Windows Analysis Report
https://update.microgate.it/optojump/optojumpnext.exe

Overview

General Information

Sample URL: https://update.microgate.it/optojump/optojumpnext.exe
Analysis ID: 1522627
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Drops large PE files
Installs new ROOT certificates
Sigma detected: New RUN Key Pointing to Suspicious Folder
Adds / modifies Windows certificates
Binary contains a suspicious time stamp
Checks for available system drives (often done to infect USB drives)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after checking a module file name)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Suspicious Execution From GUID Like Folder Names
Sigma detected: Usage Of Web Request Commands And Cmdlets
Stores large binary data to the registry
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe File created: C:\Users\user\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_20240930_074606050-MSI_vc_red.msi.txt
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\1033\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\1041\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\1042\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\1028\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\2052\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\1040\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\1036\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\1031\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\3082\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\1049\eula.rtf
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\EULA_ENU.rtf
Source: C:\Windows\System32\msiexec.exe File opened: C:\Windows\WinSxS\InstallTemp\20240930074613390.1\msvcr80.dll
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.dataaccess\p3da3de.pdb source: p3da3de.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\prompt_res_pt.pdb source: prompt_res_pt.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\u312fren.pdb source: u312fren.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\DTSagent.pdb source: dtsagent.dll.13.dr
Source: Binary string: sfxcab.pdb source: vcredist_x86.exe, 00000014.00000002.4720160753.0000000001002000.00000020.00000001.01000000.0000000A.sdmp, vcredist_x86.exe, 00000014.00000000.4617263282.0000000001002000.00000020.00000001.01000000.0000000A.sdmp
Source: Binary string: sqmapi.pdb source: Setup.exe, 00000015.00000002.4714455712.000000006F6F1000.00000020.00000001.01000000.0000000D.sdmp
Source: Binary string: SetupEngine.pdb source: Setup.exe, 00000015.00000002.4713504272.000000006BBE1000.00000020.00000001.01000000.0000000C.sdmp
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\crxf_pdf_res_sk.pdb source: crxf_pdf_res_sk.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.dataaccess\p3da3ru.pdb source: p3da3ru.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\x3frchu.pdb source: x3frchu.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\reportrenderer_res_en.pdb source: reportrenderer_res_en.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\u3lfres.pdb source: u3lfres.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\crxf_rtf_res_fi.pdb source: crxf_rtf_res_fi.dll.13.dr
Source: Binary string: h:\nt.obj.x86fre\base\wcp\tools\msmcustomaction\objfre\i386\msmcustomaction.pdb source: 4154ca.msi.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.dataaccess\p3dbtko.pdb source: p3dbtko.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\ParameterDesigner_res_zh_CN.pdb source: ParameterDesigner_res_zh_CN.dll.13.dr
Source: Binary string: C:\CodeBases\isdev\redist\Language Independent\i386\setupPreReq.pdb source: setup.exe, 0000000A.00000002.3776511882.0000000000B35000.00000002.00000001.01000000.00000007.sdmp, setup.exe, 0000000A.00000000.3716732649.0000000000B35000.00000002.00000001.01000000.00000007.sdmp, setup.exe, 0000000B.00000002.4744250125.0000000000815000.00000002.00000001.01000000.00000008.sdmp, setup.exe, 0000000B.00000000.3756341549.0000000000815000.00000002.00000001.01000000.00000008.sdmp, setup.exe, 0000000F.00000000.3948530982.0000000000B35000.00000002.00000001.01000000.00000007.sdmp, setup.exe, 00000012.00000002.4027587700.0000000000B35000.00000002.00000001.01000000.00000007.sdmp, setup.exe, 00000012.00000000.3963127945.0000000000B35000.00000002.00000001.01000000.00000007.sdmp, setup.exe, 00000013.00000002.4064250213.0000000000875000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000013.00000000.4010728428.0000000000875000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\crxf_rtf_res_en.pdb source: crxf_rtf_res_en.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\x3fsvit.pdb source: x3fsvit.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.dataaccess\crdb_adoplus_res_tr.pdb source: crdb_adoplus_res_tr.dll.13.dr
Source: Binary string: Setup.pdb source: Setup.exe, 00000015.00000002.4710518061.0000000000FF1000.00000020.00000001.01000000.0000000B.sdmp, Setup.exe, 00000015.00000000.4640088888.0000000000FF1000.00000020.00000001.01000000.0000000B.sdmp
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\u3ldtfr.pdb source: u3ldtfr.dll.13.dr
Source: Binary string: SetupResources.pdb source: SetupResources.dll8.20.dr
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z:
Source: C:\Windows\System32\msiexec.exe File opened: x:
Source: C:\Windows\System32\msiexec.exe File opened: v:
Source: C:\Windows\System32\msiexec.exe File opened: t:
Source: C:\Windows\System32\msiexec.exe File opened: r:
Source: C:\Windows\System32\msiexec.exe File opened: p:
Source: C:\Windows\System32\msiexec.exe File opened: n:
Source: C:\Windows\System32\msiexec.exe File opened: l:
Source: C:\Windows\System32\msiexec.exe File opened: j:
Source: C:\Windows\System32\msiexec.exe File opened: h:
Source: C:\Windows\System32\msiexec.exe File opened: f:
Source: C:\Windows\System32\msiexec.exe File opened: b:
Source: C:\Windows\System32\msiexec.exe File opened: y:
Source: C:\Windows\System32\msiexec.exe File opened: w:
Source: C:\Windows\System32\msiexec.exe File opened: u:
Source: C:\Windows\System32\msiexec.exe File opened: s:
Source: C:\Windows\System32\msiexec.exe File opened: q:
Source: C:\Windows\System32\msiexec.exe File opened: o:
Source: C:\Windows\System32\msiexec.exe File opened: m:
Source: C:\Windows\System32\msiexec.exe File opened: k:
Source: C:\Windows\System32\msiexec.exe File opened: i:
Source: C:\Windows\System32\msiexec.exe File opened: g:
Source: C:\Windows\System32\msiexec.exe File opened: e:
Source: C:\Windows\System32\msiexec.exe File opened: c:
Source: C:\Windows\System32\msiexec.exe File opened: a:
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_004014B7 wsprintfA,FindFirstFileA,FindClose, 9_2_004014B7
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_00404BA4 lstrcpyA,lstrcpyA,lstrcatA,lstrcatA,DeleteFileA,DeleteFileA,FindFirstFileA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,DeleteFileA,FindNextFileA,FindClose,lstrcpyA,lstrlenA,RemoveDirectoryA, 9_2_00404BA4
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AD168D __EH_prolog3_GS,_memset,GetTempPathW,FindFirstFileW,CompareFileTime,DeleteFileW,FindNextFileW, 10_2_00AD168D
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AE7E01 __EH_prolog3_GS,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,DeleteFileW, 10_2_00AE7E01
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007C7E01 __EH_prolog3_GS,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,DeleteFileW, 11_2_007C7E01
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007B168D __EH_prolog3_GS,_memset,GetTempPathW,FindFirstFileW,CompareFileTime,DeleteFileW,FindNextFileW, 11_2_007B168D
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AD168D __EH_prolog3_GS,_memset,GetTempPathW,FindFirstFileW,CompareFileTime,DeleteFileW,FindNextFileW, 15_2_00AD168D
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AE7E01 __EH_prolog3_GS,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,DeleteFileW, 15_2_00AE7E01
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AD168D __EH_prolog3_GS,_memset,GetTempPathW,FindFirstFileW,CompareFileTime,DeleteFileW,FindNextFileW, 18_2_00AD168D
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AE7E01 __EH_prolog3_GS,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,DeleteFileW, 18_2_00AE7E01
Source: C:\Users\user\Desktop\download\optojumpnext.exe File opened: C:\Users\user\AppData\Local\Temp\pftF363~tmp\ Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe File opened: C:\Users\user\AppData\Local\Temp\plfE613.tmp Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe File opened: C:\Users\user\ Jump to behavior
Source: u312fren.dll.13.dr, PrintControl_res_zh_CN.cab.13.dr, reportrenderer_res_en.dll.13.dr, dtsagent.dll.13.dr, u3ldtfr.dll.13.dr, crxf_rtf_res_fi.dll.13.dr, p3da3de.dll.13.dr, crxf_wordw_res_en.dll.13.dr, p3dbtko.dll.13.dr, crxf_rtf_res_en.dll.13.dr, crxf_pdf_res_sk.dll.13.dr, CrystalDecisions.Web.resources.dll7.13.dr, x3fsvit.dll.13.dr, ParameterDesigner_res_zh_CN.dll.13.dr, prompt_res_pt.dll.13.dr, p3da3ru.dll.13.dr, x3frchu.dll.13.dr, u3lfres.dll.13.dr, crdb_adoplus_res_tr.dll.13.dr String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Setup.exe, 00000015.00000003.4646527142.0000000001560000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4650331801.0000000002F70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://go.microsoft.
Source: Setup.exe, 00000015.00000003.4650937017.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4659920159.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4654482957.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4655826903.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4649641284.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4648140830.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4653273666.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4656053383.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4652247117.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4657314983.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4651994437.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4658562400.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4653464695.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4658361799.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4657105610.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4648283732.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4650735571.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4649441437.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4654670763.0000000001620000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000015.00000003.4660132574.0000000001620000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://go.microsoft.c
Source: u312fren.dll.13.dr, PrintControl_res_zh_CN.cab.13.dr, reportrenderer_res_en.dll.13.dr, dtsagent.dll.13.dr, u3ldtfr.dll.13.dr, crxf_rtf_res_fi.dll.13.dr, p3da3de.dll.13.dr, crxf_wordw_res_en.dll.13.dr, p3dbtko.dll.13.dr, crxf_rtf_res_en.dll.13.dr, crxf_pdf_res_sk.dll.13.dr, CrystalDecisions.Web.resources.dll7.13.dr, x3fsvit.dll.13.dr, ParameterDesigner_res_zh_CN.dll.13.dr, prompt_res_pt.dll.13.dr, p3da3ru.dll.13.dr, x3frchu.dll.13.dr, u3lfres.dll.13.dr, crdb_adoplus_res_tr.dll.13.dr String found in binary or memory: http://ocsp.thawte.com0
Source: setup.exe, 00000013.00000002.4064546490.0000000000FF4000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://saturn.installshield.com/devstudio/setuprequirements/sqlce35sp2/SSCERuntime_x64-ENU.msi
Source: setup.exe, 00000013.00000003.4017088826.00000000015D0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000013.00000003.4019306480.00000000015D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://saturn.installshield.com/is/prerequisites/Microsoft
Source: setup.exe, 00000013.00000003.4063946010.00000000015CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://saturn.installshield.com/is/prerequisites/microsoft
Source: 4154ca.msi.13.dr String found in binary or memory: http://support.businessobjects.com/ARPREADMEBOBJ_NAMEBusiness
Source: u312fren.dll.13.dr, PrintControl_res_zh_CN.cab.13.dr, reportrenderer_res_en.dll.13.dr, dtsagent.dll.13.dr, u3ldtfr.dll.13.dr, crxf_rtf_res_fi.dll.13.dr, p3da3de.dll.13.dr, crxf_wordw_res_en.dll.13.dr, p3dbtko.dll.13.dr, crxf_rtf_res_en.dll.13.dr, crxf_pdf_res_sk.dll.13.dr, CrystalDecisions.Web.resources.dll7.13.dr, x3fsvit.dll.13.dr, ParameterDesigner_res_zh_CN.dll.13.dr, prompt_res_pt.dll.13.dr, p3da3ru.dll.13.dr, x3frchu.dll.13.dr, u3lfres.dll.13.dr, crdb_adoplus_res_tr.dll.13.dr String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: u312fren.dll.13.dr, PrintControl_res_zh_CN.cab.13.dr, reportrenderer_res_en.dll.13.dr, dtsagent.dll.13.dr, u3ldtfr.dll.13.dr, crxf_rtf_res_fi.dll.13.dr, p3da3de.dll.13.dr, crxf_wordw_res_en.dll.13.dr, p3dbtko.dll.13.dr, crxf_rtf_res_en.dll.13.dr, crxf_pdf_res_sk.dll.13.dr, CrystalDecisions.Web.resources.dll7.13.dr, x3fsvit.dll.13.dr, ParameterDesigner_res_zh_CN.dll.13.dr, prompt_res_pt.dll.13.dr, p3da3ru.dll.13.dr, x3frchu.dll.13.dr, u3lfres.dll.13.dr, crdb_adoplus_res_tr.dll.13.dr String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: u312fren.dll.13.dr, PrintControl_res_zh_CN.cab.13.dr, reportrenderer_res_en.dll.13.dr, dtsagent.dll.13.dr, u3ldtfr.dll.13.dr, crxf_rtf_res_fi.dll.13.dr, p3da3de.dll.13.dr, crxf_wordw_res_en.dll.13.dr, p3dbtko.dll.13.dr, crxf_rtf_res_en.dll.13.dr, crxf_pdf_res_sk.dll.13.dr, CrystalDecisions.Web.resources.dll7.13.dr, x3fsvit.dll.13.dr, ParameterDesigner_res_zh_CN.dll.13.dr, prompt_res_pt.dll.13.dr, p3da3ru.dll.13.dr, x3frchu.dll.13.dr, u3lfres.dll.13.dr, crdb_adoplus_res_tr.dll.13.dr String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: Code39AzaleaRegular1.ttf.13.dr, Code39AzaleaWide3.ttf.13.dr, Code39AzaleaRegular2.ttf.13.dr String found in binary or memory: http://www.azalea.com
Source: CrystalDecisions.Web.resources.dll7.13.dr String found in binary or memory: http://www.businessobjects.com/ipl/default.asp?destination=PoweredByBusinessObjectslogo&language=EN
Source: setup.exe, setup.exe, 00000012.00000002.4027587700.0000000000B35000.00000002.00000001.01000000.00000007.sdmp, setup.exe, 00000012.00000000.3963127945.0000000000B35000.00000002.00000001.01000000.00000007.sdmp, setup.exe, 00000013.00000002.4064250213.0000000000875000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000013.00000000.4010728428.0000000000875000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d
Source: u312fren.dll.13.dr, PrintControl_res_zh_CN.cab.13.dr, reportrenderer_res_en.dll.13.dr, dtsagent.dll.13.dr, u3ldtfr.dll.13.dr, crxf_rtf_res_fi.dll.13.dr, p3da3de.dll.13.dr, crxf_wordw_res_en.dll.13.dr, p3dbtko.dll.13.dr, crxf_rtf_res_en.dll.13.dr, crxf_pdf_res_sk.dll.13.dr, CrystalDecisions.Web.resources.dll7.13.dr, x3fsvit.dll.13.dr, ParameterDesigner_res_zh_CN.dll.13.dr, prompt_res_pt.dll.13.dr, p3da3ru.dll.13.dr, x3frchu.dll.13.dr, u3lfres.dll.13.dr, crdb_adoplus_res_tr.dll.13.dr String found in binary or memory: http://www.sap.com0
Source: wget.exe, 00000002.00000002.3494877748.0000000000AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://update.microgate.it/optojump/optojumpnext.exe
Source: wget.exe, 00000002.00000003.3494619687.0000000002B6A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.3494982114.0000000002B6D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://update.microgate.it/optojump/optojumpnext.exeD
Source: wget.exe, 00000002.00000002.3494877748.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://update.microgate.it/optojump/optojumpnext.exeEO
Source: wget.exe, 00000002.00000002.3494877748.0000000000AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://update.microgate.it/optojump/optojumpnext.exeO
Source: wget.exe, 00000002.00000002.3494877748.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://update.microgate.it/optojump/optojumpnext.exeOCC
Source: wget.exe, 00000002.00000002.3494877748.0000000000AF5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://update.microgate.it/optojump/optojumpnext.exeto

System Summary
barindex
Drops large PE files
Source: C:\Windows\SysWOW64\wget.exe File dump: optojumpnext.exe.2.dr 263455292 Jump to dropped file
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00B0A45C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx, 10_2_00B0A45C
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007EA45C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx, 11_2_007EA45C
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00B0A45C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx, 15_2_00B0A45C
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00B0A45C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx, 18_2_00B0A45C
Creates files inside the system directory
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\4154ca.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI6267.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI62D5.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{4A10D640-13F1-4A13-BAD1-3E3790511B17} Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI6C5C.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451318.0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451318.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd.manifest Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451318.0\ATL80.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451318.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd.cat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451349.0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451349.0\8.0.50727.4053.cat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451349.0\8.0.50727.4053.policy Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451365.0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451365.0\msvcm80.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451365.0\msvcr80.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451365.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989.manifest Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451365.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989.cat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451365.0\msvcp80.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451474.0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451474.0\8.0.50727.4053.policy Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451474.0\8.0.50727.4053.cat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451490.0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451490.0\mfc80u.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451490.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e.cat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451490.0\mfcm80u.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451490.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e.manifest Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451490.0\mfc80.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451490.0\mfcm80.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.0\8.0.50727.4053.policy Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.0\8.0.50727.4053.cat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c.cat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80CHT.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80DEU.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80ESP.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c.manifest Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80ENU.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80CHS.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80ITA.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80FRA.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80JPN.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80KOR.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451756.0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451756.0\8.0.50727.4053.cat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451756.0\8.0.50727.4053.policy Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451771.0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451771.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e79c4723.cat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451771.0\vcomp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451771.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e79c4723.manifest Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451802.0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451802.0\8.0.50727.4053.cat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451802.0\8.0.50727.4053.policy Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\msvcr71.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\msvcp71.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\2ZQM54W9 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\2ZQM54W9\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\CS7YDD0W Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\CS7YDD0W\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\R5WHX29H Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\R5WHX29H\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\XWP3DVNZ Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\XWP3DVNZ\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\GZUMVK9D Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\GZUMVK9D\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\BFUG8TWT Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\BFUG8TWT\CrystalDecisions.ReportSource.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\AOPA0BQX Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\AOPA0BQX\CrystalDecisions.Shared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\J8QK6M3P Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\J8QK6M3P\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ZP2Y2ZJK Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ZP2Y2ZJK\CrystalDecisions.VSDesigner.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\FP6BNFUH Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\FP6BNFUH\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\JXBYBJ65 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\JXBYBJ65\CrystalDecisions.Web.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\MAU4NKYB Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\MAU4NKYB\CrystalDecisions.Windows.Forms.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\YB00TSL7 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\YB00TSL7\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\2W0MXMUJ Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\2W0MXMUJ\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\PUU3CUJD Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\PUU3CUJD\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4Q5PEM8P Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4Q5PEM8P\CrystalDecisions.ReportSource.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5Q78957S Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5Q78957S\CrystalDecisions.Shared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\UZ6MWTDP Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\UZ6MWTDP\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ROD5FRDX Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ROD5FRDX\CrystalDecisions.VSDesigner.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\PGVPZCZG Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\PGVPZCZG\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\UWK7THG6 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\UWK7THG6\CrystalDecisions.Web.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4W184EXT Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4W184EXT\CrystalDecisions.Windows.Forms.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\HW8U3FG6 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\HW8U3FG6\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\A2OG2MOW Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\A2OG2MOW\CrystalDecisions.ReportSource.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TEHOMAIV Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TEHOMAIV\CrystalDecisions.Shared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\HZ7D1KIO Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\HZ7D1KIO\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\XU5MHCJX Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\XU5MHCJX\CrystalDecisions.VSDesigner.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\V1SUYTKJ Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\V1SUYTKJ\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\DDU0R7DQ Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\DDU0R7DQ\CrystalDecisions.Web.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\94KTCR94 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\94KTCR94\CrystalDecisions.Windows.Forms.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\BIB90YD4 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\BIB90YD4\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1CKS4AMX Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1CKS4AMX\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\13S0U6AR Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\13S0U6AR\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\7CZXGZYM Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\7CZXGZYM\CrystalDecisions.ReportSource.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\VMEZVSED Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\VMEZVSED\CrystalDecisions.Shared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TKKJ6ZUV Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TKKJ6ZUV\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\QT2RWY2D Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\QT2RWY2D\CrystalDecisions.VSDesigner.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\2ZTAKVG3 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\2ZTAKVG3\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5CRZCV7K Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5CRZCV7K\CrystalDecisions.Web.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\8FDXG7H9 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\8FDXG7H9\CrystalDecisions.Windows.Forms.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\W5WARI3L Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\W5WARI3L\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\DSI3AZ9E Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\DSI3AZ9E\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\L8P4QM9N Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\L8P4QM9N\CrystalDecisions.Data.AdoDotNetInterop.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\3HY15T7I Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\3HY15T7I\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1T4IL8UR Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1T4IL8UR\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\LD3T68X8 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\LD3T68X8\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\BMXRJQCZ Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\BMXRJQCZ\CrystalDecisions.ReportSource.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\CD5M7MAG Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\CD5M7MAG\CrystalDecisions.Shared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\SPSEFXL9 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\SPSEFXL9\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\I4QW3CEV Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\I4QW3CEV\CrystalDecisions.VSDesigner.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\RG4F0JCM Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\RG4F0JCM\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\W2ZGPH3Q Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\W2ZGPH3Q\CrystalDecisions.Web.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\QMBNXHI2 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\QMBNXHI2\CrystalDecisions.Windows.Forms.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\C7SSKPR8 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\C7SSKPR8\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\25RQY8K1 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\25RQY8K1\CrystalDecisions.ReportSource.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\A0O7M7F3 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\A0O7M7F3\CrystalDecisions.Shared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\PLA4ZRXI Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\PLA4ZRXI\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\3M12KTOS Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\3M12KTOS\CrystalDecisions.VSDesigner.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5GC0E921 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5GC0E921\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\OKXS34X7 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\OKXS34X7\CrystalDecisions.Web.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4DVQWAVN Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4DVQWAVN\CrystalDecisions.Windows.Forms.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\IOY7IAUW Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\IOY7IAUW\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\LHA4ZL45 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\LHA4ZL45\CrystalDecisions.ReportSource.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\CF021TEE Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\CF021TEE\CrystalDecisions.Shared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\MZ32PGJ9 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\MZ32PGJ9\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\R9DU8YEO Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\R9DU8YEO\CrystalDecisions.VSDesigner.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\SCSFKCC2 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\SCSFKCC2\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\89XKOITC Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\89XKOITC\CrystalDecisions.Web.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\OMHCQ89T Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\OMHCQ89T\CrystalDecisions.Windows.Forms.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\7NXAF55T Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\7NXAF55T\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ELW9QFV0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ELW9QFV0\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\NIBV2Z0H Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\NIBV2Z0H\SAPBusinessObjects.WPF.Viewer.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\CKFTFLP8 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\CKFTFLP8\SAPBusinessObjects.WPF.ViewerShared.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\LAK3XT79 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\LAK3XT79\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\AR1KKX80 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\AR1KKX80\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\6GFRFF48 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\6GFRFF48\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\HN3U1S8A Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\HN3U1S8A\CrystalDecisions.ReportSource.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\OLJPE8JF Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\OLJPE8JF\CrystalDecisions.Shared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\500JZZ2V Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\500JZZ2V\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\2S7N8N72 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\2S7N8N72\CrystalDecisions.VSDesigner.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ZUV7L9XG Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ZUV7L9XG\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\GY1RAU4Q Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\GY1RAU4Q\CrystalDecisions.Web.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\GKGBKZ9G Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\GKGBKZ9G\CrystalDecisions.Windows.Forms.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\RHB73OA8 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\RHB73OA8\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\WYIXTXJ5 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\WYIXTXJ5\CrystalDecisions.ReportSource.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\OH33CV1O Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\OH33CV1O\CrystalDecisions.Shared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\EMFID46A Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\EMFID46A\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\90Z80RUV Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\90Z80RUV\CrystalDecisions.VSDesigner.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ENF1EFCR Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ENF1EFCR\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\OCZOYL0G Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\OCZOYL0G\CrystalDecisions.Web.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\3PZ3EP0V Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\3PZ3EP0V\CrystalDecisions.Windows.Forms.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\CSPYIF0J Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\CSPYIF0J\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\3RUR1KC3 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\3RUR1KC3\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\B0THVN5D Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\B0THVN5D\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\47AP810Y Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\47AP810Y\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\DBI6RIAR Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\DBI6RIAR\CrystalDecisions.CrystalReports.Engine.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\32GZOA1O Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\32GZOA1O\CrystalDecisions.CrystalReports.TemplateEngine.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\CAO5BCLT Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\CAO5BCLT\CrystalDecisions.Enterprise.Viewing.ReportSource.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\7J294QCD Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\7J294QCD\CrystalDecisions.ReportAppServer.ClientDoc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\PD9USU03 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\PD9USU03\CrystalDecisions.ReportAppServer.CommLayer.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\M48V42DK Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\M48V42DK\CrystalDecisions.ReportAppServer.CommonControls.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4EMXFIJW Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4EMXFIJW\CrystalDecisions.ReportAppServer.CommonObjectModel.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\I6B7UV3I Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\I6B7UV3I\CrystalDecisions.ReportAppServer.Controllers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\LX5X0FTG Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\LX5X0FTG\CrystalDecisions.ReportAppServer.CubeDefModel.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TH63W2H7 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TH63W2H7\CrystalDecisions.ReportAppServer.DataDefModel.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4AGX0JH5 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4AGX0JH5\CrystalDecisions.ReportAppServer.DataSetConversion.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4AJSKH13 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4AJSKH13\CrystalDecisions.ReportAppServer.ObjectFactory.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\M9Z0CZ2J Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\M9Z0CZ2J\CrystalDecisions.ReportAppServer.Prompting.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\82L4AQMR Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\82L4AQMR\CrystalDecisions.ReportAppServer.ReportDefModel.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1XYR0F81 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1XYR0F81\CrystalDecisions.ReportAppServer.XmlSerialize.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\83F1VE8Q Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\83F1VE8Q\CrystalDecisions.ReportSource.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5HIHY4WY Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5HIHY4WY\CrystalDecisions.Shared.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4AGS2FQA Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4AGS2FQA\CrystalDecisions.Web.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1MKXI5WK Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1MKXI5WK\CrystalDecisions.Windows.Forms.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\I33UODHT Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\I33UODHT\FlashControlV71.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ZVYCS3MV Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ZVYCS3MV\ShockwaveFlashObjects.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\CKUB02IX Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\CKUB02IX\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\SNTZXQOT Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\SNTZXQOT\CrystalDecisions.ReportSource.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\UBS9JMWP Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\UBS9JMWP\CrystalDecisions.Shared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\6P158FLG Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\6P158FLG\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\IHBATNLV Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\IHBATNLV\CrystalDecisions.VSDesigner.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ZM513EK9 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ZM513EK9\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TVDEAF2R Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TVDEAF2R\CrystalDecisions.Web.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\3GW8YO88 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\3GW8YO88\CrystalDecisions.Windows.Forms.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\W7Q0HZGX Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\W7Q0HZGX\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\30N3WX19 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\30N3WX19\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1AELXKO8 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1AELXKO8\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\X6A06IXJ Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\X6A06IXJ\CrystalDecisions.ReportSource.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TVG5ATTP Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TVG5ATTP\CrystalDecisions.Shared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\I1TPN99T Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\I1TPN99T\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\XZ3MQY35 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\XZ3MQY35\CrystalDecisions.VSDesigner.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\2K4E0C4U Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\2K4E0C4U\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1LOQFF02 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1LOQFF02\CrystalDecisions.Web.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\GEP0GRHP Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\GEP0GRHP\CrystalDecisions.Windows.Forms.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\DX882I59 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\DX882I59\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\EMB0YI5C Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\EMB0YI5C\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\BPRF5OW4 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\BPRF5OW4\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ZYNEE3D7 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ZYNEE3D7\CrystalDecisions.ReportSource.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\IW0B00FS Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\IW0B00FS\CrystalDecisions.Shared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\Y8KR065E Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\Y8KR065E\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\WB6G0Y3X Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\WB6G0Y3X\CrystalDecisions.VSDesigner.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\SUJDWFDT Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\SUJDWFDT\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5MAPX3H3 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5MAPX3H3\CrystalDecisions.Web.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\XCQLWY24 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\XCQLWY24\CrystalDecisions.Windows.Forms.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\L3YZHJ6M Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\L3YZHJ6M\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\04EPIMFS Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\04EPIMFS\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TCQAAL8A Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TCQAAL8A\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\T76IREKO Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\T76IREKO\CrystalDecisions.ReportSource.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\7V40OPR0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\7V40OPR0\CrystalDecisions.Shared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TUU5W1JN Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TUU5W1JN\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\EAYEYQTD Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\EAYEYQTD\CrystalDecisions.VSDesigner.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\FAPUGZ0V Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\FAPUGZ0V\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\LT7D5TSW Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\LT7D5TSW\CrystalDecisions.Web.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5SE3X7ON Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5SE3X7ON\CrystalDecisions.Windows.Forms.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\716D6ZOR Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\716D6ZOR\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\HNRJ4BDW Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\HNRJ4BDW\CrystalDecisions.ReportSource.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\GACLock.dat Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\MAVVA0FX Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\MAVVA0FX\CrystalDecisions.Shared.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\YRD2FLCK Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\YRD2FLCK\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\SAWDPFMU Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\SAWDPFMU\CrystalDecisions.VSDesigner.resources.dll Jump to behavior
Deletes files inside the Windows folder
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\MSI6267.tmp Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_004105DD 9_2_004105DD
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_0040FE4E 9_2_0040FE4E
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_0040CE7F 9_2_0040CE7F
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00B10090 10_2_00B10090
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00B1C170 10_2_00B1C170
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AFC537 10_2_00AFC537
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AC8829 10_2_00AC8829
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AFCE51 10_2_00AFCE51
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AA9300 10_2_00AA9300
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00B017B5 10_2_00B017B5
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AA9740 10_2_00AA9740
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AA9A30 10_2_00AA9A30
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00B01D25 10_2_00B01D25
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00B02295 10_2_00B02295
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AA6C00 10_2_00AA6C00
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00B03095 10_2_00B03095
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AA7322 10_2_00AA7322
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AF75B3 10_2_00AF75B3
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AA7575 10_2_00AA7575
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00B03811 10_2_00B03811
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AFF986 10_2_00AFF986
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007A8829 11_2_007A8829
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007F0090 11_2_007F0090
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007FC170 11_2_007FC170
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007DC537 11_2_007DC537
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007DCE51 11_2_007DCE51
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_00789300 11_2_00789300
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_00789740 11_2_00789740
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007E17B5 11_2_007E17B5
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_00789A30 11_2_00789A30
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007E1D25 11_2_007E1D25
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007E2295 11_2_007E2295
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_00786C00 11_2_00786C00
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007E3095 11_2_007E3095
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_00787322 11_2_00787322
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_00787575 11_2_00787575
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007D75B3 11_2_007D75B3
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007E3811 11_2_007E3811
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007DF986 11_2_007DF986
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00B10090 15_2_00B10090
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00B1C170 15_2_00B1C170
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AFC537 15_2_00AFC537
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AC8829 15_2_00AC8829
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AFCE51 15_2_00AFCE51
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AA9300 15_2_00AA9300
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00B017B5 15_2_00B017B5
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AA9740 15_2_00AA9740
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AA9A30 15_2_00AA9A30
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00B01D25 15_2_00B01D25
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00B02295 15_2_00B02295
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AA6C00 15_2_00AA6C00
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00B03095 15_2_00B03095
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AA7322 15_2_00AA7322
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AF75B3 15_2_00AF75B3
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AA7575 15_2_00AA7575
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00B03811 15_2_00B03811
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AFF986 15_2_00AFF986
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00B10090 18_2_00B10090
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00B1C170 18_2_00B1C170
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AFC537 18_2_00AFC537
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AC8829 18_2_00AC8829
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AFCE51 18_2_00AFCE51
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AA9300 18_2_00AA9300
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00B017B5 18_2_00B017B5
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AA9740 18_2_00AA9740
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AA9A30 18_2_00AA9A30
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00B01D25 18_2_00B01D25
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00B02295 18_2_00B02295
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AA6C00 18_2_00AA6C00
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00B03095 18_2_00B03095
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AA7322 18_2_00AA7322
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AF75B3 18_2_00AF75B3
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AA7575 18_2_00AA7575
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00B03811 18_2_00B03811
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AFF986 18_2_00AFF986
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AF7010 appears 102 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AA1410 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AECDA9 appears 71 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AF7A15 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AF4216 appears 1103 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AF42B5 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AA1070 appears 63 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AA3920 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AF2B96 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AF4249 appears 1146 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AFF4CE appears 51 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AB6E87 appears 63 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AB0A27 appears 194 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AF2F86 appears 171 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AF2E67 appears 91 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AAC6A3 appears 324 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AF427F appears 291 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AA25E0 appears 1368 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AF2E39 appears 126 times
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: String function: 00AB1233 appears 126 times
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: String function: 007825E0 appears 457 times
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: String function: 007D7010 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: String function: 00791233 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: String function: 0078C6A3 appears 112 times
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: String function: 007D4216 appears 367 times
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: String function: 007D4249 appears 383 times
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: String function: 007D427F appears 97 times
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: String function: 007D2E39 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: String function: 00790A27 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: String function: 007D2F86 appears 57 times
PE file contains executable resources (Code or Archives)
Source: _is402B..dll.11.dr Static PE information: Resource name: None type: DOS executable (COM)
Source: crdb_ado_res_it.dll.13.dr Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
PE file does not import any functions
Source: crdb_p2s_res_sk.dll.13.dr Static PE information: No import functions for PE file found
Source: p3sifit.dll.13.dr Static PE information: No import functions for PE file found
Source: x3dptcs.dll.13.dr Static PE information: No import functions for PE file found
Source: x3fsvit.dll.13.dr Static PE information: No import functions for PE file found
Source: u312dtsv.dll.13.dr Static PE information: No import functions for PE file found
Source: p3sifnb.dll.13.dr Static PE information: No import functions for PE file found
Source: u3lfrsv.dll.13.dr Static PE information: No import functions for PE file found
Source: crdb_dao_res_sk.dll.13.dr Static PE information: No import functions for PE file found
Source: x3dntes.dll.13.dr Static PE information: No import functions for PE file found
Source: crdb_dictionary_res_sk.dll.13.dr Static PE information: No import functions for PE file found
Source: p3tbten.dll.13.dr Static PE information: No import functions for PE file found
Source: x3fcrzh_TW.dll.13.dr Static PE information: No import functions for PE file found
Source: x3dpthu.dll.13.dr Static PE information: No import functions for PE file found
Source: x3dvmfi.dll.13.dr Static PE information: No import functions for PE file found
Source: crxf_pdf_res_da.dll.13.dr Static PE information: No import functions for PE file found
Source: crxf_xls_res_fr.dll.13.dr Static PE information: No import functions for PE file found
Source: crdb_pc_res_sk.dll.13.dr Static PE information: No import functions for PE file found
Source: u31220sv.dll.13.dr Static PE information: No import functions for PE file found
Source: x3ftxja.dll.13.dr Static PE information: No import functions for PE file found
Source: crdb_query_res_sk.dll.13.dr Static PE information: No import functions for PE file found
Source: ParameterDesigner_res_pt.dll.13.dr Static PE information: No import functions for PE file found
Source: crdb_adoplus_res_nl.dll.13.dr Static PE information: No import functions for PE file found
Source: crxf_html_res_th.dll.13.dr Static PE information: No import functions for PE file found
Source: p3dbezh_TW.dll.13.dr Static PE information: No import functions for PE file found
Source: x3frdtr.dll.13.dr Static PE information: No import functions for PE file found
Source: PrintControl_res_zh_CN.dll.13.dr Static PE information: No import functions for PE file found
Source: x3dmpen.dll.13.dr Static PE information: No import functions for PE file found
Source: p3soupt.dll.13.dr Static PE information: No import functions for PE file found
Source: querybuilder_res_de.dll.13.dr Static PE information: No import functions for PE file found
Source: x3dptpl.dll.13.dr Static PE information: No import functions for PE file found
Source: x3dvmzh_CN.dll.13.dr Static PE information: No import functions for PE file found
Source: x3ftxzh_TW.dll.13.dr Static PE information: No import functions for PE file found
Source: u312sasv.dll.13.dr Static PE information: No import functions for PE file found
Source: u3520sv.dll.13.dr Static PE information: No import functions for PE file found
Source: x3frdcs.dll.13.dr Static PE information: No import functions for PE file found
Source: crdb_ado_res_zh_TW.dll.13.dr Static PE information: No import functions for PE file found
Source: x3fxm2hu.dll.13.dr Static PE information: No import functions for PE file found
Source: p3ssten.dll.13.dr Static PE information: No import functions for PE file found
Source: u312frsv.dll.13.dr Static PE information: No import functions for PE file found
Source: u3l20sv.dll.13.dr Static PE information: No import functions for PE file found
Source: crdb_odbc_res_tr.dll.13.dr Static PE information: No import functions for PE file found
Source: sscsdk80_res_nl.dll.13.dr Static PE information: No import functions for PE file found
Source: u3ldtsv.dll.13.dr Static PE information: No import functions for PE file found
Source: crxf_xls_res_de.dll.13.dr Static PE information: No import functions for PE file found
Source: ParameterDesigner_res_zh_CN.dll.13.dr Static PE information: No import functions for PE file found
Source: crdb_adoplus_res_it.dll.13.dr Static PE information: No import functions for PE file found
Source: crxf_rtf_res_cs.dll.13.dr Static PE information: No import functions for PE file found
Source: x3frdzh_TW.dll.13.dr Static PE information: No import functions for PE file found
Source: crxf_rtf_res_fi.dll.13.dr Static PE information: No import functions for PE file found
Source: crpe32_res_sv.dll.13.dr Static PE information: No import functions for PE file found
Source: p3dbten.dll.13.dr Static PE information: No import functions for PE file found
Source: x3ftxnb.dll.13.dr Static PE information: No import functions for PE file found
Source: crdb_ado_res_it.dll.13.dr Static PE information: No import functions for PE file found
Source: crxf_wordw_res_sk.dll.13.dr Static PE information: No import functions for PE file found
Source: x3dmppl.dll.13.dr Static PE information: No import functions for PE file found
Source: p3sifes.dll.13.dr Static PE information: No import functions for PE file found
Source: csprintdlg_res_zh_CN.dll.13.dr Static PE information: No import functions for PE file found
Source: CrystalDecisions.Web.resources.dll.13.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal52.evad.win@29/1188@0/1
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_004021D1 GetLastError,FormatMessageA, 9_2_004021D1
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00B0A45C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx, 10_2_00B0A45C
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007EA45C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx, 11_2_007EA45C
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00B0A45C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx, 15_2_00B0A45C
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00B0A45C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx, 18_2_00B0A45C
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_00405723 GetModuleHandleA,GetProcAddress,lstrcpyA,lstrcatA,GetDiskFreeSpaceExA,GetLastError,GetDiskFreeSpaceA, 9_2_00405723
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AD8BBA CoCreateInstance, 10_2_00AD8BBA
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_004051E5 GetModuleHandleA,FindResourceA,LoadResource,SizeofResource,LockResource, 9_2_004051E5
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\Desktop\cmdline.out Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3484:120:WilError_03
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\VC_Redist_SetupMutex
Source: C:\Users\user\Desktop\download\optojumpnext.exe File created: C:\Users\user\AppData\Local\Temp\plfE613.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: runfromtemp 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: eprq 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: debuglog 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Setup.cpp 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: reboot 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Setup.cpp 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Setup.cpp 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: %s%s 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: tempdisk1folder 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: ISSetup.dll 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: ISSetup.dll 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Skin 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Startup 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: setup.isn 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Supported 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Languages 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: %s\%s.ini 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: %s\%s.ini 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: %s\%.04ld.mst 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: %s\%.04ld.mst 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Setup.cpp 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: clone_wait 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Setup.cpp 10_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: runfromtemp 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: eprq 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: debuglog 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: Setup.cpp 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: reboot 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: Setup.cpp 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: Setup.cpp 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: %s%s 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: tempdisk1folder 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: ISSetup.dll 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: ISSetup.dll 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: Skin 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: Startup 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: setup.isn 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: Supported 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: Languages 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: %s\%s.ini 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: %s\%s.ini 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: %s\%.04ld.mst 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: %s\%.04ld.mst 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: Setup.cpp 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: clone_wait 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Command line argument: Setup.cpp 11_2_007C2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: runfromtemp 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: eprq 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: debuglog 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Setup.cpp 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: reboot 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Setup.cpp 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Setup.cpp 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: %s%s 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: tempdisk1folder 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: ISSetup.dll 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: ISSetup.dll 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Skin 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Startup 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: setup.isn 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Supported 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Languages 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: %s\%s.ini 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: %s\%s.ini 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: %s\%.04ld.mst 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: %s\%.04ld.mst 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Setup.cpp 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: clone_wait 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Setup.cpp 15_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: runfromtemp 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: eprq 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: debuglog 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Setup.cpp 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: reboot 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Setup.cpp 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Setup.cpp 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: %s%s 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: tempdisk1folder 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: ISSetup.dll 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: ISSetup.dll 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Skin 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Startup 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: setup.isn 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Supported 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Languages 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: %s\%s.ini 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: %s\%s.ini 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: %s\%.04ld.mst 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: %s\%.04ld.mst 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Setup.cpp 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: clone_wait 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Command line argument: Setup.cpp 18_2_00AE2355
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe File read: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\_ISMSIDEL.INI Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: setup.exe, 00000013.00000003.4013207345.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000013.00000003.4013024278.00000000015D5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000013.00000003.4013128967.00000000015D5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Select the language for the installation from the choices below.30] ;Spport
Source: setup.exe, 0000000B.00000003.3758423834.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000003.3758455189.000000000160E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000003.3758511705.0000000001610000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Select the language for this installation from the choices below.+[;
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://update.microgate.it/optojump/optojumpnext.exe" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://update.microgate.it/optojump/optojumpnext.exe"
Source: unknown Process created: C:\Users\user\Desktop\download\optojumpnext.exe "C:\Users\user\Desktop\download\optojumpnext.exe"
Source: C:\Users\user\Desktop\download\optojumpnext.exe Process created: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe "C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe"
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Process created: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe /q"C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe" /tempdisk1folder"C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}" /IS_temp
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{a0689fe9-3467-4d73-bc25-d0f696ad268a}\CRRuntime_32bit_13_0_10.msi" /qn /norestart
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 80DCE7E404A3D2C744ABC8DE5968C142
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe "C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe "C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe"
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Process created: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe /q"C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe" /tempdisk1folder"C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}" /IS_temp
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process created: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe "C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe" /q
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Process created: C:\1adc35b2a430ffb6f8fdcb\Setup.exe c:\1adc35b2a430ffb6f8fdcb\Setup.exe /q
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{B1165B38-CA52-11E0-A63D-7C004824019B}\SSCERuntime_x86-ENU.msi" /q /norestart
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1AA463F152CC7C817FC4EBBAEC5BC88D
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 2150726FCB1B5064F395F524C5BCA25E E Global\MSI0000
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://update.microgate.it/optojump/optojumpnext.exe" Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Process created: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe "C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Process created: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe /q"C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe" /tempdisk1folder"C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}" /IS_temp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{a0689fe9-3467-4d73-bc25-d0f696ad268a}\CRRuntime_32bit_13_0_10.msi" /qn /norestart Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process created: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe "C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe" /q Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{B1165B38-CA52-11E0-A63D-7C004824019B}\SSCERuntime_x86-ENU.msi" /q /norestart Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 80DCE7E404A3D2C744ABC8DE5968C142 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Process created: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe /q"C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe" /tempdisk1folder"C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}" /IS_temp
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Process created: C:\1adc35b2a430ffb6f8fdcb\Setup.exe c:\1adc35b2a430ffb6f8fdcb\Setup.exe /q
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1AA463F152CC7C817FC4EBBAEC5BC88D
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 2150726FCB1B5064F395F524C5BCA25E E Global\MSI0000
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: acgenral.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: msacm32.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: lz32.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: riched32.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: acgenral.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: msacm32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: acgenral.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: msacm32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: msi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: odbc32.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: clusapi.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Section loaded: feclient.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: apphelp.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: acgenral.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: uxtheme.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: winmm.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: samcli.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msacm32.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: version.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: userenv.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: dwmapi.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: urlmon.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: mpr.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: sspicli.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: winmmbase.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: winmmbase.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: iertutil.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: srvcli.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: netutils.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: aclayers.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: sfc.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: sfc_os.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: setupengine.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msi.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: winhttp.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: secur32.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: sqmapi.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msasn1.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: windows.storage.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: wldp.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: profapi.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: ntmarta.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: kernel.appcore.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msxml3.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msxml3.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msxml3.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msxml3.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msxml3.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msxml3.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msxml3.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msxml3.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msxml3.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msxml3.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msxml3.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msxml3.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msxml3.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msxml3.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: cryptsp.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: rsaenh.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: cryptbase.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: gpapi.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: msisip.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: srpapi.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: tsappcmp.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: netapi32.dll
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sxs.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msxml3.dll
Source: C:\Windows\SysWOW64\wget.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe File written: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\_ISMSIDEL.INI Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Automated click: Install
Source: C:\Users\user\Desktop\download\optojumpnext.exe File opened: C:\Windows\SysWOW64\RICHED32.DLL Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\msiexec.exe File opened: C:\Windows\WinSxS\InstallTemp\20240930074613390.1\msvcr80.dll
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.dataaccess\p3da3de.pdb source: p3da3de.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\prompt_res_pt.pdb source: prompt_res_pt.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\u312fren.pdb source: u312fren.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\DTSagent.pdb source: dtsagent.dll.13.dr
Source: Binary string: sfxcab.pdb source: vcredist_x86.exe, 00000014.00000002.4720160753.0000000001002000.00000020.00000001.01000000.0000000A.sdmp, vcredist_x86.exe, 00000014.00000000.4617263282.0000000001002000.00000020.00000001.01000000.0000000A.sdmp
Source: Binary string: sqmapi.pdb source: Setup.exe, 00000015.00000002.4714455712.000000006F6F1000.00000020.00000001.01000000.0000000D.sdmp
Source: Binary string: SetupEngine.pdb source: Setup.exe, 00000015.00000002.4713504272.000000006BBE1000.00000020.00000001.01000000.0000000C.sdmp
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\crxf_pdf_res_sk.pdb source: crxf_pdf_res_sk.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.dataaccess\p3da3ru.pdb source: p3da3ru.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\x3frchu.pdb source: x3frchu.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\reportrenderer_res_en.pdb source: reportrenderer_res_en.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\u3lfres.pdb source: u3lfres.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\crxf_rtf_res_fi.pdb source: crxf_rtf_res_fi.dll.13.dr
Source: Binary string: h:\nt.obj.x86fre\base\wcp\tools\msmcustomaction\objfre\i386\msmcustomaction.pdb source: 4154ca.msi.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.dataaccess\p3dbtko.pdb source: p3dbtko.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\ParameterDesigner_res_zh_CN.pdb source: ParameterDesigner_res_zh_CN.dll.13.dr
Source: Binary string: C:\CodeBases\isdev\redist\Language Independent\i386\setupPreReq.pdb source: setup.exe, 0000000A.00000002.3776511882.0000000000B35000.00000002.00000001.01000000.00000007.sdmp, setup.exe, 0000000A.00000000.3716732649.0000000000B35000.00000002.00000001.01000000.00000007.sdmp, setup.exe, 0000000B.00000002.4744250125.0000000000815000.00000002.00000001.01000000.00000008.sdmp, setup.exe, 0000000B.00000000.3756341549.0000000000815000.00000002.00000001.01000000.00000008.sdmp, setup.exe, 0000000F.00000000.3948530982.0000000000B35000.00000002.00000001.01000000.00000007.sdmp, setup.exe, 00000012.00000002.4027587700.0000000000B35000.00000002.00000001.01000000.00000007.sdmp, setup.exe, 00000012.00000000.3963127945.0000000000B35000.00000002.00000001.01000000.00000007.sdmp, setup.exe, 00000013.00000002.4064250213.0000000000875000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000013.00000000.4010728428.0000000000875000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\crxf_rtf_res_en.pdb source: crxf_rtf_res_en.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\x3fsvit.pdb source: x3fsvit.dll.13.dr
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.dataaccess\crdb_adoplus_res_tr.pdb source: crdb_adoplus_res_tr.dll.13.dr
Source: Binary string: Setup.pdb source: Setup.exe, 00000015.00000002.4710518061.0000000000FF1000.00000020.00000001.01000000.0000000B.sdmp, Setup.exe, 00000015.00000000.4640088888.0000000000FF1000.00000020.00000001.01000000.0000000B.sdmp
Source: Binary string: d:\Cortez_REL\win32_x86\release\pdb\crystalreports.cpp\u3ldtfr.pdb source: u3ldtfr.dll.13.dr
Source: Binary string: SetupResources.pdb source: SetupResources.dll8.20.dr
Binary contains a suspicious time stamp
Source: _is402B..dll.11.dr Static PE information: 0xC43EA530 [Tue May 1 22:37:36 2074 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_0040C84D LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 9_2_0040C84D
PE file contains sections with non-standard names
Source: dotNetFx40_Full_x86_x64.exe.9.dr Static PE information: section name: .boxld01
Source: crdb_dictionary.dll.13.dr Static PE information: section name: _CODE
Source: smagentapi.dll.13.dr Static PE information: section name: .data1
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_00407C60 push eax; ret 9_2_00407C8E
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_004083D8 push eax; ret 9_2_004083F6
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AF41E4 push ecx; ret 10_2_00AF41F7
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AF7055 push ecx; ret 10_2_00AF7068
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007D41E4 push ecx; ret 11_2_007D41F7
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007D7055 push ecx; ret 11_2_007D7068
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AF41E4 push ecx; ret 15_2_00AF41F7
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AF7055 push ecx; ret 15_2_00AF7068
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AF41E4 push ecx; ret 18_2_00AF41F7
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AF7055 push ecx; ret 18_2_00AF7068
Source: CrystalDecisions.Web.resources.dll.13.dr Static PE information: section name: .text entropy: 7.396506405192319
Source: CrystalDecisions.Web.resources.dll0.13.dr Static PE information: section name: .text entropy: 7.008201733948729

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419 Blob
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419 Blob
Drops PE files
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fsvsk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3ddkfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\P2soutlk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_cdo_res_pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbezh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35dtja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\7CZXGZYM\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_rtf_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\3GW8YO88\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dmpen.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_query_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\2K4E0C4U\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle_res_fi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3souen.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fodpt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_odbc_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fodnb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\implode.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sifes.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\40ENG36U\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\BCM-4-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\c2d6dtcs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u2frdef.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TNK35R5B\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3ra3zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\smcommonutil.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\8FDXG7H9\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p2iract3.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3siftr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_db2cli_res_pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\C4FDATMH\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\PGVPZCZG\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\94KTCR94\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_adoplus_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle_res_tr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3tbtit.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\dtsagentd_res_tr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\dtsagentd_res_ru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\csprintdlg_res_zh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\saxserialize_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312dtfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_pc_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sousv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\rptdefmodel_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crqe_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35s1sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3tbthu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3tbtpt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\commonobjmodel_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\saxmlserialize_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\SWAQSL4E\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\pageobjectmodel_res_fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxmzh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\X6A06IXJ\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sscsdk80.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3ftxnb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_adoplus_res_cs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3da3zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312dtpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\0S4IETS5\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\PrintControl_res_zh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\pageobjectmodel_res_pl.dll Jump to dropped file
Source: C:\Users\user\Desktop\download\optojumpnext.exe File created: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\AOPA0BQX\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u2ftext.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\dtsagentd_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbthu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\PrintControl_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4JWH5PWK\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frcfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\PrintControl_res_th.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe File created: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_fielddef.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\clientdoc_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\85KLLAB2\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crpe32_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35s1pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312frda.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3520en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\UZ6MWTDP\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbezh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u25azalea.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crqe_res_ko.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbten.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_rtf_res_cs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sscsdk80_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dntes.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3l20da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3soupt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_html_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u2fxml.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_db2cli_res_fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\9NFPM341\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_fielddef_res_ru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\V1SUYTKJ\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\localcon_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312fren.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3lfrpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_ado_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbeen.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\PrintControl_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\querybuilder_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1LOQFF02\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_xls_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\csprintdlg_res_zh_TW.dll Jump to dropped file
Source: C:\Users\user\Desktop\download\optojumpnext.exe File created: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35s1fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312dtsv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\I1TPN99T\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\E4QRLP5W\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_wordw_res_nb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_com_res_pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\pageobjectmodel_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p2bact3.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dao_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dvmfi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3ra3fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_cdo_res_ko.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\libpng10.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_ado_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\csprintdlg_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sifzh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_fielddef_res_cs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dvmpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_html_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\rptdefmodel_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ZP2Y2ZJK\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_ado_res_fi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3ldtda.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\csprintdlg_res_fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4Q5PEM8P\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1AELXKO8\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_adoplus_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3ra3pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\localcon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sifsv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_cdo_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\AKDCDDJJ\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dictionary.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\cubedefmodel_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35s1ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dao_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxm2ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\localcon_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3520da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\XU5MHCJX\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\reportrenderer_res_pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_wordw_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\c2d6dtit.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_cdo_res_zh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\DX882I59\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sscsdk80_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5Q78957S\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_pdf_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\csprintdlg_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_com_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\ParameterDesigner_res_zh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\K94G2QYW\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dictionary_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sacommoncontrols_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312dtda.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3ra3nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1CKS4AMX\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_FileSystem_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxmcs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sacommlayer_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sstzh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fsvfi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fsvzh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\prompt_res_zh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_cdo_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\UWK7THG6\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dictionary_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312saen.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_pc_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frchu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TKKJ6ZUV\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\W5WARI3L\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dao.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_rtf_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sifen.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_pdf_res_ru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\pageobjectmodel_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxm2en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\requestmodel_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle_res_pt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\IIGQ9HG8\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_query_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_FileSystem_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_FileSystem_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_wordw_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fodnl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\smagentapi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_com_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\PUU3CUJD\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312frpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\csprintdlg_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35dtpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_xls_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\FWSCSB2G\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dictionary_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\datadefmodel_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\rptcontrollers_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_xls_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5H81AJBH\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3tbten.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\csprintdlg_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\S4690VQP\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\Xalan-C_1_10.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312sada.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dberu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\csprintdlg_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sousk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crpe32_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fodde.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3l20pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\querybuilder_res_ru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dptcs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3siffi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3lfrja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\dtsagent.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\JXBYBJ65\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_cdo_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_pc.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbtfi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\YY1KAYSV\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_rtf_res_fi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3520pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\A2OG2MOW\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dataset_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_com_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxmth.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u31220en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_odbc_res_pt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxm2fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\XalanMessages_1_10.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\cryptocme2.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxm2fi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\objectfactory_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\csprintdlg_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312dten.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\DSI3AZ9E\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312frja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_p2soutlk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\prompt_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_rtf.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\reportrenderer_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\FGX1QJPW\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\querybuilder_res_fi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u31220fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sacommoncontrols_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_adoplus_res_pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\csprintdlg_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_p2s_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\localcon_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\BIB90YD4\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_query_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3souzh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\libcurl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\QT2RWY2D\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\PrintControl_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fsvit.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dataset_res_pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\objectfactory_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4W184EXT\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dao_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_fielddef_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\reportrenderer_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3ldtpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sstsv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle_res_cs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fsvfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxm2sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\Crddt32.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxm2hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\BVLYGOZ6\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\ccme_base.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_pc_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\ParameterDesigner_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_adoplus_res_tr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dmpja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_ado_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\NDI8N8ZE\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\smerrlog.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35dten.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_wordw_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\DDU0R7DQ\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_xls.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_com_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\W7Q0HZGX\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dptja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fsvnb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sscsdk80_res_ru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\xerces-c_2_1_0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\VMEZVSED\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fcrzh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u31220da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxmpt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\querybuilder_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frdzh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3souru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dptpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3lfren.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_xls_res_zh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3lfrsv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TXXOS14F\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fcrzh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\c2d6dtru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\MAU4NKYB\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u31220pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_xls_res_pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\BJSMK5VR\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\saxmlserialize_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3ssten.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sscsdk80_res_es.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\requestmodel_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312sasv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_db2cli_res_zh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crlov_res_ko.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\30N3WX19\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3ldtja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_adoplus_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\saxserialize_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\HZ7D1KIO\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Users\user\Desktop\download\optojumpnext.exe File created: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{32D7E3D1-C9DF-4FA6-9F9B-4D5117AB2917}\dotNetFx40_Full_x86_x64.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbede.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crpe32_res_pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\dtsagentd_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\clientdoc_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxmit.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\reportrenderer_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\PrintControl_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3da3fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_wordw_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\csprintdlg_res_pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35dtda.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\reportrenderer_res_fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3520ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sscsdk80_res_ko.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3da3pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u31220sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\localcon_res_tr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dataset_res_es.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_p2bbde.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3ftxzh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\localcon_res_ru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\c2d6dtpt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5CRZCV7K\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dpthu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_odbc_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\626GTWKH\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312sapl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\FLIPZ2F3\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\SysWOW64\wget.exe File created: C:\Users\user\Desktop\download\optojumpnext.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\dotnet\CrystalDecisions.Data.AdoDotNetInterop.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312safr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sscsdk80_res_de.dll Jump to dropped file
Source: C:\Users\user\Desktop\download\optojumpnext.exe File created: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{57bcd1d4-2de9-49d9-bc0c-3f4263e9970e}\WindowsInstaller-KB893803-v2-x86.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dptsk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3ssthu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_fielddef_res_pt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_adoplus_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbehu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dvmzh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_adoplus_res_fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3lfrfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxmpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\ParameterDesigner_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\localcon_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\13S0U6AR\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\EMB0YI5C\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35dtfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312frfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sifit.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3520sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_pdf_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\9QL9H6K0\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3ddkfi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3ftxja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\2ZTAKVG3\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u31220ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\J8QK6M3P\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\MKFH1E91\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\prompt_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dataset_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frdnb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\pvlocale-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crpe32_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle_res_fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312saja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dmppl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\BFUG8TWT\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frcnl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_xls_res_pt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3l20ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3l20en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_html_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frdth.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dmpko.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3ldten.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_xls_res_fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fsvcs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sstfi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crlov_res_cs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crqe_res_cs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_query.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_cdo_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\dtsagentd_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dptit.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fcrsk.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe File created: C:\Users\user\AppData\Local\Temp\_is402B..dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\rptcontrollers_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\D1NZ3K1Y\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\csprintdlg_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_html_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3ldtsv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3foden.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3souzh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\GEP0GRHP\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_rtf_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\XZ3MQY35\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35dtsv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_p2s_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frccs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crpe32_res_fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312dtja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dvmhu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TEHOMAIV\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\pageobjectmodel_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\ParameterDesigner_res_pt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_FileSystem.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\datadefmodel_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3da3nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_cdo_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3ldtfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\prompt_res_pt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sifnb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3ddkes.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\c2d6dten.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crlov_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\FP6BNFUH\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxmda.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sacommlayer_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frcja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\pageobjectmodel_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\HW8U3FG6\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_fielddef_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\7I4WH7GP\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbtnb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\commonobjmodel_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3l20sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\A4XPZTC6\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbtpt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TVG5ATTP\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35s1en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3tbtpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\csprintdlg_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frdtr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dataset_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frdcs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\dtsagentd_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\prompt_res_nb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312frsv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35s1da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3tbtnb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_p2s_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_db2cli_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\ParameterDesigner_res_nb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ROD5FRDX\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crpe32_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fsves.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\querybuilder_res_tr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\keydecoder.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\PrintControl_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_wordw_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_adoplus_res_ko.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbtpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\cubedefmodel_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3lfrda.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_FileSystem_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3l20fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_odbc_res_tr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dntfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_pdf_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_p2ssyb10.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_p2bact3.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\reportrenderer_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3520fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_cdo_res_fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_com_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frdja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbtit.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_cdo_res_fi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_db2cli.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\GZUMVK9D\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_ado.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\EMB0YI5C\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\DSI3AZ9E\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\10GJAD92\System.Data.SqlServerCe.Entity.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\2F3KB36U\System.Data.SqlServerCe.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\7CZXGZYM\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\3GW8YO88\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\9QL9H6K0\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ZP2Y2ZJK\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1T4IL8UR\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\2ZTAKVG3\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4Q5PEM8P\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1AELXKO8\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\Z5Q4A05T\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\FGX1QJPW\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\2K4E0C4U\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\J8QK6M3P\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\MKFH1E91\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\AKDCDDJJ\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\IGZ9USZI\Microsoft.Synchronization.Data.SqlServerCe.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\01JUV2GQ\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80ESP.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074613390.1\msvcp80.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\40ENG36U\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\BIB90YD4\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TNK35R5B\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\QT2RWY2D\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\BFUG8TWT\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\8FDXG7H9\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\XU5MHCJX\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\3HY15T7I\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074613390.1\msvcm80.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\DX882I59\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4W184EXT\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIB9D9.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\C4FDATMH\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\PGVPZCZG\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5Q78957S\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\94KTCR94\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80FRA.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\GAOBZLEX\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\XQ75BFL5\policy.3.5.System.Data.SqlServerCe.Entity.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI6267.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\K94G2QYW\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1CKS4AMX\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\BVLYGOZ6\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\D1NZ3K1Y\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451490.0\mfc80.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\UWK7THG6\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\GEP0GRHP\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\I4QW3CEV\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\XZ3MQY35\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\NDI8N8ZE\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\HLLC4DDD\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80CHT.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\DDU0R7DQ\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80DEU.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TEHOMAIV\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TKKJ6ZUV\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\W5WARI3L\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451490.0\mfcm80u.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\W7Q0HZGX\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\SWAQSL4E\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\X6A06IXJ\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\BMXRJQCZ\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074613390.1\msvcr80.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\VMEZVSED\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451318.0\ATL80.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451490.0\mfc80u.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\IIGQ9HG8\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\51SBOTZ2\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\0S4IETS5\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\AOPA0BQX\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80ENU.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\2ZQM54W9\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TXXOS14F\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\RG4F0JCM\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80KOR.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4JWH5PWK\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\MAU4NKYB\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\BJSMK5VR\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\PUU3CUJD\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\CS7YDD0W\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\FP6BNFUH\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\85KLLAB2\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBE12.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451365.0\msvcr80.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\HW8U3FG6\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451771.0\vcomp.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\7I4WH7GP\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\30N3WX19\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\FWSCSB2G\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\A4XPZTC6\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\UZ6MWTDP\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\4AWW8LP3\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TVG5ATTP\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\T5PYV80Q\Microsoft.Synchronization.Data.Server.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\TAD5V0ZY\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5H81AJBH\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\HZ7D1KIO\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\msvcr71.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\QMBNXHI2\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451365.0\msvcm80.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\9NFPM341\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\S4690VQP\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\W2ZGPH3Q\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451490.0\mfcm80.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\CD5M7MAG\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451365.0\msvcp80.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80JPN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\V1SUYTKJ\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\SPSEFXL9\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\ROD5FRDX\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\L8P4QM9N\CrystalDecisions.Data.AdoDotNetInterop.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1VZJ83VX\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5CRZCV7K\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\CRGXKBUS\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\626GTWKH\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80CHS.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\D3M4L4TP\policy.3.5.System.Data.SqlServerCe.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\JXBYBJ65\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\IZ8SNHVW\Microsoft.Synchronization.Data.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\FLIPZ2F3\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\1LOQFF02\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI62D5.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\YY1KAYSV\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80ITA.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\msvcp71.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\5MHF02JX\System.Data.SqlServerCe.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\A2OG2MOW\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\I1TPN99T\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\E4QRLP5W\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBAE4.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\6FTOPTQV\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\LD3T68X8\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\13S0U6AR\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\assembly\tmp\GZUMVK9D\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe File created: C:\Users\user\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_20240930_074606050-MSI_vc_red.msi.txt
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\1033\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\1041\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\1042\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\1028\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\2052\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\1040\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\1036\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\1031\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\3082\eula.rtf
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe File created: c:\1adc35b2a430ffb6f8fdcb\1049\eula.rtf
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\EULA_ENU.rtf
Creates or modifies windows services
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\VSSetup
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ISSetupPrerequisistes Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ISSetupPrerequisistes Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ISSetupPrerequisistes Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ISSetupPrerequisistes Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ISSetupPrerequisistes Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ISSetupPrerequisistes Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ISSetupPrerequisistes Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ISSetupPrerequisistes Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AF75B3 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 10_2_00AF75B3
Stores large binary data to the registry
Source: C:\Windows\System32\msiexec.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 Blob Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Process information set: NOOPENFILEERRORBOX
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Process information set: NOOPENFILEERRORBOX
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Process information set: NOOPENFILEERRORBOX
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Process information set: NOOPENFILEERRORBOX
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Process information set: NOOPENFILEERRORBOX
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Process information set: NOOPENFILEERRORBOX
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_pdf_res_cs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3ddkfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbtsv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_cdo_res_pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_rtf_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\3GW8YO88\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\1T4IL8UR\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dmpen.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\2K4E0C4U\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle_res_fi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_html_res_cs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_odbc_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fodnb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\40ENG36U\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u2frdef.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\TNK35R5B\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\8FDXG7H9\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p2iract3.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_db2cli_res_pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\C4FDATMH\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\cxlib-5-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\94KTCR94\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Dropped PE file which has not been started: C:\1adc35b2a430ffb6f8fdcb\1033\SetupResources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35s1nb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3tbtit.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\csprintdlg_res_zh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fcren.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dntzh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\saxserialize_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_com_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sousv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\rptdefmodel_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35s1sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fcrcs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\cubedefmodel_res_ru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3tbthu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3tbtpt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\commonobjmodel_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80DEU.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\SWAQSL4E\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\X6A06IXJ\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\BMXRJQCZ\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3ftxnb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sscsdk80.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\0S4IETS5\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\dtsagentd_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\RG4F0JCM\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\4JWH5PWK\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frcfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\PrintControl_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crpe32_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35s1pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20240930074451365.0\msvcr80.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20240930074451771.0\vcomp.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fcrnl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35dtes.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3520en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312dtit.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_rtf_res_cs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3l20da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sscsdk80_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_db2cli_res_fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\9NFPM341\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxm2nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\ParameterDesigner.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3tbtko.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_p2s_res_pt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_fielddef_res_ru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crlov_res_ru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_odbc_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dmppt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3ra3it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\V1SUYTKJ\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\localcon_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\requestmodel_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\rptdefmodel_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_xls_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\csprintdlg_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\c2d6dtsv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\5MHF02JX\System.Data.SqlServerCe.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Private\System.Data.SqlServerCe.Entity.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_odbc_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3ddknb.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_isA398..dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35s1fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fodfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\E4QRLP5W\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_wordw_res_nb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p2bact3.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIBAE4.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_rtf_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\pageobjectmodel_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dao_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\libpng10.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_ado_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sifzh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_fielddef_res_cs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dvmpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_pc_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\rptcontrollers_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3520it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3ldtda.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\csprintdlg_res_fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\4Q5PEM8P\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\1AELXKO8\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\localcon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_cdo_res_de.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Dropped PE file which has not been started: C:\1adc35b2a430ffb6f8fdcb\1028\SetupResources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\dtsagentd_res_pt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\AKDCDDJJ\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dictionary.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sacommoncontrols_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3520da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\XU5MHCJX\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3tbtfi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sscsdk80_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\5Q78957S\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_pdf_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\objectfactory_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\csprintdlg_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u2fsepv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_com_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\K94G2QYW\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dictionary_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxm2cs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3ra3nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312dtda.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\clientdoc_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxmcs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\System.Data.SqlServerCe.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_p2s_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\prompt_res_zh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312saen.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_pc_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dvmcs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\W5WARI3L\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dntsk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dao.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_rtf_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sifen.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_pdf_res_ru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35dtnb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\pageobjectmodel_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxm2en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\requestmodel_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle_res_pt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_query_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crpe32_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_FileSystem_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_FileSystem_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\smagentapi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\pageobjectmodel_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312frpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.SqlServerCe.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35dtpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_xls_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\commonobjmodel_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\FWSCSB2G\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\rptcontrollers_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_fielddef_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3tbten.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\gdiplus.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3da3ru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\QMBNXHI2\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20240930074451365.0\msvcm80.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_ado_res_es.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\S4690VQP\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\Xalan-C_1_10.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_cdo_res_nb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312sada.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20240930074451490.0\mfcm80.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\csprintdlg_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\CD5M7MAG\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sousk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80JPN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\SPSEFXL9\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fodde.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crpe32_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dataset_res_pt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dptcs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3siffi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3lfrja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\JXBYBJ65\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\YY1KAYSV\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_rtf_res_fi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\csprintdlg_res_es.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_com_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dataset_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbtfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_odbc_res_pt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3ldtit.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxm2fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\datadefmodel_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\XalanMessages_1_10.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dmpzh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3ra3ko.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3l20it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312dten.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crlang.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312frja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3da3sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_p2soutlk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\prompt_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\saxserialize_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3ldtes.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\querybuilder_res_fi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\FGX1QJPW\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u31220fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_fielddef_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_FileSystem_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\csprintdlg_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\fssl-1-2-1-6.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_xls_res_tr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\QT2RWY2D\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3da3it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dataset_res_pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\objectfactory_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\4W184EXT\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dao_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80FRA.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\GAOBZLEX\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crlov_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sstsv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxm2sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fsvfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_pc_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\ParameterDesigner_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\PrintControl_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\clientdoc_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20240930074451490.0\mfc80.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxmsv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\NDI8N8ZE\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35dten.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\DDU0R7DQ\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_wordw_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_query_res_pt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_com_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fsvnb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3tbtsk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\xerces-c_2_1_0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\VMEZVSED\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fcrzh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u31220da.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Dropped PE file which has not been started: C:\1adc35b2a430ffb6f8fdcb\1049\SetupResources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3lfrsv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\TXXOS14F\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.Server.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\c2d6dtru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312sait.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_query_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u31220pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\localcon_res_pt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\MAU4NKYB\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Private\System.Data.SqlServerCe.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sscsdk80_res_es.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\reportrenderer_res_nb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312sasv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_db2cli_res_zh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\saxserialize_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\PrintControl_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbede.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crpe32_res_pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\clientdoc_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\reportrenderer_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crqe_res_ru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_wordw_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\csprintdlg_res_pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\reportrenderer_res_fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3520ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3ftxth.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sscsdk80_res_ko.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_pdf_res_fi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\localcon_res_tr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbesk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3ftxzh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crqe_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sqlcese35.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sacommlayer_res_ru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_odbc_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\626GTWKH\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSI62D5.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_query_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3ssthu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crpe32_res_nb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_adoplus_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dvmzh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxmpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sqlceqp35.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\localcon_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\13S0U6AR\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35dtfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312frfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sifit.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\10GJAD92\System.Data.SqlServerCe.Entity.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_pdf_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbtnl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u31220ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dataset_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frdnb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\BFUG8TWT\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\rptdefmodel_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sacommlayer_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_xls_res_pt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dmpko.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fsvcs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_xls_res_fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sstfi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crlov_res_cs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_query.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dptit.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_is402B..dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\objectfactory_res_ru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_html_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3ldtsv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3foden.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3souzh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxm2zh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_rtf_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\XZ3MQY35\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80CHT.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fsvpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frccs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312dtja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dvmhu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crpe32_res_fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\csprintdlg_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20240930074451318.0\ATL80.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\ParameterDesigner_res_pt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20240930074451490.0\mfc80u.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_FileSystem.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3da3nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_cdo_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\csprintdlg_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\clientdoc_res_ru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crlov_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3da3ko.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\CS7YDD0W\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\FP6BNFUH\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sacommlayer_res_hu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxmda.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIBE12.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frcja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\pageobjectmodel_res_sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312saes.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\7I4WH7GP\CrystalDecisions.Windows.Forms.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_com_res_zh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\A4XPZTC6\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3l20sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_pdf_res_ko.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbtpt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\TVG5ATTP\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\ebus-3-3-2-7.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3ddkde.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxmru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fsvde.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\msvcr71.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3tbtpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frdtr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_odbc_res_zh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frdcs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\objectfactory_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\dtsagentd_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\prompt_res_nb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35s1da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3tbtnb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_p2s_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crpe32_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_adoplus_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\ROD5FRDX\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\1VZJ83VX\SAPBusinessObjects.WPF.Viewer.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\saxserialize_res_ru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\keydecoder.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_adoplus_res_ko.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\saxmlserialize_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20240930074451646.1\mfc80CHS.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_odbc_res_cs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\cubedefmodel_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\msvcp71.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3lfrda.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_FileSystem_res_da.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_odbc_res_tr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dntfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_pdf_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sscsdk80_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\reportrenderer_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3520fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_cdo_res_fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frdja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbtit.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dptpt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_ado.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\pageobjectmodel_res_nb.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fsvsk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\P2soutlk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbezh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35dtja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\7CZXGZYM\CrystalDecisions.ReportSource.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_query_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3souen.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fodpt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\implode.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_rtf_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3tbtfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3sifes.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\c2d6dtcs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\BCM-4-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sqlceme35.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3ra3zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\smcommonutil.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_odbc_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dao_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3siftr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3ftxko.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIB9D9.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crqe_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sqlcecompact35.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\PGVPZCZG\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_adoplus_res_nl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle_res_tr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3tbtsv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSI6267.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\dtsagentd_res_ru.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\dtsagentd_res_tr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312dtfr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_pc_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crqe_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\I4QW3CEV\CrystalDecisions.VSDesigner.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\HLLC4DDD\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\saxmlserialize_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\cubedefmodel_res_ja.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\pageobjectmodel_res_fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3fxmzh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_p2s_res_zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_adoplus_res_cs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3da3zh_TW.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312dtpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3frcen.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\51SBOTZ2\SAPBusinessObjects.WPF.ViewerShared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\pageobjectmodel_res_pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\PrintControl_res_zh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\AOPA0BQX\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Dropped PE file which has not been started: C:\1adc35b2a430ffb6f8fdcb\1041\SetupResources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u2ftext.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3ra3sv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbthu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dataset_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\PrintControl_res_zh_TW.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Dropped PE file which has not been started: C:\1adc35b2a430ffb6f8fdcb\1036\SetupResources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_fielddef.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\clientdoc_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\85KLLAB2\CrystalDecisions.CrystalReports.Engine.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crlov_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbtko.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312frda.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbezh_CN.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\UZ6MWTDP\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u25azalea.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crqe_res_ko.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbten.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dntes.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\pageobjectmodel_res_es.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3soupt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_html_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u2fxml.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u35s1it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3ftxen.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312fren.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\cxlibw-5-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3lfrpl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_ado_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3dbeen.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\PrintControl_res_nl.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe Dropped PE file which has not been started: C:\1adc35b2a430ffb6f8fdcb\3082\SetupResources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\csprintdlg_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\1LOQFF02\CrystalDecisions.Web.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\querybuilder_res_en.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u3l20es.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_odbc.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_oracle.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_dao_res_pt.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sqlceoledb35.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sscsdk80_res_th.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\u312dtsv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\I1TPN99T\CrystalDecisions.VSDesigner.Mobile.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_com_res_pl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\p3ra3fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\x3dvmfi.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\assembly\tmp\6FTOPTQV\CrystalDecisions.Shared.resources.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_cdo_res_ko.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\Crystal Reports 2011\crystalreportviewers\ActiveXControls\csprintdlg_res_it.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crxf_html_res_sk.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\rptdefmodel_res_de.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\sscsdk80_res_fr.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files (x86)\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Common\SAP BusinessObjects Enterprise XI 4.0\win32_x86\crdb_ado_res_fi.dll Jump to dropped file
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Found evasive API chain checking for process token information
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe API coverage: 7.3 %
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe API coverage: 7.3 %
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\download\optojumpnext.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe File Volume queried: C:\ FullSizeInformation
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_004014B7 wsprintfA,FindFirstFileA,FindClose, 9_2_004014B7
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_00404BA4 lstrcpyA,lstrcpyA,lstrcatA,lstrcatA,DeleteFileA,DeleteFileA,FindFirstFileA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,DeleteFileA,FindNextFileA,FindClose,lstrcpyA,lstrlenA,RemoveDirectoryA, 9_2_00404BA4
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AD168D __EH_prolog3_GS,_memset,GetTempPathW,FindFirstFileW,CompareFileTime,DeleteFileW,FindNextFileW, 10_2_00AD168D
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AE7E01 __EH_prolog3_GS,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,DeleteFileW, 10_2_00AE7E01
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007C7E01 __EH_prolog3_GS,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,DeleteFileW, 11_2_007C7E01
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007B168D __EH_prolog3_GS,_memset,GetTempPathW,FindFirstFileW,CompareFileTime,DeleteFileW,FindNextFileW, 11_2_007B168D
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AD168D __EH_prolog3_GS,_memset,GetTempPathW,FindFirstFileW,CompareFileTime,DeleteFileW,FindNextFileW, 15_2_00AD168D
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AE7E01 __EH_prolog3_GS,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,DeleteFileW, 15_2_00AE7E01
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AD168D __EH_prolog3_GS,_memset,GetTempPathW,FindFirstFileW,CompareFileTime,DeleteFileW,FindNextFileW, 18_2_00AD168D
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AE7E01 __EH_prolog3_GS,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,DeleteFileW, 18_2_00AE7E01
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00B0B033 GetModuleHandleW,GetProcAddress,GetSystemInfo,GetNativeSystemInfo, 10_2_00B0B033
Source: C:\Users\user\Desktop\download\optojumpnext.exe File opened: C:\Users\user\AppData\Local\Temp\pftF363~tmp\ Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe File opened: C:\Users\user\AppData\Local\Temp\plfE613.tmp Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\download\optojumpnext.exe File opened: C:\Users\user\ Jump to behavior
Source: 4154ca.msi.13.dr Binary or memory string: vmcin
Source: wget.exe, 00000002.00000002.3494930158.0000000000B88000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\msiexec.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AF8ABD _memset,IsDebuggerPresent, 10_2_00AF8ABD
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AFEE1E EncodePointer,EncodePointer,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 10_2_00AFEE1E
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_0040C84D LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 9_2_0040C84D
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_00405CD0 GetProcessHeap,HeapFree, 9_2_00405CD0
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_0040C702 SetUnhandledExceptionFilter, 9_2_0040C702
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_0040C714 SetUnhandledExceptionFilter, 9_2_0040C714
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AFC3BA SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_00AFC3BA
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AFC397 SetUnhandledExceptionFilter, 10_2_00AFC397
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007DC3BA SetUnhandledExceptionFilter,UnhandledExceptionFilter, 11_2_007DC3BA
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: 11_2_007DC397 SetUnhandledExceptionFilter, 11_2_007DC397
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AFC3BA SetUnhandledExceptionFilter,UnhandledExceptionFilter, 15_2_00AFC3BA
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 15_2_00AFC397 SetUnhandledExceptionFilter, 15_2_00AFC397
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AFC3BA SetUnhandledExceptionFilter,UnhandledExceptionFilter, 18_2_00AFC3BA
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 18_2_00AFC397 SetUnhandledExceptionFilter, 18_2_00AFC397
Source: C:\1adc35b2a430ffb6f8fdcb\Setup.exe Memory allocated: page read and write | page guard
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00ABCDD3 __EH_prolog3_GS,GetDlgItem,GetDlgItem,GetDlgItem,GetModuleFileNameW,_memset,ShellExecuteExW,WaitForInputIdle,ShowWindow,WaitForSingleObject,GetExitCodeProcess,CloseHandle,GetDlgItem,GetDlgItem,GetDlgItem,SendMessageW, 10_2_00ABCDD3
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Process created: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe /q"C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe" /tempdisk1folder"C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}" /IS_temp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{a0689fe9-3467-4d73-bc25-d0f696ad268a}\CRRuntime_32bit_13_0_10.msi" /qn /norestart Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process created: C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe "C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{270b0954-35ca-4324-bbc6-ba5db9072dad}\vcredist_x86.exe" /q Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\Optojump Next\ISSetupPrerequisites\{B1165B38-CA52-11E0-A63D-7C004824019B}\SSCERuntime_x86-ENU.msi" /q /norestart Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Process created: C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}\setup.exe /q"C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe" /tempdisk1folder"C:\Users\user\AppData\Local\Temp\{FF90D66E-8DE8-4F32-8355-F3F889CD6D3D}" /IS_temp
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://update.microgate.it/optojump/optojumpnext.exe" > cmdline.out 2>&1
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00B08AE4 __EH_prolog3_GS,AllocateAndInitializeSid,AllocateAndInitializeSid,AllocateAndInitializeSid,AllocateAndInitializeSid,_memset,SetEntriesInAclW,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetTempPathW, 10_2_00B08AE4
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00B08AE4 __EH_prolog3_GS,AllocateAndInitializeSid,AllocateAndInitializeSid,AllocateAndInitializeSid,AllocateAndInitializeSid,_memset,SetEntriesInAclW,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetTempPathW, 10_2_00B08AE4
Source: setup.exe Binary or memory string: Shell_TrayWnd
Source: setup.exe, 0000000B.00000002.4744250125.0000000000815000.00000002.00000001.01000000.00000008.sdmp, setup.exe, 0000000B.00000000.3756341549.0000000000815000.00000002.00000001.01000000.00000008.sdmp Binary or memory string: 2zShell_TrayWnd0x0409
Source: setup.exe, 0000000A.00000002.3776511882.0000000000B35000.00000002.00000001.01000000.00000007.sdmp, setup.exe, 0000000A.00000000.3716732649.0000000000B35000.00000002.00000001.01000000.00000007.sdmp, setup.exe, 0000000F.00000000.3948530982.0000000000B35000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: Shell_TrayWnd0x0409
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00AF6C43 cpuid 10_2_00AF6C43
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: GetLocaleInfoW, 10_2_00AF14BD
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: GetLocaleInfoW,TranslateCharsetInfo,IsValidLocale, 10_2_00AF1438
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: GetLocaleInfoW,TranslateCharsetInfo,IsValidLocale, 10_2_00ABEC18
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: GetLocaleInfoW,TranslateCharsetInfo,IsValidLocale, 11_2_007D1438
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: GetLocaleInfoW, 11_2_007D14BD
Source: C:\Users\user\AppData\Local\Temp\{5ADF322E-F483-4666-AC2C-04CC4A5CEF10}\setup.exe Code function: GetLocaleInfoW,TranslateCharsetInfo,IsValidLocale, 11_2_0079EC18
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: GetLocaleInfoW, 15_2_00AF14BD
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: GetLocaleInfoW,TranslateCharsetInfo,IsValidLocale, 15_2_00AF1438
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: GetLocaleInfoW,TranslateCharsetInfo,IsValidLocale, 15_2_00ABEC18
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: GetLocaleInfoW, 18_2_00AF14BD
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: GetLocaleInfoW,TranslateCharsetInfo,IsValidLocale, 18_2_00AF1438
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: GetLocaleInfoW,TranslateCharsetInfo,IsValidLocale, 18_2_00ABEC18
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\wget.exe Queries volume information: C:\Users\user\Desktop\download VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\2ZQM54W9\SAPBusinessObjects.WPF.ViewerShared.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\CS7YDD0W\SAPBusinessObjects.WPF.Viewer.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\R5WHX29H\SAPBusinessObjects.WPF.ViewerShared.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\XWP3DVNZ\SAPBusinessObjects.WPF.Viewer.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\GZUMVK9D\CrystalDecisions.CrystalReports.Engine.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\BFUG8TWT\CrystalDecisions.ReportSource.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\AOPA0BQX\CrystalDecisions.Shared.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\J8QK6M3P\CrystalDecisions.VSDesigner.Mobile.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\ZP2Y2ZJK\CrystalDecisions.VSDesigner.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\FP6BNFUH\CrystalDecisions.Web.Mobile.MobileViewerSys.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\JXBYBJ65\CrystalDecisions.Web.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\MAU4NKYB\CrystalDecisions.Windows.Forms.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\YB00TSL7\SAPBusinessObjects.WPF.ViewerShared.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\2W0MXMUJ\SAPBusinessObjects.WPF.Viewer.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\PUU3CUJD\CrystalDecisions.CrystalReports.Engine.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\4Q5PEM8P\CrystalDecisions.ReportSource.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\5Q78957S\CrystalDecisions.Shared.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\ROD5FRDX\CrystalDecisions.VSDesigner.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\4W184EXT\CrystalDecisions.Windows.Forms.resources.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\XQ75BFL5\policy.3.5.System.Data.SqlServerCe.Entity.dll VolumeInformation
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\IZ8SNHVW\Microsoft.Synchronization.Data.dll VolumeInformation
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\IGZ9USZI\Microsoft.Synchronization.Data.SqlServerCe.dll VolumeInformation
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\5MHF02JX\System.Data.SqlServerCe.dll VolumeInformation
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\2F3KB36U\System.Data.SqlServerCe.dll VolumeInformation
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\tmp\D3M4L4TP\policy.3.5.System.Data.SqlServerCe.dll VolumeInformation
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\policy.3.5.System.Data.SqlServerCe\3.5.0.0__89845dcd8080cc91\policy.3.5.System.Data.SqlServerCe.dll VolumeInformation
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\policy.3.5.System.Data.SqlServerCe.Entity\3.5.0.0__89845dcd8080cc91\policy.3.5.System.Data.SqlServerCe.Entity.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Optojump Next\setup.exe Code function: 10_2_00ACD9F2 _memset,_memset,lstrlenW,_memset,wsprintfW,___FUnloadDelayLoadedDLL2@4,LoadLibraryW,GetProcAddress,GetLastError,GetSystemTimeAsFileTime, 10_2_00ACD9F2
Source: C:\Users\user\Desktop\download\optojumpnext.exe Code function: 9_2_004083F7 EntryPoint,GetVersion,GetCommandLineA,GetStartupInfoA,GetModuleHandleA, 9_2_004083F7
Source: C:\Windows\SysWOW64\wget.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Adds / modifies Windows certificates
Source: C:\Windows\System32\msiexec.exe Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 Blob Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1522627 URL: https://update.microgate.it... Startdate: 30/09/2024 Architecture: WINDOWS Score: 52 84 Sigma detected: New RUN Key Pointing to Suspicious Folder 2->84 9 msiexec.exe 746 1875 2->9         started        12 optojumpnext.exe 22 2->12         started        14 msiexec.exe 2->14         started        16 3 other processes 2->16 process3 file4 64 CrystalDecisions.V...igner.resources.dll, PE32 9->64 dropped 66 CrystalDecisions.R...ource.resources.dll, PE32 9->66 dropped 68 C:\...\CrystalDecisions.Web.resources.dll, PE32 9->68 dropped 76 755 other files (none is malicious) 9->76 dropped 18 msiexec.exe 9->18         started        70 C:\Users\user\AppData\Local\...\setup.exe, PE32 12->70 dropped 78 3 other files (none is malicious) 12->78 dropped 20 setup.exe 5 12->20         started        72 policy.3.5.System....ServerCe.Entity.dll, PE32 14->72 dropped 80 27 other files (none is malicious) 14->80 dropped 23 msiexec.exe 14->23         started        25 msiexec.exe 14->25         started        74 C:\Users\user\AppData\Local\...\setup.exe, PE32 16->74 dropped 27 wget.exe 2 16->27         started        31 setup.exe 16->31         started        33 conhost.exe 16->33         started        process5 dnsIp6 50 C:\Users\user\AppData\Local\...\setup.exe, PE32 20->50 dropped 35 setup.exe 8 19 20->35         started        82 217.199.6.83 BRENNERCOM-ASIT Italy 27->82 52 C:\Users\user\Desktop\...\optojumpnext.exe, PE32 27->52 dropped 86 Drops large PE files 27->86 54 C:\Users\user\AppData\Local\...\_isA398..dll, PE32 31->54 dropped file7 signatures8 process9 file10 48 C:\Users\user\AppData\Local\...\_is402B..dll, PE32 35->48 dropped 38 vcredist_x86.exe 35->38         started        41 msiexec.exe 1 35->41         started        43 msiexec.exe 35->43         started        process11 file12 56 C:\1adc35b2a430ffb6f8fdcb\sqmapi.dll, PE32 38->56 dropped 58 C:\1adc35b2a430ffb6f8fdcb\SetupUi.dll, PE32 38->58 dropped 60 C:\1adc35b2a430ffb6f8fdcb\SetupEngine.dll, PE32 38->60 dropped 62 11 other files (none is malicious) 38->62 dropped 45 Setup.exe 38->45         started        process13 signatures14 88 Installs new ROOT certificates 45->88
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
217.199.6.83
 unknown Italy
20811 BRENNERCOM-ASIT false