Edit tour

Windows Analysis Report
ArbExpress_V3.6_en_0703_066146106.exe

Overview

General Information

Sample name:	ArbExpress_V3.6_en_0703_066146106.exe
Analysis ID:	1528662
MD5:	e2e80e23d79df3609dcaee7c2d7c2e72
SHA1:	5318eef048fc22d2a027a1715658089c34c1d41d
SHA256:	5c9ab13b2956d8dfadde510ea37578d8a67a59aff8d40d7524c756e1b602db5f
Infos:

Detection

Score:	24
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Signatures

Installs new ROOT certificates

PE file has a writeable .text section

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates or modifies windows services

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

ArbExpress_V3.6_en_0703_066146106.exe (PID: 2200 cmdline: "C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe" MD5: E2E80E23D79DF3609DCAEE7C2D7C2E72)

ISBEW64.exe (PID: 5880 cmdline: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A3681F74-C246-4C16-9456-61CA4AC85351} MD5: B83D2774CDAF5016CD8765A630FA1150)

dotnetinstaller.exe (PID: 3160 cmdline: "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\DevComponents.DotNetBar2.dll" MD5: 8F50951DC767385E6E9801ECACC621E3)

conhost.exe (PID: 6360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dotnetinstaller.exe (PID: 2716 cmdline: "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbConnect.dll" MD5: 8F50951DC767385E6E9801ECACC621E3)

conhost.exe (PID: 5444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dotnetinstaller.exe (PID: 5060 cmdline: "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbExpress.exe" MD5: 8F50951DC767385E6E9801ECACC621E3)

conhost.exe (PID: 4752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dotnetinstaller.exe (PID: 5864 cmdline: "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbLib.dll" MD5: 8F50951DC767385E6E9801ECACC621E3)

conhost.exe (PID: 1476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dotnetinstaller.exe (PID: 2576 cmdline: "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\DisplayComponent.dll" MD5: 8F50951DC767385E6E9801ECACC621E3)

conhost.exe (PID: 356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dotnetinstaller.exe (PID: 2884 cmdline: "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\PreviewComponent.dll" MD5: 8F50951DC767385E6E9801ECACC621E3)

conhost.exe (PID: 2452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dotnetinstaller.exe (PID: 7088 cmdline: "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ScopeAcqPages.dll" MD5: 8F50951DC767385E6E9801ECACC621E3)

conhost.exe (PID: 1900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5388 cmdline: C:\Windows\SysWOW64\cmd.exe /c cacls "C:\Program Files (x86)\Tektronix\ArbExpress" /T /E /G Users:F MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cacls.exe (PID: 1412 cmdline: cacls "C:\Program Files (x86)\Tektronix\ArbExpress" /T /E /G Users:F MD5: 00BAAE10C69DAD58F169A3ED638D6C59)

SrTasks.exe (PID: 2612 cmdline: C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1 MD5: 2694D2D28C368B921686FE567BD319EB)

conhost.exe (PID: 6692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: ArbExpress_V3.6_en_0703_066146106.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Window detected: &Next >Cancel< &BackRelease NotesThe InstallShield Wizard will install Tektronix ArbExpress Software on your system. This program is subject to the accompanying Tektronix Software License Agreement.Welcome to the InstallShield Wizard for Tektronix ArbExpress Software.Click Next to continue with the setup program.To know more about what's new in this version of ArbExpress software click 'Release Notes'.
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Window detected: &Next >Cancel< &BackRelease NotesThe InstallShield Wizard will install Tektronix ArbExpress Software on your system. This program is subject to the accompanying Tektronix Software License Agreement.Welcome to the InstallShield Wizard for Tektronix ArbExpress Software.Click Next to continue with the setup program.To know more about what's new in this version of ArbExpress software click 'Release Notes'.

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\DotNetInstaller.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: C:\CodeBases\isdev\Redist\Language Independent\x64\ISBEW64.pdb source: ISBEW64.exe, 00000003.00000000.2387483013.0000000140010000.00000002.00000001.01000000.00000009.sdmp, ISBEW64.exe, 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E.PDBF source: ArbExpress_V3.6_en_0703_066146106.exe
Source:	Binary string: C:\projects\Perforce\tcong_PC-bej4-5RNY5Y2_ArbExpress\ArbExpress\ArbExpress\bin\Release\ArbFile.pdb source: ArbF5357.rra.0.dr

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: unknown	DNS traffic detected: query: 206.23.85.13.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 197.87.175.4.in-addr.arpa replaycode: Name error (3)

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 197.87.175.4.in-addr.arpa

Source: data1.hdr.0.dr	String found in binary or memory: http://deviis4.installshield.com/NetNirvana/
Source: ArbExpress_V3.6_en_0703_066146106.exe	String found in binary or memory: http://deviis4.installshield.com/NetNirvana/data2.cabDisk1
Source: dotnetinstaller.exe, 0000000A.00000002.2730293507.0000000004AB2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://fontawesome.ioWebfont
Source: dotnetinstaller.exe, 0000000A.00000002.2724965656.00000000005E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.veri
Source: 8f5b.rra.0.dr, setufd6.rra.0.dr, setup.ini1.0.dr, setup.ini.0.dr	String found in binary or memory: http://www.Tektronix.com
Source: 8f5b.rra.0.dr	String found in binary or memory: http://www.Tektronix.com/Measurement/cgi-bin/framed.pl?Document=/Measurement/signal_sources/home.htm
Source: ArbExpress_V3.6_en_0703_066146106.exe, data1.hdr.0.dr	String found in binary or memory: http://www.Tektronix.comID_STRING30ID_STRING35ID_STRING31ID_STRING32ID_STRING33ID_STRING34
Source: dotnetinstaller.exe, 0000000A.00000002.2730293507.0000000004AB2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.devcomponents.com/dotnetbar/order.html
Source: dotnetinstaller.exe, 0000000A.00000002.2730293507.0000000004AB2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.devcomponents.comAmailto:support
Source: dotnetinstaller.exe, 0000000A.00000002.2730293507.0000000004AB2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.devcomponents.comKSystem.Windows.Forms.ContextMenuStrip
Source: dotnetinstaller.exe, 0000000A.00000002.2725795677.0000000000835000.00000004.00000020.00020000.00000000.sdmp, dotnetinstaller.exe, 0000000C.00000002.2752519143.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, dotnetinstaller.exe, 0000000E.00000002.2767514032.0000000000445000.00000004.00000020.00020000.00000000.sdmp, dotnetinstaller.exe, 00000010.00000002.2786766818.0000000000975000.00000004.00000020.00020000.00000000.sdmp, dotnetinstaller.exe, 00000012.00000002.2807797854.0000000000995000.00000004.00000020.00020000.00000000.sdmp, dotnetinstaller.exe, 00000014.00000002.2819852174.0000000000915000.00000004.00000020.00020000.00000000.sdmp, dotnetinstaller.exe, 00000016.00000002.2832409663.00000000004D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.flexerasoftware.com0
Source: ArbExpress_V3.6_en_0703_066146106.exe, setufd6.rra.0.dr, setup.ini1.0.dr, setup.ini.0.dr	String found in binary or memory: http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d
Source: 8f5b.rra.0.dr	String found in binary or memory: http://www.tek.com
Source: ArbE549f.rra.0.dr, ArbE5441.rra.0.dr	String found in binary or memory: http://www.tek.com/contact)
Source: ArbExpress_V3.6_en_0703_066146106.exe	String found in binary or memory: https://HuF.?AVfile_exception

System Summary

PE file has a writeable .text section

Source: ISSetup.dll.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: isrt9045.rra.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ISSee7e.rra.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe	Code function: 3_2_0000000140001A00	3_2_0000000140001A00
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe	Code function: 3_2_0000000140004D40	3_2_0000000140004D40
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe	Code function: 3_2_000000014000961C	3_2_000000014000961C
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe	Code function: 3_2_000000014000DEA8	3_2_000000014000DEA8
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe	Code function: 3_2_0000000140004340	3_2_0000000140004340
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Code function: 12_2_0489525D	12_2_0489525D
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Code function: 16_2_049A2B91	16_2_049A2B91
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Code function: 16_2_049A68C3	16_2_049A68C3
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Code function: 20_2_0496496E	20_2_0496496E

Source: isrt9045.rra.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: _isu9094.rra.0.dr

Static PE information: No import functions for PE file found

Source: ArbExpress_V3.6_en_0703_066146106.exe, 00000000.00000000.2029003323.00000000004B9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameInstallShield Setup.exeL vs ArbExpress_V3.6_en_0703_066146106.exe
Source: ArbExpress_V3.6_en_0703_066146106.exe	Binary or memory string: OriginalFilenameInstallShield Setup.exeL vs ArbExpress_V3.6_en_0703_066146106.exe

Source: ArbExpress_V3.6_en_0703_066146106.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: ISSetup.dll.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: isrt9045.rra.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ISSee7e.rra.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: ISSetup.dll.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: isrt9045.rra.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ISSee7e.rra.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: sus24.winEXE@31/292@2/0

Source: ArbE5441.rra.0.dr

Initial sample: http://www.tek.com/contact

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe

Code function: 3_2_0000000140003230 CoCreateInstance,

3_2_0000000140003230

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe

Code function: 3_2_0000000140005870 LoadLibraryExW,FindResourceW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,

3_2_0000000140005870

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe

File created: C:\Program Files (x86)\InstallShield Installation Information\

Jump to behavior

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe

File created: C:\Users\Public\Desktop\ArbExpress Application.lnk

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2452:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1900:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3128:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4752:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6692:120:WilError_03
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Mutant created: \Sessions\1\BaseNamedObjects\5045756C-7552-4E48-B39F-C28A48E4EACD
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6360:120:WilError_03

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe

File created: C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\

Jump to behavior

Source: ArbExpress_V3.6_en_0703_066146106.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe

File read: C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\Disk1\setup.ini

Jump to behavior

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe

File read: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe "C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe"
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A3681F74-C246-4C16-9456-61CA4AC85351}
Source: unknown	Process created: C:\Windows\System32\SrTasks.exe C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1
Source: C:\Windows\System32\SrTasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\DevComponents.DotNetBar2.dll"
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbConnect.dll"
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbExpress.exe"
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbLib.dll"
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\DisplayComponent.dll"
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\PreviewComponent.dll"
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ScopeAcqPages.dll"
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe /c cacls "C:\Program Files (x86)\Tektronix\ArbExpress" /T /E /G Users:F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe cacls "C:\Program Files (x86)\Tektronix\ArbExpress" /T /E /G Users:F
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A3681F74-C246-4C16-9456-61CA4AC85351}	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\DevComponents.DotNetBar2.dll"	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbConnect.dll"	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbExpress.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbLib.dll"	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\DisplayComponent.dll"	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\PreviewComponent.dll"	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe "C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ScopeAcqPages.dll"	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe /c cacls "C:\Program Files (x86)\Tektronix\ArbExpress" /T /E /G Users:F	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe cacls "C:\Program Files (x86)\Tektronix\ArbExpress" /T /E /G Users:F

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: lz32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: sxproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: srcore.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vss_ps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: ntmarta.dll

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: ArbExpress Installation Manual.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\Program Files (x86)\Tektronix\ArbExpress\Documentation\ArbExpress Installation Manual.pdf
Source: ArbExpress User Manual.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\Program Files (x86)\Tektronix\ArbExpress\Documentation\ArbExpress User Manual.pdf

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe

File written: C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\Disk1\0x0409.ini

Jump to behavior

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Automated click: I accept the terms of the license agreement
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Automated click: Next >
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Automated click: Next >
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Automated click: Next >
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Automated click: OK
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Window detected: &Next >Cancel< &BackRelease NotesThe InstallShield Wizard will install Tektronix ArbExpress Software on your system. This program is subject to the accompanying Tektronix Software License Agreement.Welcome to the InstallShield Wizard for Tektronix ArbExpress Software.Click Next to continue with the setup program.To know more about what's new in this version of ArbExpress software click 'Release Notes'.
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Window detected: &Next >Cancel< &BackRelease NotesThe InstallShield Wizard will install Tektronix ArbExpress Software on your system. This program is subject to the accompanying Tektronix Software License Agreement.Welcome to the InstallShield Wizard for Tektronix ArbExpress Software.Click Next to continue with the setup program.To know more about what's new in this version of ArbExpress software click 'Release Notes'.

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: ArbExpress_V3.6_en_0703_066146106.exe

Static file information: File size 45206398 > 1048576

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: C:\CodeBases\isdev\Redist\Language Independent\x64\ISBEW64.pdb source: ISBEW64.exe, 00000003.00000000.2387483013.0000000140010000.00000002.00000001.01000000.00000009.sdmp, ISBEW64.exe, 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E.PDBF source: ArbExpress_V3.6_en_0703_066146106.exe
Source:	Binary string: C:\projects\Perforce\tcong_PC-bej4-5RNY5Y2_ArbExpress\ArbExpress\ArbExpress\bin\Release\ArbFile.pdb source: ArbF5357.rra.0.dr

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe

Code function: 3_2_00000001400068B0 LoadLibraryW,GetProcAddress,FreeLibrary,FreeLibrary,

3_2_00000001400068B0

Source: initial sample

Static PE information: section where entry point is pointing to: .rsrc

Source: ArbE502a.rra.0.dr	Static PE information: section name: .textbss
Source: MakW53a5.rra.0.dr	Static PE information: section name: _RDATA
Source: DevC1043.rra.0.dr	Static PE information: section name: .datax

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Code function: 10_2_01EE000C push eax; iretd	10_2_01EE0055
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Code function: 10_2_01EE0744 push esi; iretd	10_2_01EE0745
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Code function: 14_2_004E2A54 push esp; iretd	14_2_004E2A55

Source: ISSetup.dll.0.dr	Static PE information: section name: .text entropy: 7.980557814009445
Source: isrt9045.rra.0.dr	Static PE information: section name: .text entropy: 7.974556688094566
Source: ISSee7e.rra.0.dr	Static PE information: section name: .text entropy: 7.980557814009445

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656 Blob

Jump to behavior

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\mata504a.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\isrt.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\PreviewComponent.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\Prev39a5.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\Disk1\ISSetup.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbFile.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\mata50b7.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbExpress.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\ISSee7e.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\_isr90a3.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\ISSetup.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotn9017.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\DevC1043.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\Disp3196.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbConnect.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBE9026.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbL2be9.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setude2.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\matarb.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbEqu.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\ArbE502a.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\_isuser_0x0409.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\DisplayComponent.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\matarb.mexw32 (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\_isu9094.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\MakW53a5.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ScopeAcqPages.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\MakWfm.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setup.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbLib.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\_isres_0x0409.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE240a.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\isrt9045.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\Disk1\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE51a1.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\Scop3dbc.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbF5357.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbC1fa5.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbEther.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE5163.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\DevComponents.DotNetBar2.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\ArbEther.dll (copy)	Jump to dropped file

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotn9017.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBE9026.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\isrt9045.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\_isu9094.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\_isr90a3.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\ArbE502a.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\mata504a.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\mata50b7.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setude2.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\ISSee7e.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE5163.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE51a1.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbF5357.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\MakW53a5.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\DevC1043.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbC1fa5.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE240a.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbL2be9.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\Documentation\ArbE5441.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\Documentation\ArbE549f.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\Disp3196.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\Prev39a5.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\Program Files (x86)\Tektronix\ArbExpress\System\Scop3dbc.rra	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\DotNetInstaller.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore

Jump to behavior

Source: C:\Windows\System32\SrTasks.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP

Jump to behavior

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\Documentation\	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\Documentation\ArbExpress Installation Manual.lnk	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\Documentation\ArbExpress User Manual.lnk	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\ArbExpress Application.lnk	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\ArbExpress Help.lnk	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\Release Notes.lnk	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\Samples\	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\Samples\Waveforms.lnk	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\Samples\Equations.lnk	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\Tools\	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\Tools\Matlab.lnk	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\Uninstall ArbExpress.lnk	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\cacls.exe cacls "C:\Program Files (x86)\Tektronix\ArbExpress" /T /E /G Users:F

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 2020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 2680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 2280000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 780000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 2790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 7E0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 540000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 25C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 20B0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 940000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 2680000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 4680000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 660000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 25E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 1FB0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 740000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 2600000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 4600000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 25A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 25A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Memory allocated: 45A0000 memory commit \| memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\mata504a.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\isrt.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\PreviewComponent.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\Prev39a5.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\Disk1\ISSetup.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbFile.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\mata50b7.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbExpress.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\ISSee7e.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\_isr90a3.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\ISSetup.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\DevC1043.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\Disp3196.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbConnect.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbL2be9.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\matarb.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setude2.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbEqu.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\matarb.mexw32 (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\_isuser_0x0409.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\ArbE502a.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\DisplayComponent.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\_isu9094.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\ScopeAcqPages.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\MakW53a5.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\MakWfm.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbLib.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setup.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\_isres_0x0409.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE240a.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\isrt9045.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\Disk1\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE51a1.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\Scop3dbc.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbF5357.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbC1fa5.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbEther.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE5163.rra	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\System\DevComponents.DotNetBar2.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\ArbEther.dll (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_3-6366

Source: C:\Windows\System32\SrTasks.exe TID: 5672	Thread sleep time: -290000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe TID: 4088	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe TID: 2656	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe TID: 4984	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe TID: 6676	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe TID: 6704	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe TID: 6824	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe TID: 3572	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File Volume queried: C:\Windows FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: SrTasks.exe, 00000008.00000003.2897968400.000001A9ACA13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: SrTasks.exe, 00000008.00000003.2892882833.000001A9ACA6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:88

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe

API call chain: ExitProcess graph end node

graph_3-6368

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe

Code function: 3_2_000000014000946C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

3_2_000000014000946C

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe

Code function: 3_2_00000001400068B0 LoadLibraryW,GetProcAddress,FreeLibrary,FreeLibrary,

3_2_00000001400068B0

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe	Code function: 3_2_000000014000946C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_000000014000946C
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe	Code function: 3_2_0000000140009CA8 RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0000000140009CA8
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe	Code function: 3_2_0000000140007200 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0000000140007200
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe	Code function: 3_2_0000000140009E28 SetUnhandledExceptionFilter,	3_2_0000000140009E28

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\cacls.exe cacls "C:\Program Files (x86)\Tektronix\ArbExpress" /T /E /G Users:F

Source: ISSetup.dll.0.dr	Binary or memory string: ?OPTYPE_PROGMAN_FIELDSWWW
Source: 8f5b.rra.0.dr	Binary or memory string: OPTYPE_PROGMAN

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe

Code function: GetLocaleInfoA,

3_2_000000014000E89C

Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Queries volume information: C:\Program Files (x86)\Tektronix\ArbExpress\System\DevComponents.DotNetBar2.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Queries volume information: C:\Program Files (x86)\Tektronix\ArbExpress\System\DevComponents.DotNetBar2.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Queries volume information: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbConnect.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Queries volume information: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbConnect.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Queries volume information: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbLib.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Queries volume information: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbLib.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Queries volume information: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbConnect.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Queries volume information: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbConnect.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Queries volume information: C:\Program Files (x86)\Tektronix\ArbExpress\System\DisplayComponent.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Queries volume information: C:\Program Files (x86)\Tektronix\ArbExpress\System\DisplayComponent.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Queries volume information: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbLib.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Queries volume information: C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbLib.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Queries volume information: C:\Program Files (x86)\Tektronix\ArbExpress\System\PreviewComponent.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Queries volume information: C:\Program Files (x86)\Tektronix\ArbExpress\System\PreviewComponent.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Queries volume information: C:\Program Files (x86)\Tektronix\ArbExpress\System\ScopeAcqPages.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe	Queries volume information: C:\Program Files (x86)\Tektronix\ArbExpress\System\ScopeAcqPages.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe

Code function: 3_2_000000014000A824 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_000000014000A824

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2 Blob

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	2 Native API	2 Windows Service	2 Windows Service	12 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	11 Disable or Modify Tools	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Services File Permissions Weakness	1 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 Services File Permissions Weakness	12 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	2 Obfuscated Files or Information	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Install Root Certificate	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Services File Permissions Weakness	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ArbExpress_V3.6_en_0703_066146106.exe	2%	ReversingLabs
ArbExpress_V3.6_en_0703_066146106.exe	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\ISSee7e.rra	2%	ReversingLabs
C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\ISSee7e.rra	0%	Virustotal	Browse
C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\ISSetup.dll (copy)	2%	ReversingLabs
C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\ISSetup.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setude2.rra	0%	ReversingLabs
C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setude2.rra	0%	Virustotal	Browse
C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setup.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setup.exe (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbC1fa5.rra	0%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbConnect.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE240a.rra	0%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE240a.rra	1%	Virustotal	Browse
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE5163.rra	2%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE5163.rra	0%	Virustotal	Browse
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE51a1.rra	2%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE51a1.rra	1%	Virustotal	Browse
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbEqu.dll (copy)	2%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbEqu.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbEther.dll (copy)	2%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbEther.dll (copy)	1%	Virustotal	Browse
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbExpress.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbExpress.exe (copy)	1%	Virustotal	Browse
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbF5357.rra	2%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbF5357.rra	0%	Virustotal	Browse
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbFile.dll (copy)	2%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbFile.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbL2be9.rra	0%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbL2be9.rra	0%	Virustotal	Browse
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbLib.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbLib.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Tektronix\ArbExpress\System\DevC1043.rra	2%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\DevC1043.rra	0%	Virustotal	Browse
C:\Program Files (x86)\Tektronix\ArbExpress\System\DevComponents.DotNetBar2.dll (copy)	2%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\DevComponents.DotNetBar2.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Tektronix\ArbExpress\System\Disp3196.rra	0%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\Disp3196.rra	0%	Virustotal	Browse
C:\Program Files (x86)\Tektronix\ArbExpress\System\DisplayComponent.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\DisplayComponent.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\Tektronix\ArbExpress\System\MakW53a5.rra	2%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\MakW53a5.rra	0%	Virustotal	Browse
C:\Program Files (x86)\Tektronix\ArbExpress\System\MakWfm.dll (copy)	2%	ReversingLabs
C:\Program Files (x86)\Tektronix\ArbExpress\System\MakWfm.dll (copy)	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
206.23.85.13.in-addr.arpa	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Link
http://www.Tektronix.com	0%	Virustotal	Browse
http://deviis4.installshield.com/NetNirvana/data2.cabDisk1	0%	Virustotal	Browse
http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d	0%	Virustotal	Browse
http://deviis4.installshield.com/NetNirvana/	0%	Virustotal	Browse
http://www.tek.com	0%	Virustotal	Browse
http://www.devcomponents.com/dotnetbar/order.html	1%	Virustotal	Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
206.23.85.13.in-addr.arpa	unknown	unknown	false	1%, Virustotal, Browse	unknown
197.87.175.4.in-addr.arpa	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://fontawesome.ioWebfont	dotnetinstaller.exe, 0000000A.00000002.2730293507.0000000004AB2000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
http://deviis4.installshield.com/NetNirvana/data2.cabDisk1	ArbExpress_V3.6_en_0703_066146106.exe	false	0%, Virustotal, Browse	unknown
http://www.Tektronix.com	8f5b.rra.0.dr, setufd6.rra.0.dr, setup.ini1.0.dr, setup.ini.0.dr	false	0%, Virustotal, Browse	unknown
http://www.Tektronix.comID_STRING30ID_STRING35ID_STRING31ID_STRING32ID_STRING33ID_STRING34	ArbExpress_V3.6_en_0703_066146106.exe, data1.hdr.0.dr	false		unknown
http://deviis4.installshield.com/NetNirvana/	data1.hdr.0.dr	false	0%, Virustotal, Browse	unknown
http://www.tek.com/contact)	ArbE549f.rra.0.dr, ArbE5441.rra.0.dr	false		unknown
http://www.devcomponents.comAmailto:support	dotnetinstaller.exe, 0000000A.00000002.2730293507.0000000004AB2000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
http://ocsp.veri	dotnetinstaller.exe, 0000000A.00000002.2724965656.00000000005E7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d	ArbExpress_V3.6_en_0703_066146106.exe, setufd6.rra.0.dr, setup.ini1.0.dr, setup.ini.0.dr	false	0%, Virustotal, Browse	unknown
http://www.flexerasoftware.com0	dotnetinstaller.exe, 0000000A.00000002.2725795677.0000000000835000.00000004.00000020.00020000.00000000.sdmp, dotnetinstaller.exe, 0000000C.00000002.2752519143.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, dotnetinstaller.exe, 0000000E.00000002.2767514032.0000000000445000.00000004.00000020.00020000.00000000.sdmp, dotnetinstaller.exe, 00000010.00000002.2786766818.0000000000975000.00000004.00000020.00020000.00000000.sdmp, dotnetinstaller.exe, 00000012.00000002.2807797854.0000000000995000.00000004.00000020.00020000.00000000.sdmp, dotnetinstaller.exe, 00000014.00000002.2819852174.0000000000915000.00000004.00000020.00020000.00000000.sdmp, dotnetinstaller.exe, 00000016.00000002.2832409663.00000000004D5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.tek.com	8f5b.rra.0.dr	false	0%, Virustotal, Browse	unknown
http://www.devcomponents.comKSystem.Windows.Forms.ContextMenuStrip	dotnetinstaller.exe, 0000000A.00000002.2730293507.0000000004AB2000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
http://www.Tektronix.com/Measurement/cgi-bin/framed.pl?Document=/Measurement/signal_sources/home.htm	8f5b.rra.0.dr	false		unknown
http://www.devcomponents.com/dotnetbar/order.html	dotnetinstaller.exe, 0000000A.00000002.2730293507.0000000004AB2000.00000002.00000001.01000000.0000000D.sdmp	false	1%, Virustotal, Browse	unknown
https://HuF.?AVfile_exception	ArbExpress_V3.6_en_0703_066146106.exe	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528662
Start date and time:	2024-10-08 08:32:57 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ArbExpress_V3.6_en_0703_066146106.exe
Detection:	SUS
Classification:	sus24.winEXE@31/292@2/0
EGA Information:	Successful, ratio: 87.5%
HCA Information:	Successful, ratio: 99% Number of executed functions: 72 Number of non-executed functions: 49
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, VSSVC.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target dotnetinstaller.exe, PID 5060 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:34:54	API Interceptor	29x Sleep call for process: SrTasks.exe modified

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	22492
Entropy (8bit):	3.484893836872466
Encrypted:	false
SSDEEP:	384:CTmyuV//BiTbh/G4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/z/lWr0aa0Mhs+XVgv
MD5:	BE345D0260AE12C5F2F337B17E07C217
SHA1:	0976BA0982FE34F1C35A0974F6178E15C238ED7B
SHA-256:	E994689A13B9448C074F9B471EDEEC9B524890A0D82925E98AB90B658016D8F3
SHA-512:	77040DBEE29BE6B136A83B9E444D8B4F71FF739F7157E451778FB4FCCB939A67FF881A70483DE16BCB6AE1FEA64A89E00711A33EC26F4D3EEA8E16C9E9553EFF
Malicious:	false
Preview:	..[.0.x.0.4.0.9.].....1.1.0.0.=.S.e.t.u.p. .I.n.i.t.i.a.l.i.z.a.t.i.o.n. .E.r.r.o.r.....1.1.0.1.=.%.s.....1.1.0.2.=.%.1. .S.e.t.u.p. .i.s. .p.r.e.p.a.r.i.n.g. .t.h.e. .%.2.,. .w.h.i.c.h. .w.i.l.l. .g.u.i.d.e. .y.o.u. .t.h.r.o.u.g.h. .t.h.e. .p.r.o.g.r.a.m. .s.e.t.u.p. .p.r.o.c.e.s.s... . .P.l.e.a.s.e. .w.a.i.t.......1.1.0.3.=.C.h.e.c.k.i.n.g. .O.p.e.r.a.t.i.n.g. .S.y.s.t.e.m. .V.e.r.s.i.o.n.....1.1.0.4.=.C.h.e.c.k.i.n.g. .W.i.n.d.o.w.s.(.R.). .I.n.s.t.a.l.l.e.r. .V.e.r.s.i.o.n.....1.1.0.5.=.C.o.n.f.i.g.u.r.i.n.g. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r.....1.1.0.6.=.C.o.n.f.i.g.u.r.i.n.g. .%.s.....1.1.0.7.=.S.e.t.u.p. .h.a.s. .c.o.m.p.l.e.t.e.d. .c.o.n.f.i.g.u.r.i.n.g. .t.h.e. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. .o.n. .y.o.u.r. .s.y.s.t.e.m... .T.h.e. .s.y.s.t.e.m. .n.e.e.d.s. .t.o. .b.e. .r.e.s.t.a.r.t.e.d. .i.n. .o.r.d.e.r. .t.o. .c.o.n.t.i.n.u.e. .w.i.t.h. .t.h.e. .i.n.s.t.a.l.l.a.t.i.o.n... .P.l.e.a.s.e. .c.l.i.c.k. .R.e.s.t.a.r.t. .t.o. .r.e.b.o.o.t. .t.h.e. .s.y.s.t.e.m.......1.1.0.8.

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\0x04ecc.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	22492
Entropy (8bit):	3.484893836872466
Encrypted:	false
SSDEEP:	384:CTmyuV//BiTbh/G4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/z/lWr0aa0Mhs+XVgv
MD5:	BE345D0260AE12C5F2F337B17E07C217
SHA1:	0976BA0982FE34F1C35A0974F6178E15C238ED7B
SHA-256:	E994689A13B9448C074F9B471EDEEC9B524890A0D82925E98AB90B658016D8F3
SHA-512:	77040DBEE29BE6B136A83B9E444D8B4F71FF739F7157E451778FB4FCCB939A67FF881A70483DE16BCB6AE1FEA64A89E00711A33EC26F4D3EEA8E16C9E9553EFF
Malicious:	false
Preview:	..[.0.x.0.4.0.9.].....1.1.0.0.=.S.e.t.u.p. .I.n.i.t.i.a.l.i.z.a.t.i.o.n. .E.r.r.o.r.....1.1.0.1.=.%.s.....1.1.0.2.=.%.1. .S.e.t.u.p. .i.s. .p.r.e.p.a.r.i.n.g. .t.h.e. .%.2.,. .w.h.i.c.h. .w.i.l.l. .g.u.i.d.e. .y.o.u. .t.h.r.o.u.g.h. .t.h.e. .p.r.o.g.r.a.m. .s.e.t.u.p. .p.r.o.c.e.s.s... . .P.l.e.a.s.e. .w.a.i.t.......1.1.0.3.=.C.h.e.c.k.i.n.g. .O.p.e.r.a.t.i.n.g. .S.y.s.t.e.m. .V.e.r.s.i.o.n.....1.1.0.4.=.C.h.e.c.k.i.n.g. .W.i.n.d.o.w.s.(.R.). .I.n.s.t.a.l.l.e.r. .V.e.r.s.i.o.n.....1.1.0.5.=.C.o.n.f.i.g.u.r.i.n.g. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r.....1.1.0.6.=.C.o.n.f.i.g.u.r.i.n.g. .%.s.....1.1.0.7.=.S.e.t.u.p. .h.a.s. .c.o.m.p.l.e.t.e.d. .c.o.n.f.i.g.u.r.i.n.g. .t.h.e. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. .o.n. .y.o.u.r. .s.y.s.t.e.m... .T.h.e. .s.y.s.t.e.m. .n.e.e.d.s. .t.o. .b.e. .r.e.s.t.a.r.t.e.d. .i.n. .o.r.d.e.r. .t.o. .c.o.n.t.i.n.u.e. .w.i.t.h. .t.h.e. .i.n.s.t.a.l.l.a.t.i.o.n... .P.l.e.a.s.e. .c.l.i.c.k. .R.e.s.t.a.r.t. .t.o. .r.e.b.o.o.t. .t.h.e. .s.y.s.t.e.m.......1.1.0.8.

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\ISSee7e.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Category:	dropped
Size (bytes):	579584
Entropy (8bit):	7.6477409990124645
Encrypted:	false
SSDEEP:	6144:/Fi43SaRsu0xho+Qvv0QhHxcul05EtXdosFRJrTy6kbdXLOvZ9sNSOVJEmY7ixzF:Lz0Y1d05EtXtFR9G6IcZZxsxzpKpHgT
MD5:	B9D4678348F9D7FEF94C11DABD782960
SHA1:	F2CA4A7B784F856ED7BDC9E9337544B35D69C9A3
SHA-256:	1FAC3AA23390131843952C1E91AEBD0B6944EA65A2C271E36D288752890E9070
SHA-512:	D0206DA19972504E9513639BF0BB2E14D155951ABDE07F579B34F1D2063010C765D44C0F343D673F42DC5C661B1234F096B29654B268CC2EC46756AFC6AE3CE6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.....b...b...b.}.n...b...l...b.i.i...b.X.i...b.5.G...b...~...b...{...b...c...b.0.h...b.0.i...b...d...b...f...b.Rich..b.........PE..L...i=VL...........!.................X...............................................7..............................<T......\|V.......`..4....................p.......................................................................................text....P..............PEC2MO...... ....rsrc........`...................... ....reloc.......p......................@...........................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\ISSetup.dll (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Category:	dropped
Size (bytes):	579584
Entropy (8bit):	7.6477409990124645
Encrypted:	false
SSDEEP:	6144:/Fi43SaRsu0xho+Qvv0QhHxcul05EtXdosFRJrTy6kbdXLOvZ9sNSOVJEmY7ixzF:Lz0Y1d05EtXtFR9G6IcZZxsxzpKpHgT
MD5:	B9D4678348F9D7FEF94C11DABD782960
SHA1:	F2CA4A7B784F856ED7BDC9E9337544B35D69C9A3
SHA-256:	1FAC3AA23390131843952C1E91AEBD0B6944EA65A2C271E36D288752890E9070
SHA-512:	D0206DA19972504E9513639BF0BB2E14D155951ABDE07F579B34F1D2063010C765D44C0F343D673F42DC5C661B1234F096B29654B268CC2EC46756AFC6AE3CE6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.....b...b...b.}.n...b...l...b.i.i...b.X.i...b.5.G...b...~...b...{...b...c...b.0.h...b.0.i...b...d...b...f...b.Rich..b.........PE..L...i=VL...........!.................X...............................................7..............................<T......\|V.......`..4....................p.......................................................................................text....P..............PEC2MO...... ....rsrc........`...................... ....reloc.......p......................@...........................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\data1.cab (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	530911
Entropy (8bit):	7.9957712300000505
Encrypted:	true
SSDEEP:	12288:4lqL4JImTqN0rGADWWv1ia2UrYFGK9HZT5:UURm165Wv1iN9L
MD5:	1026CFC15528C7E2D265B52AAD685B9D
SHA1:	28972EBF5554F278AE5480AEF91A7A7F97C59D3D
SHA-256:	51893753F8FD66A5ADD439B4AF1F5EA10E02FE37F163CEEDBA81D4FC2C182B9E
SHA-512:	96B6C3E2A2EA2E3C20EC1A1E7D3CB9CBAD0482CCAF3E0ABC6742600C08A625B9594D450FCA2EC43E38D0BB12D94826E6A3C9CF33A96C597EF0EEFD31BF314B3D
Malicious:	false
Preview:	ISc(.........................................................................................................................................................................................................................................................................................................................................................................................luEPRuHN...H....................l.....L.E..OU..P......I..,0V...M.W...G..E...........................................................XQs.F.~^W.?L...Vi...[.%dsA......b$...2.e...{..Z.Jee`z.........$...E..'/.E.L.(..........O.Um+s.S.d..R.2.~..].DSU..k....T.~....O..A.nL{PeS.......}.G.0N.....M..b.E. z..$~H...R1_%Q.>.tu./...,..8.E*.h&.q4.. .R.....z.wB...?./v#,\...E~2...).coF[..U....._.E.$..,..4.S..f^... ..0\|w.'.3.......l.......h...a[..>..i.....Y..>.'.p...N.-9A...:..+..Q.D.....!J..1....,\s.{:.)9.h..Q.$..3.>\....4...2<..Ad.?.M.3..Q..,k...ms.F..}'.fS...<3......(E.a...m.T.e.V....!XW..,..-/..lD^......S..

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\data1.hdr (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	32419
Entropy (8bit):	3.6015666237649064
Encrypted:	false
SSDEEP:	768:hbaIZIO6SaJvst5gp8XA/lNH2Z2yYNLp6:hxeW3Ss
MD5:	C00BBD1327C6D7041A281BE5FB18CA1E
SHA1:	C9C76C6BCC724C1531FB850167F0D65315673766
SHA-256:	6E2E032966B8732E93996A96C12F579377648EA803FA065FED900F6655F1872F
SHA-512:	DA26F7F26A0C4844523838A1626AF939178F5C77893EE039D4C40AC01A1B852DB6FFC863854320B8AA9D04439140D41839906539C48AE2129EBEA377B706ECA4
Malicious:	false
Preview:	ISc(............>?...~..........................................................................B~.........................................................................................................................................................................................................................................................................................luEPRuHN...H....................l.....L.E..OU..P......I..,0V...M.W...G..E....................................................................>?......e=..e=............................................b.......n.......z..................................................................................................................."...............:...F...R...............................................^.......j.......................v.......................................................................................................................................................................*...........6.

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\datad74.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	32419
Entropy (8bit):	3.6015666237649064
Encrypted:	false
SSDEEP:	768:hbaIZIO6SaJvst5gp8XA/lNH2Z2yYNLp6:hxeW3Ss
MD5:	C00BBD1327C6D7041A281BE5FB18CA1E
SHA1:	C9C76C6BCC724C1531FB850167F0D65315673766
SHA-256:	6E2E032966B8732E93996A96C12F579377648EA803FA065FED900F6655F1872F
SHA-512:	DA26F7F26A0C4844523838A1626AF939178F5C77893EE039D4C40AC01A1B852DB6FFC863854320B8AA9D04439140D41839906539C48AE2129EBEA377B706ECA4
Malicious:	false
Preview:	ISc(............>?...~..........................................................................B~.........................................................................................................................................................................................................................................................................................luEPRuHN...H....................l.....L.E..OU..P......I..,0V...M.W...G..E....................................................................>?......e=..e=............................................b.......n.......z..................................................................................................................."...............:...F...R...............................................^.......j.......................v.......................................................................................................................................................................*...........6.

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\datad94.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	530911
Entropy (8bit):	7.9957712300000505
Encrypted:	true
SSDEEP:	12288:4lqL4JImTqN0rGADWWv1ia2UrYFGK9HZT5:UURm165Wv1iN9L
MD5:	1026CFC15528C7E2D265B52AAD685B9D
SHA1:	28972EBF5554F278AE5480AEF91A7A7F97C59D3D
SHA-256:	51893753F8FD66A5ADD439B4AF1F5EA10E02FE37F163CEEDBA81D4FC2C182B9E
SHA-512:	96B6C3E2A2EA2E3C20EC1A1E7D3CB9CBAD0482CCAF3E0ABC6742600C08A625B9594D450FCA2EC43E38D0BB12D94826E6A3C9CF33A96C597EF0EEFD31BF314B3D
Malicious:	false
Preview:	ISc(.........................................................................................................................................................................................................................................................................................................................................................................................luEPRuHN...H....................l.....L.E..OU..P......I..,0V...M.W...G..E...........................................................XQs.F.~^W.?L...Vi...[.%dsA......b$...2.e...{..Z.Jee`z.........$...E..'/.E.L.(..........O.Um+s.S.d..R.2.~..].DSU..k....T.~....O..A.nL{PeS.......}.G.0N.....M..b.E. z..$~H...R1_%Q.>.tu./...,..8.E*.h&.q4.. .R.....z.wB...?./v#,\...E~2...).coF[..U....._.E.$..,..4.S..f^... ..0\|w.'.3.......l.......h...a[..>..i.....Y..>.'.p...N.-9A...:..+..Q.D.....!J..1....,\s.{:.)9.h..Q.$..3.>\....4...2<..Ad.?.M.3..Q..,k...ms.F..}'.fS...<3......(E.a...m.T.e.V....!XW..,..-/..lD^......S..

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\layod65.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	606
Entropy (8bit):	2.042463363702611
Encrypted:	false
SSDEEP:	6:UwRGUlfEnalMZF2CzJthelhCnanl8JDWLNglETl127n:U2zlfzla2w1aRlQyBE
MD5:	85E08C293EF716E68706D1F6D8C060BE
SHA1:	7F41B99FBC629C15E7DFA6DFE04895EE023707A3
SHA-256:	9DBDE49A20CAC223A0680E6A88B6B33EDF0F35CF5CE4A15A0D7D419E6A2E722B
SHA-512:	999F9A90575B299795BE6C19F13FB667668BB3D11542792EA0965E693C54D158E2477F4DDDD37C408008DB82F3373AAB5A05034795327E594FD44C13E1E56DA3
Malicious:	false
Preview:	c..S.@..^...........@....................................................................................................................................................................................................................................................... ...L...............x............................... ...4...H...............................................s.e.t.u.p...i.n.i.....s.e.t.u.p...e.x.e...S.e.t.u.p...b.m.p...s.e.t.u.p...i.n.x...s.e.t.u.p...i.s.n...I.S.S.e.t.u.p...d.l.l...0.x.0.4.0.9...i.n.i...d.a.t.a.1...h.d.r...d.a.t.a.1...c.a.b...d.a.t.a.2...c.a.b...l.a.y.o.u.t...b.i.n...

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\layout.bin (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	606
Entropy (8bit):	2.042463363702611
Encrypted:	false
SSDEEP:	6:UwRGUlfEnalMZF2CzJthelhCnanl8JDWLNglETl127n:U2zlfzla2w1aRlQyBE
MD5:	85E08C293EF716E68706D1F6D8C060BE
SHA1:	7F41B99FBC629C15E7DFA6DFE04895EE023707A3
SHA-256:	9DBDE49A20CAC223A0680E6A88B6B33EDF0F35CF5CE4A15A0D7D419E6A2E722B
SHA-512:	999F9A90575B299795BE6C19F13FB667668BB3D11542792EA0965E693C54D158E2477F4DDDD37C408008DB82F3373AAB5A05034795327E594FD44C13E1E56DA3
Malicious:	false
Preview:	c..S.@..^...........@....................................................................................................................................................................................................................................................... ...L...............x............................... ...4...H...............................................s.e.t.u.p...i.n.i.....s.e.t.u.p...e.x.e...S.e.t.u.p...b.m.p...s.e.t.u.p...i.n.x...s.e.t.u.p...i.s.n...I.S.S.e.t.u.p...d.l.l...0.x.0.4.0.9...i.n.i...d.a.t.a.1...h.d.r...d.a.t.a.1...c.a.b...d.a.t.a.2...c.a.b...l.a.y.o.u.t...b.i.n...

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setude2.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	804352
Entropy (8bit):	6.5947838380291275
Encrypted:	false
SSDEEP:	12288:f3QOlnoHw/BVWJ0kVrOSknpcfAA3dF3q4NP:f37noQ/BVcN6P2tQ4NP
MD5:	F037C2B0C1EB809C474EECFCB820F997
SHA1:	543B57630595D55BCF6C38BA5B11F7D0B770DF30
SHA-256:	1C07774BA5D0543F9109D8D67B8AB991F32B8DFA440787DE57E339BBC2073816
SHA-512:	CE86A018D827F4E63E150A19680EE2EE36C65A070B7EE700796BD5330B552C55FC9730416FDEB5B2F52BC906E7FC09E52CFE5441E33C8913816C14C0B69F38C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`&...H...H...H...D...H.U.F...H...C...H..'B._.H..y...H.."T...H..#m...H...I...H.,"Q...H..'C...H...N...H.Rich..H.........................PE..L....=VL.................P..........}........`....@..........................................................................$..........x............................................................................`...............................text...cN.......P.................. ..`.rdata..V....`.......T..............@..@.data...$....P.......8..............@....rsrc...x...........................@..@........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setueeb.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Atari MSA archive data, -11636 sectors per track, starting track: 22332, ending track: 3470
Category:	dropped
Size (bytes):	259693
Entropy (8bit):	6.692274993753087
Encrypted:	false
SSDEEP:	6144:qsIKmUhmFIr3hq5aKN+mpcSjP23O3yjlD3trv0:UaNU
MD5:	5B26FDB5A5A3B6C06F591B358F970236
SHA1:	8E817F8AA8CDB649C1566AB12F513A6E1404988D
SHA-256:	9561957AC4300F51E48C55E907DAB6F94A5EA98A2AA221C055FBE463618DFE71
SHA-512:	47519049B4048DC7AA2FF3898FF1CF06858F6310454969B6DD8192D4B0DC7C32A854A83C8BFD19DEA7EDB1623D6B296D8526B7352A17C680C78D148AD2129EA4
Malicious:	false
Preview:	.....W<.....%.K.....^N.....".UX.4..\%.z4.f..e'{%.w=$4F;f...4..6.%.v....1.. B/.c..r.>..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X.....*y..:....X..:y\.x...1..i7......O.}..v....44.:...zqr^........w..C..f....@0.....@.J....oqs..a7...!.S..o.].`w.....l@o..Qb~A...e.,ROvA..f...!.b.:..)...H...t.M+...i'..r..VQ.1..(.t......Q

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setuf68.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	246914
Entropy (8bit):	7.384542988989865
Encrypted:	false
SSDEEP:	3072:jboSoC531QrAcXoLqmRemqmZNCGqgzADb2EZ01m+qM8fvXzq7vy51QiabTeUL+9U:jboNCpiYGGNCd+uC67CTeVHJE
MD5:	9F8490DD84FDDECA54D6F14F25870974
SHA1:	ED5998423E45E47D67E7ABFA9D304D81E1C5C164
SHA-256:	2DEFD9BD3F762CE684820242B72605FF9D1C96EDE0B12932B5C3C970F5ADFF8F
SHA-512:	CBC6575408171D438BA590F39B49A2551C9F2EF1F29B4222205D2934A32084137E59FED3A8EAE7C494BA021318AE76906365F89DA23C3E84F11F2B9C29FA4269
Malicious:	false
Preview:	t.,....(... <$.M. .=..........l.............o.c...gWSl..SW..WS[//d.d l$.XX%.......................q.y}a@!mQ.Y]A..M1%*)!.)........................................}...m..q]}.eMm.U=].E-M.5.=.%.-..............................U......q..8...X...iaaUi.@..MEE)M..wSk..g....._.c.33o/.......<...H..$....,.h......m..X........E]].E....wg.S[wSS.....K./C3W.$H`P(.......H.$.....u..a...0x$...5mAYY.A....ck.cc.k.W.g/......;.oX0 .T,.0,,...........\......q..Yq... ....1II.1....W.k[k.......#...d<$@<<......8... ,\|$..`......1q.$.............!!!.)g.K.Ow.;_.....#.<4l.P....L.....\|,...........Y..D..P......1II.1.......C..cW{.......?.TDl....0X......$...$....D...iu.1u.0.T...s.....)!.).C.K3.3S#k.C7[.....8.L<D.<.4.,(....q.....H..\.iaaMi........p%==.%c.C.G;{{0........XHP.h<@........,..(......X...A}y]a.sD.....5I=55)=s.._.....7GO...../OlT(.....X.................y.eqqey...]UU5]..w{...-%%.-O.G.[.....O.k.tH......4(L...............u..au...YmAYY)A.g k.so.Kk......w'.g#+;+[. ..<T.

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setufd6.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2456
Entropy (8bit):	3.6725407729186026
Encrypted:	false
SSDEEP:	48:rsAMapXYD5xibcPTmscu/+S8gvn6CJkkY09TzcqYtxkYOvl5ZAMXvrcOyb0pn:rsAMaXPcrmqrvnp6kY05w7tCYOvlnAMn
MD5:	6DD6AF0025691CD415234E63A59FB00B
SHA1:	19BAD7981EACD8AB6132BC747ED71D11AD13FDCE
SHA-256:	05F3257D331575BD32DD31D479582AFDEB9466496E2D384FF16E7EB537B86893
SHA-512:	BB456B6418B7F5C728AEA06046A5946C0461AEE96BAA06C8BD6F467BE1C8B83B08FE4278ADEA0EC608B1A70E40CC5041F7A2B2963C03B13E5C6A90F04445DC3A
Malicious:	false
Preview:	..[.S.t.a.r.t.u.p.].....P.r.o.d.u.c.t.=.T.e.k.t.r.o.n.i.x. .A.r.b.E.x.p.r.e.s.s.......P.r.o.d.u.c.t.G.U.I.D.=.5.0.4.5.7.5.6.C.-.7.5.5.2.-.4.E.4.8.-.B.3.9.F.-.C.2.8.A.4.8.E.4.E.A.C.D.....C.o.m.p.a.n.y.N.a.m.e.=.T.e.k.t.r.o.n.i.x.....C.o.m.p.a.n.y.U.R.L.=.h.t.t.p.:././.w.w.w...T.e.k.t.r.o.n.i.x...c.o.m.....E.r.r.o.r.R.e.p.o.r.t.U.R.L.=.h.t.t.p.:././.w.w.w...i.n.s.t.a.l.l.s.h.i.e.l.d...c.o.m./.i.s.e.t.u.p./.P.r.o.E.r.r.o.r.C.e.n.t.r.a.l...a.s.p.?.E.r.r.o.r.C.o.d.e.=.%.d. .:. .0.x.%.x.&.E.r.r.o.r.I.n.f.o.=.%.s.....M.e.d.i.a.F.o.r.m.a.t.=.1.....L.o.g.M.o.d.e.=.1.....S.k.i.n.=.s.e.t.u.p...i.s.n.....S.m.a.l.l.P.r.o.g.r.e.s.s.=.N.....S.p.l.a.s.h.T.i.m.e.=.....C.h.e.c.k.M.D.5.=.Y.....C.m.d.L.i.n.e.=.....S.h.o.w.P.a.s.s.w.o.r.d.D.i.a.l.o.g.=.N.....S.c.r.i.p.t.D.r.i.v.e.n.=.4.........[.L.a.n.g.u.a.g.e.s.].....D.e.f.a.u.l.t.=.0.x.0.4.0.9.....S.u.p.p.o.r.t.e.d.=.0.x.0.4.0.9.....R.e.q.u.i.r.e.E.x.a.c.t.L.a.n.g.M.a.t.c.h.=.0.x.0.4.0.4.,.0.x.0.8.0.4.....R.T.L.L.a.n.g.s.=.0.x.0.4.0.1.,.0.x.0.4.0.d.....

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setup.exe (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	804352
Entropy (8bit):	6.5947838380291275
Encrypted:	false
SSDEEP:	12288:f3QOlnoHw/BVWJ0kVrOSknpcfAA3dF3q4NP:f37noQ/BVcN6P2tQ4NP
MD5:	F037C2B0C1EB809C474EECFCB820F997
SHA1:	543B57630595D55BCF6C38BA5B11F7D0B770DF30
SHA-256:	1C07774BA5D0543F9109D8D67B8AB991F32B8DFA440787DE57E339BBC2073816
SHA-512:	CE86A018D827F4E63E150A19680EE2EE36C65A070B7EE700796BD5330B552C55FC9730416FDEB5B2F52BC906E7FC09E52CFE5441E33C8913816C14C0B69F38C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`&...H...H...H...D...H.U.F...H...C...H..'B._.H..y...H.."T...H..#m...H...I...H.,"Q...H..'C...H...N...H.Rich..H.........................PE..L....=VL.................P..........}........`....@..........................................................................$..........x............................................................................`...............................text...cN.......P.................. ..`.rdata..V....`.......T..............@..@.data...$....P.......8..............@....rsrc...x...........................@..@........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setup.ilg (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	304128
Entropy (8bit):	2.777174706338683
Encrypted:	false
SSDEEP:	3072:HKaD0Ngzsd8RqY/ix4K5cC3NACuBCfuIdRdxMchpkgK/WXVhc1ESEBnz/JK583Fd:4YY
MD5:	55F27335F7FBF56D3DF0E69CCA8AF0D3
SHA1:	02FCE2AABEB9DF93165CE7106D0BD0B2BBE02396
SHA-256:	3E36E75EE10F078730CF3287541AAF18E8C6B987D7F6FEEB12BDB8CC12CA031C
SHA-512:	45542479BFF56D437DA88975A5DE313A6F5EE975384532F503DDFE0490EFFEC33DCCBD7BE2324E9A4B03BE80AE798D3772F79568D2ED9D52C54E92A1EAF91CC2
Malicious:	false
Preview:	......................>.......................................................v............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... .......&..._...!..."...#...$...%...'...(...5...?...*...+...,...-......./...0...1...2...3...4...V...6...7...8...9...:...;...<...=...>...@...Z...A...]...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y.......[...\...^...`...a.......b...c.......m...e...f...g...h...i...j...k...l...n...p...o...q...r...s...t.......u...........x...y...z...

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setup.ini

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2604
Entropy (8bit):	3.697107381721997
Encrypted:	false
SSDEEP:	48:rsAMapXYD5xibcPTKXYYOmscu/+S8gvn6CJkkY09TzcqYtxkYOvl5ZAMXvrcOybg:rsAMaXPcmX9Omqrvnp6kY05w7tCYOvlR
MD5:	88F239292F77F747E8CC57E9D8D940CD
SHA1:	2E773E9E262447429778B18370B393E096FFAA8F
SHA-256:	A9148AC24578F54D4F544D0E4BE78CD560B4022450122B95DEDE6B4043BDB8F1
SHA-512:	62A889F0792E6C412A85A131A245B00322F56A77B49B668A4C12C700E7C5F90812B02689EBB5DE57644525BD79AE01B4EAE0C4DAAE24906BFF017E7A2AF21429
Malicious:	false
Preview:	..[.S.t.a.r.t.u.p.].....P.r.o.d.u.c.t.=.T.e.k.t.r.o.n.i.x. .A.r.b.E.x.p.r.e.s.s.......P.r.o.d.u.c.t.G.U.I.D.=.5.0.4.5.7.5.6.C.-.7.5.5.2.-.4.E.4.8.-.B.3.9.F.-.C.2.8.A.4.8.E.4.E.A.C.D.....C.o.m.p.a.n.y.N.a.m.e.=.T.e.k.t.r.o.n.i.x.....C.o.m.p.a.n.y.U.R.L.=.h.t.t.p.:././.w.w.w...T.e.k.t.r.o.n.i.x...c.o.m.....E.r.r.o.r.R.e.p.o.r.t.U.R.L.=.h.t.t.p.:././.w.w.w...i.n.s.t.a.l.l.s.h.i.e.l.d...c.o.m./.i.s.e.t.u.p./.P.r.o.E.r.r.o.r.C.e.n.t.r.a.l...a.s.p.?.E.r.r.o.r.C.o.d.e.=.%.d. .:. .0.x.%.x.&.E.r.r.o.r.I.n.f.o.=.%.s.....M.e.d.i.a.F.o.r.m.a.t.=.1.....L.o.g.M.o.d.e.=.1.....S.k.i.n.=.s.e.t.u.p...i.s.n.....S.m.a.l.l.P.r.o.g.r.e.s.s.=.N.....S.p.l.a.s.h.T.i.m.e.=.....C.h.e.c.k.M.D.5.=.Y.....C.m.d.L.i.n.e.=.....S.h.o.w.P.a.s.s.w.o.r.d.D.i.a.l.o.g.=.N.....S.c.r.i.p.t.D.r.i.v.e.n.=.4.....S.o.u.r.c.e.=.0.....A.l.l.U.s.e.r.s.=.1.....I.n.s.t.a.l.l.G.u.i.d.=.{.5.0.4.5.7.5.6.C.-.7.5.5.2.-.4.E.4.8.-.B.3.9.F.-.C.2.8.A.4.8.E.4.E.A.C.D.}.........[.L.a.n.g.u.a.g.e.s.].....D.e.f.a.u.l.t.=.0.x.0.4.0.9.....S.u.p.p.o.

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setup.inx (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	246914
Entropy (8bit):	7.384542988989865
Encrypted:	false
SSDEEP:	3072:jboSoC531QrAcXoLqmRemqmZNCGqgzADb2EZ01m+qM8fvXzq7vy51QiabTeUL+9U:jboNCpiYGGNCd+uC67CTeVHJE
MD5:	9F8490DD84FDDECA54D6F14F25870974
SHA1:	ED5998423E45E47D67E7ABFA9D304D81E1C5C164
SHA-256:	2DEFD9BD3F762CE684820242B72605FF9D1C96EDE0B12932B5C3C970F5ADFF8F
SHA-512:	CBC6575408171D438BA590F39B49A2551C9F2EF1F29B4222205D2934A32084137E59FED3A8EAE7C494BA021318AE76906365F89DA23C3E84F11F2B9C29FA4269
Malicious:	false
Preview:	t.,....(... <$.M. .=..........l.............o.c...gWSl..SW..WS[//d.d l$.XX%.......................q.y}a@!mQ.Y]A..M1%*)!.)........................................}...m..q]}.eMm.U=].E-M.5.=.%.-..............................U......q..8...X...iaaUi.@..MEE)M..wSk..g....._.c.33o/.......<...H..$....,.h......m..X........E]].E....wg.S[wSS.....K./C3W.$H`P(.......H.$.....u..a...0x$...5mAYY.A....ck.cc.k.W.g/......;.oX0 .T,.0,,...........\......q..Yq... ....1II.1....W.k[k.......#...d<$@<<......8... ,\|$..`......1q.$.............!!!.)g.K.Ow.;_.....#.<4l.P....L.....\|,...........Y..D..P......1II.1.......C..cW{.......?.TDl....0X......$...$....D...iu.1u.0.T...s.....)!.).C.K3.3S#k.C7[.....8.L<D.<.4.,(....q.....H..\.iaaMi........p%==.%c.C.G;{{0........XHP.h<@........,..(......X...A}y]a.sD.....5I=55)=s.._.....7GO...../OlT(.....X.................y.eqqey...]UU5]..w{...-%%.-O.G.[.....O.k.tH......4(L...............u..au...YmAYY)A.g k.so.Kk......w'.g#+;+[. ..<T.

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setup.isn (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Atari MSA archive data, -11636 sectors per track, starting track: 22332, ending track: 3470
Category:	dropped
Size (bytes):	259693
Entropy (8bit):	6.692274993753087
Encrypted:	false
SSDEEP:	6144:qsIKmUhmFIr3hq5aKN+mpcSjP23O3yjlD3trv0:UaNU
MD5:	5B26FDB5A5A3B6C06F591B358F970236
SHA1:	8E817F8AA8CDB649C1566AB12F513A6E1404988D
SHA-256:	9561957AC4300F51E48C55E907DAB6F94A5EA98A2AA221C055FBE463618DFE71
SHA-512:	47519049B4048DC7AA2FF3898FF1CF06858F6310454969B6DD8192D4B0DC7C32A854A83C8BFD19DEA7EDB1623D6B296D8526B7352A17C680C78D148AD2129EA4
Malicious:	false
Preview:	.....W<.....%.K.....^N.....".UX.4..\%.z4.f..e'{%.w=$4F;f...4..6.%.v....1.. B/.c..r.>..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X.....*y..:....X..:y\.x...1..i7......O.}..v....44.:...zqr^........w..C..f....@0.....@.J....oqs..a7...!.S..o.].`w.....l@o..Qb~A...e.,ROvA..f...!.b.:..)...H...t.M+...i'..r..VQ.1..(.t......Q

C:\Program Files (x86)\Tektronix\ArbExpress\Documentation\ArbE5441.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PDF document, version 1.4, 4 pages
Category:	dropped
Size (bytes):	828138
Entropy (8bit):	7.9451206492467294
Encrypted:	false
SSDEEP:	24576:HCdcr3vE16zjFILkgiEL9kpDO30yECo2sNC:HCdc7vE14hv2LepCUZLNC
MD5:	DC0CC281F569D18346E0A49AECAFE251
SHA1:	947338AA8C896EAEE9CBE4167C41FF07DDB9BC17
SHA-256:	177C52E37EEF22797B45A260BB154BCA0F13C50348B4E24AB50E5A07C4982C26
SHA-512:	3106D28AE12DFA2422E9B458D0755C6D38D8C71F9FDB1FAB9C348C3A4063E4A5C726B64DC1FA720A228C908469401D24E8253659E6DF672B38CA7011C0F441B7
Malicious:	false
Preview:	%PDF-1.4.%......207 0 obj.<</Linearized 1/L 823737/O 210/E 339708/N 13/T 819476/H [ 676 481]>>.endobj. ..xref..207 19..0000000016 00000 n..0000001157 00000 n..0000001272 00000 n..0000001307 00000 n..0000001441 00000 n..0000001596 00000 n..0000002035 00000 n..0000002563 00000 n..0000002666 00000 n..0000002923 00000 n..0000003186 00000 n..0000003701 00000 n..0000003961 00000 n..0000037165 00000 n..0000054004 00000 n..0000070131 00000 n..0000071553 00000 n..0000071808 00000 n..0000000676 00000 n..trailer..<</Size 226/Root 208 0 R/Info 206 0 R/ID[<2D667FB695AF4EBB5E2EB1C113AEEDD6><C423B4BFA381BE4F9C5EFFF78A5AB2B1>]/Prev 819464>>..startxref..0..%%EOF.. ..225 0 obj.<</E 413/Filter/FlateDecode/I 445/L 429/Length 380/O 397/S 284>>stream..h.b```."q.......... ........(. .$.T....#CC..!!.`...nF....".mS.....!p.n..R...#.F....".....Ge\C....I..{..ZU..S...=....!.....2Q.mv.....<...A.."...bb.S.U."..;C.@".G..600.T40..1..yG.........kXF.._."..CC+@\|F..4P.I.Hp..J...\|..n........X..-ep.1

C:\Program Files (x86)\Tektronix\ArbExpress\Documentation\ArbE549f.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PDF document, version 1.4
Category:	dropped
Size (bytes):	8258953
Entropy (8bit):	7.946180407433681
Encrypted:	false
SSDEEP:	196608:NWhQSqNfgZUx3wn8HsSAy7dI7Iq3cOKlzi:cUNfgilw8M/yhRrZi
MD5:	BA9FC01FA806C5AAC09ADCB74B78FBA3
SHA1:	BFCB8D889A8BB8D81DD5E602816FFFC22D87B47C
SHA-256:	C61C56FA5A25C6097766E56D688D57B8A22A00A5D1427048C08F06F4013B0CCC
SHA-512:	DADE634257446B35FB835059CDCE7C6C99D91BAC9182463733CA7C78B9DD0810D9F89601EA6B643C1B467C0B7EFDD9C9D99B74FCB6460896321AE8E0E5025FAE
Malicious:	false
Preview:	%PDF-1.4.%......4300 0 obj.<</Linearized 1/L 8253456/O 4303/E 350537/N 216/T 8167334/H [ 756 3657]>>.endobj. ..xref..4300 23..0000000016 00000 n..0000004413 00000 n..0000004535 00000 n..0000004573 00000 n..0000004755 00000 n..0000004867 00000 n..0000004979 00000 n..0000005088 00000 n..0000005200 00000 n..0000005362 00000 n..0000005995 00000 n..0000006559 00000 n..0000006663 00000 n..0000006928 00000 n..0000007187 00000 n..0000007671 00000 n..0000007931 00000 n..0000041136 00000 n..0000058843 00000 n..0000081014 00000 n..0000082379 00000 n..0000082636 00000 n..0000000756 00000 n..trailer..<</Size 4323/Root 4301 0 R/Info 4299 0 R/ID[<69AEC049D3E80E75B29F0D13EB84BBE8><208088BDD979954295A7178F5471D58E>]/Prev 8167321>>..startxref..0..%%EOF.. ..4322 0 obj.<</E 6509/Filter/FlateDecode/I 6541/L 6525/Length 3549/O 6493/S 6256>>stream..h..Y.T....o~.$...A.....J.h.2.[..."...Ee........vnK0...E..v..EZ..h.s...?.ju.`Nw.{..V.mw..=..m..y.7.pn..}o...y.......~.............`..j...#......y.

C:\Program Files (x86)\Tektronix\ArbExpress\Documentation\ArbExpress Installation Manual.pdf (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PDF document, version 1.4, 4 pages
Category:	dropped
Size (bytes):	828138
Entropy (8bit):	7.9451206492467294
Encrypted:	false
SSDEEP:	24576:HCdcr3vE16zjFILkgiEL9kpDO30yECo2sNC:HCdc7vE14hv2LepCUZLNC
MD5:	DC0CC281F569D18346E0A49AECAFE251
SHA1:	947338AA8C896EAEE9CBE4167C41FF07DDB9BC17
SHA-256:	177C52E37EEF22797B45A260BB154BCA0F13C50348B4E24AB50E5A07C4982C26
SHA-512:	3106D28AE12DFA2422E9B458D0755C6D38D8C71F9FDB1FAB9C348C3A4063E4A5C726B64DC1FA720A228C908469401D24E8253659E6DF672B38CA7011C0F441B7
Malicious:	false
Preview:	%PDF-1.4.%......207 0 obj.<</Linearized 1/L 823737/O 210/E 339708/N 13/T 819476/H [ 676 481]>>.endobj. ..xref..207 19..0000000016 00000 n..0000001157 00000 n..0000001272 00000 n..0000001307 00000 n..0000001441 00000 n..0000001596 00000 n..0000002035 00000 n..0000002563 00000 n..0000002666 00000 n..0000002923 00000 n..0000003186 00000 n..0000003701 00000 n..0000003961 00000 n..0000037165 00000 n..0000054004 00000 n..0000070131 00000 n..0000071553 00000 n..0000071808 00000 n..0000000676 00000 n..trailer..<</Size 226/Root 208 0 R/Info 206 0 R/ID[<2D667FB695AF4EBB5E2EB1C113AEEDD6><C423B4BFA381BE4F9C5EFFF78A5AB2B1>]/Prev 819464>>..startxref..0..%%EOF.. ..225 0 obj.<</E 413/Filter/FlateDecode/I 445/L 429/Length 380/O 397/S 284>>stream..h.b```."q.......... ........(. .$.T....#CC..!!.`...nF....".mS.....!p.n..R...#.F....".....Ge\C....I..{..ZU..S...=....!.....2Q.mv.....<...A.."...bb.S.U."..;C.@".G..600.T40..1..yG.........kXF.._."..CC+@\|F..4P.I.Hp..J...\|..n........X..-ep.1

C:\Program Files (x86)\Tektronix\ArbExpress\Documentation\ArbExpress User Manual.pdf (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PDF document, version 1.4
Category:	dropped
Size (bytes):	8258953
Entropy (8bit):	7.946180407433681
Encrypted:	false
SSDEEP:	196608:NWhQSqNfgZUx3wn8HsSAy7dI7Iq3cOKlzi:cUNfgilw8M/yhRrZi
MD5:	BA9FC01FA806C5AAC09ADCB74B78FBA3
SHA1:	BFCB8D889A8BB8D81DD5E602816FFFC22D87B47C
SHA-256:	C61C56FA5A25C6097766E56D688D57B8A22A00A5D1427048C08F06F4013B0CCC
SHA-512:	DADE634257446B35FB835059CDCE7C6C99D91BAC9182463733CA7C78B9DD0810D9F89601EA6B643C1B467C0B7EFDD9C9D99B74FCB6460896321AE8E0E5025FAE
Malicious:	false
Preview:	%PDF-1.4.%......4300 0 obj.<</Linearized 1/L 8253456/O 4303/E 350537/N 216/T 8167334/H [ 756 3657]>>.endobj. ..xref..4300 23..0000000016 00000 n..0000004413 00000 n..0000004535 00000 n..0000004573 00000 n..0000004755 00000 n..0000004867 00000 n..0000004979 00000 n..0000005088 00000 n..0000005200 00000 n..0000005362 00000 n..0000005995 00000 n..0000006559 00000 n..0000006663 00000 n..0000006928 00000 n..0000007187 00000 n..0000007671 00000 n..0000007931 00000 n..0000041136 00000 n..0000058843 00000 n..0000081014 00000 n..0000082379 00000 n..0000082636 00000 n..0000000756 00000 n..trailer..<</Size 4323/Root 4301 0 R/Info 4299 0 R/ID[<69AEC049D3E80E75B29F0D13EB84BBE8><208088BDD979954295A7178F5471D58E>]/Prev 8167321>>..startxref..0..%%EOF.. ..4322 0 obj.<</E 6509/Filter/FlateDecode/I 6541/L 6525/Length 3549/O 6493/S 6256>>stream..h..Y.T....o~.$...A.....J.h.2.[..."...Ee........vnK0...E..v..EZ..h.s...?.ju.`Nw.{..V.mw..=..m..y.7.pn..}o...y.......~.............`..j...#......y.

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Ampl43f5.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	505
Entropy (8bit):	4.969398482301632
Encrypted:	false
SSDEEP:	12:m4IZdO7IhelNoF0BE6Oi+hPw4s2nYVWPHtFOP:QbcWIoy5+hogFIP
MD5:	FCB46D6B1D150E1D26521B99B556F7C7
SHA1:	D5FD3FB1A0953F326904BA77E43F4EB5E710B6B1
SHA-256:	D4E500AEA88CB9808F5EBC5CE9D6DF11F765E2AD07E5001BE41EA41D16133096
SHA-512:	287225D079909108F2FB3CAE35E8D9D7E252440BE0C2BE1FFF4498C19E056544DE71FC8384FE36BF0C21E916E778ABCC1DF09688CEB5D74F142BD8F069E17634
Malicious:	false
Preview:	#This equation represents Amplitude Modulation..# Carrier is 10Hz cosine wave with 1V peak amp & ..#a 0.5 second time advance (a negative delay). ..#The signal is .5 Hz sine wave with a 1V peak amp...#View at: Amp=2v Offset=0v Start=0s Stop=1s..#Change the '.5' to change the signal frequency...#Change the '10' to change the carrier frequency...#Change the '+.5' to change the time shift...#View the waveform with Settings: Points:1M, SR:1MS/s....range(0us,1s)..sin(2pi0.5t) cos(2pi10*(t+0.5))....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Amplitude Modulation.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	505
Entropy (8bit):	4.969398482301632
Encrypted:	false
SSDEEP:	12:m4IZdO7IhelNoF0BE6Oi+hPw4s2nYVWPHtFOP:QbcWIoy5+hogFIP
MD5:	FCB46D6B1D150E1D26521B99B556F7C7
SHA1:	D5FD3FB1A0953F326904BA77E43F4EB5E710B6B1
SHA-256:	D4E500AEA88CB9808F5EBC5CE9D6DF11F765E2AD07E5001BE41EA41D16133096
SHA-512:	287225D079909108F2FB3CAE35E8D9D7E252440BE0C2BE1FFF4498C19E056544DE71FC8384FE36BF0C21E916E778ABCC1DF09688CEB5D74F142BD8F069E17634
Malicious:	false
Preview:	#This equation represents Amplitude Modulation..# Carrier is 10Hz cosine wave with 1V peak amp & ..#a 0.5 second time advance (a negative delay). ..#The signal is .5 Hz sine wave with a 1V peak amp...#View at: Amp=2v Offset=0v Start=0s Stop=1s..#Change the '.5' to change the signal frequency...#Change the '10' to change the carrier frequency...#Change the '+.5' to change the time shift...#View the waveform with Settings: Points:1M, SR:1MS/s....range(0us,1s)..sin(2pi0.5t) cos(2pi10*(t+0.5))....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Amsw4405.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	390
Entropy (8bit):	4.949868493062765
Encrypted:	false
SSDEEP:	12:3H2HFLDM1xjF+IYaDNF8NuOuqwNAdnYf7G2:aLI1X+IYyNF8N+nSyT
MD5:	F28E823CE6BA3260FE9A014B46A3D92F
SHA1:	5D4BA0C3306E21AB3D7A4720084A0BA98F188DDD
SHA-256:	C92E49BC8767FFDF3AA238DE80579FFA5B764CE9D7F2BCE06887F4A34D7372A3
SHA-512:	1E01F39227FACB6A607345E30C1413EB951C44AD1ABA5BB0C08D5619E269088D1C965FD1393F43BC9532E8F11E74D79E885BBCD80A3B261828266E21F8A83B93
Malicious:	false
Preview:	#This waveform is for Amsweep waveform..#Settings: Number of Points 1M, Sampling Rate 1MS/s..#Carrier signal is a 22.5 Hz sine wave with .5V pk amp...#The 't'factor will cause increase in amp...#Change the '.5' to change the rate of growth...#Change the '22.5' to change the carrier frequency..#View the Waveform with Settings Points:50K, SR:50K.....range(0s,1s)..0.5tsin(2pi22.5*t)....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Amsweep.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	390
Entropy (8bit):	4.949868493062765
Encrypted:	false
SSDEEP:	12:3H2HFLDM1xjF+IYaDNF8NuOuqwNAdnYf7G2:aLI1X+IYyNF8N+nSyT
MD5:	F28E823CE6BA3260FE9A014B46A3D92F
SHA1:	5D4BA0C3306E21AB3D7A4720084A0BA98F188DDD
SHA-256:	C92E49BC8767FFDF3AA238DE80579FFA5B764CE9D7F2BCE06887F4A34D7372A3
SHA-512:	1E01F39227FACB6A607345E30C1413EB951C44AD1ABA5BB0C08D5619E269088D1C965FD1393F43BC9532E8F11E74D79E885BBCD80A3B261828266E21F8A83B93
Malicious:	false
Preview:	#This waveform is for Amsweep waveform..#Settings: Number of Points 1M, Sampling Rate 1MS/s..#Carrier signal is a 22.5 Hz sine wave with .5V pk amp...#The 't'factor will cause increase in amp...#Change the '.5' to change the rate of growth...#Change the '22.5' to change the carrier frequency..#View the Waveform with Settings Points:50K, SR:50K.....range(0s,1s)..0.5tsin(2pi22.5*t)....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Damp4405.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	450
Entropy (8bit):	5.120545096930141
Encrypted:	false
SSDEEP:	6:LVIVGc9BkwIOFTNaDd4VFBsovsmJaF1z8U2n3ofPFPExG2C3aoV:W0aBk/QNaDd4VFuAJaLz92nYftPSJCtV
MD5:	0C1288F5BBBC555F5A8667FD41A5328C
SHA1:	18D8A5B892FD098275709A819E2D3F12504AD2CA
SHA-256:	71A2C40EB5FC2260791B4A6F4C088AC7ED2FC0FB31D7575FBCB5A1E60D47DFB6
SHA-512:	E9AEDC0ABCCBE03D76100F1B83756DCE328738365B2C6087E81BC6E8A1C1BFDDC993227D49E3CD58558C857C16E6CDBE33F12F7E15BEAA72EE10A66657454B1D
Malicious:	false
Preview:	#This equation is for Damped Sine Waveform..#K0 indicates the inductance(L),..#k1 indicates the capacitance (C),..#k3 indicates the damping time constant...#The equation represents an attenuated amplitude ..#waveform with a resonance frequency ..#of 1MHz(L = 2mH, C-12.66pf) and a damping time: 6us...#View the waveform with Settings Points:4K,SR:100MS/s....range(0us,40us)..K0=2e-3..K1=12.66e-12..K2=K0K1..K3=6e-6..exp(-t/k3)sin(1/sqrt(k2) *t)....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Damping Sine.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	450
Entropy (8bit):	5.120545096930141
Encrypted:	false
SSDEEP:	6:LVIVGc9BkwIOFTNaDd4VFBsovsmJaF1z8U2n3ofPFPExG2C3aoV:W0aBk/QNaDd4VFuAJaLz92nYftPSJCtV
MD5:	0C1288F5BBBC555F5A8667FD41A5328C
SHA1:	18D8A5B892FD098275709A819E2D3F12504AD2CA
SHA-256:	71A2C40EB5FC2260791B4A6F4C088AC7ED2FC0FB31D7575FBCB5A1E60D47DFB6
SHA-512:	E9AEDC0ABCCBE03D76100F1B83756DCE328738365B2C6087E81BC6E8A1C1BFDDC993227D49E3CD58558C857C16E6CDBE33F12F7E15BEAA72EE10A66657454B1D
Malicious:	false
Preview:	#This equation is for Damped Sine Waveform..#K0 indicates the inductance(L),..#k1 indicates the capacitance (C),..#k3 indicates the damping time constant...#The equation represents an attenuated amplitude ..#waveform with a resonance frequency ..#of 1MHz(L = 2mH, C-12.66pf) and a damping time: 6us...#View the waveform with Settings Points:4K,SR:100MS/s....range(0us,40us)..K0=2e-3..K1=12.66e-12..K2=K0K1..K3=6e-6..exp(-t/k3)sin(1/sqrt(k2) *t)....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Doub4415.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	289
Entropy (8bit):	4.857688459447877
Encrypted:	false
SSDEEP:	6:CBq63Ls4Gvn3ofUKWDEPoXx49PAqtLeAJXOoP+n:363hGvnYfTWD0TP3Je8+n
MD5:	FE5D6B47691F6AD04AF3523135C29F3D
SHA1:	85A79D23313F2812982FA3AC46630795E9ADF1A2
SHA-256:	5ADFF3386E7F26FE9D83F4C711A6B6D74931D2CDFA1009901D61BB06B837D3BF
SHA-512:	D258893F6E728F8AF5158D9040DC53B97BC689DBDC1431922053FEB8979CC2E284114E9249346A4D1E015F9FA7402E0E6358738A266CEBD4A03510D3C0704A7F
Malicious:	false
Preview:	#This equation is the rising & falling exponential function..#K1 and K2 are the rising and falling time constants..#View the waveform with Settings Points:100K,SR:1GS/s....range(0,100us)..k1=1e-6 #rise time constant..k2=10e-6 #fall time constant..exp(-t/k2)-exp(-t/k1)..norm()......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Double_Exp.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	289
Entropy (8bit):	4.857688459447877
Encrypted:	false
SSDEEP:	6:CBq63Ls4Gvn3ofUKWDEPoXx49PAqtLeAJXOoP+n:363hGvnYfTWD0TP3Je8+n
MD5:	FE5D6B47691F6AD04AF3523135C29F3D
SHA1:	85A79D23313F2812982FA3AC46630795E9ADF1A2
SHA-256:	5ADFF3386E7F26FE9D83F4C711A6B6D74931D2CDFA1009901D61BB06B837D3BF
SHA-512:	D258893F6E728F8AF5158D9040DC53B97BC689DBDC1431922053FEB8979CC2E284114E9249346A4D1E015F9FA7402E0E6358738A266CEBD4A03510D3C0704A7F
Malicious:	false
Preview:	#This equation is the rising & falling exponential function..#K1 and K2 are the rising and falling time constants..#View the waveform with Settings Points:100K,SR:1GS/s....range(0,100us)..k1=1e-6 #rise time constant..k2=10e-6 #fall time constant..exp(-t/k2)-exp(-t/k1)..norm()......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Exp_4415.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.936413376137447
Encrypted:	false
SSDEEP:	3:DaL2CWVrADcyWYVg3+fYRV3oyMLwEkPE2nrMY4VNtiyovyn:LredVin3ofGPEmubvn
MD5:	7C62DD220E67965419992DB8462B3666
SHA1:	356AEBB0635936EAADF828BB251B2C84AE3E1EEA
SHA-256:	452A172DD1EED198FFA0C86143EC7BDE76F1514599EB4B8D7403C92CC35841F6
SHA-512:	876E3C455E78593341442D2673965C534E2A60716C2FEEE8C50E356005CA49E83AE0F43C95684214810B3A2AD137EE9A8FD4992777A1CCB93AC770BD4C59E285
Malicious:	false
Preview:	#This equation is for Exponential Rise waveform..#View the waveform with Settings Points:100K,SR:1MS/s....range(0,10ms)..1- exp(-5*t)......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Exp_rise.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.936413376137447
Encrypted:	false
SSDEEP:	3:DaL2CWVrADcyWYVg3+fYRV3oyMLwEkPE2nrMY4VNtiyovyn:LredVin3ofGPEmubvn
MD5:	7C62DD220E67965419992DB8462B3666
SHA1:	356AEBB0635936EAADF828BB251B2C84AE3E1EEA
SHA-256:	452A172DD1EED198FFA0C86143EC7BDE76F1514599EB4B8D7403C92CC35841F6
SHA-512:	876E3C455E78593341442D2673965C534E2A60716C2FEEE8C50E356005CA49E83AE0F43C95684214810B3A2AD137EE9A8FD4992777A1CCB93AC770BD4C59E285
Malicious:	false
Preview:	#This equation is for Exponential Rise waveform..#View the waveform with Settings Points:100K,SR:1MS/s....range(0,10ms)..1- exp(-5*t)......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Expo4424.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	397
Entropy (8bit):	4.976605528490228
Encrypted:	false
SSDEEP:	12:v3NVi6GZu1fvP8yed81yedkh28inYfoPakveH:GQ1PQomXoCkM
MD5:	D891AA5C9E06337D5F26F4FA306B32F0
SHA1:	A3A12735CDA61A59AC7AA9F3FFDAFEA33E38BD2D
SHA-256:	70C4EBC9D2162497FC9A805156873C49B26D3311555BF6569C0EF12256F109A6
SHA-512:	55EB2DF07A2EB5CE57C0CC873BA74695E9BA0F77FB8C52FDF77BB075DF3004511EC06C0DA819A3F755E34B7A835DD47BBFB2A250226AF8456251803A8969292D
Malicious:	false
Preview:	#An exponentially decaying sine wave with ..#Freq=1KHz,5V peak amp,decaying time constant 10ms...#Change the '5' to change the peak amp of the sine wave...#Change the '10^3' to change the frequency of the sine wave...#Change the '10^-2' to change the time constant of the decay..#View the waveform with Settings Points:10K, SR:1MS/s....range(0ms,10ms)..k0=1e3..k1=1e-2..5sin(2pik0t)*exp(-t/k1)

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Exponential Sine.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	397
Entropy (8bit):	4.976605528490228
Encrypted:	false
SSDEEP:	12:v3NVi6GZu1fvP8yed81yedkh28inYfoPakveH:GQ1PQomXoCkM
MD5:	D891AA5C9E06337D5F26F4FA306B32F0
SHA1:	A3A12735CDA61A59AC7AA9F3FFDAFEA33E38BD2D
SHA-256:	70C4EBC9D2162497FC9A805156873C49B26D3311555BF6569C0EF12256F109A6
SHA-512:	55EB2DF07A2EB5CE57C0CC873BA74695E9BA0F77FB8C52FDF77BB075DF3004511EC06C0DA819A3F755E34B7A835DD47BBFB2A250226AF8456251803A8969292D
Malicious:	false
Preview:	#An exponentially decaying sine wave with ..#Freq=1KHz,5V peak amp,decaying time constant 10ms...#Change the '5' to change the peak amp of the sine wave...#Change the '10^3' to change the frequency of the sine wave...#Change the '10^-2' to change the time constant of the decay..#View the waveform with Settings Points:10K, SR:1MS/s....range(0ms,10ms)..k0=1e3..k1=1e-2..5sin(2pik0t)*exp(-t/k1)

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\FM S4424.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	408
Entropy (8bit):	4.859348265206968
Encrypted:	false
SSDEEP:	12:pW0NNQe14wvo/s1xQ3o4uvoxnYf7IrEoaIF8ePdP:pXNNjw/nYPw28rEoavqP
MD5:	CD156D4AFD246FF83666BB1A138123BB
SHA1:	E15712B02761AA43A90AE69C4A25033B3B63756B
SHA-256:	290A151A4261ED9FD2AB455AA9B6A59C2B6A225973877F2681DA4C2C1B730363
SHA-512:	09FA5FC65740B6A54B0FAB5893E5A10C25AABBB9428B4A150B18586BD5A17023088E9689AC4F86155106DBEEC14ED05B54170E83902953B2E2AB7748060F0E64
Malicious:	false
Preview:	#The carrier is a 40 Hz sine wave with a .97 volt DC offset...#The signal is a 2 Hz cosine wave...#Change '.97' to change the offset of the carrier sine wave..#Change the '2' to change the freq of the signal cosine wave..#Change the '40'to change the freq of the carrier sine wave..#View the waveform with Settings Points:1M,SR:5MS/s......range(0ms,200ms)..(sin(80(pit-pi))+0.97) * cos((80(pit-pi))/20)..

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\FM Stereo.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	408
Entropy (8bit):	4.859348265206968
Encrypted:	false
SSDEEP:	12:pW0NNQe14wvo/s1xQ3o4uvoxnYf7IrEoaIF8ePdP:pXNNjw/nYPw28rEoavqP
MD5:	CD156D4AFD246FF83666BB1A138123BB
SHA1:	E15712B02761AA43A90AE69C4A25033B3B63756B
SHA-256:	290A151A4261ED9FD2AB455AA9B6A59C2B6A225973877F2681DA4C2C1B730363
SHA-512:	09FA5FC65740B6A54B0FAB5893E5A10C25AABBB9428B4A150B18586BD5A17023088E9689AC4F86155106DBEEC14ED05B54170E83902953B2E2AB7748060F0E64
Malicious:	false
Preview:	#The carrier is a 40 Hz sine wave with a .97 volt DC offset...#The signal is a 2 Hz cosine wave...#Change '.97' to change the offset of the carrier sine wave..#Change the '2' to change the freq of the signal cosine wave..#Change the '40'to change the freq of the carrier sine wave..#View the waveform with Settings Points:1M,SR:5MS/s......range(0ms,200ms)..(sin(80(pit-pi))+0.97) * cos((80(pit-pi))/20)..

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Freq4434.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	485
Entropy (8bit):	4.945751889940425
Encrypted:	false
SSDEEP:	12:bA9bw8uE7DipN8213WIDSfbHUmfyDa5XJHUlPVQey:Ys8riVzSfXyDs5CPOf
MD5:	B22FDD3526C9365142D0B61FF403BF97
SHA1:	FC2875DF4902684FC7A2FFF75DBE84172558AF0E
SHA-256:	ABBBB6F9B7B8BFB06F887D586250DD031B91791F4E793219BBED173B5FEFF7FE
SHA-512:	74E8EEDDF97ADFFAAF1BA87F3BEE20CF8190793E38E1E5C8D0304AF14E089D1347C75FC8F1287A22DA2CE4B863AA0F2D66FE072C5AE554753C619E1F0901D585
Malicious:	false
Preview:	#This equation is for Frequency Modulation waveform..#k0 = modulation signal frequency..#k1 is carrier freq & k2 is the freq deviation. ..#K0 is the frequency of the cosine wave ..#that is used to modulate a sine wave of freq k1...#The Modulation index is given by k2/k0...#View the waveform with the Settings Points:2K SR=100M....range (0,20us)..k0=50e3. #modulation frequency..k1=2.5e6 #carrier freqeuncy..k2=2e6 #frequency deviation....Sin(2pik1t +k2/k0sin(2pik0*t))........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Frequency Modulation.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	485
Entropy (8bit):	4.945751889940425
Encrypted:	false
SSDEEP:	12:bA9bw8uE7DipN8213WIDSfbHUmfyDa5XJHUlPVQey:Ys8riVzSfXyDs5CPOf
MD5:	B22FDD3526C9365142D0B61FF403BF97
SHA1:	FC2875DF4902684FC7A2FFF75DBE84172558AF0E
SHA-256:	ABBBB6F9B7B8BFB06F887D586250DD031B91791F4E793219BBED173B5FEFF7FE
SHA-512:	74E8EEDDF97ADFFAAF1BA87F3BEE20CF8190793E38E1E5C8D0304AF14E089D1347C75FC8F1287A22DA2CE4B863AA0F2D66FE072C5AE554753C619E1F0901D585
Malicious:	false
Preview:	#This equation is for Frequency Modulation waveform..#k0 = modulation signal frequency..#k1 is carrier freq & k2 is the freq deviation. ..#K0 is the frequency of the cosine wave ..#that is used to modulate a sine wave of freq k1...#The Modulation index is given by k2/k0...#View the waveform with the Settings Points:2K SR=100M....range (0,20us)..k0=50e3. #modulation frequency..k1=2.5e6 #carrier freqeuncy..k2=2e6 #frequency deviation....Sin(2pik1t +k2/k0sin(2pik0*t))........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Gaus4434.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	331
Entropy (8bit):	4.76249485641638
Encrypted:	false
SSDEEP:	6:m4ZdAcnkBSJ1m2K2ZzKGE4RRwrAMjfQfDX0MFFSyKGEP1kp:m4ZCcnkkJbK2ZzG4R+UmfQfr0MFIJNC
MD5:	8139C77E3F8F178BFC28285513C529B3
SHA1:	4EEAC2EFEC5E9C847E85CCA97C712F9B9F43F198
SHA-256:	EA52B1F3EA5430C24F09B4D02B3ABE2839308466730F4D5FBB94B7E2BDA01ABA
SHA-512:	FD2900EC8DDF5B2EF6506E8077C960B0A803F6DE23A0A6C69F3AC2F6DBD3F74E6674C347946B46ED5F7DB72D26147A84A1CCE60A026A45E7C32526C93BC9C8FD
Malicious:	false
Preview:	#This equation represents the Gaussian pulse...#Ko indicates the half width for the pulse,..#K1 indicates the peak location of the pulse..#View the waveform with the Settings Points:10K,SR:1G......range(0,10us)..k0=0.3e-6 #pulse width..k1=1.28e-6 #peak location..exp(-ln(2) * (( 2 * (t-k1)/k0)^2)) ....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Gaussian.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	331
Entropy (8bit):	4.76249485641638
Encrypted:	false
SSDEEP:	6:m4ZdAcnkBSJ1m2K2ZzKGE4RRwrAMjfQfDX0MFFSyKGEP1kp:m4ZCcnkkJbK2ZzG4R+UmfQfr0MFIJNC
MD5:	8139C77E3F8F178BFC28285513C529B3
SHA1:	4EEAC2EFEC5E9C847E85CCA97C712F9B9F43F198
SHA-256:	EA52B1F3EA5430C24F09B4D02B3ABE2839308466730F4D5FBB94B7E2BDA01ABA
SHA-512:	FD2900EC8DDF5B2EF6506E8077C960B0A803F6DE23A0A6C69F3AC2F6DBD3F74E6674C347946B46ED5F7DB72D26147A84A1CCE60A026A45E7C32526C93BC9C8FD
Malicious:	false
Preview:	#This equation represents the Gaussian pulse...#Ko indicates the half width for the pulse,..#K1 indicates the peak location of the pulse..#View the waveform with the Settings Points:10K,SR:1G......range(0,10us)..k0=0.3e-6 #pulse width..k1=1.28e-6 #peak location..exp(-ln(2) * (( 2 * (t-k1)/k0)^2)) ....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Half AM.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	497
Entropy (8bit):	4.93102542385619
Encrypted:	false
SSDEEP:	12:cUO5GkXDGECWokCNueciuvoc+vo11xQNoxUmAPIabhi/:u3zmvBN2w/wm6ORg/
MD5:	D33912084734C25874BCDE2C565FAECE
SHA1:	C6E84929BE959CE19A6D04531535F16CC2AA0B1D
SHA-256:	ECA7B9EBAC80C530731C6013248D3E8CC44437C738459A29485DBC7682D4F7B4
SHA-512:	5726F95AC55D851464138786D321D7BD5935A32D5E2FB7A771561F33B1C526632C87AFE1AD20020C014373B7E5EE537DD41DB6423411511F1AE40A976EF233AB
Malicious:	false
Preview:	#Half AM. This is an AM modulated wave..#The bottom half inverted and added to the top half...#The carrier wave is a 40 Hz sine wave..#with a DC offset of .97V...#The signal is a 2 Hz sine wave...#Change '10'to change freq of the carrier sine wave..#Change '.97'to change DC offset of the carrier sine wave..#Change '8' to change the freq of the signal sine wave..#View the waveform with the Settings:Points: 500K, SR:1MS/s....range(0ms,500ms)..abs((sin(8pi10t)+0.97) sin((8pi10*t)/20))....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Half Cycle Sine Wave.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.830206090819378
Encrypted:	false
SSDEEP:	3:jJEN2CWVQCFEXgDFyUALGmN+V9FgrLVyGo+fYR9AMRxyMLwEG12+/sIov:NpQCFEQDFVAymQVgtyprAMjfY14F
MD5:	76F61980C368DB2272611E02C60F51D5
SHA1:	BD0F347580B8BE6148F2F60E9FA3784950239C06
SHA-256:	48C7A14B9CB70CF01DD28722F57FF88053A4C41416CD7BE439DA6CA43E9C9BC8
SHA-512:	9268F44399790347DD4C22680170FD64E0BE715A4765CC425701AB9B4EB2DB95CD64E5675FBDB49B3C6AF0710C73EF40CBD2F172950B336E7F024A7F5C87CE45
Malicious:	false
Preview:	#This Equation is for generating a Half cycle Sine Wave..#Change the range according to your settings..#View the waveform with the Settings Points:100K,SR:50M....range(0,2ms)..sin(0.5 * w)....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Half4444.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	497
Entropy (8bit):	4.93102542385619
Encrypted:	false
SSDEEP:	12:cUO5GkXDGECWokCNueciuvoc+vo11xQNoxUmAPIabhi/:u3zmvBN2w/wm6ORg/
MD5:	D33912084734C25874BCDE2C565FAECE
SHA1:	C6E84929BE959CE19A6D04531535F16CC2AA0B1D
SHA-256:	ECA7B9EBAC80C530731C6013248D3E8CC44437C738459A29485DBC7682D4F7B4
SHA-512:	5726F95AC55D851464138786D321D7BD5935A32D5E2FB7A771561F33B1C526632C87AFE1AD20020C014373B7E5EE537DD41DB6423411511F1AE40A976EF233AB
Malicious:	false
Preview:	#Half AM. This is an AM modulated wave..#The bottom half inverted and added to the top half...#The carrier wave is a 40 Hz sine wave..#with a DC offset of .97V...#The signal is a 2 Hz sine wave...#Change '10'to change freq of the carrier sine wave..#Change '.97'to change DC offset of the carrier sine wave..#Change '8' to change the freq of the signal sine wave..#View the waveform with the Settings:Points: 500K, SR:1MS/s....range(0ms,500ms)..abs((sin(8pi10t)+0.97) sin((8pi10*t)/20))....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Half4453.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.830206090819378
Encrypted:	false
SSDEEP:	3:jJEN2CWVQCFEXgDFyUALGmN+V9FgrLVyGo+fYR9AMRxyMLwEG12+/sIov:NpQCFEQDFVAymQVgtyprAMjfY14F
MD5:	76F61980C368DB2272611E02C60F51D5
SHA1:	BD0F347580B8BE6148F2F60E9FA3784950239C06
SHA-256:	48C7A14B9CB70CF01DD28722F57FF88053A4C41416CD7BE439DA6CA43E9C9BC8
SHA-512:	9268F44399790347DD4C22680170FD64E0BE715A4765CC425701AB9B4EB2DB95CD64E5675FBDB49B3C6AF0710C73EF40CBD2F172950B336E7F024A7F5C87CE45
Malicious:	false
Preview:	#This Equation is for generating a Half cycle Sine Wave..#Change the range according to your settings..#View the waveform with the Settings Points:100K,SR:50M....range(0,2ms)..sin(0.5 * w)....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Inte4453.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	364
Entropy (8bit):	4.876191911381749
Encrypted:	false
SSDEEP:	6:fUkzhRGN31onAHv7eFkSVKRC0G/RCC3y/rAMjfNmwPEbQbVLQE5adOvoQVLQE0o0:fqhiAHzKVKRtQR7C/UmfXP9bVLyyxLab
MD5:	55795B722BD757E36B0C09B3E97D209F
SHA1:	05699F10AECAD9D91CE794B6A5B8D2D8E173427F
SHA-256:	D6CE43FB56E0446A8C85149956A3024DF6C62434722CAE269E05F9A69761101F
SHA-512:	A28D2427E067CDFE6AB9315ECBE3BAA0986E738715A5E41346ABEB4B5061D8048503E4517097F3E383934D925A339908F890A900826BE9CF4DBAED3DA6F040DC
Malicious:	false
Preview:	#This equation Integrates the function Using integ()..# over the range specified with range()...#The integ() comprises an entire line...# After integ(),specify normalization norm() as necessary...#View the waveform with the Settings Points:1000,SR:10MS/s....range(0,33us)..-0.5..range(33us,66us)..0.5..range(66us,100us)..-0.5..range(0,100us)..integ()..norm()......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Inte4463.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	467
Entropy (8bit):	4.77019913944265
Encrypted:	false
SSDEEP:	12:3tsTbNmEaerr1ckTFeJPrkvZnoxuvqOxQVk2UmfK2+:WXNxrOpFrk99ajE
MD5:	3E0520160023F34469E4E5EF6C6F69EC
SHA1:	E4E7AFF70BA491A592B871E49539C8546254EEC2
SHA-256:	910233B1A7383E07C99D47CE7DAC14A3D62A5AF8171025897DB83675D439E256
SHA-512:	E585F12CE8F6E4465B0D459B714BB96FBD82CC4413B8E98D43F0BEA8A71A6FEF3BEF8EB7FCFA0A6EB800560D58FD571106666751B524D475C7A96B486F519C51
Malicious:	false
Preview:	#IM modulated wave. ..#The carrier is a 52.5Hz sine wave with .2v peak...#The signal wave is a .5 Hz sine wave...#The two waves have been added rather than multiplied...#Change '.2' to change the peak volt of the carrier wave...#Change the '52.5' to change the freq of the carrier wave...#Change the '.5' to change the freq of the signal wave...#View the waveform with the Settings Points:1M, SR:1M....range (0,1s)..0.2sin(2pi52.5t) + sin(2pi0.5*t)............

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Integ.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	364
Entropy (8bit):	4.876191911381749
Encrypted:	false
SSDEEP:	6:fUkzhRGN31onAHv7eFkSVKRC0G/RCC3y/rAMjfNmwPEbQbVLQE5adOvoQVLQE0o0:fqhiAHzKVKRtQR7C/UmfXP9bVLyyxLab
MD5:	55795B722BD757E36B0C09B3E97D209F
SHA1:	05699F10AECAD9D91CE794B6A5B8D2D8E173427F
SHA-256:	D6CE43FB56E0446A8C85149956A3024DF6C62434722CAE269E05F9A69761101F
SHA-512:	A28D2427E067CDFE6AB9315ECBE3BAA0986E738715A5E41346ABEB4B5061D8048503E4517097F3E383934D925A339908F890A900826BE9CF4DBAED3DA6F040DC
Malicious:	false
Preview:	#This equation Integrates the function Using integ()..# over the range specified with range()...#The integ() comprises an entire line...# After integ(),specify normalization norm() as necessary...#View the waveform with the Settings Points:1000,SR:10MS/s....range(0,33us)..-0.5..range(33us,66us)..0.5..range(66us,100us)..-0.5..range(0,100us)..integ()..norm()......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Integer.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	467
Entropy (8bit):	4.77019913944265
Encrypted:	false
SSDEEP:	12:3tsTbNmEaerr1ckTFeJPrkvZnoxuvqOxQVk2UmfK2+:WXNxrOpFrk99ajE
MD5:	3E0520160023F34469E4E5EF6C6F69EC
SHA1:	E4E7AFF70BA491A592B871E49539C8546254EEC2
SHA-256:	910233B1A7383E07C99D47CE7DAC14A3D62A5AF8171025897DB83675D439E256
SHA-512:	E585F12CE8F6E4465B0D459B714BB96FBD82CC4413B8E98D43F0BEA8A71A6FEF3BEF8EB7FCFA0A6EB800560D58FD571106666751B524D475C7A96B486F519C51
Malicious:	false
Preview:	#IM modulated wave. ..#The carrier is a 52.5Hz sine wave with .2v peak...#The signal wave is a .5 Hz sine wave...#The two waves have been added rather than multiplied...#Change '.2' to change the peak volt of the carrier wave...#Change the '52.5' to change the freq of the carrier wave...#Change the '.5' to change the freq of the signal wave...#View the waveform with the Settings Points:1M, SR:1M....range (0,1s)..0.2sin(2pi52.5t) + sin(2pi0.5*t)............

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\InterMod.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	467
Entropy (8bit):	4.77019913944265
Encrypted:	false
SSDEEP:	12:3tsTbNmEaerr1ckTFeJPrkvZnoxuvqOxQVk2UmfK2+:WXNxrOpFrk99ajE
MD5:	3E0520160023F34469E4E5EF6C6F69EC
SHA1:	E4E7AFF70BA491A592B871E49539C8546254EEC2
SHA-256:	910233B1A7383E07C99D47CE7DAC14A3D62A5AF8171025897DB83675D439E256
SHA-512:	E585F12CE8F6E4465B0D459B714BB96FBD82CC4413B8E98D43F0BEA8A71A6FEF3BEF8EB7FCFA0A6EB800560D58FD571106666751B524D475C7A96B486F519C51
Malicious:	false
Preview:	#IM modulated wave. ..#The carrier is a 52.5Hz sine wave with .2v peak...#The signal wave is a .5 Hz sine wave...#The two waves have been added rather than multiplied...#Change '.2' to change the peak volt of the carrier wave...#Change the '52.5' to change the freq of the carrier wave...#Change the '.5' to change the freq of the signal wave...#View the waveform with the Settings Points:1M, SR:1M....range (0,1s)..0.2sin(2pi52.5t) + sin(2pi0.5*t)............

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Line4472.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	264
Entropy (8bit):	5.053587940932463
Encrypted:	false
SSDEEP:	3:DaL2CWV/AVwMIVbUfYR9AMRxxLBhxhwPE2+RyUnjVFtI8XkwCFD7RtVkFFFmIJMe:L/AxIVb1rAMjx73wPEDDVnVdkkFFkkEa
MD5:	AFCEA1DAB3A5DBB948B8616EED6E7D6C
SHA1:	D70DDF8A7C51BD7392F626C82EED188B8B726A37
SHA-256:	3EBAF1E492B133E288670E2D3E839459EB9F8C2F5A7C0B7555C1B31BE9181DA7
SHA-512:	06C4083202EE00D1FD6F5498DB32E8B384C31246F5BA3F8B266E0A3393A5ABF08E269F00D8CC5A9D445030EE82DBA4887BC26C6A88431EFCCE7C27B053631E2F
Malicious:	false
Preview:	#This equation is for Linear Sweep Waveform..##View the waveform with the Settings:Points:50K,SR:10MS/s....range(0, 5ms)..k0=1.6e-3 #sweep period..k1=5e3 #starting frequency..k2=50e-3 #ending frequency..sin(2pik1t+2pi(k2-k1)(t^2)/2/k0)....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Linear_Sweep.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	264
Entropy (8bit):	5.053587940932463
Encrypted:	false
SSDEEP:	3:DaL2CWV/AVwMIVbUfYR9AMRxxLBhxhwPE2+RyUnjVFtI8XkwCFD7RtVkFFFmIJMe:L/AxIVb1rAMjx73wPEDDVnVdkkFFkkEa
MD5:	AFCEA1DAB3A5DBB948B8616EED6E7D6C
SHA1:	D70DDF8A7C51BD7392F626C82EED188B8B726A37
SHA-256:	3EBAF1E492B133E288670E2D3E839459EB9F8C2F5A7C0B7555C1B31BE9181DA7
SHA-512:	06C4083202EE00D1FD6F5498DB32E8B384C31246F5BA3F8B266E0A3393A5ABF08E269F00D8CC5A9D445030EE82DBA4887BC26C6A88431EFCCE7C27B053631E2F
Malicious:	false
Preview:	#This equation is for Linear Sweep Waveform..##View the waveform with the Settings:Points:50K,SR:10MS/s....range(0, 5ms)..k0=1.6e-3 #sweep period..k1=5e3 #starting frequency..k2=50e-3 #ending frequency..sin(2pik1t+2pi(k2-k1)(t^2)/2/k0)....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Log 4482.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.099670085906036
Encrypted:	false
SSDEEP:	6:LPuVGaW0xxjrAMjf73wPETvHkkFFGoLnAKNAXPUEoan:Lu0a5jUmfMPQEkxIIan
MD5:	7956BA42014702F58D208713C787E20E
SHA1:	16D60165E3C811E9F75525270C7C21B58E35AAA6
SHA-256:	AF6DDDEFAC0DF61177D9D75E3D8E50F0F599674B83AE4C1CBE3FCC53332664A4
SHA-512:	9B825321B914D9EA49ADBE2C129EE11A0911B72E9D85541861ABF5BF1FA3984F916D7A8815CCBEE67EFBC68BC6A75EC8C8AD1793F4CD1C53D861B8E549E0CEE1
Malicious:	false
Preview:	#This equation is for Log Sweep waveform..#K0 indicates sweep Period;..# K1 and K2 are the start and end frequencys...#View the waveform with the Settings Points:50K,SR:10MS/s....range(0, 0.22ms)..k0=2.2e-3 # sweep period..k1=5e3 #starting frequency..k2=50e-3 #ending frequency..K3=ln(k2/k1)....sin(2pik1k0/k3(exp(k3*x)-1))......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Log Sweep.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.099670085906036
Encrypted:	false
SSDEEP:	6:LPuVGaW0xxjrAMjf73wPETvHkkFFGoLnAKNAXPUEoan:Lu0a5jUmfMPQEkxIIan
MD5:	7956BA42014702F58D208713C787E20E
SHA1:	16D60165E3C811E9F75525270C7C21B58E35AAA6
SHA-256:	AF6DDDEFAC0DF61177D9D75E3D8E50F0F599674B83AE4C1CBE3FCC53332664A4
SHA-512:	9B825321B914D9EA49ADBE2C129EE11A0911B72E9D85541861ABF5BF1FA3984F916D7A8815CCBEE67EFBC68BC6A75EC8C8AD1793F4CD1C53D861B8E549E0CEE1
Malicious:	false
Preview:	#This equation is for Log Sweep waveform..#K0 indicates sweep Period;..# K1 and K2 are the start and end frequencys...#View the waveform with the Settings Points:50K,SR:10MS/s....range(0, 0.22ms)..k0=2.2e-3 # sweep period..k1=5e3 #starting frequency..k2=50e-3 #ending frequency..K3=ln(k2/k1)....sin(2pik1k0/k3(exp(k3*x)-1))......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Log.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.846284429921489
Encrypted:	false
SSDEEP:	3:GWERLLqiRNgTZV0+SdAlSKi5XGWZ4BS+fYR9AMRxyMLwAhwPE2nuosCGNqpvy:GWE3fbu2rAMjf1wPEPosCJa
MD5:	55D13BF13647F24495E4996241BDD25E
SHA1:	4FD42642199D84ECC6ADBB6DFCAC5141F7DD16FB
SHA-256:	4A6222377ED50E319E6BD66B50CCAC571D5EBE31FAC670F17BCCD09B2B416585
SHA-512:	68785A43B37914E97FE91E2834439E608AE112179921DDB805B43678E095FA3D7B276E228CE243DFB45CF3F248BCB4F4F95FFE7E7BD544C65AF88C5AF70E9843
Malicious:	false
Preview:	#This equation uses the log function...#The arguments to the log function must be positive...#View the waveform with the Settings Points:1K,SR:10MS/s....range(0,100us)..log(10*(x+0.1))....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Log4482.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.846284429921489
Encrypted:	false
SSDEEP:	3:GWERLLqiRNgTZV0+SdAlSKi5XGWZ4BS+fYR9AMRxyMLwAhwPE2nuosCGNqpvy:GWE3fbu2rAMjf1wPEPosCJa
MD5:	55D13BF13647F24495E4996241BDD25E
SHA1:	4FD42642199D84ECC6ADBB6DFCAC5141F7DD16FB
SHA-256:	4A6222377ED50E319E6BD66B50CCAC571D5EBE31FAC670F17BCCD09B2B416585
SHA-512:	68785A43B37914E97FE91E2834439E608AE112179921DDB805B43678E095FA3D7B276E228CE243DFB45CF3F248BCB4F4F95FFE7E7BD544C65AF88C5AF70E9843
Malicious:	false
Preview:	#This equation uses the log function...#The arguments to the log function must be positive...#View the waveform with the Settings Points:1K,SR:10MS/s....range(0,100us)..log(10*(x+0.1))....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Lore4492.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.023728917051655
Encrypted:	false
SSDEEP:	6:LQCFE3LBSJ1aK2ZzKGE4RRwrAMjfGFPEOfI0MCKGEQleJj:D+3LkJgK2ZzG4R+UmfOPpfI0M5fJj
MD5:	6864DADECF74B57E925875F90370E743
SHA1:	826EA6ECDFEA943732B594D6E4DD555445B23A05
SHA-256:	C66F7DC0A1555D3E8427406C69CF0593990E3B119790598344B9AB0366EF2DC3
SHA-512:	696C40AC563736E6F635621506B73802013B3A9BBF41D80F3E095D1CB540B7EF83020A9B29BC41CBC1EDF82A36F3DE2785C6F536561DC3D1AA864E53510E58B6
Malicious:	false
Preview:	#This equation is for generating a Lorentz Pulse..#K0 indicates the half width for the pulse; ..#K1 indicates the peak location of the pulse..#View the waveform with the Settings Points:1K,SR:100MS/s....range(0,10us)..k0=0.3e-6. #pulse width..k1=1.28e-6. #peak location..1/(1+(2*(t-k1)/k0) ^2)..................

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Lorentz Pulse.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.023728917051655
Encrypted:	false
SSDEEP:	6:LQCFE3LBSJ1aK2ZzKGE4RRwrAMjfGFPEOfI0MCKGEQleJj:D+3LkJgK2ZzG4R+UmfOPpfI0M5fJj
MD5:	6864DADECF74B57E925875F90370E743
SHA1:	826EA6ECDFEA943732B594D6E4DD555445B23A05
SHA-256:	C66F7DC0A1555D3E8427406C69CF0593990E3B119790598344B9AB0366EF2DC3
SHA-512:	696C40AC563736E6F635621506B73802013B3A9BBF41D80F3E095D1CB540B7EF83020A9B29BC41CBC1EDF82A36F3DE2785C6F536561DC3D1AA864E53510E58B6
Malicious:	false
Preview:	#This equation is for generating a Lorentz Pulse..#K0 indicates the half width for the pulse; ..#K1 indicates the peak location of the pulse..#View the waveform with the Settings Points:1K,SR:100MS/s....range(0,10us)..k0=0.3e-6. #pulse width..k1=1.28e-6. #peak location..1/(1+(2*(t-k1)/k0) ^2)..................

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Mark4492.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	4.743393662503266
Encrypted:	false
SSDEEP:	6:NnXvfqPSXeezyQ7AUOu5ZAHv7eirAMjf1wPE66l92bEeXGkEeXHn:h6PSunQEXu5+HzxUmfyPz6l92g2GN2Hn
MD5:	E782A64F91750C3A2F0076D6B6F7318D
SHA1:	3F31BFB63857FB72FD65FA41FBFB340762DC5A4F
SHA-256:	C8E48154F26FED806E93F6ECCC003CC88997120F74D93673CFE2CAC3E301927D
SHA-512:	265DA2CE5C0DD2DB738684E05E498827B0B657B6992174040F189AE53F6B4F83AA56122AF0621F79B4B2AF2377412005A8013D19FB3B17DBF8B344F15B66D42B
Malicious:	false
Preview:	#This Equation uses the Marker Function...#Marker Sets the marker over the range specified ..#with the range function...#The marker function comprises an entire line...#View the waveform with the Settings Points:1K,SR:10MS/s....range( 0, 100us )..sin( w )..range( 0, 50us )..mark( 1 )..range( 0, 100us )..mark( 2 )..

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Marker.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	4.743393662503266
Encrypted:	false
SSDEEP:	6:NnXvfqPSXeezyQ7AUOu5ZAHv7eirAMjf1wPE66l92bEeXGkEeXHn:h6PSunQEXu5+HzxUmfyPz6l92g2GN2Hn
MD5:	E782A64F91750C3A2F0076D6B6F7318D
SHA1:	3F31BFB63857FB72FD65FA41FBFB340762DC5A4F
SHA-256:	C8E48154F26FED806E93F6ECCC003CC88997120F74D93673CFE2CAC3E301927D
SHA-512:	265DA2CE5C0DD2DB738684E05E498827B0B657B6992174040F189AE53F6B4F83AA56122AF0621F79B4B2AF2377412005A8013D19FB3B17DBF8B344F15B66D42B
Malicious:	false
Preview:	#This Equation uses the Marker Function...#Marker Sets the marker over the range specified ..#with the range function...#The marker function comprises an entire line...#View the waveform with the Settings Points:1K,SR:10MS/s....range( 0, 100us )..sin( w )..range( 0, 50us )..mark( 1 )..range( 0, 100us )..mark( 2 )..

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Max_44a1.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	303
Entropy (8bit):	4.925498494890953
Encrypted:	false
SSDEEP:	6:NjTFBJAegLbFRCikKJSiWo0KcMyprAMjfC6wPEPoeYpoLoR:BRrAeWFRCixDYBpUmfCBP0biVR
MD5:	0530CE1E756114BE03F567A49E052816
SHA1:	1C42A398D2F5C0A1BB4A6898E9904A4DA4BEECE3
SHA-256:	E31D877282E6ED7D950552C9A2EBB55D5C564205E7F8DF951847968255B7706C
SHA-512:	2C3F691F3B5F386F8BCDAC7456799E2C262044770E469EAC31CECDE4F60084C93BCC3F5EA3258111789AB0F5185529562695D0435183F55452362DF0ED602FE3
Malicious:	false
Preview:	#This Equation uses maximum and, minimum functions...#maximum function takes the larger of ..#two values and minimum takes the smaller of two values...#View the waveform with the Settings Points:1000,SR=10MS/s....range(0,100us)..sin(2pix)..range(0,50us)..min(v,0.5)..range(50us,100us)..max(v,-0.5)....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Max_min.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	303
Entropy (8bit):	4.925498494890953
Encrypted:	false
SSDEEP:	6:NjTFBJAegLbFRCikKJSiWo0KcMyprAMjfC6wPEPoeYpoLoR:BRrAeWFRCixDYBpUmfCBP0biVR
MD5:	0530CE1E756114BE03F567A49E052816
SHA1:	1C42A398D2F5C0A1BB4A6898E9904A4DA4BEECE3
SHA-256:	E31D877282E6ED7D950552C9A2EBB55D5C564205E7F8DF951847968255B7706C
SHA-512:	2C3F691F3B5F386F8BCDAC7456799E2C262044770E469EAC31CECDE4F60084C93BCC3F5EA3258111789AB0F5185529562695D0435183F55452362DF0ED602FE3
Malicious:	false
Preview:	#This Equation uses maximum and, minimum functions...#maximum function takes the larger of ..#two values and minimum takes the smaller of two values...#View the waveform with the Settings Points:1000,SR=10MS/s....range(0,100us)..sin(2pix)..range(0,50us)..min(v,0.5)..range(50us,100us)..max(v,-0.5)....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Modu44a1.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	473
Entropy (8bit):	4.791071222812472
Encrypted:	false
SSDEEP:	12:fc6+oEIINmEqoCxQHFRK1xuhs1V1VO/KDiVk2nYfcrSSr:0r3L+mh01IYisne
MD5:	BC30D228E74DFA5EE751A43FF8B76B64
SHA1:	701EC396BB5C9C3671DBAB50AB8C87E3162FD5FE
SHA-256:	772412080DC396EA9082BE8276938A7B888AB62C9C4C31B375F2DEFB0B867C15
SHA-512:	23D73F7DF3FBA95D8BD6F6F86565D085611262AB225E2ED96505688CE1E2BB281AB9024859F1856E896CF19A49CC2C55DDF66EB1CF8430E2F321D5BD8E9642F2
Malicious:	false
Preview:	#This is a sum of a modulated wave & it's own carrier..#wave doubled.Thecarrier wave is a 3Hz sine wave, ..#The signal wave is a .1Hz sine wave..#Change '.1' to change the freq of the signal wave..#Change '3' to change the freq of the carrier wave..#Change the '2' to change the size of the carrier wave..#Change '.5' to change the amplitude of the signal wave...#View the waveform with Settings Points:5M, SR:1M....range(0,5s)..2(1+0.5sin(2pi0.1t))sin(2pi3*t)....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Modulated Wave with Carrier.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	473
Entropy (8bit):	4.791071222812472
Encrypted:	false
SSDEEP:	12:fc6+oEIINmEqoCxQHFRK1xuhs1V1VO/KDiVk2nYfcrSSr:0r3L+mh01IYisne
MD5:	BC30D228E74DFA5EE751A43FF8B76B64
SHA1:	701EC396BB5C9C3671DBAB50AB8C87E3162FD5FE
SHA-256:	772412080DC396EA9082BE8276938A7B888AB62C9C4C31B375F2DEFB0B867C15
SHA-512:	23D73F7DF3FBA95D8BD6F6F86565D085611262AB225E2ED96505688CE1E2BB281AB9024859F1856E896CF19A49CC2C55DDF66EB1CF8430E2F321D5BD8E9642F2
Malicious:	false
Preview:	#This is a sum of a modulated wave & it's own carrier..#wave doubled.Thecarrier wave is a 3Hz sine wave, ..#The signal wave is a .1Hz sine wave..#Change '.1' to change the freq of the signal wave..#Change '3' to change the freq of the carrier wave..#Change the '2' to change the size of the carrier wave..#Change '.5' to change the amplitude of the signal wave...#View the waveform with Settings Points:5M, SR:1M....range(0,5s)..2(1+0.5sin(2pi0.1t))sin(2pi3*t)....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Nois44b1.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	412
Entropy (8bit):	4.888129997126819
Encrypted:	false
SSDEEP:	12:bwbcCy0qEcluZswD4vxbyeQwDJUmf7MFPqpxYtn:zhlum2z2tsyQ
MD5:	8B4B62F06EEE9A4004405B9E5FEF72C0
SHA1:	1AEF6DAE91FA259AF4AC3909B4A32348BC5B32E1
SHA-256:	B2DF1EE7AE8EE2F6F10390B72BE6819D7E5DCB532D41BEA9FC93A2628D2B5DCC
SHA-512:	98C42FDA1B94E62D657386472C4BF7D3B325E0F26CD9737422C48AA73D7C58BAE176BBA4ED14B84415AA799E1E3F61CF5AC2586684BAE5BDE0EE3E7372801A0D
Malicious:	false
Preview:	#NoiseSyn (Sine wave with random noise added)..#<NoiseSyn> sin(2pi3.5t) + .3rand..#This is a 3.5 Hz sine wave with random noise added...#The added noise has a maximum ..#magnitude of .3 volts...#Change the '3.5' to change the freq of the sine wave...#Change the '.3' for the max magnitude of the noise...#View the waveform with the Settings Points:1M,SR:1MS/s....range(0,1s)..sin(2pi0.5*t) + rnd(8.3)......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\NoiseSyn.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	412
Entropy (8bit):	4.888129997126819
Encrypted:	false
SSDEEP:	12:bwbcCy0qEcluZswD4vxbyeQwDJUmf7MFPqpxYtn:zhlum2z2tsyQ
MD5:	8B4B62F06EEE9A4004405B9E5FEF72C0
SHA1:	1AEF6DAE91FA259AF4AC3909B4A32348BC5B32E1
SHA-256:	B2DF1EE7AE8EE2F6F10390B72BE6819D7E5DCB532D41BEA9FC93A2628D2B5DCC
SHA-512:	98C42FDA1B94E62D657386472C4BF7D3B325E0F26CD9737422C48AA73D7C58BAE176BBA4ED14B84415AA799E1E3F61CF5AC2586684BAE5BDE0EE3E7372801A0D
Malicious:	false
Preview:	#NoiseSyn (Sine wave with random noise added)..#<NoiseSyn> sin(2pi3.5t) + .3rand..#This is a 3.5 Hz sine wave with random noise added...#The added noise has a maximum ..#magnitude of .3 volts...#Change the '3.5' to change the freq of the sine wave...#Change the '.3' for the max magnitude of the noise...#View the waveform with the Settings Points:1M,SR:1MS/s....range(0,1s)..sin(2pi0.5*t) + rnd(8.3)......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Norm.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	399
Entropy (8bit):	4.814128885181189
Encrypted:	false
SSDEEP:	6:NsJgxKJ+JmVpbDhRGFUSe6+47AvEQhgAZVaxSxKJkR4YRbGAHv7eirAsjf6J4vww:HJkzW6Se07oFzZTRbHzxUGfmaEoJr
MD5:	6C23E71EB64875F0C62C06D30BDC60A1
SHA1:	ED160FC9B69B8D0A12F8D40B68A86F27A6BB0E7D
SHA-256:	FAFD7585680F0B410DF1EB4A7C471939872E2F6669F725FE88F6ABBFDE06B43E
SHA-512:	C60749D033324CECFCBB1960A2D365EE615FA262F7E63C2103222DAC2E4FC3FC990B8435EFA5D2EE9D5F64B4D74635B2B74F4143AB8112B87156E0409EE3F01E
Malicious:	false
Preview:	#This Equation uses the normalize function...#The normalize function normalizes the range ..#specified with range function and ..#scales the amplitude values so that the maximum ..#absolute value is 1.0 (i.e. a value of +1.0 or -1.0)...#The normalize statement comprises an entire line...#View the waveform with the settings Points:1k, SR:10MS/s......range(0,100us)..sin(2pix)+rnd()/10..norm()....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Norm44b1.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	399
Entropy (8bit):	4.814128885181189
Encrypted:	false
SSDEEP:	6:NsJgxKJ+JmVpbDhRGFUSe6+47AvEQhgAZVaxSxKJkR4YRbGAHv7eirAsjf6J4vww:HJkzW6Se07oFzZTRbHzxUGfmaEoJr
MD5:	6C23E71EB64875F0C62C06D30BDC60A1
SHA1:	ED160FC9B69B8D0A12F8D40B68A86F27A6BB0E7D
SHA-256:	FAFD7585680F0B410DF1EB4A7C471939872E2F6669F725FE88F6ABBFDE06B43E
SHA-512:	C60749D033324CECFCBB1960A2D365EE615FA262F7E63C2103222DAC2E4FC3FC990B8435EFA5D2EE9D5F64B4D74635B2B74F4143AB8112B87156E0409EE3F01E
Malicious:	false
Preview:	#This Equation uses the normalize function...#The normalize function normalizes the range ..#specified with range function and ..#scales the amplitude values so that the maximum ..#absolute value is 1.0 (i.e. a value of +1.0 or -1.0)...#The normalize statement comprises an entire line...#View the waveform with the settings Points:1k, SR:10MS/s......range(0,100us)..sin(2pix)+rnd()/10..norm()....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Phas44c1.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	168
Entropy (8bit):	4.947763801831567
Encrypted:	false
SSDEEP:	3:jJEN2CWVkHQKLyrQ/HM85+fYR9AMRxyMLw1QoaxfuWXVq1qMwovy:NphQgQ/s8prAMjfOtaluQVq1gyy
MD5:	3F802560AF441905A552F006E502032A
SHA1:	AF4BD21E4D0CD2615B7235F8D76770A4288658AA
SHA-256:	7B3D7F7B2FA16851396EACD1D56AB6550257C42E96F4ACFCB905DE48A8F526C5
SHA-512:	509C1FEC123C5C60D4D47AC0E3F47904C2F6EC6A7E6A292DD884204EF5875BD1B17E97B108E02BF7EA194BB98241C9D406584930DBE28A4A63769ABC7F85F642
Malicious:	false
Preview:	#This Equation is for Phase modulation..#Here w = 2 * pi * x..#View the waveform with the Settings Points:5K,SR:1MS/s......range(0us,5ms)..Sin(20w+piSin(2*w))........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Phase modulation.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	168
Entropy (8bit):	4.947763801831567
Encrypted:	false
SSDEEP:	3:jJEN2CWVkHQKLyrQ/HM85+fYR9AMRxyMLw1QoaxfuWXVq1qMwovy:NphQgQ/s8prAMjfOtaluQVq1gyy
MD5:	3F802560AF441905A552F006E502032A
SHA1:	AF4BD21E4D0CD2615B7235F8D76770A4288658AA
SHA-256:	7B3D7F7B2FA16851396EACD1D56AB6550257C42E96F4ACFCB905DE48A8F526C5
SHA-512:	509C1FEC123C5C60D4D47AC0E3F47904C2F6EC6A7E6A292DD884204EF5875BD1B17E97B108E02BF7EA194BB98241C9D406584930DBE28A4A63769ABC7F85F642
Malicious:	false
Preview:	#This Equation is for Phase modulation..#Here w = 2 * pi * x..#View the waveform with the Settings Points:5K,SR:1MS/s......range(0us,5ms)..Sin(20w+piSin(2*w))........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Ramp Negative.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.682901391331885
Encrypted:	false
SSDEEP:	3:DaL2CWV0Iq6mMIVrjoKnDDaCFRMnEtWFS2MAWe+fYR9AMRxyMLw1QoaxmLoJ7v:L0IxIVrZDab2WFzgwrAMjfOtaYLoV
MD5:	C729E8E44B9980764883297EB639E6C6
SHA1:	2D5C85E07361408F00E71440CA46552D198C4E6F
SHA-256:	C4E1A6DADDA4D5EF3DFD9A63297E33A58D52DB2A0E19E80C7E58655239C99FA9
SHA-512:	23EFADBBD8E204A36686BDC71760346B4ECB2A8C272B4345C5002609A11A8F56817E495842C2C589D1337242535E5C130A755FFCE938B26025E5E02DED40FB38
Malicious:	false
Preview:	#This equation is for Ramp Waveform..#Here t = Time from starting time that range specifies..#View the waveform with the Settings Points:5K,SR:1MS/s......range(0,5ms)..t....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Ramp.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.682901391331885
Encrypted:	false
SSDEEP:	3:DaL2CWV0Iq6mMIVrjoKnDDaCFRMnEtWFS2MAWe+fYR9AMRxyMLw1QoaxmLoJ7v:L0IxIVrZDab2WFzgwrAMjfOtaYLoV
MD5:	C729E8E44B9980764883297EB639E6C6
SHA1:	2D5C85E07361408F00E71440CA46552D198C4E6F
SHA-256:	C4E1A6DADDA4D5EF3DFD9A63297E33A58D52DB2A0E19E80C7E58655239C99FA9
SHA-512:	23EFADBBD8E204A36686BDC71760346B4ECB2A8C272B4345C5002609A11A8F56817E495842C2C589D1337242535E5C130A755FFCE938B26025E5E02DED40FB38
Malicious:	false
Preview:	#This equation is for Ramp Waveform..#Here t = Time from starting time that range specifies..#View the waveform with the Settings Points:5K,SR:1MS/s......range(0,5ms)..t....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Ramp44c1.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.682901391331885
Encrypted:	false
SSDEEP:	3:DaL2CWV0Iq6mMIVrjoKnDDaCFRMnEtWFS2MAWe+fYR9AMRxyMLw1QoaxmLoJ7v:L0IxIVrZDab2WFzgwrAMjfOtaYLoV
MD5:	C729E8E44B9980764883297EB639E6C6
SHA1:	2D5C85E07361408F00E71440CA46552D198C4E6F
SHA-256:	C4E1A6DADDA4D5EF3DFD9A63297E33A58D52DB2A0E19E80C7E58655239C99FA9
SHA-512:	23EFADBBD8E204A36686BDC71760346B4ECB2A8C272B4345C5002609A11A8F56817E495842C2C589D1337242535E5C130A755FFCE938B26025E5E02DED40FB38
Malicious:	false
Preview:	#This equation is for Ramp Waveform..#Here t = Time from starting time that range specifies..#View the waveform with the Settings Points:5K,SR:1MS/s......range(0,5ms)..t....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Rect44d0.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.910818136893702
Encrypted:	false
SSDEEP:	3:jJEN2CmR9m6vyWYVg3+fYR9AMRxyMLw1QaKWDE2OGN2MLNUwovy:NU6vydVirAMjfO9KWDEi2KWwyy
MD5:	8CB5B19A42AEB90735A796BE786B6092
SHA1:	18297753ADABB81C7D777111513735F25A196C9B
SHA-256:	13ADF1FF7FC9148DA3E9373FAB51C0259C6EC86E1E27FC9BE954C6C0780AB2CF
SHA-512:	A1DEE52149C90585A2D33EC6EF4F766F1360A76B26AE9499731938323EC7E653D5DF26F2008D1DF11EC4B1E9F48A332D829ADD1E5AF185989D17DD552A258BB9
Malicious:	false
Preview:	#This Equation is a Rectified Full wave Sine waveform..#View the waveform with the Settings Points:5K,SR:1GS/s....range(0us,5us)..abs(Sin(3*w))........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Rectified Full wave.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.910818136893702
Encrypted:	false
SSDEEP:	3:jJEN2CmR9m6vyWYVg3+fYR9AMRxyMLw1QaKWDE2OGN2MLNUwovy:NU6vydVirAMjfO9KWDEi2KWwyy
MD5:	8CB5B19A42AEB90735A796BE786B6092
SHA1:	18297753ADABB81C7D777111513735F25A196C9B
SHA-256:	13ADF1FF7FC9148DA3E9373FAB51C0259C6EC86E1E27FC9BE954C6C0780AB2CF
SHA-512:	A1DEE52149C90585A2D33EC6EF4F766F1360A76B26AE9499731938323EC7E653D5DF26F2008D1DF11EC4B1E9F48A332D829ADD1E5AF185989D17DD552A258BB9
Malicious:	false
Preview:	#This Equation is a Rectified Full wave Sine waveform..#View the waveform with the Settings Points:5K,SR:1GS/s....range(0us,5us)..abs(Sin(3*w))........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Roun44d0.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.899696739135102
Encrypted:	false
SSDEEP:	6:NfFg5NoaAFXCxDUrAMjfUKWDEPohKNoan:zgT33UUmfTWD0uK6an
MD5:	E574D3A040F307916F62612BD2C49475
SHA1:	B0563581B31880D9E1839A56F966BA87D3F37EBC
SHA-256:	A7A7434434A3C83C386A7DCB3D22121CBA8EB7FFBF7D913070B1DCFACF31C9EF
SHA-512:	D6989F3DF3BE3BD5AF8E31A538A8ECDC26680C54B7033720D2E67B304CF7EAB7DF34F677619E1E69023971B2ABD09CB4C84ABBD2535D6BA6D1FB708EEB7D0941
Malicious:	false
Preview:	#This Equation uses the round Function which..#Rounds off the fraction to obtain the integer...#View the waveform with the Settings Points:100K,SR:1GS/s....range(0,100us)..round(5sin(2pi*x))/5......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Round.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.899696739135102
Encrypted:	false
SSDEEP:	6:NfFg5NoaAFXCxDUrAMjfUKWDEPohKNoan:zgT33UUmfTWD0uK6an
MD5:	E574D3A040F307916F62612BD2C49475
SHA1:	B0563581B31880D9E1839A56F966BA87D3F37EBC
SHA-256:	A7A7434434A3C83C386A7DCB3D22121CBA8EB7FFBF7D913070B1DCFACF31C9EF
SHA-512:	D6989F3DF3BE3BD5AF8E31A538A8ECDC26680C54B7033720D2E67B304CF7EAB7DF34F677619E1E69023971B2ABD09CB4C84ABBD2535D6BA6D1FB708EEB7D0941
Malicious:	false
Preview:	#This Equation uses the round Function which..#Rounds off the fraction to obtain the integer...#View the waveform with the Settings Points:100K,SR:1GS/s....range(0,100us)..round(5sin(2pi*x))/5......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\SINC.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.110108214932373
Encrypted:	false
SSDEEP:	6:fBCA7FKx2FouK2ZzKGE4RRcxrAMjf1waEoDkTQLtSaDyj/wv:pfFKx3X2ZzG4RaxUmfyaEJC37
MD5:	2FBC583223D8A4F863F75D23DF801B23
SHA1:	FECF01636B91E617C1CD6109945D50D3C5EEF7C6
SHA-256:	F1D9623A2DE43E7A5227BF7779724CA172FBC24160CA82B54B790C960CE95B2F
SHA-512:	5E17F7A7FA4BCDB1D17096238057A14361A5C7A5C2D1F9CA48756B306F2E399537D74F455B3FD5F196521AF7386945C12B074DB81A622629AD89AB1A20F29462
Malicious:	false
Preview:	#This is the equation for SINC i.e Sin(x)/x pulse..#The K0 indicates the Freq of the wave;..#K1 indicates the peak location of the pulse...#View the waveform with the Settings Points:1K,SR:10MS/s......range(0,100us)..k0=2.5e6..k1=20e-6..k2=10e-10..(sin(2pik0(t-k1))+k2) / ((2pik0(t-k1))+k2) ......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\SINC44e0.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.110108214932373
Encrypted:	false
SSDEEP:	6:fBCA7FKx2FouK2ZzKGE4RRcxrAMjf1waEoDkTQLtSaDyj/wv:pfFKx3X2ZzG4RaxUmfyaEJC37
MD5:	2FBC583223D8A4F863F75D23DF801B23
SHA1:	FECF01636B91E617C1CD6109945D50D3C5EEF7C6
SHA-256:	F1D9623A2DE43E7A5227BF7779724CA172FBC24160CA82B54B790C960CE95B2F
SHA-512:	5E17F7A7FA4BCDB1D17096238057A14361A5C7A5C2D1F9CA48756B306F2E399537D74F455B3FD5F196521AF7386945C12B074DB81A622629AD89AB1A20F29462
Malicious:	false
Preview:	#This is the equation for SINC i.e Sin(x)/x pulse..#The K0 indicates the Freq of the wave;..#K1 indicates the peak location of the pulse...#View the waveform with the Settings Points:1K,SR:10MS/s......range(0,100us)..k0=2.5e6..k1=20e-6..k2=10e-10..(sin(2pik0(t-k1))+k2) / ((2pik0(t-k1))+k2) ......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Wind44e0.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.056218155406864
Encrypted:	false
SSDEEP:	3:DaL2CWVvIKlMLZ5YVg3+PRV3oyMLwaMFPE2joTNJMwovn:LvKUVt3ofKFPEfpJZyn
MD5:	FBC31098FD790592113D5AEDCBB55093
SHA1:	63F45C7B0103861F44A14EF8A0656F55E5811DD4
SHA-256:	1C0F9EE8714FD3CFE4AF08C1C0A8C0E4764D94BB9D91BCEF5B327364AAE9DA7B
SHA-512:	FA63554F9D46699EC84A17F55B17C2DFB6BBB72E9BB50C04E5FC6DC6218BD8536AA9A866E4413CCEDAB062F5E3C960DF3DF8E8C85D0507746AA43639F187522E
Malicious:	false
Preview:	#This equation is for Hamming Window waveform..#View the wavform with Settings Points:1K, SR:100MS/s....range(0us,10us)..0.08+0.46*(1-cos(w))......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Wind44ef.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.886866800848952
Encrypted:	false
SSDEEP:	3:DaL2CWVs4ijZ5YVg3+PRV3oyMLwaMFPE27gKWAMwn:LgUVt3ofKFPEfKWAZn
MD5:	C1BC4F4A76D558434E4EAB64569B6407
SHA1:	BC8A1D891BC0F3B83885B41301EEA37A8650C472
SHA-256:	D7AA2ACB1A04A8C22C7E7A057680130178C40E5E66D934CC003305D0BE64A7AB
SHA-512:	E4B28ED3A93B8217C8136307E33D957D2F8D2ED8C2167B730EE2BBED5AC828E203ABFEFB5EE0A5589E8D14A9AAF6BC71DC4D41150A59312B76C830FBE50C9115
Malicious:	false
Preview:	#This equation is for Hanning Window waveform..#View the wavform with Settings Points:1K, SR:100MS/s....range(0us,10us)..(1-cos(w))....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Window_Hamming.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.056218155406864
Encrypted:	false
SSDEEP:	3:DaL2CWVvIKlMLZ5YVg3+PRV3oyMLwaMFPE2joTNJMwovn:LvKUVt3ofKFPEfpJZyn
MD5:	FBC31098FD790592113D5AEDCBB55093
SHA1:	63F45C7B0103861F44A14EF8A0656F55E5811DD4
SHA-256:	1C0F9EE8714FD3CFE4AF08C1C0A8C0E4764D94BB9D91BCEF5B327364AAE9DA7B
SHA-512:	FA63554F9D46699EC84A17F55B17C2DFB6BBB72E9BB50C04E5FC6DC6218BD8536AA9A866E4413CCEDAB062F5E3C960DF3DF8E8C85D0507746AA43639F187522E
Malicious:	false
Preview:	#This equation is for Hamming Window waveform..#View the wavform with Settings Points:1K, SR:100MS/s....range(0us,10us)..0.08+0.46*(1-cos(w))......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\Window_Hanning.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.886866800848952
Encrypted:	false
SSDEEP:	3:DaL2CWVs4ijZ5YVg3+PRV3oyMLwaMFPE27gKWAMwn:LgUVt3ofKFPEfKWAZn
MD5:	C1BC4F4A76D558434E4EAB64569B6407
SHA1:	BC8A1D891BC0F3B83885B41301EEA37A8650C472
SHA-256:	D7AA2ACB1A04A8C22C7E7A057680130178C40E5E66D934CC003305D0BE64A7AB
SHA-512:	E4B28ED3A93B8217C8136307E33D957D2F8D2ED8C2167B730EE2BBED5AC828E203ABFEFB5EE0A5589E8D14A9AAF6BC71DC4D41150A59312B76C830FBE50C9115
Malicious:	false
Preview:	#This equation is for Hanning Window waveform..#View the wavform with Settings Points:1K, SR:100MS/s....range(0us,10us)..(1-cos(w))....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\abs.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.954901060891438
Encrypted:	false
SSDEEP:	3:DaL4SACR2O0mFsS+fYRV3oflRW5ELv2BPE2nuoxNWMJPQWvy:vyDn3oflR8AuBPEPoLWQP/y
MD5:	A827071AEEF57E4A3CD5F736D69EE5F1
SHA1:	FC6EA37AE90AEDF3541FB03D00BF767487671C52
SHA-256:	8351EADAFE3D0FFF113EFD4826412B76D6DB42816572F35E55647D9214871162
SHA-512:	2368EAA7F9DC3EFC1797D0ADAB3AFADE32EB74A6766F0691C5726B41DF3E43B3D0E0B3DCDC2246F97B546F22C39C5517576C264A58E3CEFACD7680B884511E47
Malicious:	false
Preview:	#This equation gives the Absolute value...#View the waveform with Settings : Points=10K, SR=100MS/s....range(0,100us)..abs(sin(2pix))........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\abs44ef.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.954901060891438
Encrypted:	false
SSDEEP:	3:DaL4SACR2O0mFsS+fYRV3oflRW5ELv2BPE2nuoxNWMJPQWvy:vyDn3oflR8AuBPEPoLWQP/y
MD5:	A827071AEEF57E4A3CD5F736D69EE5F1
SHA1:	FC6EA37AE90AEDF3541FB03D00BF767487671C52
SHA-256:	8351EADAFE3D0FFF113EFD4826412B76D6DB42816572F35E55647D9214871162
SHA-512:	2368EAA7F9DC3EFC1797D0ADAB3AFADE32EB74A6766F0691C5726B41DF3E43B3D0E0B3DCDC2246F97B546F22C39C5517576C264A58E3CEFACD7680B884511E47
Malicious:	false
Preview:	#This equation gives the Absolute value...#View the waveform with Settings : Points=10K, SR=100MS/s....range(0,100us)..abs(sin(2pix))........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\carr44ff.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	385
Entropy (8bit):	4.981282284643184
Encrypted:	false
SSDEEP:	6:m4wrE3BWJ/b10dovHe9Z19AAv62ncLV6fLomvLVt2n3ofGe9:m4wQ3BWhWdEeD1LXcwM2X2nYfN9
MD5:	687F82FE131A3562EE297A178DC8EFE3
SHA1:	21718CDDDE193011C2BA61A538A7C63D96108053
SHA-256:	7532C120CD230097B9E70D5B0DEF8A3B0777ABEA05A9E8299F38D80A09D8E860
SHA-512:	324A7AF746E09DCB18358E05A9703FE70BC457AC42E7EFA3319753BB997A7249658C431612501990029F4A4AAFB8F8B99E30C182D9D1EA8BC318A812E8B46B0B
Malicious:	false
Preview:	#This equation represents a more realistic carrier wave: ..#A 3.579545MHz sine wave with a 1 volt peak amplitude ..#and a 'pi' phase shift.(this delays the wave 180 degrees)..#Change the '3579545' to change the carrier frequency...#Change the '-pi' to change the time delay or phase.....#View the waveform with Settings Points:1K,SR:100MS/s..range(0us,10us)..sin(2pi3579545*t-pi)....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\carrier.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	385
Entropy (8bit):	4.981282284643184
Encrypted:	false
SSDEEP:	6:m4wrE3BWJ/b10dovHe9Z19AAv62ncLV6fLomvLVt2n3ofGe9:m4wQ3BWhWdEeD1LXcwM2X2nYfN9
MD5:	687F82FE131A3562EE297A178DC8EFE3
SHA1:	21718CDDDE193011C2BA61A538A7C63D96108053
SHA-256:	7532C120CD230097B9E70D5B0DEF8A3B0777ABEA05A9E8299F38D80A09D8E860
SHA-512:	324A7AF746E09DCB18358E05A9703FE70BC457AC42E7EFA3319753BB997A7249658C431612501990029F4A4AAFB8F8B99E30C182D9D1EA8BC318A812E8B46B0B
Malicious:	false
Preview:	#This equation represents a more realistic carrier wave: ..#A 3.579545MHz sine wave with a 1 volt peak amplitude ..#and a 'pi' phase shift.(this delays the wave 180 degrees)..#Change the '3579545' to change the carrier frequency...#Change the '-pi' to change the time delay or phase.....#View the waveform with Settings Points:1K,SR:100MS/s..range(0us,10us)..sin(2pi3579545*t-pi)....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\cosi450f.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.85074631621121
Encrypted:	false
SSDEEP:	6:m4bTdVwJkuWRZWLVN/en1L5R+in3oxkFPEPo8F9:m4bTdZufXen1LWinYaP0h9
MD5:	4E0704707706BEA9D471A24A9ED106D3
SHA1:	55A14CF8C3F53DF85DAD62090A3E6364D5F37DB5
SHA-256:	52037A8178164DFFE80BB1E2218D704913119D549FE5B9C8D630AEABBF7150E5
SHA-512:	270B9A83967B1F0C46EBF1C99BADEC91F8397090E6FEA994EFD1D3638603093C7E44B9593F1C5E80E8B315BE5642DBBBB7149066BCEA0529B89F60C21DC9FF1C
Malicious:	false
Preview:	#This equation represents cosine waveform..#This equation is for 1 cycle cosine wave. ..#Change x to change the number of cycles. For example ..#for a two cycle cosine wave change x to 2x...#View the waveform with Settings:Points:10K,SR:100MS/s....range(0,100us)..cos(2pix)....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\cosine wave.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.85074631621121
Encrypted:	false
SSDEEP:	6:m4bTdVwJkuWRZWLVN/en1L5R+in3oxkFPEPo8F9:m4bTdZufXen1LWinYaP0h9
MD5:	4E0704707706BEA9D471A24A9ED106D3
SHA1:	55A14CF8C3F53DF85DAD62090A3E6364D5F37DB5
SHA-256:	52037A8178164DFFE80BB1E2218D704913119D549FE5B9C8D630AEABBF7150E5
SHA-512:	270B9A83967B1F0C46EBF1C99BADEC91F8397090E6FEA994EFD1D3638603093C7E44B9593F1C5E80E8B315BE5642DBBBB7149066BCEA0529B89F60C21DC9FF1C
Malicious:	false
Preview:	#This equation represents cosine waveform..#This equation is for 1 cycle cosine wave. ..#Change x to change the number of cycles. For example ..#for a two cycle cosine wave change x to 2x...#View the waveform with Settings:Points:10K,SR:100MS/s....range(0,100us)..cos(2pix)....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\diff.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	338
Entropy (8bit):	4.866137233372633
Encrypted:	false
SSDEEP:	6:SbFJhRrA8eB4ES62hRGNO9De0nAHv7eForLn3ofUKWDEbQbVLQE5adOvoQVLQE0T:qc9BLzHj0AHz1PnYfTWD9bVLyyxLa3Dn
MD5:	051E0CECD015701398EDD7308BEA3074
SHA1:	866E048AD98FAD2BBA78EF55B6F94DA775E3916C
SHA-256:	A09B9784E03FCD979EEAC52B3EAB3AB0881BFA344B7D1C6C902B977FCF79834B
SHA-512:	3B9DFACD7A8F5C512F786DDDF34FDBEDF997FD3EC1F22CE5BB77D8DFEE27298B664B69E8A44A37674265BBF823124C5A16C6D825F2C1462F59550503D73DE2F6
Malicious:	false
Preview:	# This equation is specified with the diff() function...# The Function differentiates the function over the range ..# specified with range()...# The diff() comprises an entire line...# View the waveform with Settings Points:100K,SR:1GS/s....range(0,33us)..-0.5..range(33us,66us)..0.5..range(66us,100us)..-0.5..range(0,100us)..diff()......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\diff450f.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	338
Entropy (8bit):	4.866137233372633
Encrypted:	false
SSDEEP:	6:SbFJhRrA8eB4ES62hRGNO9De0nAHv7eForLn3ofUKWDEbQbVLQE5adOvoQVLQE0T:qc9BLzHj0AHz1PnYfTWD9bVLyyxLa3Dn
MD5:	051E0CECD015701398EDD7308BEA3074
SHA1:	866E048AD98FAD2BBA78EF55B6F94DA775E3916C
SHA-256:	A09B9784E03FCD979EEAC52B3EAB3AB0881BFA344B7D1C6C902B977FCF79834B
SHA-512:	3B9DFACD7A8F5C512F786DDDF34FDBEDF997FD3EC1F22CE5BB77D8DFEE27298B664B69E8A44A37674265BBF823124C5A16C6D825F2C1462F59550503D73DE2F6
Malicious:	false
Preview:	# This equation is specified with the diff() function...# The Function differentiates the function over the range ..# specified with range()...# The diff() comprises an entire line...# View the waveform with Settings Points:100K,SR:1GS/s....range(0,33us)..-0.5..range(33us,66us)..0.5..range(66us,100us)..-0.5..range(0,100us)..diff()......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\expd451e.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	378
Entropy (8bit):	4.828094443698755
Encrypted:	false
SSDEEP:	6:SbFmKA4F1WR0V1WrywWeu5F2XDJknQROLVX0G1LVbUxn3ofyN/WAXK+/:qjA4F1WRu1WryfD2F5O+khcnYfsWA1/
MD5:	45A471D701C0BD6DA9B5D1F23027D2DC
SHA1:	9C775920A1CBA363DEEA08F6E04F1022D5F8B608
SHA-256:	1DD0000061C1276E59D044B3B9D32A97AE67D864194430634DEE0787A820271C
SHA-512:	52DBFA0909C42D4FC17954200DB883102C3DAA2887AE85B8C1610580F2A3464F24292EDD06D04BEA8A04E7775A707AE2A53E3B07484FC9BBBE7C130D45D85323
Malicious:	false
Preview:	# This equation is exponential decay wfm..# Time is shifted to have a value of 1 at t=.1s. ..#The time constant is 10ms ..#The first half second will be filled with 0's)..#Change the '.5' to change the time shift...#Change the '10^-2' to change the time constant ..#View the waveform with Settings Points:1M, SR:1M....range(450ms,1000ms)..k0=1e-1..exp(-(t-0.1)/k0)..............

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\expdecay.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	378
Entropy (8bit):	4.828094443698755
Encrypted:	false
SSDEEP:	6:SbFmKA4F1WR0V1WrywWeu5F2XDJknQROLVX0G1LVbUxn3ofyN/WAXK+/:qjA4F1WRu1WryfD2F5O+khcnYfsWA1/
MD5:	45A471D701C0BD6DA9B5D1F23027D2DC
SHA1:	9C775920A1CBA363DEEA08F6E04F1022D5F8B608
SHA-256:	1DD0000061C1276E59D044B3B9D32A97AE67D864194430634DEE0787A820271C
SHA-512:	52DBFA0909C42D4FC17954200DB883102C3DAA2887AE85B8C1610580F2A3464F24292EDD06D04BEA8A04E7775A707AE2A53E3B07484FC9BBBE7C130D45D85323
Malicious:	false
Preview:	# This equation is exponential decay wfm..# Time is shifted to have a value of 1 at t=.1s. ..#The time constant is 10ms ..#The first half second will be filled with 0's)..#Change the '.5' to change the time shift...#Change the '10^-2' to change the time constant ..#View the waveform with Settings Points:1M, SR:1M....range(450ms,1000ms)..k0=1e-1..exp(-(t-0.1)/k0)..............

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\have452e.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	271
Entropy (8bit):	4.838571336778942
Encrypted:	false
SSDEEP:	6:8pCIG/nvAEj2AZokvLVwROLVTrAMjf7vUT9tx9Un:tIgvhj2dkvmOxUmf7MZtcn
MD5:	BDBE839B7596B7DAC6391BFBFADF5D12
SHA1:	7FBD05F2C286CF6BD4E5F29AC91DF83C75506A84
SHA-256:	274FEBE5A5FCB59E2DF87D9CE8F4E0D01A85DB9DBA3F01637F0C4DAF3F7F69AA
SHA-512:	883EE8669B2B6BE788217307999395DDF0986664F518C1CBAC8FB00B28296B929A45E6C62E14C716B7F24C6B47EC95FA5BDDBCC2E33C72FD2AA764A0D0FBDE27
Malicious:	false
Preview:	#Haversin wave..#This is a 1Hz cosine wave with a .5V peak ..#with a .5 volt DC offset...#Change the '-.5' to change the voltage...#Change the '.5' to change the DC offset..#View the waveform with the Settings Points:1M,SR:1M....range(0,1s)...-0.5cos(2pi*t) + 0.5......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\haversin.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	271
Entropy (8bit):	4.838571336778942
Encrypted:	false
SSDEEP:	6:8pCIG/nvAEj2AZokvLVwROLVTrAMjf7vUT9tx9Un:tIgvhj2dkvmOxUmf7MZtcn
MD5:	BDBE839B7596B7DAC6391BFBFADF5D12
SHA1:	7FBD05F2C286CF6BD4E5F29AC91DF83C75506A84
SHA-256:	274FEBE5A5FCB59E2DF87D9CE8F4E0D01A85DB9DBA3F01637F0C4DAF3F7F69AA
SHA-512:	883EE8669B2B6BE788217307999395DDF0986664F518C1CBAC8FB00B28296B929A45E6C62E14C716B7F24C6B47EC95FA5BDDBCC2E33C72FD2AA764A0D0FBDE27
Malicious:	false
Preview:	#Haversin wave..#This is a 1Hz cosine wave with a .5V peak ..#with a .5 volt DC offset...#Change the '-.5' to change the voltage...#Change the '.5' to change the DC offset..#View the waveform with the Settings Points:1M,SR:1M....range(0,1s)...-0.5cos(2pi*t) + 0.5......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\ln.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.858794045853285
Encrypted:	false
SSDEEP:	3:DaLqiRNgpsK8ZE+SdAlSKoZXGWZB5+fYR9AMRxyMLwAhwPE2nuotNHo:9NfbNprAMjf1wPEPo/I
MD5:	947FC384623D49080F2BEE5E023F160F
SHA1:	479C03E0574AFCB888AFBF863EA325043FBFD180
SHA-256:	0B863D14990E0757B0CE38517D4A0736705E1C330ACC36A9A362112B96FABE26
SHA-512:	13FB82597690BE6C30D077F477F617E3BC6DCA7E11761AAA82C137E500F81EDC096A255A7FC9BD6C9A1C6A17237009614EB02F293014978D0EC8E04BD03E28AA
Malicious:	false
Preview:	#This equation uses the natural log function. ..#The arguments to the function must be positive..#View the waveform with the Settings Points:1K,SR:10MS/s....range(0,100us)..ln(2*(x+0.2))....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\ln452e.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.858794045853285
Encrypted:	false
SSDEEP:	3:DaLqiRNgpsK8ZE+SdAlSKoZXGWZB5+fYR9AMRxyMLwAhwPE2nuotNHo:9NfbNprAMjf1wPEPo/I
MD5:	947FC384623D49080F2BEE5E023F160F
SHA1:	479C03E0574AFCB888AFBF863EA325043FBFD180
SHA-256:	0B863D14990E0757B0CE38517D4A0736705E1C330ACC36A9A362112B96FABE26
SHA-512:	13FB82597690BE6C30D077F477F617E3BC6DCA7E11761AAA82C137E500F81EDC096A255A7FC9BD6C9A1C6A17237009614EB02F293014978D0EC8E04BD03E28AA
Malicious:	false
Preview:	#This equation uses the natural log function. ..#The arguments to the function must be positive..#View the waveform with the Settings Points:1K,SR:10MS/s....range(0,100us)..ln(2*(x+0.2))....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\mods453e.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	424
Entropy (8bit):	5.238697051518086
Encrypted:	false
SSDEEP:	12:qF36NerjouvrmpG6juSWQVnYfYwM4kAU0IV7MkbIOyOP:637DCGXSBKYFB4QRNyOP
MD5:	8867CDCDE1E132F1A2C8FDD7E38EA664
SHA1:	080B0B4753BB2BDD5D20B1B5B5F85035E6774100
SHA-256:	78F54A0BE44E2B0EAB89D0402AD0587D902CB34F8B69E72441F868B8345E390B
SHA-512:	CF20FC2C2B12BD11FDB2E7E6A0B6102DD5BBF109B93EF0D8DFE4B0ACA326DEA5416A2E549EE3DE3193AAA95E701C1AC71BE72931EEFA1A9B9E792613C86957FD
Malicious:	false
Preview:	#This is the square of a modulated sine wave...#The '3579545' is the original freq of the carrier wave...#The '.5' controls the amplitude before squaring...#The '146190' is the freq of the signal wave..#View the waveform with Settings Points:1M, SR:50K....range(0,20s)..k0=0.7143 #peak amplitude..k1=0.000037413 #time delay..k2=3579545..k3=146190..k4=0.5(sin(2pi(t-k1)k3)^2)..k0((sin((2pi(t-k1k2)-pi))+1)*k4).......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\modsin2.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	424
Entropy (8bit):	5.238697051518086
Encrypted:	false
SSDEEP:	12:qF36NerjouvrmpG6juSWQVnYfYwM4kAU0IV7MkbIOyOP:637DCGXSBKYFB4QRNyOP
MD5:	8867CDCDE1E132F1A2C8FDD7E38EA664
SHA1:	080B0B4753BB2BDD5D20B1B5B5F85035E6774100
SHA-256:	78F54A0BE44E2B0EAB89D0402AD0587D902CB34F8B69E72441F868B8345E390B
SHA-512:	CF20FC2C2B12BD11FDB2E7E6A0B6102DD5BBF109B93EF0D8DFE4B0ACA326DEA5416A2E549EE3DE3193AAA95E701C1AC71BE72931EEFA1A9B9E792613C86957FD
Malicious:	false
Preview:	#This is the square of a modulated sine wave...#The '3579545' is the original freq of the carrier wave...#The '.5' controls the amplitude before squaring...#The '146190' is the freq of the signal wave..#View the waveform with Settings Points:1M, SR:50K....range(0,20s)..k0=0.7143 #peak amplitude..k1=0.000037413 #time delay..k2=3579545..k3=146190..k4=0.5(sin(2pi(t-k1)k3)^2)..k0((sin((2pi(t-k1k2)-pi))+1)*k4).......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\rnd.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.740487134019379
Encrypted:	false
SSDEEP:	6:SbF22IBcGySxHLz3LDKqenaTZucGTQRA0BrAMjfUKWDEPotIn:qtpsLzHVeKpG0m0BUmfTWD0r
MD5:	92C93EA068B8AE634D782581444974B2
SHA1:	92D6B0DDC5A6B209FDFE91DB0859E2D073D5A800
SHA-256:	520E0A90DCB976BEE3B4DCBD44DABC6FAAE98901E8D5B41A4CA9813594266EB7
SHA-512:	DAB6D9F7187D6B79D1FB26D787A29CFF264D9EA1A903274684A42C677735EAC69BD93F64A0C39FB6942659E500E907843D2AD23BC1EB80BA9971DE0D71D4DA22
Malicious:	false
Preview:	# This Equation uses Random Function rnd ..#When an argument is specified, generates ..#a random number sequence using that argument as the ..#initial value. If the argument is omitted,1 is used...#View the waveform with the Settings Points:100K,SR:1GS/s....range(0,100us)..rnd(2)/3....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\rnd454d.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.740487134019379
Encrypted:	false
SSDEEP:	6:SbF22IBcGySxHLz3LDKqenaTZucGTQRA0BrAMjfUKWDEPotIn:qtpsLzHVeKpG0m0BUmfTWD0r
MD5:	92C93EA068B8AE634D782581444974B2
SHA1:	92D6B0DDC5A6B209FDFE91DB0859E2D073D5A800
SHA-256:	520E0A90DCB976BEE3B4DCBD44DABC6FAAE98901E8D5B41A4CA9813594266EB7
SHA-512:	DAB6D9F7187D6B79D1FB26D787A29CFF264D9EA1A903274684A42C677735EAC69BD93F64A0C39FB6942659E500E907843D2AD23BC1EB80BA9971DE0D71D4DA22
Malicious:	false
Preview:	# This Equation uses Random Function rnd ..#When an argument is specified, generates ..#a random number sequence using that argument as the ..#initial value. If the argument is omitted,1 is used...#View the waveform with the Settings Points:100K,SR:1GS/s....range(0,100us)..rnd(2)/3....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\sin2.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	133
Entropy (8bit):	4.999474456256988
Encrypted:	false
SSDEEP:	3:DaL2CWV7FjAWYVg3+PRV3oyMLw9FPE2nDhScL8ov:L7FjCVt3ofGFPEOgGx
MD5:	AC477A374175160FD7AF64ABC72FF82B
SHA1:	4A6C01EC01AA9BFC138749B8FFDACD741882B977
SHA-256:	EF199529B39C387E2F1694DC00616822ED267276DEFD7CCB8BCD8E0D1702A743
SHA-512:	3E226EB5B9E5EDDA373432CC8C2402A5167628768A5E742D9ED6B7EBF57AFF5A27C488CE9AE428E9015484C960F43CC18AC888FE55B389061766A5803D274553
Malicious:	false
Preview:	#This equation is for sin^2 waveform..#View the wavform with Settings Points:1K,SR:100MS/s....range(0,10us)..2sin(2pi146190t)^2..

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\sin2454d.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	133
Entropy (8bit):	4.999474456256988
Encrypted:	false
SSDEEP:	3:DaL2CWV7FjAWYVg3+PRV3oyMLw9FPE2nDhScL8ov:L7FjCVt3ofGFPEOgGx
MD5:	AC477A374175160FD7AF64ABC72FF82B
SHA1:	4A6C01EC01AA9BFC138749B8FFDACD741882B977
SHA-256:	EF199529B39C387E2F1694DC00616822ED267276DEFD7CCB8BCD8E0D1702A743
SHA-512:	3E226EB5B9E5EDDA373432CC8C2402A5167628768A5E742D9ED6B7EBF57AFF5A27C488CE9AE428E9015484C960F43CC18AC888FE55B389061766A5803D274553
Malicious:	false
Preview:	#This equation is for sin^2 waveform..#View the wavform with Settings Points:1K,SR:100MS/s....range(0,10us)..2sin(2pi146190t)^2..

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\sine alternate.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270
Entropy (8bit):	5.0481030918562855
Encrypted:	false
SSDEEP:	6:J8uQOAy/HM//0ZXxFoShJWlYhshqXDXuRucaeg/rAsjf1wPETo5ryn:DQ4HW/0psgWYuqz/cat/UGfyPEUyn
MD5:	DBD81F1969B73FCD6FD7B7554EE1C7CF
SHA1:	330C8A19A9269DC7DB0778193C9776C15909B890
SHA-256:	ECD377D279CB498B5623DAE772C1B26F990A3BCBB236B45F51E4B13DAFC1FE66
SHA-512:	3EC94AFC8D7216EFF7202B72E9E9A7886F484F569564F00C093FF06A996DFCF2A3E751B98F5ED9650A480A57225839D8DBAC11E5EBEB73E76ADFEDD783E05F29
Malicious:	false
Preview:	#10KHz 1 cycle Sine Wave with a 10V pk-pk..#Here w = 2pi10^4t..#The Freq of the equation F= 1/((points/cycle) clock)..#In this equation Freq is 1/1000*100ns = 10Khz i.e 10^4..#View the waveform with the settings Points:1K,SR:10MS/s....range(0us,100us)..sin(w)......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\sine wave 1 cycle.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270
Entropy (8bit):	5.0481030918562855
Encrypted:	false
SSDEEP:	6:J8uQOAy/HM//0ZXxFoShJWlYhshqXDXuRucaeg/rAsjf1wPETo5ryn:DQ4HW/0psgWYuqz/cat/UGfyPEUyn
MD5:	DBD81F1969B73FCD6FD7B7554EE1C7CF
SHA1:	330C8A19A9269DC7DB0778193C9776C15909B890
SHA-256:	ECD377D279CB498B5623DAE772C1B26F990A3BCBB236B45F51E4B13DAFC1FE66
SHA-512:	3EC94AFC8D7216EFF7202B72E9E9A7886F484F569564F00C093FF06A996DFCF2A3E751B98F5ED9650A480A57225839D8DBAC11E5EBEB73E76ADFEDD783E05F29
Malicious:	false
Preview:	#10KHz 1 cycle Sine Wave with a 10V pk-pk..#Here w = 2pi10^4t..#The Freq of the equation F= 1/((points/cycle) clock)..#In this equation Freq is 1/1000*100ns = 10Khz i.e 10^4..#View the waveform with the settings Points:1K,SR:10MS/s....range(0us,100us)..sin(w)......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\sine wave 2cycles.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	301
Entropy (8bit):	5.066468430482892
Encrypted:	false
SSDEEP:	6:J8uQOAy/HLRNFpWVQ//0ZXxFoSnJW3lYhshqXDXuRuEprAMjfxwaUo9g+y:DQ4HLiVC/0ps8kVYuqz/EpUmfGaUoy
MD5:	DEC4941B6FC9087352120C8635457242
SHA1:	07FE2F4E7A525B8A92BE60C515CCF54CB15A8CB2
SHA-256:	D5AC6395EE9FA7A5655DF4BD23E47CFC5FB2E6F6FDECAE508492874571D60988
SHA-512:	F354AEAB43B64B7D113BA8E8742AEFCE4D94157689109288C66A2D8DF28070928E5A2007CD94197EE612E07880933CEF4FFBF08A1E06C36DA34BA28B72EF8368
Malicious:	false
Preview:	#10KHz 1 cycle Sine Wave with a 10V pk-pk..#and with 45 deg offset..#Here w = 2pi10^4t..#The Freq of the equation is..#F= 1/((points/cycle) clock)..#In this equation Freq is 1/1000*100ns = 10Khz..#View the waveform with the Settings Points:1K, SR:10MS/s......range(0us,100us)..sin(w-pi/4)........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\sine wave with 45 deg offset.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	301
Entropy (8bit):	5.066468430482892
Encrypted:	false
SSDEEP:	6:J8uQOAy/HLRNFpWVQ//0ZXxFoSnJW3lYhshqXDXuRuEprAMjfxwaUo9g+y:DQ4HLiVC/0ps8kVYuqz/EpUmfGaUoy
MD5:	DEC4941B6FC9087352120C8635457242
SHA1:	07FE2F4E7A525B8A92BE60C515CCF54CB15A8CB2
SHA-256:	D5AC6395EE9FA7A5655DF4BD23E47CFC5FB2E6F6FDECAE508492874571D60988
SHA-512:	F354AEAB43B64B7D113BA8E8742AEFCE4D94157689109288C66A2D8DF28070928E5A2007CD94197EE612E07880933CEF4FFBF08A1E06C36DA34BA28B72EF8368
Malicious:	false
Preview:	#10KHz 1 cycle Sine Wave with a 10V pk-pk..#and with 45 deg offset..#Here w = 2pi10^4t..#The Freq of the equation is..#F= 1/((points/cycle) clock)..#In this equation Freq is 1/1000*100ns = 10Khz..#View the waveform with the Settings Points:1K, SR:10MS/s......range(0us,100us)..sin(w-pi/4)........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\sine wave with offset.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.092666818947481
Encrypted:	false
SSDEEP:	6:J8MMclEmoe0ZXxZA0TRlYhshqXOuEprAMjf1waEoQpBry:+fe0p40PYuqREpUmfyaElpty
MD5:	624CB2249BCCDC64EB32441CAADCB784
SHA1:	BA405EBAB05F008C1BBD3C4EEBE9A0CBA36FDE10
SHA-256:	846C59A5764D5BBCDCECBCA6C3A6EE5C0575621A247183628AC72D37AA811BE5
SHA-512:	E73190CED07329ECD0683D8DE36616F6313E29001EE7FCAF6BA6A603659C4979FC52ED489A5BD142EFA530CD5B0BBDAC3E90C46D4CE74DAB7765872019551893
Malicious:	false
Preview:	#10KHz Sine Wave with a 2V peak-to-peak amplitude...#The Frequency of the equation is calculated ..#by F= 1/((points/cycle) * clock)..#In this equation Frequency is 1/1000100ns = 10Khz..#View the waveform with the Settings Points:1K,SR:10MS/s......range(0,100us)..sin(2pi1e4t)........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\sine wave.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.092666818947481
Encrypted:	false
SSDEEP:	6:J8MMclEmoe0ZXxZA0TRlYhshqXOuEprAMjf1waEoQpBry:+fe0p40PYuqREpUmfyaElpty
MD5:	624CB2249BCCDC64EB32441CAADCB784
SHA1:	BA405EBAB05F008C1BBD3C4EEBE9A0CBA36FDE10
SHA-256:	846C59A5764D5BBCDCECBCA6C3A6EE5C0575621A247183628AC72D37AA811BE5
SHA-512:	E73190CED07329ECD0683D8DE36616F6313E29001EE7FCAF6BA6A603659C4979FC52ED489A5BD142EFA530CD5B0BBDAC3E90C46D4CE74DAB7765872019551893
Malicious:	false
Preview:	#10KHz Sine Wave with a 2V peak-to-peak amplitude...#The Frequency of the equation is calculated ..#by F= 1/((points/cycle) * clock)..#In this equation Frequency is 1/1000100ns = 10Khz..#View the waveform with the Settings Points:1K,SR:10MS/s......range(0,100us)..sin(2pi1e4t)........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\sine455d.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270
Entropy (8bit):	5.0481030918562855
Encrypted:	false
SSDEEP:	6:J8uQOAy/HM//0ZXxFoShJWlYhshqXDXuRucaeg/rAsjf1wPETo5ryn:DQ4HW/0psgWYuqz/cat/UGfyPEUyn
MD5:	DBD81F1969B73FCD6FD7B7554EE1C7CF
SHA1:	330C8A19A9269DC7DB0778193C9776C15909B890
SHA-256:	ECD377D279CB498B5623DAE772C1B26F990A3BCBB236B45F51E4B13DAFC1FE66
SHA-512:	3EC94AFC8D7216EFF7202B72E9E9A7886F484F569564F00C093FF06A996DFCF2A3E751B98F5ED9650A480A57225839D8DBAC11E5EBEB73E76ADFEDD783E05F29
Malicious:	false
Preview:	#10KHz 1 cycle Sine Wave with a 10V pk-pk..#Here w = 2pi10^4t..#The Freq of the equation F= 1/((points/cycle) clock)..#In this equation Freq is 1/1000*100ns = 10Khz i.e 10^4..#View the waveform with the settings Points:1K,SR:10MS/s....range(0us,100us)..sin(w)......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\sine456c.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	301
Entropy (8bit):	5.066468430482892
Encrypted:	false
SSDEEP:	6:J8uQOAy/HLRNFpWVQ//0ZXxFoSnJW3lYhshqXDXuRuEprAMjfxwaUo9g+y:DQ4HLiVC/0ps8kVYuqz/EpUmfGaUoy
MD5:	DEC4941B6FC9087352120C8635457242
SHA1:	07FE2F4E7A525B8A92BE60C515CCF54CB15A8CB2
SHA-256:	D5AC6395EE9FA7A5655DF4BD23E47CFC5FB2E6F6FDECAE508492874571D60988
SHA-512:	F354AEAB43B64B7D113BA8E8742AEFCE4D94157689109288C66A2D8DF28070928E5A2007CD94197EE612E07880933CEF4FFBF08A1E06C36DA34BA28B72EF8368
Malicious:	false
Preview:	#10KHz 1 cycle Sine Wave with a 10V pk-pk..#and with 45 deg offset..#Here w = 2pi10^4t..#The Freq of the equation is..#F= 1/((points/cycle) clock)..#In this equation Freq is 1/1000*100ns = 10Khz..#View the waveform with the Settings Points:1K, SR:10MS/s......range(0us,100us)..sin(w-pi/4)........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\sine457c.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.092666818947481
Encrypted:	false
SSDEEP:	6:J8MMclEmoe0ZXxZA0TRlYhshqXOuEprAMjf1waEoQpBry:+fe0p40PYuqREpUmfyaElpty
MD5:	624CB2249BCCDC64EB32441CAADCB784
SHA1:	BA405EBAB05F008C1BBD3C4EEBE9A0CBA36FDE10
SHA-256:	846C59A5764D5BBCDCECBCA6C3A6EE5C0575621A247183628AC72D37AA811BE5
SHA-512:	E73190CED07329ECD0683D8DE36616F6313E29001EE7FCAF6BA6A603659C4979FC52ED489A5BD142EFA530CD5B0BBDAC3E90C46D4CE74DAB7765872019551893
Malicious:	false
Preview:	#10KHz Sine Wave with a 2V peak-to-peak amplitude...#The Frequency of the equation is calculated ..#by F= 1/((points/cycle) * clock)..#In this equation Frequency is 1/1000100ns = 10Khz..#View the waveform with the Settings Points:1K,SR:10MS/s......range(0,100us)..sin(2pi1e4t)........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\sine458c.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.058639111235817
Encrypted:	false
SSDEEP:	6:J8MMdrEmoe0NZBmoe0ZXxZ6VyTRlYhshqXPRUParUYn3oflTUP/br:1fe0NZBfe0pCaYuq/RUPabnYflTCr
MD5:	6751B637900F71CB6D8B7B8572F3DA75
SHA1:	47AC5A7352A8C00D8CF60F8BDD8841DB722DC71D
SHA-256:	FF43C395A4BDF0716C95D8DCC985DF095FCBBEA9C99F6C0306B2B854811A27F8
SHA-512:	D34D7430A610B568A81C7FF6000645711915B79ED359B6A6DCDBA665EB9FA85934F28ACA837511C22032CC5B319C77540D33C2B00408D82BA54DEA57DD8CBF36
Malicious:	false
Preview:	#10KHz Sine Wave with a 10V peak-to-peak amplitude...#The 5 represents the peak amplitude...#The Frequency of the equation is ..#calculated by F= 1/((points/cycle) * clock)..#In this equation Frequency is 1/1000100ns..# = 10Khz i.e 10^4 in the equation..#View the waveform with Settings Points:1K,SR=100M......range(0us,10us)..5sin(2pi10^4*t)..........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\sine_5V.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.058639111235817
Encrypted:	false
SSDEEP:	6:J8MMdrEmoe0NZBmoe0ZXxZ6VyTRlYhshqXPRUParUYn3oflTUP/br:1fe0NZBfe0pCaYuq/RUPabnYflTCr
MD5:	6751B637900F71CB6D8B7B8572F3DA75
SHA1:	47AC5A7352A8C00D8CF60F8BDD8841DB722DC71D
SHA-256:	FF43C395A4BDF0716C95D8DCC985DF095FCBBEA9C99F6C0306B2B854811A27F8
SHA-512:	D34D7430A610B568A81C7FF6000645711915B79ED359B6A6DCDBA665EB9FA85934F28ACA837511C22032CC5B319C77540D33C2B00408D82BA54DEA57DD8CBF36
Malicious:	false
Preview:	#10KHz Sine Wave with a 10V peak-to-peak amplitude...#The 5 represents the peak amplitude...#The Frequency of the equation is ..#calculated by F= 1/((points/cycle) * clock)..#In this equation Frequency is 1/1000100ns..# = 10Khz i.e 10^4 in the equation..#View the waveform with Settings Points:1K,SR=100M......range(0us,10us)..5sin(2pi10^4*t)..........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\sqrt.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	273
Entropy (8bit):	4.783672427129715
Encrypted:	false
SSDEEP:	6:N9oemy3RKikVAbDUc5gyh0UJOn3of1wPEPoPNy:cYKA7n0UJOnYfyP0Cy
MD5:	F067FC24B20A114EBFB9F7563CA61242
SHA1:	ACDDDA810662456FFA1F0D5F9082C4CFD1AEDD09
SHA-256:	7E1C4B37761F81C7A7B9DA687FCF7A5091357E0D0606EB67F4565E6EB901260D
SHA-512:	C936F0348B7F2E8F574F6335CB70EAAB0EFA91DBBE3802F57F9D908B362A6A0217F2138C36B55EBEB572CF50703510BADD4000FA0C07CE552C2735B58A465CC6
Malicious:	false
Preview:	#This Equation uses sqrt function sqrt( ..#which calculates the square root of the argument..#specified In square root function #sqrt( ..#the argument must be a positive value...#View the waveform with Settings Points:1K,SR:10MS/s....range(0,100us)..sqrt(sin(pi*x))........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\sqrt458c.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	273
Entropy (8bit):	4.783672427129715
Encrypted:	false
SSDEEP:	6:N9oemy3RKikVAbDUc5gyh0UJOn3of1wPEPoPNy:cYKA7n0UJOnYfyP0Cy
MD5:	F067FC24B20A114EBFB9F7563CA61242
SHA1:	ACDDDA810662456FFA1F0D5F9082C4CFD1AEDD09
SHA-256:	7E1C4B37761F81C7A7B9DA687FCF7A5091357E0D0606EB67F4565E6EB901260D
SHA-512:	C936F0348B7F2E8F574F6335CB70EAAB0EFA91DBBE3802F57F9D908B362A6A0217F2138C36B55EBEB572CF50703510BADD4000FA0C07CE552C2735B58A465CC6
Malicious:	false
Preview:	#This Equation uses sqrt function sqrt( ..#which calculates the square root of the argument..#specified In square root function #sqrt( ..#the argument must be a positive value...#View the waveform with Settings Points:1K,SR:10MS/s....range(0,100us)..sqrt(sin(pi*x))........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\squa459b.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	486
Entropy (8bit):	4.965558101801653
Encrypted:	false
SSDEEP:	12:f60A9XSbFYxFfWMu3fezFSrxTeJfk2UmfOowPqptiDQYNw+5WCZyy:y0UdLWJpAvOoffZYf
MD5:	85C087C9784053E4F8ACEE423986C4B5
SHA1:	10BB3FDA9E7797322D44182F4DB139FCA44A5943
SHA-256:	37652223F8586108CA68CBEB929135A13FB27A69929506DA26FB74BA316F9821
SHA-512:	CBC655756B5E668EEFE9CDE1C67D66EE5DCE5D154C55A14402107981BFDC8673ACFEC255E04461ED30A1BBEA0903A70ACF29687C3D284D7D162CE49BD883AC30
Malicious:	false
Preview:	#This is a series expansion which breaks a ..#square wave down into it's component sine waves...#This is only the first 5 members of the series...#The base waveform is a 3Hz sine wave...#Change '3' in all the series members ..#to change the freq of the square wave...#View the waveform with the Settings Points:100K,SR:100KS/s....range(0,1s)..K0 = 0.333sin(3(6tpi)) ..K1 = 0.2sin(5(6tpi)) ..K2 = 0 .1428sin(7(6tpi))..sin(6tpi) +K0+ K1+ K2+ 0.111 * sin(9(6t*pi))........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations\square.eqa (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	486
Entropy (8bit):	4.965558101801653
Encrypted:	false
SSDEEP:	12:f60A9XSbFYxFfWMu3fezFSrxTeJfk2UmfOowPqptiDQYNw+5WCZyy:y0UdLWJpAvOoffZYf
MD5:	85C087C9784053E4F8ACEE423986C4B5
SHA1:	10BB3FDA9E7797322D44182F4DB139FCA44A5943
SHA-256:	37652223F8586108CA68CBEB929135A13FB27A69929506DA26FB74BA316F9821
SHA-512:	CBC655756B5E668EEFE9CDE1C67D66EE5DCE5D154C55A14402107981BFDC8673ACFEC255E04461ED30A1BBEA0903A70ACF29687C3D284D7D162CE49BD883AC30
Malicious:	false
Preview:	#This is a series expansion which breaks a ..#square wave down into it's component sine waves...#This is only the first 5 members of the series...#The base waveform is a 3Hz sine wave...#Change '3' in all the series members ..#to change the freq of the square wave...#View the waveform with the Settings Points:100K,SR:100KS/s....range(0,1s)..K0 = 0.333sin(3(6tpi)) ..K1 = 0.2sin(5(6tpi)) ..K2 = 0 .1428sin(7(6tpi))..sin(6tpi) +K0+ K1+ K2+ 0.111 * sin(9(6t*pi))........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B001.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2642
Entropy (8bit):	1.4056439268234804
Encrypted:	false
SSDEEP:	24:kMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWksG:uC
MD5:	CB54F60F48E9C6305C456102D3671E49
SHA1:	EA9481887A7E4D8C491B2A44C52FBC1B67E8F942
SHA-256:	59270A8C10740AA75DD7F3F9453295A0D15B9746BDBF3084BE09AD0B8DC712EF
SHA-512:	1A3043360BB65E74837C54F036ED6C1C7A36D3DD07EF7650FE58894890B368A46BD59BE8C4ECA601188DB81F22A4B2D47C4113131C472670C3E9FEFFBE8ECEEC
Malicious:	false
Preview:	MAGIC 1000..#42600...............?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B002.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2642
Entropy (8bit):	3.3379277006362926
Encrypted:	false
SSDEEP:	24:ICiQO6+82CiQO6+82CiQO6+82CiQO6+82CiQO6+82CiQO6+82CiQO6+82CiQO6+8:di+i+i+i+i+i+i+i+i+i+i+i+i6
MD5:	CCB60DBF400A1E4A9C69BB80324A3862
SHA1:	96426DF1A14C7363ABAC0794B18090F8FC90A69E
SHA-256:	0397BC54E8E9A8611E70B43A184E1999A1AAD4329FE90C9E9FEAA4C89D960520
SHA-512:	B98D1CB5C74E72F1A9DDA67AC31FAFE0A7888B21354DD401BF718119D4CB0151BDF50EC88D5F84BDA6E3CF38380E58DE5BF5DED533EFD668A0F9AF03C873EC87
Malicious:	false
Preview:	MAGIC 1000..#42600...?....?......?...................?.......?....?................\|.................?.:..?.P.............................L..?....?...........D..............V.......?....?................b.................?....?......?...................?.......?....?................\|.................?.:..?.P.............................L..?....?...........D..............V.......?....?................b.................?....?......?...................?.......?....?................\|.................?.:..?.P.............................L..?....?...........D..............V.......?....?................b.................?....?......?...................?.......?....?................\|.................?.:..?.P.............................L..?....?...........D..............V.......?....?................b.................?....?......?...................?.......?....?................\|.................?.:..?.P.............................L..?....?...........D..............V.......?....?.............

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B003.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2602
Entropy (8bit):	3.3259574705386865
Encrypted:	false
SSDEEP:	24:mtlQlQlQlQlQlQlQlQlQlQlQlQlQlQlQlUsG:mtaaaaaaaaaaaaaaaQ
MD5:	BF7B65E32094B1289B21A0F57D752B95
SHA1:	76E9E409DAF57FA8BEC54B4250EE6E5A74CC3C79
SHA-256:	6E0B42219EBFD7DD9D71C4AA648FC89203AA1FBA5882E98336059D974693BF3E
SHA-512:	88B97C9C872D93516FD9E478E8FCCD8541DB0C36C8E64697F2706510CE508DC84E107A9A2F4183B31AEFCFBF229414174644411B584DF3E67B09A28594FF676E
Malicious:	false
Preview:	MAGIC 1000..#42560...?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R.

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B004.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2602
Entropy (8bit):	3.3259574705386865
Encrypted:	false
SSDEEP:	24:mtlQlQlQlQlQlQlQlQlQlQlQlQlQlQlQlUsG:mtaaaaaaaaaaaaaaaQ
MD5:	BF7B65E32094B1289B21A0F57D752B95
SHA1:	76E9E409DAF57FA8BEC54B4250EE6E5A74CC3C79
SHA-256:	6E0B42219EBFD7DD9D71C4AA648FC89203AA1FBA5882E98336059D974693BF3E
SHA-512:	88B97C9C872D93516FD9E478E8FCCD8541DB0C36C8E64697F2706510CE508DC84E107A9A2F4183B31AEFCFBF229414174644411B584DF3E67B09A28594FF676E
Malicious:	false
Preview:	MAGIC 1000..#42560...?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R.

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B005.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2642
Entropy (8bit):	3.245444941587442
Encrypted:	false
SSDEEP:	48:16gS6gS6gS6gS6gS6gS6gS6gS6gS6gS6gS6gS6gK:16gS6gS6gS6gS6gS6gS6gS6gS6gS6gS+
MD5:	D6CDF559195DCE8122A82405102BBDCE
SHA1:	AA372CCCEBB95211F0C6143C680989DB3FA4A2E3
SHA-256:	E4B2474CCEC2501A003D1AC87FEC3003A83B56621094636BC18113F20AEA457F
SHA-512:	47DAFE41180F5909574E112D83F200B30EF85E0F51E66811C9C233394E7BAAF952F138EB3D62A7F6DD9902349FF3B8736CA0BD06DF91200F06F308E0927D3D5E
Malicious:	false
Preview:	MAGIC 1000..#42600...?....?....?....?....?....?....?....?....?. ..?...............................@.........P.............................L.........R.........D..............V...............................................?....?....?....?....?....?....?....?....?. ..?...............................@.........P.............................L.........R.........D..............V...............................................?....?....?....?....?....?....?....?....?. ..?...............................@.........P.............................L.........R.........D..............V...............................................?....?....?....?....?....?....?....?....?. ..?...............................@.........P.............................L.........R.........D..............V...............................................?....?....?....?....?....?....?....?....?. ..?...............................@.........P.............................L.........R.........D..............V..........................

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B006.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2682
Entropy (8bit):	3.2016404997643333
Encrypted:	false
SSDEEP:	48:Rclf9v7Vclf9v7Vclf9v7Vclf9v7Vclf9v7Vclf9v7Vclf9v7Vclf9v7Vclf9v7z:RcB9jVcB9jVcB9jVcB9jVcB9jVcB9jV4
MD5:	C9E88F2A016825FE917DED20867ABD2D
SHA1:	98853AD648254E822F994F977A7D200B6B40A5DD
SHA-256:	3098820068D58001FBE5DF458B868AA91FF7DACF12801D9518613C1E9E78F019
SHA-512:	8F954E9CDF6C9CEF8E697770D29B4F0EE3E291C6D850987FD8C4794149C38E259203B1A0B7B2A74E26879FB97992F36EB012A2F47A506EDF3CA0F146F592323B
Malicious:	false
Preview:	MAGIC 1000..#42640...?....?....?....?....?....?....?....?....?....?.R..?....?.....................@.........P.........@...................L.........R.........D......................................................................................................?....?....?....?....?....?....?....?....?....?.R..?....?.....................@.........P.........@...................L.........R.........D......................................................................................................?....?....?....?....?....?....?....?....?....?.R..?....?.....................@.........P.........@...................L.........R.........D......................................................................................................?....?....?....?....?....?....?....?....?....?.R..?....?.....................@.........P.........@...................L.........R.........D......................................................................................................?....?....?....?...

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B007.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2842
Entropy (8bit):	3.2935452653247403
Encrypted:	false
SSDEEP:	24:jGp/RWGp/RWGp/RWGp/RWGp/RWGp/RWGp/RwsG:jGKGKGKGKGKGKGC
MD5:	FF218399BE9B424DB7CBA338B2DE2644
SHA1:	48EB3E1F4F1BA1DD12A04C88AD214404B3EC1165
SHA-256:	84186AA280A9ADFFD10BFFA7C40152BD30AE5FB981CA0EC965006D96A42A7F31
SHA-512:	52866B74001DC86B0374B6124B7968D39DB6FFF8A2490469EB5F00D44C99C0BDEDF245788971BFB967D14EC34B9EBDDD2CA35A24A6BB9535086349A4D4EC4965
Malicious:	false
Preview:	MAGIC 1000..#42800"..?."..?......?...................?.......?....?.p..?."..?."..?....?."..?.$..?.b..?.X..?....?...?.@........."...."....$.........p..?."..?................V............................................"....p..............&..?.p..?...........$...."...."...."...."...."...."........"....:...."....$.............."..?...?. ..............&............................................ ..................."..?."..?......?...................?.......?....?.p..?."..?."..?....?."..?.$..?.b..?.X..?....?...?.@........."...."....$.........p..?."..?................V............................................"....p..............&..?.p..?...........$...."...."...."...."...."...."........"....:...."....$.............."..?...?. ..............&............................................ ..................."..?."..?......?...................?.......?....?.p..?."..?."..?....?."..?.$..?.b..?.X..?....?.*..?.@........."...."....$.........p..?."..?................V..........................

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B008.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2842
Entropy (8bit):	3.2935452653247403
Encrypted:	false
SSDEEP:	24:jGp/RWGp/RWGp/RWGp/RWGp/RWGp/RWGp/RwsG:jGKGKGKGKGKGKGC
MD5:	FF218399BE9B424DB7CBA338B2DE2644
SHA1:	48EB3E1F4F1BA1DD12A04C88AD214404B3EC1165
SHA-256:	84186AA280A9ADFFD10BFFA7C40152BD30AE5FB981CA0EC965006D96A42A7F31
SHA-512:	52866B74001DC86B0374B6124B7968D39DB6FFF8A2490469EB5F00D44C99C0BDEDF245788971BFB967D14EC34B9EBDDD2CA35A24A6BB9535086349A4D4EC4965
Malicious:	false
Preview:	MAGIC 1000..#42800"..?."..?......?...................?.......?....?.p..?."..?."..?....?."..?.$..?.b..?.X..?....?...?.@........."...."....$.........p..?."..?................V............................................"....p..............&..?.p..?...........$...."...."...."...."...."...."........"....:...."....$.............."..?...?. ..............&............................................ ..................."..?."..?......?...................?.......?....?.p..?."..?."..?....?."..?.$..?.b..?.X..?....?...?.@........."...."....$.........p..?."..?................V............................................"....p..............&..?.p..?...........$...."...."...."...."...."...."........"....:...."....$.............."..?...?. ..............&............................................ ..................."..?."..?......?...................?.......?....?.p..?."..?."..?....?."..?.$..?.b..?.X..?....?.*..?.@........."...."....$.........p..?."..?................V..........................

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B009.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	3402
Entropy (8bit):	3.0545033192532207
Encrypted:	false
SSDEEP:	96:AsmpEsmpEsmpEsmpEsmpEsmpEsmpEsmp7:AsmpEsmpEsmpEsmpEsmpEsmpEsmpEsmV
MD5:	466BAF64BD401A0F062787500B09059A
SHA1:	CC86EAACAD420CBFEB731B929A5DBFAC1E4151A3
SHA-256:	CC04DDD6A26944ECD197A964B65E8E8091A20762625FDA16E632870A1D6356A7
SHA-512:	C45B792EAAF474C8AE227FE05E667C7DAAA157F1726B90760EDCE0768138527110ECCE31D8920012614473CAE6A7EDFFD3D9BC6B33F5E710637FC40501D2620F
Malicious:	false
Preview:	MAGIC 1000..#43360...............?....D....n.........?.......?.J..?....................................8..................................J.........P......................?....?....?....?....?....?..........................#.......................................................................................?....?....?....?....?....?....?....?....?....?....?....?...............................B......................................................?....D....n.........?.......?.J..?....................................8..................................J.........P......................?....?....?....?....?....?..........................#.......................................................................................?....?....?....?....?....?....?....?....?....?....?....?...............................B......................................................?....D....n.........?.......?.J..?....................................8..................................J.........P...........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B010.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	3402
Entropy (8bit):	3.0545033192532207
Encrypted:	false
SSDEEP:	96:AsmpEsmpEsmpEsmpEsmpEsmpEsmpEsmp7:AsmpEsmpEsmpEsmpEsmpEsmpEsmpEsmV
MD5:	466BAF64BD401A0F062787500B09059A
SHA1:	CC86EAACAD420CBFEB731B929A5DBFAC1E4151A3
SHA-256:	CC04DDD6A26944ECD197A964B65E8E8091A20762625FDA16E632870A1D6356A7
SHA-512:	C45B792EAAF474C8AE227FE05E667C7DAAA157F1726B90760EDCE0768138527110ECCE31D8920012614473CAE6A7EDFFD3D9BC6B33F5E710637FC40501D2620F
Malicious:	false
Preview:	MAGIC 1000..#43360...............?....D....n.........?.......?.J..?....................................8..................................J.........P......................?....?....?....?....?....?..........................#.......................................................................................?....?....?....?....?....?....?....?....?....?....?....?...............................B......................................................?....D....n.........?.......?.J..?....................................8..................................J.........P......................?....?....?....?....?....?..........................#.......................................................................................?....?....?....?....?....?....?....?....?....?....?....?...............................B......................................................?....D....n.........?.......?.J..?....................................8..................................J.........P...........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B011.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2922
Entropy (8bit):	2.779547698661516
Encrypted:	false
SSDEEP:	48:J0H0H0H0H0H0H0H0H0H0H0H0H0H0H0H0/:J0H0H0H0H0H0H0H0H0H0H0H0H0H0H0Hy
MD5:	181DD37D630D15ED02E94AFACCA1CFF7
SHA1:	6F2EDA3F35688D2E13BC68C0D2154BE47E4D02E5
SHA-256:	FA117755915F20FF4FAC3E29E4519887D42146B77076DB4BBD4F8FC1E0BB5641
SHA-512:	8C835B56B0638E1812CF83B345B6CA4DAD8192B3BD068064B97731B36D7FEE1EA2063F86A9C82B05AFDC2A12E42D9047E88AFAB8C3AD36E1581E7D2537FEEBC5
Malicious:	false
Preview:	MAGIC 1000..#42880...............?....D....n.........?.......?....?.R..?....?....?.$..?........... .........P.........@...................$.........R.........D......................................................?....D....n.........?.......?....?.R..?....?....?.$..?........... .........P.........@...................$.........R.........D......................................................?....D....n.........?.......?....?.R..?....?....?.$..?........... .........P.........@...................$.........R.........D......................................................?....D....n.........?.......?....?.R..?....?....?.$..?........... .........P.........@...................$.........R.........D......................................................?....D....n.........?.......?....?.R..?....?....?.$..?........... .........P.........@...................$.........R.........D......................................................?....D....n.........?.......?....?.R..?....?....?.$..?........... .

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B45ab.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2642
Entropy (8bit):	1.4056439268234804
Encrypted:	false
SSDEEP:	24:kMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWksG:uC
MD5:	CB54F60F48E9C6305C456102D3671E49
SHA1:	EA9481887A7E4D8C491B2A44C52FBC1B67E8F942
SHA-256:	59270A8C10740AA75DD7F3F9453295A0D15B9746BDBF3084BE09AD0B8DC712EF
SHA-512:	1A3043360BB65E74837C54F036ED6C1C7A36D3DD07EF7650FE58894890B368A46BD59BE8C4ECA601188DB81F22A4B2D47C4113131C472670C3E9FEFFBE8ECEEC
Malicious:	false
Preview:	MAGIC 1000..#42600...............?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n.........?.............................?....D....n......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B45bb.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2642
Entropy (8bit):	3.3379277006362926
Encrypted:	false
SSDEEP:	24:ICiQO6+82CiQO6+82CiQO6+82CiQO6+82CiQO6+82CiQO6+82CiQO6+82CiQO6+8:di+i+i+i+i+i+i+i+i+i+i+i+i6
MD5:	CCB60DBF400A1E4A9C69BB80324A3862
SHA1:	96426DF1A14C7363ABAC0794B18090F8FC90A69E
SHA-256:	0397BC54E8E9A8611E70B43A184E1999A1AAD4329FE90C9E9FEAA4C89D960520
SHA-512:	B98D1CB5C74E72F1A9DDA67AC31FAFE0A7888B21354DD401BF718119D4CB0151BDF50EC88D5F84BDA6E3CF38380E58DE5BF5DED533EFD668A0F9AF03C873EC87
Malicious:	false
Preview:	MAGIC 1000..#42600...?....?......?...................?.......?....?................\|.................?.:..?.P.............................L..?....?...........D..............V.......?....?................b.................?....?......?...................?.......?....?................\|.................?.:..?.P.............................L..?....?...........D..............V.......?....?................b.................?....?......?...................?.......?....?................\|.................?.:..?.P.............................L..?....?...........D..............V.......?....?................b.................?....?......?...................?.......?....?................\|.................?.:..?.P.............................L..?....?...........D..............V.......?....?................b.................?....?......?...................?.......?....?................\|.................?.:..?.P.............................L..?....?...........D..............V.......?....?.............

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B45ca.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2602
Entropy (8bit):	3.3259574705386865
Encrypted:	false
SSDEEP:	24:mtlQlQlQlQlQlQlQlQlQlQlQlQlQlQlQlUsG:mtaaaaaaaaaaaaaaaQ
MD5:	BF7B65E32094B1289B21A0F57D752B95
SHA1:	76E9E409DAF57FA8BEC54B4250EE6E5A74CC3C79
SHA-256:	6E0B42219EBFD7DD9D71C4AA648FC89203AA1FBA5882E98336059D974693BF3E
SHA-512:	88B97C9C872D93516FD9E478E8FCCD8541DB0C36C8E64697F2706510CE508DC84E107A9A2F4183B31AEFCFBF229414174644411B584DF3E67B09A28594FF676E
Malicious:	false
Preview:	MAGIC 1000..#42560...?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R..?....?....?.H..?...................................................j.........J...................$..................................V.......?....?....?.H..?.R.

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B45da.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2642
Entropy (8bit):	3.245444941587442
Encrypted:	false
SSDEEP:	48:16gS6gS6gS6gS6gS6gS6gS6gS6gS6gS6gS6gS6gK:16gS6gS6gS6gS6gS6gS6gS6gS6gS6gS+
MD5:	D6CDF559195DCE8122A82405102BBDCE
SHA1:	AA372CCCEBB95211F0C6143C680989DB3FA4A2E3
SHA-256:	E4B2474CCEC2501A003D1AC87FEC3003A83B56621094636BC18113F20AEA457F
SHA-512:	47DAFE41180F5909574E112D83F200B30EF85E0F51E66811C9C233394E7BAAF952F138EB3D62A7F6DD9902349FF3B8736CA0BD06DF91200F06F308E0927D3D5E
Malicious:	false
Preview:	MAGIC 1000..#42600...?....?....?....?....?....?....?....?....?. ..?...............................@.........P.............................L.........R.........D..............V...............................................?....?....?....?....?....?....?....?....?. ..?...............................@.........P.............................L.........R.........D..............V...............................................?....?....?....?....?....?....?....?....?. ..?...............................@.........P.............................L.........R.........D..............V...............................................?....?....?....?....?....?....?....?....?. ..?...............................@.........P.............................L.........R.........D..............V...............................................?....?....?....?....?....?....?....?....?. ..?...............................@.........P.............................L.........R.........D..............V..........................

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B45e9.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2682
Entropy (8bit):	3.2016404997643333
Encrypted:	false
SSDEEP:	48:Rclf9v7Vclf9v7Vclf9v7Vclf9v7Vclf9v7Vclf9v7Vclf9v7Vclf9v7Vclf9v7z:RcB9jVcB9jVcB9jVcB9jVcB9jVcB9jV4
MD5:	C9E88F2A016825FE917DED20867ABD2D
SHA1:	98853AD648254E822F994F977A7D200B6B40A5DD
SHA-256:	3098820068D58001FBE5DF458B868AA91FF7DACF12801D9518613C1E9E78F019
SHA-512:	8F954E9CDF6C9CEF8E697770D29B4F0EE3E291C6D850987FD8C4794149C38E259203B1A0B7B2A74E26879FB97992F36EB012A2F47A506EDF3CA0F146F592323B
Malicious:	false
Preview:	MAGIC 1000..#42640...?....?....?....?....?....?....?....?....?....?.R..?....?.....................@.........P.........@...................L.........R.........D......................................................................................................?....?....?....?....?....?....?....?....?....?.R..?....?.....................@.........P.........@...................L.........R.........D......................................................................................................?....?....?....?....?....?....?....?....?....?.R..?....?.....................@.........P.........@...................L.........R.........D......................................................................................................?....?....?....?....?....?....?....?....?....?.R..?....?.....................@.........P.........@...................L.........R.........D......................................................................................................?....?....?....?...

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B45f9.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2842
Entropy (8bit):	3.2935452653247403
Encrypted:	false
SSDEEP:	24:jGp/RWGp/RWGp/RWGp/RWGp/RWGp/RWGp/RwsG:jGKGKGKGKGKGKGC
MD5:	FF218399BE9B424DB7CBA338B2DE2644
SHA1:	48EB3E1F4F1BA1DD12A04C88AD214404B3EC1165
SHA-256:	84186AA280A9ADFFD10BFFA7C40152BD30AE5FB981CA0EC965006D96A42A7F31
SHA-512:	52866B74001DC86B0374B6124B7968D39DB6FFF8A2490469EB5F00D44C99C0BDEDF245788971BFB967D14EC34B9EBDDD2CA35A24A6BB9535086349A4D4EC4965
Malicious:	false
Preview:	MAGIC 1000..#42800"..?."..?......?...................?.......?....?.p..?."..?."..?....?."..?.$..?.b..?.X..?....?...?.@........."...."....$.........p..?."..?................V............................................"....p..............&..?.p..?...........$...."...."...."...."...."...."........"....:...."....$.............."..?...?. ..............&............................................ ..................."..?."..?......?...................?.......?....?.p..?."..?."..?....?."..?.$..?.b..?.X..?....?...?.@........."...."....$.........p..?."..?................V............................................"....p..............&..?.p..?...........$...."...."...."...."...."...."........"....:...."....$.............."..?...?. ..............&............................................ ..................."..?."..?......?...................?.......?....?.p..?."..?."..?....?."..?.$..?.b..?.X..?....?.*..?.@........."...."....$.........p..?."..?................V..........................

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B4609.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	3402
Entropy (8bit):	3.0545033192532207
Encrypted:	false
SSDEEP:	96:AsmpEsmpEsmpEsmpEsmpEsmpEsmpEsmp7:AsmpEsmpEsmpEsmpEsmpEsmpEsmpEsmV
MD5:	466BAF64BD401A0F062787500B09059A
SHA1:	CC86EAACAD420CBFEB731B929A5DBFAC1E4151A3
SHA-256:	CC04DDD6A26944ECD197A964B65E8E8091A20762625FDA16E632870A1D6356A7
SHA-512:	C45B792EAAF474C8AE227FE05E667C7DAAA157F1726B90760EDCE0768138527110ECCE31D8920012614473CAE6A7EDFFD3D9BC6B33F5E710637FC40501D2620F
Malicious:	false
Preview:	MAGIC 1000..#43360...............?....D....n.........?.......?.J..?....................................8..................................J.........P......................?....?....?....?....?....?..........................#.......................................................................................?....?....?....?....?....?....?....?....?....?....?....?...............................B......................................................?....D....n.........?.......?.J..?....................................8..................................J.........P......................?....?....?....?....?....?..........................#.......................................................................................?....?....?....?....?....?....?....?....?....?....?....?...............................B......................................................?....D....n.........?.......?.J..?....................................8..................................J.........P...........

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\100BaseT\100B4618.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2922
Entropy (8bit):	2.779547698661516
Encrypted:	false
SSDEEP:	48:J0H0H0H0H0H0H0H0H0H0H0H0H0H0H0H0/:J0H0H0H0H0H0H0H0H0H0H0H0H0H0H0Hy
MD5:	181DD37D630D15ED02E94AFACCA1CFF7
SHA1:	6F2EDA3F35688D2E13BC68C0D2154BE47E4D02E5
SHA-256:	FA117755915F20FF4FAC3E29E4519887D42146B77076DB4BBD4F8FC1E0BB5641
SHA-512:	8C835B56B0638E1812CF83B345B6CA4DAD8192B3BD068064B97731B36D7FEE1EA2063F86A9C82B05AFDC2A12E42D9047E88AFAB8C3AD36E1581E7D2537FEEBC5
Malicious:	false
Preview:	MAGIC 1000..#42880...............?....D....n.........?.......?....?.R..?....?....?.$..?........... .........P.........@...................$.........R.........D......................................................?....D....n.........?.......?....?.R..?....?....?.$..?........... .........P.........@...................$.........R.........D......................................................?....D....n.........?.......?....?.R..?....?....?.$..?........... .........P.........@...................$.........R.........D......................................................?....D....n.........?.......?....?.R..?....?....?.$..?........... .........P.........@...................$.........R.........D......................................................?....D....n.........?.......?....?.R..?....?....?.$..?........... .........P.........@...................$.........R.........D......................................................?....D....n.........?.......?....?.R..?....?....?.$..?........... .

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Bluetooth\tdho4628.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2880045
Entropy (8bit):	6.419444630430931
Encrypted:	false
SSDEEP:	49152:TCxk3sX9+35taRQTmzSOjKQekZxujpPXSAwL1tjP:OxosX9+3ra+mzSOjKQekzujpfSAwJZP
MD5:	659EAA2AE7D6C1B83D279C77A1C1728F
SHA1:	68EB9539DCF20975091F4812F72BC88A098BA56F
SHA-256:	1C942350DBC023916EB67E82C496DAA41E32FD82B202B13BCC96B59C65B85E6C
SHA-512:	E196857A15B3848C4D34B567A9704FE279526B71778B079A4E9EA21E4A224C4CD8EF19D0ED46B6462AF95C1486680AB01061917363C5FA034EBD4AC8BA9F771C
Malicious:	false
Preview:	MAGIC 1000..#72880000...;... ;........@.........@;....:... ..........:....;...................:....:..............:....:.............................:....:.................. ;....:........ .....:...`;..................`;...@;... ..........:....;....:........ ....@;...`;..................`;....:... ..........:....;...................:....:... .....:...@;........@.....:...`;........`.........`;....:...`.... ....@;...`;..............:....;...................;...@;...`....`.... ;....;...................;....:.............`;... ;...@....`.... ;....;..............:....;...................;... ;........`.....;....;...@..........:....;....:.......@.....;....;.............;....;.............:....<....:.......@.....;....;............. ;....;...................;....:..............;....:..............;...@;..............;....;...`..........:...(<....;...(..........<....<.......@....`;...X<....:...P.........8<....<........8.....;...H<........8....`.....<....;............;....;..............;

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Bluetooth\tdhop1.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2880045
Entropy (8bit):	6.419444630430931
Encrypted:	false
SSDEEP:	49152:TCxk3sX9+35taRQTmzSOjKQekZxujpPXSAwL1tjP:OxosX9+3ra+mzSOjKQekzujpfSAwJZP
MD5:	659EAA2AE7D6C1B83D279C77A1C1728F
SHA1:	68EB9539DCF20975091F4812F72BC88A098BA56F
SHA-256:	1C942350DBC023916EB67E82C496DAA41E32FD82B202B13BCC96B59C65B85E6C
SHA-512:	E196857A15B3848C4D34B567A9704FE279526B71778B079A4E9EA21E4A224C4CD8EF19D0ED46B6462AF95C1486680AB01061917363C5FA034EBD4AC8BA9F771C
Malicious:	false
Preview:	MAGIC 1000..#72880000...;... ;........@.........@;....:... ..........:....;...................:....:..............:....:.............................:....:.................. ;....:........ .....:...`;..................`;...@;... ..........:....;....:........ ....@;...`;..................`;....:... ..........:....;...................:....:... .....:...@;........@.....:...`;........`.........`;....:...`.... ....@;...`;..............:....;...................;...@;...`....`.... ;....;...................;....:.............`;... ;...@....`.... ;....;..............:....;...................;... ;........`.....;....;...@..........:....;....:.......@.....;....;.............;....;.............:....<....:.......@.....;....;............. ;....;...................;....:..............;....:..............;...@;..............;....;...`..........:...(<....;...(..........<....<.......@....`;...X<....:...P.........8<....<........8.....;...H<........8....`.....<....;............;....;..............;

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD.SEQ (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	358
Entropy (8bit):	4.278391194645534
Encrypted:	false
SSDEEP:	6:9ymklHrQLRQLdHrQLeIdQLfRG6fLCGhUuwSyyWatn:PklHrMRMdLMeIdMfosmGhUu8at
MD5:	2472784FE3012B2002DBCF08E4AAE054
SHA1:	5EAFC2D4BE652A99F97988E5ABBEA733DD4AA400
SHA-256:	3457F9E78FDEC94B0BF5F48FDAF8FB949BAA0D446C74A59FF99180CA29801A81
SHA-512:	F8443D1144F539090FDF156FB333DDE17929A45084819ACFA5A98646D3E518695C2C06F4418C9AD9C254901B0EDC449976A674E1FE9BD81263E8444A43A28DD8
Malicious:	false
Preview:	MAGIC 3003..LINES 4.."CCD_002.wfm", "CCD_001.wfm", "", 10000, 0, 0, 0.."CCD_004.wfm", "CCD_003.wfm", "", 10000, 0, 0, 0.."CCD_008.wfm", "CCD_007.wfm", "", 10000, 0, 0, 0.."CCD_006.wfm", "CCD_005.wfm", "", 10000, 0, 0, 0..TABLE_JUMP 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ..LOGIC_JUMP -1, -1, -1, -1, ..JUMP_MODE TABLE..JUMP_TIMING ASYNC ..STROBE 0..

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD.set (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1490
Entropy (8bit):	5.250807936085089
Encrypted:	false
SSDEEP:	24:aDC1DXUe83voUjH7ima2vyYXTB+49huZVts6l1qrpSt873N:aDaEeoN7iH2vyYVz2vtl1qrpSk9
MD5:	D65AD52B64E52B00CD4A275239E8E243
SHA1:	E90FCC67CCC0DBD1EEE3F5E944285CB553234174
SHA-256:	FE53055675DC109921DA589B4D4EB07F29E152D2B37F3BCEA7A813FFDBD8D40F
SHA-512:	DEFF9F76184C879F42A108F0E5642AC7AC1D4AD0D606D7796774B459096E7D155DCB912E117DD2B7363B1E43D5779BF76D4AFEC63B82E755FB9F0B4BD19BCFFF
Malicious:	false
Preview:	MAGIC 4000..Version 3..Instrument 400..Ch1Add Off..Ch1Noise -1.3000000000e+02..Ch1SkewAdjust 0.0000000000e+00..Ch1WaveformSequence "CCD_002.wfm"..Ch1Filter Through..Ch1Amplitude 5.0000000000e-01..Ch1Offset 0.0000000000e+00..Ch1DirectOutput False..Ch2Add Noise..Ch2Noise -1.3000000000e+02..Ch2SkewAdjust 0.0000000000e+00..Ch2WaveformSequence "CCD_001.wfm"..Ch2Filter Through..Ch2Amplitude 1.0000000000e+00..Ch2Offset 5.0000000000e-01..Ch2DirectOutput False..Clock 1.0000000000e+07..ClockReference Internal..ClockSource Internal..RunMode Continuous..TriggerSource External..TriggerSlope Positive..TriggerPolarity Positive..TriggerLevel 1.4000000000e+00..TriggerImpedance 1kohm..TriggerInterval 1.0000000000e-01..LCDBackLight Enabled..HilightColor 0..HardcopyFormat BMP..HardcopyDrive Main..KeyboardType ASCII..KnobDirection Forward..RemoteControl Network..GpibConfiguration Talk/Listen..GpibAddress 30..DHCPClient Disabled..IPAddress 172.17.24.197..SubnetMask 255.255.240.0..Gateway1Address ..Gateway1N

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD46b5.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	358
Entropy (8bit):	4.278391194645534
Encrypted:	false
SSDEEP:	6:9ymklHrQLRQLdHrQLeIdQLfRG6fLCGhUuwSyyWatn:PklHrMRMdLMeIdMfosmGhUu8at
MD5:	2472784FE3012B2002DBCF08E4AAE054
SHA1:	5EAFC2D4BE652A99F97988E5ABBEA733DD4AA400
SHA-256:	3457F9E78FDEC94B0BF5F48FDAF8FB949BAA0D446C74A59FF99180CA29801A81
SHA-512:	F8443D1144F539090FDF156FB333DDE17929A45084819ACFA5A98646D3E518695C2C06F4418C9AD9C254901B0EDC449976A674E1FE9BD81263E8444A43A28DD8
Malicious:	false
Preview:	MAGIC 3003..LINES 4.."CCD_002.wfm", "CCD_001.wfm", "", 10000, 0, 0, 0.."CCD_004.wfm", "CCD_003.wfm", "", 10000, 0, 0, 0.."CCD_008.wfm", "CCD_007.wfm", "", 10000, 0, 0, 0.."CCD_006.wfm", "CCD_005.wfm", "", 10000, 0, 0, 0..TABLE_JUMP 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ..LOGIC_JUMP -1, -1, -1, -1, ..JUMP_MODE TABLE..JUMP_TIMING ASYNC ..STROBE 0..

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD46d4.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1490
Entropy (8bit):	5.250807936085089
Encrypted:	false
SSDEEP:	24:aDC1DXUe83voUjH7ima2vyYXTB+49huZVts6l1qrpSt873N:aDaEeoN7iH2vyYVz2vtl1qrpSk9
MD5:	D65AD52B64E52B00CD4A275239E8E243
SHA1:	E90FCC67CCC0DBD1EEE3F5E944285CB553234174
SHA-256:	FE53055675DC109921DA589B4D4EB07F29E152D2B37F3BCEA7A813FFDBD8D40F
SHA-512:	DEFF9F76184C879F42A108F0E5642AC7AC1D4AD0D606D7796774B459096E7D155DCB912E117DD2B7363B1E43D5779BF76D4AFEC63B82E755FB9F0B4BD19BCFFF
Malicious:	false
Preview:	MAGIC 4000..Version 3..Instrument 400..Ch1Add Off..Ch1Noise -1.3000000000e+02..Ch1SkewAdjust 0.0000000000e+00..Ch1WaveformSequence "CCD_002.wfm"..Ch1Filter Through..Ch1Amplitude 5.0000000000e-01..Ch1Offset 0.0000000000e+00..Ch1DirectOutput False..Ch2Add Noise..Ch2Noise -1.3000000000e+02..Ch2SkewAdjust 0.0000000000e+00..Ch2WaveformSequence "CCD_001.wfm"..Ch2Filter Through..Ch2Amplitude 1.0000000000e+00..Ch2Offset 5.0000000000e-01..Ch2DirectOutput False..Clock 1.0000000000e+07..ClockReference Internal..ClockSource Internal..RunMode Continuous..TriggerSource External..TriggerSlope Positive..TriggerPolarity Positive..TriggerLevel 1.4000000000e+00..TriggerImpedance 1kohm..TriggerInterval 1.0000000000e-01..LCDBackLight Enabled..HilightColor 0..HardcopyFormat BMP..HardcopyDrive Main..KeyboardType ASCII..KnobDirection Forward..RemoteControl Network..GpibConfiguration Talk/Listen..GpibAddress 30..DHCPClient Disabled..IPAddress 172.17.24.197..SubnetMask 255.255.240.0..Gateway1Address ..Gateway1N

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD_001.WFM (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	5157
Entropy (8bit):	4.433661745438711
Encrypted:	false
SSDEEP:	96:egT6Jr9BwNAG18xnY7zqPbYoaqMXaNtlaGqdGtfYNy00DHS:zT6JpiN3SY60q7NijVy0Yy
MD5:	BB580B2A437C0944DE4C2E1804FF9DEB
SHA1:	B6C09D426E53A8C31C2562A5CEE5D5D61B96AD0E
SHA-256:	92B553CCEEB030080FBB5C78B35CD255986F4D1BEAB6462B343F3D5844343131
SHA-512:	DA28D52E0148E40BFAFC5501B8299683B5A2EA9D831C1FDD97982E2E9964531AC054CCB955B62944965DCF1D5C27B7D6B587E7E42E66088E1E429917CE772B25
Malicious:	false
Preview:	MAGIC 1000..#45115.................~.......`.}....... .\|........~{........~z.......`~y....... ~x........}w........}v......._}u........}t........\|s........\|r......._\|q........\|p........{o........{n......._{m........{l........zk........zj......._zi........zh........yg........yf.......^ye........yd........xc........xb.......^xa........x`........w_........w^.......^w]........w\........v[........vZ.......^vY........vX........uW........uV.......]uU........uT........tS........tR.......]tQ........tP........sO........sN.......]sM........sL........rK........rJ.......\rI........rH........qG........qF.......\qE........qD........pC........pB.......\pA........p@........o?........o>.......\o=........o<........n;........n:.......\n9........n8........m7........m6.......\m5........m4........l3........l2.......[l1........l0........k/........k........[k-........k,........j+........j*.......Zj)........j(........i'........i&.......Zi%........i$........h#........h".......Zh!........h ........g.........g.....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD_002.WFM (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	5157
Entropy (8bit):	3.015852203614612
Encrypted:	false
SSDEEP:	48:rZaCr6FGuozwN64loAc4DQoWBYyqeIH6YtXdNPiMceLYKD+i:HrFucwJu4OXqeYvdNPdrjD+i
MD5:	C545F70498D75E9146B689D7A3D070B9
SHA1:	44062780B34D8E279A9B6E1B14D7C7EA3E6ED0F0
SHA-256:	2453CC77BD6E0322CAF11C189D1825CA764BD1CE2818FD80F1B0B936EA115CF9
SHA-512:	CCC293CDC2154DF463EBB4CE0F9C7DF1C85B631F771A26B85C3CB35A05737EC85396E753AC3B0388979D6CA641920D55904F4460B372998342CCBB6C304459D8
Malicious:	false
Preview:	MAGIC 1000..#45115...?....... ......?.......(......?....... ......?.......,0.....?.......8`.....?......."......?.......(......?..............?.......4.....?.......:.....?....... ......?.......#......?.......&......?.......)$.....?.......,0.....?......./<.....?.......2H.....?.......5T.....?.......8`.....?.......;l.....?.......>x.....?....... ......?......."......?.......#......?.......%......?.......&......?.......(......?.......)......?.......+......?.......,......?..............?......./......?.......1.....?.......2.....?.......4.....?.......5.....?.......7.....?.......8.....?.......:.....?.......;.....?.......=......?.......>......?....... ......?....... ......?.......!......?......I"......?.......#......?.......#......?.......$......?......I%......?.......&......?.......&......?.......'......?......J(!.....?.......)$.....?.......)'.....?.......**.....?......K+-.....?.......,0.....?.......,3.....?.......-6.....?......L.9.....?......./<.....?......./?.....?.......0B.....?...

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD_003.WFM (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	5157
Entropy (8bit):	3.04468170000289
Encrypted:	false
SSDEEP:	48:Na3CiWNAS5I25bRYqGlONCmiTZj7DGk/JFyLdXFkFZPpKZ9cXD9XqCQRwt+fSvWO:E3ChvrFlWPj/XmdoZPpKEp6XObt
MD5:	AC08EFC98BADFBDA5CB93B7365E96054
SHA1:	6A08B9D98CF1E0B121EC0825D6D8E558073FD60D
SHA-256:	5446C8083349345A4F3E2165D577ED3B4DFDC84841C5FC627CDFFCD57BA9E4DB
SHA-512:	3F705D71E35A2061FF04D1587B4C1044FC49E7281E6C6072247F7AB891FEE1158A6ABDCBE603D8A53728EEB6A309C39F93A8ECFC8E8F81AEDF4789DCC85CABAD
Malicious:	false
Preview:	MAGIC 1000..#45115...?.......A.....?........{.....?.......<.....?.......V......?........0.....?......q.U.....?......:j{.....?.............?......LY......?......E&......?......H......?............?.......s.....?......@.......?..............?......[I......?..............?........%.....?.......</.....?........8.....?........A.....?......f.K.....?......NIT.....?........].....?........f.....?........o.....?........y.....?......S.......?......q.......?.......3......?.............?.......B......?.............?......~E......?..............?......n:......?..............?.......!......?..............?......t.......?......B^......?..............?.............?.......v.....?.............?......S......?......Ih.....?.............?......2......?......./.....?.......h.....?.............?......k......?.............?......C.......?......,8......?.......Q......?.............?.............?......-.......?..............?..............?......c.......?.............?..............?...

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD_004.WFM (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	5157
Entropy (8bit):	3.04468170000289
Encrypted:	false
SSDEEP:	48:Na3CiWNAS5I25bRYqGlONCmiTZj7DGk/JFyLdXFkFZPpKZ9cXD9XqCQRwt+fSvWO:E3ChvrFlWPj/XmdoZPpKEp6XObt
MD5:	AC08EFC98BADFBDA5CB93B7365E96054
SHA1:	6A08B9D98CF1E0B121EC0825D6D8E558073FD60D
SHA-256:	5446C8083349345A4F3E2165D577ED3B4DFDC84841C5FC627CDFFCD57BA9E4DB
SHA-512:	3F705D71E35A2061FF04D1587B4C1044FC49E7281E6C6072247F7AB891FEE1158A6ABDCBE603D8A53728EEB6A309C39F93A8ECFC8E8F81AEDF4789DCC85CABAD
Malicious:	false
Preview:	MAGIC 1000..#45115...?.......A.....?........{.....?.......<.....?.......V......?........0.....?......q.U.....?......:j{.....?.............?......LY......?......E&......?......H......?............?.......s.....?......@.......?..............?......[I......?..............?........%.....?.......</.....?........8.....?........A.....?......f.K.....?......NIT.....?........].....?........f.....?........o.....?........y.....?......S.......?......q.......?.......3......?.............?.......B......?.............?......~E......?..............?......n:......?..............?.......!......?..............?......t.......?......B^......?..............?.............?.......v.....?.............?......S......?......Ih.....?.............?......2......?......./.....?.......h.....?.............?......k......?.............?......C.......?......,8......?.......Q......?.............?.............?......-.......?..............?..............?......c.......?.............?..............?...

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD_005.WFM (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	5157
Entropy (8bit):	4.433661745438711
Encrypted:	false
SSDEEP:	96:j2N1DvE+mWWjpAaD0Jp96v0mb4bo+BQzOb8gREgcaxqQCsy:ijDv8V4JG3oPQ4REBKqQCP
MD5:	F23301918A230D01FDF1DE6E9CC96AF4
SHA1:	AEC74E395764D77801F4E6CBC343604D6C97633D
SHA-256:	5185BEC4A3E7EFB9C73B6027EB4C905A9665B400717887CB8C64CB9BF3B3E44B
SHA-512:	107D64AE07E1C3C276876BC10E6D9C0A2E4AD891367A23C752390E883A25AD5E200665BBA0A16C086BBB842150CB43DA363CDD4C63C7805E8031F461D3915F78
Malicious:	false
Preview:	MAGIC 1000..#45115.......~?........}?......@.\|?........{?........z?........y?......@.x?........w?........v?........u?......@.t?........s?........r?........q?......@.p?........o?........n?......~.m?......>.l?........k?........j?......~.i?......>.h?........g?........f?......~.e?......>.d?........c?........b?......~.a?......>.`?........_?........^?......~.]?......>.\?........[?........Z?......~.Y?......>.X?........W?........V?......~.U?......>.T?........S?........R?......~.Q?......>.P?........O?........N?......\|.M?......<.L?........K?........J?......\|.I?......<.H?........G?........F?......\|.E?......<.D?........C?........B?......\|.A?......<.@?........??........>?......\|.=?......<.<?........;?........:?......\|.9?......<.8?........7?........6?......\|.5?......<.4?........3?........2?......\|.1?......<.0?......../?.........?......z.-?......:.,?........+?........*?......z.)?......:.(?........'?........&?......z.%?......:.$?........#?........"?......z.!?......:. ?.........?.........?......z..?...

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD_006.WFM (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	5157
Entropy (8bit):	3.05943574978778
Encrypted:	false
SSDEEP:	96:TalglMKA/StW/ly5fcIbilhJldWCu+iArnF3DjR3:TuglRtW/lmbGhB7u5Anr3
MD5:	5C37B6542CEC0E9C2164BC918A0ABDDC
SHA1:	186DC0B30E2BAA3E4E45039527D6E9F774564789
SHA-256:	D833B88B90CD8BB59B92F0AB8F97FAC158DD91353152EB71C1FF12A21BBD3D82
SHA-512:	E6FA5E50B7ABB449E15CCEC05F20800646D179D5FF88E592429AA35303E60B754CCA0E0EA50731F8EB5378E77A4B8165E67B5E13033F0435342ABE40D540F43D
Malicious:	false
Preview:	MAGIC 1000..#45115...?..............?......`.~.....?........}.....?.......>}.....?......?~\|.....?.......{.....?........z.....?.......=z.....?.......\|y.....?......^.x.....?........w.....?.......;w.....?......>{v.....?.......u.....?......}.t.....?.......:t.....?.......ys.....?......].r.....?........q.....?.......8q.....?......<xp.....?.......o.....?......\|.n.....?.......7n.....?.......vm.....?......[.l.....?........k.....?.......5k.....?......;uj.....?.......i.....?......z.h.....?.......4h.....?.......sg.....?......Z.f.....?........e.....?.......2e.....?......9rd.....?.......c.....?......y.b.....?.......1b.....?.......pa.....?......X.`.....?........_.....?......./_.....?......8o^.....?.......].....?......w.\.....?........\.....?.......m[.....?......W.Z.....?........Y.....?.......,Y.....?......6lX.....?.......W.....?......v.V.....?.......+V.....?.......jU.....?......U.T.....?........S.....?.......)S.....?......5iR.....?.......Q.....?......t.P.....?.......(P.....?.......gO.....?...

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD_007.WFM (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	5157
Entropy (8bit):	3.0280036523495037
Encrypted:	false
SSDEEP:	48:Z8+Xh9hoWqXkmyAvF6NZNNTSERash0l6DQOb8UDwvs/MBAezJFSPteffaroUV5ZE:5hENIZNNBanAedguLa5Fk5
MD5:	37B23504AFB53E951D328D701F133221
SHA1:	FBD52D34087E10F168678498F30EE6312526F472
SHA-256:	42901DD3CD26BF98295852AAA2FB59AAB117F05EB5FE4F4F876441BF194835B2
SHA-512:	092047793169955CD5F6E797BAC40ADFF6381F054D47A02793A5CB5A84471050C55E5CD6B745C79D6729F1C5AA1B1C52F8083826DE693AB2CD5CFB0E23A8E0D9
Malicious:	false
Preview:	MAGIC 1000..#45115...?......\|m~.....?........\|.....?........y.....?.......Zw.....?......@.t.....?......).r.....?......\Ip.....?........m.....?.......k.....?......8;i.....?........f.....?........d.....?.......1b.....?......0._.....?........].....?.......-[.....?........X.....?......V.V.....?.......0T.....?........Q.....?......;.O.....?.......<M.....?........J.....?........H.....?.......RF.....?........D.....?.......A.....?.......s?.....?......H,=.....?......,.:.....?........8.....?.......^6.....?........4.....?......A.1.....?......&./.....?.......b-.....?......8(+.....?........(.....?........&.....?.......$.....?.......P".....?....... .....?......8.......?..............?..............?.......q......?.......K......?......2(......?..............?..............?..............?..............?......J.......?..............?......^s......?.......c......?......0W......?......x.......?......2.......?..............?............?.............?......:......?......t......?............?...

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD_008.WFM (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	5157
Entropy (8bit):	3.0280036523495037
Encrypted:	false
SSDEEP:	48:Z8+Xh9hoWqXkmyAvF6NZNNTSERash0l6DQOb8UDwvs/MBAezJFSPteffaroUV5ZE:5hENIZNNBanAedguLa5Fk5
MD5:	37B23504AFB53E951D328D701F133221
SHA1:	FBD52D34087E10F168678498F30EE6312526F472
SHA-256:	42901DD3CD26BF98295852AAA2FB59AAB117F05EB5FE4F4F876441BF194835B2
SHA-512:	092047793169955CD5F6E797BAC40ADFF6381F054D47A02793A5CB5A84471050C55E5CD6B745C79D6729F1C5AA1B1C52F8083826DE693AB2CD5CFB0E23A8E0D9
Malicious:	false
Preview:	MAGIC 1000..#45115...?......\|m~.....?........\|.....?........y.....?.......Zw.....?......@.t.....?......).r.....?......\Ip.....?........m.....?.......k.....?......8;i.....?........f.....?........d.....?.......1b.....?......0._.....?........].....?.......-[.....?........X.....?......V.V.....?.......0T.....?........Q.....?......;.O.....?.......<M.....?........J.....?........H.....?.......RF.....?........D.....?.......A.....?.......s?.....?......H,=.....?......,.:.....?........8.....?.......^6.....?........4.....?......A.1.....?......&./.....?.......b-.....?......8(+.....?........(.....?........&.....?.......$.....?.......P".....?....... .....?......8.......?..............?..............?.......q......?.......K......?......2(......?..............?..............?..............?..............?......J.......?..............?......^s......?.......c......?......0W......?......x.......?......2.......?..............?............?.............?......:......?......t......?............?...

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD_46d4.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	5157
Entropy (8bit):	4.433661745438711
Encrypted:	false
SSDEEP:	96:egT6Jr9BwNAG18xnY7zqPbYoaqMXaNtlaGqdGtfYNy00DHS:zT6JpiN3SY60q7NijVy0Yy
MD5:	BB580B2A437C0944DE4C2E1804FF9DEB
SHA1:	B6C09D426E53A8C31C2562A5CEE5D5D61B96AD0E
SHA-256:	92B553CCEEB030080FBB5C78B35CD255986F4D1BEAB6462B343F3D5844343131
SHA-512:	DA28D52E0148E40BFAFC5501B8299683B5A2EA9D831C1FDD97982E2E9964531AC054CCB955B62944965DCF1D5C27B7D6B587E7E42E66088E1E429917CE772B25
Malicious:	false
Preview:	MAGIC 1000..#45115.................~.......`.}....... .\|........~{........~z.......`~y....... ~x........}w........}v......._}u........}t........\|s........\|r......._\|q........\|p........{o........{n......._{m........{l........zk........zj......._zi........zh........yg........yf.......^ye........yd........xc........xb.......^xa........x`........w_........w^.......^w]........w\........v[........vZ.......^vY........vX........uW........uV.......]uU........uT........tS........tR.......]tQ........tP........sO........sN.......]sM........sL........rK........rJ.......\rI........rH........qG........qF.......\qE........qD........pC........pB.......\pA........p@........o?........o>.......\o=........o<........n;........n:.......\n9........n8........m7........m6.......\m5........m4........l3........l2.......[l1........l0........k/........k........[k-........k,........j+........j*.......Zj)........j(........i'........i&.......Zi%........i$........h#........h".......Zh!........h ........g.........g.....

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD_46e3.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	5157
Entropy (8bit):	3.015852203614612
Encrypted:	false
SSDEEP:	48:rZaCr6FGuozwN64loAc4DQoWBYyqeIH6YtXdNPiMceLYKD+i:HrFucwJu4OXqeYvdNPdrjD+i
MD5:	C545F70498D75E9146B689D7A3D070B9
SHA1:	44062780B34D8E279A9B6E1B14D7C7EA3E6ED0F0
SHA-256:	2453CC77BD6E0322CAF11C189D1825CA764BD1CE2818FD80F1B0B936EA115CF9
SHA-512:	CCC293CDC2154DF463EBB4CE0F9C7DF1C85B631F771A26B85C3CB35A05737EC85396E753AC3B0388979D6CA641920D55904F4460B372998342CCBB6C304459D8
Malicious:	false
Preview:	MAGIC 1000..#45115...?....... ......?.......(......?....... ......?.......,0.....?.......8`.....?......."......?.......(......?..............?.......4.....?.......:.....?....... ......?.......#......?.......&......?.......)$.....?.......,0.....?......./<.....?.......2H.....?.......5T.....?.......8`.....?.......;l.....?.......>x.....?....... ......?......."......?.......#......?.......%......?.......&......?.......(......?.......)......?.......+......?.......,......?..............?......./......?.......1.....?.......2.....?.......4.....?.......5.....?.......7.....?.......8.....?.......:.....?.......;.....?.......=......?.......>......?....... ......?....... ......?.......!......?......I"......?.......#......?.......#......?.......$......?......I%......?.......&......?.......&......?.......'......?......J(!.....?.......)$.....?.......)'.....?.......**.....?......K+-.....?.......,0.....?.......,3.....?.......-6.....?......L.9.....?......./<.....?......./?.....?.......0B.....?...

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD_46f3.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	5157
Entropy (8bit):	3.04468170000289
Encrypted:	false
SSDEEP:	48:Na3CiWNAS5I25bRYqGlONCmiTZj7DGk/JFyLdXFkFZPpKZ9cXD9XqCQRwt+fSvWO:E3ChvrFlWPj/XmdoZPpKEp6XObt
MD5:	AC08EFC98BADFBDA5CB93B7365E96054
SHA1:	6A08B9D98CF1E0B121EC0825D6D8E558073FD60D
SHA-256:	5446C8083349345A4F3E2165D577ED3B4DFDC84841C5FC627CDFFCD57BA9E4DB
SHA-512:	3F705D71E35A2061FF04D1587B4C1044FC49E7281E6C6072247F7AB891FEE1158A6ABDCBE603D8A53728EEB6A309C39F93A8ECFC8E8F81AEDF4789DCC85CABAD
Malicious:	false
Preview:	MAGIC 1000..#45115...?.......A.....?........{.....?.......<.....?.......V......?........0.....?......q.U.....?......:j{.....?.............?......LY......?......E&......?......H......?............?.......s.....?......@.......?..............?......[I......?..............?........%.....?.......</.....?........8.....?........A.....?......f.K.....?......NIT.....?........].....?........f.....?........o.....?........y.....?......S.......?......q.......?.......3......?.............?.......B......?.............?......~E......?..............?......n:......?..............?.......!......?..............?......t.......?......B^......?..............?.............?.......v.....?.............?......S......?......Ih.....?.............?......2......?......./.....?.......h.....?.............?......k......?.............?......C.......?......,8......?.......Q......?.............?.............?......-.......?..............?..............?......c.......?.............?..............?...

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD_4703.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	5157
Entropy (8bit):	4.433661745438711
Encrypted:	false
SSDEEP:	96:j2N1DvE+mWWjpAaD0Jp96v0mb4bo+BQzOb8gREgcaxqQCsy:ijDv8V4JG3oPQ4REBKqQCP
MD5:	F23301918A230D01FDF1DE6E9CC96AF4
SHA1:	AEC74E395764D77801F4E6CBC343604D6C97633D
SHA-256:	5185BEC4A3E7EFB9C73B6027EB4C905A9665B400717887CB8C64CB9BF3B3E44B
SHA-512:	107D64AE07E1C3C276876BC10E6D9C0A2E4AD891367A23C752390E883A25AD5E200665BBA0A16C086BBB842150CB43DA363CDD4C63C7805E8031F461D3915F78
Malicious:	false
Preview:	MAGIC 1000..#45115.......~?........}?......@.\|?........{?........z?........y?......@.x?........w?........v?........u?......@.t?........s?........r?........q?......@.p?........o?........n?......~.m?......>.l?........k?........j?......~.i?......>.h?........g?........f?......~.e?......>.d?........c?........b?......~.a?......>.`?........_?........^?......~.]?......>.\?........[?........Z?......~.Y?......>.X?........W?........V?......~.U?......>.T?........S?........R?......~.Q?......>.P?........O?........N?......\|.M?......<.L?........K?........J?......\|.I?......<.H?........G?........F?......\|.E?......<.D?........C?........B?......\|.A?......<.@?........??........>?......\|.=?......<.<?........;?........:?......\|.9?......<.8?........7?........6?......\|.5?......<.4?........3?........2?......\|.1?......<.0?......../?.........?......z.-?......:.,?........+?........*?......z.)?......:.(?........'?........&?......z.%?......:.$?........#?........"?......z.!?......:. ?.........?.........?......z..?...

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD_4712.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	5157
Entropy (8bit):	3.05943574978778
Encrypted:	false
SSDEEP:	96:TalglMKA/StW/ly5fcIbilhJldWCu+iArnF3DjR3:TuglRtW/lmbGhB7u5Anr3
MD5:	5C37B6542CEC0E9C2164BC918A0ABDDC
SHA1:	186DC0B30E2BAA3E4E45039527D6E9F774564789
SHA-256:	D833B88B90CD8BB59B92F0AB8F97FAC158DD91353152EB71C1FF12A21BBD3D82
SHA-512:	E6FA5E50B7ABB449E15CCEC05F20800646D179D5FF88E592429AA35303E60B754CCA0E0EA50731F8EB5378E77A4B8165E67B5E13033F0435342ABE40D540F43D
Malicious:	false
Preview:	MAGIC 1000..#45115...?..............?......`.~.....?........}.....?.......>}.....?......?~\|.....?.......{.....?........z.....?.......=z.....?.......\|y.....?......^.x.....?........w.....?.......;w.....?......>{v.....?.......u.....?......}.t.....?.......:t.....?.......ys.....?......].r.....?........q.....?.......8q.....?......<xp.....?.......o.....?......\|.n.....?.......7n.....?.......vm.....?......[.l.....?........k.....?.......5k.....?......;uj.....?.......i.....?......z.h.....?.......4h.....?.......sg.....?......Z.f.....?........e.....?.......2e.....?......9rd.....?.......c.....?......y.b.....?.......1b.....?.......pa.....?......X.`.....?........_.....?......./_.....?......8o^.....?.......].....?......w.\.....?........\.....?.......m[.....?......W.Z.....?........Y.....?.......,Y.....?......6lX.....?.......W.....?......v.V.....?.......+V.....?.......jU.....?......U.T.....?........S.....?.......)S.....?......5iR.....?.......Q.....?......t.P.....?.......(P.....?.......gO.....?...

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CCD\CCD_4722.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	5157
Entropy (8bit):	3.0280036523495037
Encrypted:	false
SSDEEP:	48:Z8+Xh9hoWqXkmyAvF6NZNNTSERash0l6DQOb8UDwvs/MBAezJFSPteffaroUV5ZE:5hENIZNNBanAedguLa5Fk5
MD5:	37B23504AFB53E951D328D701F133221
SHA1:	FBD52D34087E10F168678498F30EE6312526F472
SHA-256:	42901DD3CD26BF98295852AAA2FB59AAB117F05EB5FE4F4F876441BF194835B2
SHA-512:	092047793169955CD5F6E797BAC40ADFF6381F054D47A02793A5CB5A84471050C55E5CD6B745C79D6729F1C5AA1B1C52F8083826DE693AB2CD5CFB0E23A8E0D9
Malicious:	false
Preview:	MAGIC 1000..#45115...?......\|m~.....?........\|.....?........y.....?.......Zw.....?......@.t.....?......).r.....?......\Ip.....?........m.....?.......k.....?......8;i.....?........f.....?........d.....?.......1b.....?......0._.....?........].....?.......-[.....?........X.....?......V.V.....?.......0T.....?........Q.....?......;.O.....?.......<M.....?........J.....?........H.....?.......RF.....?........D.....?.......A.....?.......s?.....?......H,=.....?......,.:.....?........8.....?.......^6.....?........4.....?......A.1.....?......&./.....?.......b-.....?......8(+.....?........(.....?........&.....?.......$.....?.......P".....?....... .....?......8.......?..............?..............?.......q......?.......K......?......2(......?..............?..............?..............?..............?......J.......?..............?......^s......?.......c......?......0W......?......x.......?......2.......?..............?............?.............?......:......?......t......?............?...

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CD ROM\CDRO4732.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	250044
Entropy (8bit):	5.374978832096472
Encrypted:	false
SSDEEP:	768:t4my8vfFbN7HB/f0xL2XXglKX2L324v+kntKfgLVS5R/eQ2UdJB2SX02sXumCB/o:b34jHx00lRzca1Sw
MD5:	B41182B484E688CBBCA8A2CAACDC06A6
SHA1:	9FF6E65AA7AF76FD0B74B945B9B78FDA114C50A2
SHA-256:	603CB9FFBA10C502494DE3CD9404352A99C56E4825F471B409B5A02472C612F0
SHA-512:	B7BF97801E69C0EEE213207CD3F16B0BD6159065B2B2E4613C998D7CD31D25270E1A708E9B78C18297DD79D151139A37F3A1E1CF58109475ECA42FD2B9E88B5A
Malicious:	false
Preview:	MAGIC 1000..#6250000...<.B..<...x..>...._./...o...o.......0....0...................................8....H.#..H.#..(....(....8....8....H.#..8....8....8....(.........8....H.#..H.#..8....8....8....(...................(....(....8....H.#..8....8....(.........(....8....(....(....(....(..................................................P.....o....O....O.._./.._./..>.......;.B..<.B..<.!..=..p=..A.=.1A.=.QA.=..A.=..A.=..!.>.8!.>.X!,>.h!4>..!D>..!L>..!T>..!d>..!l>..!t>....>....>.$..>....>.$..>.$..>.4..>.D..>.<..>.<..>.D..>.D..>.L..>.L..>.T..>.T..>.\..>.T..>.\..>.d..>.\..>.\..>.\..>.L..>.L..>.L..>.T..>.\..>.\..>.T..>.\..>.T..>.L..>.L..>.T..>.T..>.d..>.\..>.T..>.T..>.L..>.L..>.\..>.T..>.<..>.4..>.<..>.<..>.<..>.,..>....>....>....>....>....>..!t>..!d>..!d>..!d>..!\>..!D>.X!,>.(!.>..!.>..!.>..A.=..A.=.QA.=..A.=..p=.a.0=.!..=....<...x..\|.>..>....>........_./........o...o....O....O...o..0....0..........o...o....O....O.._./......>....\|.>....B<.B..<....<.!..=.a.0=..p=.QA.=..A.=..A.=.

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\CD ROM\CDROM.WFM (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	250044
Entropy (8bit):	5.374978832096472
Encrypted:	false
SSDEEP:	768:t4my8vfFbN7HB/f0xL2XXglKX2L324v+kntKfgLVS5R/eQ2UdJB2SX02sXumCB/o:b34jHx00lRzca1Sw
MD5:	B41182B484E688CBBCA8A2CAACDC06A6
SHA1:	9FF6E65AA7AF76FD0B74B945B9B78FDA114C50A2
SHA-256:	603CB9FFBA10C502494DE3CD9404352A99C56E4825F471B409B5A02472C612F0
SHA-512:	B7BF97801E69C0EEE213207CD3F16B0BD6159065B2B2E4613C998D7CD31D25270E1A708E9B78C18297DD79D151139A37F3A1E1CF58109475ECA42FD2B9E88B5A
Malicious:	false
Preview:	MAGIC 1000..#6250000...<.B..<...x..>...._./...o...o.......0....0...................................8....H.#..H.#..(....(....8....8....H.#..8....8....8....(.........8....H.#..H.#..8....8....8....(...................(....(....8....H.#..8....8....(.........(....8....(....(....(....(..................................................P.....o....O....O.._./.._./..>.......;.B..<.B..<.!..=..p=..A.=.1A.=.QA.=..A.=..A.=..!.>.8!.>.X!,>.h!4>..!D>..!L>..!T>..!d>..!l>..!t>....>....>.$..>....>.$..>.$..>.4..>.D..>.<..>.<..>.D..>.D..>.L..>.L..>.T..>.T..>.\..>.T..>.\..>.d..>.\..>.\..>.\..>.L..>.L..>.L..>.T..>.\..>.\..>.T..>.\..>.T..>.L..>.L..>.T..>.T..>.d..>.\..>.T..>.T..>.L..>.L..>.\..>.T..>.<..>.4..>.<..>.<..>.<..>.,..>....>....>....>....>....>..!t>..!d>..!d>..!d>..!\>..!D>.X!,>.(!.>..!.>..!.>..A.=..A.=.QA.=..A.=..p=.a.0=.!..=....<...x..\|.>..>....>........_./........o...o....O....O...o..0....0..........o...o....O....O.._./......>....\|.>....B<.B..<....<.!..=.a.0=..p=.QA.=..A.=..A.=.

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Edge GSM\edge4760.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2363245
Entropy (8bit):	6.734092682549553
Encrypted:	false
SSDEEP:	49152:IcCrMW3XVkmU8uUuThhGMhA089SyCCjlUH8jNVXB+ZUWlUP/kL9BtlN/731:IvrPXVkmUrZVEMhM9SyCCjlZrXwUnkLz
MD5:	595344B3A798D47B42B85C1B647160D4
SHA1:	9B18A14F2CD20E1035293C1583AC2D795FF63F62
SHA-256:	C42CB0CB557165FE2BFA25A5B74D013669846295E04EDAC1D92781570610B484
SHA-512:	3E886AF27DFCB6DC80001528431C6ACE418CD1F178FBB5F75EF26B1368AE316DB23CFE1A5CEAC6BE010D3C7FF27CB1C2DA745B47DECCCA774C89521280D62C6E
Malicious:	false
Preview:	MAGIC 1000..#72363200.G;:.d..:..G.9.D#-7..f...X.2..>.s...\....^...%.H.......a_8..V.:..Wz:...:..{.:.&..:...f:..d.9.^.>......I.;....^..g.\..>K;...................8.g.49..{X9.7SN9..19...49.(.J9.Jzv9.f..9..@.9.;..9...9...K9.=..7.'.J...]...M....R..=._....J........x...(.J9.8..9.Mo.:... :.O6.:....9....8......).J...:c...Z........c..9....9.o.9....9....9.Wk........HJ...pX....+...z... ..7....9..[M9..._9...49..e.8.i.^...K...Vc....'....c..O.v8....9....9....8......Z..........''..b+6..."......T_.....9..3-:...W:...X:..K6:....9..n9.!.+..Z.1......%.}..J./....x...}'8...8....8.L.P...F1.......nl...i._..z.X....9....9."".:..=':....:.`..9.b..9...\|... ....q..W....:.z..cV=......._......+.8...,9..2L9.Q.h9....9.X..9.z..9..a#:.y.@:.seL:..$;:..i.9...\|..K<....F..7@\|...6.....\..7........xT.9...B:.d'.:....:..:.&9L:.e..9.....g(...A2....R....U..."A..4........e2............E..8..O;9.#y.9.lc.9....:.fv :.#..:..Z.9.]..9.s/#8..2i......\q#...w6....,...J...]....3.....H.9.Z..:..C;:.jx5:....:....9

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Edge GSM\edge47fd.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	4726445
Entropy (8bit):	6.734035575668014
Encrypted:	false
SSDEEP:	98304:g+YGyl8m8c8VZsr6W5zDPR+zXjnxA93XyNKfi:HyGc8zsr6wB+zTnxAZyj
MD5:	34AD40B313E49F9E9963D43C803ABA12
SHA1:	6F8B7767F5CC14C9330B9D3F7F1F243DB3A696CD
SHA-256:	6F3FD934EA4E88D776530BAA2EB84655757936D5E5351C030C95DF3989111B8A
SHA-512:	F2254DAA9929D36184D51F0B4D3209E724C7B3194895656DA2E67255F59A16B7B74A39194B745121B7E23D9F9707666EEABEC0A9816C892C3A5A66FCF5399A07
Malicious:	false
Preview:	MAGIC 1000..#74726400.G;:....:."..9....7............T..@.k..c._....-......1 7.L8.9..\@:...~:....:..^.:...E:....9..a-......._.d..=..........;...d.]..h...j[.8..?.:...:..).:....:.!..:..l:....9......,Y.....h......+..N`.....<... ...y.6.Xk.9..(!:...I:...Q:.\K;:.\..:..q.9..;s8..H0................7...9......}.......&Ud....8..E.9..4$9.l.19.Z.A9.(.J9...O9.T.L9...<9....9...8...Q7.q...(.J..9w...........h....b.....K....S..).J9....9..{.:...+:..B-:.=o.:....9....8.(.J...K...V.B....i...p..n.R.......`.>..(.J9..Y.:..5<:...P:.._B:.Ko.:.YZ.9.\.v8.(.J...=..R..........Q...C..._...jv.8.).J9.M.9..9.9..tT9...8....S.....#D..(.J...........E..8...i9...9...9.O&.9..Y)9.j..7.....P.P..M\|...{.....(a........n....G.8.Ve.9.pGF9...G9.t..9..\|.8.L.#...D...W(....H....;...:....W/...r8... 9...j9....9.V.w9...09..8......K..\|..y.\|..d.@.......@k..1.S8...8..qs8.mR.4.~......)...vd..+.n....;..........8.'..9.\|..9..#.:..{.:.,..9..=.9....8...`.........=...._...._...^:.....KD.....9...3:.(.i:.9[x:

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Edge GSM\edge4916.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	147744
Entropy (8bit):	6.3112913177786565
Encrypted:	false
SSDEEP:	1536:bOdyFbqwevQWPT7RDgdwf/kAvEr9PbNEozHEYtNuFdwnAXDTYOruuQ6aazL9u:qdWqb/gHg2aoz+FdLHY6sJW9u
MD5:	F8C8283A7AD0CBB27734000D779D5C52
SHA1:	AAD6AC2847EB45F6E91644413CA9B9F30DCF7311
SHA-256:	17067621294F6B6AE2339CE56AFDF5B579D9532F597FAB72FEDC83785B2FA4CA
SHA-512:	0F204DDA497F190B8911B1206F91B8255571C955050BAC13B00A579CC1B0FADA40FF789D57CADEE4ECC8E346B2DB66587BEA8634FA0E540199DCB4C0E851BC6B
Malicious:	false
Preview:	MAGIC 1000..#6147700.G;:....:.9p19..3......9...K.....9...Q........G;:....9...:..G;:..3...s.A....K..9p19...Q...3...L....G;:..3....a...s.A..L.....:....9....9..G;:.9p19...Q....Q...3...9p19.s.A...G.:.9p19...:.9p19...K....Q....:..3....3.....j:..3.....K..L.....Q..s.A...3.....Q...G;:...:...Q..9p19...K...G;:...K..s.A....Q....Q....:..G.:..G;:.L.....Q....Q..s.A..L...L...L.....Q.....:..G;:..3.....K..Z{q....K.....9...:.L...s.A..9p19....9...K...3....G;:..3......9.L....3...Z{q.....:...K..s.A....K..{...9p19...j:..3....G;:.Z{q...3...9p19.......3......9..3.....:..G;:..G;:.s.A....K....K..9p19...Q..L.....j:....9...j:.........9...Q..s.A....:..G;:.L.....K...3......9...j:....9..a.....:....:...Q....K....:..G.:..a.....Q....Q..9p19..G.:...:.9p19...Q....:..G;:.Z{q...3...{...9p19.9p19.s.A..9p19.Z{q..9p19.Z{q...3......:.s.A...G;:...Q..L...9p19...j:.L......9...Q....:.L...Z{q....:...Q.....9....9.9p19...:..G;:.s.A...3....a...9p19.9p19...K.....9....9..G;:...K....j:....9...K....:...K..

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Edge GSM\edge4926.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2363245
Entropy (8bit):	6.730212234194968
Encrypted:	false
SSDEEP:	49152:lfaFy3vCev0+ndNKFWBt9xrr0YE4RkOAFSgampZ:wMz0+njKF+xrrdEgUamZ
MD5:	2C56302341352CFC4F86D4B22B369405
SHA1:	E8B84BCF2DDE571213B24BF4148830337EE293F6
SHA-256:	1A54CC22E66B8BB053E505F5FA2B446FCA8861D49212D07DBEDEFB05E6176107
SHA-512:	E27E757EEBAB7C51FDE2DC45FDE365CE6A587674F8E92941BBADBC93ECC9145F71EC2997CB245220A6BF89C033F2C06BD055ED845098A89B05F3C3BA647B5920
Malicious:	false
Preview:	MAGIC 1000..#72363200.G;:.l6D:..%M:...V:.e._:...g:...p:._.y:..^.:...:.-M.:...:..;.:.)..:.~.:...:.&..:.<,.:..=.:..N.:.B`.:.2.p:..._:..(M:.>K;:..m):....:.J..:...9.O..9..6.9...x9..19....9.)k.8.BH.8.2.Q....r.............K...C{..Es....E...........L.....F........BV...R... ...Y..........c....(........C...h)7..E.8.J..9..;=9...x9.<.9.o.9..+.9..N.9.@q.9..'a9.:m=9....9....8..z.8...:8..,7......r.......~"...!.'...K....(...P....,....ns..D.....)7..P98....8....8.%..9..>=9.k.`9..Z.9.X7.9....9...9.S .9.r7.9..N.9..e.9...x9..'a9..VI9.Z.19....9....9.)..8..z.8.C.i8.;g.8..,7.L.P..B.........,>c...Y...\.........D...""...t.#....5....G..h.Y...tk...R}.......W..........e....G..o%..=_....2........2L...3......8....9.G..9....9..1.9..^.:..$;:.JZ5:..e/:.iq):..\|#:....:....:....:.7..:...:....9...9...9....9.'..9.F..9.e..9...9....9.~..9....9._..9...9.@..9....9.!..9....9..y.9.rm.9...:...:.b..:....:...:....:.C..:.{..:....:..\|.:.$w :.\q#:..k&:..e):..`,:.=Z/:.uT2:..N5:..H8:..C;:...&:.3..:.S..9

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Edge GSM\edge4a10.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	4726445
Entropy (8bit):	6.730381218428854
Encrypted:	false
SSDEEP:	98304:iP1XeXrO9w5h1yCJfdhLSs0p3WbrgoPdJ76tWCy85LXZ0bX13fsCPClYN:iP1XeX2A1yCl10pGooVJ7EWCxOhf7iQ
MD5:	A8D37CC38E8F2C4110F7B55E60EE9825
SHA1:	A59236912AED5AD93498EFE4C6472A9C76D1B886
SHA-256:	169176A834F21293883E84770E6E5B5433E2824DB8F6C2003EA930840222CBA1
SHA-512:	D35159A72994004976DB011F997DE05D9EEF2D13224A6066B21A0053C23AF646AFD66A766B05ABD57ADDB5C5D86CBA1F0AB0F6630777D502B1988E3502AA81AB
Malicious:	false
Preview:	MAGIC 1000..#74726400.G;:...?:.k6D:...H:..%M:.g.Q:...V:...Z:.c._:..yc:...g:._hl:...p:..Wu:.[.y:..E~:..^.:.+..:...:....:.)M.:...:.}.:.'..:..;.:.{w.:.%..:...:.y*.:.#f.:...:.w.:.!..:....:.F,.:..:..=.:.J.:..N.:...:.N`.:...y:.L.p:...g:..._:.T.V:..(M:..:D:.\K;:..\2:..n):.c. :....:....:.k..:....9.7..9....9....9.F..9..6.9..Y.9...x9..>U9.l.19.E..9....9....8..l.8...i8..J.8.@.,7...Q........r..z.........)...}....>.3....K...pc..~B{........r....[....D....-.......`...@... ........pQ....E...P:.............uV................. ..q=...YZ...Aw...(..........c....E....(..`I..._....y...;.C......Y)7..o!8..C.8.E..8.S..9..t.9..:=9...[9...x9..F.9..).9....9...9....9.3,.9..=.9..N.9.;`.9..q.9...s9..(a9.5KO9..m=9...+9.E..9....9.J..8..6.8..\|.8.i..8...:8..0.7.@.,7.........<+...r.......:........!........].'....9....K....9..\.(.../....Q.......7.....s....qs....+......\...T.)7....7..M98.ka.8....8....8.L..8....9.F..9..`+9..==9.7.O9...`9...r9..Y.9.<H.9..6.9..%.9.4..9....9...9....9.. .9.3,.9

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Edge GSM\edge4d8b.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	147744
Entropy (8bit):	6.3143930682292115
Encrypted:	false
SSDEEP:	1536:y6bKCjx2T/a/EnfwN4D1jYC4yLRLRFdwvnK/7KM+xapkmZuvj39oIYA03mRSWgwV:tOCjxOfU4pY+bFGEsap9Oj9oZ3OgwV
MD5:	B58DE594F86A498D8C950865F506190E
SHA1:	2082C944A01A90D147F2784576D28AD5121D3376
SHA-256:	2A5F375A61BA71E31FD8C3FDF399729AB9B3F3921AD97BACAA104BBACAB081BE
SHA-512:	DA27C05462ADDCABA3C9F9C8A9084FBB01910777D3650F7D185158581257EA64CA7028E9DF1BCE2FC53609474CF331D6E7406516B4DA585B0B139BE2B7483A7E
Malicious:	false
Preview:	MAGIC 1000..#6147700..9.S)#:.?2....Y....8...9.......9...8.S)#:....:.]....]....?2..?2..?2..+\...]......8.?2..?2...Q..+\...+\...]....+\...:.R:....9...8.S)#:.?2........8...9...9...9...9.?2..S)#:.?2....Y...Q...Q..]....?2.....:...9.]......8...8...8.....?2....8...9....:...Y...8.:.+\.........8..8.:...Y....9.+\.....8.:.R:....9....9.+\......:...Y..].....8.:.]......8.+\....8.:.......9.:.R:...8....:....9.S)#:...8.]....]....:.R:.?2........9....9......Q..+\...?2..?2..]......Y....8...9.]....:.R:.w.:.?2..]....w.:..Q....Y....8...8.QR.:.:.R:.+\...j..:.+\....8.:....9.S)#:.].....8.:.+\...:.R:..Q.....9.+\......9....:.].......9...Y....9...9...8.S)#:...Y....Y...Q..S)#:.QR.:.:.R:.:.R:....:...9.......8...8.].....Q..?2....9..Q..:.R:.+\...S)#:.......8....9.]....]....S)#:..Q..?2....9...9...9.S)#:.]....S)#:.]......8...9...8...8.+\....8.:.]......8...8...8.?2..:.R:...8......8.:....9.+\...S)#:...Y..]......8...8.]......9....9.

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Edge GSM\edge4daa.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2363245
Entropy (8bit):	6.731822669451422
Encrypted:	false
SSDEEP:	49152:yQbPO3gFxoSwAYXJtq2BHHirzdL3OxWJCL1A4v:TbPO3gFGSwAuJt7pHiHJ3OxbAc
MD5:	369DA59226FF78AA0E8E82505637962E
SHA1:	DFC3EE7F547D9FE8160F004E5F6D2D9CB278382C
SHA-256:	5323A42EA86705305548FB5599FECFC8249AC02E6892F79CCCCD73A21D7FC79D
SHA-512:	E09884565D6DB0631C6067F6B1B98E14373739A4C7CE9396547A293F1F3FAE00E6617952A0EB1D962B24AEDD31A97A1B66C1C425B542BFC5083B98FE09704A6E
Malicious:	false
Preview:	MAGIC 1000..#72363200..9..9...9..}.9..f.9.pO.9.P8.9.1!.9....9....9....9.[b.:..V.:.;K.:..?.:..4.:..(#:..A.:..Y.:.y..9....9..<.9.4k.9.r..9...9..._9.YH09...9....8.9w.8.W[d...w..y...@0.....L..Hw\|..f....(..........mT.........{....d....M*...66..\|.B..].N..>.Y....K...5<..fR-..Mo...4......................l9...r.X...Z...S.........Y.7....8.V..8....8..U.8...9..\|.9..e.9.pN$9.Q709.2 <9...H9...S9..._9...k9...w9...9.,..9. ^<9....8....7.O.v..z.....xd..d..w....I..O\|....S!..b+6....K..u._....t........t...._..o#K...K6..\t!..........}...j,.....d.........x..-..7....8...;9....9...9.+.w9.J.k9.i._9...T9...H9..2<9..I09..a$9.$x.9.C..9.b..9..{.8.@..8.~.8....8....8..F.9.;.<9.._9.@..9....9..u.9.4S.9..0.9....9.)..9.z..9..R.:..A.:.70.:...#:...,:.1.4:...=:...F:.+.O:..X:.}.a:.&.j:..s:.wq\|:....:.d'.:....:....:.a..:....:..1.:.>H.:...j:...R:.6.;:.tI#:..w.:..K.9.\..9....9...09.E..8.R.\...$..tYL..>...]....]....]....]....]....]....]....]....]....]....]....]....]....]....]....]....7)....4...V@..

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Edge GSM\edge4e75.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	4726445
Entropy (8bit):	6.73131511607227
Encrypted:	false
SSDEEP:	98304:r68Tm8U/6h4QF5UP0zelWvIFJ9uXqwDTCVKgXxA/2E:rzTm8tvSMSAvEJGqwKwyxA/7
MD5:	506BFBF1647C22944558FB960A021116
SHA1:	27E51D7AE2C3B69D15EB5A50EED1CFA2300BCDA0
SHA-256:	48CD443524D6891B51069588DDB73B2387B53EF0E38313E468884E4AC68488FB
SHA-512:	BB7C7BC2623E8487B8A451E043E139176EBBDF02B740CB80D9C343086ABEE68DC2BE8C80233EE52B3DDC1B186FC8F0978A6EB6847C8052C7B5CCD4B7235E1629
Malicious:	false
Preview:	MAGIC 1000..#74726400..9.{..9..9.[..9...9.;..9..}.9..r.9..f.9..Z.9.kO.9..C.9.L8.9..,.9.,!.9....9....9.\|..9....9.\..9....9..h.:.Vb.:..\.:..V.:..P.:.6K.:.nE.:..?.:..9.:..4.:.N. :..(#:.}6.:..B.:..M.:.,Y.:..d.:....9....9....9..%.9..=.9.8T.9.Xk.9.x..9....9....9...9..w9./._9.o.H9..H09..v.9./..9...8.]..8...d8..x.8....7.&Ud..J\...K.w..&u........^..../.....5..T.L....d...v\|..J$............................k...Kk..+T.............f.....{...Fp....d...&Y$...M...B0..v66...<..V.B....H..6.N....S....Y..W.R....K..?.C...5<..'.4...R-....%...o........j.........R.....o..t...\...D...,.............9.....v..f.X..6!;...[....)...J.............F.....P.7.0AL8....8...8..8...8....8..l.8.kU.8.K>.8....9....9.v\|.9..p.9.Ve.9..Y.9.6N$9..B9..709..+69...<9.f.B9...H9.F.M9...S9.&.Y9..._9...e9.v.k9..q9.V.w9..}9...9...9....9...f9.._<9...9....8..K}8....7..Z.....v.............:...vd.......h.......y....q...H........{........US!....+...*6....@..e.K..)nU...._...Ej..u.t..:.........>.....t..Jgj.

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Edge GSM\edge_gsm_16if.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2363245
Entropy (8bit):	6.734092682549553
Encrypted:	false
SSDEEP:	49152:IcCrMW3XVkmU8uUuThhGMhA089SyCCjlUH8jNVXB+ZUWlUP/kL9BtlN/731:IvrPXVkmUrZVEMhM9SyCCjlZrXwUnkLz
MD5:	595344B3A798D47B42B85C1B647160D4
SHA1:	9B18A14F2CD20E1035293C1583AC2D795FF63F62
SHA-256:	C42CB0CB557165FE2BFA25A5B74D013669846295E04EDAC1D92781570610B484
SHA-512:	3E886AF27DFCB6DC80001528431C6ACE418CD1F178FBB5F75EF26B1368AE316DB23CFE1A5CEAC6BE010D3C7FF27CB1C2DA745B47DECCCA774C89521280D62C6E
Malicious:	false
Preview:	MAGIC 1000..#72363200.G;:.d..:..G.9.D#-7..f...X.2..>.s...\....^...%.H.......a_8..V.:..Wz:...:..{.:.&..:...f:..d.9.^.>......I.;....^..g.\..>K;...................8.g.49..{X9.7SN9..19...49.(.J9.Jzv9.f..9..@.9.;..9...9...K9.=..7.'.J...]...M....R..=._....J........x...(.J9.8..9.Mo.:... :.O6.:....9....8......).J...:c...Z........c..9....9.o.9....9....9.Wk........HJ...pX....+...z... ..7....9..[M9..._9...49..e.8.i.^...K...Vc....'....c..O.v8....9....9....8......Z..........''..b+6..."......T_.....9..3-:...W:...X:..K6:....9..n9.!.+..Z.1......%.}..J./....x...}'8...8....8.L.P...F1.......nl...i._..z.X....9....9."".:..=':....:.`..9.b..9...\|... ....q..W....:.z..cV=......._......+.8...,9..2L9.Q.h9....9.X..9.z..9..a#:.y.@:.seL:..$;:..i.9...\|..K<....F..7@\|...6.....\..7........xT.9...B:.d'.:....:..:.&9L:.e..9.....g(...A2....R....U..."A..4........e2............E..8..O;9.#y.9.lc.9....:.fv :.#..:..Z.9.]..9.s/#8..2i......\q#...w6....,...J...]....3.....H.9.Z..:..C;:.jx5:....:....9

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Edge GSM\edge_gsm_32if.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	4726445
Entropy (8bit):	6.734035575668014
Encrypted:	false
SSDEEP:	98304:g+YGyl8m8c8VZsr6W5zDPR+zXjnxA93XyNKfi:HyGc8zsr6wB+zTnxAZyj
MD5:	34AD40B313E49F9E9963D43C803ABA12
SHA1:	6F8B7767F5CC14C9330B9D3F7F1F243DB3A696CD
SHA-256:	6F3FD934EA4E88D776530BAA2EB84655757936D5E5351C030C95DF3989111B8A
SHA-512:	F2254DAA9929D36184D51F0B4D3209E724C7B3194895656DA2E67255F59A16B7B74A39194B745121B7E23D9F9707666EEABEC0A9816C892C3A5A66FCF5399A07
Malicious:	false
Preview:	MAGIC 1000..#74726400.G;:....:."..9....7............T..@.k..c._....-......1 7.L8.9..\@:...~:....:..^.:...E:....9..a-......._.d..=..........;...d.]..h...j[.8..?.:...:..).:....:.!..:..l:....9......,Y.....h......+..N`.....<... ...y.6.Xk.9..(!:...I:...Q:.\K;:.\..:..q.9..;s8..H0................7...9......}.......&Ud....8..E.9..4$9.l.19.Z.A9.(.J9...O9.T.L9...<9....9...8...Q7.q...(.J..9w...........h....b.....K....S..).J9....9..{.:...+:..B-:.=o.:....9....8.(.J...K...V.B....i...p..n.R.......`.>..(.J9..Y.:..5<:...P:.._B:.Ko.:.YZ.9.\.v8.(.J...=..R..........Q...C..._...jv.8.).J9.M.9..9.9..tT9...8....S.....#D..(.J...........E..8...i9...9...9.O&.9..Y)9.j..7.....P.P..M\|...{.....(a........n....G.8.Ve.9.pGF9...G9.t..9..\|.8.L.#...D...W(....H....;...:....W/...r8... 9...j9....9.V.w9...09..8......K..\|..y.\|..d.@.......@k..1.S8...8..qs8.mR.4.~......)...vd..+.n....;..........8.'..9.\|..9..#.:..{.:.,..9..=.9....8...`.........=...._...._...^:.....KD.....9...3:.(.i:.9[x:

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Edge GSM\edge_gsm_i.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	147744
Entropy (8bit):	6.3112913177786565
Encrypted:	false
SSDEEP:	1536:bOdyFbqwevQWPT7RDgdwf/kAvEr9PbNEozHEYtNuFdwnAXDTYOruuQ6aazL9u:qdWqb/gHg2aoz+FdLHY6sJW9u
MD5:	F8C8283A7AD0CBB27734000D779D5C52
SHA1:	AAD6AC2847EB45F6E91644413CA9B9F30DCF7311
SHA-256:	17067621294F6B6AE2339CE56AFDF5B579D9532F597FAB72FEDC83785B2FA4CA
SHA-512:	0F204DDA497F190B8911B1206F91B8255571C955050BAC13B00A579CC1B0FADA40FF789D57CADEE4ECC8E346B2DB66587BEA8634FA0E540199DCB4C0E851BC6B
Malicious:	false
Preview:	MAGIC 1000..#6147700.G;:....:.9p19..3......9...K.....9...Q........G;:....9...:..G;:..3...s.A....K..9p19...Q...3...L....G;:..3....a...s.A..L.....:....9....9..G;:.9p19...Q....Q...3...9p19.s.A...G.:.9p19...:.9p19...K....Q....:..3....3.....j:..3.....K..L.....Q..s.A...3.....Q...G;:...:...Q..9p19...K...G;:...K..s.A....Q....Q....:..G.:..G;:.L.....Q....Q..s.A..L...L...L.....Q.....:..G;:..3.....K..Z{q....K.....9...:.L...s.A..9p19....9...K...3....G;:..3......9.L....3...Z{q.....:...K..s.A....K..{...9p19...j:..3....G;:.Z{q...3...9p19.......3......9..3.....:..G;:..G;:.s.A....K....K..9p19...Q..L.....j:....9...j:.........9...Q..s.A....:..G;:.L.....K...3......9...j:....9..a.....:....:...Q....K....:..G.:..a.....Q....Q..9p19..G.:...:.9p19...Q....:..G;:.Z{q...3...{...9p19.9p19.s.A..9p19.Z{q..9p19.Z{q...3......:.s.A...G;:...Q..L...9p19...j:.L......9...Q....:.L...Z{q....:...Q.....9....9.9p19...:..G;:.s.A...3....a...9p19.9p19...K.....9....9..G;:...K....j:....9...K....:...K..

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Edge GSM\edge_gsm_i2.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2363245
Entropy (8bit):	6.730212234194968
Encrypted:	false
SSDEEP:	49152:lfaFy3vCev0+ndNKFWBt9xrr0YE4RkOAFSgampZ:wMz0+njKF+xrrdEgUamZ
MD5:	2C56302341352CFC4F86D4B22B369405
SHA1:	E8B84BCF2DDE571213B24BF4148830337EE293F6
SHA-256:	1A54CC22E66B8BB053E505F5FA2B446FCA8861D49212D07DBEDEFB05E6176107
SHA-512:	E27E757EEBAB7C51FDE2DC45FDE365CE6A587674F8E92941BBADBC93ECC9145F71EC2997CB245220A6BF89C033F2C06BD055ED845098A89B05F3C3BA647B5920
Malicious:	false
Preview:	MAGIC 1000..#72363200.G;:.l6D:..%M:...V:.e._:...g:...p:._.y:..^.:...:.-M.:...:..;.:.)..:.~.:...:.&..:.<,.:..=.:..N.:.B`.:.2.p:..._:..(M:.>K;:..m):....:.J..:...9.O..9..6.9...x9..19....9.)k.8.BH.8.2.Q....r.............K...C{..Es....E...........L.....F........BV...R... ...Y..........c....(........C...h)7..E.8.J..9..;=9...x9.<.9.o.9..+.9..N.9.@q.9..'a9.:m=9....9....8..z.8...:8..,7......r.......~"...!.'...K....(...P....,....ns..D.....)7..P98....8....8.%..9..>=9.k.`9..Z.9.X7.9....9...9.S .9.r7.9..N.9..e.9...x9..'a9..VI9.Z.19....9....9.)..8..z.8.C.i8.;g.8..,7.L.P..B.........,>c...Y...\.........D...""...t.#....5....G..h.Y...tk...R}.......W..........e....G..o%..=_....2........2L...3......8....9.G..9....9..1.9..^.:..$;:.JZ5:..e/:.iq):..\|#:....:....:....:.7..:...:....9...9...9....9.'..9.F..9.e..9...9....9.~..9....9._..9...9.@..9....9.!..9....9..y.9.rm.9...:...:.b..:....:...:....:.C..:.{..:....:..\|.:.$w :.\q#:..k&:..e):..`,:.=Z/:.uT2:..N5:..H8:..C;:...&:.3..:.S..9

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Edge GSM\edge_gsm_i4.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	4726445
Entropy (8bit):	6.730381218428854
Encrypted:	false
SSDEEP:	98304:iP1XeXrO9w5h1yCJfdhLSs0p3WbrgoPdJ76tWCy85LXZ0bX13fsCPClYN:iP1XeX2A1yCl10pGooVJ7EWCxOhf7iQ
MD5:	A8D37CC38E8F2C4110F7B55E60EE9825
SHA1:	A59236912AED5AD93498EFE4C6472A9C76D1B886
SHA-256:	169176A834F21293883E84770E6E5B5433E2824DB8F6C2003EA930840222CBA1
SHA-512:	D35159A72994004976DB011F997DE05D9EEF2D13224A6066B21A0053C23AF646AFD66A766B05ABD57ADDB5C5D86CBA1F0AB0F6630777D502B1988E3502AA81AB
Malicious:	false
Preview:	MAGIC 1000..#74726400.G;:...?:.k6D:...H:..%M:.g.Q:...V:...Z:.c._:..yc:...g:._hl:...p:..Wu:.[.y:..E~:..^.:.+..:...:....:.)M.:...:.}.:.'..:..;.:.{w.:.%..:...:.y*.:.#f.:...:.w.:.!..:....:.F,.:..:..=.:.J.:..N.:...:.N`.:...y:.L.p:...g:..._:.T.V:..(M:..:D:.\K;:..\2:..n):.c. :....:....:.k..:....9.7..9....9....9.F..9..6.9..Y.9...x9..>U9.l.19.E..9....9....8..l.8...i8..J.8.@.,7...Q........r..z.........)...}....>.3....K...pc..~B{........r....[....D....-.......`...@... ........pQ....E...P:.............uV................. ..q=...YZ...Aw...(..........c....E....(..`I..._....y...;.C......Y)7..o!8..C.8.E..8.S..9..t.9..:=9...[9...x9..F.9..).9....9...9....9.3,.9..=.9..N.9.;`.9..q.9...s9..(a9.5KO9..m=9...+9.E..9....9.J..8..6.8..\|.8.i..8...:8..0.7.@.,7.........<+...r.......:........!........].'....9....K....9..\.(.../....Q.......7.....s....qs....+......\...T.)7....7..M98.ka.8....8....8.L..8....9.F..9..`+9..==9.7.O9...`9...r9..Y.9.<H.9..6.9..%.9.4..9....9...9....9.. .9.3,.9

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Edge GSM\edge_gsm_q.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	147744
Entropy (8bit):	6.3143930682292115
Encrypted:	false
SSDEEP:	1536:y6bKCjx2T/a/EnfwN4D1jYC4yLRLRFdwvnK/7KM+xapkmZuvj39oIYA03mRSWgwV:tOCjxOfU4pY+bFGEsap9Oj9oZ3OgwV
MD5:	B58DE594F86A498D8C950865F506190E
SHA1:	2082C944A01A90D147F2784576D28AD5121D3376
SHA-256:	2A5F375A61BA71E31FD8C3FDF399729AB9B3F3921AD97BACAA104BBACAB081BE
SHA-512:	DA27C05462ADDCABA3C9F9C8A9084FBB01910777D3650F7D185158581257EA64CA7028E9DF1BCE2FC53609474CF331D6E7406516B4DA585B0B139BE2B7483A7E
Malicious:	false
Preview:	MAGIC 1000..#6147700..9.S)#:.?2....Y....8...9.......9...8.S)#:....:.]....]....?2..?2..?2..+\...]......8.?2..?2...Q..+\...+\...]....+\...:.R:....9...8.S)#:.?2........8...9...9...9...9.?2..S)#:.?2....Y...Q...Q..]....?2.....:...9.]......8...8...8.....?2....8...9....:...Y...8.:.+\.........8..8.:...Y....9.+\.....8.:.R:....9....9.+\......:...Y..].....8.:.]......8.+\....8.:.......9.:.R:...8....:....9.S)#:...8.]....]....:.R:.?2........9....9......Q..+\...?2..?2..]......Y....8...9.]....:.R:.w.:.?2..]....w.:..Q....Y....8...8.QR.:.:.R:.+\...j..:.+\....8.:....9.S)#:.].....8.:.+\...:.R:..Q.....9.+\......9....:.].......9...Y....9...9...8.S)#:...Y....Y...Q..S)#:.QR.:.:.R:.:.R:....:...9.......8...8.].....Q..?2....9..Q..:.R:.+\...S)#:.......8....9.]....]....S)#:..Q..?2....9...9...9.S)#:.]....S)#:.]......8...9...8...8.+\....8.:.]......8...8...8.?2..:.R:...8......8.:....9.+\...S)#:...Y..]......8...8.]......9....9.

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Edge GSM\edge_gsm_q2.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	2363245
Entropy (8bit):	6.731822669451422
Encrypted:	false
SSDEEP:	49152:yQbPO3gFxoSwAYXJtq2BHHirzdL3OxWJCL1A4v:TbPO3gFGSwAuJt7pHiHJ3OxbAc
MD5:	369DA59226FF78AA0E8E82505637962E
SHA1:	DFC3EE7F547D9FE8160F004E5F6D2D9CB278382C
SHA-256:	5323A42EA86705305548FB5599FECFC8249AC02E6892F79CCCCD73A21D7FC79D
SHA-512:	E09884565D6DB0631C6067F6B1B98E14373739A4C7CE9396547A293F1F3FAE00E6617952A0EB1D962B24AEDD31A97A1B66C1C425B542BFC5083B98FE09704A6E
Malicious:	false
Preview:	MAGIC 1000..#72363200..9..9...9..}.9..f.9.pO.9.P8.9.1!.9....9....9....9.[b.:..V.:.;K.:..?.:..4.:..(#:..A.:..Y.:.y..9....9..<.9.4k.9.r..9...9..._9.YH09...9....8.9w.8.W[d...w..y...@0.....L..Hw\|..f....(..........mT.........{....d....M*...66..\|.B..].N..>.Y....K...5<..fR-..Mo...4......................l9...r.X...Z...S.........Y.7....8.V..8....8..U.8...9..\|.9..e.9.pN$9.Q709.2 <9...H9...S9..._9...k9...w9...9.,..9. ^<9....8....7.O.v..z.....xd..d..w....I..O\|....S!..b+6....K..u._....t........t...._..o#K...K6..\t!..........}...j,.....d.........x..-..7....8...;9....9...9.+.w9.J.k9.i._9...T9...H9..2<9..I09..a$9.$x.9.C..9.b..9..{.8.@..8.~.8....8....8..F.9.;.<9.._9.@..9....9..u.9.4S.9..0.9....9.)..9.z..9..R.:..A.:.70.:...#:...,:.1.4:...=:...F:.+.O:..X:.}.a:.&.j:..s:.wq\|:....:.d'.:....:....:.a..:....:..1.:.>H.:...j:...R:.6.;:.tI#:..w.:..K.9.\..9....9...09.E..8.R.\...$..tYL..>...]....]....]....]....]....]....]....]....]....]....]....]....]....]....]....]....7)....4...V@..

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Edge GSM\edge_gsm_q4.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	4726445
Entropy (8bit):	6.73131511607227
Encrypted:	false
SSDEEP:	98304:r68Tm8U/6h4QF5UP0zelWvIFJ9uXqwDTCVKgXxA/2E:rzTm8tvSMSAvEJGqwKwyxA/7
MD5:	506BFBF1647C22944558FB960A021116
SHA1:	27E51D7AE2C3B69D15EB5A50EED1CFA2300BCDA0
SHA-256:	48CD443524D6891B51069588DDB73B2387B53EF0E38313E468884E4AC68488FB
SHA-512:	BB7C7BC2623E8487B8A451E043E139176EBBDF02B740CB80D9C343086ABEE68DC2BE8C80233EE52B3DDC1B186FC8F0978A6EB6847C8052C7B5CCD4B7235E1629
Malicious:	false
Preview:	MAGIC 1000..#74726400..9.{..9..9.[..9...9.;..9..}.9..r.9..f.9..Z.9.kO.9..C.9.L8.9..,.9.,!.9....9....9.\|..9....9.\..9....9..h.:.Vb.:..\.:..V.:..P.:.6K.:.nE.:..?.:..9.:..4.:.N. :..(#:.}6.:..B.:..M.:.,Y.:..d.:....9....9....9..%.9..=.9.8T.9.Xk.9.x..9....9....9...9..w9./._9.o.H9..H09..v.9./..9...8.]..8...d8..x.8....7.&Ud..J\...K.w..&u........^..../.....5..T.L....d...v\|..J$............................k...Kk..+T.............f.....{...Fp....d...&Y$...M...B0..v66...<..V.B....H..6.N....S....Y..W.R....K..?.C...5<..'.4...R-....%...o........j.........R.....o..t...\...D...,.............9.....v..f.X..6!;...[....)...J.............F.....P.7.0AL8....8...8..8...8....8..l.8.kU.8.K>.8....9....9.v\|.9..p.9.Ve.9..Y.9.6N$9..B9..709..+69...<9.f.B9...H9.F.M9...S9.&.Y9..._9...e9.v.k9..q9.V.w9..}9...9...9....9...f9.._<9...9....8..K}8....7..Z.....v.............:...vd.......h.......y....q...H........{........US!....+...*6....@..e.K..)nU...._...Ej..u.t..:.........>.....t..Jgj.

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Misc\FM.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	375044
Entropy (8bit):	5.544636915042466
Encrypted:	false
SSDEEP:	1536:GvuvY14lVvBmdv2xvsYhK3v1YDaWvgFDvXMvX3Q52yvovK3vfvjPOIjv0jJr5+Gg:yciN1gRNyNAdNLeUhXuVZ3pQfH3q9TL
MD5:	2222518F269F93472F3B7D5C26E1B3B9
SHA1:	39DE445E75C80E1033CBF180CF49744B2482AA49
SHA-256:	46B361D5DCABF89DBD027CB6401ABF12E2CEF18DE82AB8DCC1E9C01CFB8B06BE
SHA-512:	2AD747E5ADF365A412090F686D8F31A3A94C695C890FB98C491C151ADD7C9B59F1A72BA9A325B352553DAF330C2F7372A89F95159AA972931ECAEE40351D067A
Malicious:	false
Preview:	MAGIC 1000..#6375000w]W..9.c..9.c..z.g..>.s....o..>.s....o..>.s....k..>.s....k..z.g..9.c...}_...<O...,K....>..-.2.......y...%I... .........,........(...7.c..+."..)....#....1.C=.7..=...2>."..>..i.>...>.4M.>....>..(.?..i.?.."?...?...:?..,K?..<O?.w]W?..m[?.z.g?...k?...o?...w?.>.s?.>.s?...w?.>.s?.>.s?.>.s?.>.s?...k?.z.g?.9.c?.w]W?..<O?..,K?.m.6?...?.."?.fY.?..(.?....>..m.>...>..i.>.:.s>...2>.7..=. ..=......1...+."..:.s...i........4M......c....%I...."........:..1.C...,K..w]W...m[..9.c..z.g....o....k..>.s....o..>.s....o....k....k..z.g...}_...}_..w]W...,K..1.C....:..-.2..j.&..fY...c.........7......%I...:.s..+."....... ....#..<.)..=."I.>.7.c>..(.>...>..m.>.7..>.c..?..8.?.."?...?.m.6?.1.C?..,K?.4MS?..}_?.9.c?...k?...k?...o?...o?.>.s?.>.s?...w?...o?.>.s?.>.s?...o?...k?.9.c?..m[?..<O?..,K?...>?...:?...?.."?..8.?. ..?....>.4M.>...>.%I.>.4MS>."I.>.1..=.#..<.!....7...4MS.."....(.....,...m........(....i...j.&........:..r.G...<O...m[...}_...}_....k..>.s....o....o..>.s....w..

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Misc\FM4f7f.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	375044
Entropy (8bit):	5.544636915042466
Encrypted:	false
SSDEEP:	1536:GvuvY14lVvBmdv2xvsYhK3v1YDaWvgFDvXMvX3Q52yvovK3vfvjPOIjv0jJr5+Gg:yciN1gRNyNAdNLeUhXuVZ3pQfH3q9TL
MD5:	2222518F269F93472F3B7D5C26E1B3B9
SHA1:	39DE445E75C80E1033CBF180CF49744B2482AA49
SHA-256:	46B361D5DCABF89DBD027CB6401ABF12E2CEF18DE82AB8DCC1E9C01CFB8B06BE
SHA-512:	2AD747E5ADF365A412090F686D8F31A3A94C695C890FB98C491C151ADD7C9B59F1A72BA9A325B352553DAF330C2F7372A89F95159AA972931ECAEE40351D067A
Malicious:	false
Preview:	MAGIC 1000..#6375000w]W..9.c..9.c..z.g..>.s....o..>.s....o..>.s....k..>.s....k..z.g..9.c...}_...<O...,K....>..-.2.......y...%I... .........,........(...7.c..+."..)....#....1.C=.7..=...2>."..>..i.>...>.4M.>....>..(.?..i.?.."?...?...:?..,K?..<O?.w]W?..m[?.z.g?...k?...o?...w?.>.s?.>.s?...w?.>.s?.>.s?.>.s?.>.s?...k?.z.g?.9.c?.w]W?..<O?..,K?.m.6?...?.."?.fY.?..(.?....>..m.>...>..i.>.:.s>...2>.7..=. ..=......1...+."..:.s...i........4M......c....%I...."........:..1.C...,K..w]W...m[..9.c..z.g....o....k..>.s....o..>.s....o....k....k..z.g...}_...}_..w]W...,K..1.C....:..-.2..j.&..fY...c.........7......%I...:.s..+."....... ....#..<.)..=."I.>.7.c>..(.>...>..m.>.7..>.c..?..8.?.."?...?.m.6?.1.C?..,K?.4MS?..}_?.9.c?...k?...k?...o?...o?.>.s?.>.s?...w?...o?.>.s?.>.s?...o?...k?.9.c?..m[?..<O?..,K?...>?...:?...?.."?..8.?. ..?....>.4M.>...>.%I.>.4MS>."I.>.1..=.#..<.!....7...4MS.."....(.....,...m........(....i...j.&........:..r.G...<O...m[...}_...}_....k..>.s....o....o..>.s....w..

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Misc\PRBS4fcd.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	10263
Entropy (8bit):	0.9780016951624251
Encrypted:	false
SSDEEP:	24:hr444444144D4e9DD44E49t4g44V494t4D4U44r444gAD4DDgQ4D444r449Ug4rh:haaam
MD5:	91F0064113F8F59597425670AF90869D
SHA1:	B701044A530CFAEE7FA9CB8FF6D2200C6DEA20A0
SHA-256:	5432A31E92FCFB0AA203739F79453AA59DF67E545D9455B3F7934517E15137F0
SHA-512:	7C6E71521599E55E17E005AF4AC1FBDB6503726FCB7D4044118EFD81E38A2D6C550737FED30D46DA64C8E8A296DC0BAE073E76394810CECA347917839E03451E
Malicious:	false
Preview:	MAGIC 1000..#510220...?....?....?....?....?....?....?....?....?........................?....?....?....?.........?....?....?........................?.........?....?..............?....?.........?....?.........?....?....?....?.........?........................?....?....?..............?....?........................?..............?...................?.........?.........?....?....?.........?.........?....?....?....?..............?..............?.........?....?....?..............?....?....?..................................?....?....?.........?....?....?.........?..............?....?....?....?.........?.........?..............?.........?..................................?.........?.........?.........?.........?....?....?....?....?.........?.........?....?.........?.............................?....?.........?....?....?.........?....?.........?....?.........?.........?....?.............................?.........?....?....?.........?....?....?....?....?...................?....?....?....?.......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Misc\PRBS9.WFM (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	10263
Entropy (8bit):	0.9780016951624251
Encrypted:	false
SSDEEP:	24:hr444444144D4e9DD44E49t4g44V494t4D4U44r444gAD4DDgQ4D444r449Ug4rh:haaam
MD5:	91F0064113F8F59597425670AF90869D
SHA1:	B701044A530CFAEE7FA9CB8FF6D2200C6DEA20A0
SHA-256:	5432A31E92FCFB0AA203739F79453AA59DF67E545D9455B3F7934517E15137F0
SHA-512:	7C6E71521599E55E17E005AF4AC1FBDB6503726FCB7D4044118EFD81E38A2D6C550737FED30D46DA64C8E8A296DC0BAE073E76394810CECA347917839E03451E
Malicious:	false
Preview:	MAGIC 1000..#510220...?....?....?....?....?....?....?....?....?........................?....?....?....?.........?....?....?........................?.........?....?..............?....?.........?....?.........?....?....?....?.........?........................?....?....?..............?....?........................?..............?...................?.........?.........?....?....?.........?.........?....?....?....?..............?..............?.........?....?....?..............?....?....?..................................?....?....?.........?....?....?.........?..............?....?....?....?.........?.........?..............?.........?..................................?.........?.........?.........?.........?....?....?....?....?.........?.........?....?.........?.............................?....?.........?....?....?.........?....?.........?....?.........?.........?....?.............................?.........?....?....?.........?....?....?....?....?...................?....?....?....?.......

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Misc\PWM.WFM (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	160044
Entropy (8bit):	1.7207414370044587
Encrypted:	false
SSDEEP:	24:y1WNNNNNNNNNNNNNNNNNNNNNNNN4z4z4z4z4z4z4z4z4z4z4z4z4z4z4z4z4z4zR:y4v
MD5:	E22ABE5022F935B3BBE977B75A221F89
SHA1:	9FECCE887D2450BE45206A433C58758F76F83EA1
SHA-256:	B8AA2E7F1B8F67E6497B2D6BB0E8D25FEF652C95C8B81401A726DD4FB091FEF8
SHA-512:	31655CA947534696E87BCFD84ED62DD34A1EEEA03FE4EEC9AF981D311292B8E7555B1EA9450E285CCB7019A1C3A5680C6076322475235AF22F239FDC7DAE03F2
Malicious:	false
Preview:	MAGIC 1000..#6160000...?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....................................................................................?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....................................................................................?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....................................................................................?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....................................................................................?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....................................................................................?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....?...............................................................................?....?....?....?.

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Misc\PWM4fec.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	160044
Entropy (8bit):	1.7207414370044587
Encrypted:	false
SSDEEP:	24:y1WNNNNNNNNNNNNNNNNNNNNNNNN4z4z4z4z4z4z4z4z4z4z4z4z4z4z4z4z4z4zR:y4v
MD5:	E22ABE5022F935B3BBE977B75A221F89
SHA1:	9FECCE887D2450BE45206A433C58758F76F83EA1
SHA-256:	B8AA2E7F1B8F67E6497B2D6BB0E8D25FEF652C95C8B81401A726DD4FB091FEF8
SHA-512:	31655CA947534696E87BCFD84ED62DD34A1EEEA03FE4EEC9AF981D311292B8E7555B1EA9450E285CCB7019A1C3A5680C6076322475235AF22F239FDC7DAE03F2
Malicious:	false
Preview:	MAGIC 1000..#6160000...?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....................................................................................?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....................................................................................?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....................................................................................?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....................................................................................?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....................................................................................?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....?....?...............................................................................?....?....?....?.

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Misc\k28_501b.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	5042
Entropy (8bit):	2.771122244913468
Encrypted:	false
SSDEEP:	24:c47t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7w:m
MD5:	25A1AB37C167A73A441AADB6ABC51BD7
SHA1:	7E257C7EAADD0E457BEE02D3AD4FA07A61F6F541
SHA-256:	97ED857ECE366B2ECAA3645758B3BA813A6AFF8B9468A13BF7AE03E991B9F1E3
SHA-512:	BB41FA1C4BCC576C0B33CEDDA1E706876B9411DF67260C16DF1B86DE8F019CDF4798C9C85474C82B607FD20E6369FA8EA6F6A9787FBA1AFB316E6214E7E8EEBF
Malicious:	false
Preview:	MAGIC 1000..#45000..@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@...................

C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms\Misc\k28_5emp.wfm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	5042
Entropy (8bit):	2.771122244913468
Encrypted:	false
SSDEEP:	24:c47t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7t7w:m
MD5:	25A1AB37C167A73A441AADB6ABC51BD7
SHA1:	7E257C7EAADD0E457BEE02D3AD4FA07A61F6F541
SHA-256:	97ED857ECE366B2ECAA3645758B3BA813A6AFF8B9468A13BF7AE03E991B9F1E3
SHA-512:	BB41FA1C4BCC576C0B33CEDDA1E706876B9411DF67260C16DF1B86DE8F019CDF4798C9C85474C82B607FD20E6369FA8EA6F6A9787FBA1AFB316E6214E7E8EEBF
Malicious:	false
Preview:	MAGIC 1000..#45000..@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@........................@?...@....@?...@.........@?....>....>....>....>...@....@?...@....@?....>...@...................

C:\Program Files (x86)\Tektronix\ArbExpress\System\App.ico (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	MS Windows icon resource - 6 icons, 48x48, 16 colors, 4 bits/pixel, 32x32, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	2.725839820837408
Encrypted:	false
SSDEEP:	48:dm+cPmXxDDDDDDDFDRjDjTDDDDDDDDDB7HPptoHLnz:dmvPmYLnz
MD5:	B5F4B7747CE892F9DFC884691FC40C8D
SHA1:	1116614DBD9AA85D97B9CA0FB02A20E09F263B71
SHA-256:	2FA7AC85D608C3D3A9CA7B7AEAC23819BDBC36610DC9C80259FA20A2BB2CDE72
SHA-512:	651644C8C79F796091B8324566DDCB4567B938102989375A3068B2AE264E1BEB55AE7AE87946D91996BEF9DEDB4603A7782D1182B25B31B043BD7411ED32B2C5
Malicious:	false
Preview:	......00......h...f... ......................(.......00.............. ......................h...."..(...0...`....................................................................................................................................................................................................................................................................................................wwwwwwwwwwwwwwp........wDDDDDDDDDDDDDDw........tB""""""""""""$G........t..............G........t..............G........t..............G........t..............G........t..............G........t..............G........t..............G........t..............G........t..............G........tz......z......G........t..............G........t.z......z.....G........t..............G........t..z......z....G........t..............G........t..............G........t..............G........t..............G........t..............G........t..............G........t..............G........t..............G......

C:\Program Files (x86)\Tektronix\ArbExpress\System\App5153.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	MS Windows icon resource - 6 icons, 48x48, 16 colors, 4 bits/pixel, 32x32, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	2.725839820837408
Encrypted:	false
SSDEEP:	48:dm+cPmXxDDDDDDDFDRjDjTDDDDDDDDDB7HPptoHLnz:dmvPmYLnz
MD5:	B5F4B7747CE892F9DFC884691FC40C8D
SHA1:	1116614DBD9AA85D97B9CA0FB02A20E09F263B71
SHA-256:	2FA7AC85D608C3D3A9CA7B7AEAC23819BDBC36610DC9C80259FA20A2BB2CDE72
SHA-512:	651644C8C79F796091B8324566DDCB4567B938102989375A3068B2AE264E1BEB55AE7AE87946D91996BEF9DEDB4603A7782D1182B25B31B043BD7411ED32B2C5
Malicious:	false
Preview:	......00......h...f... ......................(.......00.............. ......................h...."..(...0...`....................................................................................................................................................................................................................................................................................................wwwwwwwwwwwwwwp........wDDDDDDDDDDDDDDw........tB""""""""""""$G........t..............G........t..............G........t..............G........t..............G........t..............G........t..............G........t..............G........t..............G........t..............G........tz......z......G........t..............G........t.z......z.....G........t..............G........t..z......z....G........t..............G........t..............G........t..............G........t..............G........t..............G........t..............G........t..............G........t..............G......

C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbC1fa5.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	169472
Entropy (8bit):	5.783231724742427
Encrypted:	false
SSDEEP:	3072:bv84RASBNvWMdaoTP0Yt4fscMcGP+MBpXh:x2vMdx0nc
MD5:	F3C12BC2AD56585937D74506C9D62F96
SHA1:	5F5F4CF8F928025B67FDFCB881056ECF20926DB0
SHA-256:	069127301E179C688800EE5B6FFCC1724CB8478F913B99A4A0790B341C23047B
SHA-512:	C5E366371F5031F19CDF854B4B3CC4163282410861EE9AAA9BF7BB2288DCCD240DBDA0271CD9FCC22A8616E19330E2C87B289E39EFBA47898BC7247C16135B44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....d._...........!..0.............Z.... ........... ....................................@.....................................O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................<.......H.......tk...?............................................................s....}M.... ....."...}P....(...... ^...B.r...pQ.r...pQ....r...p.....:.(......}\.....{\..."..}\...V.(......}].....}^.....{]..."..}].....{^..."..}^......0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.....0..(........(..

C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbConnect.dll (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	169472
Entropy (8bit):	5.783231724742427
Encrypted:	false
SSDEEP:	3072:bv84RASBNvWMdaoTP0Yt4fscMcGP+MBpXh:x2vMdx0nc
MD5:	F3C12BC2AD56585937D74506C9D62F96
SHA1:	5F5F4CF8F928025B67FDFCB881056ECF20926DB0
SHA-256:	069127301E179C688800EE5B6FFCC1724CB8478F913B99A4A0790B341C23047B
SHA-512:	C5E366371F5031F19CDF854B4B3CC4163282410861EE9AAA9BF7BB2288DCCD240DBDA0271CD9FCC22A8616E19330E2C87B289E39EFBA47898BC7247C16135B44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....d._...........!..0.............Z.... ........... ....................................@.....................................O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................<.......H.......tk...?............................................................s....}M.... ....."...}P....(...... ^...B.r...pQ.r...pQ....r...p.....:.(......}\.....{\..."..}\...V.(......}].....}^.....{]..."..}].....{^..."..}^......0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.....0..(........(..

C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE240a.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2762752
Entropy (8bit):	6.56038820893923
Encrypted:	false
SSDEEP:	24576:mWz56k1bil6jdidLwgYqD8dSKtwdDLdZ4UBwduBorvAESsTLx08pS9fSu0+BK2:N0k1bJjiwqQjSr65sYLx088V
MD5:	E145BA544D06D6438EC711C3D18F5EBF
SHA1:	BCB89697ECB7962A6A39E70C93731D5C6482DCDA
SHA-256:	888EC69186ED917AF7BE5195ECE83EDF22C5E6813BF5CB3CB1554AF48A6BBD83
SHA-512:	0888C4BDB780B1B67019054338EB58B3907A4D6FFC441E35A17537B8124AEA256B340AAF87EAAEE255EF0EE310FD2F181440BB622C226C5F511D4BD66A6CFDFC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Oe._.........."...0...)..>.......... ... ...... ...............................+...`....................................O.... ..:...................`...................................................... ............... ..H............text...4.).. ....)................. ..`.rsrc....:... ..<....).............@..@.reloc.......`......&.............@..B.......................H........2...............7................................................(!...j.(....&.............(...."..}......{.....0..4.........r...p(".....1.....3...........(.....+.....(......"..(........0..1.........1.....3................(................(....>.........(....F...........(....2......(....j........#.......@[..(....:........(.......0.............().....&r]..p("......................0...............(3.....&r]..p(".....*...................0.............(+...

C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE5163.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	358912
Entropy (8bit):	6.719986198651759
Encrypted:	false
SSDEEP:	6144:wUDVaFYgLBFvkrF3vAu3Ox1eYvK5iqnIhyeK8ZsXhAOJc8:hVaFYgLBFkrF3vAuI1nvK5iqnesh/F
MD5:	0B6D7A6C657284D1EF16B692610BADC5
SHA1:	F8FD8A06C221D158E82C679F6FCF51CA14139C5B
SHA-256:	600108EC4719975CF69ADE459842724027FF6CC52019967A462BB1E7FFEDFA44
SHA-512:	F0F9B19E94BB9C7C23F511D1617CE40D75CBD4E758EB85519C5DC25E16EB0FC33617FE279E2C48E9734BFA0E80300BE02034BDF37C28CEFD9C96126077A0E147
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........L...L...L...)...m...)......)...[.......P.......C.......^...)...O...L...........N.......M..... .M.......M...RichL...................PE..L....d._...........!.....D...........=.......`............................................@.........................PP..d....P..(...............................X'...@..T............................A..@............`..D............................text....C.......D.................. ..`.rdata.......`.......H..............@..@.data...Pi...`.......B..............@....rsrc................P..............@..@.reloc..X'.......(...R..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE51a1.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	404480
Entropy (8bit):	6.6495348583868195
Encrypted:	false
SSDEEP:	12288:NfVjjIFPH1O5SELWHc59pLkdOAnwexmv8ct1:NfZLWHcHpLkJwexI
MD5:	292FAA2899E764BA099B254301BFCFA7
SHA1:	9A019BEE4FA6D0D31D9EABD632D1D28C00946233
SHA-256:	DFB9B827FB67E8827CB8846BFE174830355139962AFC24AC94E7477F94BA1A1C
SHA-512:	E278039BA9894AE4D31CB1256AD5C0B7C5990564E280EE927E66621A2D7C7F135E41D903E607E47B92C2B13EE5E71BCB20250934D4F4793D4667D56A4BF2AE11
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&...br..br..br.....ir......r.....pr..0..~r..0..rr..0..pr.....gr..br..r.....`r......cr......cr.....cr..Richbr..........................PE..L....d._...........!.....N..........F8.......`............................................@.....................................<....P.......................`..t'..@...T...............................@............`...............................text....M.......N.................. ..`.rdata..<....`.......R..............@..@.data....?..........................@....rsrc........P......................@..@.reloc..t'...`...(..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE51e0.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	10408283
Entropy (8bit):	7.998831189389843
Encrypted:	true
SSDEEP:	196608:MC9p/bRCTyL7tTjqoLn2b9bW+OR4+w8vFdRf5p9Vsmj:MsbgTm7tTmE2ZaTJw8BH
MD5:	A0916AD1AFE3032E79D157DA16B34450
SHA1:	C8740B27306CF7EFA79E80B89572CEAC684318B7
SHA-256:	CC9BC94FC33B72C6D10A11C258B8D552EFFA3C905D4D621471BFC1C33F603372
SHA-512:	515B87E14F68592C1324FC938D44EFDB9D0AC3548DEB370CEE8EFCF8F42284AC4F0896CC41F9C654909F56A3FD46A4B314A90D392EF8301835E4825E1F66970C
Malicious:	false
Preview:	ITSF....`..................\|.{.......".....\|.{......."..`...............x.......T@.......@..............[..............ITSP....T...........................................j..].!......."..T...............PMGLK................/..../#IDXHDR....n.../#ITBITS..../#STRINGS....".i./#SYSTEM..^.G./#TOPICS....n.p./#URLSTR......../#URLTBL....^.4./#WINDOWS....Y.L./$FIftiMain....~..p./$OBJINST....?.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property....;../$WWKeywordLinks/..../$WWKeywordLinks/BTree....%..L./$WWKeywordLinks/Data....q.p./$WWKeywordLinks/Map....a:./$WWKeywordLinks/Property..... ./A003_1134.png....U..6./A003_1135.png........./A003_1136.png......4./A003_1137.png....R.3./A003_1138.png........./A003_1139.png.......i./A003_1140.png....m..../A003_1141.png.......3./A003_1142.png...4..`./A003_1143.png......../A003_1144.png.......!./A003_1145.png...9..W./A003_1146.png.......I./A003_1147.png...Y..A./A003_1148.png.......t./A003_1149.png.......f./A003_1150.png....t..Q./A003_1151.png....E

C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbE5347.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	562
Entropy (8bit):	4.928664272192018
Encrypted:	false
SSDEEP:	12:TMG1cOUNTbxVH43UZ/R+4pxy/4p3UelGc4phm/4plpUelFP4pxelzm3xT:3qNBBTvSnxOCsr
MD5:	35D3E7D8FD5302F9EAFAEF982BA494DF
SHA1:	2ED034FE8A8B52BD7E4F58A4CBBC76D249C359ED
SHA-256:	0CD375E62A7B4BF4FC7C07D9FF16878777FB32F8ADED269BDB53F8A7A89C55D7
SHA-512:	6D1F53EF9DEF3BBA4201CC0BC926F335866E46788A0E06775C916EDB843AFC19E5EE671F8A1870BC7B4C9CD74600069AC1FE544EB050E7A326ABDD2C6DAA8A21
Malicious:	false
Preview:	<?xml version="1.0"?>..<configuration>.. <appSettings>.. User application and configured property settings go here.-->.. Example: <add key="settingName" value="settingValue"/> -->.. <add key="toolBarButton_Cursor.Pushed" value="True" />.. <add key="toolBarButton_Cursor.ToolTipText" value="Cursor" />.. <add key="toolBarButton_Marker.Pushed" value="True" />.. <add key="toolBarButton_Marker.ToolTipText" value="Marker" />.. <add key="toolBarButton_PT_Draw.ToolTipText" value="Point Draw" />.. </appSettings>..</configuration>

C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbEqu.dll (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	358912
Entropy (8bit):	6.719986198651759
Encrypted:	false
SSDEEP:	6144:wUDVaFYgLBFvkrF3vAu3Ox1eYvK5iqnIhyeK8ZsXhAOJc8:hVaFYgLBFkrF3vAuI1nvK5iqnesh/F
MD5:	0B6D7A6C657284D1EF16B692610BADC5
SHA1:	F8FD8A06C221D158E82C679F6FCF51CA14139C5B
SHA-256:	600108EC4719975CF69ADE459842724027FF6CC52019967A462BB1E7FFEDFA44
SHA-512:	F0F9B19E94BB9C7C23F511D1617CE40D75CBD4E758EB85519C5DC25E16EB0FC33617FE279E2C48E9734BFA0E80300BE02034BDF37C28CEFD9C96126077A0E147
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........L...L...L...)...m...)......)...[.......P.......C.......^...)...O...L...........N.......M..... .M.......M...RichL...................PE..L....d._...........!.....D...........=.......`............................................@.........................PP..d....P..(...............................X'...@..T............................A..@............`..D............................text....C.......D.................. ..`.rdata.......`.......H..............@..@.data...Pi...`.......B..............@....rsrc................P..............@..@.reloc..X'.......(...R..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbEther.dll (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	404480
Entropy (8bit):	6.6495348583868195
Encrypted:	false
SSDEEP:	12288:NfVjjIFPH1O5SELWHc59pLkdOAnwexmv8ct1:NfZLWHcHpLkJwexI
MD5:	292FAA2899E764BA099B254301BFCFA7
SHA1:	9A019BEE4FA6D0D31D9EABD632D1D28C00946233
SHA-256:	DFB9B827FB67E8827CB8846BFE174830355139962AFC24AC94E7477F94BA1A1C
SHA-512:	E278039BA9894AE4D31CB1256AD5C0B7C5990564E280EE927E66621A2D7C7F135E41D903E607E47B92C2B13EE5E71BCB20250934D4F4793D4667D56A4BF2AE11
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&...br..br..br.....ir......r.....pr..0..~r..0..rr..0..pr.....gr..br..r.....`r......cr......cr.....cr..Richbr..........................PE..L....d._...........!.....N..........F8.......`............................................@.....................................<....P.......................`..t'..@...T...............................@............`...............................text....M.......N.................. ..`.rdata..<....`.......R..............@..@.data....?..........................@....rsrc........P......................@..@.reloc..t'...`...(..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbExpress.chm (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	10408283
Entropy (8bit):	7.998831189389843
Encrypted:	true
SSDEEP:	196608:MC9p/bRCTyL7tTjqoLn2b9bW+OR4+w8vFdRf5p9Vsmj:MsbgTm7tTmE2ZaTJw8BH
MD5:	A0916AD1AFE3032E79D157DA16B34450
SHA1:	C8740B27306CF7EFA79E80B89572CEAC684318B7
SHA-256:	CC9BC94FC33B72C6D10A11C258B8D552EFFA3C905D4D621471BFC1C33F603372
SHA-512:	515B87E14F68592C1324FC938D44EFDB9D0AC3548DEB370CEE8EFCF8F42284AC4F0896CC41F9C654909F56A3FD46A4B314A90D392EF8301835E4825E1F66970C
Malicious:	false
Preview:	ITSF....`..................\|.{.......".....\|.{......."..`...............x.......T@.......@..............[..............ITSP....T...........................................j..].!......."..T...............PMGLK................/..../#IDXHDR....n.../#ITBITS..../#STRINGS....".i./#SYSTEM..^.G./#TOPICS....n.p./#URLSTR......../#URLTBL....^.4./#WINDOWS....Y.L./$FIftiMain....~..p./$OBJINST....?.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property....;../$WWKeywordLinks/..../$WWKeywordLinks/BTree....%..L./$WWKeywordLinks/Data....q.p./$WWKeywordLinks/Map....a:./$WWKeywordLinks/Property..... ./A003_1134.png....U..6./A003_1135.png........./A003_1136.png......4./A003_1137.png....R.3./A003_1138.png........./A003_1139.png.......i./A003_1140.png....m..../A003_1141.png.......3./A003_1142.png...4..`./A003_1143.png......../A003_1144.png.......!./A003_1145.png...9..W./A003_1146.png.......I./A003_1147.png...Y..A./A003_1148.png.......t./A003_1149.png.......f./A003_1150.png....t..Q./A003_1151.png....E

C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbExpress.exe (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2762752
Entropy (8bit):	6.56038820893923
Encrypted:	false
SSDEEP:	24576:mWz56k1bil6jdidLwgYqD8dSKtwdDLdZ4UBwduBorvAESsTLx08pS9fSu0+BK2:N0k1bJjiwqQjSr65sYLx088V
MD5:	E145BA544D06D6438EC711C3D18F5EBF
SHA1:	BCB89697ECB7962A6A39E70C93731D5C6482DCDA
SHA-256:	888EC69186ED917AF7BE5195ECE83EDF22C5E6813BF5CB3CB1554AF48A6BBD83
SHA-512:	0888C4BDB780B1B67019054338EB58B3907A4D6FFC441E35A17537B8124AEA256B340AAF87EAAEE255EF0EE310FD2F181440BB622C226C5F511D4BD66A6CFDFC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Oe._.........."...0...)..>.......... ... ...... ...............................+...`....................................O.... ..:...................`...................................................... ............... ..H............text...4.).. ....)................. ..`.rsrc....:... ..<....).............@..@.reloc.......`......&.............@..B.......................H........2...............7................................................(!...j.(....&.............(...."..}......{.....0..4.........r...p(".....1.....3...........(.....+.....(......"..(........0..1.........1.....3................(................(....>.........(....F...........(....2......(....j........#.......@[..(....:........(.......0.............().....&r]..p("......................0...............(3.....&r]..p(".....*...................0.............(+...

C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbExpress.exe.config (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	562
Entropy (8bit):	4.928664272192018
Encrypted:	false
SSDEEP:	12:TMG1cOUNTbxVH43UZ/R+4pxy/4p3UelGc4phm/4plpUelFP4pxelzm3xT:3qNBBTvSnxOCsr
MD5:	35D3E7D8FD5302F9EAFAEF982BA494DF
SHA1:	2ED034FE8A8B52BD7E4F58A4CBBC76D249C359ED
SHA-256:	0CD375E62A7B4BF4FC7C07D9FF16878777FB32F8ADED269BDB53F8A7A89C55D7
SHA-512:	6D1F53EF9DEF3BBA4201CC0BC926F335866E46788A0E06775C916EDB843AFC19E5EE671F8A1870BC7B4C9CD74600069AC1FE544EB050E7A326ABDD2C6DAA8A21
Malicious:	false
Preview:	<?xml version="1.0"?>..<configuration>.. <appSettings>.. User application and configured property settings go here.-->.. Example: <add key="settingName" value="settingValue"/> -->.. <add key="toolBarButton_Cursor.Pushed" value="True" />.. <add key="toolBarButton_Cursor.ToolTipText" value="Cursor" />.. <add key="toolBarButton_Marker.Pushed" value="True" />.. <add key="toolBarButton_Marker.ToolTipText" value="Marker" />.. <add key="toolBarButton_PT_Draw.ToolTipText" value="Point Draw" />.. </appSettings>..</configuration>

C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbF5357.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	412672
Entropy (8bit):	6.652589061894945
Encrypted:	false
SSDEEP:	12288:zh6QnWFCk5KQS5mUnq+kx675P7wn+aSX9GfE7A12Bin:FHxmUnq3x6758+aG9GMMwB
MD5:	69624B1AB275E5AEA277EC8A011F40BC
SHA1:	3198AE6438ECF0F02004984D0D0A2F675FF12AF0
SHA-256:	CA22DBD05D69653FEBEFD40FA801B85914FACC1596CE73425E471C8C6A03342D
SHA-512:	4988CAC32BD47D17398F97847F94A7C43C2511D8A519267ACCEBDABC305BF47E6739D093FDDBCB65D5BE78CFCC4A9A8A025BBCB80A6A3BA0F146ACEE224621D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@U.]!;.]!;.]!;.8G8.V!;.8G>..!;.8G?.O!;....X!;..I>.A!;..I?.R!;..I8.I!;.8G:.X!;.]!:..!;..H?.^!;..H;.\!;..H..\!;..H9.\!;.Rich]!;.........PE..L....d._...........!.....\|..........P.....................................................@.................................H...<....`.......................p..\(..`...T...............................@...............P............................text....{.......\|.................. ..`.rdata.............................@..@.data........0......................@....rsrc........`....... ..............@..@.reloc..\(...p...*..."..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbFile.dll (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	412672
Entropy (8bit):	6.652589061894945
Encrypted:	false
SSDEEP:	12288:zh6QnWFCk5KQS5mUnq+kx675P7wn+aSX9GfE7A12Bin:FHxmUnq3x6758+aG9GMMwB
MD5:	69624B1AB275E5AEA277EC8A011F40BC
SHA1:	3198AE6438ECF0F02004984D0D0A2F675FF12AF0
SHA-256:	CA22DBD05D69653FEBEFD40FA801B85914FACC1596CE73425E471C8C6A03342D
SHA-512:	4988CAC32BD47D17398F97847F94A7C43C2511D8A519267ACCEBDABC305BF47E6739D093FDDBCB65D5BE78CFCC4A9A8A025BBCB80A6A3BA0F146ACEE224621D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@U.]!;.]!;.]!;.8G8.V!;.8G>..!;.8G?.O!;....X!;..I>.A!;..I?.R!;..I8.I!;.8G:.X!;.]!:..!;..H?.^!;..H;.\!;..H..\!;..H9.\!;.Rich]!;.........PE..L....d._...........!.....\|..........P.....................................................@.................................H...<....`.......................p..\(..`...T...............................@...............P............................text....{.......\|.................. ..`.rdata.............................@..@.data........0......................@....rsrc........`....... ..............@..@.reloc..\(...p...*..."..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbL2be9.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	5.824030017832848
Encrypted:	false
SSDEEP:	768:7Rb78Xc4V1SQpSQAIb1YgBKxv9TcUvVIxa7Y4+Bt9TIMLsp2Tj:l81SQpSQAIb1UmUvD7Y4UTIY
MD5:	AA30619BF3CBDD793907028F0DA0136D
SHA1:	5116C3697915B581116E54FE1299929AAED9C834
SHA-256:	2C1742A27FC5A1A00AFF1CAA1360D70DB38BA6D875DC64E9C21C037C285CD432
SHA-512:	3D475FFD06F7CA827246C5FED05EE4F4683E606E0016B4AA21BCF71F38CE4729CE78E39958F7692AB6591178C8D03C5F3351FE8AB8D1D3DBB499A0B319B93DEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....d._...........!..0.................. ........... .......................@............@.....................................O............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........n...j............................................................{...."..}........0..+.........(}......(.....}.....s....}.....s....}......(.....%....(.........%. .....3.(.........%..3.3.(.........%...3.(.........%...3.f(.........%... ....(.........%..3.3 ....(.........%..3.3.3(.........%. ......(.........%.. .....f.(.........%.. .... .....(.........%... .....(.........%... .... ....(.........%.... ....(.........%...f.f ....(.........%.. .... .... ....(.........%..

C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbLib.dll (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	5.824030017832848
Encrypted:	false
SSDEEP:	768:7Rb78Xc4V1SQpSQAIb1YgBKxv9TcUvVIxa7Y4+Bt9TIMLsp2Tj:l81SQpSQAIb1UmUvD7Y4UTIY
MD5:	AA30619BF3CBDD793907028F0DA0136D
SHA1:	5116C3697915B581116E54FE1299929AAED9C834
SHA-256:	2C1742A27FC5A1A00AFF1CAA1360D70DB38BA6D875DC64E9C21C037C285CD432
SHA-512:	3D475FFD06F7CA827246C5FED05EE4F4683E606E0016B4AA21BCF71F38CE4729CE78E39958F7692AB6591178C8D03C5F3351FE8AB8D1D3DBB499A0B319B93DEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....d._...........!..0.................. ........... .......................@............@.....................................O............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........n...j............................................................{...."..}........0..+.........(}......(.....}.....s....}.....s....}......(.....%....(.........%. .....3.(.........%..3.3.(.........%...3.(.........%...3.f(.........%... ....(.........%..3.3 ....(.........%..3.3.3(.........%. ......(.........%.. .....f.(.........%.. .... .....(.........%... .....(.........%... .... ....(.........%.... ....(.........%...f.f ....(.........%.. .... .... ....(.........%..

C:\Program Files (x86)\Tektronix\ArbExpress\System\DevC1043.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5128192
Entropy (8bit):	5.997356061291721
Encrypted:	false
SSDEEP:	49152:ZfbOajjp+gmHkx9IiNIsIC4QrWAAJKbXRebxjWIUPHaoe2DRNzxfItzUB1WoiQsK:UajjAHkxu+AJKbXRebxjWIU
MD5:	548D695FF96BD80167A8F6A3EDC2FC93
SHA1:	E1D27D5AFC4725BCAE772EB8B838737CCF3FEEB1
SHA-256:	AA53F75FD1B83F562735FCBBE2A093A6B6C24ADCB21128741613B6E9EDFFAC4F
SHA-512:	21A54CEA47B9C5157B4AA978BC3C92F171D525DCDAE0A0DF304E4ED50742BD691432C5403E8E038A912ACEDC381047861A75A45182A8EC0E4907FDA9DDEAF682
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!......N.........,.N.. ... N...... ........................N...........@..................................@N.(.....N......................`N......................................................@N.............. ..H............textxc.2.M.. ....M................. ..`.datax....... N.......N.............@....idata..V....@N.......N.............@..@.reloc.......`N...... N.............@..B.rsrc.........N......0N.............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Tektronix\ArbExpress\System\DevComponents.DotNetBar2.dll (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5128192
Entropy (8bit):	5.997356061291721
Encrypted:	false
SSDEEP:	49152:ZfbOajjp+gmHkx9IiNIsIC4QrWAAJKbXRebxjWIUPHaoe2DRNzxfItzUB1WoiQsK:UajjAHkxu+AJKbXRebxjWIU
MD5:	548D695FF96BD80167A8F6A3EDC2FC93
SHA1:	E1D27D5AFC4725BCAE772EB8B838737CCF3FEEB1
SHA-256:	AA53F75FD1B83F562735FCBBE2A093A6B6C24ADCB21128741613B6E9EDFFAC4F
SHA-512:	21A54CEA47B9C5157B4AA978BC3C92F171D525DCDAE0A0DF304E4ED50742BD691432C5403E8E038A912ACEDC381047861A75A45182A8EC0E4907FDA9DDEAF682
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!......N.........,.N.. ... N...... ........................N...........@..................................@N.(.....N......................`N......................................................@N.............. ..H............textxc.2.M.. ....M................. ..`.datax....... N.......N.............@....idata..V....@N.......N.............@..@.reloc.......`N...... N.............@..B.rsrc.........N......0N.............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Tektronix\ArbExpress\System\Disp3196.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	5.086848744037299
Encrypted:	false
SSDEEP:	3072:AtBSl8IUajyvROAgNWU/cbDxZhy4lxdR9:AWKIUqyvROfWU/
MD5:	9D1AF7AEC60748436B67D6691C79B5FB
SHA1:	58EDD817BE56455B98E713FDE7D537A5A52A1FA3
SHA-256:	883E8A37DD8930AE34B19519A319050E5E0D0BE6D4928624777BB7C9576B6F1F
SHA-512:	C2B7B8DEAA3923988347E9093DB30E0515FF99CFD7C5D0DDE85C636732DCA039A5105A94AF65B2264CA64E3B1D0A412E0378C6DDAF618E38618DFC4513118B92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....d._...........!..0.................. ........... ....................... ............@.................................L...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......<O..................P............................................0............}......j}......j}.....#........}.....#........}.....#........}.....#........}.....#........}.......H...}.......I...}.......I...}.....(....}......}......}.....s....}......}....z..}......}......}.......}....>..}......}........0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3....

C:\Program Files (x86)\Tektronix\ArbExpress\System\DisplayComponent.dll (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	5.086848744037299
Encrypted:	false
SSDEEP:	3072:AtBSl8IUajyvROAgNWU/cbDxZhy4lxdR9:AWKIUqyvROfWU/
MD5:	9D1AF7AEC60748436B67D6691C79B5FB
SHA1:	58EDD817BE56455B98E713FDE7D537A5A52A1FA3
SHA-256:	883E8A37DD8930AE34B19519A319050E5E0D0BE6D4928624777BB7C9576B6F1F
SHA-512:	C2B7B8DEAA3923988347E9093DB30E0515FF99CFD7C5D0DDE85C636732DCA039A5105A94AF65B2264CA64E3B1D0A412E0378C6DDAF618E38618DFC4513118B92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....d._...........!..0.................. ........... ....................... ............@.................................L...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......<O..................P............................................0............}......j}......j}.....#........}.....#........}.....#........}.....#........}.....#........}.......H...}.......I...}.......I...}.....(....}......}......}.....s....}......}....z..}......}......}.......}....>..}......}........0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3....

C:\Program Files (x86)\Tektronix\ArbExpress\System\MakW53a5.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	360448
Entropy (8bit):	6.752206735920315
Encrypted:	false
SSDEEP:	6144:XQtpiangFXqlc6U+oYWjgvAumyN+2k66efojmhDbcLsRwAp93AOdY9GeXCG:AtzgFXq9U+oYWjgvAuZOvefoYbcCsLCG
MD5:	FBDD8074DC7A093DED2BDEB34FDA3055
SHA1:	E039FFCFE4645872AAFCA03CB9828C2AA082A21C
SHA-256:	BFFCC5092409371C6181E3109645C5C0A06BAA8948039E3B6C9940910000015F
SHA-512:	9F71F07E089BCFC113000E7ACB94E867BD2B119784202EA73A5AF4253B590A733C713104C0F06975A042F3B22C71D76E9CA6068B5D49256DF5BCDFDD64940C8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........IS..(=..(=..(=..N>.(=..N8..(=..N9.(=..@8.(=..@9..(=..@>.(=..N<..(=..(<..(=..A9..(=..A=..(=..A...(=..A?..(=.Rich.(=.........PE..L....d._...........!.....T...B.......D.......p............................................@..........................U......lW..(...............................T%...E..T...........................8F..@............p..D............................text...~R.......T.................. ..`.rdata.......p.......X..............@..@.data...."...`.......H..............@..._RDATA...............R..............@..@.rsrc................X..............@..@.reloc..T%.......&...Z..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Tektronix\ArbExpress\System\MakWfm.dll (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	360448
Entropy (8bit):	6.752206735920315
Encrypted:	false
SSDEEP:	6144:XQtpiangFXqlc6U+oYWjgvAumyN+2k66efojmhDbcLsRwAp93AOdY9GeXCG:AtzgFXq9U+oYWjgvAuZOvefoYbcCsLCG
MD5:	FBDD8074DC7A093DED2BDEB34FDA3055
SHA1:	E039FFCFE4645872AAFCA03CB9828C2AA082A21C
SHA-256:	BFFCC5092409371C6181E3109645C5C0A06BAA8948039E3B6C9940910000015F
SHA-512:	9F71F07E089BCFC113000E7ACB94E867BD2B119784202EA73A5AF4253B590A733C713104C0F06975A042F3B22C71D76E9CA6068B5D49256DF5BCDFDD64940C8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........IS..(=..(=..(=..N>.(=..N8..(=..N9.(=..@8.(=..@9..(=..@>.(=..N<..(=..(<..(=..A9..(=..A=..(=..A...(=..A?..(=.Rich.(=.........PE..L....d._...........!.....T...B.......D.......p............................................@..........................U......lW..(...............................T%...E..T...........................8F..@............p..D............................text...~R.......T.................. ..`.rdata.......p.......X..............@..@.data...."...`.......H..............@..._RDATA...............R..............@..@.rsrc................X..............@..@.reloc..T%.......&...Z..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Tektronix\ArbExpress\System\Prev39a5.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23040
Entropy (8bit):	5.2310276785053915
Encrypted:	false
SSDEEP:	384:xK/Hf/ke1HVbswQYmtZUS8JM2WK1ubDkRYr45KVQbP:xgHEw5swMtZX8WTQKV0
MD5:	516FB4A8F0FE44FC539C563200F5F95F
SHA1:	E7236C2601B29267E690A2EFA04DE17F59870CBF
SHA-256:	37C51DAE2D502130EE9AD8A270EB4598961F0526DD592338FAD69D3196CE33F4
SHA-512:	B8465D77DB5A37D8251A322DAD0A36231EA53DBE999734C67EBAD885216537569CF1DEAE3736AE4077176E186DF7AB7AF734F6CA36912B1BD206B1050D9BD1AC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....d._...........!..0..P...........n... ........... ....................................@..................................n..O.................................................................................... ............... ..H............text....O... ...P.................. ..`.rsrc................R..............@..@.reloc...............X..............@..B.................n......H........F...&...........m.. .............................................(.....0...........\|.....{3...l}o....\|.....{4...l}p....\|......(....j}q....\|......(......(....Xj}r....\|......(....j}h....\|......(....j}i....\|.....{5...}o....\|.....{6...}p....\|......(....j}q....\|......(......(....Xj}r....\|......(....j}h....\|......(....j}i...f..sS...}......sS...}.....:.\|.....l}o...:.\|.....l}p...6.\|.....}q...6.\|.....}r...f.\|.....}h....\|.....}i...6.\|.....}o...6.\|.....}p...*6.\|.....}

C:\Program Files (x86)\Tektronix\ArbExpress\System\PreviewComponent.dll (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23040
Entropy (8bit):	5.2310276785053915
Encrypted:	false
SSDEEP:	384:xK/Hf/ke1HVbswQYmtZUS8JM2WK1ubDkRYr45KVQbP:xgHEw5swMtZX8WTQKV0
MD5:	516FB4A8F0FE44FC539C563200F5F95F
SHA1:	E7236C2601B29267E690A2EFA04DE17F59870CBF
SHA-256:	37C51DAE2D502130EE9AD8A270EB4598961F0526DD592338FAD69D3196CE33F4
SHA-512:	B8465D77DB5A37D8251A322DAD0A36231EA53DBE999734C67EBAD885216537569CF1DEAE3736AE4077176E186DF7AB7AF734F6CA36912B1BD206B1050D9BD1AC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....d._...........!..0..P...........n... ........... ....................................@..................................n..O.................................................................................... ............... ..H............text....O... ...P.................. ..`.rsrc................R..............@..@.reloc...............X..............@..B.................n......H........F...&...........m.. .............................................(.....0...........\|.....{3...l}o....\|.....{4...l}p....\|......(....j}q....\|......(......(....Xj}r....\|......(....j}h....\|......(....j}i....\|.....{5...}o....\|.....{6...}p....\|......(....j}q....\|......(......(....Xj}r....\|......(....j}h....\|......(....j}i...f..sS...}......sS...}.....:.\|.....l}o...:.\|.....l}p...6.\|.....}q...6.\|.....}r...f.\|.....}h....\|.....}i...6.\|.....}o...6.\|.....}p...*6.\|.....}

C:\Program Files (x86)\Tektronix\ArbExpress\System\Scop3dbc.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	213504
Entropy (8bit):	6.615215945438717
Encrypted:	false
SSDEEP:	3072:ggx9jYicV0NV+8GNVW2BNVEgHvNVINVINVANVG:F9EV0Nc8GNzBNlPNaNqNON
MD5:	D3DCAB11FC0EFBFABE6C0BBA035A6A83
SHA1:	416D9CF1055E0EC0790746FC95566A692E6C846B
SHA-256:	A99F27DD5502AC102E58B018A39016BF06CC001173F858C0384330354B3601DF
SHA-512:	470D81E9713EB58FAF28DF445D36F5E13C1500E1CB002FEDF46BC0D08270DA52A58E9ED73C5EA2D4C13974FE72AE9C1879F92854D6A319DE7C20B8499D115B27
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....d._...........!..0..8..........VW... ...`....... ....................................@..................................W..O....`............................................................................... ............... ..H............text...\7... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B................8W......H.......H....d..............._...........................................0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3...(.....(.....{.....{....o.....o....o.....{....o....z.,..{....,..{....o......(........0...........j...}.....{.....o.....{.....o.....{....o.....{.....o.....{....o.....{.....o.....Yj..{......( ...o!....{....r...po!.....j}......}......&..*..................0..o............("...s#.....s$...}.....s%..

C:\Program Files (x86)\Tektronix\ArbExpress\System\ScopeAcqPages.dll (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	213504
Entropy (8bit):	6.615215945438717
Encrypted:	false
SSDEEP:	3072:ggx9jYicV0NV+8GNVW2BNVEgHvNVINVINVANVG:F9EV0Nc8GNzBNlPNaNqNON
MD5:	D3DCAB11FC0EFBFABE6C0BBA035A6A83
SHA1:	416D9CF1055E0EC0790746FC95566A692E6C846B
SHA-256:	A99F27DD5502AC102E58B018A39016BF06CC001173F858C0384330354B3601DF
SHA-512:	470D81E9713EB58FAF28DF445D36F5E13C1500E1CB002FEDF46BC0D08270DA52A58E9ED73C5EA2D4C13974FE72AE9C1879F92854D6A319DE7C20B8499D115B27
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....d._...........!..0..8..........VW... ...`....... ....................................@..................................W..O....`............................................................................... ............... ..H............text...\7... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B................8W......H.......H....d..............._...........................................0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3...(.....(.....{.....{....o.....o....o.....{....o....z.,..{....,..{....o......(........0...........j...}.....{.....o.....{.....o.....{....o.....{.....o.....{....o.....{.....o.....Yj..{......( ...o!....{....r...po!.....j}......}......&..*..................0..o............("...s#.....s$...}.....s%..

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\ArbE502a.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	5.61589919429097
Encrypted:	false
SSDEEP:	3072:vwCBlibuTbRIBSOM/frKBFYYgv3t8U6nNdsAQrpKlZ:IwpIBvM/frKBFPgv3t8UULQs
MD5:	E26CCFA18EBD19EECF29A84426CF3FDB
SHA1:	5F5B6E6E1670932945CB4EF35979D7AF8956CC0D
SHA-256:	69C621F6E9D355734E3DCB94A92654B0B4997BDD607ACB35BEEE587DCCB897C1
SHA-512:	652B347AC7D66EBCEB51B03BC180C70DB69A355E737A04AE5703C3C0A3757A83B693901E62313E407FA1A35F159440D6435F89D530B44F6B221C7FF8C996AF9C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........".S.L.S.L.S.L.@.%.R.L.V.,.T.L.V.C.J.L.S.M.:.L....V.L.V....L.V...R.L.V...R.L.RichS.L.........PE..L.....WA...........!.................v.......................................`..........................................e.... ..<............................0..,....P..............................................."..P............................textbss.Y...............................text........p...................... ..`.rdata..._...P...`..................@..@.data...Lg.......0...P..............@....idata..y.... ......................@....reloc...%...0...0..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\ArbEther.dll (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	5.61589919429097
Encrypted:	false
SSDEEP:	3072:vwCBlibuTbRIBSOM/frKBFYYgv3t8U6nNdsAQrpKlZ:IwpIBvM/frKBFPgv3t8UULQs
MD5:	E26CCFA18EBD19EECF29A84426CF3FDB
SHA1:	5F5B6E6E1670932945CB4EF35979D7AF8956CC0D
SHA-256:	69C621F6E9D355734E3DCB94A92654B0B4997BDD607ACB35BEEE587DCCB897C1
SHA-512:	652B347AC7D66EBCEB51B03BC180C70DB69A355E737A04AE5703C3C0A3757A83B693901E62313E407FA1A35F159440D6435F89D530B44F6B221C7FF8C996AF9C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........".S.L.S.L.S.L.@.%.R.L.V.,.T.L.V.C.J.L.S.M.:.L....V.L.V....L.V...R.L.V...R.L.RichS.L.........PE..L.....WA...........!.................v.......................................`..........................................e.... ..<............................0..,....P..............................................."..P............................textbss.Y...............................text........p...................... ..`.rdata..._...P...`..................@..@.data...Lg.......0...P..............@....idata..y.... ......................@....reloc...%...0...0..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\Clos5059.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	667
Entropy (8bit):	7.379803385778967
Encrypted:	false
SSDEEP:	12:zknebb8jfnPm9oPm4WuWm61KkneySyxVSScifKPhml9bzcIcI0VcRR2aQva2lgND:BS0SSc/PsQIRRRQNgDkXjU5mFB7ZXxm
MD5:	20CAA1CBD01D6A2199813EEBB53464A7
SHA1:	ABDB5D0EE17605B578CFB765DA58320D4FFA2BA0
SHA-256:	7702965D43AF4F58900DFE65CD941F2E765A2DD381734E4CC17E723EB4548915
SHA-512:	07EE9B93BAB2BAA7BDB1C49190EA3F3D9EC1D717B6D8B69696F70D1B5CCA5004E3975059D3CA0C7F2981C59D434AFF89AB7CA92392E75138BE5A154FC445B08A
Malicious:	false
Preview:	.P-file 2.4......................$...8.....n.4....&..B.h..G.E..`1V_.]2kX........F..."...~'......?<..K....CloseSession...n.4....&..B....G. ..^8..]2k\..... .F.3."...~'......?.B...n...\?..m.B...^.&.......2k6..w.u.._..I."...>..%.s..v?~}............/..B..&!.....;...].k...7.5.CPa.....H9~.7..-Q.....K.)....n.x....&...h..G.E..`1V_.4A.4h..X.....F.a.Vz..~'.....n.j....&...B.h...E..n1V_.]2k^........F..."...~'......?0..K..n.tU..t..t.B...2.K......Akk.w{u..N..I."...>..$.>..v?2}............./..B.h.......(...].k[..7.5.CPa.....N9~.k...fQ.....K.)....#..oblmB;f......S....T]...I.7T5..Ua.ODM..y~.......?....<.nW ..c4..._-a.G.G....C....+....

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\CloseSession.p (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	667
Entropy (8bit):	7.379803385778967
Encrypted:	false
SSDEEP:	12:zknebb8jfnPm9oPm4WuWm61KkneySyxVSScifKPhml9bzcIcI0VcRR2aQva2lgND:BS0SSc/PsQIRRRQNgDkXjU5mFB7ZXxm
MD5:	20CAA1CBD01D6A2199813EEBB53464A7
SHA1:	ABDB5D0EE17605B578CFB765DA58320D4FFA2BA0
SHA-256:	7702965D43AF4F58900DFE65CD941F2E765A2DD381734E4CC17E723EB4548915
SHA-512:	07EE9B93BAB2BAA7BDB1C49190EA3F3D9EC1D717B6D8B69696F70D1B5CCA5004E3975059D3CA0C7F2981C59D434AFF89AB7CA92392E75138BE5A154FC445B08A
Malicious:	false
Preview:	.P-file 2.4......................$...8.....n.4....&..B.h..G.E..`1V_.]2kX........F..."...~'......?<..K....CloseSession...n.4....&..B....G. ..^8..]2k\..... .F.3."...~'......?.B...n...\?..m.B...^.&.......2k6..w.u.._..I."...>..%.s..v?~}............/..B..&!.....;...].k...7.5.CPa.....H9~.7..-Q.....K.)....n.x....&...h..G.E..`1V_.4A.4h..X.....F.a.Vz..~'.....n.j....&...B.h...E..n1V_.]2k^........F..."...~'......?0..K..n.tU..t..t.B...2.K......Akk.w{u..N..I."...>..$.>..v?2}............./..B.h.......(...].k[..7.5.CPa.....N9~.k...fQ.....K.)....#..oblmB;f......S....T]...I.7T5..Ua.ODM..y~.......?....<.nW ..c4..._-a.G.G....C....+....

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\Load5069.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.444170612377388
Encrypted:	false
SSDEEP:	12:5fvknebb8jfnPm9oPm4WuWm6lHVebb8jo9K/yH7NFWRS1QckTrtwa5ATSZtOM601:589UU7NFWRSKckTrtwa2Tqcl0/nRdvSu
MD5:	8534A70D175530F2E1F4E99AFEB96629
SHA1:	0C25AB3A4C5F2FC074E03C4339F631E225845913
SHA-256:	460EF62215FA463E50668D430661696BE3BF864475AB5DDF250D2DB43CCDD3C0
SHA-512:	CC6E6A95F5641A8E767C1E8CEF554824CA9B432BA00EC5F01EDB943FF0C0CADB8031A3B7AFA6CBD4C1D2823E170917C4409A32796F56F26A0DA9FE8A6AE3BE31
Malicious:	false
Preview:	.P-file 2.4..0...........-...........8.....n.4....&..B.h..G.E..`1V_.]2kX........F..."...~'......?<..K....LoadWfm...n.6....&..B.h..G.E..`1V_.]2k9g..G..we.F._.Co..3T.....LU.\|...n.#3g...../....^.".......2k&..w]u../..N."...>.%.s?...w}...VQh...../..B.j...........].k[..7.5.CUa.....I9~....BQ.....K.)....#..&/....M......S....y]...I.7S5..ua.OWM..y~.K.....?....<.nW6..cu....-.....G`.........+]....j..!..."[..n.x....&..*.h..G.E..`1V_.4A.4h..X.....F.a.Vz..~'.....n.j....&...B.h...E..n1V_.]2k^........F..."...~'......?;..K..n.tU..t..b.B...1.E.....2kF..w.u.....L.k...>..%.s..v?:}.........../..B.`.......#...].kX..7.5.CVa..c...9~.Z...Q.....K.(.....#..&/,mB;n......S....\]...I.7\5..Qa.OKM..y~.......?....T..WU..c....A-..o..G

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\LoadWfm.p (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.444170612377388
Encrypted:	false
SSDEEP:	12:5fvknebb8jfnPm9oPm4WuWm6lHVebb8jo9K/yH7NFWRS1QckTrtwa5ATSZtOM601:589UU7NFWRSKckTrtwa2Tqcl0/nRdvSu
MD5:	8534A70D175530F2E1F4E99AFEB96629
SHA1:	0C25AB3A4C5F2FC074E03C4339F631E225845913
SHA-256:	460EF62215FA463E50668D430661696BE3BF864475AB5DDF250D2DB43CCDD3C0
SHA-512:	CC6E6A95F5641A8E767C1E8CEF554824CA9B432BA00EC5F01EDB943FF0C0CADB8031A3B7AFA6CBD4C1D2823E170917C4409A32796F56F26A0DA9FE8A6AE3BE31
Malicious:	false
Preview:	.P-file 2.4..0...........-...........8.....n.4....&..B.h..G.E..`1V_.]2kX........F..."...~'......?<..K....LoadWfm...n.6....&..B.h..G.E..`1V_.]2k9g..G..we.F._.Co..3T.....LU.\|...n.#3g...../....^.".......2k&..w]u../..N."...>.%.s?...w}...VQh...../..B.j...........].k[..7.5.CUa.....I9~....BQ.....K.)....#..&/....M......S....y]...I.7S5..ua.OWM..y~.K.....?....<.nW6..cu....-.....G`.........+]....j..!..."[..n.x....&..*.h..G.E..`1V_.4A.4h..X.....F.a.Vz..~'.....n.j....&...B.h...E..n1V_.]2k^........F..."...~'......?;..K..n.tU..t..b.B...1.E.....2kF..w.u.....L.k...>..%.s..v?:}.........../..B.`.......#...].kX..7.5.CVa..c...9~.Z...Q.....K.(.....#..&/,mB;n......S....\]...I.7\5..Qa.OKM..y~.......?....T..WU..c....A-..o..G

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\NewS5098.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	725
Entropy (8bit):	7.4041572376422105
Encrypted:	false
SSDEEP:	12:x7knebb8jfnPm9oPm4WuWm6Uebb8sVH7tkGdYnSSsP9Tg93/ewJI0VcRR2aQvade:xjk/SSsKFmwCRRQUDka8djU5mNNbp7As
MD5:	4F84BD8B9B92D5F7445372D2935CEAD2
SHA1:	19AA37D972D6BB53062485D1481539B817390F8F
SHA-256:	564B848A7689C280171DB31FC34AB7ABCD75B17011ADF2E557D2A1687C313B56
SHA-512:	768565F09D6BB623B0C894292990DCCCD24CF7F6BF38C5A336B947E0728AF1F2999404A542D05A8720E3A9D44856DCDEBF8D02A1872CB158F2FC67E30ECB006A
Malicious:	false
Preview:	.P-file 2.4..........................8.....n.4....&..B.h..G.E..`1V_.]2kX........F..."...~'......?<..K....NewSession...n.6....&..B.h..G.E..`1V_.3Ak.l..}...C.'{A.E....i......?:..K..n.JU..O..S.B...^.".....cb.S..w..<_..M."...>..%.s..v?.}........../..B.h....... ...].kg..7.5.CVa..G.....!...Q.....K.)....#..&/#mB;a......S....^]...I.7g5..wa.OHM..y~.#.....?....<.nW1..c..n.x....&..*.h..G.E..`1V_.4A.4h..X.....F.a.Vz..~'.....n.j....&...B.h...E..n1V_.]2k^........F..."...~'......?6..K..n.tU..t..x.B...;.S.....[kw.w.u..N..I."...>..$.>..v?2}............./..B.h.......(...].k[..7.5.CPa.....N9~.k...fQ.....K.)....#..oblmB;f......S....T]...I.7T5..Ua.ODM..y~.......?....<.nW:..c....B-l.M.G....g..

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\NewSession.p (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	725
Entropy (8bit):	7.4041572376422105
Encrypted:	false
SSDEEP:	12:x7knebb8jfnPm9oPm4WuWm6Uebb8sVH7tkGdYnSSsP9Tg93/ewJI0VcRR2aQvade:xjk/SSsKFmwCRRQUDka8djU5mNNbp7As
MD5:	4F84BD8B9B92D5F7445372D2935CEAD2
SHA1:	19AA37D972D6BB53062485D1481539B817390F8F
SHA-256:	564B848A7689C280171DB31FC34AB7ABCD75B17011ADF2E557D2A1687C313B56
SHA-512:	768565F09D6BB623B0C894292990DCCCD24CF7F6BF38C5A336B947E0728AF1F2999404A542D05A8720E3A9D44856DCDEBF8D02A1872CB158F2FC67E30ECB006A
Malicious:	false
Preview:	.P-file 2.4..........................8.....n.4....&..B.h..G.E..`1V_.]2kX........F..."...~'......?<..K....NewSession...n.6....&..B.h..G.E..`1V_.3Ak.l..}...C.'{A.E....i......?:..K..n.JU..O..S.B...^.".....cb.S..w..<_..M."...>..%.s..v?.}........../..B.h....... ...].kg..7.5.CVa..G.....!...Q.....K.)....#..&/#mB;a......S....^]...I.7g5..wa.OHM..y~.#.....?....<.nW1..c..n.x....&..*.h..G.E..`1V_.4A.4h..X.....F.a.Vz..~'.....n.j....&...B.h...E..n1V_.]2k^........F..."...~'......?6..K..n.tU..t..x.B...;.S.....[kw.w.u..N..I."...>..$.>..v?2}............./..B.h.......(...].k[..7.5.CPa.....N9~.k...fQ.....K.)....#..oblmB;f......S....T]...I.7T5..Ua.ODM..y~.......?....<.nW:..c....B-l.M.G....g..

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\Tran50a7.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	798
Entropy (8bit):	7.507477236171556
Encrypted:	false
SSDEEP:	24:5ny2LIJVNCB6zODF0SonRRQECDk9ijU5mNNbp7A0L:5nnLIIYzrSoRa1DPQaNe0L
MD5:	22E1D474F34AF7E63E8C15B2951C04E1
SHA1:	EF7CF40D316C6118362F50D4D5C728F4F04308EB
SHA-256:	E1B860CD1474E828CCD16D12AF718231F2BEB3727C06DC82319E1444C1E0638E
SHA-512:	F3B46A100DBE26886BFE94F3E2397848A25EEDD81B679BBBDC718D4F4865C7B4D4079C7EC09CF2994B0BD42626DCB62FD4C4C99917FDDE0D785F20F4E0062976
Malicious:	false
Preview:	.P-file 2.4..P...........H...........8.....n.4....&..B.h..G.E..`1V_.]2kX........F..."...~'......?<..K....TransferWfm...n.6....&..B.h..G.E..`1V_.]2kX..u...C.'{y."....S..W...?o.a8...0U..'.....'....$......H....w.u.....D."...>..%.s..v?.}.........../....#...Bz..o...].kX..7.5.CPa..?..f9~....OQ.....K.)....#..&/.mB;W......S.....]....q.q5..Ka.OJM..y~.......?....#.nW<..cU...7-..!..G+...).....+].....j..!..."[.y..@..3....[.R.}...s....../....n.x....&...h..G.E..`1V_.4A.4h..X.....F.a.Vz..~'.....n.j....&...B.h...E..n1V_.]2k^........F..."...~'......?7..K..n.tU..t..z.B...,.E......@kO.wyu..N..I."...>..$.>..v?2}............./..B.h.......(...].k[..7.5.CPa.....N9~.k...fQ.....K.)....#..oblmB;f......S....T]...I.7T5..Ua.ODM..y~.......?....<.nW:..c....B-f._.G....g..

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\TransferWfm.p (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	798
Entropy (8bit):	7.507477236171556
Encrypted:	false
SSDEEP:	24:5ny2LIJVNCB6zODF0SonRRQECDk9ijU5mNNbp7A0L:5nnLIIYzrSoRa1DPQaNe0L
MD5:	22E1D474F34AF7E63E8C15B2951C04E1
SHA1:	EF7CF40D316C6118362F50D4D5C728F4F04308EB
SHA-256:	E1B860CD1474E828CCD16D12AF718231F2BEB3727C06DC82319E1444C1E0638E
SHA-512:	F3B46A100DBE26886BFE94F3E2397848A25EEDD81B679BBBDC718D4F4865C7B4D4079C7EC09CF2994B0BD42626DCB62FD4C4C99917FDDE0D785F20F4E0062976
Malicious:	false
Preview:	.P-file 2.4..P...........H...........8.....n.4....&..B.h..G.E..`1V_.]2kX........F..."...~'......?<..K....TransferWfm...n.6....&..B.h..G.E..`1V_.]2kX..u...C.'{y."....S..W...?o.a8...0U..'.....'....$......H....w.u.....D."...>..%.s..v?.}.........../....#...Bz..o...].kX..7.5.CPa..?..f9~....OQ.....K.)....#..&/.mB;W......S.....]....q.q5..Ka.OJM..y~.......?....#.nW<..cU...7-..!..G+...).....+].....j..!..."[.y..@..3....[.R.}...s....../....n.x....&...h..G.E..`1V_.4A.4h..X.....F.a.Vz..~'.....n.j....&...B.h...E..n1V_.]2k^........F..."...~'......?7..K..n.tU..t..z.B...,.E......@kO.wyu..N..I."...>..$.>..v?2}............./..B.h.......(...].k[..7.5.CPa.....N9~.k...fQ.....K.)....#..oblmB;f......S....T]...I.7T5..Ua.ODM..y~.......?....<.nW:..c....B-f._.G....g..

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\mata504a.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.939485823387047
Encrypted:	false
SSDEEP:	384:0v6LKwf3gC/F+R30W27Ce+TDRAiO069Xj:RN1M0r7V+pvO/
MD5:	72EDD5449D4C965F0E131C5625911A16
SHA1:	4ADDD4D198BB26BB4F199E8E53F0675E93E3053C
SHA-256:	2918EF52AB0D4F8F6DDA4B2B7D5ED3723AB5332ADB006A337665863FE4F09880
SHA-512:	EC0F74E5268FA305BB6FE1AD07E7BF73F7F1DD35EC69D6519FA8233055D0D60F3211D3D092BA3ED59E8CD1F0D329D0145112E1360522DBD7B9018B4AFF4362CF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.KB...B...B.......@...e...@...e...F.......@.......@...e...K...B...z...e...T...e...C...e...C...RichB...................PE..L...Q.gM...........!................](.......0...............................p......E'...............................:..L....5.......P.......................`..\....................................4..@............0...............................text............................... ..`.rdata..<....0......."..............@..@.data........@......................@....rsrc........P.......0..............@..@.reloc.......`.......2..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\mata50b7.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	90209
Entropy (8bit):	4.547805182917404
Encrypted:	false
SSDEEP:	768:YIjznOBobCw/mNNL4RoMis7itxy3SRJgIMRpzi5Pmk/3iB9IkMBc8/+A0i7iccxY:5/6w/mOis7eR9Kpzi5Ok/gMBZGWuHo9
MD5:	ED82FA0ADCDB0DDCC0B01475B7ABCF8A
SHA1:	A6F5D4DA34D18AC51E127FA5837E41CD515E5F8E
SHA-256:	D8936CB9033FAB93CDA85AC1CCF54D359DC333479ABA6FC1AE450D8014B64C08
SHA-512:	4FFA70FBF074DB25C7A277DD331441F46BA60383E44EA32C4E1402EBA886825AF85287270FDE645C60770FB2A680436D17848FCD40C2CE8AF5048BA3E3265C19
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d.b. l.. l.. l..Bs.."l..[p.."l..Os..!l...p..1l..Os...l.. l...l..%`Q."l..&O..(l...j..!l...L../l..Rich l..........PE..L...6..B...........!.................5..................................................................................W....P..x....`.......................p.......................................................R...............................text.............................. ..`.rdata..............................@..@.data....d.......P..................@....idata.......P.......0..............@....rsrc........`.......@..............@..@.reloc.......p.......P..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\matarb.dll (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	90209
Entropy (8bit):	4.547805182917404
Encrypted:	false
SSDEEP:	768:YIjznOBobCw/mNNL4RoMis7itxy3SRJgIMRpzi5Pmk/3iB9IkMBc8/+A0i7iccxY:5/6w/mOis7eR9Kpzi5Ok/gMBZGWuHo9
MD5:	ED82FA0ADCDB0DDCC0B01475B7ABCF8A
SHA1:	A6F5D4DA34D18AC51E127FA5837E41CD515E5F8E
SHA-256:	D8936CB9033FAB93CDA85AC1CCF54D359DC333479ABA6FC1AE450D8014B64C08
SHA-512:	4FFA70FBF074DB25C7A277DD331441F46BA60383E44EA32C4E1402EBA886825AF85287270FDE645C60770FB2A680436D17848FCD40C2CE8AF5048BA3E3265C19
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d.b. l.. l.. l..Bs.."l..[p.."l..Os..!l...p..1l..Os...l.. l...l..%`Q."l..&O..(l...j..!l...L../l..Rich l..........PE..L...6..B...........!.................5..................................................................................W....P..x....`.......................p.......................................................R...............................text.............................. ..`.rdata..............................@..@.data....d.......P..................@....idata.......P.......0..............@....rsrc........`.......@..............@..@.reloc.......p.......P..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\matarb.mexw32 (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.939485823387047
Encrypted:	false
SSDEEP:	384:0v6LKwf3gC/F+R30W27Ce+TDRAiO069Xj:RN1M0r7V+pvO/
MD5:	72EDD5449D4C965F0E131C5625911A16
SHA1:	4ADDD4D198BB26BB4F199E8E53F0675E93E3053C
SHA-256:	2918EF52AB0D4F8F6DDA4B2B7D5ED3723AB5332ADB006A337665863FE4F09880
SHA-512:	EC0F74E5268FA305BB6FE1AD07E7BF73F7F1DD35EC69D6519FA8233055D0D60F3211D3D092BA3ED59E8CD1F0D329D0145112E1360522DBD7B9018B4AFF4362CF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.KB...B...B.......@...e...@...e...F.......@.......@...e...K...B...z...e...T...e...C...e...C...RichB...................PE..L...Q.gM...........!................](.......0...............................p......E'...............................:..L....5.......P.......................`..\....................................4..@............0...............................text............................... ..`.rdata..<....0......."..............@..@.data........@......................@....rsrc........P.......0..............@..@.reloc.......`.......2..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\quer5105.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	632
Entropy (8bit):	7.3023268333747255
Encrypted:	false
SSDEEP:	12:V5uknebb8jfnPm9oPm4WuWm6Aebb8ak3g99Tdav+0HtZRVAd6I0bRdIO+gSvaSNP:VQkW9T820zAQRdvSrDkTzjMtd
MD5:	BE1C9200C8D79E456A738F1C8B41DF8E
SHA1:	040CF4A207D1F6F44CAF2FDCC8A95F020FD17C51
SHA-256:	355D7F0C70C0C26383DD7913C24A3B0512CF3B0B62BB9C62088D4A44149B1DF9
SHA-512:	41B495A59BE40BD3EB4F0A44F9C007F5182DFD7DD24E5DBAC3B894D2EC01B3C47721B39599536546507C7016263AA90A4EC4FE29DEDF4D169BA49C72CB0E60CF
Malicious:	false
Preview:	.P-file 2.4..........................8.....n.4....&..B.h..G.E..`1V_.]2kX........F..."...~'......?<..K....query...n.6....&..B.h..G.E..`1V_.3Ak.}..a...B.5.c.Q~..~'..i...vx..K.....;n.v..k.B...^.f.......2k...w_u....y...". ....%.s..v?<}............/..B.k......%...].kY..7.5.C.a..3..K9~....KQ..C..)....#..&/ImB;s......S...U]...I.7W5..Ra.OIM..y~.#.....?......nW1..c7...(-..-..G..n.x....&..*.h..G.E..`1V_.4A.4h..X.....F.a.Vz..~'.....n.j....&...B.h...E..n1V_.]2k^........F..."...~'......?9..K..n.tU..t..f.B...+.A.......2kF..w.u.....L.k...>..%.s..v?:}.........../..B.`.......#...].kX..7.5.CVa..c...9~.C..

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\query.p (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	632
Entropy (8bit):	7.3023268333747255
Encrypted:	false
SSDEEP:	12:V5uknebb8jfnPm9oPm4WuWm6Aebb8ak3g99Tdav+0HtZRVAd6I0bRdIO+gSvaSNP:VQkW9T820zAQRdvSrDkTzjMtd
MD5:	BE1C9200C8D79E456A738F1C8B41DF8E
SHA1:	040CF4A207D1F6F44CAF2FDCC8A95F020FD17C51
SHA-256:	355D7F0C70C0C26383DD7913C24A3B0512CF3B0B62BB9C62088D4A44149B1DF9
SHA-512:	41B495A59BE40BD3EB4F0A44F9C007F5182DFD7DD24E5DBAC3B894D2EC01B3C47721B39599536546507C7016263AA90A4EC4FE29DEDF4D169BA49C72CB0E60CF
Malicious:	false
Preview:	.P-file 2.4..........................8.....n.4....&..B.h..G.E..`1V_.]2kX........F..."...~'......?<..K....query...n.6....&..B.h..G.E..`1V_.3Ak.}..a...B.5.c.Q~..~'..i...vx..K.....;n.v..k.B...^.f.......2k...w_u....y...". ....%.s..v?<}............/..B.k......%...].kY..7.5.C.a..3..K9~....KQ..C..)....#..&/ImB;s......S...U]...I.7W5..Ra.OIM..y~.#.....?......nW1..c7...(-..-..G..n.x....&..*.h..G.E..`1V_.4A.4h..X.....F.a.Vz..~'.....n.j....&...B.h...E..n1V_.]2k^........F..."...~'......?9..K..n.tU..t..f.B...+.A.......2kF..w.u.....L.k...>..%.s..v?:}.........../..B.`.......#...].kX..7.5.CVa..c...9~.C..

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\read.p (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	595
Entropy (8bit):	7.237528206615109
Encrypted:	false
SSDEEP:	12:0fknebb8jfnPm9oPm4WuWm677ebbtkB3B4Sc7jLTx9CHW5IpdwJI0bRGO4va+qNp:HkB3KSc7jLd9EKIzwDRGvaDkouxpiLg2
MD5:	27B1496A640B749215537CC38520645C
SHA1:	83292417D9892C7A3BA708D1BA94012032E9B14A
SHA-256:	9D2C1CA81A4476E1251A6CE9E64126CDD67F7F81F3149FA72D901126CAA63B3F
SHA-512:	50500075CE89D7D9E42F8971E0721A7C015D204E4C8E1766BB899B7B1CBFC958FC20D2061272C7F644196B371A25C3CF7681A5C4E73D980DCA8B33C3BBE32DC1
Malicious:	false
Preview:	.P-file 2.4..........................8.....n.4....&..B.h..G.E..`1V_.]2kX........F..."...~'......?<..K....read...n.6....&..B.h..G.E..._%_.)S.-z.F..s..5j.."....T..t...?:..K..n.OU..O..n.B...^.o.._.)`.2k.61.[u.....L."...>..%.s..v?.}............./..B.i.......b...].k[..7.5.C.a...2]dm9~.....Q.....K.)....#..&/nmB;m......S....X]...I.7s5..Ua.O.M..y~.......n.x....&..*.h..G.E..`1V_.4A.4h..X.....F.a.Vz..~'.....n.j....&...B.h...E..n1V_.]2k^........F..."...~'......?8..K..n.tU..t..d.B...;.E.......2k...w.t.....B."...>..%.s..v?8}............./..B.k....... ...].k^..7.5.C6a..K..

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\read5115.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	595
Entropy (8bit):	7.237528206615109
Encrypted:	false
SSDEEP:	12:0fknebb8jfnPm9oPm4WuWm677ebbtkB3B4Sc7jLTx9CHW5IpdwJI0bRGO4va+qNp:HkB3KSc7jLd9EKIzwDRGvaDkouxpiLg2
MD5:	27B1496A640B749215537CC38520645C
SHA1:	83292417D9892C7A3BA708D1BA94012032E9B14A
SHA-256:	9D2C1CA81A4476E1251A6CE9E64126CDD67F7F81F3149FA72D901126CAA63B3F
SHA-512:	50500075CE89D7D9E42F8971E0721A7C015D204E4C8E1766BB899B7B1CBFC958FC20D2061272C7F644196B371A25C3CF7681A5C4E73D980DCA8B33C3BBE32DC1
Malicious:	false
Preview:	.P-file 2.4..........................8.....n.4....&..B.h..G.E..`1V_.]2kX........F..."...~'......?<..K....read...n.6....&..B.h..G.E..._%_.)S.-z.F..s..5j.."....T..t...?:..K..n.OU..O..n.B...^.o.._.)`.2k.61.[u.....L."...>..%.s..v?.}............./..B.i.......b...].k[..7.5.C.a...2]dm9~.....Q.....K.)....#..&/nmB;m......S....X]...I.7s5..Ua.O.M..y~.......n.x....&..*.h..G.E..`1V_.4A.4h..X.....F.a.Vz..~'.....n.j....&...B.h...E..n1V_.]2k^........F..."...~'......?8..K..n.tU..t..d.B...;.E.......2k...w.t.....B."...>..%.s..v?8}............./..B.k....... ...].k^..7.5.C6a..K..

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\samp5134.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	5.050993935746915
Encrypted:	false
SSDEEP:	24:uXCoYUuFYvdzIAQ+kjZ9RlfPfO/eP9lDIX9tIw4retf5hJr0AAa:+CoY5YvezNj3RlHmWP3E3R/hrJ
MD5:	9132A6C63131ED519DEB1B074780CD05
SHA1:	C87F74663157D6AE2639BB0BA8E4356CA7615B0F
SHA-256:	788CDF9B4581D2F81766728C3B1CDF501F99E02004D5D3438D4C3BE84EF937DA
SHA-512:	B22FC4583AC09ECFA2B4435C5BC74070FBFC155C9EAFE4FE0F2C6754ABB247B730BC4BF1280391E906648A377E45B147C0428C8DCDB70C74B5CCA8FDF75DF910
Malicious:	false
Preview:	%A very very preliminary sample code to show how to use..%Caliber fuctions to talk to instrument from MATLAB..%Plase compile this using 'PCODE <filename> before..%running it.....%This script only with visa resource strings..%Since TekVisa does not support connection over raw sockets,..%you cannot connect to a Tek AWG using this script.....echo off....%Open a session. If you are connecting over LAN to an AWG..%the first parameter to NewSession would be the IP address..%and the second parameter would be the string'tcpip'..s=NewSession('USB0::0x0699::0x0343::JU010107::INSTR','usb');....%IDN query outputs two values;Status of the query and the ..%response from the instrument...[status,idn]=query(s, 'idn?');....%Writes a single command to the connected AWG. Status will..%be Zero if write is successful..status=Write(s,'Output1:State On');....%Following script creates a sine waveform with 1000 points..Frequency = 1e2;..Period = 1/Frequency;..Pts = [1:1000] Period;..Data = sin(Pts);....%F

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\sample.m (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	5.050993935746915
Encrypted:	false
SSDEEP:	24:uXCoYUuFYvdzIAQ+kjZ9RlfPfO/eP9lDIX9tIw4retf5hJr0AAa:+CoY5YvezNj3RlHmWP3E3R/hrJ
MD5:	9132A6C63131ED519DEB1B074780CD05
SHA1:	C87F74663157D6AE2639BB0BA8E4356CA7615B0F
SHA-256:	788CDF9B4581D2F81766728C3B1CDF501F99E02004D5D3438D4C3BE84EF937DA
SHA-512:	B22FC4583AC09ECFA2B4435C5BC74070FBFC155C9EAFE4FE0F2C6754ABB247B730BC4BF1280391E906648A377E45B147C0428C8DCDB70C74B5CCA8FDF75DF910
Malicious:	false
Preview:	%A very very preliminary sample code to show how to use..%Caliber fuctions to talk to instrument from MATLAB..%Plase compile this using 'PCODE <filename> before..%running it.....%This script only with visa resource strings..%Since TekVisa does not support connection over raw sockets,..%you cannot connect to a Tek AWG using this script.....echo off....%Open a session. If you are connecting over LAN to an AWG..%the first parameter to NewSession would be the IP address..%and the second parameter would be the string'tcpip'..s=NewSession('USB0::0x0699::0x0343::JU010107::INSTR','usb');....%IDN query outputs two values;Status of the query and the ..%response from the instrument...[status,idn]=query(s, 'idn?');....%Writes a single command to the connected AWG. Status will..%be Zero if write is successful..status=Write(s,'Output1:State On');....%Following script creates a sine waveform with 1000 points..Frequency = 1e2;..Period = 1/Frequency;..Pts = [1:1000] Period;..Data = sin(Pts);....%F

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\writ5134.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	736
Entropy (8bit):	7.442997450480618
Encrypted:	false
SSDEEP:	12:J5Jfvknebb8jfnPm9oPm4WuWm6jebb8jo9K/yz7oIWSqKhKwuFTcl5I0VcRdIO+T:JrM9UmWD8uFTbRdvSrDkdUjMttrshXKo
MD5:	C26A879A8DEEEB7D9E6DF0C5A537AA09
SHA1:	4149EC97473835AC31E4953E5124D0E6B65472A2
SHA-256:	EE442C104973C82E8C8056D8AB8DCD420C9870048542CF00D214926F8FFD5CF6
SHA-512:	3DC0EA72749C8FF0046AAD531BA9165687E5724F3B2256636CC4E4B9E2302BF76E776A457A92878E64D350F56C5C21D8D107AF140ECA4AF223EF6928A580FA6F
Malicious:	false
Preview:	.P-file 2.4.. ...........3...........8.....n.4....&..B.h..G.E..`1V_.]2kX........F..."...~'......?<..K....Write...n.6....&..B.h..G.E..`1V_.]2k9g..G..we.F._.Co..3T.....LU.\|...n.7:g.....?.#..9.".......2k]..w+u.....J."...>.;.%...v?.-4.........../..B.h...........].k...7.5.CPa.....H9~.F..?Q.....K.).....##...ImB;s......S....G]...I.7.5..Ya.OLM..y~.......?......nW0..cC....-.. ..G#...$.....+..n.x....&..*.h..G.E..`1V_.4A.4h..X.....F.a.Vz..~'.....n.j....&...B.h...E..n1V_.]2k^........F..."...~'......?9..K..n.tU..t..f.B...,.M.......2kF..w.u.....L.k...>..%.s..v?:}.........../..B.`.......#...].kX..7.5.CVa..c...9~.Z...Q.....K.(.....#..&/,mB;n......S....\]...I.7\5..Qa.OKM..y~.......?....K..WZ..c....H-..o..G

C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab\write.p (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	736
Entropy (8bit):	7.442997450480618
Encrypted:	false
SSDEEP:	12:J5Jfvknebb8jfnPm9oPm4WuWm6jebb8jo9K/yz7oIWSqKhKwuFTcl5I0VcRdIO+T:JrM9UmWD8uFTbRdvSrDkdUjMttrshXKo
MD5:	C26A879A8DEEEB7D9E6DF0C5A537AA09
SHA1:	4149EC97473835AC31E4953E5124D0E6B65472A2
SHA-256:	EE442C104973C82E8C8056D8AB8DCD420C9870048542CF00D214926F8FFD5CF6
SHA-512:	3DC0EA72749C8FF0046AAD531BA9165687E5724F3B2256636CC4E4B9E2302BF76E776A457A92878E64D350F56C5C21D8D107AF140ECA4AF223EF6928A580FA6F
Malicious:	false
Preview:	.P-file 2.4.. ...........3...........8.....n.4....&..B.h..G.E..`1V_.]2kX........F..."...~'......?<..K....Write...n.6....&..B.h..G.E..`1V_.]2k9g..G..we.F._.Co..3T.....LU.\|...n.7:g.....?.#..9.".......2k]..w+u.....J."...>.;.%...v?.-4.........../..B.h...........].k...7.5.CPa.....H9~.F..?Q.....K.).....##...ImB;s......S....G]...I.7.5..Ya.OLM..y~.......?......nW0..cC....-.. ..G#...$.....+..n.x....&..*.h..G.E..`1V_.4A.4h..X.....F.a.Vz..~'.....n.j....&...B.h...E..n1V_.]2k^........F..."...~'......?9..K..n.tU..t..f.B...,.M.......2kF..w.u.....L.k...>..%.s..v?:}.........../..B.`.......#...].kX..7.5.CVa..c...9~.Z...Q.....K.(.....#..&/,mB;n......S....\]...I.7\5..Qa.OKM..y~.......?....K..WZ..c....H-..o..G

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\ArbExpress Application.lnk

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Oct 8 05:34:59 2024, mtime=Tue Oct 8 05:35:00 2024, atime=Tue Jul 14 18:57:08 2020, length=2762752, window=hide
Category:	dropped
Size (bytes):	1385
Entropy (8bit):	4.553745797733391
Encrypted:	false
SSDEEP:	24:8mXM2JEqcdOEDDYjtYxjxJeAKfzdidfUUUPqygm:8m8pfdOLjtYxZKfzdidMgyg
MD5:	5BF7BB86FC3ED73BE70E2056B1ED5B52
SHA1:	85687D8E14C766C1F7EF40356DA12BD687B46E63
SHA-256:	D4D5EEBB889B178E79C10A90DE82FED68E5306702A5A09BFCD67E30F7D9536A4
SHA-512:	74EF111DE1062B8E66948510BDD2144EE6E50857D524C2636D54BD7240EF7C5529A63C94D55A25AD10148DF999CC9EA774278074F064AF9C19202B0669CB07E8
Malicious:	false
Preview:	L..................F.... ...=..2L....V:3L....Be..Z...(.....................?....P.O. .:i.....+00.../C:\.....................1.....HY\4..PROGRA~2.........O.IHY\4....................V.....a...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....HY\4..TEKTRO~1..D......HY\4HY\4....t)....................a...T.e.k.t.r.o.n.i.x.....^.1.....HYf4..ARBEXP~1..F......HY\4HYf4....{)....................a.v.A.r.b.E.x.p.r.e.s.s.....T.1.....HYg4..System..>......HY\4HYg4....~).....................i..S.y.s.t.e.m.....j.2..(..P$. .ARBEXP~1.EXE..N......HY`4HY`4.....)........................A.r.b.E.x.p.r.e.s.s...e.x.e.......p...............-.......o...........n.K......C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbExpress.exe..P.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.k.t.r.o.n.i.x.\.A.r.b.E.x.p.r.e.s.s.\.S.y.s.t.e.m.\.A.r.b.E.x.p.r.e.s.s...e.x.e.3.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.k.t.r.o.n.i.x.\.A.r.b

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\ArbExpress Help.lnk

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Oct 8 05:35:11 2024, mtime=Tue Oct 8 05:35:11 2024, atime=Fri Jan 10 17:51:28 2020, length=10408283, window=hide
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	4.663224963795364
Encrypted:	false
SSDEEP:	24:8lYPe2JEqcdOEDKYomtDxgdTAKfZdeVUUU/qygm:8l5pfdOGBtDxc0KfZdDQyg
MD5:	8153AB980965D875117ECFF11AAEBDF9
SHA1:	990C376B834565163FDAF7BDFA1606E7138DDE80
SHA-256:	D84621AB60CD726B0A7C5FDDBB9006B3CFD717A13488EBA3F10EF28AC098FFFA
SHA-512:	6CA6BCD07E327F1DFB84FED34B8C8439140EE10BC91B8593466D0BD7E9BBB9A7A092755359ED695C52BDD57CFD8A554ED2522C1F6CBCA014637355C2481C1C4E
Malicious:	false
Preview:	L..................F.... ..._C.9L......9L....x#.....[......................?....P.O. .:i.....+00.../C:\.....................1.....HY\4..PROGRA~2.........O.IHY\4....................V.....a...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....HY\4..TEKTRO~1..D......HY\4HY\4....t)....................a...T.e.k.t.r.o.n.i.x.....^.1.....HYg4..ARBEXP~1..F......HY\4HYh4....{).....................}..A.r.b.E.x.p.r.e.s.s.....T.1.....HYg4..System..>......HY\4HYg4....~).....................i..S.y.s.t.e.m.....j.2.[..Pn. .ARBEXP~1.CHM..N......HYf4HYf4.....<........................A.r.b.E.x.p.r.e.s.s...c.h.m.......p...............-.......o...........n.K......C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbExpress.chm..P.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.k.t.r.o.n.i.x.\.A.r.b.E.x.p.r.e.s.s.\.S.y.s.t.e.m.\.A.r.b.E.x.p.r.e.s.s...c.h.m.........................@Z\|...K.J.........`.......X.......134349.......

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\Documentation\ArbExpress Installation Manual.lnk

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1130
Entropy (8bit):	3.441176058939492
Encrypted:	false
SSDEEP:	12:8gl0Ca/ledp8e3lulK8uuVsShKxrk38K8uu+WGQmbdpYUwuXVzu+WGQCQ/CNUvHZ:8IdOmqDyk3bRpd9bQOUFqy
MD5:	AA163887D16C4172E26222360444C598
SHA1:	044EB02FCD542D8DE517CCE6331B7F906964CA8C
SHA-256:	0917860F44C33C2A53C2C80EF9E89600D452B7EA0AC1940E36BC050149E2EB63
SHA-512:	62EC75B9B08781642C60CBB3A3884D9ED9AAB401B25911BFFF7DBE35A00545606F29F3296487D9AA20C3B86BD9DE9A896699F48C8EEC5B7CECA126925693CB25
Malicious:	false
Preview:	L..................F........................................................u....P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...".\.1...........Tektronix.D............................................T.e.k.t.r.o.n.i.x.....`.1...........ArbExpress..F............................................A.r.b.E.x.p.r.e.s.s.....h.1...........Documentation.L............................................D.o.c.u.m.e.n.t.a.t.i.o.n.......2...........ArbExpress Installation Manual.pdf..v............................................A.r.b.E.x.p.r.e.s.s. .I.n.s.t.a.l.l.a.t.i.o.n. .M.a.n.u.a.l...p.d.f...2...n.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.k.t.r.o.n.i.x.\.A.r.b.E.x.p.r.e.s.s.\.D.o.c.u.m.e.n.t.a.t.i.o.n.\.A.r.b.E.x.p.r.e.s.s. .I.n.s.t.a.l.l.a.t.i.o.n. .M.a.n.u.a.l...p.d.f.........*................@Z\|...K.J.....................1SPS.XF.L8C...

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\Documentation\ArbExpress User Manual.lnk

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.41493412191966
Encrypted:	false
SSDEEP:	12:8gl0Ka/ledp8e3lulK8uuVsShKxlAxuuwIbdpYUwuXVzuwYQ/CNUvH4t2YZ/elFR:8AdOmqD8AFd9LOUFqy
MD5:	F357D518B7CA52309D632E16FB8354B7
SHA1:	114F1CEE40D8E2A6B36764D4A03EB43F66E35AF9
SHA-256:	19A189DF58A3C589BE8721B565402370585C761CE9B5EBD9E632EEF5E5D8C1AC
SHA-512:	C3F59B571D40B2F0DDFCA3E7872252ACB37B924E915BE64F3C0DBE392FF518AA0F1F4AFE3DBD4020F6BAAF7F4A23DCC15CE248AA50944F4802F5A220BCBDE668
Malicious:	false
Preview:	L..................F........................................................]....P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...".\.1...........Tektronix.D............................................T.e.k.t.r.o.n.i.x.....`.1...........ArbExpress..F............................................A.r.b.E.x.p.r.e.s.s.....h.1...........Documentation.L............................................D.o.c.u.m.e.n.t.a.t.i.o.n.......2...........ArbExpress User Manual.pdf..f............................................A.r.b.E.x.p.r.e.s.s. .U.s.e.r. .M.a.n.u.a.l...p.d.f......f.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.k.t.r.o.n.i.x.\.A.r.b.E.x.p.r.e.s.s.\.D.o.c.u.m.e.n.t.a.t.i.o.n.\.A.r.b.E.x.p.r.e.s.s. .U.s.e.r. .M.a.n.u.a.l...p.d.f.........................@Z\|...K.J.....................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\Release Notes.lnk

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	3.2980761871529274
Encrypted:	false
SSDEEP:	12:8gl0aa/ledp8e3lulK8uuV45IkYOlbdpYUwuAyZlQ/CNUvH4t2YZ/elFlSJm:8wdOmq6BJdMOUFqy
MD5:	30045E4D7E59BC0FEB333D9E2B5A3340
SHA1:	BA9FB255832A7A7DF2B25A2BFAFAD20BACD48EF0
SHA-256:	70983EFEF2066D33403187729DFB4D46DFF820341F2A60B4DE3C14377F46D7DF
SHA-512:	83EEFA92216203393A08EB82DDBFBC5D3B64353A945520DF69BEC7BAB26DB7A8F690DB7B8B080FBF2AA1FA8F956ADD2D42BD676AF1CDFDDE8AC51500188C0570
Malicious:	false
Preview:	L..................F........................................................-....P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...".\.1...........Tektronix.D............................................T.e.k.t.r.o.n.i.x.....`.1...........ArbExpress..F............................................A.r.b.E.x.p.r.e.s.s.....T.1...........System..>............................................S.y.s.t.e.m.....t.2...........Release Notes.doc.T............................................R.e.l.e.a.s.e. .N.o.t.e.s...d.o.c... ...S.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.k.t.r.o.n.i.x.\.A.r.b.E.x.p.r.e.s.s.\.S.y.s.t.e.m.\.R.e.l.e.a.s.e. .N.o.t.e.s...d.o.c.........*................@Z\|...K.J.....................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.............

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\Samples\Equations.lnk

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Directory, ctime=Tue Oct 8 05:35:08 2024, mtime=Tue Oct 8 05:35:08 2024, atime=Tue Oct 8 05:35:08 2024, length=12288, window=hide
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.553148988371639
Encrypted:	false
SSDEEP:	24:8mkNW22JEqcdOEDKYomt/ryvRrtCl3Rs54AyTfQd3lp5e4d3lp50UUUDqygm:8mqpfdOGBtj2rElB2mfQd3lO4d3lRkyg
MD5:	A554040F33473D70BE0C39678820AE45
SHA1:	4B7543CAEED0B19FD4563FA7B58B1D19CAF5C271
SHA-256:	C9A2BCBB34C5E584A0A39919AC03819AD8FA1111294439178341EB3A2973FE51
SHA-512:	1F668B755DE15DE217EE11F79B4A096F47AC512E30DD3F8BE7C257D73E536C7BD3EE04578FFB5F9A1AB583218B4EDDF257B5C3F4820F2D7876E948DC6D2A5A93
Malicious:	false
Preview:	L..................F........5..7L...'m.8L...'m.8L....0......................3....P.O. .:i.....+00.../C:\.....................1.....HY\4..PROGRA~2.........O.IHY\4....................V.....a...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....HY\4..TEKTRO~1..D......HY\4HY\4....t)....................a...T.e.k.t.r.o.n.i.x.....^.1.....HYg4..ARBEXP~1..F......HY\4HYh4....{).....................}..A.r.b.E.x.p.r.e.s.s.....V.1.....HYe4..Samples.@......HYe4HYe4....c)........................S.a.m.p.l.e.s.....\.1.....HYe4..EQUATI~1..D......HYe4HYe4.....)........................E.q.u.a.t.i.o.n.s.......l...............-.......k...........n.K......C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Equations..O.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.k.t.r.o.n.i.x.\.A.r.b.E.x.p.r.e.s.s.\.S.a.m.p.l.e.s.\.E.q.u.a.t.i.o.n.s.>.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.k.t.r.o.n.i.x.\.A.r.b.E.x.p.r.e.s.s.\.S

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\Samples\Waveforms.lnk

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Directory, ctime=Tue Oct 8 05:35:08 2024, mtime=Tue Oct 8 05:35:11 2024, atime=Tue Oct 8 05:35:11 2024, length=4096, window=hide
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.603720908692057
Encrypted:	false
SSDEEP:	24:8VhwD22JEqcdOEDKYomt/ryvRrtClKRLAyTfrd3lNUUUPqygm:8VFpfdOGBtj2rElA8mfrd3lOgyg
MD5:	9B1938FA0AD23F01CED60D727DD14949
SHA1:	0A5B88EF0870078CB65EE5D6CD470BCF2F2E58DE
SHA-256:	7F78247084B70C967EA9D52006557751A4BE5613D5040F1F0759EA1168E67278
SHA-512:	09AB4538DAC890CB8B3D51912CEEB72AE951A1D9969000207046F845B245727C65BA5D7763D59C7F7F38C56B4120D5383112FBD428F33CBF8FF5394DB7E787A2
Malicious:	false
Preview:	L..................F........'m.8L...wG.9L...wG.9L...........................3....P.O. .:i.....+00.../C:\.....................1.....HY\4..PROGRA~2.........O.IHY\4....................V.....a...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....HY\4..TEKTRO~1..D......HY\4HY\4....t)....................a...T.e.k.t.r.o.n.i.x.....^.1.....HYg4..ARBEXP~1..F......HY\4HYh4....{).....................}..A.r.b.E.x.p.r.e.s.s.....V.1.....HYe4..Samples.@......HYe4HYe4....c)........................S.a.m.p.l.e.s.....\.1.....HYe4..WAVEFO~1..D......HYe4HYe4....[.....................4..W.a.v.e.f.o.r.m.s.......l...............-.......k...........n.K......C:\Program Files (x86)\Tektronix\ArbExpress\Samples\Waveforms..O.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.k.t.r.o.n.i.x.\.A.r.b.E.x.p.r.e.s.s.\.S.a.m.p.l.e.s.\.W.a.v.e.f.o.r.m.s.........................@Z\|...K.J.........`.......X.......134349...........hT..CrF.f4...

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\Tools\Matlab.lnk

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Directory, ctime=Tue Oct 8 05:35:11 2024, mtime=Tue Oct 8 05:35:11 2024, atime=Tue Oct 8 05:35:11 2024, length=4096, window=hide
Category:	dropped
Size (bytes):	1350
Entropy (8bit):	4.543230354105075
Encrypted:	false
SSDEEP:	24:8maZzs2JEqcdOEDKYomtxs5yAJf5d0dgUUUPqygm:8myIpfdOGBtxiJf5d0dVAyg
MD5:	DC227E142D0B545705477ED220E9E3E7
SHA1:	876BD3C9E0C72EC1B05DEB0ABDA3E2CF8E952384
SHA-256:	8BF1D974E5C6E980AC88E54EED0EC91D94B252652E37E7D21EA655FDB60D6CB1
SHA-512:	50A1FB989005E2634043F57EF39F4FCA8CD7BB02036A91BB27BB2451C519A1159DDF562E7A1E4FB0F7B81DF7754886213E83E59E321FD2C049464D79E3834488
Malicious:	false
Preview:	L..................F...........9L....k.9L....k.9L...........................%....P.O. .:i.....+00.../C:\.....................1.....HY\4..PROGRA~2.........O.IHY\4....................V.....a...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....HY\4..TEKTRO~1..D......HY\4HY\4....t)....................a...T.e.k.t.r.o.n.i.x.....^.1.....HYg4..ARBEXP~1..F......HY\4HYh4....{).....................}..A.r.b.E.x.p.r.e.s.s.....P.1.....HYf4..Tools.<......HYf4HYf4.....+....................a.v.T.o.o.l.s.....T.1.....HYf4..Matlab..>......HYf4HYf4.....+....................:$K.M.a.t.l.a.b.......g...............-.......f...........n.K......C:\Program Files (x86)\Tektronix\ArbExpress\Tools\Matlab..J.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.k.t.r.o.n.i.x.\.A.r.b.E.x.p.r.e.s.s.\.T.o.o.l.s.\.M.a.t.l.a.b.9.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.k.t.r.o.n.i.x.\.A.r.b.E.x.p.r.e.s.s.\.T.o.o.l.s.\.M.a.t.l.a.b.\.....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tektronix ArbExpress\Uninstall ArbExpress.lnk

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Tue Oct 8 05:34:54 2024, mtime=Tue Oct 8 05:34:54 2024, atime=Tue Jul 14 19:32:56 2020, length=804352, window=hide
Category:	modified
Size (bytes):	2644
Entropy (8bit):	3.8894080788559786
Encrypted:	false
SSDEEP:	48:8CipfdOWSTZXXYMg3fbp0MdVTXXYhZdVTXXYH4dVTXXYh1ypFVTXXYhBAyg:8CGQXXqSwXeXpXFX2Ay
MD5:	BA103441E666040B641C8738DAAC4CE3
SHA1:	BBA6B1640FE0F94F529F016B153FD634F8DC2EF4
SHA-256:	484DE6567840B51E8DEB18981C1CB831E9284709D0119D10622E2F782785E548
SHA-512:	16F800A7A12AA7EC5FFAA74921A7C45B71ECF2A005E2FB09A00E744FF15A30BF758FE6D6AD8FEB788C447BFC01CE30D5D2509E819E2345009AA75774BE19E68A
Malicious:	false
Preview:	L..................F.@.. ....../L...Q../L........Z...F......................O....P.O. .:i.....+00.../C:\.....................1.....HY\4..PROGRA~2.........O.IHY\4....................V.....a...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.......1.....HY\4..INSTAL~1..~......HY\4HY\4.....)........................I.n.s.t.a.l.l.S.h.i.e.l.d. .I.n.s.t.a.l.l.a.t.i.o.n. .I.n.f.o.r.m.a.t.i.o.n.......1.....HY\4..{50457~1..~......HY\4HY\4.....).....................m..{.5.0.4.5.7.5.6.C.-.7.5.5.2.-.4.E.4.8.-.B.3.9.F.-.C.2.8.A.4.8.E.4.E.A.C.D.}.....\.2..F...P.. .setup.exe.D......HY\4HY\4....i)........................s.e.t.u.p...e.x.e.......................-...................n.K......C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setup.exe..}.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.I.n.s.t.a.l.l.S.h.i.e.l.d. .I.n.s.t.a.l.l.a.t.i.o.n. .I.n.f.o.r.m.a.t.i.o.n.\.{.5.0.4.5.7.5.6.C.

C:\Users\Public\Desktop\ArbExpress Application.lnk

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Oct 8 05:34:59 2024, mtime=Tue Oct 8 05:35:14 2024, atime=Tue Jul 14 18:57:08 2020, length=2762752, window=hide
Category:	dropped
Size (bytes):	1367
Entropy (8bit):	4.578517499347337
Encrypted:	false
SSDEEP:	24:8mXGW2JEqcdOEDKYomtDxjxJZ/AKfwdidfUUUPqygm:8mrpfdOGBtDxqKfwdidMgyg
MD5:	7815F960159C2F3AA248A3134A982797
SHA1:	CE4FCFA52058AD0636312EF53D48CBF939D1410A
SHA-256:	8A0C270A9555D78122D1D671CE38023582D711FA68E701B385F6A66A7503AD8F
SHA-512:	BE1A87DF089832E722ECA25E1C841BB8B5485B3062F527FF29693EF2284B91265B1694AD27878BEFE6DB46A2B76F8C19D355701B13D21D3C44F51209BDA1D9E7
Malicious:	false
Preview:	L..................F.... ...=..2L...d/.;L....Be..Z...(.....................?....P.O. .:i.....+00.../C:\.....................1.....HY\4..PROGRA~2.........O.IHY\4....................V.....a...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....HY\4..TEKTRO~1..D......HY\4HY\4....t)....................a...T.e.k.t.r.o.n.i.x.....^.1.....HYg4..ARBEXP~1..F......HY\4HYh4....{).....................}..A.r.b.E.x.p.r.e.s.s.....T.1.....HYg4..System..>......HY\4HYg4....~).....................i..S.y.s.t.e.m.....j.2..(..P$. .ARBEXP~1.EXE..N......HY`4HYa4.....)........................A.r.b.E.x.p.r.e.s.s...e.x.e.......p...............-.......o...........n.K......C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbExpress.exe..G.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.k.t.r.o.n.i.x.\.A.r.b.E.x.p.r.e.s.s.\.S.y.s.t.e.m.\.A.r.b.E.x.p.r.e.s.s...e.x.e.3.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.k.t.r.o.n.i.x.\.A.r.b.E.x.p.r.e.s.s.\.S

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\DotNetInstaller.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	654
Entropy (8bit):	5.221124782773253
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10U26K9EsUBF51K9Vi0U29xtUz1B0U2uk71K6xhk70Uj7hBck6v:MLF2CpI326KuLF51K229Iz52VMj4B
MD5:	B3A1EAF1DE51A999113D0F0B150C2EFD
SHA1:	79892F4A2D76BDC1E5EBD5E105C2E45E8B2207CC
SHA-256:	08B8DECCF24156D50E42638FEA1C7461A1CFB78848B32BD87434901BEFA102CE
SHA-512:	816EDF7A334732CDD50C85F4036701211D5E75AE6AF3BA53CDB24C3402E2A5E0C2F2E9BAF92CBDFDE528AD34267F7ABC0FFBE636525EB4A74280F984C0BD32D2
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\25c2833ce29881dfbe170558e9e6b073\System.Configuration.Install.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\f4b409548f4799c2d8461ba7f4818be2\Accessibility.ni.dll",0..

C:\Users\user\AppData\Local\Temp\8f5b.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	304128
Entropy (8bit):	2.777174706338683
Encrypted:	false
SSDEEP:	3072:HKaD0Ngzsd8RqY/ix4K5cC3NACuBCfuIdRdxMchpkgK/WXVhc1ESEBnz/JK583Fd:4YY
MD5:	55F27335F7FBF56D3DF0E69CCA8AF0D3
SHA1:	02FCE2AABEB9DF93165CE7106D0BD0B2BBE02396
SHA-256:	3E36E75EE10F078730CF3287541AAF18E8C6B987D7F6FEEB12BDB8CC12CA031C
SHA-512:	45542479BFF56D437DA88975A5DE313A6F5EE975384532F503DDFE0490EFFEC33DCCBD7BE2324E9A4B03BE80AE798D3772F79568D2ED9D52C54E92A1EAF91CC2
Malicious:	false
Preview:	......................>.......................................................v............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... .......&..._...!..."...#...$...%...'...(...5...?...*...+...,...-......./...0...1...2...3...4...V...6...7...8...9...:...;...<...=...>...@...Z...A...]...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y.......[...\...^...`...a.......b...c.......m...e...f...g...h...i...j...k...l...n...p...o...q...r...s...t.......u...........x...y...z...

C:\Users\user\AppData\Local\Temp\ispr9120.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Atari MSA archive data, -11636 sectors per track, starting track: 22332, ending track: 3470
Category:	dropped
Size (bytes):	259693
Entropy (8bit):	6.692274993753087
Encrypted:	false
SSDEEP:	6144:qsIKmUhmFIr3hq5aKN+mpcSjP23O3yjlD3trv0:UaNU
MD5:	5B26FDB5A5A3B6C06F591B358F970236
SHA1:	8E817F8AA8CDB649C1566AB12F513A6E1404988D
SHA-256:	9561957AC4300F51E48C55E907DAB6F94A5EA98A2AA221C055FBE463618DFE71
SHA-512:	47519049B4048DC7AA2FF3898FF1CF06858F6310454969B6DD8192D4B0DC7C32A854A83C8BFD19DEA7EDB1623D6B296D8526B7352A17C680C78D148AD2129EA4
Malicious:	false
Preview:	.....W<.....%.K.....^N.....".UX.4..\%.z4.f..e'{%.w=$4F;f...4..6.%.v....1.. B/.c..r.>..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X.....*y..:....X..:y\.x...1..i7......O.}..v....44.:...zqr^........w..C..f....@0.....@.J....oqs..a7...!.S..o.].`w.....l@o..Qb~A...e.,ROvA..f...!.b.:..)...H...t.M+...i'..r..VQ.1..(.t......Q

C:\Users\user\AppData\Local\Temp\skin8e5.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Generic INItialization configuration [ALL]
Category:	dropped
Size (bytes):	25527
Entropy (8bit):	4.801368694271482
Encrypted:	false
SSDEEP:	192:Rp4NNm9MNfLrOlD52MzFwFeSAWak8VeuGPy4fcPB3jhe7fnoJgX7I7N:Rp4NNm+NU
MD5:	DB0B65FBB51667D25B39FAF77C9EBB52
SHA1:	56482F2FAF50568D37FB133D5ACD25A4F93D428F
SHA-256:	4C10EF89B1B745CB68D6D527BCD197339B5DF82AC32C962133D1CB6E6C6BDB24
SHA-512:	D1A9E2A0F47FBB19522FFBF4A9CA1DC49330E3619C78EE1A57D1CEA868C25F698A0DB9F13A51C2FDB41553F71D744D17809E45BF526994D9314B3507288F624D
Malicious:	false
Preview:	[SKINS]..VERSION=1....[ALL]..TEXTCOLOR=255,255,255..RECTS=2..RECT1=0,51,102..RECT1POS=0,0..RECT1AREA=460,35..RECT2=61,102,171..RECT2POS=0,35..RECT2AREA=460,280..IMAGES=3..IMAGE1=LeftSplash2.BMP..IMAGE1POS=0,35..IMAGE1OPT=SCALE,UPPER_LEFT..IMAGE2=TopDivider.gif..IMAGE2POS=0,35..IMAGE2OPT=SCALE,HCENTER,UPPER_LEFT..IMAGE3=Console2.gif..IMAGE3POS=0,0..IMAGE3OPT=SCALE,LOWER_LEFT..BUTTONSUP=ButtonNormal.gif..BUTTONSDOWN=ButtonPushed.gif..BUTTONSOPT=SCALE,TRANSPARENT..BUTTONSTXTCLR=0,0,0..BUTTONSDISTXTCLR=96,104,112..BUTTONS=4..BUTTON1=12..BUTTON1POS=195,284..BUTTON2=1..BUTTON2POS=250,284..BUTTON3=9..BUTTON3POS=400,284..BUTTON4=2..BUTTON4POS=400,284....[AskPath]..BUTTONS=4..BUTTON1=12..BUTTON1POS=195,284..BUTTON2=1..BUTTON2POS=250,284..BUTTON3=9..BUTTON3POS=400,284..BUTTON4=31..BUTTON4POS=390,112....[AskDestPath]..BUTTONS=4..BUTTON1=12..BUTTON1POS=195,284..BUTTON2=1..BUTTON2POS=250,284..BUTTON3=9..BUTTON3POS=400,284..BUTTON4=196..BUTTON4POS=390,231....[ComponentDialog]..BUTTONS=4..BUTTON1=12.

C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\0x0409.ini

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	22492
Entropy (8bit):	3.484893836872466
Encrypted:	false
SSDEEP:	384:CTmyuV//BiTbh/G4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/z/lWr0aa0Mhs+XVgv
MD5:	BE345D0260AE12C5F2F337B17E07C217
SHA1:	0976BA0982FE34F1C35A0974F6178E15C238ED7B
SHA-256:	E994689A13B9448C074F9B471EDEEC9B524890A0D82925E98AB90B658016D8F3
SHA-512:	77040DBEE29BE6B136A83B9E444D8B4F71FF739F7157E451778FB4FCCB939A67FF881A70483DE16BCB6AE1FEA64A89E00711A33EC26F4D3EEA8E16C9E9553EFF
Malicious:	false
Preview:	..[.0.x.0.4.0.9.].....1.1.0.0.=.S.e.t.u.p. .I.n.i.t.i.a.l.i.z.a.t.i.o.n. .E.r.r.o.r.....1.1.0.1.=.%.s.....1.1.0.2.=.%.1. .S.e.t.u.p. .i.s. .p.r.e.p.a.r.i.n.g. .t.h.e. .%.2.,. .w.h.i.c.h. .w.i.l.l. .g.u.i.d.e. .y.o.u. .t.h.r.o.u.g.h. .t.h.e. .p.r.o.g.r.a.m. .s.e.t.u.p. .p.r.o.c.e.s.s... . .P.l.e.a.s.e. .w.a.i.t.......1.1.0.3.=.C.h.e.c.k.i.n.g. .O.p.e.r.a.t.i.n.g. .S.y.s.t.e.m. .V.e.r.s.i.o.n.....1.1.0.4.=.C.h.e.c.k.i.n.g. .W.i.n.d.o.w.s.(.R.). .I.n.s.t.a.l.l.e.r. .V.e.r.s.i.o.n.....1.1.0.5.=.C.o.n.f.i.g.u.r.i.n.g. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r.....1.1.0.6.=.C.o.n.f.i.g.u.r.i.n.g. .%.s.....1.1.0.7.=.S.e.t.u.p. .h.a.s. .c.o.m.p.l.e.t.e.d. .c.o.n.f.i.g.u.r.i.n.g. .t.h.e. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. .o.n. .y.o.u.r. .s.y.s.t.e.m... .T.h.e. .s.y.s.t.e.m. .n.e.e.d.s. .t.o. .b.e. .r.e.s.t.a.r.t.e.d. .i.n. .o.r.d.e.r. .t.o. .c.o.n.t.i.n.u.e. .w.i.t.h. .t.h.e. .i.n.s.t.a.l.l.a.t.i.o.n... .P.l.e.a.s.e. .c.l.i.c.k. .R.e.s.t.a.r.t. .t.o. .r.e.b.o.o.t. .t.h.e. .s.y.s.t.e.m.......1.1.0.8.

C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\Disk1\0x0409.ini

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	22492
Entropy (8bit):	3.484893836872466
Encrypted:	false
SSDEEP:	384:CTmyuV//BiTbh/G4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/z/lWr0aa0Mhs+XVgv
MD5:	BE345D0260AE12C5F2F337B17E07C217
SHA1:	0976BA0982FE34F1C35A0974F6178E15C238ED7B
SHA-256:	E994689A13B9448C074F9B471EDEEC9B524890A0D82925E98AB90B658016D8F3
SHA-512:	77040DBEE29BE6B136A83B9E444D8B4F71FF739F7157E451778FB4FCCB939A67FF881A70483DE16BCB6AE1FEA64A89E00711A33EC26F4D3EEA8E16C9E9553EFF
Malicious:	false
Preview:	..[.0.x.0.4.0.9.].....1.1.0.0.=.S.e.t.u.p. .I.n.i.t.i.a.l.i.z.a.t.i.o.n. .E.r.r.o.r.....1.1.0.1.=.%.s.....1.1.0.2.=.%.1. .S.e.t.u.p. .i.s. .p.r.e.p.a.r.i.n.g. .t.h.e. .%.2.,. .w.h.i.c.h. .w.i.l.l. .g.u.i.d.e. .y.o.u. .t.h.r.o.u.g.h. .t.h.e. .p.r.o.g.r.a.m. .s.e.t.u.p. .p.r.o.c.e.s.s... . .P.l.e.a.s.e. .w.a.i.t.......1.1.0.3.=.C.h.e.c.k.i.n.g. .O.p.e.r.a.t.i.n.g. .S.y.s.t.e.m. .V.e.r.s.i.o.n.....1.1.0.4.=.C.h.e.c.k.i.n.g. .W.i.n.d.o.w.s.(.R.). .I.n.s.t.a.l.l.e.r. .V.e.r.s.i.o.n.....1.1.0.5.=.C.o.n.f.i.g.u.r.i.n.g. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r.....1.1.0.6.=.C.o.n.f.i.g.u.r.i.n.g. .%.s.....1.1.0.7.=.S.e.t.u.p. .h.a.s. .c.o.m.p.l.e.t.e.d. .c.o.n.f.i.g.u.r.i.n.g. .t.h.e. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. .o.n. .y.o.u.r. .s.y.s.t.e.m... .T.h.e. .s.y.s.t.e.m. .n.e.e.d.s. .t.o. .b.e. .r.e.s.t.a.r.t.e.d. .i.n. .o.r.d.e.r. .t.o. .c.o.n.t.i.n.u.e. .w.i.t.h. .t.h.e. .i.n.s.t.a.l.l.a.t.i.o.n... .P.l.e.a.s.e. .c.l.i.c.k. .R.e.s.t.a.r.t. .t.o. .r.e.b.o.o.t. .t.h.e. .s.y.s.t.e.m.......1.1.0.8.

C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\Disk1\ISSetup.dll

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Category:	dropped
Size (bytes):	579584
Entropy (8bit):	7.6477409990124645
Encrypted:	false
SSDEEP:	6144:/Fi43SaRsu0xho+Qvv0QhHxcul05EtXdosFRJrTy6kbdXLOvZ9sNSOVJEmY7ixzF:Lz0Y1d05EtXtFR9G6IcZZxsxzpKpHgT
MD5:	B9D4678348F9D7FEF94C11DABD782960
SHA1:	F2CA4A7B784F856ED7BDC9E9337544B35D69C9A3
SHA-256:	1FAC3AA23390131843952C1E91AEBD0B6944EA65A2C271E36D288752890E9070
SHA-512:	D0206DA19972504E9513639BF0BB2E14D155951ABDE07F579B34F1D2063010C765D44C0F343D673F42DC5C661B1234F096B29654B268CC2EC46756AFC6AE3CE6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.....b...b...b.}.n...b...l...b.i.i...b.X.i...b.5.G...b...~...b...{...b...c...b.0.h...b.0.i...b...d...b...f...b.Rich..b.........PE..L...i=VL...........!.................X...............................................7..............................<T......\|V.......`..4....................p.......................................................................................text....P..............PEC2MO...... ....rsrc........`...................... ....reloc.......p......................@...........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\Disk1\Setup.bmp

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PC bitmap, Windows 3.x format, 688 x 463 x 24, image size 955632, resolution 2834 x 2834 px/m, cbSize 955686, bits offset 54
Category:	dropped
Size (bytes):	955686
Entropy (8bit):	5.249397671368493
Encrypted:	false
SSDEEP:	12288:L8PRxvPxklDgYxsTLx0CDpS9fSu0iv+6vB:orvAESsTLx08pS9fSu0+B
MD5:	80EF6C85B644F2D21AB2EC6CC09F48FE
SHA1:	E45B027A0E6DC66534FDA2528FC0DA6B7D50C16F
SHA-256:	2DD11A7D9027E89BDB78BD4A28C076E1D49D9F2177535CB6ACB34C0860B9A621
SHA-512:	0D0DE9D6310D29E909ACE8085D1F0E1D47FA709C29D2FCF9F14BF26F97742285A7BEAA50482C233535F6B6B46705F3D18B3758AC433FE41849FC8A1CC6E98BF6
Malicious:	false
Preview:	BM&.......6...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\Disk1\data1.cab

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	530911
Entropy (8bit):	7.9957712300000505
Encrypted:	true
SSDEEP:	12288:4lqL4JImTqN0rGADWWv1ia2UrYFGK9HZT5:UURm165Wv1iN9L
MD5:	1026CFC15528C7E2D265B52AAD685B9D
SHA1:	28972EBF5554F278AE5480AEF91A7A7F97C59D3D
SHA-256:	51893753F8FD66A5ADD439B4AF1F5EA10E02FE37F163CEEDBA81D4FC2C182B9E
SHA-512:	96B6C3E2A2EA2E3C20EC1A1E7D3CB9CBAD0482CCAF3E0ABC6742600C08A625B9594D450FCA2EC43E38D0BB12D94826E6A3C9CF33A96C597EF0EEFD31BF314B3D
Malicious:	false
Preview:	ISc(.........................................................................................................................................................................................................................................................................................................................................................................................luEPRuHN...H....................l.....L.E..OU..P......I..,0V...M.W...G..E...........................................................XQs.F.~^W.?L...Vi...[.%dsA......b$...2.e...{..Z.Jee`z.........$...E..'/.E.L.(..........O.Um+s.S.d..R.2.~..].DSU..k....T.~....O..A.nL{PeS.......}.G.0N.....M..b.E. z..$~H...R1_%Q.>.tu./...,..8.E*.h&.q4.. .R.....z.wB...?./v#,\...E~2...).coF[..U....._.E.$..,..4.S..f^... ..0\|w.'.3.......l.......h...a[..>..i.....Y..>.'.p...N.-9A...:..+..Q.D.....!J..1....,\s.{:.)9.h..Q.$..3.>\....4...2<..Ad.?.M.3..Q..,k...ms.F..}'.fS...<3......(E.a...m.T.e.V....!XW..,..-/..lD^......S..

C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\Disk1\data1.hdr

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	InstallShield CAB
Category:	dropped
Size (bytes):	32419
Entropy (8bit):	3.6015666237649064
Encrypted:	false
SSDEEP:	768:hbaIZIO6SaJvst5gp8XA/lNH2Z2yYNLp6:hxeW3Ss
MD5:	C00BBD1327C6D7041A281BE5FB18CA1E
SHA1:	C9C76C6BCC724C1531FB850167F0D65315673766
SHA-256:	6E2E032966B8732E93996A96C12F579377648EA803FA065FED900F6655F1872F
SHA-512:	DA26F7F26A0C4844523838A1626AF939178F5C77893EE039D4C40AC01A1B852DB6FFC863854320B8AA9D04439140D41839906539C48AE2129EBEA377B706ECA4
Malicious:	false
Preview:	ISc(............>?...~..........................................................................B~.........................................................................................................................................................................................................................................................................................luEPRuHN...H....................l.....L.E..OU..P......I..,0V...M.W...G..E....................................................................>?......e=..e=............................................b.......n.......z..................................................................................................................."...............:...F...R...............................................^.......j.......................v.......................................................................................................................................................................*...........6.

C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\Disk1\layout.bin

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	606
Entropy (8bit):	2.042463363702611
Encrypted:	false
SSDEEP:	6:UwRGUlfEnalMZF2CzJthelhCnanl8JDWLNglETl127n:U2zlfzla2w1aRlQyBE
MD5:	85E08C293EF716E68706D1F6D8C060BE
SHA1:	7F41B99FBC629C15E7DFA6DFE04895EE023707A3
SHA-256:	9DBDE49A20CAC223A0680E6A88B6B33EDF0F35CF5CE4A15A0D7D419E6A2E722B
SHA-512:	999F9A90575B299795BE6C19F13FB667668BB3D11542792EA0965E693C54D158E2477F4DDDD37C408008DB82F3373AAB5A05034795327E594FD44C13E1E56DA3
Malicious:	false
Preview:	c..S.@..^...........@....................................................................................................................................................................................................................................................... ...L...............x............................... ...4...H...............................................s.e.t.u.p...i.n.i.....s.e.t.u.p...e.x.e...S.e.t.u.p...b.m.p...s.e.t.u.p...i.n.x...s.e.t.u.p...i.s.n...I.S.S.e.t.u.p...d.l.l...0.x.0.4.0.9...i.n.i...d.a.t.a.1...h.d.r...d.a.t.a.1...c.a.b...d.a.t.a.2...c.a.b...l.a.y.o.u.t...b.i.n...

C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\Disk1\setup.exe

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	804352
Entropy (8bit):	6.5947838380291275
Encrypted:	false
SSDEEP:	12288:f3QOlnoHw/BVWJ0kVrOSknpcfAA3dF3q4NP:f37noQ/BVcN6P2tQ4NP
MD5:	F037C2B0C1EB809C474EECFCB820F997
SHA1:	543B57630595D55BCF6C38BA5B11F7D0B770DF30
SHA-256:	1C07774BA5D0543F9109D8D67B8AB991F32B8DFA440787DE57E339BBC2073816
SHA-512:	CE86A018D827F4E63E150A19680EE2EE36C65A070B7EE700796BD5330B552C55FC9730416FDEB5B2F52BC906E7FC09E52CFE5441E33C8913816C14C0B69F38C8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`&...H...H...H...D...H.U.F...H...C...H..'B._.H..y...H.."T...H..#m...H...I...H.,"Q...H..'C...H...N...H.Rich..H.........................PE..L....=VL.................P..........}........`....@..........................................................................$..........x............................................................................`...............................text...cN.......P.................. ..`.rdata..V....`.......T..............@..@.data...$....P.......8..............@....rsrc...x...........................@..@........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\Disk1\setup.ini

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2456
Entropy (8bit):	3.6725407729186026
Encrypted:	false
SSDEEP:	48:rsAMapXYD5xibcPTmscu/+S8gvn6CJkkY09TzcqYtxkYOvl5ZAMXvrcOyb0pn:rsAMaXPcrmqrvnp6kY05w7tCYOvlnAMn
MD5:	6DD6AF0025691CD415234E63A59FB00B
SHA1:	19BAD7981EACD8AB6132BC747ED71D11AD13FDCE
SHA-256:	05F3257D331575BD32DD31D479582AFDEB9466496E2D384FF16E7EB537B86893
SHA-512:	BB456B6418B7F5C728AEA06046A5946C0461AEE96BAA06C8BD6F467BE1C8B83B08FE4278ADEA0EC608B1A70E40CC5041F7A2B2963C03B13E5C6A90F04445DC3A
Malicious:	false
Preview:	..[.S.t.a.r.t.u.p.].....P.r.o.d.u.c.t.=.T.e.k.t.r.o.n.i.x. .A.r.b.E.x.p.r.e.s.s.......P.r.o.d.u.c.t.G.U.I.D.=.5.0.4.5.7.5.6.C.-.7.5.5.2.-.4.E.4.8.-.B.3.9.F.-.C.2.8.A.4.8.E.4.E.A.C.D.....C.o.m.p.a.n.y.N.a.m.e.=.T.e.k.t.r.o.n.i.x.....C.o.m.p.a.n.y.U.R.L.=.h.t.t.p.:././.w.w.w...T.e.k.t.r.o.n.i.x...c.o.m.....E.r.r.o.r.R.e.p.o.r.t.U.R.L.=.h.t.t.p.:././.w.w.w...i.n.s.t.a.l.l.s.h.i.e.l.d...c.o.m./.i.s.e.t.u.p./.P.r.o.E.r.r.o.r.C.e.n.t.r.a.l...a.s.p.?.E.r.r.o.r.C.o.d.e.=.%.d. .:. .0.x.%.x.&.E.r.r.o.r.I.n.f.o.=.%.s.....M.e.d.i.a.F.o.r.m.a.t.=.1.....L.o.g.M.o.d.e.=.1.....S.k.i.n.=.s.e.t.u.p...i.s.n.....S.m.a.l.l.P.r.o.g.r.e.s.s.=.N.....S.p.l.a.s.h.T.i.m.e.=.....C.h.e.c.k.M.D.5.=.Y.....C.m.d.L.i.n.e.=.....S.h.o.w.P.a.s.s.w.o.r.d.D.i.a.l.o.g.=.N.....S.c.r.i.p.t.D.r.i.v.e.n.=.4.........[.L.a.n.g.u.a.g.e.s.].....D.e.f.a.u.l.t.=.0.x.0.4.0.9.....S.u.p.p.o.r.t.e.d.=.0.x.0.4.0.9.....R.e.q.u.i.r.e.E.x.a.c.t.L.a.n.g.M.a.t.c.h.=.0.x.0.4.0.4.,.0.x.0.8.0.4.....R.T.L.L.a.n.g.s.=.0.x.0.4.0.1.,.0.x.0.4.0.d.....

C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\Disk1\setup.inx

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	246914
Entropy (8bit):	7.384542988989865
Encrypted:	false
SSDEEP:	3072:jboSoC531QrAcXoLqmRemqmZNCGqgzADb2EZ01m+qM8fvXzq7vy51QiabTeUL+9U:jboNCpiYGGNCd+uC67CTeVHJE
MD5:	9F8490DD84FDDECA54D6F14F25870974
SHA1:	ED5998423E45E47D67E7ABFA9D304D81E1C5C164
SHA-256:	2DEFD9BD3F762CE684820242B72605FF9D1C96EDE0B12932B5C3C970F5ADFF8F
SHA-512:	CBC6575408171D438BA590F39B49A2551C9F2EF1F29B4222205D2934A32084137E59FED3A8EAE7C494BA021318AE76906365F89DA23C3E84F11F2B9C29FA4269
Malicious:	false
Preview:	t.,....(... <$.M. .=..........l.............o.c...gWSl..SW..WS[//d.d l$.XX%.......................q.y}a@!mQ.Y]A..M1%*)!.)........................................}...m..q]}.eMm.U=].E-M.5.=.%.-..............................U......q..8...X...iaaUi.@..MEE)M..wSk..g....._.c.33o/.......<...H..$....,.h......m..X........E]].E....wg.S[wSS.....K./C3W.$H`P(.......H.$.....u..a...0x$...5mAYY.A....ck.cc.k.W.g/......;.oX0 .T,.0,,...........\......q..Yq... ....1II.1....W.k[k.......#...d<$@<<......8... ,\|$..`......1q.$.............!!!.)g.K.Ow.;_.....#.<4l.P....L.....\|,...........Y..D..P......1II.1.......C..cW{.......?.TDl....0X......$...$....D...iu.1u.0.T...s.....)!.).C.K3.3S#k.C7[.....8.L<D.<.4.,(....q.....H..\.iaaMi........p%==.%c.C.G;{{0........XHP.h<@........,..(......X...A}y]a.sD.....5I=55)=s.._.....7GO...../OlT(.....X.................y.eqqey...]UU5]..w{...-%%.-O.G.[.....O.k.tH......4(L...............u..au...YmAYY)A.g k.so.Kk......w'.g#+;+[. ..<T.

C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\Disk1\setup.isn

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Atari MSA archive data, -11636 sectors per track, starting track: 22332, ending track: 3470
Category:	dropped
Size (bytes):	259693
Entropy (8bit):	6.692274993753087
Encrypted:	false
SSDEEP:	6144:qsIKmUhmFIr3hq5aKN+mpcSjP23O3yjlD3trv0:UaNU
MD5:	5B26FDB5A5A3B6C06F591B358F970236
SHA1:	8E817F8AA8CDB649C1566AB12F513A6E1404988D
SHA-256:	9561957AC4300F51E48C55E907DAB6F94A5EA98A2AA221C055FBE463618DFE71
SHA-512:	47519049B4048DC7AA2FF3898FF1CF06858F6310454969B6DD8192D4B0DC7C32A854A83C8BFD19DEA7EDB1623D6B296D8526B7352A17C680C78D148AD2129EA4
Malicious:	false
Preview:	.....W<.....%.K.....^N.....".UX.4..\%.z4.f..e'{%.w=$4F;f...4..6.%.v....1.. B/.c..r.>..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X.....*y..:....X..:y\.x...1..i7......O.}..v....44.:...zqr^........w..C..f....@0.....@.J....oqs..a7...!.S..o.].`w.....l@o..Qb~A...e.,ROvA..f...!.b.:..)...H...t.M+...i'..r..VQ.1..(.t......Q

C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\setup.ini

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2456
Entropy (8bit):	3.6725407729186026
Encrypted:	false
SSDEEP:	48:rsAMapXYD5xibcPTmscu/+S8gvn6CJkkY09TzcqYtxkYOvl5ZAMXvrcOyb0pn:rsAMaXPcrmqrvnp6kY05w7tCYOvlnAMn
MD5:	6DD6AF0025691CD415234E63A59FB00B
SHA1:	19BAD7981EACD8AB6132BC747ED71D11AD13FDCE
SHA-256:	05F3257D331575BD32DD31D479582AFDEB9466496E2D384FF16E7EB537B86893
SHA-512:	BB456B6418B7F5C728AEA06046A5946C0461AEE96BAA06C8BD6F467BE1C8B83B08FE4278ADEA0EC608B1A70E40CC5041F7A2B2963C03B13E5C6A90F04445DC3A
Malicious:	false
Preview:	..[.S.t.a.r.t.u.p.].....P.r.o.d.u.c.t.=.T.e.k.t.r.o.n.i.x. .A.r.b.E.x.p.r.e.s.s.......P.r.o.d.u.c.t.G.U.I.D.=.5.0.4.5.7.5.6.C.-.7.5.5.2.-.4.E.4.8.-.B.3.9.F.-.C.2.8.A.4.8.E.4.E.A.C.D.....C.o.m.p.a.n.y.N.a.m.e.=.T.e.k.t.r.o.n.i.x.....C.o.m.p.a.n.y.U.R.L.=.h.t.t.p.:././.w.w.w...T.e.k.t.r.o.n.i.x...c.o.m.....E.r.r.o.r.R.e.p.o.r.t.U.R.L.=.h.t.t.p.:././.w.w.w...i.n.s.t.a.l.l.s.h.i.e.l.d...c.o.m./.i.s.e.t.u.p./.P.r.o.E.r.r.o.r.C.e.n.t.r.a.l...a.s.p.?.E.r.r.o.r.C.o.d.e.=.%.d. .:. .0.x.%.x.&.E.r.r.o.r.I.n.f.o.=.%.s.....M.e.d.i.a.F.o.r.m.a.t.=.1.....L.o.g.M.o.d.e.=.1.....S.k.i.n.=.s.e.t.u.p...i.s.n.....S.m.a.l.l.P.r.o.g.r.e.s.s.=.N.....S.p.l.a.s.h.T.i.m.e.=.....C.h.e.c.k.M.D.5.=.Y.....C.m.d.L.i.n.e.=.....S.h.o.w.P.a.s.s.w.o.r.d.D.i.a.l.o.g.=.N.....S.c.r.i.p.t.D.r.i.v.e.n.=.4.........[.L.a.n.g.u.a.g.e.s.].....D.e.f.a.u.l.t.=.0.x.0.4.0.9.....S.u.p.p.o.r.t.e.d.=.0.x.0.4.0.9.....R.e.q.u.i.r.e.E.x.a.c.t.L.a.n.g.M.a.t.c.h.=.0.x.0.4.0.4.,.0.x.0.8.0.4.....R.T.L.L.a.n.g.s.=.0.x.0.4.0.1.,.0.x.0.4.0.d.....

C:\Users\user\AppData\Local\Temp\{3AC6FFEA-3778-4530-BBC2-4614DD352102}\setup.isn

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Atari MSA archive data, -11636 sectors per track, starting track: 22332, ending track: 3470
Category:	dropped
Size (bytes):	259693
Entropy (8bit):	6.692274993753087
Encrypted:	false
SSDEEP:	6144:qsIKmUhmFIr3hq5aKN+mpcSjP23O3yjlD3trv0:UaNU
MD5:	5B26FDB5A5A3B6C06F591B358F970236
SHA1:	8E817F8AA8CDB649C1566AB12F513A6E1404988D
SHA-256:	9561957AC4300F51E48C55E907DAB6F94A5EA98A2AA221C055FBE463618DFE71
SHA-512:	47519049B4048DC7AA2FF3898FF1CF06858F6310454969B6DD8192D4B0DC7C32A854A83C8BFD19DEA7EDB1623D6B296D8526B7352A17C680C78D148AD2129EA4
Malicious:	false
Preview:	.....W<.....%.K.....^N.....".UX.4..\%.z4.f..e'{%.w=$4F;f...4..6.%.v....1.. B/.c..r.>..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X..:...X.....*y..:....X..:y\.x...1..i7......O.}..v....44.:...zqr^........w..C..f....@0.....@.J....oqs..a7...!.S..o.].`w.....l@o..Qb~A...e.,ROvA..f...!.b.:..)...H...t.M+...i'..r..VQ.1..(.t......Q

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBE9026.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	107392
Entropy (8bit):	5.976686564124204
Encrypted:	false
SSDEEP:	1536:XDEbW8/KCWYxcnGP48IA2h+k3ZLZwyzHoAoS5RQjKRyVCUA:XDEKrScnS4rAI+wnHoAoS5RT2A
MD5:	B83D2774CDAF5016CD8765A630FA1150
SHA1:	50B7F86488926C6B06322AF6A5176E4C7786058D
SHA-256:	4935372DAA99F6C10033ACCF0CD6403B6F7061477500C1EB65D7CA2DEDBCBFD8
SHA-512:	90FD6C47D658491ACFD54A1CB7D76BB01C3E6F58B4DF4466998411D73E497A305DAC13798182448289052F836C92958CA42B69BB14549D51AEA4A0F92E665727
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,0.hQ..hQ..hQ..a)..&Q..a)..bQ..a)..CQ..O...iQ..O...gQ..hQ...Q..a)..kQ..v...iQ..a)..iQ..RichhQ..........PE..d...F=VL..........#..................}.........@....................................e%.......................................................V..........`............................................................................................................text...~........................... ..`.rdata..rb.......d..................@..@.data....*...p.......R..............@....pdata...............j..............@..@.rsrc...`............z..............@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	107392
Entropy (8bit):	5.976686564124204
Encrypted:	false
SSDEEP:	1536:XDEbW8/KCWYxcnGP48IA2h+k3ZLZwyzHoAoS5RQjKRyVCUA:XDEKrScnS4rAI+wnHoAoS5RT2A
MD5:	B83D2774CDAF5016CD8765A630FA1150
SHA1:	50B7F86488926C6B06322AF6A5176E4C7786058D
SHA-256:	4935372DAA99F6C10033ACCF0CD6403B6F7061477500C1EB65D7CA2DEDBCBFD8
SHA-512:	90FD6C47D658491ACFD54A1CB7D76BB01C3E6F58B4DF4466998411D73E497A305DAC13798182448289052F836C92958CA42B69BB14549D51AEA4A0F92E665727
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,0.hQ..hQ..hQ..a)..&Q..a)..bQ..a)..CQ..O...iQ..O...gQ..hQ...Q..a)..kQ..v...iQ..a)..iQ..RichhQ..........PE..d...F=VL..........#..................}.........@....................................e%.......................................................V..........`............................................................................................................text...~........................... ..`.rdata..rb.......d..................@..@.data....*...p.......R..............@....pdata...............j..............@..@.rsrc...`............z..............@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\core9007.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	65503
Entropy (8bit):	3.783333450686201
Encrypted:	false
SSDEEP:	1536:biZVg/LPnypGccYM3MFe/Xvv+JcvpqLm416lt91FHWEi7I8qQdeVH3+HF2FnlP5r:gW/LPni+3MFe/XycRj4slt9HHWEi7I8M
MD5:	09D38CECA6A012F4CE5B54F03DB9B21A
SHA1:	01FCB72F22205E406FF9A48C5B98D7B7457D7D98
SHA-256:	F6D7BC8CA6550662166F34407968C7D3669613E50E98A4E40BEC1589E74FF5D1
SHA-512:	8C73CA3AF53A9BAF1B9801F87A8FF759DA9B40637A86567C6CC10AB491ACCB446B40C8966807BD06D52EB57384E2D6A4886510DE338019CFD7EF966B45315BA9
Malicious:	false
Preview:	; Corecomp.ini..;..; This file stores information about files that InstallShield..; will install to the Windows\System folder, such as Windows..; 95 and NT 4.0 core components and DAO, ODBC, and ActiveX files...; ..; The entries have the following format, without a space before ..; or after the equal sign:..;..; <file name>=<properties>..; ..; Currently, following properties are supported:..; 0x00000000 No registry entry is created for this file. It is..; not logged for uninstallation, and is therefore ..; never removed...;..; Inappropriate modification to this file can prevent an..; application from getting Windows 95/Windows NT logo...;..; Last Updated: 2/27/2002; rs....[Win32]....12500852.cpx=0x00000000 ..12510866.cpx=0x00000000 ..12520437.cpx=0x00000000..12520850.cpx=0x00000000..12520860.cpx=0x00000000..12520861.cpx=0x00000000 ..12520863.cpx=0x00000000 ..12520865.cpx=0x00000000..6to4svc.dll=0x00000000..82557ndi.dll=0x00000000..8514a.dll=0x000

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\corecomp.ini (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	65503
Entropy (8bit):	3.783333450686201
Encrypted:	false
SSDEEP:	1536:biZVg/LPnypGccYM3MFe/Xvv+JcvpqLm416lt91FHWEi7I8qQdeVH3+HF2FnlP5r:gW/LPni+3MFe/XycRj4slt9HHWEi7I8M
MD5:	09D38CECA6A012F4CE5B54F03DB9B21A
SHA1:	01FCB72F22205E406FF9A48C5B98D7B7457D7D98
SHA-256:	F6D7BC8CA6550662166F34407968C7D3669613E50E98A4E40BEC1589E74FF5D1
SHA-512:	8C73CA3AF53A9BAF1B9801F87A8FF759DA9B40637A86567C6CC10AB491ACCB446B40C8966807BD06D52EB57384E2D6A4886510DE338019CFD7EF966B45315BA9
Malicious:	false
Preview:	; Corecomp.ini..;..; This file stores information about files that InstallShield..; will install to the Windows\System folder, such as Windows..; 95 and NT 4.0 core components and DAO, ODBC, and ActiveX files...; ..; The entries have the following format, without a space before ..; or after the equal sign:..;..; <file name>=<properties>..; ..; Currently, following properties are supported:..; 0x00000000 No registry entry is created for this file. It is..; not logged for uninstallation, and is therefore ..; never removed...;..; Inappropriate modification to this file can prevent an..; application from getting Windows 95/Windows NT logo...;..; Last Updated: 2/27/2002; rs....[Win32]....12500852.cpx=0x00000000 ..12510866.cpx=0x00000000 ..12520437.cpx=0x00000000..12520850.cpx=0x00000000..12520860.cpx=0x00000000..12520861.cpx=0x00000000 ..12520863.cpx=0x00000000 ..12520865.cpx=0x00000000..6to4svc.dll=0x00000000..82557ndi.dll=0x00000000..8514a.dll=0x000

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotn9017.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11152
Entropy (8bit):	5.897352517059274
Encrypted:	false
SSDEEP:	192:Bw77flawuDuQd02NwyowJL/ZUW+ebCfKB5Qpkqs1IlJM3m:ANDQd02NwYJLGYbCCn1zm
MD5:	8F50951DC767385E6E9801ECACC621E3
SHA1:	468A8E65EBCF871198A67B478941645089A72557
SHA-256:	F3C2471DF257575D0668DDDFD0C2F805E4B3236BC546255E6CAA2C813E914A52
SHA-512:	C2CADF398BBA369D27A0C78D4C613F3B41E1D84A7E8B1A2A24E5D60F92A4D23E15BA9382816009C5476016DE12D110FD1852A45BD605408CD70C557B9FD49B7C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...6=VL............................>... ...@....@.. .......................................................................)..K....@.......................`....................................................... ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................ ......H.......8"...............................................................0..?........(......,%s..........,....o.....+...o............&..&.................11..........14...............................0..W.......s................r...p.....(......s.......o.....,...o......o....+...o......&..&...............EK..........EN...............................0...................i.>..........i.1s...+g......o......r...po....,..r...po....-....r...po....,..r...po....-....r...po....,..r#.

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11152
Entropy (8bit):	5.897352517059274
Encrypted:	false
SSDEEP:	192:Bw77flawuDuQd02NwyowJL/ZUW+ebCfKB5Qpkqs1IlJM3m:ANDQd02NwYJLGYbCCn1zm
MD5:	8F50951DC767385E6E9801ECACC621E3
SHA1:	468A8E65EBCF871198A67B478941645089A72557
SHA-256:	F3C2471DF257575D0668DDDFD0C2F805E4B3236BC546255E6CAA2C813E914A52
SHA-512:	C2CADF398BBA369D27A0C78D4C613F3B41E1D84A7E8B1A2A24E5D60F92A4D23E15BA9382816009C5476016DE12D110FD1852A45BD605408CD70C557B9FD49B7C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...6=VL............................>... ...@....@.. .......................................................................)..K....@.......................`....................................................... ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................ ......H.......8"...............................................................0..?........(......,%s..........,....o.....+...o............&..&.................11..........14...............................0..W.......s................r...p.....(......s.......o.....,...o......o....+...o......&..&...............EK..........EN...............................0...................i.>..........i.1s...+g......o......r...po....,..r...po....-....r...po....,..r...po....-....r...po....,..r#.

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\DIFx9007.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.638552692098388
Encrypted:	false
SSDEEP:	3:m1eAsIdWVVVWhs6E2QVVK2Whsyor3Vg2Wn:mdv0am2QVVgQ3Van
MD5:	1EB6253DEE328C2063CA12CF657BE560
SHA1:	46E01BCBB287873CF59C57B616189505D2BB1607
SHA-256:	6BC8B890884278599E4C0CA4095CEFDF0F5394C5796012D169CC0933E03267A1
SHA-512:	7C573896ABC86D899AFBCE720690454C06DBFAFA97B69BC49B8E0DDEC5590CE16F3CC1A30408314DB7C4206AA95F5C684A6587EA2DA033AECC4F70720FC6189E
Malicious:	false
Preview:	[<Properties>]..DIFx32Supported=No..DIFxIntel64Supported=No..DIFxAMD64Supported=No..

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\DIFxData.ini (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.638552692098388
Encrypted:	false
SSDEEP:	3:m1eAsIdWVVVWhs6E2QVVK2Whsyor3Vg2Wn:mdv0am2QVVgQ3Van
MD5:	1EB6253DEE328C2063CA12CF657BE560
SHA1:	46E01BCBB287873CF59C57B616189505D2BB1607
SHA-256:	6BC8B890884278599E4C0CA4095CEFDF0F5394C5796012D169CC0933E03267A1
SHA-512:	7C573896ABC86D899AFBCE720690454C06DBFAFA97B69BC49B8E0DDEC5590CE16F3CC1A30408314DB7C4206AA95F5C684A6587EA2DA033AECC4F70720FC6189E
Malicious:	false
Preview:	[<Properties>]..DIFx32Supported=No..DIFxIntel64Supported=No..DIFxAMD64Supported=No..

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\Font8ff7.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.175273297885966
Encrypted:	false
SSDEEP:	3:m1eAsCMWRXBQYrD:mdjXIYf
MD5:	8CE28395A49EB4ADA962F828ECA2F130
SHA1:	270730E2969B8B03DB2A08BA93DFE60CBFB36C5F
SHA-256:	A7E91B042CE33490353C00244C0420C383A837E73E6006837A60D3C174102932
SHA-512:	BB712043CDDBE62B5BFDD79796299B0C4DE0883A39F79CD006D3B04A1A2BED74B477DF985F7A89B653E20CB719B94FA255FDAA0819A8C6180C338C01F39B8382
Malicious:	false
Preview:	[<Properties>]..FontRegistration=No..

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\FontData.ini (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.175273297885966
Encrypted:	false
SSDEEP:	3:m1eAsCMWRXBQYrD:mdjXIYf
MD5:	8CE28395A49EB4ADA962F828ECA2F130
SHA1:	270730E2969B8B03DB2A08BA93DFE60CBFB36C5F
SHA-256:	A7E91B042CE33490353C00244C0420C383A837E73E6006837A60D3C174102932
SHA-512:	BB712043CDDBE62B5BFDD79796299B0C4DE0883A39F79CD006D3B04A1A2BED74B477DF985F7A89B653E20CB719B94FA255FDAA0819A8C6180C338C01F39B8382
Malicious:	false
Preview:	[<Properties>]..FontRegistration=No..

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\Stri9045.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10794
Entropy (8bit):	3.7718133428363454
Encrypted:	false
SSDEEP:	192:w6Psa1xfLjpTOtmeYja1jxW45MsJkKm5UOZNPbX3BQUtHyPKYRJRWRHEFvtOev:wva1xHpTUHmmn
MD5:	4D08D91965F75CF4D8F22015DDC8A8DE
SHA1:	769A3C1F91A3198DCDFA5DD080C276F3688632D1
SHA-256:	9904B14B5F94BCB6D0F4BD7E9694467274331F62B4144B1263C95631AE5EBA7A
SHA-512:	E548C71CC69468A50FB9A7DAF866CF9DF0FA4DC0D9DF71FDEC8047E3EA3BB771727F96592568B4816839493FD7B6C2E7746E03BC35419411F8011370FEB1ED5E
Malicious:	false
Preview:	..[.S.t.r.i.n.g.T.a.b.l.e.:.D.a.t.a.:.0.4.0.9.].....A.F.G.3.0.0.0._.F.I.L.E._.D.E.S.C.R.I.P.T.I.O.N.=.T.e.k.t.r.o.n.i.x. .A.F.G.3.0.0.0./.A.r.b.E.x.p.r.e.s.s. .F.i.l.e.....A.R.B.E.X.P.R.E.S.S._.A.P.P.L.I.C.A.T.I.O.N.=.A.r.b.E.x.p.r.e.s.s...e.x.e.....A.R.B.E.X.P.R.E.S.S._.F.I.L.E._.D.E.S.C.R.I.P.T.I.O.N.=.T.e.k.t.r.o.n.i.x. .A.r.b.E.x.p.r.e.s.s. .F.i.l.e.....A.R.B.E.X.P.R.E.S.S._.F.I.L.E._.E.X.T.E.N.S.I.O.N.=...w.f.m.....A.R.B.E.X.P.R.E.S.S._.F.I.L.E._.I.C.O.N._.I.N.D.E.X.=.0.....A.R.B.E.X.P.R.E.S.S._.F.I.L.E._.I.D.=.A.r.b.E.x.p.r.e.s.s...D.o.c.u.m.e.n.t.....A.R.B.E.X.P.R.E.S.S._.T.F.W._.F.I.L.E._.E.X.T.E.N.S.I.O.N.=...t.f.w.....I.D.P.R.O.P._.S.E.T.U.P.T.Y.P.E._.C.O.M.P.L.E.T.E.=.C.o.m.p.l.e.t.e.....I.D.P.R.O.P._.S.E.T.U.P.T.Y.P.E._.C.O.M.P.L.E.T.E._.D.E.S.C.=.C.o.m.p.l.e.t.e.....I.D.P.R.O.P._.S.E.T.U.P.T.Y.P.E._.C.U.S.T.O.M.=.C.u.s.t.o.m.....I.D.P.R.O.P._.S.E.T.U.P.T.Y.P.E._.C.U.S.T.O.M._.D.E.S.C._.P.R.O.=.C.u.s.t.o.m.....I.D.S._.D.O.T.N.E.T._.F.R.A.M.E.W.O.R.K.=.M.i.c.r.o.s.o.f.t. ...

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\StringTable_0x0409.ips (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10794
Entropy (8bit):	3.7718133428363454
Encrypted:	false
SSDEEP:	192:w6Psa1xfLjpTOtmeYja1jxW45MsJkKm5UOZNPbX3BQUtHyPKYRJRWRHEFvtOev:wva1xHpTUHmmn
MD5:	4D08D91965F75CF4D8F22015DDC8A8DE
SHA1:	769A3C1F91A3198DCDFA5DD080C276F3688632D1
SHA-256:	9904B14B5F94BCB6D0F4BD7E9694467274331F62B4144B1263C95631AE5EBA7A
SHA-512:	E548C71CC69468A50FB9A7DAF866CF9DF0FA4DC0D9DF71FDEC8047E3EA3BB771727F96592568B4816839493FD7B6C2E7746E03BC35419411F8011370FEB1ED5E
Malicious:	false
Preview:	..[.S.t.r.i.n.g.T.a.b.l.e.:.D.a.t.a.:.0.4.0.9.].....A.F.G.3.0.0.0._.F.I.L.E._.D.E.S.C.R.I.P.T.I.O.N.=.T.e.k.t.r.o.n.i.x. .A.F.G.3.0.0.0./.A.r.b.E.x.p.r.e.s.s. .F.i.l.e.....A.R.B.E.X.P.R.E.S.S._.A.P.P.L.I.C.A.T.I.O.N.=.A.r.b.E.x.p.r.e.s.s...e.x.e.....A.R.B.E.X.P.R.E.S.S._.F.I.L.E._.D.E.S.C.R.I.P.T.I.O.N.=.T.e.k.t.r.o.n.i.x. .A.r.b.E.x.p.r.e.s.s. .F.i.l.e.....A.R.B.E.X.P.R.E.S.S._.F.I.L.E._.E.X.T.E.N.S.I.O.N.=...w.f.m.....A.R.B.E.X.P.R.E.S.S._.F.I.L.E._.I.C.O.N._.I.N.D.E.X.=.0.....A.R.B.E.X.P.R.E.S.S._.F.I.L.E._.I.D.=.A.r.b.E.x.p.r.e.s.s...D.o.c.u.m.e.n.t.....A.R.B.E.X.P.R.E.S.S._.T.F.W._.F.I.L.E._.E.X.T.E.N.S.I.O.N.=...t.f.w.....I.D.P.R.O.P._.S.E.T.U.P.T.Y.P.E._.C.O.M.P.L.E.T.E.=.C.o.m.p.l.e.t.e.....I.D.P.R.O.P._.S.E.T.U.P.T.Y.P.E._.C.O.M.P.L.E.T.E._.D.E.S.C.=.C.o.m.p.l.e.t.e.....I.D.P.R.O.P._.S.E.T.U.P.T.Y.P.E._.C.U.S.T.O.M.=.C.u.s.t.o.m.....I.D.P.R.O.P._.S.E.T.U.P.T.Y.P.E._.C.U.S.T.O.M._.D.E.S.C._.P.R.O.=.C.u.s.t.o.m.....I.D.S._.D.O.T.N.E.T._.F.R.A.M.E.W.O.R.K.=.M.i.c.r.o.s.o.f.t. ...

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\_isr90a3.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	389120
Entropy (8bit):	5.523712660311275
Encrypted:	false
SSDEEP:	3072:bfJCQc/skkkkknOpb9YfMX0E9QsJB9cWe7Ka29stSyfQonN+kh:bhEskkkkknOpKluaufuNT
MD5:	74F3C0FE8CAE9F03BF2A1AA3A0407D01
SHA1:	C3C154F0BBD508483D58C2CB78498689F7B7C192
SHA-256:	1D2F9BB9B2F0612265F9606D2A08889229FAF75D2F9F32CE048C5891C1F9F99A
SHA-512:	ACF7A94E8E20C87AB16EDAF56C51AD99178AF30AD2DDED93652A27AD95B09D6D448BF7821419EB447108C7F603E2467857D8C318DDCF7FBBA15F7E3DBE13CC1E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r...6...6...6......."...........6...w......5.......5.....7...Rich6...................PE..L....QVL...........!.....@...................P...............................................................................V..(........A...........................................................................P...............................text...Z?.......@.................. ..`.rdata.......P.......P..............@..@.data... 1...`...0...`..............@....rsrc....A.......P..................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\_isres_0x0409.dll (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	389120
Entropy (8bit):	5.523712660311275
Encrypted:	false
SSDEEP:	3072:bfJCQc/skkkkknOpb9YfMX0E9QsJB9cWe7Ka29stSyfQonN+kh:bhEskkkkknOpKluaufuNT
MD5:	74F3C0FE8CAE9F03BF2A1AA3A0407D01
SHA1:	C3C154F0BBD508483D58C2CB78498689F7B7C192
SHA-256:	1D2F9BB9B2F0612265F9606D2A08889229FAF75D2F9F32CE048C5891C1F9F99A
SHA-512:	ACF7A94E8E20C87AB16EDAF56C51AD99178AF30AD2DDED93652A27AD95B09D6D448BF7821419EB447108C7F603E2467857D8C318DDCF7FBBA15F7E3DBE13CC1E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r...6...6...6......."...........6...w......5.......5.....7...Rich6...................PE..L....QVL...........!.....@...................P...............................................................................V..(........A...........................................................................P...............................text...Z?.......@.................. ..`.rdata.......P.......P..............@..@.data... 1...`...0...`..............@....rsrc....A.......P..................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\_isu9094.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.034678937378336
Encrypted:	false
SSDEEP:	48:KaGQhetcZeXHLtrmlUR0L5ZrlwKcycwIhtrlrB+2htz9I:5l6BrMUuLb9QzPW
MD5:	22D161C26445E007F499C71039DF15E1
SHA1:	039DCB8FE6B2C84485DC0F6854530DEF26353ECC
SHA-256:	76D38656DB2FB9195B74C0A5ADD0FDE5E89C7C0ABBB5C54A68BE4E89CAAFFA1A
SHA-512:	440134930FC0EDEE1599FE4CEB0F2B8DD8A2857188303C4CA6C717BAFB7524CEE742450DD84CBE519C56D66E0F0747D4A2B88287B4419DE88D8FE3A67D1082CF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L....m._...........!......... ...............................................0..........................................................`.................... .......................................................................................rsrc...`...........................@..@.reloc....... ....... ..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\_isuser_0x0409.dll (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.034678937378336
Encrypted:	false
SSDEEP:	48:KaGQhetcZeXHLtrmlUR0L5ZrlwKcycwIhtrlrB+2htz9I:5l6BrMUuLb9QzPW
MD5:	22D161C26445E007F499C71039DF15E1
SHA1:	039DCB8FE6B2C84485DC0F6854530DEF26353ECC
SHA-256:	76D38656DB2FB9195B74C0A5ADD0FDE5E89C7C0ABBB5C54A68BE4E89CAAFFA1A
SHA-512:	440134930FC0EDEE1599FE4CEB0F2B8DD8A2857188303C4CA6C717BAFB7524CEE742450DD84CBE519C56D66E0F0747D4A2B88287B4419DE88D8FE3A67D1082CF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L....m._...........!......... ...............................................0..........................................................`.................... .......................................................................................rsrc...`...........................@..@.reloc....... ....... ..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\defa9084.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	RIFF (little-endian) data, palette, 1168 bytes, data size 1028, 256 entries, extra bytes 0x6f66666c
Category:	dropped
Size (bytes):	1168
Entropy (8bit):	2.551387347019812
Encrypted:	false
SSDEEP:	12:b126a96IlDkYTYcspSuB0MRG763GDwFGrZYOFBz3WI7KEpw3f6QL7nhem:Ax96Il9T3ISMg76KJrZtT2b5X
MD5:	0ABAFE3F69D053494405061DE2629C82
SHA1:	E414B6F1E9EB416B9895012D24110B844F9F56D1
SHA-256:	8075162DB275EB52F5D691B15FC0D970CB007F5BECE33CE5DB509EDF51C1F020
SHA-512:	63448F2BEF338EA44F3BF9EF35E594EF94B4259F3B2595D77A836E872129B879CEF912E23CF48421BABF1208275E21DA1FABFDC494958BCFCD391C78308EAA27
Malicious:	false
Preview:	RIFF....PAL data..........................................................f...3..............f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3............f...3...............f...3..................f...3...............f..3.....f...f...f...ff..f3..f...3...3...3...3f..33..3................f...3...................f...3..................f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3................f...3.....f...f...f...f.f.f.3.f...f...f...f..f.f.f.3.f...f...f...f...f.i.f.3.f...ff..ff..ff..fff.ff3.ff..f3..f3..f3..f3f.f33.f3..f...f...f...f.f.f.3.f...3...3...3...3.f.3.3.3...3...3...3..3.f.3.3.3...3...3...3...3.f.3.3.3...3f..3f..3f..3ff.3f3.3f..33..33..33..33f.333.33..3...3...3...3.f.3.3.3.............f...3..............f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3............f...3.........................................................................................................

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\default.pal (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	RIFF (little-endian) data, palette, 1168 bytes, data size 1028, 256 entries, extra bytes 0x6f66666c
Category:	dropped
Size (bytes):	1168
Entropy (8bit):	2.551387347019812
Encrypted:	false
SSDEEP:	12:b126a96IlDkYTYcspSuB0MRG763GDwFGrZYOFBz3WI7KEpw3f6QL7nhem:Ax96Il9T3ISMg76KJrZtT2b5X
MD5:	0ABAFE3F69D053494405061DE2629C82
SHA1:	E414B6F1E9EB416B9895012D24110B844F9F56D1
SHA-256:	8075162DB275EB52F5D691B15FC0D970CB007F5BECE33CE5DB509EDF51C1F020
SHA-512:	63448F2BEF338EA44F3BF9EF35E594EF94B4259F3B2595D77A836E872129B879CEF912E23CF48421BABF1208275E21DA1FABFDC494958BCFCD391C78308EAA27
Malicious:	false
Preview:	RIFF....PAL data..........................................................f...3..............f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3............f...3...............f...3..................f...3...............f..3.....f...f...f...ff..f3..f...3...3...3...3f..33..3................f...3...................f...3..................f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3................f...3.....f...f...f...f.f.f.3.f...f...f...f..f.f.f.3.f...f...f...f...f.i.f.3.f...ff..ff..ff..fff.ff3.ff..f3..f3..f3..f3f.f33.f3..f...f...f...f.f.f.3.f...3...3...3...3.f.3.3.3...3...3...3..3.f.3.3.3...3...3...3...3.f.3.3.3...3f..3f..3f..3ff.3f3.3f..33..33..33..33f.333.33..3...3...3...3.f.3.3.3.............f...3..............f...3...................f...3......f...f...f...ff..f3..f...3...3...3...3f..33..3............f...3.........................................................................................................

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\isrt.dll (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Category:	dropped
Size (bytes):	265080
Entropy (8bit):	7.943414176526729
Encrypted:	false
SSDEEP:	6144:4w2aRHD/ToBCIqR8qJsDW9L4yR3OSc27xbOuU0j+2zu:4iPG3DWqyR3a27x6un+Ou
MD5:	3795427182D2DC8CE5609A342BC65313
SHA1:	0E53A85D991526A9191D3B0F3007363B3649FAF0
SHA-256:	F82E52E2A5176C01312F95B300B66AB1D2A0B0BC2556500C8F42A61390CC49CD
SHA-512:	6C3669B38B67EE37D99F452AD6B0F58102FD0DB952E9F146B8E0EC409CE5BC61052D4CDB23C2EED4183B18BAF529C86AC95BAE420A90908D58D5F4399B0E1B76
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.yo...<...<...<...<...<p..<...<...<...<U..<...<=..<...<d..<...<..<...<8.2<...<..<...<...<...<=..<X..<..<...<...<...<Rich...<........PE..L....=VL...........!.....p..........(6.......................................`......xH.......................................3..........................x....P.......................................................................................text...................PEC2MO...... ....rsrc....@.......2.................. ....reloc.......P......................@...................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\isrt9045.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Category:	dropped
Size (bytes):	265080
Entropy (8bit):	7.943414176526729
Encrypted:	false
SSDEEP:	6144:4w2aRHD/ToBCIqR8qJsDW9L4yR3OSc27xbOuU0j+2zu:4iPG3DWqyR3a27x6un+Ou
MD5:	3795427182D2DC8CE5609A342BC65313
SHA1:	0E53A85D991526A9191D3B0F3007363B3649FAF0
SHA-256:	F82E52E2A5176C01312F95B300B66AB1D2A0B0BC2556500C8F42A61390CC49CD
SHA-512:	6C3669B38B67EE37D99F452AD6B0F58102FD0DB952E9F146B8E0EC409CE5BC61052D4CDB23C2EED4183B18BAF529C86AC95BAE420A90908D58D5F4399B0E1B76
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.yo...<...<...<...<...<p..<...<...<...<U..<...<=..<...<d..<...<..<...<8.2<...<..<...<...<...<=..<X..<..<...<...<...<Rich...<........PE..L....=VL...........!.....p..........(6.......................................`......xH.......................................3..........................x....P.......................................................................................text...................PEC2MO...... ....rsrc....@.......2.................. ....reloc.......P......................@...................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\lice8ff7.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with very long lines (707), with CRLF line terminators
Category:	dropped
Size (bytes):	6460
Entropy (8bit):	5.02098414757129
Encrypted:	false
SSDEEP:	96:wR5U3WeZg0nmRHp/cghbzd0jzpCI/YdT0MUbtYIg6MKLXMtQLALA:sgnmH/c0+pJAd9b6Fj0AuA
MD5:	5EBE2A05F5D3D8B86FF7364D5B6289B0
SHA1:	A0428F939028E25DE7E4619B7BFF2512A1E9E761
SHA-256:	7C34201DF96FDCB5C88897D480F07074F77FD29A6B26ECA01D684B331385D831
SHA-512:	A55FF416077403AE408116A87DB5BA84D4C750F399003BC1FCEFC8D8E73F79256F7F37648CFD49BFB377E3F562CBC7FA7276F680BE6049035128860694FE1CA8
Malicious:	false
Preview:	TEKTRONIX SOFTWARE LICENSE AGREEMENT..(Waveform Creation and Editing tool for Tektronix AWG/AFG instruments)....THE ENCLOSED OR ACCOMPANYING PROGRAM IS FURNISHED SUBJECT TO THE TERMS AND CONDITIONS OF THIS AGREEMENT. USE OF THE PROGRAM IN ANY MANNER, DOWNLOADING AND UNPACKING THE PROGRAM FROM ITS COMPRESSED STATE OR INSTALLING THE PROGRAM FROM A CD WILL BE CONSIDERED ACCEPTANCE OF THE AGREEMENT TERMS. IF THESE TERMS ARE NOT ACCEPTABLE, THE UNUSED PROGRAM AND ANY ACCOMPANYING DOCUMENTATION SHOULD BE RETURNED PROMPTLY TO TEKTRONIX FOR A REFUND OF ANY LICENSE FEE PAID FOR THE PROGRAM.....DEFINITIONS..."Program" means the software program accompanying this Agreement....."Customer" means the person or organization that downloaded the Program or to whom the Program was otherwise furnished by Tektronix.....LICENSE...Customer may:..a..Use the Program on any machine owned or controlled by Customer solely for use with instruments manufactured or marketed by Tektronix;..b..Copy the Program for

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\license.txt (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	ASCII text, with very long lines (707), with CRLF line terminators
Category:	dropped
Size (bytes):	6460
Entropy (8bit):	5.02098414757129
Encrypted:	false
SSDEEP:	96:wR5U3WeZg0nmRHp/cghbzd0jzpCI/YdT0MUbtYIg6MKLXMtQLALA:sgnmH/c0+pJAd9b6Fj0AuA
MD5:	5EBE2A05F5D3D8B86FF7364D5B6289B0
SHA1:	A0428F939028E25DE7E4619B7BFF2512A1E9E761
SHA-256:	7C34201DF96FDCB5C88897D480F07074F77FD29A6B26ECA01D684B331385D831
SHA-512:	A55FF416077403AE408116A87DB5BA84D4C750F399003BC1FCEFC8D8E73F79256F7F37648CFD49BFB377E3F562CBC7FA7276F680BE6049035128860694FE1CA8
Malicious:	false
Preview:	TEKTRONIX SOFTWARE LICENSE AGREEMENT..(Waveform Creation and Editing tool for Tektronix AWG/AFG instruments)....THE ENCLOSED OR ACCOMPANYING PROGRAM IS FURNISHED SUBJECT TO THE TERMS AND CONDITIONS OF THIS AGREEMENT. USE OF THE PROGRAM IN ANY MANNER, DOWNLOADING AND UNPACKING THE PROGRAM FROM ITS COMPRESSED STATE OR INSTALLING THE PROGRAM FROM A CD WILL BE CONSIDERED ACCEPTANCE OF THE AGREEMENT TERMS. IF THESE TERMS ARE NOT ACCEPTABLE, THE UNUSED PROGRAM AND ANY ACCOMPANYING DOCUMENTATION SHOULD BE RETURNED PROMPTLY TO TEKTRONIX FOR A REFUND OF ANY LICENSE FEE PAID FOR THE PROGRAM.....DEFINITIONS..."Program" means the software program accompanying this Agreement....."Customer" means the person or organization that downloaded the Program or to whom the Program was otherwise furnished by Tektronix.....LICENSE...Customer may:..a..Use the Program on any machine owned or controlled by Customer solely for use with instruments manufactured or marketed by Tektronix;..b..Copy the Program for

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setu8f9a.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	246914
Entropy (8bit):	7.384542988989865
Encrypted:	false
SSDEEP:	3072:jboSoC531QrAcXoLqmRemqmZNCGqgzADb2EZ01m+qM8fvXzq7vy51QiabTeUL+9U:jboNCpiYGGNCd+uC67CTeVHJE
MD5:	9F8490DD84FDDECA54D6F14F25870974
SHA1:	ED5998423E45E47D67E7ABFA9D304D81E1C5C164
SHA-256:	2DEFD9BD3F762CE684820242B72605FF9D1C96EDE0B12932B5C3C970F5ADFF8F
SHA-512:	CBC6575408171D438BA590F39B49A2551C9F2EF1F29B4222205D2934A32084137E59FED3A8EAE7C494BA021318AE76906365F89DA23C3E84F11F2B9C29FA4269
Malicious:	false
Preview:	t.,....(... <$.M. .=..........l.............o.c...gWSl..SW..WS[//d.d l$.XX%.......................q.y}a@!mQ.Y]A..M1%*)!.)........................................}...m..q]}.eMm.U=].E-M.5.=.%.-..............................U......q..8...X...iaaUi.@..MEE)M..wSk..g....._.c.33o/.......<...H..$....,.h......m..X........E]].E....wg.S[wSS.....K./C3W.$H`P(.......H.$.....u..a...0x$...5mAYY.A....ck.cc.k.W.g/......;.oX0 .T,.0,,...........\......q..Yq... ....1II.1....W.k[k.......#...d<$@<<......8... ,\|$..`......1q.$.............!!!.)g.K.Ow.;_.....#.<4l.P....L.....\|,...........Y..D..P......1II.1.......C..cW{.......?.TDl....0X......$...$....D...iu.1u.0.T...s.....)!.).C.K3.3S#k.C7[.....8.L<D.<.4.,(....q.....H..\.iaaMi........p%==.%c.C.G;{{0........XHP.h<@........,..(......X...A}y]a.sD.....5I=55)=s.._.....7GO...../OlT(.....X.................y.eqqey...]UU5]..w{...-%%.-O.G.[.....O.k.tH......4(L...............u..au...YmAYY)A.g k.so.Kk......w'.g#+;+[. ..<T.

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setup.inx (copy)

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	data
Category:	dropped
Size (bytes):	246914
Entropy (8bit):	7.384542988989865
Encrypted:	false
SSDEEP:	3072:jboSoC531QrAcXoLqmRemqmZNCGqgzADb2EZ01m+qM8fvXzq7vy51QiabTeUL+9U:jboNCpiYGGNCd+uC67CTeVHJE
MD5:	9F8490DD84FDDECA54D6F14F25870974
SHA1:	ED5998423E45E47D67E7ABFA9D304D81E1C5C164
SHA-256:	2DEFD9BD3F762CE684820242B72605FF9D1C96EDE0B12932B5C3C970F5ADFF8F
SHA-512:	CBC6575408171D438BA590F39B49A2551C9F2EF1F29B4222205D2934A32084137E59FED3A8EAE7C494BA021318AE76906365F89DA23C3E84F11F2B9C29FA4269
Malicious:	false
Preview:	t.,....(... <$.M. .=..........l.............o.c...gWSl..SW..WS[//d.d l$.XX%.......................q.y}a@!mQ.Y]A..M1%*)!.)........................................}...m..q]}.eMm.U=].E-M.5.=.%.-..............................U......q..8...X...iaaUi.@..MEE)M..wSk..g....._.c.33o/.......<...H..$....,.h......m..X........E]].E....wg.S[wSS.....K./C3W.$H`P(.......H.$.....u..a...0x$...5mAYY.A....ck.cc.k.W.g/......;.oX0 .T,.0,,...........\......q..Yq... ....1II.1....W.k[k.......#...d<$@<<......8... ,\|$..`......1q.$.............!!!.)g.K.Ow.;_.....#.<4l.P....L.....\|,...........Y..D..P......1II.1.......C..cW{.......?.TDl....0X......$...$....D...iu.1u.0.T...s.....)!.).C.K3.3S#k.C7[.....8.L<D.<.4.,(....q.....H..\.iaaMi........p%==.%c.C.G;{{0........XHP.h<@........,..(......X...A}y]a.sD.....5I=55)=s.._.....7GO...../OlT(.....X.................y.eqqey...]UU5]..w{...-%%.-O.G.[.....O.k.tH......4(L...............u..au...YmAYY)A.g k.so.Kk......w'.g#+;+[. ..<T.

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\{5045756C-7552-4E48-B39F-C28A48E4EACD}\skin913f.rra

Download File

Process:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
File Type:	Generic INItialization configuration [ALL]
Category:	dropped
Size (bytes):	25527
Entropy (8bit):	4.801368694271482
Encrypted:	false
SSDEEP:	192:Rp4NNm9MNfLrOlD52MzFwFeSAWak8VeuGPy4fcPB3jhe7fnoJgX7I7N:Rp4NNm+NU
MD5:	DB0B65FBB51667D25B39FAF77C9EBB52
SHA1:	56482F2FAF50568D37FB133D5ACD25A4F93D428F
SHA-256:	4C10EF89B1B745CB68D6D527BCD197339B5DF82AC32C962133D1CB6E6C6BDB24
SHA-512:	D1A9E2A0F47FBB19522FFBF4A9CA1DC49330E3619C78EE1A57D1CEA868C25F698A0DB9F13A51C2FDB41553F71D744D17809E45BF526994D9314B3507288F624D
Malicious:	false
Preview:	[SKINS]..VERSION=1....[ALL]..TEXTCOLOR=255,255,255..RECTS=2..RECT1=0,51,102..RECT1POS=0,0..RECT1AREA=460,35..RECT2=61,102,171..RECT2POS=0,35..RECT2AREA=460,280..IMAGES=3..IMAGE1=LeftSplash2.BMP..IMAGE1POS=0,35..IMAGE1OPT=SCALE,UPPER_LEFT..IMAGE2=TopDivider.gif..IMAGE2POS=0,35..IMAGE2OPT=SCALE,HCENTER,UPPER_LEFT..IMAGE3=Console2.gif..IMAGE3POS=0,0..IMAGE3OPT=SCALE,LOWER_LEFT..BUTTONSUP=ButtonNormal.gif..BUTTONSDOWN=ButtonPushed.gif..BUTTONSOPT=SCALE,TRANSPARENT..BUTTONSTXTCLR=0,0,0..BUTTONSDISTXTCLR=96,104,112..BUTTONS=4..BUTTON1=12..BUTTON1POS=195,284..BUTTON2=1..BUTTON2POS=250,284..BUTTON3=9..BUTTON3POS=400,284..BUTTON4=2..BUTTON4POS=400,284....[AskPath]..BUTTONS=4..BUTTON1=12..BUTTON1POS=195,284..BUTTON2=1..BUTTON2POS=250,284..BUTTON3=9..BUTTON3POS=400,284..BUTTON4=31..BUTTON4POS=390,112....[AskDestPath]..BUTTONS=4..BUTTON1=12..BUTTON1POS=195,284..BUTTON2=1..BUTTON2POS=250,284..BUTTON3=9..BUTTON3POS=400,284..BUTTON4=196..BUTTON4POS=390,231....[ComponentDialog]..BUTTONS=4..BUTTON1=12.

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\cacls.exe
File Type:	ASCII text, with very long lines (2002), with no line terminators
Category:	dropped
Size (bytes):	2002
Entropy (8bit):	3.4576760942172498
Encrypted:	false
SSDEEP:	12:gb9bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbRbbbbbbbbbbU:t
MD5:	88C638B18640262EC1BA40807D892E47
SHA1:	7B5E5EC3379506F4B44D31D994133F7A0D4A7F8B
SHA-256:	F18CD18B31B8FB53A7F84ABFFCD050213A1AECC6D4CD74FB9BF625D363F5AC01
SHA-512:	239695991E673C69ED8E5A0BC4ED946D0A427A47816B5D3D63E79B7BA40BE76B49D2BDBAAB1048CD11FA1440D5F48648767AF9B8BF7384376DC7CCA117D2A7B2
Malicious:	false
Preview:	processed dir: processed dir: processed dir: processed dir: processed dir: processed file: processed file: processed dir: processed dir: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed file: processed dir: processed dir: processed dir: processed dir: pro

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.977946547120798
TrID:	Win32 Executable (generic) a (10002005/4) 95.55% DirectShow filter (201580/2) 1.93% Windows ActiveX control (116523/4) 1.11% Win32 EXE PECompact compressed (v2.x) (59071/9) 0.56% InstallShield setup (43055/19) 0.41%
File name:	ArbExpress_V3.6_en_0703_066146106.exe
File size:	45'206'398 bytes
MD5:	e2e80e23d79df3609dcaee7c2d7c2e72
SHA1:	5318eef048fc22d2a027a1715658089c34c1d41d
SHA256:	5c9ab13b2956d8dfadde510ea37578d8a67a59aff8d40d7524c756e1b602db5f
SHA512:	19d9128d7e3a2efee02fc32d6a84a8a5b51dfab747ffb8af7035c5e5e5a588fec0e3ae59f8d9619375af0e44a32ea530cfd67abc6f358f3b5d16afc14c616b5c
SSDEEP:	786432:aJv3YHKyr6GL778Z/u7YdCB6iUwBNyDv5q3QCPakTWcocoginxsc91a:IvoqyGGL77f7kCBxEDhtmakTUtxb94
TLSH:	4CA73303B962444EE59269B0DCAF0DB4AA707D6BAA32624F3781FD2C3DF14827547B1D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`&...H...H...H...D...H.U.F...H...C...H..'B._.H..y....H.."T...H..#m...H...I...H.,"Q...H..'C...H...N...H.Rich..H................

File Icon


Icon Hash:	4492c4ceb2d2c245

Static PE Info

General

Entrypoint:	0x43d97d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4C563DA6 [Mon Aug 2 03:38:14 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d359f27a4bcb5db01bbb086efdc99bd8

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 004675A8h
push 0043F0A8h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 58h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [0046638Ch]
xor edx, edx
mov dl, ah
mov dword ptr [0047D704h], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [0047D700h], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [0047D6FCh], ecx
shr eax, 10h
mov dword ptr [0047D6F8h], eax
push 00000001h
call 00007F67F48562F3h
pop ecx
test eax, eax
jne 00007F67F48538EAh
push 0000001Ch
call 00007F67F48539A7h
pop ecx
call 00007F67F4854874h
test eax, eax
jne 00007F67F48538EAh
push 00000010h
call 00007F67F4853996h
pop ecx
xor esi, esi
mov dword ptr [ebp-04h], esi
call 00007F67F4857C03h
call 00007F67F4857B5Dh
mov dword ptr [0047EF20h], eax
call 00007F67F48579E6h
mov dword ptr [0047D658h], eax
call 00007F67F48577B3h
call 00007F67F48576F6h
call 00007F67F4854CEAh
mov dword ptr [ebp-30h], esi
lea eax, dword ptr [ebp-5Ch]
push eax
call dword ptr [00466318h]
call 00007F67F485769Ah
mov dword ptr [ebp-64h], eax
test byte ptr [ebp-30h], 00000001h
je 00007F67F48538E8h
movzx eax, word ptr [ebp-2Ch]

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[IMP] VS2008 SP1 build 30729
[C++] VS98 (6.0) SP6 build 8804
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x724b0	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7f000	0x48878	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x66000	0x588	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x64e63	0x65000	6ba40cc976e0fccea8fad1b9f11148c2	False	0.5117114982982673	data	6.595714436384025	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x66000	0xe256	0xe400	688f80559ce0a808a88a5f77d346af22	False	0.3622361567982456	data	4.460932540314023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x75000	0x9f24	0x8400	7d0a0b5e6306ca9044dbf53ad2752072	False	0.24532433712121213	data	3.277902439193296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7f000	0x48878	0x48a00	db337c833af6f13c264fe1c76afda0e8	False	0.31875605098967297	data	6.344657477747268	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
GIF	0x7fe3c	0x6592	GIF image data, version 89a, 175 x 312	English	United States	0.9916544881162987
RT_BITMAP	0x863d0	0x14220	Device independent bitmap graphic, 220 x 370 x 8, image size 81400			0.34390764454792394
RT_BITMAP	0x9a5f0	0x1b5c	Device independent bitmap graphic, 180 x 75 x 4, image size 6900			0.18046830382638493
RT_BITMAP	0x9c14c	0x38e4	Device independent bitmap graphic, 180 x 75 x 8, image size 13500			0.26689096402087337
RT_BITMAP	0x9fa30	0x1238	Device independent bitmap graphic, 60 x 60 x 8, image size 3600			0.23499142367066894
RT_BITMAP	0xa0c68	0x6588	Device independent bitmap graphic, 161 x 152 x 8, image size 24928, resolution 3796 x 3796 px/m, 256 important colors			0.3035934133579563
RT_BITMAP	0xa71f0	0x11f88	Device independent bitmap graphic, 161 x 152 x 24, image size 73568, resolution 3780 x 3780 px/m			0.12790729268557766
RT_ICON	0xb9178	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152			0.1152439024390244
RT_ICON	0xb97e0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512			0.2217741935483871
RT_ICON	0xb9ac8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128			0.40202702702702703
RT_ICON	0xb9bf0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors			0.052505330490405115
RT_ICON	0xbaa98	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.07490974729241877
RT_ICON	0xbb340	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.08959537572254335
RT_ICON	0xbb8a8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.2932572614107884
RT_ICON	0xbde50	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.4343339587242026
RT_ICON	0xbeef8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.7198581560283688
RT_ICON	0xbf360	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.35618279569892475
RT_ICON	0xbf648	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.42473118279569894
RT_DIALOG	0xbf930	0x1fe	data			0.4745098039215686
RT_DIALOG	0xbfb30	0x296	data			0.44108761329305135
RT_DIALOG	0xbfdc8	0x2e0	data			0.43342391304347827
RT_DIALOG	0xc00a8	0x64	data			0.68
RT_DIALOG	0xc010c	0x42	data			0.8333333333333334
RT_DIALOG	0xc0150	0xe6	data			0.6434782608695652
RT_DIALOG	0xc0238	0x124	data			0.5068493150684932
RT_DIALOG	0xc035c	0xe6	data			0.5826086956521739
RT_DIALOG	0xc0444	0x276	data			0.45396825396825397
RT_DIALOG	0xc06bc	0x3d8	data			0.41971544715447157
RT_DIALOG	0xc0a94	0x182	data			0.5233160621761658
RT_DIALOG	0xc0c18	0x21c	data			0.48148148148148145
RT_DIALOG	0xc0e34	0x1fa	data			0.5079051383399209
RT_DIALOG	0xc1030	0x222	data			0.4835164835164835
RT_DIALOG	0xc1254	0x8c	data			0.7285714285714285
RT_DIALOG	0xc12e0	0x3cc	data			0.43209876543209874
RT_DIALOG	0xc16ac	0x158	data			0.5494186046511628
RT_DIALOG	0xc1804	0x1ea	data			0.5163265306122449
RT_DIALOG	0xc19f0	0x116	data			0.6079136690647482
RT_DIALOG	0xc1b08	0xee	data			0.6260504201680672
RT_DIALOG	0xc1bf8	0x1d4	data			0.5021367521367521
RT_DIALOG	0xc1dcc	0x1ec	data			0.5142276422764228
RT_DIALOG	0xc1fb8	0x2b8	data			0.4813218390804598
RT_STRING	0xc2270	0x160	data	English	United States	0.5340909090909091
RT_STRING	0xc23d0	0x23e	data	English	United States	0.40418118466898956
RT_STRING	0xc2610	0x378	data	English	United States	0.4222972972972973
RT_STRING	0xc2988	0x252	data	English	United States	0.4393939393939394
RT_STRING	0xc2bdc	0x1f4	data	English	United States	0.442
RT_STRING	0xc2dd0	0x66c	data	English	United States	0.36253041362530414
RT_STRING	0xc343c	0x366	data	English	United States	0.41379310344827586
RT_STRING	0xc37a4	0x27e	data	English	United States	0.4561128526645768
RT_STRING	0xc3a24	0x518	data	English	United States	0.39800613496932513
RT_STRING	0xc3f3c	0x882	data	English	United States	0.3002754820936639
RT_STRING	0xc47c0	0x23e	data	English	United States	0.45121951219512196
RT_STRING	0xc4a00	0x3ba	data	English	United States	0.3280922431865828
RT_STRING	0xc4dbc	0x12c	data	English	United States	0.5266666666666666
RT_STRING	0xc4ee8	0x4a	data	English	United States	0.6756756756756757
RT_STRING	0xc4f34	0xda	data	English	United States	0.6100917431192661
RT_STRING	0xc5010	0x110	data	English	United States	0.5845588235294118
RT_STRING	0xc5120	0x20a	data	English	United States	0.4521072796934866
RT_STRING	0xc532c	0xba	Matlab v4 mat-file (little endian) P, numeric, rows 0, columns 0	English	United States	0.5860215053763441
RT_STRING	0xc53e8	0xa8	data	English	United States	0.6607142857142857
RT_STRING	0xc5490	0x12a	data	English	United States	0.5201342281879194
RT_STRING	0xc55bc	0x422	data	English	United States	0.2741020793950851
RT_STRING	0xc59e0	0x5c2	data	English	United States	0.37720488466757124
RT_STRING	0xc5fa4	0x40	data	English	United States	0.671875
RT_STRING	0xc5fe4	0xcaa	data	English	United States	0.2313386798272671
RT_STRING	0xc6c90	0x284	data	English	United States	0.43788819875776397
RT_GROUP_ICON	0xc6f14	0x5a	data			0.7555555555555555
RT_GROUP_ICON	0xc6f70	0x14	data			1.25
RT_GROUP_ICON	0xc6f84	0x14	data			1.25
RT_VERSION	0xc6f98	0x468	data			0.4237588652482269
RT_MANIFEST	0xc7400	0x477	XML 1.0 document, ASCII text, with CRLF line terminators			0.4689413823272091

Imports

DLL	Import
COMCTL32.dll
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW
KERNEL32.dll	FindResourceExW, GetDriveTypeW, WriteFile, lstrcpynW, lstrcmpiW, GetFileAttributesW, FindClose, FindFirstFileW, UnmapViewOfFile, MapViewOfFile, GetSystemInfo, VirtualQuery, CompareStringA, IsBadReadPtr, CreateFileMappingW, CreateDirectoryW, CompareStringW, GetCurrentDirectoryW, ExpandEnvironmentStringsW, SetFileAttributesW, FileTimeToLocalFileTime, GetFileTime, HeapFree, HeapAlloc, GetProcessHeap, TlsAlloc, TlsSetValue, GetCurrentThreadId, GetProcAddress, GetModuleHandleW, GetPrivateProfileIntW, lstrcpyW, lstrlenW, Sleep, CloseHandle, CreateProcessW, RemoveDirectoryW, DeleteFileW, SetLastError, GetFileSize, SetFilePointer, CreateEventW, QueryPerformanceFrequency, GetSystemTimeAsFileTime, ReleaseMutex, GetUserDefaultLangID, GetSystemDefaultLangID, CreateMutexW, SetErrorMode, LoadLibraryW, lstrcatW, FreeLibrary, GetDiskFreeSpaceW, VerLanguageNameW, WideCharToMultiByte, ReadFile, GetTickCount, GetCommandLineW, ExitThread, CreateThread, GetDateFormatA, GetTimeFormatA, CreateFileA, FreeResource, lstrcatA, MulDiv, lstrcmpiA, GetPrivateProfileIntA, GetPrivateProfileStringA, GetPrivateProfileSectionNamesA, GetOEMCP, GetACP, FlushFileBuffers, SetStdHandle, LoadLibraryA, GetStringTypeW, GetStringTypeA, IsBadCodePtr, GetExitCodeProcess, GetLocaleInfoW, IsValidLocale, lstrcpyA, lstrlenA, GetWindowsDirectoryW, InterlockedDecrement, LocalFree, InterlockedIncrement, FormatMessageW, GetTempPathW, GetVersionExW, CreateFileW, GlobalFree, FindResourceW, LoadResource, SizeofResource, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, MultiByteToWideChar, GetModuleFileNameW, GetSystemDirectoryW, SetCurrentDirectoryW, WaitForSingleObject, ExitProcess, GetCurrentProcess, DuplicateHandle, GetThreadContext, VirtualProtectEx, WriteProcessMemory, FlushInstructionCache, SetThreadContext, ResumeThread, GetLastError, GetCPInfo, GetStartupInfoA, GetFileType, GetStdHandle, SetHandleCount, GetCommandLineA, GetEnvironmentStrings, GetEnvironmentStringsW, FreeEnvironmentStringsW, FreeEnvironmentStringsA, UnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleA, HeapReAlloc, RaiseException, RtlUnwind, DeleteCriticalSection, InterlockedExchange, MoveFileExW, IsBadWritePtr, VirtualAlloc, VirtualFree, HeapCreate, HeapDestroy, GetVersionExA, GetEnvironmentVariableA, GetModuleFileNameA, SetUnhandledExceptionFilter, HeapSize, LCMapStringW, LCMapStringA, TlsGetValue, GetTempFileNameW, OpenProcess, CompareFileTime, GetProcessTimes, TerminateProcess, GetLocalTime, InitializeCriticalSection, GetCurrentProcessId, GetVersion, LeaveCriticalSection, EnterCriticalSection, GetCurrentThread, VirtualProtect, SearchPathW, ResetEvent, SetEvent, QueryPerformanceCounter, SystemTimeToFileTime, lstrcmpA, FindNextFileW, lstrcmpW
USER32.dll	CharUpperW, WaitForInputIdle, DialogBoxIndirectParamW, MessageBoxW, wsprintfW, SetForegroundWindow, SetWindowLongW, SetWindowTextW, SendMessageW, GetDlgItem, LoadIconW, EndDialog, MoveWindow, SetActiveWindow, DrawTextW, SetFocus, BeginPaint, LoadStringW, FillRect, EndPaint, GetMessageW, DefWindowProcW, GetWindow, SystemParametersInfoW, GetSystemMetrics, MapWindowPoints, GetPropW, EnableMenuItem, SetPropW, RemovePropW, GetSysColor, LoadImageW, GetDC, ReleaseDC, CreateDialogParamW, GetParent, GetWindowTextW, IsWindowVisible, ExitWindowsEx, UpdateWindow, InvalidateRect, DrawIcon, MapDialogRect, wsprintfA, GetClassNameW, GetWindowRect, DrawFocusRect, InflateRect, CallWindowProcW, GetWindowDC, CopyRect, EnumChildWindows, CreateWindowExW, RegisterClassExW, IntersectRect, GetDlgItemTextW, CreateDialogIndirectParamW, GetDesktopWindow, GetClientRect, IsWindowEnabled, FindWindowExW, IsDialogMessageW, PeekMessageW, MsgWaitForMultipleObjects, TranslateMessage, DispatchMessageW, EnableWindow, ShowWindow, SendDlgItemMessageW, PostMessageW, ScreenToClient, SetWindowPos, IsWindow, DestroyWindow, GetWindowLongW, SetDlgItemTextW
GDI32.dll	SetBkMode, SetTextColor, TextOutW, RestoreDC, SetBkColor, CreateSolidBrush, UnrealizeObject, SelectPalette, RealizePalette, BitBlt, CreateCompatibleDC, SelectObject, GetDIBColorTable, GetSystemPaletteEntries, CreatePalette, DeleteDC, CreateHalftonePalette, GetDeviceCaps, TranslateCharsetInfo, GetObjectW, CreateFontIndirectW, DeleteObject, CreateCompatibleBitmap, CreateDCW, GetStockObject, GetTextExtentPoint32W, CreatePatternBrush, CreateDIBitmap, DeleteMetaFile, SetMetaFileBitsEx, SetStretchBltMode, SelectClipRgn, CreateRectRgn, SetPixel, PatBlt, PlayMetaFile, StretchBlt, CreateBitmap, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx, SetMapMode, SaveDC
ADVAPI32.dll	RegCreateKeyExW, RegOpenKeyExA, RegQueryValueExA, OpenThreadToken, GetTokenInformation, AllocateAndInitializeSid, EqualSid, FreeSid, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyW, RegEnumKeyW, RegEnumKeyExW, RegDeleteKeyW, RegSetValueExW, RegEnumValueW, RegQueryValueExW, RegDeleteValueW, InitializeSecurityDescriptor, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, SetSecurityDescriptorDacl, RegOpenKeyExW, RegCloseKey
SHELL32.dll	ShellExecuteExW, SHGetMalloc, SHGetPathFromIDListW, SHGetSpecialFolderLocation
ole32.dll	CoInitialize, CoUninitialize, CoInitializeSecurity
OLEAUT32.dll	VariantChangeType, VariantClear, GetErrorInfo, SysStringLen, SysReAllocStringLen, SysAllocString, SysFreeString, SysAllocStringLen
LZ32.dll	LZOpenFileW, LZCopy, LZClose
msi.dll
RPCRT4.dll	UuidToStringW, RpcStringFreeW, UuidCreate

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 08:34:20.811788082 CEST	53	61347	162.159.36.2	192.168.2.5
Oct 8, 2024 08:34:21.327908993 CEST	57902	53	192.168.2.5	1.1.1.1
Oct 8, 2024 08:34:21.335939884 CEST	53	57902	1.1.1.1	192.168.2.5
Oct 8, 2024 08:34:23.005273104 CEST	64170	53	192.168.2.5	1.1.1.1
Oct 8, 2024 08:34:23.012262106 CEST	53	64170	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 08:34:21.327908993 CEST	192.168.2.5	1.1.1.1	0xe3b3	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Oct 8, 2024 08:34:23.005273104 CEST	192.168.2.5	1.1.1.1	0xa31e	Standard query (0)	197.87.175.4.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 08:34:21.335939884 CEST	1.1.1.1	192.168.2.5	0xe3b3	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Oct 8, 2024 08:34:23.012262106 CEST	1.1.1.1	192.168.2.5	0xa31e	Name error (3)	197.87.175.4.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	02:33:47
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe"
Imagebase:	0x400000
File size:	45'206'398 bytes
MD5 hash:	E2E80E23D79DF3609DCAEE7C2D7C2E72
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	02:34:22
Start date:	08/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A3681F74-C246-4C16-9456-61CA4AC85351}
Imagebase:	0x140000000
File size:	107'392 bytes
MD5 hash:	B83D2774CDAF5016CD8765A630FA1150
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:34:54
Start date:	08/10/2024
Path:	C:\Windows\System32\SrTasks.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1
Imagebase:	0x7ff63f120000
File size:	59'392 bytes
MD5 hash:	2694D2D28C368B921686FE567BD319EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:34:54
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:34:55
Start date:	08/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\DevComponents.DotNetBar2.dll"
Imagebase:	0x400000
File size:	11'152 bytes
MD5 hash:	8F50951DC767385E6E9801ECACC621E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:34:55
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:34:58
Start date:	08/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbConnect.dll"
Imagebase:	0x400000
File size:	11'152 bytes
MD5 hash:	8F50951DC767385E6E9801ECACC621E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:34:58
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:35:00
Start date:	08/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbExpress.exe"
Imagebase:	0x400000
File size:	11'152 bytes
MD5 hash:	8F50951DC767385E6E9801ECACC621E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:35:00
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:35:01
Start date:	08/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbLib.dll"
Imagebase:	0x400000
File size:	11'152 bytes
MD5 hash:	8F50951DC767385E6E9801ECACC621E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:35:01
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:35:03
Start date:	08/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\DisplayComponent.dll"
Imagebase:	0x400000
File size:	11'152 bytes
MD5 hash:	8F50951DC767385E6E9801ECACC621E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:35:03
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	02:35:05
Start date:	08/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\PreviewComponent.dll"
Imagebase:	0x400000
File size:	11'152 bytes
MD5 hash:	8F50951DC767385E6E9801ECACC621E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:35:05
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:35:06
Start date:	08/10/2024
Path:	C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ScopeAcqPages.dll"
Imagebase:	0x400000
File size:	11'152 bytes
MD5 hash:	8F50951DC767385E6E9801ECACC621E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:35:06
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	02:35:29
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe /c cacls "C:\Program Files (x86)\Tektronix\ArbExpress" /T /E /G Users:F
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	02:35:29
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	02:35:30
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	cacls "C:\Program Files (x86)\Tektronix\ArbExpress" /T /E /G Users:F
Imagebase:	0xce0000
File size:	27'648 bytes
MD5 hash:	00BAAE10C69DAD58F169A3ED638D6C59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.1%
Total number of Nodes:	1945
Total number of Limit Nodes:	53

Executed Functions

Function 0000000140001A00 Relevance: 72.2, APIs: 39, Strings: 2, Instructions: 400
memorywindowsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 0000000140001A33
CoInitializeEx.COMBASE ref: 0000000140001A3E
GetCurrentThreadId.KERNEL32 ref: 0000000140001ACF
StringFromGUID2.OLE32 ref: 0000000140001B34
SysAllocString.OLEAUT32 ref: 0000000140001B42
SysStringLen.OLEAUT32 ref: 0000000140001B5E
SysStringLen.OLEAUT32 ref: 0000000140001B6B
CharUpperBuffW.USER32 ref: 0000000140001B76
CharNextW.USER32 ref: 0000000140001C32
CharNextW.USER32 ref: 0000000140001C40
CharNextW.USER32 ref: 0000000140001C56
lstrcmpiW.KERNELBASE ref: 0000000140001C7A
lstrcmpiW.KERNEL32 ref: 0000000140001C92
CharNextW.USER32 ref: 0000000140001CC0
CharNextW.USER32 ref: 0000000140001CCE
CharNextW.USER32 ref: 0000000140001CE1
CreateEventW.KERNEL32 ref: 0000000140001D02
CreateThread.KERNELBASE ref: 0000000140001D35
StringFromGUID2.OLE32 ref: 0000000140001D59
SysAllocString.OLEAUT32 ref: 0000000140001D67
SysFreeString.OLEAUT32 ref: 0000000140001D82
SysStringByteLen.OLEAUT32 ref: 0000000140001D8B
SysAllocStringByteLen.OLEAUT32 ref: 0000000140001D96
SysFreeString.OLEAUT32 ref: 0000000140001DB2
SysStringLen.OLEAUT32 ref: 0000000140001DBB
SysStringLen.OLEAUT32 ref: 0000000140001DC8
CharUpperBuffW.USER32 ref: 0000000140001DD3
CreateItemMoniker.OLE32 ref: 0000000140001E24
Sleep.KERNEL32 ref: 0000000140001E35
GetRunningObjectTable.OLE32 ref: 0000000140001E69
Sleep.KERNEL32 ref: 0000000140001EA4
GetMessageW.USER32 ref: 0000000140001ED5
DispatchMessageW.USER32 ref: 0000000140001EE5
GetMessageW.USER32 ref: 0000000140001EF8
SleepEx.KERNELBASE ref: 0000000140001F13
SysFreeString.OLEAUT32 ref: 0000000140001F2C
DeleteCriticalSection.KERNEL32 ref: 0000000140001FEA
CoUninitialize.COMBASE ref: 0000000140001FF7
SysFreeString.OLEAUT32 ref: 0000000140002000

Strings

UnregServer, xrefs: 0000000140001C70
RegServer, xrefs: 0000000140001C88

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: String$Char$Next$Free$AllocCreateMessageSleep$BuffByteFromThreadUpperlstrcmpi$CommandCriticalCurrentDeleteDispatchEventInitializeItemLineMonikerObjectRunningSectionTableUninitialize
String ID: RegServer$UnregServer
API String ID: 1439686361-1360048911
Opcode ID: c53b9eb475a62b58cef6332658bd80aed3c823ee1ddb201bd18a5fc6f0ca370e
Instruction ID: b7d74cdaf3e56adff6bdb8ee720ce2329d7f6e7b9e3d89e0ba8973d5c19e4dc5
Opcode Fuzzy Hash: c53b9eb475a62b58cef6332658bd80aed3c823ee1ddb201bd18a5fc6f0ca370e
Instruction Fuzzy Hash: C2024671205B8282EB66DF22E8547EA63A1FB8CBD4F444125FB9A477B4EF3AC445C300

Function 0000000140009238 Relevance: 13.6, APIs: 9, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.LIBCMT ref: 0000000140009261
DecodePointer.KERNEL32 ref: 0000000140009294
DecodePointer.KERNEL32 ref: 00000001400092B1
DecodePointer.KERNEL32 ref: 00000001400092F0
DecodePointer.KERNEL32 ref: 0000000140009309
DecodePointer.KERNEL32 ref: 0000000140009318
_initterm.LIBCMT ref: 0000000140009357
_initterm.LIBCMT ref: 000000014000936A
ExitProcess.KERNEL32 ref: 00000001400093A3

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: DecodePointer$_initterm$ExitProcess_lock
String ID:
API String ID: 2551688548-0
Opcode ID: d3b06b25a786ca0534e88820e4e6a3589d924fda1cc0c655bfba7bfd7dc408fa
Instruction ID: 07673facac83906e7c76a80bdf98338d6e48441c0e0544f8201256dd6b8b1c23
Opcode Fuzzy Hash: d3b06b25a786ca0534e88820e4e6a3589d924fda1cc0c655bfba7bfd7dc408fa
Instruction Fuzzy Hash: 654147B1216B5081FA62DB13F8403D972A4B78CBC4F440125BB8E4BBBAEB7AC555CB05

Function 00000001400013F0 Relevance: 9.2, APIs: 6, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140001455
GetModuleFileNameW.KERNEL32 ref: 00000001400014D7
LoadTypeLib.OLEAUT32 ref: 00000001400014FA
GetModuleFileNameW.KERNEL32 ref: 0000000140001516
LoadTypeLibEx.OLEAUT32 ref: 0000000140001526
LeaveCriticalSection.KERNEL32 ref: 000000014000170C

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: CriticalFileLoadModuleNameSectionType$EnterLeave
String ID:
API String ID: 2533399358-0
Opcode ID: 4a95d764720e9f89894b0dbb495441985030873d61e6edebb0900d6dc42e40ab
Instruction ID: 8eb3aa069d2603357a3d4cf543e7500a3a539a99d2529c06f853cfa51108d033
Opcode Fuzzy Hash: 4a95d764720e9f89894b0dbb495441985030873d61e6edebb0900d6dc42e40ab
Instruction Fuzzy Hash: 5AA1E1B6205B4182EA66CF16F8943D963A0F78CBD4F585126EB8E4B7B4DF3AC945C700

Function 0000000140007B44 Relevance: 9.1, APIs: 6, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 0000000140007B56
_FF_MSGBANNER.LIBCMT ref: 0000000140007BF4
_FF_MSGBANNER.LIBCMT ref: 0000000140007C1F
_RTC_Initialize.LIBCMT ref: 0000000140007C38
GetCommandLineW.KERNEL32 ref: 0000000140007C51
_cinit.LIBCMT ref: 0000000140007C94

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: CommandInfoInitializeLineStartup_cinit
String ID:
API String ID: 3693240955-0
Opcode ID: a677a459171d0055582345a6e5c1bd70690981f78429a4a97dd698e5d380b6b8
Instruction ID: 618e1691778918ebcc204c73ae439f9684ea69a3c8b4418158c818dd905ae431
Opcode Fuzzy Hash: a677a459171d0055582345a6e5c1bd70690981f78429a4a97dd698e5d380b6b8
Instruction Fuzzy Hash: C3413EB1A0438186FB67EBA7B5517EA7291AB8D3C4F044439B789476F3DF7C89408712

Function 0000000140001760 Relevance: 6.0, APIs: 4, Instructions: 29
synchronizationthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32 ref: 0000000140001777
WaitForSingleObject.KERNEL32 ref: 000000014000178A
CloseHandle.KERNEL32 ref: 00000001400017A4
PostThreadMessageW.USER32 ref: 00000001400017B7

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: ObjectSingleWait$CloseHandleMessagePostThread
String ID:
API String ID: 3386540786-0
Opcode ID: b996f8a358e3857f069cf0b71e94f0ea8b998367879f486d310f3a42798108ed
Instruction ID: 5221bdb29aa0d4e5f2d3e52342bcc899d36ec8d34f176b3988a9326c8c9679c0
Opcode Fuzzy Hash: b996f8a358e3857f069cf0b71e94f0ea8b998367879f486d310f3a42798108ed
Instruction Fuzzy Hash: BEF06D7260458486F752DF36E4047A937A2FBDEBA9F445110EB594B2A4CB78C888CB40

Function 0000000140001160 Relevance: 4.6, APIs: 3, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32 ref: 00000001400012DC
SysStringLen.OLEAUT32 ref: 00000001400012E8
SysFreeString.OLEAUT32 ref: 000000014000131A

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: String$Free
String ID:
API String ID: 1391021980-0
Opcode ID: 2d10286868130cb06e7a1fcadc46548283396d2f5339114b0e3874c3305c231f
Instruction ID: ee9f486afb513c7c286d9bc955161b819ab45af594cbfe0c5b807114dbd55448
Opcode Fuzzy Hash: 2d10286868130cb06e7a1fcadc46548283396d2f5339114b0e3874c3305c231f
Instruction Fuzzy Hash: 0C510876204B8082EB65CF16F4907AE77A0F789BE4F508215EFAA877A4DF38C555CB40

Function 000000014000A430 Relevance: 3.0, APIs: 2, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,0000000140007C62), ref: 000000014000A444
FreeEnvironmentStringsW.KERNEL32(?,?,?,0000000140007C62), ref: 000000014000A49B

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 4be84f8da798ce5530ee38e97613c715554758017dcf0d69418dd1c154c19818
Instruction ID: a05c25852a6f65f82b8facba23e8fe879d9a18c701681738e1736eaa58bf0201
Opcode Fuzzy Hash: 4be84f8da798ce5530ee38e97613c715554758017dcf0d69418dd1c154c19818
Instruction Fuzzy Hash: 3601AC75B0469085DE61EF63B54939A63E0E78EFC0F4C4420FB4A07765DABCC5808300

Function 00000001400061D0 Relevance: 3.0, APIs: 2, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32 ref: 00000001400061FC
SysAllocString.OLEAUT32 ref: 0000000140006212

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: AllocFolderPathSpecialString
String ID:
API String ID: 997430384-0
Opcode ID: 36e408226ae31ac45d39e01efaff93e09a8eb11419a68d0dd6d3ed220063823a
Instruction ID: 3dace4caf315503cb7b9d81d11fe13e9779b47cba291b766f1ae0c490d9d72ea
Opcode Fuzzy Hash: 36e408226ae31ac45d39e01efaff93e09a8eb11419a68d0dd6d3ed220063823a
Instruction Fuzzy Hash: BAF01272714A4482FB32DB72F89579A63A1BB5C7C4F414416AB9D4B665DF3CC144CB00

Function 0000000140006240 Relevance: 3.0, APIs: 2, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32 ref: 000000014000626C
SysAllocString.OLEAUT32 ref: 0000000140006282

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: AllocFolderPathSpecialString
String ID:
API String ID: 997430384-0
Opcode ID: d4544bca33c8623ed21ede49bc312ce01ed4ac2a4fc16018878fee9bde5d1abf
Instruction ID: 6774e0e8a2b881655ae1fe0c58510dcf3f97e1c32c1f912f13a511ba33b91d73
Opcode Fuzzy Hash: d4544bca33c8623ed21ede49bc312ce01ed4ac2a4fc16018878fee9bde5d1abf
Instruction Fuzzy Hash: D6F0FE72714A4082EB72DB72F89579A62A1BB5C7C4F414415AB9D4B664DE3CC1448B00

Function 0000000140008AD8 Relevance: 3.0, APIs: 2, Instructions: 18
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(?,?,?,?,0000000140007BE7), ref: 0000000140008AEA
HeapSetInformation.KERNEL32 ref: 0000000140008B14

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: Heap$CreateInformation
String ID:
API String ID: 1774340351-0
Opcode ID: 60955895670250e950209d8e72f64c9098f7b83159f4408353f43344fc270f5a
Instruction ID: 085bc612c012e77dfde3bb6aadc7deea4adf74b7881832ae79349772b23d908f
Opcode Fuzzy Hash: 60955895670250e950209d8e72f64c9098f7b83159f4408353f43344fc270f5a
Instruction Fuzzy Hash: 55E04FB572279082EB9ADB22B8597956290FB8C380F905029FF89077A4EF7DC1458B00

Function 0000000140008EBC Relevance: 2.5, APIs: 2, Instructions: 30
sleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.LIBCMT ref: 0000000140008EDB

Part of subcall function 00000001400076C4: _FF_MSGBANNER.LIBCMT ref: 00000001400076F4
Part of subcall function 00000001400076C4: HeapAlloc.KERNEL32(?,?,00000000,00000001400073F7), ref: 0000000140007719
Part of subcall function 00000001400076C4: _errno.LIBCMT ref: 000000014000773D
Part of subcall function 00000001400076C4: _errno.LIBCMT ref: 0000000140007748

Sleep.KERNEL32(?,?,00000000,000000014000C125,?,?,?,000000014000C1CF,?,?,00000000,0000000140008BF9,?,?,00000000,0000000140008CB0), ref: 0000000140008EF2

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: _errno$AllocHeapSleepmalloc
String ID:
API String ID: 496785850-0
Opcode ID: a6449296bb5b4f8c4b08f73258b287ffd965e0c787605054bc7408744147d5ec
Instruction ID: 537f67181e73cc186da4c8275488393e9c5cd010b32cf849189cf0473b688248
Opcode Fuzzy Hash: a6449296bb5b4f8c4b08f73258b287ffd965e0c787605054bc7408744147d5ec
Instruction Fuzzy Hash: 8DF0C272600B8582EA22DF27B4403AE7261F7DCBD0F540124FFAA077A4CF39C8928700

Non-executed Functions

Function 0000000140004D40 Relevance: 68.8, APIs: 33, Strings: 6, Instructions: 566stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140004B80: CharNextW.USER32 ref: 0000000140004BAA

lstrcmpiW.KERNEL32(?,?,?,00000000,?,00000000,00000001400057F3,?,00000000,?,00000000,0000000140005A1E), ref: 0000000140004DD2
lstrcmpiW.KERNEL32(?,?,?,00000000,?,00000000,00000001400057F3,?,00000000,?,00000000,0000000140005A1E), ref: 0000000140004DEA
CharNextW.USER32(?,?,?,00000000,?,00000000,00000001400057F3,?,00000000,?,00000000,0000000140005A1E), ref: 0000000140004E46
lstrcmpiW.KERNEL32 ref: 0000000140004E76
lstrlenW.KERNEL32 ref: 000000014000522E

Strings

Advapi32.dll, xrefs: 00000001400054A7
ForceRemove, xrefs: 0000000140004DE0
Delete, xrefs: 0000000140004DC8
Val, xrefs: 0000000140004F54
RegDeleteKeyExW, xrefs: 00000001400054B9
NoRemove, xrefs: 0000000140004F1D

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: lstrcmpi$CharNext$lstrlen
String ID: Advapi32.dll$Delete$ForceRemove$NoRemove$RegDeleteKeyExW$Val
API String ID: 3245553444-3074132075
Opcode ID: 574a2f52c3467135ad231e8221758b9eccbb2765c3416c74247ca22dbefdb9c9
Instruction ID: 778a35a82eab5513ffc37bb2e0784930ca6e74b3d4e47f5133f1fce391781031
Opcode Fuzzy Hash: 574a2f52c3467135ad231e8221758b9eccbb2765c3416c74247ca22dbefdb9c9
Instruction Fuzzy Hash: 743262B5304B4186FB62EB27B8543EB62A5B78DBC1F440125BB8987BB5EF79C445C700

Function 000000014000DEA8 Relevance: 28.9, APIs: 19, Instructions: 377COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000E459), ref: 000000014000DF1A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000E459), ref: 000000014000DF30
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000E459), ref: 000000014000DFDA
malloc.LIBCMT ref: 000000014000E04B
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000E459), ref: 000000014000E082
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000E459), ref: 000000014000E0A7
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000E459), ref: 000000014000E0F7
malloc.LIBCMT ref: 000000014000E14A
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000E459), ref: 000000014000E184
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000E459), ref: 000000014000E1C7
free.LIBCMT ref: 000000014000E1D8
free.LIBCMT ref: 000000014000E1E6
LCMapStringA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000E459), ref: 000000014000E275
malloc.LIBCMT ref: 000000014000E2E3
LCMapStringA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000E459), ref: 000000014000E32C
free.LIBCMT ref: 000000014000E374
LCMapStringA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000E459), ref: 000000014000E394
free.LIBCMT ref: 000000014000E3A6
free.LIBCMT ref: 000000014000E3B8

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: String$free$ByteCharMultiWidemalloc$ErrorLast
String ID:
API String ID: 1837315383-0
Opcode ID: 790e360d3d82f2ea2347be63969d824b8f6a96a5d02ec7c98fc1d8ce4b5cb352
Instruction ID: 36ff578f2a5c835a7022fa6b916d227458f80fccd6e2589ac859924e0fb8596d
Opcode Fuzzy Hash: 790e360d3d82f2ea2347be63969d824b8f6a96a5d02ec7c98fc1d8ce4b5cb352
Instruction Fuzzy Hash: 11F19FB26046808AE766CF26F8407DD77A1F74CBD8F544625FB5A67BE8DB38CA408700

Function 0000000140004340 Relevance: 15.3, APIs: 10, Instructions: 270stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140004B80: CharNextW.USER32 ref: 0000000140004BAA

Part of subcall function 00000001400040C0: lstrcmpiW.KERNEL32 ref: 0000000140004176

CharNextW.USER32(?,00000000,?,?,FFFFFFFE,?,00000000,0000000140004FE8), ref: 00000001400043FB
lstrlenW.KERNEL32(?,00000000,?,?,FFFFFFFE,?,00000000,0000000140004FE8), ref: 0000000140004452
CharNextW.USER32(?,00000000,?,?,FFFFFFFE,?,00000000,0000000140004FE8), ref: 00000001400044F3
CharNextW.USER32(?,00000000,?,?,FFFFFFFE,?,00000000,0000000140004FE8), ref: 0000000140004512

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: CharNext$lstrcmpilstrlen
String ID:
API String ID: 1051761657-0
Opcode ID: f3154b8e141115c88e6c8bc3963e58bf20827cc774e56c4b8f923a12ca3be294
Instruction ID: 839d84e8e2e58941d85d68fc581de24184406efd97ea25ddc00372293b46d8b9
Opcode Fuzzy Hash: f3154b8e141115c88e6c8bc3963e58bf20827cc774e56c4b8f923a12ca3be294
Instruction Fuzzy Hash: 48B161F2214A8081EB72DB16F8503EA62A5F78D7D0F444115FB8E87AE6EF78C444C705

Function 000000014000961C Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 137fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,?,?,?,0000000140009878,?,?,?,?,000000014000C0F0,?,?,?,000000014000C1CF), ref: 00000001400096DF
GetStdHandle.KERNEL32(?,?,?,?,?,0000000140009878,?,?,?,?,000000014000C0F0,?,?,?,000000014000C1CF), ref: 00000001400097EB
WriteFile.KERNEL32 ref: 0000000140009825

Strings

<program name unknown>, xrefs: 00000001400096E9
..., xrefs: 0000000140009742
Microsoft Visual C++ Runtime Library, xrefs: 00000001400097CF
Runtime Error!Program: , xrefs: 000000014000969E

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 49319980787f49705267d80be5e237d6ac7b51f90437b0d6f23b082f9f5b6435
Instruction ID: 7031fb11c9f8d5d7307010091df27ca73d12975a7f1fb81de5a39e834d5e979d
Opcode Fuzzy Hash: 49319980787f49705267d80be5e237d6ac7b51f90437b0d6f23b082f9f5b6435
Instruction Fuzzy Hash: C151BDB231464142FB26EB77B995BEA6291B78D3C4F804226BF8D4BAF5CF7DC1058640

Function 0000000140007200 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0000000140008797
RtlLookupFunctionEntry.KERNEL32 ref: 00000001400087B6
RtlVirtualUnwind.KERNEL32 ref: 0000000140008802
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001724), ref: 0000000140008874
SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001724), ref: 000000014000888C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001724), ref: 0000000140008899
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001724), ref: 00000001400088B2
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001724), ref: 00000001400088C0

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: f60b0a82c0ab7c463cc57d977c74447b366e374225e7c9d62e12f8eddd241c4b
Instruction ID: 6456794bf226124b766afbac0b74476d5722fd6e4d820f3a85fa1103d037e848
Opcode Fuzzy Hash: f60b0a82c0ab7c463cc57d977c74447b366e374225e7c9d62e12f8eddd241c4b
Instruction Fuzzy Hash: 2E31DD75105B4585EAA2DB52F88439A73A4F78C394F90412AFB8E4B775DFBEC188CB00

Function 000000014000946C Relevance: 12.1, APIs: 8, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00000001400094AB
RtlLookupFunctionEntry.KERNEL32 ref: 00000001400094C4
RtlVirtualUnwind.KERNEL32 ref: 0000000140009502
IsDebuggerPresent.KERNEL32 ref: 0000000140009549
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000140009553
UnhandledExceptionFilter.KERNEL32 ref: 000000014000955E
GetCurrentProcess.KERNEL32 ref: 0000000140009574
TerminateProcess.KERNEL32 ref: 0000000140009582

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: ae5614e2d4ca8372d021df3987ae21e1364e5e4791f7fabf3b96f1eeea8b4345
Instruction ID: 06c94d1c8bf6888431f73c5498eb31435ce0334f070dcab656e6167061affebf
Opcode Fuzzy Hash: ae5614e2d4ca8372d021df3987ae21e1364e5e4791f7fabf3b96f1eeea8b4345
Instruction Fuzzy Hash: 53311872608B8582EB66CB56F4443DEB3A4F788795F500125EBCA47B69EF7CC248CB00

Function 0000000140005870 Relevance: 9.1, APIs: 6, Instructions: 127libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000001400058C9
FindResourceW.KERNEL32 ref: 00000001400058F1
FreeLibrary.KERNEL32 ref: 0000000140005A23

Part of subcall function 0000000140003A80: GetLastError.KERNEL32 ref: 0000000140003A84

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: Library$ErrorFindFreeLastLoadResource
String ID:
API String ID: 3418355812-0
Opcode ID: f31ee2e4daae8a9e28d2c12cb13091382cc6c1343d53f12a23b0ff9af19c730b
Instruction ID: 988a098b27ff3148f2e01d2fd7557f730efac5fc2e13e597eb4f652e5678100b
Opcode Fuzzy Hash: f31ee2e4daae8a9e28d2c12cb13091382cc6c1343d53f12a23b0ff9af19c730b
Instruction Fuzzy Hash: BA5181B1705B8086EA52EB2BB4443DB62D1F78E7E1F500225BB9E477B5EF38C4458B41

Function 00000001400068B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00000001400068C8
GetProcAddress.KERNEL32 ref: 00000001400068F5
FreeLibrary.KERNEL32 ref: 0000000140006903

Strings

DriverPackageGetPathW, xrefs: 00000001400068EB

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: DriverPackageGetPathW
API String ID: 145871493-341743864
Opcode ID: 7ffa9a20de688f379fe2ae145a8db88722e4293c1271579e93f086675a7654c6
Instruction ID: 71872d51fa73bb03ec15527d1967ee3b4e3d96c43b0306141dea45fb8dcd3b63
Opcode Fuzzy Hash: 7ffa9a20de688f379fe2ae145a8db88722e4293c1271579e93f086675a7654c6
Instruction Fuzzy Hash: A901A131704B9182EA46CB57B5903A953A0E78CFD0F085024FF8E5BB28DE3DC4968700

Function 000000014000A824 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000000014000A85B
GetCurrentProcessId.KERNEL32 ref: 000000014000A866
GetCurrentThreadId.KERNEL32 ref: 000000014000A872
GetTickCount.KERNEL32 ref: 000000014000A87E
QueryPerformanceCounter.KERNEL32 ref: 000000014000A88F

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 805f681e310bcaa54f51ad100a0e80d747b094cd24f6d97717bbde417d2946ab
Instruction ID: 00aeea000cc7c7b808f48da4adb55bcdd5cd29d6573f5c95b593dc39200301c0
Opcode Fuzzy Hash: 805f681e310bcaa54f51ad100a0e80d747b094cd24f6d97717bbde417d2946ab
Instruction Fuzzy Hash: A5016931265B4086EB92CF22F8547956360F74DBD0F446620FF9E4B7B0DA7DC9898300

Function 0000000140009CA8 Relevance: 4.5, APIs: 3, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0000000140009CE7
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000140009D2D
UnhandledExceptionFilter.KERNEL32 ref: 0000000140009D38

Part of subcall function 000000014000961C: GetModuleFileNameA.KERNEL32(?,?,?,?,?,0000000140009878,?,?,?,?,000000014000C0F0,?,?,?,000000014000C1CF), ref: 00000001400096DF

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextFileModuleName
String ID:
API String ID: 2731829486-0
Opcode ID: 4e5702ea1c96806e4306ae5e32b9d8c9471292bcdca3bd7594f53fb29dccb40b
Instruction ID: d7211cd7a0b934c5b14731845ea949a2d1b3d6b6722e21d5c4705f73c19bd827
Opcode Fuzzy Hash: 4e5702ea1c96806e4306ae5e32b9d8c9471292bcdca3bd7594f53fb29dccb40b
Instruction Fuzzy Hash: 21015E71215A8542FB66DB62F4547EA63A0FB8D384F040129BB8E0B6F5DF7DC504CB11

Function 0000000140003230 Relevance: 1.5, APIs: 1, Instructions: 35comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 0000000140003277

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 875605757a2449476a98f95d112a103c651caaa92174f3cc6de7ab4ff84c9953
Instruction ID: 4eae171bfb77eac9e3a843d278eb924d81724f4266949a10ae07889404c9975a
Opcode Fuzzy Hash: 875605757a2449476a98f95d112a103c651caaa92174f3cc6de7ab4ff84c9953
Instruction Fuzzy Hash: 51016276604A11C2E712CF2AF450399B3B5F788BC8F598011EB8847738DF39C456C700

Function 000000014000E89C Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32 ref: 000000014000E8C4

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f43f5ff56737a04b063bbd7835d8b4b6d8fd65e0e1228449adbab71e683ed752
Instruction ID: f8f62ac5750262d9b7ce562af0b70137be4286cdc81dfe6cc917c44723564100
Opcode Fuzzy Hash: f43f5ff56737a04b063bbd7835d8b4b6d8fd65e0e1228449adbab71e683ed752
Instruction Fuzzy Hash: F2E039B1608A8081FA32D762E8013CA27A0A79C798F800212BA9C5B6F5DE3CC201CB00

Function 0000000140009E28 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0000000140009E33

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b8a79dd1f54f78a976d3e6130f85f59db9f1453600447be262f51493e9983399
Instruction ID: 610a4ce270b00e521f3fe3a763a0a4cc7b624a191b6a2187795a19de89c1b2a3
Opcode Fuzzy Hash: b8a79dd1f54f78a976d3e6130f85f59db9f1453600447be262f51493e9983399
Instruction Fuzzy Hash: A5B01230B51400C1E705FB23ECCE3C022A0B75C340FC00412F3098A130EA7C819B8700

Function 000000014000D740 Relevance: 53.8, APIs: 43, Instructions: 94
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.LIBCMT ref: 000000014000D755

Part of subcall function 0000000140007398: HeapFree.KERNEL32(?,?,00000000,0000000140008CC4,?,?,00000000,0000000140008AC1,?,?,?,?,0000000140007762,?,?,00000000), ref: 00000001400073AE
Part of subcall function 0000000140007398: _errno.LIBCMT ref: 00000001400073B8
Part of subcall function 0000000140007398: GetLastError.KERNEL32(?,?,00000000,0000000140008CC4,?,?,00000000,0000000140008AC1,?,?,?,?,0000000140007762,?,?,00000000), ref: 00000001400073C0

free.LIBCMT ref: 000000014000D75E
free.LIBCMT ref: 000000014000D767
free.LIBCMT ref: 000000014000D770
free.LIBCMT ref: 000000014000D779
free.LIBCMT ref: 000000014000D782
free.LIBCMT ref: 000000014000D78A
free.LIBCMT ref: 000000014000D793
free.LIBCMT ref: 000000014000D79C
free.LIBCMT ref: 000000014000D7A5
free.LIBCMT ref: 000000014000D7AE
free.LIBCMT ref: 000000014000D7B7
free.LIBCMT ref: 000000014000D7C0
free.LIBCMT ref: 000000014000D7C9
free.LIBCMT ref: 000000014000D7D2
free.LIBCMT ref: 000000014000D7DB
free.LIBCMT ref: 000000014000D7E7
free.LIBCMT ref: 000000014000D7F3
free.LIBCMT ref: 000000014000D7FF
free.LIBCMT ref: 000000014000D80B
free.LIBCMT ref: 000000014000D817
free.LIBCMT ref: 000000014000D823
free.LIBCMT ref: 000000014000D82F
free.LIBCMT ref: 000000014000D83B
free.LIBCMT ref: 000000014000D847
free.LIBCMT ref: 000000014000D853
free.LIBCMT ref: 000000014000D85F
free.LIBCMT ref: 000000014000D86B
free.LIBCMT ref: 000000014000D877
free.LIBCMT ref: 000000014000D883
free.LIBCMT ref: 000000014000D88F
free.LIBCMT ref: 000000014000D89B
free.LIBCMT ref: 000000014000D8A7
free.LIBCMT ref: 000000014000D8B3
free.LIBCMT ref: 000000014000D8BF
free.LIBCMT ref: 000000014000D8CB
free.LIBCMT ref: 000000014000D8D7
free.LIBCMT ref: 000000014000D8E3
free.LIBCMT ref: 000000014000D8EF
free.LIBCMT ref: 000000014000D8FB
free.LIBCMT ref: 000000014000D907
free.LIBCMT ref: 000000014000D913
free.LIBCMT ref: 000000014000D91F

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: b294043ed31a96b31fe9a6b32b266b0c30e33a1bd26a6a8d2958a14b6af750a6
Instruction ID: c0958beaf5094fad19d9f2a1c8c88e157fecefdb76ad659dea4977d404804c16
Opcode Fuzzy Hash: b294043ed31a96b31fe9a6b32b266b0c30e33a1bd26a6a8d2958a14b6af750a6
Instruction Fuzzy Hash: 3C4174B2A1164081FA46FB37D8527EC1320ABCAB84F444532BF4D6B2B7CEB4C9459350

Function 0000000140003BF0 Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 309stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00000001400056A7,?,00000000), ref: 0000000140003C49
CoTaskMemFree.OLE32(?,?,?,?,?,?,?,?,?,?,00000000,?,00000001400056A7,?,00000000), ref: 0000000140003C96

Strings

HKCU{Software{Classes, xrefs: 0000000140003D31, 0000000140003D41
}}, xrefs: 0000000140003DDA, 0000000140003DEA
HKCR, xrefs: 0000000140003CE3

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: FreeTasklstrlen
String ID: }}$HKCR$HKCU{Software{Classes
API String ID: 3667574239-1142484189
Opcode ID: 8d28bbf2e3c96b828f5a0bc7071d0360e1061a846541978ab76e6d9a7004125d
Instruction ID: 97ba2297f0d36d74944d7852c4191000d12d93cac8a229ea8e4991eb19fa2dc4
Opcode Fuzzy Hash: 8d28bbf2e3c96b828f5a0bc7071d0360e1061a846541978ab76e6d9a7004125d
Instruction Fuzzy Hash: 60D1BCB2204A4181FB63DB13F4503EA26A4B74CBD8F544125FF9A5B7F2DB7AC5948704

Function 000000014000D24C Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 130libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,00000000,000000FC,00000001,00000001400097E4,?,?,?,?,?,0000000140009878), ref: 000000014000D289
GetProcAddress.KERNEL32(?,?,?,?,00000000,000000FC,00000001,00000001400097E4,?,?,?,?,?,0000000140009878), ref: 000000014000D2A5
GetProcAddress.KERNEL32(?,?,?,?,00000000,000000FC,00000001,00000001400097E4,?,?,?,?,?,0000000140009878), ref: 000000014000D2CD
EncodePointer.KERNEL32(?,?,?,?,00000000,000000FC,00000001,00000001400097E4,?,?,?,?,?,0000000140009878), ref: 000000014000D2D6
GetProcAddress.KERNEL32(?,?,?,?,00000000,000000FC,00000001,00000001400097E4,?,?,?,?,?,0000000140009878), ref: 000000014000D2EC
EncodePointer.KERNEL32(?,?,?,?,00000000,000000FC,00000001,00000001400097E4,?,?,?,?,?,0000000140009878), ref: 000000014000D2F5
GetProcAddress.KERNEL32(?,?,?,?,00000000,000000FC,00000001,00000001400097E4,?,?,?,?,?,0000000140009878), ref: 000000014000D30B
EncodePointer.KERNEL32(?,?,?,?,00000000,000000FC,00000001,00000001400097E4,?,?,?,?,?,0000000140009878), ref: 000000014000D314
GetProcAddress.KERNEL32(?,?,?,?,00000000,000000FC,00000001,00000001400097E4,?,?,?,?,?,0000000140009878), ref: 000000014000D332
EncodePointer.KERNEL32(?,?,?,?,00000000,000000FC,00000001,00000001400097E4,?,?,?,?,?,0000000140009878), ref: 000000014000D33B
DecodePointer.KERNEL32(?,?,?,?,00000000,000000FC,00000001,00000001400097E4,?,?,?,?,?,0000000140009878), ref: 000000014000D36D
DecodePointer.KERNEL32(?,?,?,?,00000000,000000FC,00000001,00000001400097E4,?,?,?,?,?,0000000140009878), ref: 000000014000D37C
DecodePointer.KERNEL32(?,?,?,?,00000000,000000FC,00000001,00000001400097E4,?,?,?,?,?,0000000140009878), ref: 000000014000D3D4
DecodePointer.KERNEL32(?,?,?,?,00000000,000000FC,00000001,00000001400097E4,?,?,?,?,?,0000000140009878), ref: 000000014000D3F4
DecodePointer.KERNEL32(?,?,?,?,00000000,000000FC,00000001,00000001400097E4,?,?,?,?,?,0000000140009878), ref: 000000014000D40D

Strings

GetProcessWindowStation, xrefs: 000000014000D328
GetActiveWindow, xrefs: 000000014000D2BC
GetLastActivePopup, xrefs: 000000014000D2DB
MessageBoxA, xrefs: 000000014000D29B
GetUserObjectInformationA, xrefs: 000000014000D2FA
USER32.DLL, xrefs: 000000014000D282

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: Pointer$AddressDecodeProc$Encode$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 3085332118-232180764
Opcode ID: 5b6f6419df1a918eadaa3df85aa7bea1dcdac677b95fb57eba1084bd53492d35
Instruction ID: b0c9ef7875fabae5a828df602e2b87cd1658d0750b339f68b7a2deeeea6f0124
Opcode Fuzzy Hash: 5b6f6419df1a918eadaa3df85aa7bea1dcdac677b95fb57eba1084bd53492d35
Instruction Fuzzy Hash: E8510AB0206B1581FE57EB53B8503E932A0AB8DBC0F441026BF8E4B7B5EF39C5518321

Function 000000014000B7EC Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000000014000811C: RtlLookupFunctionEntry.KERNEL32 ref: 0000000140008190

__GetUnwindTryBlock.LIBCMT ref: 000000014000B85D
__SetUnwindTryBlock.LIBCMT ref: 000000014000B885

Part of subcall function 0000000140008088: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,0000000140007470), ref: 0000000140008108

__GetUnwindTryBlock.LIBCMT ref: 000000014000B88F
_getptd.LIBCMT ref: 000000014000B8E4
_getptd.LIBCMT ref: 000000014000B8F6
_getptd.LIBCMT ref: 000000014000B902
_SetThrowImageBase.LIBCMT ref: 000000014000B91F
_getptd.LIBCMT ref: 000000014000B96F
_getptd.LIBCMT ref: 000000014000B981
_getptd.LIBCMT ref: 000000014000B98D
_getptd.LIBCMT ref: 000000014000BCCE

Strings

bad exception, xrefs: 000000014000BA1B
csm, xrefs: 000000014000B8A5
csm, xrefs: 000000014000B93B
csm, xrefs: 000000014000BA6B

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: _getptd$BlockUnwind$BaseEntryExceptionFunctionImageLookupRaiseThrow
String ID: bad exception$csm$csm$csm
API String ID: 2351602029-820278400
Opcode ID: 515ec01ff13d04b697d29f4db90ad25df8b22ea9fb6345d992fda9906cb2c0d0
Instruction ID: dafaeae216a137fbed8fed7eac0a0837beabe067a753f3aa9ed93300367c0196
Opcode Fuzzy Hash: 515ec01ff13d04b697d29f4db90ad25df8b22ea9fb6345d992fda9906cb2c0d0
Instruction Fuzzy Hash: E2E18CB220478086EA72EB26B4407EA77A4F7597C4F448525FF8907BAACF38D491CB01

Function 0000000140005A70 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 213stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 0000000140005B2A
free.LIBCMT ref: 0000000140005B6A
free.LIBCMT ref: 0000000140005B7E
GetModuleHandleW.KERNEL32 ref: 0000000140005BE2
lstrlenW.KERNEL32 ref: 0000000140005C0F
free.LIBCMT ref: 0000000140005C5E
lstrlenW.KERNEL32 ref: 0000000140005C89
free.LIBCMT ref: 0000000140005C72

Part of subcall function 00000001400037F0: lstrlenW.KERNEL32 ref: 000000014000383B
Part of subcall function 00000001400037F0: lstrlenW.KERNEL32 ref: 00000001400038B3

free.LIBCMT ref: 0000000140005CF0
free.LIBCMT ref: 0000000140005D04
free.LIBCMT ref: 0000000140005D90
free.LIBCMT ref: 0000000140005DA4

Strings

REGISTRY, xrefs: 0000000140005D4B
Module, xrefs: 0000000140005CAB
Module_Raw, xrefs: 0000000140005D18

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: free$lstrlen$Module$FileHandleName
String ID: Module$Module_Raw$REGISTRY
API String ID: 47240346-549000027
Opcode ID: 0eb8516139d78ae7982e3a3e02dc2c56e693eea15e665ad8a8e3e17b88ff00be
Instruction ID: 0d51043d63ccf1b47866b192c3ee8ae17b0444253f7b702fbe624e60540ffe13
Opcode Fuzzy Hash: 0eb8516139d78ae7982e3a3e02dc2c56e693eea15e665ad8a8e3e17b88ff00be
Instruction Fuzzy Hash: 5D916FB221578085FA62EB52F4947EB63A4FB8E7C1F841016BF8E47AB6DB39C545C700

Function 00000001400032E0 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 206stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000000014000339A
free.LIBCMT ref: 00000001400033D8
free.LIBCMT ref: 00000001400033EC
GetModuleHandleW.KERNEL32 ref: 0000000140003450
lstrlenW.KERNEL32 ref: 000000014000347D
free.LIBCMT ref: 00000001400034CC
lstrlenW.KERNEL32 ref: 00000001400034F7
free.LIBCMT ref: 00000001400034E0

Part of subcall function 00000001400037F0: lstrlenW.KERNEL32 ref: 000000014000383B
Part of subcall function 00000001400037F0: lstrlenW.KERNEL32 ref: 00000001400038B3

free.LIBCMT ref: 000000014000355E
free.LIBCMT ref: 0000000140003572
free.LIBCMT ref: 00000001400035EE
free.LIBCMT ref: 0000000140003602

Strings

REGISTRY, xrefs: 00000001400035A0
Module, xrefs: 0000000140003519
Module_Raw, xrefs: 0000000140003586

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: free$lstrlen$Module$FileHandleName
String ID: Module$Module_Raw$REGISTRY
API String ID: 47240346-549000027
Opcode ID: 1b8dbd92e831d9b30aa19935c5f53163d24c720a99b2c8b5a10a1f49d7a59c73
Instruction ID: a20f3075f30f8bfc617431944abcf7cf98644f1bb930d154fc3d943831a6d88f
Opcode Fuzzy Hash: 1b8dbd92e831d9b30aa19935c5f53163d24c720a99b2c8b5a10a1f49d7a59c73
Instruction Fuzzy Hash: 0A916EB2219B8095EA63DB12F4917EA63A8FB897C4F801015BF8E47AB6DF39C545C700

Function 000000014000AFE0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000000014000B00E
_getptd.LIBCMT ref: 000000014000B022
_getptd.LIBCMT ref: 000000014000B061
_getptd.LIBCMT ref: 000000014000B06D
_getptd.LIBCMT ref: 000000014000B079
_CreateFrameInfo.LIBCMT ref: 000000014000B08E

Part of subcall function 00000001400085C4: _getptd.LIBCMT ref: 00000001400085D0
Part of subcall function 00000001400085C4: _getptd.LIBCMT ref: 00000001400085DE
Part of subcall function 00000001400085C4: _getptd.LIBCMT ref: 00000001400085F2

_getptd.LIBCMT ref: 000000014000B0AC
_getptd.LIBCMT ref: 000000014000B0BD
_getptd.LIBCMT ref: 000000014000B1C1
_getptd.LIBCMT ref: 000000014000B1D5

Strings

csm, xrefs: 000000014000B181

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: _getptd$CreateFrameInfo
String ID: csm
API String ID: 4181383844-1018135373
Opcode ID: a2df5260ed98cf15840aef52eb4146501ad7326ec8d4dfc4be3d0cca82250c27
Instruction ID: 59cbc98ad185060b0f050dae6d6d36192f63636f2b4c1a8b54fdef7a96141d2f
Opcode Fuzzy Hash: a2df5260ed98cf15840aef52eb4146501ad7326ec8d4dfc4be3d0cca82250c27
Instruction Fuzzy Hash: 3941E472245B8586EA71EB12F4407EA77A4F789BD0F444225EF8D17BA6DB38C4A28700

Function 0000000140008D00 Relevance: 18.1, APIs: 12, Instructions: 82COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0000000140008D1F

Part of subcall function 0000000140007398: HeapFree.KERNEL32(?,?,00000000,0000000140008CC4,?,?,00000000,0000000140008AC1,?,?,?,?,0000000140007762,?,?,00000000), ref: 00000001400073AE
Part of subcall function 0000000140007398: _errno.LIBCMT ref: 00000001400073B8
Part of subcall function 0000000140007398: GetLastError.KERNEL32(?,?,00000000,0000000140008CC4,?,?,00000000,0000000140008AC1,?,?,?,?,0000000140007762,?,?,00000000), ref: 00000001400073C0

free.LIBCMT ref: 0000000140008D2D
free.LIBCMT ref: 0000000140008D3B
free.LIBCMT ref: 0000000140008D49
free.LIBCMT ref: 0000000140008D57
free.LIBCMT ref: 0000000140008D65
free.LIBCMT ref: 0000000140008D76
free.LIBCMT ref: 0000000140008D8E
_lock.LIBCMT ref: 0000000140008D98
free.LIBCMT ref: 0000000140008DC6
_lock.LIBCMT ref: 0000000140008DDB
free.LIBCMT ref: 0000000140008E25

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: free$_lock$ErrorFreeHeapLast_errno
String ID:
API String ID: 1575098132-0
Opcode ID: 62627b433823d386537a654b219d860ae8d7c30fa77884fb431c4aef4a580d45
Instruction ID: 96d6593a3fa4a79db719d122f461afcde06f7864e7a1d776ad58fd213976bbd0
Opcode Fuzzy Hash: 62627b433823d386537a654b219d860ae8d7c30fa77884fb431c4aef4a580d45
Instruction Fuzzy Hash: D33109B161264084FE6AEB63F061BFC1361BF8ABC0F441626BF4E176E6CE78C9418351

Function 000000014000E8F0 Relevance: 15.2, APIs: 10, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000020,?,?,00000000,?,00000000,?), ref: 000000014000E946
GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000020,?,?,00000000,?,00000000,?), ref: 000000014000E965
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000020,?,?,00000000,?,00000000,?), ref: 000000014000EA0A
malloc.LIBCMT ref: 000000014000EA21
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000020,?,?,00000000,?,00000000,?), ref: 000000014000EA69
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000020,?,?,00000000,?,00000000,?), ref: 000000014000EAA4
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000020,?,?,00000000,?,00000000,?), ref: 000000014000EAE0
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000020,?,?,00000000,?,00000000,?), ref: 000000014000EB20
free.LIBCMT ref: 000000014000EB2E
free.LIBCMT ref: 000000014000EB50

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: ByteCharMultiWide$Infofree$malloc
String ID:
API String ID: 1309074677-0
Opcode ID: fde0d328da79bf17c281ecad3b8224bc5219f49d839b3bcb3318655f7e3d1ab7
Instruction ID: 74af14bb06a820b3063617f7b55946240b22efecd0e85ac0e4f58a2a3f6433e7
Opcode Fuzzy Hash: fde0d328da79bf17c281ecad3b8224bc5219f49d839b3bcb3318655f7e3d1ab7
Instruction Fuzzy Hash: 7D61AFB22006C086EB66CB26B8407EAB6D5F78D7E4F184625FB5A67BF4DB78C5418300

Function 0000000140004B80 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

CharNextW.USER32 ref: 0000000140004BAA
CharNextW.USER32 ref: 0000000140004BF1
CharNextW.USER32 ref: 0000000140004C0D
CharNextW.USER32 ref: 0000000140004C22
CharNextW.USER32 ref: 0000000140004C31
CharNextW.USER32 ref: 0000000140004C92
CharNextW.USER32 ref: 0000000140004CBF

Strings

', xrefs: 0000000140004BDE

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: CharNext
String ID: '
API String ID: 3213498283-1997036262
Opcode ID: 0e6ded2558aacabd075a1b17af776be4bfc9a755cb72b628663e67427d2967ff
Instruction ID: b64bcd3b1c09598002f4f60942271453c3cd8730bd64f8bfe81f92d9ec6a9a95
Opcode Fuzzy Hash: 0e6ded2558aacabd075a1b17af776be4bfc9a755cb72b628663e67427d2967ff
Instruction Fuzzy Hash: A85151B6201A5481EB62CF16F5443AD73A5F76CBC8F549412FB89873B6EB79C890C308

Function 000000014000C1F0 Relevance: 13.8, APIs: 11, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000000014000C23C

Part of subcall function 0000000140007398: HeapFree.KERNEL32(?,?,00000000,0000000140008CC4,?,?,00000000,0000000140008AC1,?,?,?,?,0000000140007762,?,?,00000000), ref: 00000001400073AE
Part of subcall function 0000000140007398: _errno.LIBCMT ref: 00000001400073B8
Part of subcall function 0000000140007398: GetLastError.KERNEL32(?,?,00000000,0000000140008CC4,?,?,00000000,0000000140008AC1,?,?,?,?,0000000140007762,?,?,00000000), ref: 00000001400073C0

Part of subcall function 000000014000D974: free.LIBCMT ref: 000000014000D992
Part of subcall function 000000014000D974: free.LIBCMT ref: 000000014000D9A4
Part of subcall function 000000014000D974: free.LIBCMT ref: 000000014000D9B6
Part of subcall function 000000014000D974: free.LIBCMT ref: 000000014000D9C8
Part of subcall function 000000014000D974: free.LIBCMT ref: 000000014000D9DA
Part of subcall function 000000014000D974: free.LIBCMT ref: 000000014000D9EC
Part of subcall function 000000014000D974: free.LIBCMT ref: 000000014000D9FE

free.LIBCMT ref: 000000014000C25E
free.LIBCMT ref: 000000014000C276
free.LIBCMT ref: 000000014000C282
free.LIBCMT ref: 000000014000C2A6
free.LIBCMT ref: 000000014000C2BA
free.LIBCMT ref: 000000014000C2C9
free.LIBCMT ref: 000000014000C2D5
free.LIBCMT ref: 000000014000C302
free.LIBCMT ref: 000000014000C32A
free.LIBCMT ref: 000000014000C344

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 4358f57d0e295694d605f874f1cbf1a7fd68dea9e3487841cd4a87c289e8253f
Instruction ID: 56ad933bf91817ce6327eb374a1c6172d5f27e7827888fe5a92640bb60b87dc2
Opcode Fuzzy Hash: 4358f57d0e295694d605f874f1cbf1a7fd68dea9e3487841cd4a87c289e8253f
Instruction Fuzzy Hash: 9741DAB262268084FF56DF67E451BEC23A0AB8DBD4F584435BB0D4B6A5CF78C9918310

Function 000000014000DAE8 Relevance: 13.7, APIs: 9, Instructions: 173COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,?,?,?,?,?,?,000000014000DDBA), ref: 000000014000DB48
GetLastError.KERNEL32(?,?,?,?,?,?,?,000000014000DDBA), ref: 000000014000DB5A
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,000000014000DDBA), ref: 000000014000DBBA
malloc.LIBCMT ref: 000000014000DC26
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,000000014000DDBA), ref: 000000014000DC70
GetStringTypeW.KERNEL32(?,?,?,?,?,?,?,000000014000DDBA), ref: 000000014000DC87
free.LIBCMT ref: 000000014000DC98
GetStringTypeA.KERNEL32(?,?,?,?,?,?,?,000000014000DDBA), ref: 000000014000DD15
free.LIBCMT ref: 000000014000DD25

Part of subcall function 000000014000E8F0: GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000020,?,?,00000000,?,00000000,?), ref: 000000014000E946
Part of subcall function 000000014000E8F0: GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000020,?,?,00000000,?,00000000,?), ref: 000000014000E965
Part of subcall function 000000014000E8F0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000020,?,?,00000000,?,00000000,?), ref: 000000014000EA69
Part of subcall function 000000014000E8F0: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000020,?,?,00000000,?,00000000,?), ref: 000000014000EAA4

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: ByteCharMultiWide$StringType$Infofree$ErrorLastmalloc
String ID:
API String ID: 3804003340-0
Opcode ID: f2f3bf7c34cd13633bb1380339f3195d64577aad6335747b2f6ba3b570a5d046
Instruction ID: cab85fc238418ec976bf301ebaf6f74cf56dc6d435efe584e054c2169caed09c
Opcode Fuzzy Hash: f2f3bf7c34cd13633bb1380339f3195d64577aad6335747b2f6ba3b570a5d046
Instruction Fuzzy Hash: AC61AFB260068486EB22DF26E540BDD7792F74CBE8F544626FF1957BA8DBB4C840C350

Function 00000001400064F0 Relevance: 12.1, APIs: 8, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 0000000140006522
SysAllocString.OLEAUT32 ref: 0000000140006530

Part of subcall function 0000000140006060: RegOpenKeyExW.ADVAPI32 ref: 00000001400060C8
Part of subcall function 0000000140006060: RegCloseKey.ADVAPI32 ref: 0000000140006106

SysFreeString.OLEAUT32 ref: 0000000140006557
SysAllocString.OLEAUT32 ref: 0000000140006565
SysFreeString.OLEAUT32 ref: 000000014000658C
SysAllocString.OLEAUT32 ref: 000000014000659A
SysFreeString.OLEAUT32 ref: 00000001400065C6
SysAllocString.OLEAUT32 ref: 00000001400065D4

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: String$AllocFree$CloseOpen
String ID:
API String ID: 2642695901-0
Opcode ID: 68c6b1cc41f599b406cc5914f14598145bd948cd27f6acc84c7cec185ad1da02
Instruction ID: ea616666b6e2f61425ff325b76587b7726ec7a38bd78109e6b2d8fa9203de7bb
Opcode Fuzzy Hash: 68c6b1cc41f599b406cc5914f14598145bd948cd27f6acc84c7cec185ad1da02
Instruction Fuzzy Hash: C5316CB1241F5182EA66DB62B9583A862A6FB4CBC5F240114FF8A27B6CDF78C850C344

Function 0000000140006390 Relevance: 10.6, APIs: 7, Instructions: 91librarystringloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000001400063D0
lstrlenW.KERNEL32 ref: 00000001400063EE
WideCharToMultiByte.KERNEL32 ref: 0000000140006460
GetProcAddress.KERNEL32 ref: 000000014000647E
FreeLibrary.KERNEL32 ref: 000000014000648C
GetLastError.KERNEL32 ref: 0000000140006492
FreeLibrary.KERNEL32 ref: 00000001400064AD

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: Library$Free$AddressByteCharErrorLastLoadMultiProcWidelstrlen
String ID:
API String ID: 3778413393-0
Opcode ID: 49835e31d37fd752eb4ecd8de971fa9f82d5c83a7a29c42762e4dd7f15a00a60
Instruction ID: acd532ba863be1c7bcd3007121607070e3b0e9c9fdc9593c5502ec0fd2b1d1be
Opcode Fuzzy Hash: 49835e31d37fd752eb4ecd8de971fa9f82d5c83a7a29c42762e4dd7f15a00a60
Instruction Fuzzy Hash: 57316071304B9085E752DF72A8547D923A1F74CBE4F484225BB9E577A4DF39C545C300

Function 000000014000B0F1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000000014000B0F9
RaiseException.KERNEL32 ref: 000000014000B135
RaiseException.KERNEL32 ref: 000000014000B152
_getptd.LIBCMT ref: 000000014000B1C1
_getptd.LIBCMT ref: 000000014000B1D5

Strings

csm, xrefs: 000000014000B181

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: _getptd$ExceptionRaise
String ID: csm
API String ID: 2255768072-1018135373
Opcode ID: 85e021c1cf15b837442737425ff74368fab25fdd73c0e90eefd894568a3e8b92
Instruction ID: 7834f7b1a417e502361a51dcb3367f281ffcacd5a829dde570f4ab484c457edc
Opcode Fuzzy Hash: 85e021c1cf15b837442737425ff74368fab25fdd73c0e90eefd894568a3e8b92
Instruction Fuzzy Hash: B8313E76240685C6E671DF12F0507DE7764F788BA1F404226EF9A13BA5CB39D985CB01

Function 000000014000C0C4 Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 000000014000C0EB

Part of subcall function 000000014000961C: GetModuleFileNameA.KERNEL32(?,?,?,?,?,0000000140009878,?,?,?,?,000000014000C0F0,?,?,?,000000014000C1CF), ref: 00000001400096DF

Part of subcall function 00000001400090E8: ExitProcess.KERNEL32 ref: 00000001400090F7

Part of subcall function 0000000140008EBC: malloc.LIBCMT ref: 0000000140008EDB
Part of subcall function 0000000140008EBC: Sleep.KERNEL32(?,?,00000000,000000014000C125,?,?,?,000000014000C1CF,?,?,00000000,0000000140008BF9,?,?,00000000,0000000140008CB0), ref: 0000000140008EF2

_errno.LIBCMT ref: 000000014000C12D
_lock.LIBCMT ref: 000000014000C141
free.LIBCMT ref: 000000014000C163
_errno.LIBCMT ref: 000000014000C168
LeaveCriticalSection.KERNEL32(?,?,?,000000014000C1CF,?,?,00000000,0000000140008BF9,?,?,00000000,0000000140008CB0,?,?,00000000,0000000140008AC1), ref: 000000014000C18E

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: _errno$CriticalExitFileLeaveModuleNameProcessSectionSleep_lockfreemalloc
String ID:
API String ID: 1024173049-0
Opcode ID: 27328bd3c37525a16da653f5624db51b334cf35f8d4b93e75faabd07a2e7061a
Instruction ID: a459ecb661e264d81968177394fb0841a67272d0fcd7c351f488746f679228cb
Opcode Fuzzy Hash: 27328bd3c37525a16da653f5624db51b334cf35f8d4b93e75faabd07a2e7061a
Instruction Fuzzy Hash: 61218EB162664082F662EB13B805BEE62A5EB8E7C4F544025BB4A4B7F3CF7CC8408340

Function 000000014000CC64 Relevance: 9.1, APIs: 6, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000000014000CC83

Part of subcall function 000000014000C7F4: _getptd.LIBCMT ref: 000000014000C7FE

Part of subcall function 000000014000C95C: GetOEMCP.KERNEL32 ref: 000000014000C986

Part of subcall function 0000000140008EBC: malloc.LIBCMT ref: 0000000140008EDB
Part of subcall function 0000000140008EBC: Sleep.KERNEL32(?,?,00000000,000000014000C125,?,?,?,000000014000C1CF,?,?,00000000,0000000140008BF9,?,?,00000000,0000000140008CB0), ref: 0000000140008EF2

free.LIBCMT ref: 000000014000CD0F

Part of subcall function 0000000140007398: HeapFree.KERNEL32(?,?,00000000,0000000140008CC4,?,?,00000000,0000000140008AC1,?,?,?,?,0000000140007762,?,?,00000000), ref: 00000001400073AE
Part of subcall function 0000000140007398: _errno.LIBCMT ref: 00000001400073B8
Part of subcall function 0000000140007398: GetLastError.KERNEL32(?,?,00000000,0000000140008CC4,?,?,00000000,0000000140008AC1,?,?,?,?,0000000140007762,?,?,00000000), ref: 00000001400073C0

_lock.LIBCMT ref: 000000014000CD47
free.LIBCMT ref: 000000014000CDF7
free.LIBCMT ref: 000000014000CE27
_errno.LIBCMT ref: 000000014000CE2C

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: free$_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 2878544890-0
Opcode ID: 4ffe022ba510d5618aff1731b833a035a863fc98d5603c194fd9b1b589509ede
Instruction ID: 729266b367a9acadb76e510206d03886aa791f85ad191b3d94257b74e8d0af1f
Opcode Fuzzy Hash: 4ffe022ba510d5618aff1731b833a035a863fc98d5603c194fd9b1b589509ede
Instruction Fuzzy Hash: B6519EB161268086E766DB27F4407E9BBA1F78CBD4F644226FB9A473B5DB38C442C710

Function 00000001400048A0 Relevance: 9.1, APIs: 6, Instructions: 93registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00000001400048F3
RegCloseKey.ADVAPI32 ref: 000000014000490D
RegEnumKeyExW.ADVAPI32 ref: 0000000140004960
RegEnumKeyExW.ADVAPI32 ref: 00000001400049B7
RegCloseKey.ADVAPI32 ref: 00000001400049CB
RegCloseKey.ADVAPI32 ref: 00000001400049F1

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: Close$Enum$Open
String ID:
API String ID: 4245071059-0
Opcode ID: 6b27da36c03dc189b13cc3fc719a83d315f55ae3f45d5c4ca58aa036d5068959
Instruction ID: 66739259efcb7cf610d53dcf62e1f4f3b598e0703dc97c14d406df7e91f72b85
Opcode Fuzzy Hash: 6b27da36c03dc189b13cc3fc719a83d315f55ae3f45d5c4ca58aa036d5068959
Instruction Fuzzy Hash: 38411672209B8186EB62CB56F89039AB7E4FBCC7D4F100125FB8D87A69DF78C4458B00

Function 0000000140008C58 Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000,0000000140008AC1,?,?,?,?,0000000140007762,?,?,00000000,00000001400073F7), ref: 0000000140008C62
FlsGetValue.KERNEL32(?,?,00000000,0000000140008AC1,?,?,?,?,0000000140007762,?,?,00000000,00000001400073F7), ref: 0000000140008C70
SetLastError.KERNEL32(?,?,00000000,0000000140008AC1,?,?,?,?,0000000140007762,?,?,00000000,00000001400073F7), ref: 0000000140008CC8

Part of subcall function 0000000140008F28: Sleep.KERNEL32(?,?,00000000,0000000140008C8B,?,?,00000000,0000000140008AC1,?,?,?,?,0000000140007762,?,?,00000000), ref: 0000000140008F6D

FlsSetValue.KERNEL32(?,?,00000000,0000000140008AC1,?,?,?,?,0000000140007762,?,?,00000000,00000001400073F7), ref: 0000000140008C9C
free.LIBCMT ref: 0000000140008CBF

Part of subcall function 0000000140008BA4: _lock.LIBCMT ref: 0000000140008BF4
Part of subcall function 0000000140008BA4: _lock.LIBCMT ref: 0000000140008C14

GetCurrentThreadId.KERNEL32 ref: 0000000140008CB0

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 83e5c8f28edd488bb586a77fb23812abd2622481f1c1e1bf039117adda3e93b5
Instruction ID: 6943dabb5a8c28a8a6b8719798e64d2a641102e6684dc43baf1e331fb3e6e0bb
Opcode Fuzzy Hash: 83e5c8f28edd488bb586a77fb23812abd2622481f1c1e1bf039117adda3e93b5
Instruction Fuzzy Hash: FD01217060174182FB57DB67B944BA822A2BB8C7E0F184228FF99473F1EE7CC5458310

Function 00000001400066B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00000001400066D0
GetProcAddress.KERNEL32 ref: 00000001400066F2
FreeLibrary.KERNEL32 ref: 0000000140006703

Strings

DriverPackageInstallW, xrefs: 00000001400066E8

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: DriverPackageInstallW
API String ID: 145871493-1557024896
Opcode ID: 06898464406e56f7c49107d1d52abf3077fc6534b014ff019eb78fcc24f1b6f7
Instruction ID: e6090650b5da9845b7b647930ee2fbfc1c5c9c7a2d3d279e6188ef2b8700c45a
Opcode Fuzzy Hash: 06898464406e56f7c49107d1d52abf3077fc6534b014ff019eb78fcc24f1b6f7
Instruction Fuzzy Hash: 7B213975209B8586DA61CB2AB4503AA73E1F74CBD4F544125FF8D97B28EF3CC9448B40

Function 00000001400067B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00000001400067D0
GetProcAddress.KERNEL32 ref: 00000001400067F2
FreeLibrary.KERNEL32 ref: 0000000140006803

Strings

DriverPackageUninstallW, xrefs: 00000001400067E8

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: DriverPackageUninstallW
API String ID: 145871493-4209722632
Opcode ID: 2fccdce5eaa761393539b991b21593147892889562b044c7766234b3e4124e58
Instruction ID: 1d03c2be80ddb3689b6e782ac2bc9dc50387c9c5d39cb900616ffb64ce7251f1
Opcode Fuzzy Hash: 2fccdce5eaa761393539b991b21593147892889562b044c7766234b3e4124e58
Instruction Fuzzy Hash: D4213972609B8586DA61CB26B8503AA73E1F74CBD4F548225FF8D97B28EF38C5448B40

Function 0000000140006610 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 0000000140006628
GetProcAddress.KERNEL32 ref: 0000000140006655
FreeLibrary.KERNEL32 ref: 0000000140006663

Strings

DriverPackagePreinstallW, xrefs: 000000014000664B

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: DriverPackagePreinstallW
API String ID: 145871493-4107050277
Opcode ID: 6ba2c980b17703929eadda4c4f7273af0fb2cecb180e951db7d5aa7915ea6531
Instruction ID: d9aa6b7dedc5d6099b38ff628ff4d8a1496697f4b307a4f4530b7f8f26d22b0a
Opcode Fuzzy Hash: 6ba2c980b17703929eadda4c4f7273af0fb2cecb180e951db7d5aa7915ea6531
Instruction Fuzzy Hash: 8401B571719B9182EB86CB5BB59036953A0F78CBD4F485024FF4E5B728EE3DC8968700

Function 000000014000D974 Relevance: 8.8, APIs: 7, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000000014000D992

Part of subcall function 0000000140007398: HeapFree.KERNEL32(?,?,00000000,0000000140008CC4,?,?,00000000,0000000140008AC1,?,?,?,?,0000000140007762,?,?,00000000), ref: 00000001400073AE
Part of subcall function 0000000140007398: _errno.LIBCMT ref: 00000001400073B8
Part of subcall function 0000000140007398: GetLastError.KERNEL32(?,?,00000000,0000000140008CC4,?,?,00000000,0000000140008AC1,?,?,?,?,0000000140007762,?,?,00000000), ref: 00000001400073C0

free.LIBCMT ref: 000000014000D9A4
free.LIBCMT ref: 000000014000D9B6
free.LIBCMT ref: 000000014000D9C8
free.LIBCMT ref: 000000014000D9DA
free.LIBCMT ref: 000000014000D9EC
free.LIBCMT ref: 000000014000D9FE

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 3cca06d8e3bf9a3713f966f07bb8bb3718331e0fbae277c8b9b49ab32aabf939
Instruction ID: 2145a17a23cdd023243b8bcbe047b7ca5d80e31c4ef3d8716a82684131bcfb00
Opcode Fuzzy Hash: 3cca06d8e3bf9a3713f966f07bb8bb3718331e0fbae277c8b9b49ab32aabf939
Instruction Fuzzy Hash: 1C01ADB260050091FB53EB63F492BED2371A7CE7C4F440416BB0E5B5B5CE79D9819361

Function 000000014000ACC4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000000014000ACDB

Part of subcall function 00000001400088D0: _getptd.LIBCMT ref: 00000001400088D4

_getptd.LIBCMT ref: 000000014000ACED
_getptd.LIBCMT ref: 000000014000ACFB

Strings

csm, xrefs: 000000014000ACD3
MOC, xrefs: 000000014000ACCB

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: _getptd
String ID: MOC$csm
API String ID: 3186804695-1389381023
Opcode ID: bc2323d3ee3df84e0aa3928afe37143f4d3522527c0845f9e5bd94596c0b7c31
Instruction ID: 3aa5a0e8cf80a6e70265197e5a9df1865b83e6168b1c95c143dd321bc9a731e2
Opcode Fuzzy Hash: bc2323d3ee3df84e0aa3928afe37143f4d3522527c0845f9e5bd94596c0b7c31
Instruction Fuzzy Hash: 55E04875501200CAF727FB52A0057DD35E0F79D756F86C071A784433A2C7BC4490CB11

Function 000000014000A4C4 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32 ref: 000000014000A4E9

Part of subcall function 0000000140008F28: Sleep.KERNEL32(?,?,00000000,0000000140008C8B,?,?,00000000,0000000140008AC1,?,?,?,?,0000000140007762,?,?,00000000), ref: 0000000140008F6D

GetFileType.KERNEL32 ref: 000000014000A666

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: FileInfoSleepStartupType
String ID:
API String ID: 1527402494-0
Opcode ID: 251b22781a8bed187218fd6f99c950f5ffda652357fdfb7a9b45b7507ab7663a
Instruction ID: f1a4cc58452895f8ecabbee7fc04da0b3070f15edfd3bdd4804f75d1c2ee8532
Opcode Fuzzy Hash: 251b22781a8bed187218fd6f99c950f5ffda652357fdfb7a9b45b7507ab7663a
Instruction Fuzzy Hash: 14915DB261468085EB12CB26E84879836E5F30A7F4F698725E7B9473F1DB7EC842C711

Function 00000001400074B8 Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,00000000,00000001400075C9,?,?,?,?,0000000140007449), ref: 00000001400074E1
DecodePointer.KERNEL32(?,?,00000000,00000001400075C9,?,?,?,?,0000000140007449), ref: 00000001400074F0

Part of subcall function 0000000140009034: _errno.LIBCMT ref: 000000014000903D

EncodePointer.KERNEL32(?,?,00000000,00000001400075C9,?,?,?,?,0000000140007449), ref: 000000014000756D

Part of subcall function 0000000140008FAC: realloc.LIBCMT ref: 0000000140008FD7
Part of subcall function 0000000140008FAC: Sleep.KERNEL32(?,?,00000000,000000014000755D,?,?,00000000,00000001400075C9,?,?,?,?,0000000140007449), ref: 0000000140008FF3

EncodePointer.KERNEL32(?,?,00000000,00000001400075C9,?,?,?,?,0000000140007449), ref: 000000014000757C
EncodePointer.KERNEL32(?,?,00000000,00000001400075C9,?,?,?,?,0000000140007449), ref: 0000000140007588

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: Pointer$Encode$Decode$Sleep_errnorealloc
String ID:
API String ID: 1310268301-0
Opcode ID: 5e85352ea3328edc7a216b42e29695b01e4e5a847025ff0e929179526e54d913
Instruction ID: 6cd1af15e87afbe952b9f477314331f12dd8beeea221fddc429617c45dbd875d
Opcode Fuzzy Hash: 5e85352ea3328edc7a216b42e29695b01e4e5a847025ff0e929179526e54d913
Instruction Fuzzy Hash: 78216DB1701A4480EA12EB63F9443DAA391B78CBC1F444825FB4E0B7BAEABCC085C345

Function 000000014000B5A8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000000014000B5D9
_getptd.LIBCMT ref: 000000014000B5F8
_CallSETranslator.LIBCMT ref: 000000014000B639

Part of subcall function 0000000140008448: _getptd.LIBCMT ref: 000000014000846F

Strings

MOC, xrefs: 000000014000B60E

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: _getptd$CallTranslator
String ID: MOC
API String ID: 3569367362-624257665
Opcode ID: 04df5c5e1e2076b2249b6c941c7c70ae2ac4259a1e13be1024252e866a7979be
Instruction ID: 504180437007703d3da7f54a7c0a24b6b739d7cd428bf268837928b5220591e0
Opcode Fuzzy Hash: 04df5c5e1e2076b2249b6c941c7c70ae2ac4259a1e13be1024252e866a7979be
Instruction Fuzzy Hash: 6A6190B2204BC496DB31DB16F4807EEB7A0F788BC8F044526EB9D47AA9DB78C155CB00

Function 0000000140004AD0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000000140004AF0
GetProcAddress.KERNEL32 ref: 0000000140004B05

Strings

Advapi32.dll, xrefs: 0000000140004AE9
RegDeleteKeyExW, xrefs: 0000000140004AFB

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyExW
API String ID: 1646373207-2191092095
Opcode ID: ba2d829cebd6b487d60ee0deaf7004dfa47d5afa8726728c944fe30236e214ef
Instruction ID: 462ee25dd716abb96fc04bf8f2c598cfe9262d5ff41b4f641db104fb3e694699
Opcode Fuzzy Hash: ba2d829cebd6b487d60ee0deaf7004dfa47d5afa8726728c944fe30236e214ef
Instruction Fuzzy Hash: 0501E2B1619A8080EB57CF57E8847D527A0EB4CBC4F885065EB4D0B7BADB7AC494C704

Function 00000001400090AC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,000000FF,00000001400090F5,?,?,00000000,000000014000C102,?,?,?,000000014000C1CF,?,?,00000000,0000000140008BF9), ref: 00000001400090BB
GetProcAddress.KERNEL32(?,?,000000FF,00000001400090F5,?,?,00000000,000000014000C102,?,?,?,000000014000C1CF,?,?,00000000,0000000140008BF9), ref: 00000001400090D0

Strings

CorExitProcess, xrefs: 00000001400090C6
mscoree.dll, xrefs: 00000001400090B4

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: ae92f531f47ebb245147c041da5d04b1de0f7ba00532cfa74997367f00670beb
Instruction ID: bd44a2196b5c310ae1a0f19dda9ad44ff415f0a3e7d637001e16db04d52139ff
Opcode Fuzzy Hash: ae92f531f47ebb245147c041da5d04b1de0f7ba00532cfa74997367f00670beb
Instruction Fuzzy Hash: C0E0127071661542FE9B9B92B8843A412919B4C780F485028A79E0B3F1EE7A9999C700

Function 000000014000AD10 Relevance: 6.1, APIs: 4, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000000140008208: _getptd.LIBCMT ref: 000000014000820C

_getptd.LIBCMT ref: 000000014000AD52
_SetImageBase.LIBCMT ref: 000000014000AE28
_getptd.LIBCMT ref: 000000014000AE5B
_getptd.LIBCMT ref: 000000014000AE69

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: _getptd$BaseImage
String ID:
API String ID: 2482573191-0
Opcode ID: 98a5a6a917ddd4be4fca11f54d82e087a7ecbe56627acb91d98cb70d4dc990ef
Instruction ID: db1282a9764c579a757e51b53515a999351e9a52606167c5de47e02bd004f7b0
Opcode Fuzzy Hash: 98a5a6a917ddd4be4fca11f54d82e087a7ecbe56627acb91d98cb70d4dc990ef
Instruction Fuzzy Hash: 304163B2600A4585EA26E757F4817ED6690B74EBD8F558222FF59477F2DB38C442C700

Function 00000001400036F0 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0000000140003753
free.LIBCMT ref: 0000000140003768
RaiseException.KERNEL32(?,?,?,?,?,?,?,00000001400035DA), ref: 000000014000379D
RaiseException.KERNEL32(?,?,?,00000001400035DA), ref: 00000001400037B3

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: ExceptionRaisefree
String ID:
API String ID: 501637548-0
Opcode ID: dafb5da48201dce4baf7c8ff6607bf8fea63bcc6beef1ff0bd367b6192d39cd7
Instruction ID: fafe504ed305d800c50ee4d728a906ad5c677b67aa98a7fd24dbcfceddb15717
Opcode Fuzzy Hash: dafb5da48201dce4baf7c8ff6607bf8fea63bcc6beef1ff0bd367b6192d39cd7
Instruction Fuzzy Hash: 6E219DB2604A50C2FB66DF22F191BED73A0FB88FC4F008515EB9907A69CF79C8418781

Function 0000000140008B7C Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32(?,?,?,?,0000000140008EB1,?,?,00000000,0000000140007C12), ref: 0000000140008B8B
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140008EB1), ref: 000000014000C05E
free.LIBCMT ref: 000000014000C067
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140008EB1), ref: 000000014000C087

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: a3176ef91523f80b145836236767eea2317155b237430114f4e431af4d8ba0ab
Instruction ID: 24949af41600a50218b7ba83c01f318ba3bcce0f53689542d12ca2586d092747
Opcode Fuzzy Hash: a3176ef91523f80b145836236767eea2317155b237430114f4e431af4d8ba0ab
Instruction Fuzzy Hash: 16118871A16A40C2FA2ACB17F8447987360F74DBD4F584211FB990BAB5CB39C496C700

Function 0000000140002A90 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 0000000140002AD0
SysFreeString.OLEAUT32 ref: 0000000140002ADA
SysFreeString.OLEAUT32 ref: 0000000140002AE4
SysFreeString.OLEAUT32 ref: 0000000140002AEE

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: b5e704aaa25ec80050bffbaab756e7269d2974b30e33d70d5be437bf872a4c96
Instruction ID: 2460d78c275cdd5aba3c75697fa967caff103665d156fc7b4d197c2ee54207d4
Opcode Fuzzy Hash: b5e704aaa25ec80050bffbaab756e7269d2974b30e33d70d5be437bf872a4c96
Instruction Fuzzy Hash: 1801EC31204A0186D7129F1BE9983997370FB88FE4F144211EBAE47BB5DF7AD4A5C300

Function 00000001400023A0 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 00000001400023D1
SysFreeString.OLEAUT32 ref: 00000001400023DB
SysFreeString.OLEAUT32 ref: 00000001400023E5
SysFreeString.OLEAUT32 ref: 00000001400023EF

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: e8a3a9a07525436b146ad32b67b240c06138c429e22b6ce2f8afbaa00471f732
Instruction ID: c7f1c6efbe32ed7523752ccb910b43a785a44d6dba67ad8cd7571bb3764643f5
Opcode Fuzzy Hash: e8a3a9a07525436b146ad32b67b240c06138c429e22b6ce2f8afbaa00471f732
Instruction Fuzzy Hash: D3F0C432214A0196EB069B27E9983A86370FB8CFC0F144021EB4E47B70CF79C4A5C340

Function 000000014000BD6C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000000014000BD90

Strings

csm, xrefs: 000000014000BDBD
csm, xrefs: 000000014000BEC7

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 5558db94516e4555785c3016d45f11891a141cde8e88e727fe663a89f03799f2
Instruction ID: 02180cf6eb52865928f417daec28905aa01ff43f23aafe2298e435bb3e352a72
Opcode Fuzzy Hash: 5558db94516e4555785c3016d45f11891a141cde8e88e727fe663a89f03799f2
Instruction Fuzzy Hash: D2518FB220468086EB76CE27F4407E9B6A0F35DBC4F148125FF9957BA9CB38C891CB05

Function 000000014000F0F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 000000014000863C: _getptd.LIBCMT ref: 0000000140008649
Part of subcall function 000000014000863C: _getptd.LIBCMT ref: 000000014000865C

_getptd.LIBCMT ref: 000000014000F150
_getptd.LIBCMT ref: 000000014000F163

Strings

csm, xrefs: 000000014000F110

Memory Dump Source

Source File: 00000003.00000002.3073780559.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000003.00000002.3073689091.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073858819.0000000140010000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3073935163.0000000140017000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3074008214.000000014001A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000000_ISBEW64.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 5fb5f516ece612a840ad19b53f9db860e8904185b01b90d7810ceb371c965011
Instruction ID: ce4c0d6d623976e352da637ade08d3c0661dd96a3736f888ca5ddf5caa442b5d
Opcode Fuzzy Hash: 5fb5f516ece612a840ad19b53f9db860e8904185b01b90d7810ceb371c965011
Instruction Fuzzy Hash: 03014CB2101641C9EB72DF72E8503F823A4E79CB99F498125EF4D0BBA5CB30C981E701

Analysis Process: dotnetinstaller.exePID: 3160, Parent PID: 2200COMMON

Execution Graph

Execution Coverage:	12.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	13
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 04AA0070 Relevance: 2.8, Strings: 2, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@j, xrefs: 04AA0390
dSk, xrefs: 04AA0371

Memory Dump Source

Source File: 0000000A.00000002.2730089445.0000000004AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4aa0000_dotnetinstaller.jbxd

Similarity

API ID:
String ID: :@j$dSk
API String ID: 0-4078699674
Opcode ID: 8c6c6b6d2fdc0ff611cde22b7fa455ca0cc1971bab206b4ea99e350d35092edb
Instruction ID: 15b53b249d06d9c7292e4ca19169ad3281d3f71d06840bf41c27f6144efc5ab0
Opcode Fuzzy Hash: 8c6c6b6d2fdc0ff611cde22b7fa455ca0cc1971bab206b4ea99e350d35092edb
Instruction Fuzzy Hash: 8CA17C307052058FDB18AFB8C4587AE77F6EF89308F208479D605CF2A5DB7A9895CB91

Function 01EBA4CF Relevance: 1.6, APIs: 1, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(?,00000E84,3525C6B7,00000000,00000000,00000000,00000000), ref: 01EBA561

Memory Dump Source

Source File: 0000000A.00000002.2726523312.0000000001EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 01EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1eba000_dotnetinstaller.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: c745fb1fda0f48ec53501c8c13a8dbaf52122a7d55f4d5bb66673f5f602532b8
Instruction ID: 210934036ccaf7aa567b2696aad1ed7ca91abfd98cc175a3925a959990bcce04
Opcode Fuzzy Hash: c745fb1fda0f48ec53501c8c13a8dbaf52122a7d55f4d5bb66673f5f602532b8
Instruction Fuzzy Hash: 3821B5714093806FDB228F61DC45F96BFB8EF46314F0884DBE9858B153D329A909C772

Function 01EBA502 Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(?,00000E84,3525C6B7,00000000,00000000,00000000,00000000), ref: 01EBA561

Memory Dump Source

Source File: 0000000A.00000002.2726523312.0000000001EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 01EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1eba000_dotnetinstaller.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 38f1a50c8f0b331f6c6086cc9fb7d49ee1ebbb91f097f6189d662e5cb806b6a4
Instruction ID: a6775bf243241798607c3167a83d0094658644c4b579c0330d2fd49cfdaf826b
Opcode Fuzzy Hash: 38f1a50c8f0b331f6c6086cc9fb7d49ee1ebbb91f097f6189d662e5cb806b6a4
Instruction Fuzzy Hash: 8E11B672500200AFDB21CF65DC85FAAFBA8EF44314F04846AEA459B151D375E5448BB1

Function 01EBA23C Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(?,3525C6B7,00000000,?,?,?,?,?,?,?,?,6B9D3C58), ref: 01EBA290

Memory Dump Source

Source File: 0000000A.00000002.2726523312.0000000001EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 01EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1eba000_dotnetinstaller.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 330f64d6b587cf0e05c779424f4e44254ec0db7cb0f3ad4329ec6cd341d6e0c4
Instruction ID: 968cd92ff51ba4f76de7adeda21bb02d360424615327cb63ad134aa7897779ff
Opcode Fuzzy Hash: 330f64d6b587cf0e05c779424f4e44254ec0db7cb0f3ad4329ec6cd341d6e0c4
Instruction Fuzzy Hash: FE1188714093849FDB128F15DC44B62FFB4DF46624F0880DAED858B253D275A908CB72

Function 01EBA25E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(?,3525C6B7,00000000,?,?,?,?,?,?,?,?,6B9D3C58), ref: 01EBA290

Memory Dump Source

Source File: 0000000A.00000002.2726523312.0000000001EBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 01EBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1eba000_dotnetinstaller.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: e0f740ffda52c9a654f485dd997a9524b1653c59d008e3f5bb7e359e0367378a
Instruction ID: bf5e0cdcd41e6fccf88debb167c5c51394c22249c2581203840bde2e969f4cb0
Opcode Fuzzy Hash: e0f740ffda52c9a654f485dd997a9524b1653c59d008e3f5bb7e359e0367378a
Instruction Fuzzy Hash: 95F0C8358046508FDB51CF56D8857A6FBA4DF45724F08C0AADD494B352D37AE408CFA2

Function 04AA0007 Relevance: .1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2730089445.0000000004AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4aa0000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a0a9d98e9ce02610d37a1f655dc178f4d0af41b489976eaeccbc286795e41f9
Instruction ID: f506e2557291d250ad5a8ea732283d0cbff7881024fee59076e1527608815f71
Opcode Fuzzy Hash: 5a0a9d98e9ce02610d37a1f655dc178f4d0af41b489976eaeccbc286795e41f9
Instruction Fuzzy Hash: 8751F87090D386CFDB159F74C8583AABBB1BF42318F1481BAC141CB192D37D98A5CB52

Function 01EE05E1 Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2726959641.0000000001EE0000.00000040.00000020.00020000.00000000.sdmp, Offset: 01EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ee0000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d513c47c4c3197f8159c3eaf82f2a97001cc21b25a6d2a4aca9284e94cc0351b
Instruction ID: 46c493cf8bf090822b118351dab767f2874566ccde0b60a8a7b7a13f185dea21
Opcode Fuzzy Hash: d513c47c4c3197f8159c3eaf82f2a97001cc21b25a6d2a4aca9284e94cc0351b
Instruction Fuzzy Hash: 54F0F4B64097806FC3118B66AC41853FFF8DF86230709C4ABEC498B252D139B909CBB2

Function 01EE0606 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2726959641.0000000001EE0000.00000040.00000020.00020000.00000000.sdmp, Offset: 01EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1ee0000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b79e558918d9f6181bc00015acbabf1bca8e9541cdb73dffc26182725c35f2d
Instruction ID: f08fd31e4d6a547da1c96cb8069b11423f5555e867ef9b8ec37080090c324556
Opcode Fuzzy Hash: 1b79e558918d9f6181bc00015acbabf1bca8e9541cdb73dffc26182725c35f2d
Instruction Fuzzy Hash: 38E012B66046045B9750CF0AEC46462F7E4EB84630B18C47FDC4D8B711E67AF509CBB6

Function 01EB23F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2726347463.0000000001EB2000.00000040.00000800.00020000.00000000.sdmp, Offset: 01EB2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1eb2000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825e43207aa856efd7773507bbf11fea808c7a60f153493f424528c8d0a2994b
Instruction ID: d1d40704406a240ca1c21d10a67ba4b6eb717b14655e913080bd8ae785a8a397
Opcode Fuzzy Hash: 825e43207aa856efd7773507bbf11fea808c7a60f153493f424528c8d0a2994b
Instruction Fuzzy Hash: 0AD05B752046814FE7168E1CD595BDA3FA4AF51709F4644F99D408B763C75CE5C5D200

Function 01EB23BC Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2726347463.0000000001EB2000.00000040.00000800.00020000.00000000.sdmp, Offset: 01EB2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1eb2000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91c8a7fe09e583f3af8cdee49668a2e794a8f58cc16faf8c49dccc333adfe4b1
Instruction ID: da1997d9ed5aa264176084ea98dca2d963943a86b6abe7919d1236b305e903f4
Opcode Fuzzy Hash: 91c8a7fe09e583f3af8cdee49668a2e794a8f58cc16faf8c49dccc333adfe4b1
Instruction Fuzzy Hash: E7D05E342416824BDB25DE1CD6D4F9E37D4AF40B08F0644E8AD108B262CBA8E9C0CA00

Analysis Process: dotnetinstaller.exePID: 2716, Parent PID: 2200COMMON

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	13
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02220070 Relevance: 2.8, Strings: 2, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dSk, xrefs: 02220371
:@j, xrefs: 02220390

Memory Dump Source

Source File: 0000000C.00000002.2753670122.0000000002220000.00000040.00000800.00020000.00000000.sdmp, Offset: 02220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2220000_dotnetinstaller.jbxd

Similarity

API ID:
String ID: :@j$dSk
API String ID: 0-4078699674
Opcode ID: 9ab374c1078c84433b90983d490fa7e608a1777d94eeb6f29a73476b770e9f83
Instruction ID: e459d69401b21a00253d7a4abfa55ac2ff126666b98eb94e5cb6f41488892c69
Opcode Fuzzy Hash: 9ab374c1078c84433b90983d490fa7e608a1777d94eeb6f29a73476b770e9f83
Instruction Fuzzy Hash: 2DA1A230714229DFDB18ABB8C51577E77F6EF88308F10817AD105CB2A9DB7A8985CB91

Function 005EA4CF Relevance: 1.6, APIs: 1, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E84,7D6C5AFC,00000000,00000000,00000000,00000000), ref: 005EA561

Memory Dump Source

Source File: 0000000C.00000002.2750957432.00000000005EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 005EA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ea000_dotnetinstaller.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 1cc040a8ef51ba3b9456e23959ed0638aea615e2cbee561587d033754ca43710
Instruction ID: e2ddd0587f6e2b7fad0a2f819e369933392ff5ab4810c84098a814c9afb0cbd2
Opcode Fuzzy Hash: 1cc040a8ef51ba3b9456e23959ed0638aea615e2cbee561587d033754ca43710
Instruction Fuzzy Hash: 8521B5714093806FDB228F61DC45FA6BFB8EF06314F08849BE9858F193D269A909C772

Function 005EA502 Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E84,7D6C5AFC,00000000,00000000,00000000,00000000), ref: 005EA561

Memory Dump Source

Source File: 0000000C.00000002.2750957432.00000000005EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 005EA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ea000_dotnetinstaller.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 0fd0962a325aff8264ae12469964f3da70be3221784c7c28fa70742054196efa
Instruction ID: b3848a5625905d0e2d1466dc98a922307f68e2d4fd1b3cb643eefa4babc2be2f
Opcode Fuzzy Hash: 0fd0962a325aff8264ae12469964f3da70be3221784c7c28fa70742054196efa
Instruction Fuzzy Hash: 5F11B272500240AFEB21CF62DC45F66FBA8EF05314F14885AEA459B151D378E4448BB2

Function 005EA23C Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 005EA290

Memory Dump Source

Source File: 0000000C.00000002.2750957432.00000000005EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 005EA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ea000_dotnetinstaller.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: dfddd8f25fc17428adf80fb7849c4a7bf73656c02716875e0182812ff5083471
Instruction ID: 62a93a039ee7cf3c88547fe4025e5550c272da287fd604d9cdd466b15cf16dbe
Opcode Fuzzy Hash: dfddd8f25fc17428adf80fb7849c4a7bf73656c02716875e0182812ff5083471
Instruction Fuzzy Hash: E71165754093C4AFD7128B15DC44B62FFB4DF56624F0880DAED858B253D265A808CB72

Function 005EA25E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 005EA290

Memory Dump Source

Source File: 0000000C.00000002.2750957432.00000000005EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 005EA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ea000_dotnetinstaller.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: d344cd21b2c2bc342b722dd636ed4701df06607d8ac54b0616a93fcd43abe51a
Instruction ID: b1b9b2c8f79d45dd31ff318d4cbfaedb73bd2e99268b3bf3dee3b30cf89ae858
Opcode Fuzzy Hash: d344cd21b2c2bc342b722dd636ed4701df06607d8ac54b0616a93fcd43abe51a
Instruction Fuzzy Hash: DFF081399046409FDB508F16D885761FF90EF15724F08C09ADE495B252D279F404CAA2

Function 021E05DF Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2753303219.00000000021E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 021E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_21e0000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5637b180f65a9dee07fab17e5e0baaf536526e189a49b8887894249d99d2afa
Instruction ID: 341a2e28d8dbd53df631d8c1f640d6466df88f5b6b4f015eee4b5630ac4e960d
Opcode Fuzzy Hash: f5637b180f65a9dee07fab17e5e0baaf536526e189a49b8887894249d99d2afa
Instruction Fuzzy Hash: 1D0186B650D7806FD7128B169C41863FFB8DF86630709C49FEC498B653D629A909CB72

Function 021E0606 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2753303219.00000000021E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 021E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_21e0000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbeeb7ba18008deb3e91d675b6e40fcd6f2bd2e901ab6e4008be68471a58089d
Instruction ID: 4169b9141389019ed11bd61413568376a77e830a31150e9bdbafc181f41d686f
Opcode Fuzzy Hash: cbeeb7ba18008deb3e91d675b6e40fcd6f2bd2e901ab6e4008be68471a58089d
Instruction Fuzzy Hash: 4CE092B66046045B9750CF0BEC82462FBD4EB84630708C17FDC0D8B701E679F505CBA5

Function 005E23F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2750838943.00000000005E2000.00000040.00000800.00020000.00000000.sdmp, Offset: 005E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5e2000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c67993ccbecd7f38cb2b4dfa48f2fcb472315c723370aa3a9120ac589df823d6
Instruction ID: 4ff7bc58726a6a9062aaecb12174d068f39f0ef087f206b1dd095ce9fbb6dc31
Opcode Fuzzy Hash: c67993ccbecd7f38cb2b4dfa48f2fcb472315c723370aa3a9120ac589df823d6
Instruction Fuzzy Hash: E1D05E792047C14FDB2A8F1DD6A5B953BD8BB51708F4A44F9AC808B7A7CB68D9C1D200

Function 005E23BC Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2750838943.00000000005E2000.00000040.00000800.00020000.00000000.sdmp, Offset: 005E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5e2000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b83687008c79025c6eeaf8aad6fca6e686d2e0d6cceb64d4cc73b5e56bf4744
Instruction ID: 479620423da344dbb8abc3a126ac185cc57d3354a3def82896fe1e3aa11dc8c0
Opcode Fuzzy Hash: 2b83687008c79025c6eeaf8aad6fca6e686d2e0d6cceb64d4cc73b5e56bf4744
Instruction Fuzzy Hash: 98D05E342406814BCB29CE1DD6D4F5937D8BB44B04F1A48E8AC508B266CBACD9C0CA00

Analysis Process: dotnetinstaller.exePID: 5060, Parent PID: 2200COMMON

Executed Functions

Function 02160070 Relevance: 2.8, Strings: 2, Instructions: 290COMMON

Download Yara Rule

Strings

dSk, xrefs: 02160371
:@j, xrefs: 02160390

Memory Dump Source

Source File: 0000000E.00000002.2774073561.0000000002160000.00000040.00000800.00020000.00000000.sdmp, Offset: 02160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2160000_dotnetinstaller.jbxd

Similarity

API ID:
String ID: :@j$dSk
API String ID: 0-4078699674
Opcode ID: 7249af9755f474f7d7169bea488cf71ff8a5914e319ac7ca1bea59ad17813362
Instruction ID: 54e9cb96f935ac66112fea6bc9b91586559a0a718fc9a3a62f8a655041079e58
Opcode Fuzzy Hash: 7249af9755f474f7d7169bea488cf71ff8a5914e319ac7ca1bea59ad17813362
Instruction Fuzzy Hash: 91A178307402058FDB18ABB9C41977E77E6FF88309F20806DD506DB6A5DB7AC895CB91

Function 01FA05E0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2773824832.0000000001FA0000.00000040.00000020.00020000.00000000.sdmp, Offset: 01FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1fa0000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66b4057711c1ed0295900655b40e856fd682f1bd30e7a8568a89f92264bfb8e3
Instruction ID: fa699e876d0762e9aa2dfa8ad1f2b15e7d13f92a18dcff8f8b955af9e09bfc24
Opcode Fuzzy Hash: 66b4057711c1ed0295900655b40e856fd682f1bd30e7a8568a89f92264bfb8e3
Instruction Fuzzy Hash: 32F0F9B64083806FD7128F16EC44862FFB8EF86620749C09FEC498B612D229B908C771

Function 01FA0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2773824832.0000000001FA0000.00000040.00000020.00020000.00000000.sdmp, Offset: 01FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1fa0000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82e7e94aaae185ed2929f389bb743060184608cab363e9eb1017961076317cf7
Instruction ID: 1c2001e26f90e7616419fda739f8de0f6a523722387bdab831ae1f3b16eb298b
Opcode Fuzzy Hash: 82e7e94aaae185ed2929f389bb743060184608cab363e9eb1017961076317cf7
Instruction Fuzzy Hash: 58E092B66006044B9750CF0AEC42452F7E4EB84630708C57FDC0D8B701E639F505CBA5

Function 004E23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2768680913.00000000004E2000.00000040.00000800.00020000.00000000.sdmp, Offset: 004E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e2000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a81ba44155044cd4e4160c3d7573aab190ee15e29928443ca521f97762fd023
Instruction ID: f756e009019b866bb0e00641a4f5198ff30171b24610d6a1cdb06b05ec78fb4e
Opcode Fuzzy Hash: 7a81ba44155044cd4e4160c3d7573aab190ee15e29928443ca521f97762fd023
Instruction Fuzzy Hash: 76D05E792046D14FD7268F1CD6A5B9637D8AB51709F4A44FAAC408B7A3CBACD9C1D200

Function 004E23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2768680913.00000000004E2000.00000040.00000800.00020000.00000000.sdmp, Offset: 004E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4e2000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac2a1b185f113c31664c67f028af253b4aa350abb7643b8af8dcf3c8c19c8971
Instruction ID: 13a343d6dfe5f05505eec5a14ac727c02f21d0d05f8c248f3a16f1b99cae2f9b
Opcode Fuzzy Hash: ac2a1b185f113c31664c67f028af253b4aa350abb7643b8af8dcf3c8c19c8971
Instruction Fuzzy Hash: 74D05E342406814BCB25CE2DD7D4F5A33D8AB40B05F1A44E9AC108B362CBACD9C0CA00

Analysis Process: dotnetinstaller.exePID: 5864, Parent PID: 2200COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	13
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 04990070 Relevance: 2.8, Strings: 2, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dSk, xrefs: 04990371
:@j, xrefs: 04990390

Memory Dump Source

Source File: 00000010.00000002.2789340823.0000000004990000.00000040.00000800.00020000.00000000.sdmp, Offset: 04990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4990000_dotnetinstaller.jbxd

Similarity

API ID:
String ID: :@j$dSk
API String ID: 0-4078699674
Opcode ID: 6f08d88b261092be256b21a71539d576370a2380198157dd02c80817fa82c1af
Instruction ID: 519be5d92ba0e4c2d6c9066f0bb8009001fed64455909a6532fdf27b225ce551
Opcode Fuzzy Hash: 6f08d88b261092be256b21a71539d576370a2380198157dd02c80817fa82c1af
Instruction Fuzzy Hash: 6EA16C317002058FDF18AFB8C46576E77EAEF89309F208479D515CB2A5DB7A9C81CB91

Function 006BA4CF Relevance: 1.6, APIs: 1, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E84,EDA93AA5,00000000,00000000,00000000,00000000), ref: 006BA561

Memory Dump Source

Source File: 00000010.00000002.2784685022.00000000006BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 006BA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ba000_dotnetinstaller.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d8944f68bbcfe27552063e11529bf760b0113831de80cb880bfffa0920e1e304
Instruction ID: 618f841af77629635ca059d65b06ee645655ce1dfc5c09c9664a99c38c65c734
Opcode Fuzzy Hash: d8944f68bbcfe27552063e11529bf760b0113831de80cb880bfffa0920e1e304
Instruction Fuzzy Hash: DF21B7B24093806FDB22CF61DC45F96BFB8EF06314F0884DBE9858B153D225A949C772

Function 006BA502 Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E84,EDA93AA5,00000000,00000000,00000000,00000000), ref: 006BA561

Memory Dump Source

Source File: 00000010.00000002.2784685022.00000000006BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 006BA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ba000_dotnetinstaller.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 04ae52364aaf89ea1e647ef47ea905dc0111b472e920d439e4cd292ca82c653f
Instruction ID: d2b9be18f387527fac9d2c4394f8796ff3e9af13a64ff694693cf1296cff3fa4
Opcode Fuzzy Hash: 04ae52364aaf89ea1e647ef47ea905dc0111b472e920d439e4cd292ca82c653f
Instruction Fuzzy Hash: 3C11C1B2500200AFEB21CF65DD45FA6FBA9EF04324F18C85AEA459B251D379E544CBB2

Function 006BA23C Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 006BA290

Memory Dump Source

Source File: 00000010.00000002.2784685022.00000000006BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 006BA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ba000_dotnetinstaller.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 0e754d52be768c64fb54d5045db60a069764a680fcf0d6d2b318d456eeab6bad
Instruction ID: 8fff501de0583b9112acc41476a674f99e6383e4e756e3b947c8c3a756291a1c
Opcode Fuzzy Hash: 0e754d52be768c64fb54d5045db60a069764a680fcf0d6d2b318d456eeab6bad
Instruction Fuzzy Hash: 311184B1409384AFD7228F15DC44B62FFB4DF46724F0880DAED858B663D275A948CB72

Function 006BA25E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 006BA290

Memory Dump Source

Source File: 00000010.00000002.2784685022.00000000006BA000.00000040.00000800.00020000.00000000.sdmp, Offset: 006BA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ba000_dotnetinstaller.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: c0cc7da9c54c1d2144cd9a715c882c186cf90e8380b7f730dbc7f283625d1839
Instruction ID: eab043d8d164d8c201cb3de808ed31198a301d9cbf824ec45eef9a701bf0fe80
Opcode Fuzzy Hash: c0cc7da9c54c1d2144cd9a715c882c186cf90e8380b7f730dbc7f283625d1839
Instruction Fuzzy Hash: 8EF0FF758046008FEB10CF46D8857A1FBA0EF05324F0CC09ADD484B352E27AE948CFA2

Function 021105DF Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.2787531125.0000000002110000.00000040.00000020.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2110000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a487c632a832fc227b2ee11d18d23810b3804a9798564e2889ba474e6a59127
Instruction ID: bf4f9a60ec838067f436743d694e70b20436e09776bde08de002e2d7769f94fb
Opcode Fuzzy Hash: 0a487c632a832fc227b2ee11d18d23810b3804a9798564e2889ba474e6a59127
Instruction Fuzzy Hash: EB01D67650D7846FD7128F16AC45862FFB8DF86620709C4AFEC898B612D229B909C772

Function 02110606 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.2787531125.0000000002110000.00000040.00000020.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2110000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6862b47eb03f04553583cbea615135c763c50642e16ef500fe106dce0531576
Instruction ID: 862179564c68be604347b74b10e5c24b1b61ea108aa60748b4e1d505df667c35
Opcode Fuzzy Hash: b6862b47eb03f04553583cbea615135c763c50642e16ef500fe106dce0531576
Instruction Fuzzy Hash: 1DE092B66006044B9750CF0AFC46462F7E4EB84630708C47FDC4D8B701E63AF505CBA5

Function 006B23F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.2784580939.00000000006B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6b2000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9605fe24395c69c0c50b966a21546dfd0c64995195f162c1555cc1c965eae970
Instruction ID: 8026bdb62873160ed0e5d713f723bc953e7c7ddb15ee709a152a836aa54aa75b
Opcode Fuzzy Hash: 9605fe24395c69c0c50b966a21546dfd0c64995195f162c1555cc1c965eae970
Instruction Fuzzy Hash: 48D02EB92046924FD3268E1CC2A4BC53BD0AF40708F4A40F9AC008BB63CB28D8C0C300

Function 006B23BC Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.2784580939.00000000006B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 006B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6b2000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1d7c84a963c81a488a4854d5a996ef5922527325766b6ed9fa482872762c9c6
Instruction ID: 6e00dd7b7181ed14cf4014fe574e11ff56a75c90f27c0735f2a29ab2501d70a4
Opcode Fuzzy Hash: d1d7c84a963c81a488a4854d5a996ef5922527325766b6ed9fa482872762c9c6
Instruction Fuzzy Hash: 64D05E742406824BCB25DE1CD6E4F9933D5AB40B04F0644E8AC108B362CBACDDC0CB00

Analysis Process: dotnetinstaller.exePID: 2576, Parent PID: 2200COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	13
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 005AA4CF Relevance: 1.6, APIs: 1, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E84,A9400475,00000000,00000000,00000000,00000000), ref: 005AA561

Memory Dump Source

Source File: 00000012.00000002.2804547685.00000000005AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 005AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5aa000_dotnetinstaller.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 54c530d182af9e5f93777e2c46d0fc720911009e8d1628faa3eff1257dde927f
Instruction ID: 26cd16bbdba06a3c57c50b1ac6ac71734b7ed261b2963177cd70c977f8a19513
Opcode Fuzzy Hash: 54c530d182af9e5f93777e2c46d0fc720911009e8d1628faa3eff1257dde927f
Instruction Fuzzy Hash: DA21E5764093846FDB228F61DC44F96BFB8EF06314F08849BE9858F153D328A908CB76

Function 005AA502 Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E84,A9400475,00000000,00000000,00000000,00000000), ref: 005AA561

Memory Dump Source

Source File: 00000012.00000002.2804547685.00000000005AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 005AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5aa000_dotnetinstaller.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 615a4c5877f3cb87a8781edb42a4ca26a7dbc44948521c42bbc693e8ddc034ad
Instruction ID: bedf3b318ab806da5dd296874495ebf62554d0eb99c6d2a411d525287f9c4276
Opcode Fuzzy Hash: 615a4c5877f3cb87a8781edb42a4ca26a7dbc44948521c42bbc693e8ddc034ad
Instruction Fuzzy Hash: EB11C871500204AFEF21CF65DC45F6AFBE8EF15324F04885AE9458B151D374E444CBB6

Function 005AA23C Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 005AA290

Memory Dump Source

Source File: 00000012.00000002.2804547685.00000000005AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 005AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5aa000_dotnetinstaller.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: a5ee0784fa03006bc37ad876a65de2c52419fd621a907d02bd31621a14eec732
Instruction ID: 0255cb036673bd09db37d6cad5a6220e21614ae0c980772e13c5b587d76c3422
Opcode Fuzzy Hash: a5ee0784fa03006bc37ad876a65de2c52419fd621a907d02bd31621a14eec732
Instruction Fuzzy Hash: 16116575409384AFD7228F15DC44B62FFB4DF46624F0880DAED858B252D265A818CB72

Function 04970070 Relevance: 1.5, Strings: 1, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@j, xrefs: 04970390

Memory Dump Source

Source File: 00000012.00000002.2809787411.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_4970000_dotnetinstaller.jbxd

Similarity

API ID:
String ID: :@j
API String ID: 0-4039273937
Opcode ID: bd21bfd28b0b7933bb5d8f3f83d99113e19f516efc1e47e4eb4e9a2dba4faaf7
Instruction ID: 492af204c7b1411eeb304de5c799c19f313ff0a755f92ca27fe08575a7a687a8
Opcode Fuzzy Hash: bd21bfd28b0b7933bb5d8f3f83d99113e19f516efc1e47e4eb4e9a2dba4faaf7
Instruction Fuzzy Hash: 53A18D307042058FDB18BF78C45976E7BEAEF89349F208479D105CF2A5DB7A9886CB91

Function 005AA25E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 005AA290

Memory Dump Source

Source File: 00000012.00000002.2804547685.00000000005AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 005AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5aa000_dotnetinstaller.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 9b02d9401a2eebcb64e82ced8216534ed0ec888a919f02e2f571c5cc8a5d5d5d
Instruction ID: d99785c57bd0eb836de5df32f705247003a70f038df7f6a0e723fde8e60d1f1d
Opcode Fuzzy Hash: 9b02d9401a2eebcb64e82ced8216534ed0ec888a919f02e2f571c5cc8a5d5d5d
Instruction Fuzzy Hash: 6BF0AF799046409FDB608F15D885765FFE4EF16724F08C09ADD494B352D3BAE818CFA2

Function 005D05E1 Relevance: .1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.2805021515.00000000005D0000.00000040.00000020.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5d0000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 689849a63b8b28f5a0a237e4e323f4c20d109e9a29b605dc3fc0375803f0f6f6
Instruction ID: 3b592ec7531bd25a69980520188bcd17a36020bf22491b5fd1aa3656b0686330
Opcode Fuzzy Hash: 689849a63b8b28f5a0a237e4e323f4c20d109e9a29b605dc3fc0375803f0f6f6
Instruction Fuzzy Hash: 7801DDB550D7906FD7128B15AC50926BFB8DFC6620F09C0DBEC49CB253D128A808CB72

Function 005D0648 Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.2805021515.00000000005D0000.00000040.00000020.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5d0000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d93a1c605e5b014d567ad674dd6bbfd6575a7333a46e203a23dc543e96292943
Instruction ID: fc99035ec918ee8150a6c6b47fa1f317ce0fdc51c9e1037e2f40e636f51537d5
Opcode Fuzzy Hash: d93a1c605e5b014d567ad674dd6bbfd6575a7333a46e203a23dc543e96292943
Instruction Fuzzy Hash: C911C0B550D7C45FD7138B25AC51962BFB4EF83620B0984DFE845CB253D519E809C772

Function 005D0606 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.2805021515.00000000005D0000.00000040.00000020.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5d0000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61b37f84e6de52c344af32eebac1ae1eb9e398c7738bb947172abab864250d42
Instruction ID: 0ef52ec82ca2365d20f83942622b4375d92e2427994fce130c6947137c656425
Opcode Fuzzy Hash: 61b37f84e6de52c344af32eebac1ae1eb9e398c7738bb947172abab864250d42
Instruction Fuzzy Hash: 41E092B66006045B9650CF0AFC41462FBD4EB84630B08C07FDC0D8B701E679B504CBA5

Function 005A23F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.2804432386.00000000005A2000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5a2000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 856610cd52cedddf5a83decc948632f6f0f4264a55cfe7ba0becb7bfa707cbb3
Instruction ID: e337c96f20c51a8cbf2a61e1510449552424b0d2bf1f8d973fa28ef8071f867c
Opcode Fuzzy Hash: 856610cd52cedddf5a83decc948632f6f0f4264a55cfe7ba0becb7bfa707cbb3
Instruction Fuzzy Hash: 75D05E792047814FDB268B1CC6A6B9A3BD4BB56704F4A44F9AC40CB763C768D9C1D200

Function 005A23BC Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.2804432386.00000000005A2000.00000040.00000800.00020000.00000000.sdmp, Offset: 005A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_5a2000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23bfd7db2a9668f020c161f7f4c0570e063e9f9fcb7f67483a2cb0a24dca1d9f
Instruction ID: 45fb0f2ae47dda4606e2518da8f7f137e65a54cd15539b4eda8eb789fc78219f
Opcode Fuzzy Hash: 23bfd7db2a9668f020c161f7f4c0570e063e9f9fcb7f67483a2cb0a24dca1d9f
Instruction Fuzzy Hash: F6D05E342006814BCF25CA1CC6E5F5D37D4BB42704F0A48E9AC108B262C7BCD8C0DA00

Analysis Process: dotnetinstaller.exePID: 2884, Parent PID: 2200COMMON

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	13
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0048A4CF Relevance: 1.6, APIs: 1, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E84,61D0A62F,00000000,00000000,00000000,00000000), ref: 0048A561

Memory Dump Source

Source File: 00000014.00000002.2817702676.000000000048A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0048A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_48a000_dotnetinstaller.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: dec695b38401fdc4f8d6708f255ebaac1fff7c62030bc6a6ff93049ecb2391b2
Instruction ID: 1f13d754818614a1540d95d7c3c1df8909bbe40123b56e754510642ce5b53395
Opcode Fuzzy Hash: dec695b38401fdc4f8d6708f255ebaac1fff7c62030bc6a6ff93049ecb2391b2
Instruction Fuzzy Hash: 3821E5764093846FEB228F61DC44F96BFB8EF06314F08849BE9848B153D268A958C776

Function 0048A502 Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E84,61D0A62F,00000000,00000000,00000000,00000000), ref: 0048A561

Memory Dump Source

Source File: 00000014.00000002.2817702676.000000000048A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0048A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_48a000_dotnetinstaller.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: a003cc38b7a01c2581f454eab0ed31de1a309775f657c67d59918fd744b7dc92
Instruction ID: 66f6f9b7df681d75f1aeb1bb54b55e0c495637d2fb624f793e44a77bcf7d8aff
Opcode Fuzzy Hash: a003cc38b7a01c2581f454eab0ed31de1a309775f657c67d59918fd744b7dc92
Instruction Fuzzy Hash: BF11E7B2500204AFEB21CF65DC45F6AFBA8EF14324F08885BEE458B251D378E455CBB6

Function 0048A23C Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 0048A290

Memory Dump Source

Source File: 00000014.00000002.2817702676.000000000048A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0048A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_48a000_dotnetinstaller.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 2ea4d88708bb6596d15ab728ed8cb54a9e10b68a1c40617ac633f96b9cdb48ec
Instruction ID: 2315fc705d08036cf5317c39c3d7999e634ae0270977dd76f4b7f10e19900d20
Opcode Fuzzy Hash: 2ea4d88708bb6596d15ab728ed8cb54a9e10b68a1c40617ac633f96b9cdb48ec
Instruction Fuzzy Hash: 2F116175409784AFDB228F15DC44B62FFB4DF46624F0880DBED858B262D269A818CB72

Function 04970070 Relevance: 1.5, Strings: 1, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@j, xrefs: 04970390

Memory Dump Source

Source File: 00000014.00000002.2821294062.0000000004970000.00000040.00000800.00020000.00000000.sdmp, Offset: 04970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_4970000_dotnetinstaller.jbxd

Similarity

API ID:
String ID: :@j
API String ID: 0-4039273937
Opcode ID: f5f0e69fc50f299d894181912826b932a142e4a7f99430be047079fbde1daf99
Instruction ID: 76e371573bfcbc2a079004e43317ea92bedd48929b5c209c3bf6cd53bf7b697f
Opcode Fuzzy Hash: f5f0e69fc50f299d894181912826b932a142e4a7f99430be047079fbde1daf99
Instruction Fuzzy Hash: 51A18E307042058FDB18BF74C529B6E77EAEF85348F208479E506CB2A5EB79D885CB91

Function 0048A25E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 0048A290

Memory Dump Source

Source File: 00000014.00000002.2817702676.000000000048A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0048A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_48a000_dotnetinstaller.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 73f4d9ed5f8f8c9e29ba708c3d94072bec8b9c067d8e13afd89c1a3ff7890390
Instruction ID: a5943854868b9f314e75462d4bddafe8e7e244b03f16d79180c99d4af9720698
Opcode Fuzzy Hash: 73f4d9ed5f8f8c9e29ba708c3d94072bec8b9c067d8e13afd89c1a3ff7890390
Instruction Fuzzy Hash: CBF0DC74804600CFEB208F05D885726FBA4EF05324F08C4DBDD080B352D2BAE829CBA3

Function 00470606 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000014.00000002.2817542641.0000000000470000.00000040.00000020.00020000.00000000.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_470000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b99469dd28a1f4ca03ab2a428828193467a917c982fa6f24cc3022589d1565
Instruction ID: 54cbb883bdcfc03fafe9fb1472a919d4738835d58ae461817c53a33968ae5b15
Opcode Fuzzy Hash: d2b99469dd28a1f4ca03ab2a428828193467a917c982fa6f24cc3022589d1565
Instruction Fuzzy Hash: 15E092B6600A044B9650CF0BFC41452F7E4EB88630B08C07FDC0D8B711E639B508CBA5

Function 004823F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000014.00000002.2817656397.0000000000482000.00000040.00000800.00020000.00000000.sdmp, Offset: 00482000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_482000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf57410e5a57524721965516f3248feb09b1ffb3615c995af9dad492ebe70e2
Instruction ID: a123d4183bef457a8df1984ce75aa618a48c95b04c091c7a7d083b8d8e76fb95
Opcode Fuzzy Hash: cdf57410e5a57524721965516f3248feb09b1ffb3615c995af9dad492ebe70e2
Instruction Fuzzy Hash: 9FD05E792046914FD7269B1CC6A5B9A3794AB51B04F4A48FAAC40CB763C7ACD9C1D310

Function 004823BC Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000014.00000002.2817656397.0000000000482000.00000040.00000800.00020000.00000000.sdmp, Offset: 00482000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_482000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b35f6202fa14172b00e1b49dc45c6db6a7a0c39da9ef0597379e73216e79eda1
Instruction ID: b291dcf3ee25faea3b9575032ae07f3e7f855e9f4fab04a29f9e6789cfddbdc6
Opcode Fuzzy Hash: b35f6202fa14172b00e1b49dc45c6db6a7a0c39da9ef0597379e73216e79eda1
Instruction Fuzzy Hash: 66D05E346006814BCB26DA2CC7E4F5E33D4AB40704F0A48E9BC108B762C7BCD9C0DB00

Analysis Process: dotnetinstaller.exePID: 7088, Parent PID: 2200COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004CA4CF Relevance: 1.6, APIs: 1, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E84,4D9569B2,00000000,00000000,00000000,00000000), ref: 004CA561

Memory Dump Source

Source File: 00000016.00000002.2832343335.00000000004CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 004CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_4ca000_dotnetinstaller.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: ee2fe4ce109e2293203530c897b03bca67ea3e3b6db03249a0833457fd31ff7d
Instruction ID: e2649c3945dcfc8cffb8ea51f858ec210ed788803e1e910277efbcab8163c6db
Opcode Fuzzy Hash: ee2fe4ce109e2293203530c897b03bca67ea3e3b6db03249a0833457fd31ff7d
Instruction Fuzzy Hash: B121E5764093846FDB22CF61CC44F96BFB8EF46314F08849BE9848B153D228A909C776

Function 004CA502 Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E84,4D9569B2,00000000,00000000,00000000,00000000), ref: 004CA561

Memory Dump Source

Source File: 00000016.00000002.2832343335.00000000004CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 004CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_4ca000_dotnetinstaller.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d01ad1d30694444f0b5a210388ad146b0a29ef37cb0e6a00af804e4a5cd06520
Instruction ID: ddbdf49393fe064b3f5c8b9223e53ced791cf5c15a50affaae7867adae297a34
Opcode Fuzzy Hash: d01ad1d30694444f0b5a210388ad146b0a29ef37cb0e6a00af804e4a5cd06520
Instruction Fuzzy Hash: 991104B6500204AFEB21CF61CC45F66FBA8EF44328F08C45AEE058B251D338E455CBB6

Function 004CA23C Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 004CA290

Memory Dump Source

Source File: 00000016.00000002.2832343335.00000000004CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 004CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_4ca000_dotnetinstaller.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 001fb27749149c8af8a6946f6d7ba103a7b8037778dcc1090e859e9722e1a3ba
Instruction ID: 6034f4f0147290bd7a1a0230b87aa8bc9a18ec59d4513edadb7c7f9922aead8f
Opcode Fuzzy Hash: 001fb27749149c8af8a6946f6d7ba103a7b8037778dcc1090e859e9722e1a3ba
Instruction Fuzzy Hash: A1116175409384AFD7228B15DC44B62FFB4DF46624F0880DAED858B263D269A818CB72

Function 04A80070 Relevance: 1.5, Strings: 1, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@j, xrefs: 04A80390

Memory Dump Source

Source File: 00000016.00000002.2836862405.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_4a80000_dotnetinstaller.jbxd

Similarity

API ID:
String ID: :@j
API String ID: 0-4039273937
Opcode ID: 48433615b5e68186cd61fcc2445bde3e40a7e26fea66ef5425c3dffd1ccedb57
Instruction ID: 55a2f5b4aaba3b6471a4e41d2eb9fdf7c1fc3ebb1ec352bfe6d783e0a09c5c04
Opcode Fuzzy Hash: 48433615b5e68186cd61fcc2445bde3e40a7e26fea66ef5425c3dffd1ccedb57
Instruction Fuzzy Hash: B0A14A307042048FDB18BFB4C45576E76F6EF89348F21807DD505CB2A5EBBA988ADB91

Function 004CA25E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 004CA290

Memory Dump Source

Source File: 00000016.00000002.2832343335.00000000004CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 004CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_4ca000_dotnetinstaller.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: f3eeeaca371f92fe23918ca0e517da03801439c20934572405f3b03c3a972dd3
Instruction ID: a5e14fa93d733a98bd5cbf11570b9fbccfcb38878026d4a69aa6b67b4e7d51c5
Opcode Fuzzy Hash: f3eeeaca371f92fe23918ca0e517da03801439c20934572405f3b03c3a972dd3
Instruction Fuzzy Hash: DFF0D1798042188FDB60CF15D885B21FB94DF45328F08C0DADD094B352D279E818CAA3

Function 04A80006 Relevance: .1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000016.00000002.2836862405.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_4a80000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ea419616bf4bdf45563c657026a75ec024f85d807e113f7c44b5d31ef54c03
Instruction ID: ce05b7b2df0beda531635f022700a2e2f2101caa42cb6b7e4b4bdde0d6f56d0b
Opcode Fuzzy Hash: 59ea419616bf4bdf45563c657026a75ec024f85d807e113f7c44b5d31ef54c03
Instruction Fuzzy Hash: B851A77090E3858FE721BF64C8543AA7BB1FF42354F0640AEC555CB192E778A88EDB51

Function 020505DF Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000016.00000002.2835311392.0000000002050000.00000040.00000020.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2050000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582f8b25a8185da513b7665f9fbbf585f6ebde9f1610e46b38e398c290421a53
Instruction ID: 96b5a2066d35dd3a9e147de5a889d878e80c51993b5f6c097f351ef79d7b6b25
Opcode Fuzzy Hash: 582f8b25a8185da513b7665f9fbbf585f6ebde9f1610e46b38e398c290421a53
Instruction Fuzzy Hash: C001D6B640D7806FD7228F15AC40863FFB8EF86220709C49FEC8987612D329A809C772

Function 02050606 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000016.00000002.2835311392.0000000002050000.00000040.00000020.00020000.00000000.sdmp, Offset: 02050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2050000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5a7625ad8173490699847aa90cba0aabe1198da269e746e82d45b31c57856f
Instruction ID: 36db6d88c6334315915ee0e47239b943decbeb07636bea2b0babbbe57bf91bf7
Opcode Fuzzy Hash: 3c5a7625ad8173490699847aa90cba0aabe1198da269e746e82d45b31c57856f
Instruction Fuzzy Hash: 54E092B66046044B9660CF0AFC41462F7D4EBC4630B08C07FDC0D8B711E639B944CBA5

Function 004C23F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000016.00000002.2832274131.00000000004C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_4c2000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d1fa2dacb9c95c74c5a07400d462fd3677693f1a5a06998bc7f099b5265489
Instruction ID: a6b845caa4f6248ee645e125a098dd9418c867cf2eee1a491e7720eac34fcfd2
Opcode Fuzzy Hash: 30d1fa2dacb9c95c74c5a07400d462fd3677693f1a5a06998bc7f099b5265489
Instruction Fuzzy Hash: 7BD05E7E2046914FD72A8B1CC6A5F9637A4AB51704F4A44FEAC40CB763C7BCD9C1D204

Function 004C23BC Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000016.00000002.2832274131.00000000004C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_4c2000_dotnetinstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b391850c4c6d71029b6b3aa6e53d04551bdb05d8b52d69ae34e7c168b5bba45
Instruction ID: 3dcfd03411ae61c939e1a3644f4dcb084cac68df7305c5819c7db5a09792137e
Opcode Fuzzy Hash: 4b391850c4c6d71029b6b3aa6e53d04551bdb05d8b52d69ae34e7c168b5bba45
Instruction Fuzzy Hash: 52D017382006814BCB65CA2CC6E4F5A3394AB40704F0A44ADAC108B362C7ECD8C0DA00

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ArbExpress_V3.6_en_0703_066146106.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\0x0409.ini (copy)

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\0x04ecc.rra

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\ISSee7e.rra

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\ISSetup.dll (copy)

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\data1.cab (copy)

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\data1.hdr (copy)

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\datad74.rra

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\datad94.rra

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\layod65.rra

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\layout.bin (copy)

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setude2.rra

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setueeb.rra

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setuf68.rra

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setufd6.rra

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setup.exe (copy)

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setup.ilg (copy)

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setup.ini

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setup.inx (copy)

C:\Program Files (x86)\InstallShield Installation Information\{5045756C-7552-4E48-B39F-C28A48E4EACD}\setup.isn (copy)

C:\Program Files (x86)\Tektronix\ArbExpress\Documentation\ArbE5441.rra

C:\Program Files (x86)\Tektronix\ArbExpress\Documentation\ArbE549f.rra

C:\Program Files (x86)\Tektronix\ArbExpress\Documentation\ArbExpress Installation Manual.pdf (copy)

C:\Program Files (x86)\Tektronix\ArbExpress\Documentation\ArbExpress User Manual.pdf (copy)

Windows Analysis Report
ArbExpress_V3.6_en_0703_066146106.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre