Windows Analysis Report
allegro_free_viewer_16-6 (1).exe

Overview

General Information

Sample name: allegro_free_viewer_16-6 (1).exe
Analysis ID: 1525195
MD5: 1c39b01dbc156506913f5b3e6fb35abc
SHA1: 93b132a1713e2443bdeb4162ae15e123456b0f5b
SHA256: 10e8647ccbe250696134bdb811988db16637709f2f9a5994a9813d32a6eb35b3
Infos:

Detection

Score: 2
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

Checks for available system drives (often done to infect USB drives)
Detected potential crypto function
Found potential string decryption / allocating functions
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files

Classification

Uses 32bit PE files
Source: allegro_free_viewer_16-6 (1).exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Binary string: wextract.pdb source: Cadence Allegro Free Physical Viewers 16.6.msi0.0.dr, Cadence Allegro Free Physical Viewers 16.6.msi.0.dr
Source: Binary string: C:\CodeBases\isdev\src\Runtime\MSI\Shared\Setup\Setup___Win32_Release_Prerequisites_Unicode\setupPreReq.pdb`Q source: allegro_free_viewer_16-6 (1).exe
Source: Binary string: C:\CodeBases\isdev\src\Runtime\MSI\Shared\Setup\Setup___Win32_Release_Prerequisites_Unicode\setupPreReq.pdb source: allegro_free_viewer_16-6 (1).exe
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\SysWOW64\msiexec.exe File opened: z: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: x: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: v: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: t: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: r: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: p: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: n: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: l: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: j: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: h: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: f: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: b: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: y: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: w: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: u: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: s: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: q: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: o: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: m: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: k: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: i: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: g: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: e: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: c: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: a: Jump to behavior
Source: allegro_free_viewer_16-6 (1).exe, 00000000.00000003.1692522216.00000000022E4000.00000004.00000020.00020000.00000000.sdmp, allegro_free_viewer_16-6 (1).exe, 00000000.00000003.1691984054.00000000022E4000.00000004.00000020.00020000.00000000.sdmp, allegro_free_viewer_16-6 (1).exe, 00000000.00000002.2942939226.000000000067E000.00000004.00000020.00020000.00000000.sdmp, allegro_free_viewer_16-6 (1).exe, 00000000.00000003.1691907341.00000000022F7000.00000004.00000020.00020000.00000000.sdmp, Microsoft Visual C++ 2005 SP1 Redistributable MFC Security Update KB2538242(x86).prq.0.dr, Microsoft Visual C++ 2005 SP1 Redistributable Package (x86).prq.0.dr String found in binary or memory: http://saturn.installshield.com/is/prerequisites/microsoft
Source: allegro_free_viewer_16-6 (1).exe, 00000000.00000003.1744714385.00000000006E5000.00000004.00000020.00020000.00000000.sdmp, allegro_free_viewer_16-6 (1).exe, 00000000.00000002.2943062968.00000000006E5000.00000004.00000020.00020000.00000000.sdmp, allegro_free_viewer_16-6 (1).exe, 00000000.00000003.1744439476.00000000006E2000.00000004.00000020.00020000.00000000.sdmp, allegro_free_viewer_16-6 (1).exe, 00000000.00000003.1702664335.00000000006DB000.00000004.00000020.00020000.00000000.sdmp, allegro_free_viewer_16-6 (1).exe, 00000000.00000003.1703116708.00000000006E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cadence.com
Source: Cadence Allegro Free Physical Viewers 16.6.msi0.0.dr, Cadence Allegro Free Physical Viewers 16.6.msi.0.dr String found in binary or memory: http://www.flexerasoftware.com0
Source: allegro_free_viewer_16-6 (1).exe String found in binary or memory: http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d
Detected potential crypto function
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEF9 0_3_022DDEF9
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DDEBB 0_3_022DDEBB
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: 0_3_022DA050 0_3_022DA050
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Code function: String function: 022DDF4C appears 64 times
Sample file is different than original file name gathered from version info
Source: allegro_free_viewer_16-6 (1).exe Binary or memory string: OriginalFilename vs allegro_free_viewer_16-6 (1).exe
Source: allegro_free_viewer_16-6 (1).exe, 00000000.00000002.2942797505.0000000000560000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameInstallShield Setup.exev+ vs allegro_free_viewer_16-6 (1).exe
Source: allegro_free_viewer_16-6 (1).exe Binary or memory string: OriginalFilenameInstallShield Setup.exev+ vs allegro_free_viewer_16-6 (1).exe
Uses 32bit PE files
Source: allegro_free_viewer_16-6 (1).exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: clean2.winEXE@4/10@0/0
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe File created: C:\Users\user\AppData\Local\Downloaded Installations Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe File created: C:\Users\user\AppData\Local\Temp\{62614748-01DB-461A-94EF-BCB066E470A5}\ Jump to behavior
Source: allegro_free_viewer_16-6 (1).exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe File read: C:\Users\user\AppData\Local\Temp\{62614748-01DB-461A-94EF-BCB066E470A5}\Setup.INI Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe File read: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe "C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe"
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Process created: C:\Windows\SysWOW64\msiexec.exe MSIEXEC.EXE /i "C:\Users\user\AppData\Local\Downloaded Installations\{A28E479A-352B-4AFB-A0D8-D881CB11D9D7}\Cadence Allegro Free Physical Viewers 16.6.msi" SETUPEXEDIR="C:\Users\user\Desktop" SETUPEXENAME="allegro_free_viewer_16-6 (1).exe"
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Process created: C:\Windows\SysWOW64\msiexec.exe MSIEXEC.EXE /i "C:\Users\user\AppData\Local\Downloaded Installations\{A28E479A-352B-4AFB-A0D8-D881CB11D9D7}\Cadence Allegro Free Physical Viewers 16.6.msi" SETUPEXEDIR="C:\Users\user\Desktop" SETUPEXENAME="allegro_free_viewer_16-6 (1).exe" Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Section loaded: msi.dll Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msihnd.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe File written: C:\Users\user\AppData\Local\Temp\{62614748-01DB-461A-94EF-BCB066E470A5}\Setup.INI Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe Automated click: I accept the terms in the license agreement
Source: C:\Windows\SysWOW64\msiexec.exe Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe Automated click: Next >
Source: Window Recorder Window detected: More than 3 window changes detected
Source: allegro_free_viewer_16-6 (1).exe Static file information: File size 21974609 > 1048576
Source: allegro_free_viewer_16-6 (1).exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wextract.pdb source: Cadence Allegro Free Physical Viewers 16.6.msi0.0.dr, Cadence Allegro Free Physical Viewers 16.6.msi.0.dr
Source: Binary string: C:\CodeBases\isdev\src\Runtime\MSI\Shared\Setup\Setup___Win32_Release_Prerequisites_Unicode\setupPreReq.pdb`Q source: allegro_free_viewer_16-6 (1).exe
Source: Binary string: C:\CodeBases\isdev\src\Runtime\MSI\Shared\Setup\Setup___Win32_Release_Prerequisites_Unicode\setupPreReq.pdb source: allegro_free_viewer_16-6 (1).exe
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\allegro_free_viewer_16-6 (1).exe File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: allegro_free_viewer_16-6 (1).exe Binary or memory string: Shell_TrayWnd
Source: allegro_free_viewer_16-6 (1).exe Binary or memory string: BShell_TrayWnd
Source: allegro_free_viewer_16-6 (1).exe Binary or memory string: ABShell_TrayWndTahoma0x0409NoSuppressRebootKeyDotNetOptionalInstallIfSilentDotNetOptionalSETUPEXENAMESETUPEXEDIRCertKeyCacheFolderCacheRootLocationTypeSuppressWrongOSSuppressReboot
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1525195 Sample: allegro_free_viewer_16-6 (1).exe Startdate: 03/10/2024 Architecture: WINDOWS Score: 2 5 allegro_free_viewer_16-6 (1).exe 29 2->5         started        7 msiexec.exe 2->7         started        process3 9 msiexec.exe 9 5->9         started       
⊘No contacted IP infos