE6E1D6EDDC0085DE

Function 004A6A03 Relevance: 42.2, APIs: 6, Strings: 18, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004A4E3A: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,004A114E,?,00000000), ref: 004A4E5B

CloseHandle.KERNEL32(00000000,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 004A6C0A
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 004A6C19
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 004A6C28
CloseHandle.KERNEL32(?,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 004A6C33

Strings

Failed to allocate full command-line., xrefs: 004A6B58
Failed to allocate parameters for unelevated process., xrefs: 004A6AC4
burn.filehandle.self, xrefs: 004A6B0F
Failed to wait for clean room process: %ls, xrefs: 004A6BED
Failed to cache to clean room., xrefs: 004A6A8C
"%ls" %ls, xrefs: 004A6B44
-%ls="%ls", xrefs: 004A6AB0
Failed to append original command line., xrefs: 004A6B33
vqJ, xrefs: 004A6C16
burn.filehandle.attached, xrefs: 004A6AE1
Failed to get path for current process., xrefs: 004A6A4D
Failed to append %ls, xrefs: 004A6AE6
D, xrefs: 004A6B73
Failed to launch clean room process: %ls, xrefs: 004A6BC1
burn.clean.room, xrefs: 004A6AA8
c:\agent\_work\36\s\wix\src\burn\engine\engine.cpp, xrefs: 004A6BB4
vqJ, xrefs: 004A6AFF, 004A6B02
%ls %ls, xrefs: 004A6B1F

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CloseHandle$FileModuleName
String ID: "%ls" %ls$%ls %ls$-%ls="%ls"$D$Failed to allocate full command-line.$Failed to allocate parameters for unelevated process.$Failed to append %ls$Failed to append original command line.$Failed to cache to clean room.$Failed to get path for current process.$Failed to launch clean room process: %ls$Failed to wait for clean room process: %ls$burn.clean.room$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\36\s\wix\src\burn\engine\engine.cpp$vqJ$vqJ
API String ID: 3884789274-1091261433
Opcode ID: 5b1f40bc0dba505886cee7acec089773f7b515fa686197a991c67a9f0a995ce6
Instruction ID: 5f728c4c9f670605eb592cbb650efa54fce7ac54dffd34e671ea24ff9d9ab1e7
Opcode Fuzzy Hash: 5b1f40bc0dba505886cee7acec089773f7b515fa686197a991c67a9f0a995ce6
Instruction Fuzzy Hash: 9E711732D00269BBCF219A96CC41EDFBB78EF16721F154117F910B6291D7789A018BE9

Function 004A6E5B Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 004A6EDD

Part of subcall function 004E56A2: InitializeCriticalSection.KERNEL32(0050F764,?,004A6EE9,00000000,?,?,?,?,?,?), ref: 004E56B9

Part of subcall function 004A1591: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,004A6F05,00000000,?), ref: 004A15CF
Part of subcall function 004A1591: GetLastError.KERNEL32(?,?,?,004A6F05,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 004A15D9

CoInitializeEx.COMBASE(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 004A6F4B

Part of subcall function 004A56C9: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 004A56EA

GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 004A6FDD
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 004A6FE7
CoUninitialize.COMBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004A7254

Strings

Failed to run per-machine mode., xrefs: 004A7132
3.14.1.8722, xrefs: 004A704A
Failed to initialize Regutil., xrefs: 004A6F8F
Failed to parse command line., xrefs: 004A6F0B
Failed to get OS info., xrefs: 004A7015
Failed to initialize core., xrefs: 004A7089
Invalid run mode., xrefs: 004A70BF
Failed to run untrusted mode., xrefs: 004A717C
Failed to run embedded mode., xrefs: 004A710A
Failed to initialize Wiutil., xrefs: 004A6FA7
Failed to run per-user mode., xrefs: 004A715A
Failed to run RunOnce mode., xrefs: 004A70E2
Failed to initialize XML util., xrefs: 004A6FBF
c:\agent\_work\36\s\wix\src\burn\engine\engine.cpp, xrefs: 004A700B
Failed to initialize Cryputil., xrefs: 004A6F6C
Failed to initialize COM., xrefs: 004A6F57
, xrefs: 004A71BB
Failed to initialize engine state., xrefs: 004A6F32

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.14.1.8722$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$c:\agent\_work\36\s\wix\src\burn\engine\engine.cpp$
API String ID: 3262001429-808583736
Opcode ID: 1e758d48f6872f666c1c344e0d1e7106b18c73a5488c5e3d1b96189179d7276c
Instruction ID: 5843a5227132cee6c7b40b46ba33e70f6c3ec45713cc86155ddaab8a7d8687b1
Opcode Fuzzy Hash: 1e758d48f6872f666c1c344e0d1e7106b18c73a5488c5e3d1b96189179d7276c
Instruction Fuzzy Hash: 7DB1FA72D042689BDB31AF668C45BEE76B4AB26315F0500DBF908B6341DA3C9E40CE9D

Function 004B916B Relevance: 38.8, APIs: 1, Strings: 21, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WixBundleOriginalSource, xrefs: 004B939A
Failed to load manifest., xrefs: 004B9229
Failed to get manifest stream from container., xrefs: 004B920D
Failed to set original source variable., xrefs: 004B93AB
Failed to get source process folder from path., xrefs: 004B9366
Failed to open manifest stream., xrefs: 004B91EC
Failed to parse command line., xrefs: 004B92A8
Failed to load catalog files., xrefs: 004B9450
Failed to initialize variables., xrefs: 004B91B2
Failed to extract bootstrapper application payloads., xrefs: 004B9430
WixBundleSourceProcessFolder, xrefs: 004B9375
Failed to set source process path variable., xrefs: 004B934A
WixBundleElevated, xrefs: 004B92E6, 004B92F7
Failed to get unique temporary folder for bootstrapper application., xrefs: 004B940F
hN, xrefs: 004B92B9
Failed to set source process folder variable., xrefs: 004B9386
WixBundleSourceProcessPath, xrefs: 004B9339
Failed to initialize internal cache functionality., xrefs: 004B93E0
Failed to open attached UX container., xrefs: 004B91CF
Failed to overwrite the %ls built-in variable., xrefs: 004B92FC
WixBundleUILevel, xrefs: 004B9317, 004B9328

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel$hN
API String ID: 32694325-3673425271
Opcode ID: 87ddbdf5ba2d71261f36d4047b43fdc4efc2163bcd636b3919d723ee164034db
Instruction ID: f9557c5449bc1d62e1b830068d3ef05fe69f4ce3b60bf0b08067d0bedc8b64cc
Opcode Fuzzy Hash: 87ddbdf5ba2d71261f36d4047b43fdc4efc2163bcd636b3919d723ee164034db
Instruction Fuzzy Hash: 41A17472E4461ABADB129AA5CC41FEFB7ACAB14704F10022BFB15E7141D73CAD0587A9

Function 004A9322 Relevance: 36.4, APIs: 1, Strings: 23, Instructions: 430
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(004B91AC,004A7083,00000000,004A710B), ref: 004A9342

Strings

WixBundleAction, xrefs: 004A9AAC
WixBundleVersion, xrefs: 004A9C0C
#, xrefs: 004A93C1
WixBundleForcedRestartPackage, xrefs: 004A9B52
WixBundleInstalled, xrefs: 004A9B68
0, xrefs: 004A9359
LogonUser, xrefs: 004A9578
InstallerVersion, xrefs: 004A9529
WixBundleExecutePackageCacheFolder, xrefs: 004A9B1A
hN, xrefs: 004A9AD0
WixBundleProviderKey, xrefs: 004A9BBC
Date, xrefs: 004A9466
WixBundleSourceProcessFolder, xrefs: 004A9BDC
WixBundleElevated, xrefs: 004A9B84
InstallerName, xrefs: 004A9508
Failed to add built-in variable: %ls., xrefs: 004A9C57
WixBundleSourceProcessPath, xrefs: 004A9BCC
WixBundleTag, xrefs: 004A9BEC
WixBundleActiveParent, xrefs: 004A9BA0
$, xrefs: 004A9A7F
', xrefs: 004A95AB
WixBundleExecutePackageAction, xrefs: 004A9B36
WixBundleUILevel, xrefs: 004A9BFC

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion$hN
API String ID: 32694325-4108890096
Opcode ID: 91ffb2986c7c9186b79b056aafdee672a45a278642a7c03859df0990e1bb60c5
Instruction ID: 45ade49bd507c1e9d8c03de4f930b9a88012c395f6d9c155831ef40d48b8c9c1
Opcode Fuzzy Hash: 91ffb2986c7c9186b79b056aafdee672a45a278642a7c03859df0990e1bb60c5
Instruction Fuzzy Hash: 114259B0C156699FDB61CF5AC9883CDFBB4BB49305F9081EED50CA6210D7B80B898F49

Function 004BA32E Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 208
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,004A6A86,?,?,00000000,004A6A86,00000000), ref: 004BA371
GetLastError.KERNEL32 ref: 004BA37E

Part of subcall function 004A35C3: ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 004A3659

SetFilePointerEx.KERNELBASE(00000000,004EE4B8,00000000,00000000,00000000,?,00000000,004EE500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004BA42B
GetLastError.KERNEL32 ref: 004BA435
CloseHandle.KERNELBASE(00000000,?,00000000,004EE500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004BA560

Strings

Failed to copy engine from: %ls to: %ls, xrefs: 004BA406
msi.dll, xrefs: 004BA472
Failed to seek to checksum in exe header., xrefs: 004BA463
c:\agent\_work\36\s\wix\src\burn\engine\cache.cpp, xrefs: 004BA3A2, 004BA459, 004BA4C0, 004BA52F
Failed to seek to signature table in exe header., xrefs: 004BA4CA
Failed to zero out original data offset., xrefs: 004BA552
Failed to seek to original data in exe burn section header., xrefs: 004BA539
Failed to seek to beginning of engine file: %ls, xrefs: 004BA3D7
Failed to create engine file at path: %ls, xrefs: 004BA3AF
Failed to update signature offset., xrefs: 004BA47F
cabinet.dll, xrefs: 004BA4D9

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: File$ErrorLast$CloseCreateHandlePointerRead
String ID: Failed to copy engine from: %ls to: %ls$Failed to create engine file at path: %ls$Failed to seek to beginning of engine file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$c:\agent\_work\36\s\wix\src\burn\engine\cache.cpp$cabinet.dll$msi.dll
API String ID: 3456208997-1085769834
Opcode ID: b78fe003c6245beeb07e8ca20c82dcf788ffe9a39cc491aa2728480d9f2ac67f
Instruction ID: bcac943dcbc81eabf81412de7bba15fe3393410226af3c914c185f219a626a8e
Opcode Fuzzy Hash: b78fe003c6245beeb07e8ca20c82dcf788ffe9a39cc491aa2728480d9f2ac67f
Instruction Fuzzy Hash: DB51F472D406357BE7216A658C46FBF76689B15B10F11012BFE00BB281E6ACDD1046FF

Function 004B9EF0 Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000), ref: 004B9F4F

Part of subcall function 004E5A1F: OpenProcessToken.ADVAPI32(?,00000008,?,004A7083,00000000,?,?,?,?,?,?,?,004B92DE,00000000), ref: 004E5A3D
Part of subcall function 004E5A1F: GetLastError.KERNEL32(?,?,?,?,?,?,?,004B92DE,00000000), ref: 004E5A47
Part of subcall function 004E5A1F: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,004B92DE,00000000), ref: 004E5AD1

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 004B9F75
GetLastError.KERNEL32 ref: 004B9F7F
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 004B9FFE
GetLastError.KERNEL32 ref: 004BA008
UuidCreate.RPCRT4(?), ref: 004BA047
StringFromGUID2.OLE32(?,?,00000027), ref: 004BA06B

Strings

Failed to append bundle id on to temp path for working folder., xrefs: 004BA0B7
Failed to get temp path for working folder., xrefs: 004BA036
c:\agent\_work\36\s\wix\src\burn\engine\cache.cpp, xrefs: 004B9FA3, 004BA02C, 004BA080
Failed to ensure windows path for working folder ended in backslash., xrefs: 004B9FD2
Temp\, xrefs: 004B9FD9
Failed to get windows path for working folder., xrefs: 004B9FAD
Failed to convert working folder guid into string., xrefs: 004BA08A
%ls%ls\, xrefs: 004BA09F
Failed to create working folder guid., xrefs: 004BA054
Failed to concat Temp directory on windows path for working folder., xrefs: 004B9FF1
Failed to copy working folder path., xrefs: 004BA0E5

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorLast$Process$CloseCreateCurrentDirectoryFromHandleOpenPathStringTempTokenUuidWindows
String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$c:\agent\_work\36\s\wix\src\burn\engine\cache.cpp
API String ID: 2129574491-2527715341
Opcode ID: 804e7ef2f75390ee5afface7ced6d8d455d59a565ca6d17e5d46a647c436a669
Instruction ID: 326023b88af6c55ce60444618838752c6c45aa1186cff9eef6b72a350ebf0869
Opcode Fuzzy Hash: 804e7ef2f75390ee5afface7ced6d8d455d59a565ca6d17e5d46a647c436a669
Instruction Fuzzy Hash: 9051FB72A45328ABDB20AEA5CC49FEE77A8AB10710F104567FF05F7240E67CDD44466E

Function 004C2CCA Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000000), ref: 004C2CEC
CoUninitialize.COMBASE ref: 004C2F67

Strings

c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp, xrefs: 004C2D62, 004C2E89, 004C2ED6, 004C2F15, 004C2F41
Failed to reset begin operation event., xrefs: 004C2F1F
Failed to wait for begin operation event., xrefs: 004C2EE0
<the>.cab, xrefs: 004C2D8C
Invalid operation for this state., xrefs: 004C2F4B
Failed to initialize cabinet.dll., xrefs: 004C2D6E
Failed to extract all files from container, erf: %d:%X:%d, xrefs: 004C2E48
Failed to set operation complete event., xrefs: 004C2E93
Failed to initialize COM., xrefs: 004C2CF8

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp
API String ID: 3442037557-1413192050
Opcode ID: 2b627aae68cfea060c2860c8e3f5aaf6409c9222f4151212feef48fe713601d3
Instruction ID: 4a2ad2e643bea1f5e5861b04c9cc52eff5916a63e8b006cc2e796ef072534a2f
Opcode Fuzzy Hash: 2b627aae68cfea060c2860c8e3f5aaf6409c9222f4151212feef48fe713601d3
Instruction Fuzzy Hash: 43518B3FD44276E7D76056568F45F2B27249B00B21B36066FFE01BB2A0D6EC8D0196EE

Function 004A5FAF Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 157
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,004A6F2C,?,?,00000000,?,?), ref: 004A5FDB
InitializeCriticalSection.KERNEL32(000000D0,?,?,004A6F2C,?,?,00000000,?,?), ref: 004A5FE4
lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,004A6F2C,?,?,00000000,?,?), ref: 004A602A
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,004A6F2C,?,?,00000000,?,?), ref: 004A6034
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,004A6F2C,?,?,00000000,?,?), ref: 004A6048
lstrlenW.KERNEL32(burn.filehandle.attached,?,?,004A6F2C,?,?,00000000,?,?), ref: 004A6058
lstrlenW.KERNEL32(burn.filehandle.self,?,?,004A6F2C,?,?,00000000,?,?), ref: 004A60A8
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,004A6F2C,?,?,00000000,?,?), ref: 004A60B2
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,004A6F2C,?,?,00000000,?,?), ref: 004A60C6
lstrlenW.KERNEL32(burn.filehandle.self,?,?,004A6F2C,?,?,00000000,?,?), ref: 004A60D6

Strings

Missing required parameter for switch: %ls, xrefs: 004A617A
burn.filehandle.attached, xrefs: 004A6025, 004A602D, 004A6032, 004A6033, 004A6053, 004A6175
burn.filehandle.self, xrefs: 004A60A3, 004A60AB, 004A60B0, 004A60B1, 004A60D1, 004A61A1
Failed to initialize engine section., xrefs: 004A613F
c:\agent\_work\36\s\wix\src\burn\engine\engine.cpp, xrefs: 004A616B, 004A6197
Failed to parse file handle: '%ls', xrefs: 004A6158

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\36\s\wix\src\burn\engine\engine.cpp
API String ID: 3039292287-4012780215
Opcode ID: 74290bb1d8e04f17991fe88f37d03e1934376bfac64a4a869158db8f3ede4fcf
Instruction ID: ef9057bbeaa62530184bb92b1ae417d7b4b9b0a68e833357a710c2b375f72600
Opcode Fuzzy Hash: 74290bb1d8e04f17991fe88f37d03e1934376bfac64a4a869158db8f3ede4fcf
Instruction Fuzzy Hash: 41511671A00255BFC7209F6ACC46F9BBB68FB16711F15011BF614D7291DB78A940CBA8

Function 004E76B2 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 152
libraryloadercomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,004E7C60,00000000,?,00000000), ref: 004E76CC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,004CDB3B,?,004A70CB,?,00000000,?), ref: 004E76D8
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 004E7718
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 004E7724
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 004E772F
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 004E7739
CoCreateInstance.OLE32(0050F7E4,00000000,00000001,004EE9F0,?,?,?,?,?,?,?,?,?,?,?,004CDB3B), ref: 004E7774
ExitProcess.KERNEL32 ref: 004E7823

Strings

IsWow64Process, xrefs: 004E7712
c:\agent\_work\36\s\wix\src\libs\dutil\xmlutil.cpp, xrefs: 004E76FC
kernel32.dll, xrefs: 004E76BC
Wow64DisableWow64FsRedirection, xrefs: 004E771E
Wow64EnableWow64FsRedirection, xrefs: 004E7726
Wow64RevertWow64FsRedirection, xrefs: 004E7731
N, xrefs: 004E778E

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$c:\agent\_work\36\s\wix\src\libs\dutil\xmlutil.cpp$kernel32.dll$N
API String ID: 2124981135-1483991932
Opcode ID: c1812363082de238450f5a10c1c1e87c43aa9f8a52d27fb67d1657f1e86eb4c9
Instruction ID: 721a8bc451160ee8f0c0ab90b985cd4c6384566110cb30061c0437cb0a3c17ba
Opcode Fuzzy Hash: c1812363082de238450f5a10c1c1e87c43aa9f8a52d27fb67d1657f1e86eb4c9
Instruction Fuzzy Hash: 1D41D635A04395ABDB24DFA6C844F6E7BA4FF04722F11446AE901EB390D778ED01C798

Function 004ADF8F Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 131fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,004AE17F,004A70CB,?,?,004A710B), ref: 004ADFD6
GetLastError.KERNEL32(?,004AE17F,004A70CB,?,?,004A710B,004A710B,00000000,?,00000000), ref: 004ADFE7
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,004AE17F,004A70CB,?,?,004A710B,004A710B,00000000,?), ref: 004AE036
GetCurrentProcess.KERNEL32(000000FF,00000000,?,004AE17F,004A70CB,?,?,004A710B,004A710B,00000000,?,00000000), ref: 004AE03C
DuplicateHandle.KERNELBASE(00000000,?,004AE17F,004A70CB,?,?,004A710B,004A710B,00000000,?,00000000), ref: 004AE03F
GetLastError.KERNEL32(?,004AE17F,004A70CB,?,?,004A710B,004A710B,00000000,?,00000000), ref: 004AE049
SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,004AE17F,004A70CB,?,?,004A710B,004A710B,00000000,?,00000000), ref: 004AE09B
GetLastError.KERNEL32(?,004AE17F,004A70CB,?,?,004A710B,004A710B,00000000,?,00000000), ref: 004AE0A5

Strings

feclient.dll, xrefs: 004AE098
Failed to open file: %ls, xrefs: 004AE018
Failed to open container., xrefs: 004AE0F1
c:\agent\_work\36\s\wix\src\burn\engine\container.cpp, xrefs: 004AE00B, 004AE06D, 004AE0C9
Failed to move file pointer to container offset., xrefs: 004AE0D3
crypt32.dll, xrefs: 004AE097
Failed to duplicate handle to container: %ls, xrefs: 004AE07A

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$c:\agent\_work\36\s\wix\src\burn\engine\container.cpp$crypt32.dll$feclient.dll
API String ID: 2619879409-4081371799
Opcode ID: 90953d30505765601fe85f7db2b605dbbcf82e4f990b68f3c0fbc51d18e6f28a
Instruction ID: 828c1e0f0bd879de55d2bbedf51ed483e3567d98bd9fd289cca0251e1e7f1363
Opcode Fuzzy Hash: 90953d30505765601fe85f7db2b605dbbcf82e4f990b68f3c0fbc51d18e6f28a
Instruction Fuzzy Hash: E9411832144261ABD7209F1BCD85F177BA5EBE5720F21411AFE24DF392DAB9DC018B68

Function 004E715D Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 004A13CA: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004A1409
Part of subcall function 004A13CA: GetLastError.KERNEL32(?,?), ref: 004A1413

Part of subcall function 004A4143: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 004A4174

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 004E71A7
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 004E71C7
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 004E71E7
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 004E7207
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 004E7227
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 004E7247
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 004E7267

Strings

MsiGetPatchInfoExW, xrefs: 004E71FC
MsiDeterminePatchSequenceW, xrefs: 004E719C
MsiSourceListAddSourceExW, xrefs: 004E725C
MsiSetExternalUIRecord, xrefs: 004E723C
MsiDetermineApplicablePatchesW, xrefs: 004E71BC
MsiGetProductInfoExW, xrefs: 004E721C
Msi.dll, xrefs: 004E716F
MsiEnumProductsExW, xrefs: 004E71DC

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: f9cdfc0e1fa18177797cdfbf835ad584a520777d80d88e9559ddb19e1ab3a947
Instruction ID: 20c1a619fc63ad48c2def1f45108952628a1a3d4a232b7db3a8541db45670a08
Opcode Fuzzy Hash: f9cdfc0e1fa18177797cdfbf835ad584a520777d80d88e9559ddb19e1ab3a947
Instruction Fuzzy Hash: D931F875944345EEDB229F61EC15B2E7AE4F761719F00003AE00096AB1E3BA084AEF97

Function 004C330D Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,004AE0EB,?,00000000,?,004AE17F), ref: 004C3344
GetLastError.KERNEL32(?,004AE0EB,?,00000000,?,004AE17F,004A70CB,?,?,004A710B,004A710B,00000000,?,00000000), ref: 004C334D

Strings

c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp, xrefs: 004C3371, 004C33B7, 004C3403
wininet.dll, xrefs: 004C3323
Failed to create begin operation event., xrefs: 004C337B
Failed to copy file name., xrefs: 004C332F
Failed to create extraction thread., xrefs: 004C340D
Failed to create operation complete event., xrefs: 004C33C1
Failed to wait for operation complete., xrefs: 004C3420

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp$wininet.dll
API String ID: 545576003-498445066
Opcode ID: c66bcc5a2206f640b2cb9107fc2457d53ee9a6dfe80022e629030420e5894482
Instruction ID: 1b2227922bb395fb8332a8469b335e5be443e2f0cb2a505a150fdd1a4df4e1d8
Opcode Fuzzy Hash: c66bcc5a2206f640b2cb9107fc2457d53ee9a6dfe80022e629030420e5894482
Instruction Fuzzy Hash: 83214B7794077A7AE2211D564C45F3B655CEB00BA6B01822FFE00BB251EAACCD0045FD

Function 004E4E59 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 004E4E81
GetProcAddress.KERNEL32(SystemFunction041), ref: 004E4E93
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 004E4ED6
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 004E4EEA
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 004E4F22
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 004E4F36

Strings

c:\agent\_work\36\s\wix\src\libs\dutil\cryputil.cpp, xrefs: 004E4F0B
CryptUnprotectMemory, xrefs: 004E4F17
SystemFunction040, xrefs: 004E4E76
CryptProtectMemory, xrefs: 004E4ECB
Crypt32.dll, xrefs: 004E4EB7
AdvApi32.dll, xrefs: 004E4E60
SystemFunction041, xrefs: 004E4E83

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$c:\agent\_work\36\s\wix\src\libs\dutil\cryputil.cpp
API String ID: 4214558900-626015102
Opcode ID: 10792a8c57d8d0e3f9f5c5bfa88dd0e39376491566647710717782030b353a21
Instruction ID: 6a1cbb38d9eec7e80e512bf366bdb221cfb86fc2f9142fb683f4fa3914c49193
Opcode Fuzzy Hash: 10792a8c57d8d0e3f9f5c5bfa88dd0e39376491566647710717782030b353a21
Instruction Fuzzy Hash: D321B33294127167CB315717AC49B1F7FD0EBA0B52F010136ED00BA6A1E7789C05ABCA

Function 004C249B Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 004C24CB
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 004C24E3
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 004C24E8
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 004C24EB
GetLastError.KERNEL32(?,?), ref: 004C24F5
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 004C2564
GetLastError.KERNEL32(?,?), ref: 004C2571

Strings

c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp, xrefs: 004C2519, 004C2595
<the>.cab, xrefs: 004C24C4
Failed to add virtual file pointer for cab container., xrefs: 004C254A
Failed to duplicate handle to cab container., xrefs: 004C2523
Failed to open cabinet file: %hs, xrefs: 004C25A2

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp
API String ID: 3030546534-2422751550
Opcode ID: df9b3653b836f7aa13c1e6ef1238ced82312fb1107664f5a4f81833ce28c8581
Instruction ID: fa333400fb63c57398881db8d244a2eb91162c279d72930e511af33169639a1a
Opcode Fuzzy Hash: df9b3653b836f7aa13c1e6ef1238ced82312fb1107664f5a4f81833ce28c8581
Instruction Fuzzy Hash: B931F53A941639BBD7215B568D49F9B7E68EF04761F11012AFE00BB250D6F8ED008AEC

Function 004B868D Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000000FF,00000000,00000001,00000002,?,00000000,?,?,004A6ADB,?,?), ref: 004B86AD
GetCurrentProcess.KERNEL32(?,00000000,?,?,004A6ADB,?,?), ref: 004B86B3
DuplicateHandle.KERNELBASE(00000000,?,?,004A6ADB,?,?), ref: 004B86B6
GetLastError.KERNEL32(?,?,004A6ADB,?,?), ref: 004B86C0
CloseHandle.KERNEL32(000000FF,?,004A6ADB,?,?), ref: 004B8739

Strings

c:\agent\_work\36\s\wix\src\burn\engine\core.cpp, xrefs: 004B86E4
burn.filehandle.attached, xrefs: 004B8706
Failed to append the file handle to the command line., xrefs: 004B8721
Failed to duplicate file handle for attached container., xrefs: 004B86EE
%ls -%ls=%u, xrefs: 004B870D

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CurrentHandleProcess$CloseDuplicateErrorLast
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to duplicate file handle for attached container.$burn.filehandle.attached$c:\agent\_work\36\s\wix\src\burn\engine\core.cpp
API String ID: 4224961946-423936899
Opcode ID: c648540783cb1f56e631ae1a5ce23ab71276887080b1e807e0f7dac63ac50820
Instruction ID: d5c5f635a24f3a3e57fd83107ea39bce4421d48efee6ed42b9c2a126125450cf
Opcode Fuzzy Hash: c648540783cb1f56e631ae1a5ce23ab71276887080b1e807e0f7dac63ac50820
Instruction Fuzzy Hash: A811B732940225B7C7109BA58C45E9FBB6C9F15774F20025AF910EB2D1DA789E01D7A8

Function 004E5A1F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?,004A7083,00000000,?,?,?,?,?,?,?,004B92DE,00000000), ref: 004E5A3D
GetLastError.KERNEL32(?,?,?,?,?,?,?,004B92DE,00000000), ref: 004E5A47
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,004B92DE,00000000), ref: 004E5A79
GetLastError.KERNEL32(?,?,?,?,?,?,?,004B92DE,00000000), ref: 004E5A92
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,004B92DE,00000000), ref: 004E5AD1

Strings

c:\agent\_work\36\s\wix\src\libs\dutil\procutil.cpp, xrefs: 004E5ABF

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorLastToken$CloseHandleInformationOpenProcess
String ID: c:\agent\_work\36\s\wix\src\libs\dutil\procutil.cpp
API String ID: 4040495316-3104418550
Opcode ID: 1b6f0910b85af3c2e4e205b8a6dcde918d533007004555990eeb0108395c1895
Instruction ID: d3c900eead35effb851790798ba1679b20e1d306be6c9d59a14223063b638ff0
Opcode Fuzzy Hash: 1b6f0910b85af3c2e4e205b8a6dcde918d533007004555990eeb0108395c1895
Instruction Fuzzy Hash: B821F936D00675EBC7209F968884AAEBBB8EF50715F054277ED05FB250E2748E00DBD5

Function 004B8747 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000005,?,00000003,00000080,00000000,?,00000000,?,?,?), ref: 004B877B
CloseHandle.KERNEL32(00000000), ref: 004B87EB

Strings

burn.filehandle.self, xrefs: 004B878C, 004B87BE
Failed to append the file handle to the command line., xrefs: 004B87A7
%ls -%ls=%u, xrefs: 004B8793, 004B87C5
Failed to append the file handle to the obfuscated command line., xrefs: 004B87D9

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to append the file handle to the obfuscated command line.$burn.filehandle.self
API String ID: 3498533004-3263533295
Opcode ID: dbe5637ba30812724ac6567e74dd70ea0b25c8eb314febfba4a4fa89d7362869
Instruction ID: 28a0664cc4c911d61ee3bbce4e609f1bc71eab7fb8cda47c2c77e1580e5a2a29
Opcode Fuzzy Hash: dbe5637ba30812724ac6567e74dd70ea0b25c8eb314febfba4a4fa89d7362869
Instruction Fuzzy Hash: 6311CB31A402647BCB215A5A8C45F9B7A6CAB41B79F20021BFD20EB2D1DEB89511C76D

Function 004E5C34 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 53synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,004A6BE6,?,000000FF,?,?,?,?,?,00000000,?,?,?), ref: 004E5C40
GetLastError.KERNEL32(?,004A6BE6,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 004E5C4E
GetExitCodeProcess.KERNELBASE(000000FF,?), ref: 004E5C93
GetLastError.KERNEL32(?,004A6BE6,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 004E5C9D

Strings

c:\agent\_work\36\s\wix\src\libs\dutil\procutil.cpp, xrefs: 004E5C72
kJ, xrefs: 004E5CC3

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectProcessSingleWait
String ID: c:\agent\_work\36\s\wix\src\libs\dutil\procutil.cpp$kJ
API String ID: 590199018-1362585798
Opcode ID: 078eb4be8a68c16b852266c9ed3540ab5873b11dd60a1c1d96cec894897539da
Instruction ID: 2f4a12982ebe23420ed08efa7f3d9db28def850bebeaad32e74159a58259bdce
Opcode Fuzzy Hash: 078eb4be8a68c16b852266c9ed3540ab5873b11dd60a1c1d96cec894897539da
Instruction Fuzzy Hash: 9201A137940B75A7D7204FA28C58A9A7B64EF04B66F214262FE15AF390D2388C0086DE

Function 004A4143 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 004A4174
GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 004A41A1
GetLastError.KERNEL32(?,00000000,?,00000000), ref: 004A41CD
GetLastError.KERNEL32(00000000,004EE564,?,00000000,?,00000000,?,00000000), ref: 004A420B
GlobalFree.KERNEL32(00000000), ref: 004A423C

Strings

c:\agent\_work\36\s\wix\src\libs\dutil\fileutil.cpp, xrefs: 004A418F, 004A41E8

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: c:\agent\_work\36\s\wix\src\libs\dutil\fileutil.cpp
API String ID: 1145190524-1339450348
Opcode ID: 1671a6ca53cb100377567dd4653f44f84fb772a150942df643c16edd899d1774
Instruction ID: 988fc704d8cd99e2bd5f7cb01cdb90b6015ba959226c7d829158466ead75755d
Opcode Fuzzy Hash: 1671a6ca53cb100377567dd4653f44f84fb772a150942df643c16edd899d1774
Instruction Fuzzy Hash: 4C312B37900235ABC7218A968C05FAFBAA4EFF5390F114267FD04E7341E678DD0086E9

Function 004C2656 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 004C26FC
GetLastError.KERNEL32(?,?,?), ref: 004C2706

Strings

c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp, xrefs: 004C272A
Invalid seek type., xrefs: 004C2692
Failed to move file pointer 0x%x bytes., xrefs: 004C2737

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp
API String ID: 2976181284-2134847726
Opcode ID: 523edee96389d1a3b78a2198e5fbe453795108eacad2a3e37b0c144eaddcfef2
Instruction ID: 36567fa0854c3f23c07cb3510e608217788a2746b5998cd1f94f9254124db8db
Opcode Fuzzy Hash: 523edee96389d1a3b78a2198e5fbe453795108eacad2a3e37b0c144eaddcfef2
Instruction Fuzzy Hash: DB31A379A0151AFFCB04CF99CD85E69B7A4FF04314B10811AF91497350D7B8ED108BA8

Function 004A1B27 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000000,004A7083,00000000,00000000,?,004BBDBF,00000000,00000000,?,00000000,840F01E8,004A7083,00000000,004A714F,840F01E8), ref: 004A1B35
GetLastError.KERNEL32(?,004BBDBF,00000000,00000000,?,00000000,840F01E8,004A7083,00000000,004A714F,840F01E8), ref: 004A1B43
CreateDirectoryW.KERNEL32(00000000,004A7083,00000000,?,004BBDBF,00000000,00000000,?,00000000,840F01E8,004A7083,00000000,004A714F,840F01E8), ref: 004A1BB3
GetLastError.KERNEL32(?,004BBDBF,00000000,00000000,?,00000000,840F01E8,004A7083,00000000,004A714F,840F01E8), ref: 004A1BBD

Strings

c:\agent\_work\36\s\wix\src\libs\dutil\dirutil.cpp, xrefs: 004A1BED

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: c:\agent\_work\36\s\wix\src\libs\dutil\dirutil.cpp
API String ID: 1375471231-3208742346
Opcode ID: bba0ee44fb88e269ebfda003097c95fee9268267edf23d05793f7bff6e5ab8cd
Instruction ID: e4f9a6ae8a45b1a791862f67490444042412a92cca829f23d4d055a817cf4822
Opcode Fuzzy Hash: bba0ee44fb88e269ebfda003097c95fee9268267edf23d05793f7bff6e5ab8cd
Instruction Fuzzy Hash: 7421D73664027197DB211AA64844B3BA654AB77B60F114027FD45AF2B0F62CEC4192F9

Function 004E7BBC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004E7BCB
CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,0050F7E4,00000001,00000000,004A6FB9,?,?,?,?,?,?), ref: 004E7C03
CLSIDFromProgID.OLE32(MSXML.DOMDocument,0050F7E4,?,?,?,?,?,?), ref: 004E7C0F

Strings

MSXML.DOMDocument, xrefs: 004E7C0A
Msxml2.DOMDocument, xrefs: 004E7BFE

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: FromProg$Initialize
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 4047641309-2356320334
Opcode ID: fb283f48477376dd221a4b742f682b110ab277cdd5b67cf5d81b759aa161e7d8
Instruction ID: 8c184b1702e0053756f7ead63ec0e0cd9b7697e3bfbf9d47fa273876e964d007
Opcode Fuzzy Hash: fb283f48477376dd221a4b742f682b110ab277cdd5b67cf5d81b759aa161e7d8
Instruction Fuzzy Hash: 7CF0A7207483B66BD3210B676C45F0B2EA8E791BB6F300437E901D7550D2549CC68BA5

Function 004C25C1 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004C2FDB: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,004C25F0,?,?,?), ref: 004C3003
Part of subcall function 004C2FDB: GetLastError.KERNEL32(?,004C25F0,?,?,?), ref: 004C300D

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 004C25FE
GetLastError.KERNEL32 ref: 004C2608

Strings

c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp, xrefs: 004C262C
Failed to read during cabinet extraction., xrefs: 004C2636

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp
API String ID: 2170121939-1889023893
Opcode ID: 0aa633f4b613f540f719d7967b423769245589a7b5b3efe7268354ed00cb845f
Instruction ID: 221ba1a1473d23fbf8e64944ffa695291db380cc8a1af95780436bedcbdfbf4a
Opcode Fuzzy Hash: 0aa633f4b613f540f719d7967b423769245589a7b5b3efe7268354ed00cb845f
Instruction Fuzzy Hash: B501E536A00269ABCB119F55DD05E8A7BA8FF04764F11011AFD04A7250D7B4D9109BE8

Function 004C2FDB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,004C25F0,?,?,?), ref: 004C3003
GetLastError.KERNEL32(?,004C25F0,?,?,?), ref: 004C300D

Strings

c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp, xrefs: 004C3031
Failed to move to virtual file pointer., xrefs: 004C303B

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp
API String ID: 2976181284-1638580159
Opcode ID: 9ef32bc5d3a8332eba6e5efa1148c08744cfdd74aa4c8bfadd2d1e3c72b5483c
Instruction ID: 8f93052ba5620c5a3f5b0fedefcc395930b5ee3e6ec5bf742e0bccb4f33ae981
Opcode Fuzzy Hash: 9ef32bc5d3a8332eba6e5efa1148c08744cfdd74aa4c8bfadd2d1e3c72b5483c
Instruction Fuzzy Hash: B701D43750063AB787215A879C05F57FA24EF00BB2B11C12EFD186A210DB2A9D1086DC

Function 004A35C3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 004A3659
GetLastError.KERNEL32 ref: 004A36BC

Strings

c:\agent\_work\36\s\wix\src\libs\dutil\fileutil.cpp, xrefs: 004A36E0

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: c:\agent\_work\36\s\wix\src\libs\dutil\fileutil.cpp
API String ID: 1948546556-1339450348
Opcode ID: 2d227f48aa923d4b44a425b4bc0886a232904253dbf797fbc711b9a90cd76de1
Instruction ID: b50457d04706634a666daf3881b6b838726c1ec7f471407b8b96e3257b6c1b81
Opcode Fuzzy Hash: 2d227f48aa923d4b44a425b4bc0886a232904253dbf797fbc711b9a90cd76de1
Instruction Fuzzy Hash: 40319271E00269ABDB318F15C8507DE77A4AB25752F0040ABF944D7340E6B8DEC48E98

Function 004A6DE9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,004A1175,?,?,00000000), ref: 004A6E08
CompareStringW.KERNELBASE(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,004A1175,?,?,00000000), ref: 004A6E38

Strings

burn.clean.room, xrefs: 004A6DF5, 004A6E02, 004A6E2F

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: d8306bb4d4236386b75f7273f4a6f086bd62511988177797c3be101c3e177e99
Instruction ID: e31ea68063424587a4a0aec78dfafb4d030a48b0f92893439a3cb8ba27ac3d3f
Opcode Fuzzy Hash: d8306bb4d4236386b75f7273f4a6f086bd62511988177797c3be101c3e177e99
Instruction Fuzzy Hash: BE01D675500224AAE2244B59EC89D37BB6DE73EB50725452BF556C3610C3349C90DBA4

Function 004A450A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,?,004A3680,?,?,?), ref: 004A452E
GetLastError.KERNEL32(?,?,004A3680,?,?,?), ref: 004A4538

Strings

c:\agent\_work\36\s\wix\src\libs\dutil\fileutil.cpp, xrefs: 004A4561

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: c:\agent\_work\36\s\wix\src\libs\dutil\fileutil.cpp
API String ID: 442123175-1339450348
Opcode ID: 0fe72399d88c65c5cb60fa1a2ae893e833a24e4860bc616eec2ac3841123801b
Instruction ID: b5d114d93bb0a5c32f5a41c306c9a30564b93d8ef6496dddc67d65f739bf3d10
Opcode Fuzzy Hash: 0fe72399d88c65c5cb60fa1a2ae893e833a24e4860bc616eec2ac3841123801b
Instruction Fuzzy Hash: 12F06D33A00138BBC7119E9ACD45E9FBB6DABA5752B010126FA04EB140D674EE0086E9

Function 004A4E3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,004A114E,?,00000000), ref: 004A4E5B
GetLastError.KERNEL32(?,?,?,?,004A114E,?,00000000), ref: 004A4E72

Strings

c:\agent\_work\36\s\wix\src\libs\dutil\pathutil.cpp, xrefs: 004A4E96

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: c:\agent\_work\36\s\wix\src\libs\dutil\pathutil.cpp
API String ID: 2776309574-3540446462
Opcode ID: 752718261abf0629dc3a8cb7a634cd0bb312854c1fe8771475cffb8c0993bb1f
Instruction ID: c6c24991d05f2503a3f002a0691d56f44f2d85bcd8ee9af4a812cf1398df526f
Opcode Fuzzy Hash: 752718261abf0629dc3a8cb7a634cd0bb312854c1fe8771475cffb8c0993bb1f
Instruction Fuzzy Hash: D6F0C273A001306787215A9BAC48A4FFA5DBBE2B70B520123FE44AB251D7B9DC0082E8

Function 004A1070 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 004A10DA

Part of subcall function 004A1C00: GetFileAttributesW.KERNELBASE(?,00000000,?,004A109F,?,00000000), ref: 004A1C09

Part of subcall function 004A3B2C: FindFirstFileW.KERNELBASE(?,?,?,00000000), ref: 004A3B67
Part of subcall function 004A3B2C: FindClose.KERNEL32(00000000,?,00000000), ref: 004A3B73

Strings

Comctl32.dll, xrefs: 004A10B5
%ls.local, xrefs: 004A107E

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: FileFind$AttributesCloseExitFirstProcess
String ID: %ls.local$Comctl32.dll
API String ID: 3456499317-3877841543
Opcode ID: 84502b1672764ccad6bf9139bc324548d9e55e2605d2f198a2bd33b117e0bb4b
Instruction ID: 151ccb3d0c7020611ce048c76786701b747506eb64530e9069bc2e8ae1c4cfb1
Opcode Fuzzy Hash: 84502b1672764ccad6bf9139bc324548d9e55e2605d2f198a2bd33b117e0bb4b
Instruction Fuzzy Hash: F0F03170504159BADB20AB93CD0AEDF7E799F227A8F100166B800A1421F7789B50D669

Function 004A3FE8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,004BA3CE,00000000,00000000,00000000,00000000,00000000), ref: 004A4000
GetLastError.KERNEL32(?,?,?,004BA3CE,00000000,00000000,00000000,00000000,00000000), ref: 004A400A

Strings

c:\agent\_work\36\s\wix\src\libs\dutil\fileutil.cpp, xrefs: 004A402E

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: c:\agent\_work\36\s\wix\src\libs\dutil\fileutil.cpp
API String ID: 2976181284-1339450348
Opcode ID: 6b4f4ced1a93926cd2fd192bd451ab8e74f81d8e6b36604a083ce8585e0d1dd3
Instruction ID: dd41cd70231f0042c390b5d76cdc5cab2a9479f5d2279524cf55ba30f968ab90
Opcode Fuzzy Hash: 6b4f4ced1a93926cd2fd192bd451ab8e74f81d8e6b36604a083ce8585e0d1dd3
Instruction Fuzzy Hash: 3FF0A476604129EB9B108F85DD09D9F7FA8EF96750B024129FE04AF251E275DC10EBE8

Function 004A13CA Relevance: 4.6, APIs: 3, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004A1409
GetLastError.KERNEL32(?,?), ref: 004A1413
LoadLibraryW.KERNELBASE(?,?,00000104,?,?,?), ref: 004A147C

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID:
API String ID: 1230559179-0
Opcode ID: 7a2b1b35d28c527bc3f0bcd2cca2d004df36bd017b5054778a936958f3f73b22
Instruction ID: 7a57fab8c708821b1400a8d449ea5f38e66571403fb6ff19fe54d933d2162196
Opcode Fuzzy Hash: 7a2b1b35d28c527bc3f0bcd2cca2d004df36bd017b5054778a936958f3f73b22
Instruction Fuzzy Hash: CC219AB6D013396BC7208B698C48F9F77ACAB15724F510167FE04EB251E638DD408BA8

Function 004A51AE Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,004E5465,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,004E53F9,000001C7), ref: 004A51B8
RtlFreeHeap.NTDLL(00000000,?,004E5465,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,004E53F9,000001C7,?,?), ref: 004A51BF
GetLastError.KERNEL32(?,004E5465,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,004E53F9,000001C7,?,?), ref: 004A51C9

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: cbd4a0a9003654b37a50c0af04a030245888a828c4bee47c6c96a9b936957659
Instruction ID: a452c8eb5f2067b9153f0ff010e4ba0da375de45fda96c6221dc47f72a10a112
Opcode Fuzzy Hash: cbd4a0a9003654b37a50c0af04a030245888a828c4bee47c6c96a9b936957659
Instruction Fuzzy Hash: 12D0127390053567862117E75D4CA67BE58EF156A27014231FD48DA211D635CC4096E9

Function 004D9896 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(004D99A9,?,004D9890,00000000,?,?,004D99A9,C35F1C0A,?,004D99A9), ref: 004D98A7
TerminateProcess.KERNEL32(00000000,?,004D9890,00000000,?,?,004D99A9,C35F1C0A,?,004D99A9), ref: 004D98AE
ExitProcess.KERNEL32 ref: 004D98C0

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 76165c1524a9c41f708f6f9d92aaea5566d539cc02c476200809845c93c0ceec
Instruction ID: ad3c4961a001f90e03089a6995a683c1f5ea8aebcae0ca38bc79d32d3790d0e8
Opcode Fuzzy Hash: 76165c1524a9c41f708f6f9d92aaea5566d539cc02c476200809845c93c0ceec
Instruction Fuzzy Hash: B1D05E31010144AFCF003F62DC5E8493F29AF017447004032B9058A232DB769C91EA88

Function 004A582C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0050EBD4,00000000,?,004E8E2A,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 004A5840

Strings

c:\agent\_work\36\s\wix\src\libs\dutil\regutil.cpp, xrefs: 004A587D

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: Open
String ID: c:\agent\_work\36\s\wix\src\libs\dutil\regutil.cpp
API String ID: 71445658-90795250
Opcode ID: 6fbf75bc7b987c650e7f653027e510b0587e703ea893c7d2b5f6631fc9bd1f86
Instruction ID: 11d007eaff07553e3b081e32b63059832b6edeb2ef84dd3da1890f83cfbef9a0
Opcode Fuzzy Hash: 6fbf75bc7b987c650e7f653027e510b0587e703ea893c7d2b5f6631fc9bd1f86
Instruction Fuzzy Hash: D2F02432A00625A78B3129578E05F6B7D45DB627F0F19802FBD09DB320E52DCC20D7E8

Function 004E4651 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004E4648

Part of subcall function 004CFE24: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004CFE97
Part of subcall function 004CFE24: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004CFEA8

Strings

dP, xrefs: 004E4651

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: dP
API String ID: 1269201914-3498987474
Opcode ID: 5ad0e01e1e93eb5c774ddce1a7b12ed15773657862dfa2d54ba443242e494c48
Instruction ID: 570dd403bf071b1a871b555184ad7140a8bd857ebaef50e55ddfb9489b2fb910
Opcode Fuzzy Hash: 5ad0e01e1e93eb5c774ddce1a7b12ed15773657862dfa2d54ba443242e494c48
Instruction Fuzzy Hash: 20B012C53D8201AE764451563E47D3F068CF3CAB12330452FB000C51C2E44C0C060037

Function 004E4661 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004E4648

Part of subcall function 004CFE24: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004CFE97
Part of subcall function 004CFE24: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004CFEA8

Strings

lP, xrefs: 004E4661

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: lP
API String ID: 1269201914-3774743571
Opcode ID: e3f6c9c04716daf8ddd75b4cb2355399e0bff023e4ed28706a953de42f380899
Instruction ID: b4037d021549ba2acf07ef5a359bea947bd510b8c737343c8a01ad185e2b58e3
Opcode Fuzzy Hash: e3f6c9c04716daf8ddd75b4cb2355399e0bff023e4ed28706a953de42f380899
Instruction Fuzzy Hash: 22B012C53E8101AE764451562D47D3F468CF3C6B22330852FB440C51C2E44C0C050036

Function 004E4630 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004E4648

Part of subcall function 004CFE24: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004CFE97
Part of subcall function 004CFE24: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004CFEA8

Strings

hP, xrefs: 004E4630

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: hP
API String ID: 1269201914-360620755
Opcode ID: c414e92cf258748a0d688bcc62498088b5bb2f96a65f0db06de88234bdcb5bac
Instruction ID: de29a0e2f1488af3ea9c59e9e1a0666cdb221d240c85c8c3a72c45f3393c8d72
Opcode Fuzzy Hash: c414e92cf258748a0d688bcc62498088b5bb2f96a65f0db06de88234bdcb5bac
Instruction Fuzzy Hash: 3AB012D53D8201BE7A0811532D47D3F064CF3C2B22330462FB000C40C2A44C5C45403E

Function 004CFB44 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004CFB5C

Part of subcall function 004CFE24: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004CFE97
Part of subcall function 004CFE24: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004CFEA8

Strings

|P, xrefs: 004CFB44

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: |P
API String ID: 1269201914-2149487505
Opcode ID: d9358aea353aeed5e2bfcef65a471af16040845b477cb56ad0fd005efaaed416
Instruction ID: 491460acbc5940f84a0b4762cfbb2c8a69344d2926961f69f14b6e239d599362
Opcode Fuzzy Hash: d9358aea353aeed5e2bfcef65a471af16040845b477cb56ad0fd005efaaed416
Instruction Fuzzy Hash: 44B012D9368001BE724451419D17E3F464EE3C8B24330853FB400C50C6B54C2C4D203B

Function 004A50E9 Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,004A2D50,?,00000001,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A50FA
RtlAllocateHeap.NTDLL(00000000,?,004A2D50,?,00000001,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A5101

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 7f063cda6af30074a8a640470d853c2292f93fc4cb7edc258ab90b25c00a668e
Instruction ID: 81efd9c81b656431fb477b56118010344edc2d3d2385b0c3df0b8427d25c1add
Opcode Fuzzy Hash: 7f063cda6af30074a8a640470d853c2292f93fc4cb7edc258ab90b25c00a668e
Instruction Fuzzy Hash: FAC08C331A020CEBCF006FF9EC4EC9ABBACEB28602700C520F909CB051D63CE0909B65

Function 004E7C1A Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004E7C4F

Part of subcall function 004E76B2: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,004E7C60,00000000,?,00000000), ref: 004E76CC
Part of subcall function 004E76B2: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,004CDB3B,?,004A70CB,?,00000000,?), ref: 004E76D8

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID:
API String ID: 52713655-0
Opcode ID: 5f5d07cf8b7c34c0e907bf92b2eb9f524a1190b0df003357b065d25f0d2bbd3e
Instruction ID: d30c6c6a0ac7e0c63632b86a00ec07d5e6298e48ba3aeac42f2c7cb4cbacfcbe
Opcode Fuzzy Hash: 5f5d07cf8b7c34c0e907bf92b2eb9f524a1190b0df003357b065d25f0d2bbd3e
Instruction Fuzzy Hash: BC314B76E002699FCB01DFA9D884ADEB7F8EF08720F11456AED05BB311D674AD408BA4

Function 004E8EB5 Relevance: 1.6, APIs: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(80070490,00000000,80070490,0050EBD4,00000000,80070490,?,?,004BA771,WiX\Burn,PackageCache,00000000,0050EBD4,00000000,00000000,80070490), ref: 004E8F0F

Part of subcall function 004A5967: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 004A59DD
Part of subcall function 004A5967: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 004A5A15

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: 02b1eab6f57ecd09bead0d207914b429d1577f41a18b8e6b34a21345471eb07c
Instruction ID: fc2c5773b80e5deea8163cc63e632d43999d68d613c7d57e6953f57ad70628fc
Opcode Fuzzy Hash: 02b1eab6f57ecd09bead0d207914b429d1577f41a18b8e6b34a21345471eb07c
Instruction Fuzzy Hash: 4F112532C001A5EFCF21AF9ACD809AFB67AEB1136AB10017FED4567211CA394E50D7D8

Function 004A4F1E Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,004BA82B,0000001C,80070490,00000000,00000000,80070490), ref: 004A4F3E

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: cfd996ac51aa1c630781ae6bba9de936378b7e18a02dc954872288d509808306
Instruction ID: 94fbbfbc3b78ca4efd8782fbb8ef7dcc471619d2e89a96cccae91fcb3fc4bfb0
Opcode Fuzzy Hash: cfd996ac51aa1c630781ae6bba9de936378b7e18a02dc954872288d509808306
Instruction Fuzzy Hash: 9FE0C2B23001283BE7006AA25D00CAF3B4E9FA6354B000026FE00D7001C6A8D90052BC

Function 004A1C00 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00000000,?,004A109F,?,00000000), ref: 004A1C09

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ee0565e17b9844af6bf5826a79e79d36ea2a7eb4e808053eb534a8bc4a210129
Instruction ID: 37e8bd9ecd3e299bb8f3ef7a1ffadd771f1ca6aeff340295dddf28b043452971
Opcode Fuzzy Hash: ee0565e17b9844af6bf5826a79e79d36ea2a7eb4e808053eb534a8bc4a210129
Instruction Fuzzy Hash: 68D05B31241124574B287EA998045A7BB55DF13771B454616ED55CF3B1C3355C12C7C4

Function 004E7563 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(00000000,00000000,004A7234,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004E7570

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 03b7f8b5fca027b7e046e8ca7c8139809d0f7125266032d61688f61e1e0f6969
Instruction ID: a0d337a0333451b67f4e5b40013e7f1d79ed5f92e67e3ebc900e4c99f50d9cc0
Opcode Fuzzy Hash: 03b7f8b5fca027b7e046e8ca7c8139809d0f7125266032d61688f61e1e0f6969
Instruction Fuzzy Hash: 8AE053B28252208AC3608F59B850A497BA8F329E44380102FE400C2A25C3B04489AFD2

Function 004CFB65 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004CFB5C

Part of subcall function 004CFE24: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004CFE97
Part of subcall function 004CFE24: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004CFEA8

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2873c11518f736be1842bcac7e3eb336c9c48175a379930107725e55cef215bd
Instruction ID: 385f7be90bbc0a9239adf498546535147244468bf71d68b8abdc93b5b2632158
Opcode Fuzzy Hash: 2873c11518f736be1842bcac7e3eb336c9c48175a379930107725e55cef215bd
Instruction Fuzzy Hash: 7CB012D9358002AE728451855E17F3F098DE2C8B10330443FB000C61C6F54C2C4E6037

Function 004CFB75 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004CFB5C

Part of subcall function 004CFE24: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004CFE97
Part of subcall function 004CFE24: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004CFEA8

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1b522df5f564688add57cac7424fc93bd2f5794f44001870860a6684ec14e48f
Instruction ID: 5fb1fa9ca37af68e86c22c625b5cc0258f7e6954f1cde748bdfb1b97bc53a6e5
Opcode Fuzzy Hash: 1b522df5f564688add57cac7424fc93bd2f5794f44001870860a6684ec14e48f
Instruction Fuzzy Hash: 9DB09299258001AE728451855956E3A0589E284B10330482FB001C6186A54C2C4D6036

Function 004A1EF9 Relevance: 1.3, APIs: 1, Instructions: 52stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,?,004A2C85,?,?,004A149E,00000000,?,004A149E,?,?,00000104), ref: 004A1F29

Part of subcall function 004A5369: GetProcessHeap.KERNEL32(00000000,000001C7,?,004A2CA9,000001C7,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A5371
Part of subcall function 004A5369: HeapSize.KERNEL32(00000000,?,004A2CA9,000001C7,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A5378

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: f7e081a3d55cb8b4922f18bcaa4d7d6bae36ebebb368a34936c042955fa3fd36
Instruction ID: 3ff644839feef0fdfc6076d8d724aee20bb794acfaebcf36367fcf08d9f31de1
Opcode Fuzzy Hash: f7e081a3d55cb8b4922f18bcaa4d7d6bae36ebebb368a34936c042955fa3fd36
Instruction Fuzzy Hash: D501B536200268BFCF115E15DC40FDB7B59AB677A0F104116FE14AB161C375A85096A8

Non-executed Functions

Function 004A62C2 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 140sleepshutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,00000001,00000000,?,?,?,?,?,?,?), ref: 004A62EB
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 004A62F2
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 004A62FC
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004A634C
GetLastError.KERNEL32 ref: 004A6356
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 004A639A
GetLastError.KERNEL32 ref: 004A63A4
Sleep.KERNEL32(000003E8), ref: 004A63E0
InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,80040002), ref: 004A63F1
GetLastError.KERNEL32 ref: 004A63FB
CloseHandle.KERNEL32(?), ref: 004A6451

Strings

Failed to schedule restart., xrefs: 004A643C
Failed to adjust token to add shutdown privileges., xrefs: 004A63D2
Failed to get process token., xrefs: 004A632A
SeShutdownPrivilege, xrefs: 004A633F
c:\agent\_work\36\s\wix\src\burn\engine\engine.cpp, xrefs: 004A6320, 004A637A, 004A63C8, 004A6432
Failed to get shutdown privilege LUID., xrefs: 004A6384

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorLast$ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSleepSystemValue
String ID: Failed to adjust token to add shutdown privileges.$Failed to get process token.$Failed to get shutdown privilege LUID.$Failed to schedule restart.$SeShutdownPrivilege$c:\agent\_work\36\s\wix\src\burn\engine\engine.cpp
API String ID: 2241679041-3077915282
Opcode ID: 9d7435e8ef79de6dfd788cb13abbc8da5fec05a416ac59569bc6bbf1f91cb76b
Instruction ID: ef76e2539d0948d333947e4aee965751a7267ab04e6256481e0a1a5e17020f93
Opcode Fuzzy Hash: 9d7435e8ef79de6dfd788cb13abbc8da5fec05a416ac59569bc6bbf1f91cb76b
Instruction Fuzzy Hash: D8417D72D40235BBEB104BA68C8AB6F7958AB15751F160537FD01FB281D66C8C0046ED

Function 004E506D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 131threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0050F764,00000000,?,?,?,?,004C2E9E,8007139F,Invalid operation for this state.,c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 004E509B
GetCurrentProcessId.KERNEL32(00000000,?,004C2E9E,8007139F,Invalid operation for this state.,c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 004E50AB
GetCurrentThreadId.KERNEL32 ref: 004E50B4
GetLocalTime.KERNEL32(8007139F,?,004C2E9E,8007139F,Invalid operation for this state.,c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 004E50CA
LeaveCriticalSection.KERNEL32(0050F764,004C2E9E,?,00000000,0000FDE9,?,004C2E9E,8007139F,Invalid operation for this state.,c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 004E51C1

Strings

%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 004E5167
hN, xrefs: 004E5126
hN, xrefs: 004E5135

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls$hN$hN
API String ID: 296830338-100946766
Opcode ID: 4adee0f05df0a8323e8858d425dacc63704b2dd7be6b9eef1b78bbdf7074677a
Instruction ID: 2a8cc6609f02e35f1661c7e3dbef0f2ad4cbdf7b8e5f5b5b2081323be50d1227
Opcode Fuzzy Hash: 4adee0f05df0a8323e8858d425dacc63704b2dd7be6b9eef1b78bbdf7074677a
Instruction Fuzzy Hash: C241B631D00659ABDB219FA6DC44BBFB7B8FB0871AF104126F501E6290D63C9D41D7AA

Function 004DF018 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 004DF1FC

Strings

1#SNAN, xrefs: 004DF124
1#QNAN, xrefs: 004DF12B
1#IND, xrefs: 004DF11D
1#INF, xrefs: 004DF14E

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 4d073a8c5ded35f523d79cf8561afa841d244e3ebee484e2c65ee75de46d96d5
Instruction ID: 0f7f5a39430bfffb4cde184a1d03bd39e49c9fdce9a3c0415f8da78322646a62
Opcode Fuzzy Hash: 4d073a8c5ded35f523d79cf8561afa841d244e3ebee484e2c65ee75de46d96d5
Instruction Fuzzy Hash: 8FD23471E082288BDB25CE29DD907EAB7B5EB45305F1441EBD80EE7340E778AE858F45

Function 004DC2AF Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 004DC34A
FindNextFileW.KERNEL32(00000000,?), ref: 004DC3C5
FindClose.KERNEL32(00000000), ref: 004DC3E7
FindClose.KERNEL32(00000000), ref: 004DC40A

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: a27175b8c612041d3bd2cc5a0fb64a93eaf1ce7b4d3b008d5b3c6d4d393cb01d
Instruction ID: 508655bc84f9b1365a83f149b6395f7406d6a68bf642ef038a68b1a2a6e4e367
Opcode Fuzzy Hash: a27175b8c612041d3bd2cc5a0fb64a93eaf1ce7b4d3b008d5b3c6d4d393cb01d
Instruction Fuzzy Hash: 9541B67190011A9EDB20DFA9DCE89BFB778EB44344F148197E80597385E7389E80CA59

Function 004E406A Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004E4065,?,?,00000008,?,?,004E3C6F,00000000), ref: 004E4297

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: ddd2075fd60269a5ba9c6db66c487ccc0be0c5e5c7777cdb39e61e0eaefbd191
Instruction ID: 0d4ae21dbf10aeadfeb29fdf7396fc9464c4df75bbe7aaa45001f6345e26aa95
Opcode Fuzzy Hash: ddd2075fd60269a5ba9c6db66c487ccc0be0c5e5c7777cdb39e61e0eaefbd191
Instruction Fuzzy Hash: D7B16F31610648CFDB14CF29C48AB657BE0FF85365F258699E999CF3A1C339E982CB44

Function 004D71EE Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 004D737C

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ed656c7afacb20acc0191ba3842063b61b46871a894fabfe83a32ee2b4abac35
Instruction ID: ebec1dff3956675d425d51df8baaaf345238b1979ca7fde8542704be1ea205a9
Opcode Fuzzy Hash: ed656c7afacb20acc0191ba3842063b61b46871a894fabfe83a32ee2b4abac35
Instruction Fuzzy Hash: E2C101306086468FCB25CF68C4B167FBBA1AF05304F24465FE84297392E738ED46CB5A

Function 004D2299 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: c801a1b5c249db299e91aa86d6fe65100d77585493ca606317b267f41af3ef65
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: B99166721090A30ADB2D467A867443FFFE15AB23A130A07AFE8F2CA3C5ED5CD555D624

Function 004AA1A0 Relevance: 59.8, APIs: 5, Strings: 29, Instructions: 331COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004A710B,?,00000000,80070490,?,?,?,?,?,?,?,?,004CDCD5,?,004A710B,?), ref: 004AA1D1
LeaveCriticalSection.KERNEL32(004A710B,?,?,?,?,?,?,?,?,004CDCD5,?,004A710B,?,004A710B,004A710B,Chain), ref: 004AA534

Strings

Hidden, xrefs: 004AA259
Initializing hidden variable '%ls', xrefs: 004AA39B
Failed to get @Hidden., xrefs: 004AA518
Persisted, xrefs: 004AA274
Failed to set variant value., xrefs: 004AA4B5
Failed to get variable node count., xrefs: 004AA20B
Failed to select variable nodes., xrefs: 004AA1EE
Failed to set value of variable: %ls, xrefs: 004AA4D7
Failed to get @Type., xrefs: 004AA4AE
Initializing version variable '%ls' to value '%ls', xrefs: 004AA37D
Failed to get @Id., xrefs: 004AA51F
Initializing numeric variable '%ls' to value '%ls', xrefs: 004AA30C
Type, xrefs: 004AA2CD
Variable, xrefs: 004AA1DB
numeric, xrefs: 004AA2E6
c:\agent\_work\36\s\wix\src\burn\engine\variable.cpp, xrefs: 004AA4E9
Value, xrefs: 004AA28F
Failed to get @Value., xrefs: 004AA4BC
Failed to find variable value '%ls'., xrefs: 004AA502
Failed to get next node., xrefs: 004AA526
version, xrefs: 004AA356
Failed to set variant encryption, xrefs: 004AA4CD
string, xrefs: 004AA321
Invalid value for @Type: %ls, xrefs: 004AA49B
Failed to change variant type., xrefs: 004AA50A
Failed to get @Persisted., xrefs: 004AA511
Initializing string variable '%ls' to value '%ls', xrefs: 004AA344
Failed to insert variable '%ls'., xrefs: 004AA4C6
Attempt to set built-in variable value: %ls, xrefs: 004AA4F8

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Attempt to set built-in variable value: %ls$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant encryption$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$c:\agent\_work\36\s\wix\src\burn\engine\variable.cpp$numeric$string$version
API String ID: 3168844106-3004887034
Opcode ID: ee9a21d397d72c0b5ba7fce3fb5a4d42f444c949a920b2eac0a6c787f677fa70
Instruction ID: 9bf07bf858609a169644109a00664a244a93670afa7a3ea4b33f2b4afb6db260
Opcode Fuzzy Hash: ee9a21d397d72c0b5ba7fce3fb5a4d42f444c949a920b2eac0a6c787f677fa70
Instruction Fuzzy Hash: DBB15832D00259BBCF119B95CC05EAEBB74EF55715F204267F800BA291C77C9A24CB9E

Function 004B7195 Relevance: 45.7, APIs: 17, Strings: 9, Instructions: 228filepipesleepCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,?,?,00000000,75C0B390,?,004A6205,?,004EE500), ref: 004B71B6
GetCurrentProcessId.KERNEL32(?,004A6205,?,004EE500), ref: 004B71C1
SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,004A6205,?,004EE500), ref: 004B71F8
ConnectNamedPipe.KERNEL32(?,00000000,?,004A6205,?,004EE500), ref: 004B720D
GetLastError.KERNEL32(?,004A6205,?,004EE500), ref: 004B7217
Sleep.KERNEL32(00000064,?,004A6205,?,004EE500), ref: 004B724C
SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,004A6205,?,004EE500), ref: 004B726F
WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,004A6205,?,004EE500), ref: 004B728A
WriteFile.KERNEL32(?,004A6205,004EE500,00000000,00000000,?,004A6205,?,004EE500), ref: 004B72A5
WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,004A6205,?,004EE500), ref: 004B72C0
ReadFile.KERNEL32(?,00000000,00000004,00000000,00000000,?,004A6205,?,004EE500), ref: 004B72DB
GetLastError.KERNEL32(?,004A6205,?,004EE500), ref: 004B7336
GetLastError.KERNEL32(?,004A6205,?,004EE500), ref: 004B736A
GetLastError.KERNEL32(?,004A6205,?,004EE500), ref: 004B739E
GetLastError.KERNEL32(?,004A6205,?,004EE500), ref: 004B73D2
GetLastError.KERNEL32(?,004A6205,?,004EE500), ref: 004B7403
GetLastError.KERNEL32(?,004A6205,?,004EE500), ref: 004B7434

Strings

Failed to write secret length to pipe., xrefs: 004B73FC
c:\agent\_work\36\s\wix\src\burn\engine\pipe.cpp, xrefs: 004B7322, 004B7356, 004B738A, 004B73BE, 004B73F2, 004B7423, 004B7454
Failed to reset pipe to blocking., xrefs: 004B742D
Failed to read ACK from pipe., xrefs: 004B7360
Failed to set pipe to non-blocking., xrefs: 004B745E
Failed to write our process id to pipe., xrefs: 004B7394
crypt32.dll, xrefs: 004B7288
Failed to wait for child to connect to pipe., xrefs: 004B732C
Failed to write secret to pipe., xrefs: 004B73C8

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
String ID: Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$c:\agent\_work\36\s\wix\src\burn\engine\pipe.cpp$crypt32.dll
API String ID: 2944378912-1623437160
Opcode ID: c6b7b7f47c5f6c415b6315856d78903e09b4add1b4958a0a771d9c947a57b725
Instruction ID: 04b8060057afa29de043a8f04fae43d7c37cfb67eb3b4996c93685ddebc6be1f
Opcode Fuzzy Hash: c6b7b7f47c5f6c415b6315856d78903e09b4add1b4958a0a771d9c947a57b725
Instruction Fuzzy Hash: 8A61C772D492396BE7209AA58C85BEEB9A86F50711F114167FE00FB281D67CDD008BFD

Function 004AC111 Relevance: 44.1, APIs: 8, Strings: 17, Instructions: 311registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 004AC155
_MREFOpen@16.MSPDB140-MSVCRT ref: 004AC17D
RegCloseKey.ADVAPI32(00000000,?,00000000,?,?,?,?,?), ref: 004AC47C

Strings

Failed to get expand environment string., xrefs: 004AC3EA
Failed to open registry key., xrefs: 004AC1F0
Failed to set variable., xrefs: 004AC43E
Failed to query registry key value size., xrefs: 004AC259
Unsupported registry key value type. Type = '%u', xrefs: 004AC30F
Failed to allocate string buffer., xrefs: 004AC370
Failed to change value type., xrefs: 004AC420, 004AC443
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 004AC21F
c:\agent\_work\36\s\wix\src\burn\engine\search.cpp, xrefs: 004AC24D, 004AC282, 004AC2D5, 004AC3DE
Failed to clear variable., xrefs: 004AC1DB
Failed to format key string., xrefs: 004AC162
Failed to format value string., xrefs: 004AC18A
Failed to allocate memory registry value., xrefs: 004AC28C
Registry key not found. Key = '%ls', xrefs: 004AC1B5
Failed to query registry key value., xrefs: 004AC2E1
RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 004AC454
Failed to read registry value., xrefs: 004AC405

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: Open@16$Close
String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$c:\agent\_work\36\s\wix\src\burn\engine\search.cpp
API String ID: 2348241696-1030985318
Opcode ID: 2291736b0f701acfbbb4f1878e8c6712d6b6eeccffe749168b2dd430ea3fa422
Instruction ID: d1110705b9d2db1ca46696871e29631dcee433bf6682ab7aa47af023b0f5395e
Opcode Fuzzy Hash: 2291736b0f701acfbbb4f1878e8c6712d6b6eeccffe749168b2dd430ea3fa422
Instruction Fuzzy Hash: 56A1D872E00129EBCF519B99C981BBE7AA4AB29714F108127FD01BA251D77D9D008BDD

Function 004B63A0 Relevance: 38.7, APIs: 10, Strings: 12, Instructions: 184fileCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,8000FFFF,feclient.dll,?,004B68B3,004EE4E8,?,feclient.dll,00000000,?,?), ref: 004B63B7
ReadFile.KERNEL32(feclient.dll,feclient.dll,00000004,?,00000000,?,004B68B3,004EE4E8,?,feclient.dll,00000000,?,?), ref: 004B63D8
GetLastError.KERNEL32(?,004B68B3,004EE4E8,?,feclient.dll,00000000,?,?), ref: 004B63DE
ReadFile.KERNEL32(feclient.dll,00000000,004EE518,?,00000000,00000000,004EE519,?,004B68B3,004EE4E8,?,feclient.dll,00000000,?,?), ref: 004B646C
GetLastError.KERNEL32(?,004B68B3,004EE4E8,?,feclient.dll,00000000,?,?), ref: 004B6472

Strings

N, xrefs: 004B64EC, 004B65A3, 004B6535, 004B64EF
Verification secret from parent is too big., xrefs: 004B6439
Failed to read verification secret from parent pipe., xrefs: 004B64A0
Verification secret from parent does not match., xrefs: 004B64DA
Verification process id from parent does not match., xrefs: 004B65BF
c:\agent\_work\36\s\wix\src\burn\engine\pipe.cpp, xrefs: 004B6402, 004B642D, 004B6496, 004B64CE, 004B651B, 004B6575, 004B65B3
feclient.dll, xrefs: 004B63A6, 004B63D6, 004B63D7, 004B646B, 004B64F0, 004B6546
Failed to allocate buffer for verification secret., xrefs: 004B6455
Failed to read verification process id from parent pipe., xrefs: 004B6525
N, xrefs: 004B652C
Failed to inform parent process that child is running., xrefs: 004B657F
Failed to read size of verification secret from parent pipe., xrefs: 004B640C

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorFileLastRead$CurrentProcess
String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$c:\agent\_work\36\s\wix\src\burn\engine\pipe.cpp$feclient.dll$N$N
API String ID: 1233551569-519914097
Opcode ID: 1a4885559bd4fe628c332efb28ace3405b1b7802380b391f09ab30c2a3a9864b
Instruction ID: e42245db1d19cb55e3c5e218926b1f915e879bda5b67771092e68ce09e4fd148
Opcode Fuzzy Hash: 1a4885559bd4fe628c332efb28ace3405b1b7802380b391f09ab30c2a3a9864b
Instruction Fuzzy Hash: 5151D573944629B7DB219A959D45FFFB668AF10B10F22016BFE00BB290D67CDD0086BD

Function 004C43C0 Relevance: 36.9, APIs: 3, Strings: 18, Instructions: 144COMMON

Download Yara Rule

Strings

Protocol, xrefs: 004C4487
burn, xrefs: 004C44A4
InstallArguments, xrefs: 004C43FA
none, xrefs: 004C44FA
DetectCondition, xrefs: 004C43D8
netfx4, xrefs: 004C44D9
Failed to get @DetectCondition., xrefs: 004C43E9
Repairable, xrefs: 004C4460
RepairArguments, xrefs: 004C443E
Failed to parse exit codes., xrefs: 004C44D0
Failed to parse command lines., xrefs: 004C454C
Failed to get @InstallArguments., xrefs: 004C440B
Failed to get @Repairable., xrefs: 004C4479
UninstallArguments, xrefs: 004C441C
Failed to get @RepairArguments., xrefs: 004C444F
Failed to get @UninstallArguments., xrefs: 004C442D
Invalid protocol type: %ls, xrefs: 004C4520
Failed to get @Protocol., xrefs: 004C4538

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: DetectCondition$Failed to get @DetectCondition.$Failed to get @InstallArguments.$Failed to get @Protocol.$Failed to get @RepairArguments.$Failed to get @Repairable.$Failed to get @UninstallArguments.$Failed to parse command lines.$Failed to parse exit codes.$InstallArguments$Invalid protocol type: %ls$Protocol$RepairArguments$Repairable$UninstallArguments$burn$netfx4$none
API String ID: 760788290-1911311241
Opcode ID: eceb8efdf1fa4a54b902ec04caac15b1c5a21f9854eadaaea5a183ae73a48bde
Instruction ID: a6453f2efc58f895f41d9a1f985719807468adc7015da1f70ee0ef73afe7c045
Opcode Fuzzy Hash: eceb8efdf1fa4a54b902ec04caac15b1c5a21f9854eadaaea5a183ae73a48bde
Instruction Fuzzy Hash: 93417A76E8437ABBE75151668D62F7A7958AB50B31F30032BFB20F62D1C76CE900429D

Function 004C0050 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004BFF39: LoadBitmapW.USER32(?,00000001), ref: 004BFF6F
Part of subcall function 004BFF39: GetLastError.KERNEL32 ref: 004BFF7B

LoadCursorW.USER32(00000000,00007F00), ref: 004C00B1
RegisterClassW.USER32(?), ref: 004C00C5
GetLastError.KERNEL32 ref: 004C00D0
UnregisterClassW.USER32(WixBurnSplashScreen,?), ref: 004C01D5
DeleteObject.GDI32(00000000), ref: 004C01E4

Strings

Failed to register window., xrefs: 004C00FE
Failed to load splash screen., xrefs: 004C0089
WixBurnSplashScreen, xrefs: 004C00BE, 004C01D0
Failed to create window., xrefs: 004C0167
c:\agent\_work\36\s\wix\src\burn\engine\splashscreen.cpp, xrefs: 004C00F4, 004C015D
Unexpected return value from message pump., xrefs: 004C01BF

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ClassErrorLastLoad$BitmapCursorDeleteObjectRegisterUnregister
String ID: Failed to create window.$Failed to load splash screen.$Failed to register window.$Unexpected return value from message pump.$WixBurnSplashScreen$c:\agent\_work\36\s\wix\src\burn\engine\splashscreen.cpp
API String ID: 164797020-2801829539
Opcode ID: 5ba8e13c3de69ba42a8052f608ee026dce912f99894f350a04fadcfa9015c891
Instruction ID: 66fb28eb68e655c8faab6187c1808dcd23c48b15ae25d26e8d441248ad25e41e
Opcode Fuzzy Hash: 5ba8e13c3de69ba42a8052f608ee026dce912f99894f350a04fadcfa9015c891
Instruction Fuzzy Hash: 1341C776900269FFEB119BE5DC49FAEF7B9FF04310F10012AFA01AA150DB399D008799

Function 004B1263 Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 151registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,004B21B0,InstallerVersion,InstallerVersion,00000000,004B21B0,InstallerName,InstallerName,00000000,004B21B0,Date,InstalledDate,00000000,004B21B0,LogonUser), ref: 004B1411

Part of subcall function 004A5D90: RegSetValueExW.ADVAPI32(00020006,004F4178,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,004B1017,00000000,?,00020006), ref: 004A5DC3

Strings

Failed to write %ls value., xrefs: 004B13FA
PackageName, xrefs: 004B12DD, 004B12F0
ThisVersionInstalled, xrefs: 004B12BD, 004B12D0
Failed to get the formatted key path for update registration., xrefs: 004B1285
LogonUser, xrefs: 004B1387
InstallerVersion, xrefs: 004B13DF, 004B13E4, 004B13E5, 004B13F5
Date, xrefs: 004B13A7
PackageVersion, xrefs: 004B12FD, 004B1310
InstallerName, xrefs: 004B13C2, 004B13C7, 004B13C8, 004B13D8
Failed to create the key for update registration., xrefs: 004B12B1
PublishingGroup, xrefs: 004B1345, 004B1358
ReleaseType, xrefs: 004B1368, 004B136D, 004B137C
InstalledBy, xrefs: 004B1382, 004B139B
InstalledDate, xrefs: 004B13A2, 004B13BB
Publisher, xrefs: 004B131D, 004B1330

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CloseValue
String ID: Date$Failed to create the key for update registration.$Failed to get the formatted key path for update registration.$Failed to write %ls value.$InstalledBy$InstalledDate$InstallerName$InstallerVersion$LogonUser$PackageName$PackageVersion$Publisher$PublishingGroup$ReleaseType$ThisVersionInstalled
API String ID: 3132538880-2703781546
Opcode ID: 7712de8ef7a52b0331b045f4e3d8d28b610fc4f5ecffcc812e09128ea46112ea
Instruction ID: a566a437e10d8c49197f8fa50b8560b3e00ce9d922281f651059f3d71e784854
Opcode Fuzzy Hash: 7712de8ef7a52b0331b045f4e3d8d28b610fc4f5ecffcc812e09128ea46112ea
Instruction Fuzzy Hash: 68415931A40E65F7DB125651CC12FFF3AA5EB10B16FA14067FD01B6630DB6C9E01A6AC

Function 004CE285 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 271COMMON

Download Yara Rule

Strings

Failed to copy filename for passthrough pseudo bundle., xrefs: 004CE4CF
Failed to copy key for passthrough pseudo bundle., xrefs: 004CE499
c:\agent\_work\36\s\wix\src\burn\engine\pseudobundle.cpp, xrefs: 004CE2B9, 004CE4B2, 004CE4EC
Failed to copy key for passthrough pseudo bundle payload., xrefs: 004CE4D6
Failed to copy local source path for passthrough pseudo bundle., xrefs: 004CE4C8
Failed to copy cache id for passthrough pseudo bundle., xrefs: 004CE516
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 004CE4F8
Failed to allocate memory for pseudo bundle payload hash., xrefs: 004CE4BE
Failed to recreate command-line arguments., xrefs: 004CE554
Failed to copy related arguments for passthrough bundle package, xrefs: 004CE593
Failed to allocate space for burn package payload inside of passthrough bundle., xrefs: 004CE2C5
Failed to copy download source for passthrough pseudo bundle., xrefs: 004CE4A0
Failed to copy install arguments for passthrough bundle package, xrefs: 004CE573
Failed to copy uninstall arguments for passthrough bundle package, xrefs: 004CE5BD

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of passthrough bundle.$Failed to allocate space for burn payload inside of related bundle struct$Failed to copy cache id for passthrough pseudo bundle.$Failed to copy download source for passthrough pseudo bundle.$Failed to copy filename for passthrough pseudo bundle.$Failed to copy install arguments for passthrough bundle package$Failed to copy key for passthrough pseudo bundle payload.$Failed to copy key for passthrough pseudo bundle.$Failed to copy local source path for passthrough pseudo bundle.$Failed to copy related arguments for passthrough bundle package$Failed to copy uninstall arguments for passthrough bundle package$Failed to recreate command-line arguments.$c:\agent\_work\36\s\wix\src\burn\engine\pseudobundle.cpp
API String ID: 1357844191-1162945257
Opcode ID: a7f07b8c131bec08e248c736af0929e50124d22a99fe3d0c0bef01fa96e65aab
Instruction ID: c8391c1083c45a70429e7c8a8a09bb737c8c0036d7c9ad5fd5d28291ee219d04
Opcode Fuzzy Hash: a7f07b8c131bec08e248c736af0929e50124d22a99fe3d0c0bef01fa96e65aab
Instruction Fuzzy Hash: A0B1BA79A00615EFCB51CF2AC881F59BBE4BF09314F1081AAFD049B361D779EA11DB88

Function 004A82B9 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000), ref: 004A82F5

Part of subcall function 004E5CD2: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process2,?,?,?,?,004A7B69,00000000), ref: 004E5CE7
Part of subcall function 004E5CD2: GetProcAddress.KERNEL32(00000000), ref: 004E5CEE
Part of subcall function 004E5CD2: GetLastError.KERNEL32(?,?,?,?,004A7B69,00000000), ref: 004E5D09

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004A8321
GetLastError.KERNEL32 ref: 004A832F
GetSystemWow64DirectoryW.KERNEL32(?,00000104,00000000), ref: 004A8367
GetLastError.KERNEL32 ref: 004A8371
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004A83B4
GetLastError.KERNEL32 ref: 004A83BE

Strings

Failed to get 32-bit system folder., xrefs: 004A839F
Failed to get 64-bit system folder., xrefs: 004A835D
Failed to backslash terminate system folder., xrefs: 004A8401
c:\agent\_work\36\s\wix\src\burn\engine\variable.cpp, xrefs: 004A8353, 004A8395
Failed to set system folder variant value., xrefs: 004A841D

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorLast$DirectorySystem$AddressCurrentHandleModuleProcProcessWow64
String ID: Failed to backslash terminate system folder.$Failed to get 32-bit system folder.$Failed to get 64-bit system folder.$Failed to set system folder variant value.$c:\agent\_work\36\s\wix\src\burn\engine\variable.cpp
API String ID: 325818893-1386230865
Opcode ID: 54d94686345d0f1822f6a1f946665601ad58045c83c4d4fa986868b83fa3f13e
Instruction ID: f452aa7926d8b6507d43a8f1f9a04c75dfacd73665d24822e1193537fd2cde76
Opcode Fuzzy Hash: 54d94686345d0f1822f6a1f946665601ad58045c83c4d4fa986868b83fa3f13e
Instruction Fuzzy Hash: 09312A32D41239A7DB2057528C4DB9F76A8EF22B15F11416BAD04FB281EA7C9D408BDD

Function 004BB2FA Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,004BC4D3,?,00000000,00000000,00000000,?), ref: 004BB315
GetLastError.KERNEL32(?,004BC4D3,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 004BB323

Part of subcall function 004A37ED: Sleep.KERNEL32(?,00000000,?,004BA24E,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,004A6A86), ref: 004A3804

CloseHandle.KERNEL32(00000000,?,00000001,00000003,000007D0,00000000,00000000), ref: 004BB401

Strings

Failed to verify container hash: %ls, xrefs: 004BB384
Failed to copy %ls to %ls, xrefs: 004BB3EF
c:\agent\_work\36\s\wix\src\burn\engine\cache.cpp, xrefs: 004BB347
Copying, xrefs: 004BB3A0, 004BB3AB
Failed to move %ls to %ls, xrefs: 004BB3D9
Failed to open container in working path: %ls, xrefs: 004BB352
Moving, xrefs: 004BB397
%ls container from working path '%ls' to path '%ls', xrefs: 004BB3AC

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls container from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open container in working path: %ls$Failed to verify container hash: %ls$Moving$c:\agent\_work\36\s\wix\src\burn\engine\cache.cpp
API String ID: 1275171361-3235902153
Opcode ID: 9e96f14a32a20bf9b72939adba88dee7ad3c3f6ca64d85d510ca84d9b34296d5
Instruction ID: e5b98786a3ad25fcf55765d474bc32368d9ae640625938d7caef323f73fccf64
Opcode Fuzzy Hash: 9e96f14a32a20bf9b72939adba88dee7ad3c3f6ca64d85d510ca84d9b34296d5
Instruction Fuzzy Hash: EB2125B2A407797BD6222A168C86FBB255CDF01B58F11002BFE047A2C1D7DDAD2185FE

Function 004C02CB Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 96threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000,?,?,004A7154,?,?), ref: 004C02EC
GetLastError.KERNEL32(?,?,004A7154,?,?), ref: 004C02F9
CreateThread.KERNEL32(00000000,00000000,004C0050,00000000,00000000,00000000), ref: 004C0358
GetLastError.KERNEL32(?,?,004A7154,?,?), ref: 004C0365
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,004A7154,?,?), ref: 004C03A0
CloseHandle.KERNEL32(?,?,?,004A7154,?,?), ref: 004C03B4
CloseHandle.KERNEL32(?,?,?,004A7154,?,?), ref: 004C03C1

Strings

Failed to create modal event., xrefs: 004C0324
TqJ, xrefs: 004C0342
c:\agent\_work\36\s\wix\src\burn\engine\splashscreen.cpp, xrefs: 004C031A, 004C0386
Failed to create UI thread., xrefs: 004C0390

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create UI thread.$Failed to create modal event.$TqJ$c:\agent\_work\36\s\wix\src\burn\engine\splashscreen.cpp
API String ID: 2351989216-1536746078
Opcode ID: 875046f535b63bc4b01eb6be5669d23a7c52c33f28bcf404c5e1ce1870f1b710
Instruction ID: eeec4eb5b913fa8c07ac62d433514f01e959223f7913d27f3f52ea77620af26e
Opcode Fuzzy Hash: 875046f535b63bc4b01eb6be5669d23a7c52c33f28bcf404c5e1ce1870f1b710
Instruction Fuzzy Hash: 7731867AD00269FBD7118F99CC45FAFBBB8AB44710F11416BEE00F6250E6788A00CA99

Function 004EA375 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 164COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,label,000000FF,?,?,?,74DEDFD0,?,004EA8E7,?,?), ref: 004EA3CB
SysFreeString.OLEAUT32(00000000), ref: 004EA436
SysFreeString.OLEAUT32(00000000), ref: 004EA4AE
SysFreeString.OLEAUT32(00000000), ref: 004EA4ED

Strings

term, xrefs: 004EA3FE
label, xrefs: 004EA3BD
`<u, xrefs: 004EA436, 004EA4AE, 004EA4ED
scheme, xrefs: 004EA3DE

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: String$Free$Compare
String ID: `<u$label$scheme$term
API String ID: 1324494773-4028212031
Opcode ID: a6c41e5c1234ee590dbf28189c8f0bed9ce39adf3c7833def6d029fb18ba5cb7
Instruction ID: 9d81c529ee85f0a4ffb43eda1892d70246fbddec86a6d7f23dcf264f170ff892
Opcode Fuzzy Hash: a6c41e5c1234ee590dbf28189c8f0bed9ce39adf3c7833def6d029fb18ba5cb7
Instruction Fuzzy Hash: 77517F31900259FBCB11DB96C848FAEBBB4AF00726F1042AAF511AB2E0D774AE50DB55

Function 004B709D Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 90synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(0074006E,0002BF20,0064002E,F0000003,004EE518,?,?,00000000,feclient.dll,?,TqJ,00000000,00000000,?,00000000), ref: 004B7146
GetLastError.KERNEL32(?,?,?,004A692F,?,?,00000000,?,?,?,?,?,?,004EE4A0,?,?), ref: 004B7151

Strings

Failed to wait for child process exit., xrefs: 004B717F
c:\agent\_work\36\s\wix\src\burn\engine\pipe.cpp, xrefs: 004B7175
TqJ, xrefs: 004B70D3
feclient.dll, xrefs: 004B70DD
Failed to write exit code to message buffer., xrefs: 004B70C1
Failed to post terminate message to child process., xrefs: 004B7131
Failed to post terminate message to child process cache thread., xrefs: 004B7115
Failed to write restart to message buffer., xrefs: 004B70E9

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: Failed to post terminate message to child process cache thread.$Failed to post terminate message to child process.$Failed to wait for child process exit.$Failed to write exit code to message buffer.$Failed to write restart to message buffer.$TqJ$c:\agent\_work\36\s\wix\src\burn\engine\pipe.cpp$feclient.dll
API String ID: 1211598281-3422988414
Opcode ID: b7ab17dbec26cdab1003590f74c3f2e4b89f4a42adc41637b08d88068a8a010d
Instruction ID: 2ba120a491be97ab3bc1e8456e1887f0f2f69253299a56d898b12f190ce0aab1
Opcode Fuzzy Hash: b7ab17dbec26cdab1003590f74c3f2e4b89f4a42adc41637b08d88068a8a010d
Instruction Fuzzy Hash: 76213932948629BBCB225A99CC05EDFBA689F40365F110257F900B6290D73CAE1087FC

Function 004C30B0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 87threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,74DF2F60,?,?), ref: 004C30D4
GetLastError.KERNEL32 ref: 004C30E7
GetExitCodeThread.KERNEL32(004EE488,00000000), ref: 004C3129
GetLastError.KERNEL32 ref: 004C3137
ResetEvent.KERNEL32(004EE460), ref: 004C3172
GetLastError.KERNEL32 ref: 004C317C

Strings

c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp, xrefs: 004C310E, 004C315E, 004C31A3
Failed to wait for operation complete event., xrefs: 004C3118
Failed to get extraction thread exit code., xrefs: 004C3168
Failed to reset operation complete event., xrefs: 004C31AD

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp
API String ID: 2979751695-296692858
Opcode ID: 78b44cdf407fddb4438c0b5eb3ed9f3a3165e732f1ef6db190363d0087f198f5
Instruction ID: c5410b64a2a516cbc008db485e7ac16f08454ab9915c0631c018a5f3cc1e9c41
Opcode Fuzzy Hash: 78b44cdf407fddb4438c0b5eb3ed9f3a3165e732f1ef6db190363d0087f198f5
Instruction Fuzzy Hash: 1831B174A40315EFE7109F668D05F7A76F8AB00702F14816FF905EA2A0EA7DDB009B2D

Function 004C31CA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(004EE478,?,00000000,?,004ADED5,?,004A7083,00000000,?,004B948E,?,004A7333,004A713F,004A713F,00000000,?), ref: 004C31E7
GetLastError.KERNEL32(?,004ADED5,?,004A7083,00000000,?,004B948E,?,004A7333,004A713F,004A713F,00000000,?,004A714F,FFF9E89D,004A714F), ref: 004C31F1
WaitForSingleObject.KERNEL32(004EE488,000000FF,?,004ADED5,?,004A7083,00000000,?,004B948E,?,004A7333,004A713F,004A713F,00000000,?,004A714F), ref: 004C322B
GetLastError.KERNEL32(?,004ADED5,?,004A7083,00000000,?,004B948E,?,004A7333,004A713F,004A713F,00000000,?,004A714F,FFF9E89D,004A714F), ref: 004C3235
CloseHandle.KERNEL32(00000000,004A714F,?,00000000,?,004ADED5,?,004A7083,00000000,?,004B948E,?,004A7333,004A713F,004A713F,00000000), ref: 004C3280
CloseHandle.KERNEL32(00000000,004A714F,?,00000000,?,004ADED5,?,004A7083,00000000,?,004B948E,?,004A7333,004A713F,004A713F,00000000), ref: 004C328F
CloseHandle.KERNEL32(00000000,004A714F,?,00000000,?,004ADED5,?,004A7083,00000000,?,004B948E,?,004A7333,004A713F,004A713F,00000000), ref: 004C329E

Strings

c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp, xrefs: 004C3215, 004C3259
Failed to set begin operation event., xrefs: 004C321F
Failed to wait for thread to terminate., xrefs: 004C3263

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CloseHandle$ErrorLast$EventObjectSingleWait
String ID: Failed to set begin operation event.$Failed to wait for thread to terminate.$c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp
API String ID: 1206859064-754580096
Opcode ID: 198d6a96e7e2be417df6ffb703d61b937051687988baf6491a78480c7ad59bb3
Instruction ID: 6b422ba8fbcaed57361f0eee84b33e3ad720d8aac7211a0fdeb5ec86a316a019
Opcode Fuzzy Hash: 198d6a96e7e2be417df6ffb703d61b937051687988baf6491a78480c7ad59bb3
Instruction Fuzzy Hash: C3210436900A32B7DB615F56DC49F16B6A0BF04727F00426AE90865AA0D77CED50CADD

Function 004BB04A Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 232COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,?,00000000,00000000,00000003,00000000,00000000), ref: 004BB0FD
GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,000007D0,00000001), ref: 004BB125

Strings

Failed to get file hash., xrefs: 004BB14F
$, xrefs: 004BB1FC
c:\agent\_work\36\s\wix\src\burn\engine\cache.cpp, xrefs: 004BB145, 004BB259, 004BB2AA
Failed to allocate string., xrefs: 004BB193
Could not close verify handle., xrefs: 004BB2B4
Failed to allocate memory, xrefs: 004BB0BB
Failed to encode file hash., xrefs: 004BB1B0
0, xrefs: 004BB1BD
Could not verify file %ls., xrefs: 004BB266

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorLast
String ID: $$0$Could not close verify handle.$Could not verify file %ls.$Failed to allocate memory$Failed to allocate string.$Failed to encode file hash.$Failed to get file hash.$c:\agent\_work\36\s\wix\src\burn\engine\cache.cpp
API String ID: 1452528299-3709293557
Opcode ID: cb507c85f7a5736078c4de14d0ace4a6a18bb8bdaefcd03a706fc9f317c017ce
Instruction ID: 2c6c0a11c73380df096cf403489c1bc35703fb0f0c59a7a99297d168dfea5b5c
Opcode Fuzzy Hash: cb507c85f7a5736078c4de14d0ace4a6a18bb8bdaefcd03a706fc9f317c017ce
Instruction Fuzzy Hash: 14818272D00229AADB21DB99C845BEEB7B4EF09754F10415BED10BB280E7789D018BE8

Function 004C01F2 Relevance: 16.6, APIs: 11, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004C01FD
DefWindowProcW.USER32(?,00000082,?,?), ref: 004C023B
SetWindowLongW.USER32(?,000000EB,00000000), ref: 004C0248
SetWindowLongW.USER32(?,000000EB,?), ref: 004C0257
DefWindowProcW.USER32(?,?,?,?), ref: 004C0265
CreateCompatibleDC.GDI32(?), ref: 004C0271
SelectObject.GDI32(00000000,00000000), ref: 004C0282
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 004C02A4
SelectObject.GDI32(00000000,00000000), ref: 004C02AC
DeleteDC.GDI32(00000000), ref: 004C02AF
PostQuitMessage.USER32(00000000), ref: 004C02BD

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: Window$Long$ObjectProcSelect$CompatibleCreateDeleteMessagePostQuitStretch
String ID:
API String ID: 409979828-0
Opcode ID: 34fc9db75f0d7acfc85f9980877868c6787572b32c511f97375499159b905ffe
Instruction ID: 1980acb0b1bba3847a134d968c471e1ba10acf99efe68f7a551d83d0bbc757d9
Opcode Fuzzy Hash: 34fc9db75f0d7acfc85f9980877868c6787572b32c511f97375499159b905ffe
Instruction Fuzzy Hash: 7921AC3A100214FFDB555F69DC8CE7B3F68EB49720B014569FA069B1A2D2758C10EB69

Function 004EA250 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,name,000000FF,00000000,00000000,00000000,?,74DEDFD0), ref: 004EA2AF
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,email,000000FF), ref: 004EA2CC
SysFreeString.OLEAUT32(00000000), ref: 004EA30A
SysFreeString.OLEAUT32(00000000), ref: 004EA34E

Strings

email, xrefs: 004EA2BE
`<u, xrefs: 004EA30A, 004EA34E
uri, xrefs: 004EA2DA
name, xrefs: 004EA2A1

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: String$CompareFree
String ID: `<u$email$name$uri
API String ID: 3589242889-1197142144
Opcode ID: 638d2200447646ff8ac918baeea2f9f45b835c79615a87c877835c4d0bd9390f
Instruction ID: 757bb84a915805f68fd8d790eb7f23a484ddf1a3ed6edb30b367cf78e4cc2867
Opcode Fuzzy Hash: 638d2200447646ff8ac918baeea2f9f45b835c79615a87c877835c4d0bd9390f
Instruction Fuzzy Hash: 99419E35900259BBCF11DB96CC44FAEBB74AF00726F2042A5EA20BB2D1C739AE54DB55

Function 004B1131 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 108stringCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 004B116A

Part of subcall function 004A1B27: CreateDirectoryW.KERNELBASE(00000000,004A7083,00000000,00000000,?,004BBDBF,00000000,00000000,?,00000000,840F01E8,004A7083,00000000,004A714F,840F01E8), ref: 004A1B35
Part of subcall function 004A1B27: GetLastError.KERNEL32(?,004BBDBF,00000000,00000000,?,00000000,840F01E8,004A7083,00000000,004A714F,840F01E8), ref: 004A1B43

lstrlenA.KERNEL32(002E0032,00000000,00000094,00000000,00000094,crypt32.dll,crypt32.dll,004B2190,swidtag,00000094,004EE500,00330074,004B2190,00000000,crypt32.dll,00000000), ref: 004B11BD

Part of subcall function 004A4483: CreateFileW.KERNEL32(002E0032,40000000,00000001,00000000,00000002,00000080,00000000,004B2190,00000000,?,004B11D4,004EE500,00000080,002E0032,00000000), ref: 004A449B
Part of subcall function 004A4483: GetLastError.KERNEL32(?,004B11D4,004EE500,00000080,002E0032,00000000,?,004B2190,crypt32.dll,00000094,?,?,?,?,?,00000000), ref: 004A44A8

Strings

Failed to allocate regid file path., xrefs: 004B1215
Failed to allocate regid folder path., xrefs: 004B121C
Failed to write tag xml to file: %ls, xrefs: 004B11FB
swidtag, xrefs: 004B117D
Failed to create regid folder: %ls, xrefs: 004B1205
Failed to format tag folder path., xrefs: 004B1223
crypt32.dll, xrefs: 004B115A, 004B1197, 004B1198

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CreateErrorLast$DirectoryFileOpen@16lstrlen
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to create regid folder: %ls$Failed to format tag folder path.$Failed to write tag xml to file: %ls$crypt32.dll$swidtag
API String ID: 904508749-2959304021
Opcode ID: edf74e9197462affee52c59b2e8ef83acc0db1e32471ebc8060145a6236787e3
Instruction ID: 17c8743cd7b9884b68f2adfe0a6d84c7cd9a1a4137b6896a97aa08fb4d19706e
Opcode Fuzzy Hash: edf74e9197462affee52c59b2e8ef83acc0db1e32471ebc8060145a6236787e3
Instruction Fuzzy Hash: 4831D231C00618BFCB159F94DC51BDDBBB4AF04711F6081A7FA10FA261E7789E509BA9

Function 004C12A0 Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 154COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 004C12B5
LeaveCriticalSection.KERNEL32(?), ref: 004C1430

Strings

UX requested unknown container with id: %ls, xrefs: 004C135A
UX requested unknown payload with id: %ls, xrefs: 004C130A
UX denied while trying to set download URL on embedded payload: %ls, xrefs: 004C1320
Failed to set download password., xrefs: 004C13DE
UX did not provide container or payload id., xrefs: 004C141F
Failed to set download user., xrefs: 004C13B8
Failed to set download URL., xrefs: 004C138F
Engine is active, cannot change engine state., xrefs: 004C12CF

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set download URL.$Failed to set download password.$Failed to set download user.$UX denied while trying to set download URL on embedded payload: %ls$UX did not provide container or payload id.$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-2615595102
Opcode ID: 4cfd3354f2d88fe8aef994b759954deb6d361144f66b91ae7406f46b6c5dad26
Instruction ID: c435fcf7ed90f7f22091add23d70d4c44d24789908c45fc0b77a9bcbaf0c62fc
Opcode Fuzzy Hash: 4cfd3354f2d88fe8aef994b759954deb6d361144f66b91ae7406f46b6c5dad26
Instruction Fuzzy Hash: F341027A900251ABDBA59A25C841F6B73A8AF02318B14816FF805E7262E77CDC40C79D

Function 004E909D Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 195filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,00000000,00000000,00000078,00000410,000000FF,?,00000000,00000000), ref: 004E90DA
GetLastError.KERNEL32 ref: 004E90E8
VirtualAlloc.KERNEL32(00000000,00010000,00003000,00000004), ref: 004E9129
GetLastError.KERNEL32 ref: 004E9136
VirtualFree.KERNEL32(?,00000000,00008000), ref: 004E92A9
CloseHandle.KERNEL32(?), ref: 004E92B8

Strings

GET, xrefs: 004E91DD
c:\agent\_work\36\s\wix\src\libs\dutil\dlutil.cpp, xrefs: 004E910C

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorLastVirtual$AllocCloseCreateFileFreeHandle
String ID: GET$c:\agent\_work\36\s\wix\src\libs\dutil\dlutil.cpp
API String ID: 2028584396-3792313763
Opcode ID: d8eabb7fb38729f803242947f74189e3ed4335f09fc02c3105d9e93ea380fd1b
Instruction ID: 78463ad2565b46731420cda6e17fe238df3f98f69b60e3bf2d9b8902bd1c046c
Opcode Fuzzy Hash: d8eabb7fb38729f803242947f74189e3ed4335f09fc02c3105d9e93ea380fd1b
Instruction Fuzzy Hash: 8561807190025AABDF11CF96CC85BEEBBB8AF08351F11055AFE05B7290D738DC408B98

Function 004B2271 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 132registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,00000001,00000000,?), ref: 004B23A2
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,00000001,00000000,?), ref: 004B23B1

Part of subcall function 004A54AE: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,004B22E9,?,00000000,00020006), ref: 004A54D3

Strings

Failed to open registration key., xrefs: 004B23E7
Failed to delete registration key: %ls, xrefs: 004B2350
%ls.RebootRequired, xrefs: 004B22BF
Failed to update resume mode., xrefs: 004B2386
Failed to write volatile reboot required registry key., xrefs: 004B22ED

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: Close$Create
String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.
API String ID: 359002179-2517785395
Opcode ID: cda03422d724f7cb49adf3cc4e18dea344a5669aa29041c688ab05e473a2df2e
Instruction ID: 20b050b9ae00f4bc32eb06c21b379c5d4cb40a17417ae4ff3c1e6b5c8a859b92
Opcode Fuzzy Hash: cda03422d724f7cb49adf3cc4e18dea344a5669aa29041c688ab05e473a2df2e
Instruction Fuzzy Hash: 5D419032900718BBDB22AF61DD02EEF7BB9BF90309F10041FF90161151DBBD9A509B69

Function 004CF398 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 105comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00504514,00000000,00000017,00504524,?,?,00000000,00000000,?,?,?,?,?,004CF9BE,00000000,00000000), ref: 004CF3D0

Strings

Failed to set BITS job to foreground., xrefs: 004CF451
Failed to create IBackgroundCopyManager., xrefs: 004CF3DC
WixBurn, xrefs: 004CF3FB
Failed to create BITS job., xrefs: 004CF40A
Failed to set progress timeout., xrefs: 004CF43A
Failed to set notification flags for BITS job., xrefs: 004CF422

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CreateInstance
String ID: Failed to create BITS job.$Failed to create IBackgroundCopyManager.$Failed to set BITS job to foreground.$Failed to set notification flags for BITS job.$Failed to set progress timeout.$WixBurn
API String ID: 542301482-468763447
Opcode ID: 069f6a787ef45b54b950251c491fb1c2a6ed2cce0a4d1512a7127717ce87a7ad
Instruction ID: ef04525a0e03d899ca6591e1f60c48757826de18e38ed23b9c95ba65a74d5d13
Opcode Fuzzy Hash: 069f6a787ef45b54b950251c491fb1c2a6ed2cce0a4d1512a7127717ce87a7ad
Instruction Fuzzy Hash: CA31C575A00215AFCB19CB69C885E6FBBF5EF48700B01406EFA01EB390DA38DC05CB95

Function 004E93E9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,?,?,?,?,?,WiX\Burn,DownloadTimeout,00000078), ref: 004E9433
GetLastError.KERNEL32 ref: 004E9440
ReadFile.KERNEL32(00000000,00000008,00000008,?,00000000), ref: 004E9487
GetLastError.KERNEL32 ref: 004E94BB
CloseHandle.KERNEL32(00000000,c:\agent\_work\36\s\wix\src\libs\dutil\dlutil.cpp,000000C8,00000000), ref: 004E94EF

Strings

c:\agent\_work\36\s\wix\src\libs\dutil\dlutil.cpp, xrefs: 004E9464, 004E94DF
%ls.R, xrefs: 004E9407

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleRead
String ID: %ls.R$c:\agent\_work\36\s\wix\src\libs\dutil\dlutil.cpp
API String ID: 3160720760-2563767296
Opcode ID: bc4f1cfa1dd2cfb74c9478c272a2a24a16b7adce02aed7fd16da0af64b590fc9
Instruction ID: 58eec47661701a3f646a504677d2a2e7c8b1e198b142daa66d6f24cacf720695
Opcode Fuzzy Hash: bc4f1cfa1dd2cfb74c9478c272a2a24a16b7adce02aed7fd16da0af64b590fc9
Instruction Fuzzy Hash: CE312872900265ABE7208F56CD89B6F7AB4BF05721F114266FE04EF2C1E7789C0187A9

Function 004BF0D7 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 122COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,?,00000001,004EE500,?,00000001,000000FF,?,?,00000000,00000000,00000001,00000000,?,004B9106), ref: 004BF20D

Strings

Failed to create pipe and cache pipe., xrefs: 004BF15D
UX aborted elevation requirement., xrefs: 004BF115
Failed to connect to elevated child process., xrefs: 004BF1F6
Failed to create pipe name and client token., xrefs: 004BF141
Failed to elevate., xrefs: 004BF1EF
c:\agent\_work\36\s\wix\src\burn\engine\elevation.cpp, xrefs: 004BF10B

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CloseHandle
String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$c:\agent\_work\36\s\wix\src\burn\engine\elevation.cpp
API String ID: 2962429428-2894792899
Opcode ID: 025ad911fba50b1c5a3de4d2130cb6242f0f16a6ed329e687497b2d9a3087790
Instruction ID: 319088bff849d504ff15318a7e148a13e2067209bf279bc21a21dfd832388f17
Opcode Fuzzy Hash: 025ad911fba50b1c5a3de4d2130cb6242f0f16a6ed329e687497b2d9a3087790
Instruction Fuzzy Hash: 01317D73644721BAE715A264CC46FEB765CDB11334F20066BF908BA281DF6D9D0442FD

Function 004A902C Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,004A75EF,00000100,00000100,00000000,?,00000001,00000000,00000100), ref: 004A903E
LeaveCriticalSection.KERNEL32(00000000,00000000,00000100,00000000,?,?,?,004A75EF,00000100,00000100,00000000,?,00000001,00000000,00000100), ref: 004A911D

Strings

Failed to format value '%ls' of variable: %ls, xrefs: 004A90E7
Failed to get value as string for variable: %ls, xrefs: 004A910C
*****, xrefs: 004A90D9, 004A90E6
Failed to get variable: %ls, xrefs: 004A907F
Failed to get unformatted string., xrefs: 004A90AE

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
API String ID: 3168844106-2873099529
Opcode ID: 823607f9c2a47a9ff84bb3532f9af45d87e6894d89a8726e77941cc5089ce66c
Instruction ID: 1fedd7cc9625fcd5d055210ecd9c35c3de7de7c2b58cffc973c014c562d95277
Opcode Fuzzy Hash: 823607f9c2a47a9ff84bb3532f9af45d87e6894d89a8726e77941cc5089ce66c
Instruction Fuzzy Hash: A331243280062AFBDF215F41CC06BAE7E64AF22369F20411BF90466152C77DEE508BCD

Function 004B6306 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 004A50E9: GetProcessHeap.KERNEL32(?,000001C7,?,004A2D50,?,00000001,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A50FA
Part of subcall function 004A50E9: RtlAllocateHeap.NTDLL(00000000,?,004A2D50,?,00000001,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A5101

_memcpy_s.LIBCMT ref: 004B6357
_memcpy_s.LIBCMT ref: 004B636A
_memcpy_s.LIBCMT ref: 004B6385

Strings

c:\agent\_work\36\s\wix\src\burn\engine\pipe.cpp, xrefs: 004B6336
Failed to allocate memory for message., xrefs: 004B6340
crypt32.dll, xrefs: 004B6361, 004B6380

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: _memcpy_s$Heap$AllocateProcess
String ID: Failed to allocate memory for message.$c:\agent\_work\36\s\wix\src\burn\engine\pipe.cpp$crypt32.dll
API String ID: 886498622-4208266268
Opcode ID: fe8683e578bc1105ce91707cd0de9fcdbf4db5bf0f3c2b51d235f9d54a6e1b54
Instruction ID: 98eb90c9f33275037de30f1598755565b7d1c89bf3c22827a5bfba58948b57d4
Opcode Fuzzy Hash: fe8683e578bc1105ce91707cd0de9fcdbf4db5bf0f3c2b51d235f9d54a6e1b54
Instruction Fuzzy Hash: DE1191B310020DABDB019E95CC81DEBB3ACEF65704B00451BFE14DB141DB79E65087E4

Function 004E82C2 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 004E8316
GetLastError.KERNEL32 ref: 004E8320
CloseHandle.KERNEL32(?), ref: 004E8353

Strings

c:\agent\_work\36\s\wix\src\libs\dutil\shelutil.cpp, xrefs: 004E8341
PDu, xrefs: 004E8316
<, xrefs: 004E8308

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CloseErrorExecuteHandleLastShell
String ID: <$PDu$c:\agent\_work\36\s\wix\src\libs\dutil\shelutil.cpp
API String ID: 3023784893-1716625543
Opcode ID: 010b74c6ca1eb5c3c2871be11400aa3eb4cbef938196db38c2453aec939a343e
Instruction ID: 139862586993d17a56f1a2edc00e8c603e732e47e5e6aa5e5d8411fc1c1da4dd
Opcode Fuzzy Hash: 010b74c6ca1eb5c3c2871be11400aa3eb4cbef938196db38c2453aec939a343e
Instruction Fuzzy Hash: 2221D5B5E01229ABCB10CF99C984A9EBBF8BB08B41F10411AEC05E7340D7749A008B94

Function 004D312E Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004D3125,004D37FC), ref: 004D313C
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004D314A
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004D3163
SetLastError.KERNEL32(00000000,?,004D3125,004D37FC), ref: 004D31B5

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e23eee49e732cc28adedccec81ecfaa72b253987f1b8c1207b8a2c7dd9f71f4b
Instruction ID: 75f67ac4d38914331429ba8163b1da7b541edd617488f141a83cd540879e8aaa
Opcode Fuzzy Hash: e23eee49e732cc28adedccec81ecfaa72b253987f1b8c1207b8a2c7dd9f71f4b
Instruction Fuzzy Hash: AF01243221A2225EE6252E767CBA91F2658EF127BB730073FF420443E0EE5D4D05614F

Function 004EB12C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 004A50E9: GetProcessHeap.KERNEL32(?,000001C7,?,004A2D50,?,00000001,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A50FA
Part of subcall function 004A50E9: RtlAllocateHeap.NTDLL(00000000,?,004A2D50,?,00000001,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A5101

SysFreeString.OLEAUT32(00000000), ref: 004EB289
SysFreeString.OLEAUT32(00000000), ref: 004EB294
SysFreeString.OLEAUT32(00000000), ref: 004EB29F

Strings

`<u, xrefs: 004EB27E
c:\agent\_work\36\s\wix\src\libs\dutil\atomutil.cpp, xrefs: 004EB15F

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: `<u$c:\agent\_work\36\s\wix\src\libs\dutil\atomutil.cpp
API String ID: 2724874077-571412331
Opcode ID: f01ebf781fb1a6718e3d01e35ef68ee8cce7a31f41ff228bfb84f18a1f0c3498
Instruction ID: bb362ebb94545fc2b677b0a6636110be92970d5e8c8bd1266211a85bba5e3907
Opcode Fuzzy Hash: f01ebf781fb1a6718e3d01e35ef68ee8cce7a31f41ff228bfb84f18a1f0c3498
Instruction Fuzzy Hash: B2519171D01266EFCB11DBA6C948BAFB7B8EF00755F11419AE901AB210D774EE01CBD9

Function 004EB029 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 004A50E9: GetProcessHeap.KERNEL32(?,000001C7,?,004A2D50,?,00000001,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A50FA
Part of subcall function 004A50E9: RtlAllocateHeap.NTDLL(00000000,?,004A2D50,?,00000001,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A5101

SysFreeString.OLEAUT32(00000000), ref: 004EB10C
SysFreeString.OLEAUT32(?), ref: 004EB117
SysFreeString.OLEAUT32(00000000), ref: 004EB122

Strings

`<u, xrefs: 004EB101
c:\agent\_work\36\s\wix\src\libs\dutil\atomutil.cpp, xrefs: 004EB056

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: `<u$c:\agent\_work\36\s\wix\src\libs\dutil\atomutil.cpp
API String ID: 2724874077-571412331
Opcode ID: dd99edbe6e0ce41b90ba254328b49c31902acb470b4144c5010626066b3b3568
Instruction ID: 2ddea7d8dcc0e94cf111f84fb637f97ae8781940f1ab27bff422b550f4ae3529
Opcode Fuzzy Hash: dd99edbe6e0ce41b90ba254328b49c31902acb470b4144c5010626066b3b3568
Instruction Fuzzy Hash: 5F31E431D00529ABCB219B97CC45B9FBB78EF01765F014156E910AB251D778AE01CBD5

Function 004A736B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,004A828E,004A828E,?,004A7301,?,?,00000000), ref: 004A73A7
GetLastError.KERNEL32(?,004A7301,?,?,00000000,?,?,004A828E,?,004A9C40,?,?,?,?,?), ref: 004A73D6

Strings

Failed to compare strings., xrefs: 004A7404
version.dll, xrefs: 004A7399
c:\agent\_work\36\s\wix\src\burn\engine\variable.cpp, xrefs: 004A73FA

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CompareErrorLastString
String ID: Failed to compare strings.$c:\agent\_work\36\s\wix\src\burn\engine\variable.cpp$version.dll
API String ID: 1733990998-34241861
Opcode ID: 582f455e18dfd66680dd1a029f8fc8f7a53c315ca4b13c8f27ad36fb0583a33e
Instruction ID: c65256bc6ed840f629be24242643f909004ae4277df352862f5805b8cdb825b3
Opcode Fuzzy Hash: 582f455e18dfd66680dd1a029f8fc8f7a53c315ca4b13c8f27ad36fb0583a33e
Instruction Fuzzy Hash: F9210A32605125ABCB208F98CC40A5ABBA4AB5A760B21031AFD11AF3C0D678DD01D798

Function 004CF2D1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000008,00000000,00000000,?,004CFA29,?,?,?,?,?,00000000,00000000,?), ref: 004CF2EB
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,004CFA29,?,?,?,?,?,00000000,00000000,?), ref: 004CF2F6
GetLastError.KERNEL32(?,004CFA29,?,?,?,?,?,00000000,00000000,?), ref: 004CF303

Strings

Failed to create BITS job complete event., xrefs: 004CF331
c:\agent\_work\36\s\wix\src\burn\engine\bitsengine.cpp, xrefs: 004CF327

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CreateCriticalErrorEventInitializeLastSection
String ID: Failed to create BITS job complete event.$c:\agent\_work\36\s\wix\src\burn\engine\bitsengine.cpp
API String ID: 3069647169-1975467286
Opcode ID: 08327fa50f4524a0c4ee89802d35c2c87fef369ae45a69398c63f5da5b0929c8
Instruction ID: 5851154738f06241c90bdeb889f6692dace009c5b6acfe52756b17f2a373ccf5
Opcode Fuzzy Hash: 08327fa50f4524a0c4ee89802d35c2c87fef369ae45a69398c63f5da5b0929c8
Instruction Fuzzy Hash: F40192B6501672BBC3109F56D805A8ABF98FF15761B01412AFD08DB641D77898408BE8

Function 004E6306 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 004E6331
GetLastError.KERNEL32(?,004A66AA,00000001,?,?,004A6227,?,?,?,?,004A712C,?,?,?,?), ref: 004E6340

Strings

srclient.dll, xrefs: 004E630F
c:\agent\_work\36\s\wix\src\libs\dutil\srputil.cpp, xrefs: 004E6361
SRSetRestorePointW, xrefs: 004E6326

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: SRSetRestorePointW$c:\agent\_work\36\s\wix\src\libs\dutil\srputil.cpp$srclient.dll
API String ID: 199729137-2477992140
Opcode ID: 2e24d1f565c40dfa3e416f8ec8f16d885782a753c7b4821e35c30e880530d659
Instruction ID: d6d2882c15a7c085919647fa04b8f709b6678d44f53ab1585d5251c6e94a443c
Opcode Fuzzy Hash: 2e24d1f565c40dfa3e416f8ec8f16d885782a753c7b4821e35c30e880530d659
Instruction Fuzzy Hash: 8101AD329847B293D3312B978909B5E6A90AB317A6F030137FD04AB691E6689C4097DB

Function 004A91B3 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004A7083,WixBundleOriginalSource,?,?,004BC326,840F01E8,WixBundleOriginalSource,?,0050EBC0,?,00000000,004A710B,00000001,?,?,004A710B), ref: 004A91BF
LeaveCriticalSection.KERNEL32(004A7083,004A7083,00000000,00000000,?,?,004BC326,840F01E8,WixBundleOriginalSource,?,0050EBC0,?,00000000,004A710B,00000001,?), ref: 004A9226

Strings

Failed to get value of variable: %ls, xrefs: 004A91F9
WixBundleOriginalSource, xrefs: 004A91BB
Failed to get value as string for variable: %ls, xrefs: 004A9215

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as string for variable: %ls$Failed to get value of variable: %ls$WixBundleOriginalSource
API String ID: 3168844106-30613933
Opcode ID: ba2ae1b17325240a3a606366382989f3c8e10213b9a161fe12d97ea844f615fc
Instruction ID: 77a3b585543998429fcbb68288e6bcf56d6658a1be2f9100f326e994e166c99c
Opcode Fuzzy Hash: ba2ae1b17325240a3a606366382989f3c8e10213b9a161fe12d97ea844f615fc
Instruction Fuzzy Hash: 1501BC3294012AFBCF215F40DC05B9E3A64EF22728F108466FD04AA221CB3D9E11D6DC

Function 004A52AB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80004005,00000000,00000000,00000100,?,004A1EB7,00000000,80004005,00000000,80004005,00000000,000001C7,?,004A1DFD), ref: 004A52C9
HeapReAlloc.KERNEL32(00000000,?,004A1EB7,00000000,80004005,00000000,80004005,00000000,000001C7,?,004A1DFD,000001C7,00000100,?,80004005,00000000), ref: 004A52D0

Part of subcall function 004A50E9: GetProcessHeap.KERNEL32(?,000001C7,?,004A2D50,?,00000001,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A50FA
Part of subcall function 004A50E9: RtlAllocateHeap.NTDLL(00000000,?,004A2D50,?,00000001,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A5101

Part of subcall function 004A5369: GetProcessHeap.KERNEL32(00000000,000001C7,?,004A2CA9,000001C7,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A5371
Part of subcall function 004A5369: HeapSize.KERNEL32(00000000,?,004A2CA9,000001C7,80004005,8007139F,?,?,004E5417,8007139F,?,00000000,00000000,8007139F), ref: 004A5378

_memcpy_s.LIBCMT ref: 004A531C

Strings

c:\agent\_work\36\s\wix\src\libs\dutil\memutil.cpp, xrefs: 004A535D

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: Heap$Process$AllocAllocateSize_memcpy_s
String ID: c:\agent\_work\36\s\wix\src\libs\dutil\memutil.cpp
API String ID: 3406509257-2907297377
Opcode ID: 7400481b2a68ff28630046f49089555b3d8e135cddadccad3e3670df3a3c2478
Instruction ID: 98698ada812b27026fd62f4b5f153c182974471c55a023473b22b765d5a474df
Opcode Fuzzy Hash: 7400481b2a68ff28630046f49089555b3d8e135cddadccad3e3670df3a3c2478
Instruction Fuzzy Hash: 88113A32500918ABDF112F659E44DAF3A19EFA23A4B05471BFD149B251D3B98D5093D8

Function 004A4053 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000080,00000000,000002C0,00000000,?,004CA7DB,00000000,00000088,000002C0,BundleCachePath,00000000), ref: 004A4087
GetLastError.KERNEL32(?,004CA7DB,00000000,00000088,000002C0,BundleCachePath,00000000,000002C0,BundleVersion,000000B8,000002C0,EngineVersion,000002C0,000000B0), ref: 004A4094

Strings

c:\agent\_work\36\s\wix\src\libs\dutil\fileutil.cpp, xrefs: 004A4068, 004A40B8

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: c:\agent\_work\36\s\wix\src\libs\dutil\fileutil.cpp
API String ID: 1214770103-1339450348
Opcode ID: 4a749f13a8e55674a9d378274cc8102de3372154afe7a30825140b16baded63f
Instruction ID: d21f07e0e2765c9b409296a6ca7ca33d3824d7823aaa1a855bab4e5e9c05d37f
Opcode Fuzzy Hash: 4a749f13a8e55674a9d378274cc8102de3372154afe7a30825140b16baded63f
Instruction Fuzzy Hash: 8301F232644130B6E63126565C49F6E6958ABE2B60F114226FF40BF2D0D2E94C00A2EE

Function 004B23EE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004A582C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0050EBD4,00000000,?,004E8E2A,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 004A5840

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,00000001,00000000), ref: 004B245E

Strings

Failed to open registration key., xrefs: 004B2415
Failed to update resume mode., xrefs: 004B242F
Failed to update name and publisher., xrefs: 004B2448

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to open registration key.$Failed to update name and publisher.$Failed to update resume mode.
API String ID: 47109696-1865096027
Opcode ID: 7212c7fd086c6449fa2c8d7e81393e0a63c2d04153ed0883c36ca0114b010498
Instruction ID: 3fe04ceaf2ec15c3557fd94fb594e9b40d89f8d06da81351bc0918a0ec114332
Opcode Fuzzy Hash: 7212c7fd086c6449fa2c8d7e81393e0a63c2d04153ed0883c36ca0114b010498
Instruction Fuzzy Hash: A901D432A40678F7DB125A95DD02FEFBA69AF50758F204017FA00B6151CBBCDE10A7A9

Function 004E83D2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,,qJ,?,00000000,004A712C,?,?,?), ref: 004E83F9
CoCreateInstance.OLE32(00000000,00000000,00000001,0050ACCC,?), ref: 004E8411

Strings

,qJ, xrefs: 004E83E9, 004E83F0, 004E83F3
Microsoft.Update.AutoUpdate, xrefs: 004E83F4

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID: ,qJ$Microsoft.Update.AutoUpdate
API String ID: 2151042543-2340689674
Opcode ID: 66df60de21b46ea2e0218c45cfe875158f0c84b68227cf42f448cacf239e2090
Instruction ID: 281347fdaa628fe61dbc433a46bf76e866c21c30ad7230f777efa716c98976ec
Opcode Fuzzy Hash: 66df60de21b46ea2e0218c45cfe875158f0c84b68227cf42f448cacf239e2090
Instruction Fuzzy Hash: 30F05471600219BBEB00DBFADD45AEFB7BCEB48710F000475FA01E7191D674AE048676

Function 004C1055 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 004C106A
GetLastError.KERNEL32 ref: 004C1074

Strings

c:\agent\_work\36\s\wix\src\burn\engine\engineforapplication.cpp, xrefs: 004C1098
Failed to post shutdown message., xrefs: 004C10A2

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post shutdown message.$c:\agent\_work\36\s\wix\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-3792247793
Opcode ID: b7cdb8eb2c3086acdbd07c5d4acacb7c15b446ff5ff67b62aff3d13866ed0071
Instruction ID: edf70be5a516005a7523f3f38e273b6891f7f671c6b35789d40b7b52416514b0
Opcode Fuzzy Hash: b7cdb8eb2c3086acdbd07c5d4acacb7c15b446ff5ff67b62aff3d13866ed0071
Instruction Fuzzy Hash: 7AF0EC37A416743793202A975C09F5B7B94AF01BA1F12402BFE44BF592E659DC0086EC

Function 004C238E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(004EE478,00000000,?,004C32E3,?,00000000,?,004ADF87,?,004A70CB,?,004B91E6,?,?,004A70CB,?), ref: 004C2398
GetLastError.KERNEL32(?,004C32E3,?,00000000,?,004ADF87,?,004A70CB,?,004B91E6,?,?,004A70CB,?,004A710B,00000001), ref: 004C23A2

Strings

c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp, xrefs: 004C23C6
Failed to set begin operation event., xrefs: 004C23D0

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$c:\agent\_work\36\s\wix\src\burn\engine\cabextract.cpp
API String ID: 3848097054-2329002262
Opcode ID: 4532ffa7645cae28c53d67d6408ca76487b76cd1c9ef300aa11c814264362304
Instruction ID: fcd786db3e6d3f208e1f0459b7a241d41406846c4a9afd7d1b1f08b925998597
Opcode Fuzzy Hash: 4532ffa7645cae28c53d67d6408ca76487b76cd1c9ef300aa11c814264362304
Instruction Fuzzy Hash: 8DF0EC379416B467925016A76E45F9B76988F10B62B01016FFE00FB361EADC9C0046ED

Function 004E12DC Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(C35F1C0A,?,00000000,0050B9F8), ref: 004E133F

Part of subcall function 004DCE00: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,004E0FB5,?,00000000,-00000008), ref: 004DCEAC

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 004E159A
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004E15E2
GetLastError.KERNEL32 ref: 004E1685

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 442cb40120a8a8eb1cef1e1d15af2c22786813acae27e4aff845f262cf0139eb
Instruction ID: e8aa09bd462188ef869b7b905338f2d9224fc463695deb414712c7b766bb9661
Opcode Fuzzy Hash: 442cb40120a8a8eb1cef1e1d15af2c22786813acae27e4aff845f262cf0139eb
Instruction Fuzzy Hash: 69D17BB5D002989FCF15CFA9D8809EDBBB5FF49304F18452AE816EB361D734A942CB54

Function 004A9133 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 004A913F
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 004A91A6

Strings

Failed to get value of variable: %ls, xrefs: 004A9179
Failed to get value as numeric for variable: %ls, xrefs: 004A9195

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as numeric for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-4270472870
Opcode ID: fd0677dd5ab0d1151fd62c4fd835c7edfa3f9fcf7e565066d338c74e2d7318a3
Instruction ID: 5e2170489b5c65fcc54d38890da39857835ab113e8832213bbda94b4ec21eb79
Opcode Fuzzy Hash: fd0677dd5ab0d1151fd62c4fd835c7edfa3f9fcf7e565066d338c74e2d7318a3
Instruction Fuzzy Hash: 1B01713294012AFBDF115F41CC09B9E7A68EF22765F104126FD04AA221C63E9E11A7DD

Function 004A92A2 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 004A92AE
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 004A9315

Strings

Failed to get value of variable: %ls, xrefs: 004A92E8
Failed to get value as version for variable: %ls, xrefs: 004A9304

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as version for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-1851729331
Opcode ID: c87d76d66f78b51ed8d39d71498241a949a3eed308bba9107a0a5ba1fe0b6cfb
Instruction ID: 53bbe483c36060e8fb52a18df8a0831fa1f9ddcfa0cb77f586a5a86ee6ff7f2b
Opcode Fuzzy Hash: c87d76d66f78b51ed8d39d71498241a949a3eed308bba9107a0a5ba1fe0b6cfb
Instruction Fuzzy Hash: 3601BC36941129FBCF225F41CC05B9E3B64AF21329F108126FD00AA261D73D9E10A7DC

Function 004AF19E Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,004B8C6F,000000B8,00000000,?,00000000,75C0B390), ref: 004AF1AD
LeaveCriticalSection.KERNEL32(000000D0,?,004B8C6F,000000B8,00000000,?,00000000,75C0B390), ref: 004AF1D0

Strings

c:\agent\_work\36\s\wix\src\burn\engine\userexperience.cpp, xrefs: 004AF1E9
Engine active cannot be changed because it was already in that state., xrefs: 004AF1F3

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine active cannot be changed because it was already in that state.$c:\agent\_work\36\s\wix\src\burn\engine\userexperience.cpp
API String ID: 3168844106-3237756853
Opcode ID: 78447127b4641512f516c00f60ec366342f13b86bf3f39bfc6a446477804433f
Instruction ID: 7a9240288c2b3084d9ea7ac587d2b3b1458ec15fac9bc8d6c8c761a04f2cebd0
Opcode Fuzzy Hash: 78447127b4641512f516c00f60ec366342f13b86bf3f39bfc6a446477804433f
Instruction Fuzzy Hash: A6F0A4373003056B97119EAADC80D97B3EDEFA5315710443FF905CB640EA78E90586A8

Function 004A9233 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000006,?,004AB599,00000000,?,00000000,00000000,00000000,?,004AB3DA,00000000,?,00000000,00000000), ref: 004A923F
LeaveCriticalSection.KERNEL32(00000000,00000000,00000000,00000000,?,004AB599,00000000,?,00000000,00000000,00000000,?,004AB3DA,00000000,?,00000000), ref: 004A9295

Strings

Failed to get value of variable: %ls, xrefs: 004A9265
Failed to copy value of variable: %ls, xrefs: 004A9284

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to copy value of variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-2936390398
Opcode ID: a79601ec227a92dae370f3eb8121fee7d9981b71f1cf8314788475e9dddaea2f
Instruction ID: b31a7e3b7533f081502a0b93ed1f20be174da68c2caca95dc834261520df2395
Opcode Fuzzy Hash: a79601ec227a92dae370f3eb8121fee7d9981b71f1cf8314788475e9dddaea2f
Instruction Fuzzy Hash: 17F08C36940168BBCF126F55CC05B9E7B68EF51359F008166FD05AA222C6399E109ADC

Function 004A51E5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 004A5248

Strings

wininet.dll, xrefs: 004A5206
crypt32.dll, xrefs: 004A5205, 004A5244, 004A5246

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: _memcpy_s
String ID: crypt32.dll$wininet.dll
API String ID: 2001391462-82500532
Opcode ID: 59fd57b86b399a8220e6a168d4e9898f202bf9281ac66c6c48f50d2de842fe61
Instruction ID: 7e12b82303d6958a3cbbe3d59284f40f220fa48b63a41008865bdb470d87e59d
Opcode Fuzzy Hash: 59fd57b86b399a8220e6a168d4e9898f202bf9281ac66c6c48f50d2de842fe61
Instruction Fuzzy Hash: 8E116072600619AFCF08DF59CDD5A9F7F69EF95294B14802AFC054B351D234E910CBE4

Function 004E8243 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004A582C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0050EBD4,00000000,?,004E8E2A,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 004A5840

RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,004E80E3,?), ref: 004E82B4

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 004E825E
EnableLUA, xrefs: 004E8286

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: CloseOpen
String ID: EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 47109696-3551287084
Opcode ID: 2de8c5b894267e29428ba1ae65ef923eb9cc49e9daee4476fc6ea624677a5120
Instruction ID: a6a406b3d0ddc6e0cdb2e17ec1807b2d60da6fb1a5c7a3151cc6605f99894b46
Opcode Fuzzy Hash: 2de8c5b894267e29428ba1ae65ef923eb9cc49e9daee4476fc6ea624677a5120
Instruction Fuzzy Hash: 1C01D432C00634FBDB10A7A2CC0ABDEFA78AF14762F2000AAA901B7151D7785E40D6D8

Function 004A821D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 004A822F

Part of subcall function 004E5CD2: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process2,?,?,?,?,004A7B69,00000000), ref: 004E5CE7
Part of subcall function 004E5CD2: GetProcAddress.KERNEL32(00000000), ref: 004E5CEE
Part of subcall function 004E5CD2: GetLastError.KERNEL32(?,?,?,?,004A7B69,00000000), ref: 004E5D09

Part of subcall function 004A799D: RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 004A7A23

Strings

Failed to set variant value., xrefs: 004A826C
Failed to get 64-bit folder., xrefs: 004A8252

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: AddressCloseCurrentErrorHandleLastModuleProcProcess
String ID: Failed to get 64-bit folder.$Failed to set variant value.
API String ID: 3109562764-2681622189
Opcode ID: e6e118bafa468d4331931407749f3d734fa912dafa86c5c7ccb9681eb6a40280
Instruction ID: 9ac6672a90a36290f8419b71d3693a1fbacb8774ec11d688346333cbeffdb076
Opcode Fuzzy Hash: e6e118bafa468d4331931407749f3d734fa912dafa86c5c7ccb9681eb6a40280
Instruction Fuzzy Hash: B801A272940668BBCF119B92CC45BEE7A68DF11765F21019BF440A6111EA789F409788

Function 004D039F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 004D0CC2

Part of subcall function 004D2ECD: RaiseException.KERNEL32(?,?,?,004D0CE4,?,00000000,00000000,?,?,?,?,?,004D0CE4,?,0050B5D0), ref: 004D2F2D

__CxxThrowException@8.LIBVCRUNTIME ref: 004D0CDF

Strings

Unknown exception, xrefs: 004D0CEC

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: b14482064faa82f71c8d5e6e009296d3395cd469ebb706782f1b44ac26948cd6
Instruction ID: 3c9a334837a3b3ae71e58bae27880eac6bd23f6d0683b88e6a83bc46e25b3ab5
Opcode Fuzzy Hash: b14482064faa82f71c8d5e6e009296d3395cd469ebb706782f1b44ac26948cd6
Instruction Fuzzy Hash: 6FF0F43490020C67CB04AAA6EC71A5E376CAB00704F50432BBD14C33D1EBB9EA0585DD

Function 004C03C9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004A2A4C: FormatMessageW.KERNEL32(004A5F55,004A7154,?,00000000,00000000,00000000,?,80070656,?,?,?,004C03E0,00000000,004A7154,00000000,80070656), ref: 004A2A7D
Part of subcall function 004A2A4C: GetLastError.KERNEL32(?,?,?,004C03E0,00000000,004A7154,00000000,80070656,?,TqJ,004B5D7A,TqJ,?,80070656,00000001,crypt32.dll), ref: 004A2A8A
Part of subcall function 004A2A4C: LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,004C03E0,00000000,004A7154,00000000,80070656,?,TqJ,004B5D7A,TqJ), ref: 004A2AD1

MessageBoxW.USER32(00000000,00000000,?,00001010), ref: 004C0417

Strings

TqJ, xrefs: 004C03C9
Failed to allocate string to display error message, xrefs: 004C03E9

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: Message$ErrorFormatFreeLastLocal
String ID: Failed to allocate string to display error message$TqJ
API String ID: 2195691534-267679178
Opcode ID: 85061685641d01d0dc30be25b9f149fd21079449d049cff6ecee047ed8f26199
Instruction ID: f5226ee6a71145ba9e2bdd62297e91118901bed5521352b6c78d1f4ec7c46cde
Opcode Fuzzy Hash: 85061685641d01d0dc30be25b9f149fd21079449d049cff6ecee047ed8f26199
Instruction Fuzzy Hash: 6CF08635540268FBCB699A80CD06FDF76649B01755F10402EFB0465151D67D8A41E79D

Function 004A40DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00000000,00000000,00000000,74DF34C0,?,?,?,004AD729,?,?,?,00000000,00000000), ref: 004A40F6
GetLastError.KERNEL32(?,?,?,004AD729,?,?,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 004A4100

Strings

c:\agent\_work\36\s\wix\src\libs\dutil\fileutil.cpp, xrefs: 004A4124

Memory Dump Source

Source File: 00000014.00000002.5111130535.00000000004A1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000014.00000002.5111074665.00000000004A0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111247731.00000000004EE000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111294695.000000000050E000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.5111329117.0000000000511000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4a0000_VC_redist.jbxd

Similarity

API ID: ErrorFileLastSize
String ID: c:\agent\_work\36\s\wix\src\libs\dutil\fileutil.cpp
API String ID: 464720113-1339450348
Opcode ID: 049007f95e886a88ca6ea9a21b0efc93778db23aea9a49dc805234715bb11d88
Instruction ID: 717984c25045d2f763871b09eca196fcddbc30e0a349651d09d4eacb21f8ff0f
Opcode Fuzzy Hash: 049007f95e886a88ca6ea9a21b0efc93778db23aea9a49dc805234715bb11d88
Instruction Fuzzy Hash: FBF0C8B6901235AB97104F49CD0999EFBACFFA5750F01411AFC44A7300E3B4AD40C7D9

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

52ca59.rbf (copy)

52ca5a.rbf (copy)

52ca5b.rbf (copy)

52ca60.rbf (copy)

52ca61.rbf (copy)

52ca62.rbf (copy)

52ca63.rbf (copy)

52ca69.rbf (copy)

52ca6b.rbf (copy)

52ca6c.rbf (copy)

52ca6d.rbf (copy)

52ca6e.rbf (copy)

52ca6f.rbf (copy)

52ca70.rbf (copy)

52ca71.rbf (copy)

52ca72.rbf (copy)

52ca73.rbf (copy)

52ca74.rbf (copy)

52ca7a.rbf (copy)

52ca7b.rbf (copy)

Windows Analysis Report
https://www.danielgm.net/cc/release/CloudCompare_v2.14.alpha_setup_x64.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre