Edit tour

Windows Analysis Report
VS80sp1-KB954961-X86-INTL.exe

Overview

General Information

Sample name:	VS80sp1-KB954961-X86-INTL.exe
Analysis ID:	1428262
MD5:	de6843e7937dfe0704b9eadfe589e691
SHA1:	c07566c6abc50cd9350d33209520bda798dda3e8
SHA256:	b4ad9fb4f0fc28c41b1a32ba309c8f8cf8b0c1eacb40107d7687288a040eb317
Infos:

Detection

Score:	7
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Compliance

Score:	47
Range:	0 - 100

Signatures

Checks for available system drives (often done to infect USB drives)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64

VS80sp1-KB954961-X86-INTL.exe (PID: 380 cmdline: "C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe" MD5: DE6843E7937DFE0704B9EADFE589E691)

msiexec.exe (PID: 6156 cmdline: "C:\Windows\system32\msiexec.exe" REBOOT=ReallySuppress /p "C:\Users\user\AppData\Local\Temp\ZNW50FA\VS80sp1-KB954961-X86-INTL.msp" /l*v C:\Users\user\AppData\Local\Temp\VS80sp1-KB954961-X86-INTL\VS80sp1-KB954961-X86-INTL-msi.0.log MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5660 cmdline: "C:\Windows\system32\msiexec.exe" REBOOT=ReallySuppress /q /i C:\Users\user\AppData\Local\Temp\ZNW50FA\dw20shared.msi APPGUID={AB1098F4-4E8B-4BC1-9979-6367DF53ED51} REINSTALL=all REINSTALLMODE=vomus MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6024 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 5284 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding D94135EDDA44CEACEF1298338DEB1A49 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5556 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 31C2B4F4F21467A963096029BA61CEDC E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Compliance

Uses 32bit PE files

Source: VS80sp1-KB954961-X86-INTL.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: VS80sp1-KB954961-X86-INTL.exe

Static PE information: certificate valid

Uses new MSVCR Dlls

Source: C:\Windows\System32\msiexec.exe

File opened: C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcr80.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: msvcm80.i386.pdb source: msvcm80.dll.4.dr
Source:	Binary string: ddsetca.pdb source: 5E0E.tmp.0.dr, 5CE2.tmp.0.dr, 5B27.tmp.0.dr, VS80sp1-KB954961-X86-INTL.msp.0.dr, 5D90.tmp.0.dr, 5D31.tmp.0.dr
Source:	Binary string: t:\dw\x86\ship\0\dw20.pdb source: DW20.EXE.4.dr
Source:	Binary string: t:\dw\x86\ship\0\dw20.pdb\x86\ship\0\dw20.exe\bbtopt\dw20O.pdb source: DW20.EXE.4.dr
Source:	Binary string: t:\dw\x86\ship\0\dwtrig20.pdb\ship\0\dwtrig20.exe\bbtopt\dwtrig20O.pdb", source: DWTRIG20.EXE.4.dr
Source:	Binary string: h:\nt.obj.x86fre\base\wcp\tools\msmcustomaction\objfre\i386\msmcustomaction.pdb source: dw20shared.msi.0.dr, 5d6f33.msi.4.dr
Source:	Binary string: C:\BriqsBuildDirectories\BriqsSourceDirectory\target\briqs3.4\retail\i386\DDPatch.pdb source: 5497.tmp.0.dr, 55A4.tmp.0.dr, 5AA8.tmp.0.dr, 582D.tmp.0.dr, 5E0E.tmp.0.dr, 5CE2.tmp.0.dr, 5FA7.tmp.0.dr, 590C.tmp.0.dr, 573E.tmp.0.dr, 5B27.tmp.0.dr, 5C24.tmp.0.dr, 5EFB.tmp.0.dr, VS80sp1-KB954961-X86-INTL.msp.0.dr, 594B.tmp.0.dr, 5AE7.tmp.0.dr, 5565.tmp.0.dr, 5BC5.tmp.0.dr, 58BC.tmp.0.dr, 5CA3.tmp.0.dr, 5C63.tmp.0.dr, 5467.tmp.0.dr, 5437.tmp.0.dr, 59BA.tmp.0.dr, 5525.tmp.0.dr, 5D90.tmp.0.dr, 5D31.tmp.0.dr, 56CF.tmp.0.dr, 585D.tmp.0.dr, 60C7.tmp.0.dr, 6036.tmp.0.dr, 570F.tmp.0.dr
Source:	Binary string: t:\dw\x86\ship\0\dwtrig20.pdb source: DWTRIG20.EXE.4.dr
Source:	Binary string: t:\msishared\x86\ship\0\CustomActions\dwsens.pdb source: MSI7204.tmp.4.dr, dw20shared.msi.0.dr, MSI738B.tmp.4.dr, 5d6f33.msi.4.dr, MSI7194.tmp.4.dr
Source:	Binary string: \x86\ship\0\dw20.exe\bbtopt\dw20O.pdb source: DW20.EXE.4.dr
Source:	Binary string: t:\msishared\x86\ship\0\CustomActions\dwsens.pdbPu source: MSI7204.tmp.4.dr, dw20shared.msi.0.dr, MSI738B.tmp.4.dr, 5d6f33.msi.4.dr, MSI7194.tmp.4.dr
Source:	Binary string: C:\razzle\binaries\BRIQSSHARED.x86ret\bin\i386\wrapdrvr.pdb source: VS80sp1-KB954961-X86-INTL.exe
Source:	Binary string: msvcp80.i386.pdb source: msvcp80.dll.4.dr
Source:	Binary string: t:\msishared\x86\ship\0\CustomActions\dw20sharedca.pdb source: dw20shared.msi.0.dr, 5d6f33.msi.4.dr
Source:	Binary string: \ship\0\dwtrig20.exe\bbtopt\dwtrig20O.pdb source: DWTRIG20.EXE.4.dr
Source:	Binary string: t:\msishared\x86\ship\0\CustomActions\AbortMsiCA.pdb source: dw20shared.msi.0.dr, MSI70E6.tmp.4.dr, 5d6f33.msi.4.dr
Source:	Binary string: FileHashFixup.pdb source: filehashfixup.exe.0.dr

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

System Summary

Creates files inside the system directory

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5d6f30.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI70E6.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{95120000-00B9-0409-0000-0000000FF1CE}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7144.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7174.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7194.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7195.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7204.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\PCHEALTH	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\PCHEALTH\ERRORREP	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\PCHEALTH\ERRORREP\QHEADLES	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\PCHEALTH\ERRORREP\QSIGNOFF	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20240418183627404.0	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcr80.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20240418183627404.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.manifest	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20240418183627404.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcp80.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcm80.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20240418183627498.0	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20240418183627498.0\8.0.50727.42.policy	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20240418183627498.0\8.0.50727.42.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI738B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5d6f33.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5d6f33.msi	Jump to behavior

Deletes files inside the Windows folder

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI70E6.tmp

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe

Code function: 0_3_0108A191

0_3_0108A191

PE file contains executable resources (Code or Archives)

Source: VS80sp1-KB954961-X86-INTL.exe

Static PE information: Resource name: BINARY type: Microsoft Cabinet archive data, many, 12381593 bytes, 5 files, at 0x2c +A "manifest.ini" +A "filehashfixup.exe", number 1, 631 datablocks, 0x1 compression

Sample file is different than original file name gathered from version info

Source: VS80sp1-KB954961-X86-INTL.exe, 00000000.00000003.2008386411.0000000002E78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFileHashFixup.exeP vs VS80sp1-KB954961-X86-INTL.exe
Source: VS80sp1-KB954961-X86-INTL.exe, 00000000.00000003.2073654830.0000000002E79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFileHashFixup.exeP vs VS80sp1-KB954961-X86-INTL.exe

Uses 32bit PE files

Source: VS80sp1-KB954961-X86-INTL.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: clean7.winEXE@10/83@0/0

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Common Files\Microsoft Shared\DW

Jump to behavior

Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\MicrosoftDevDivPatchMutex

Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe

File created: C:\Users\user\AppData\Local\Temp\ZNW50FA.tmp

Jump to behavior

Source: VS80sp1-KB954961-X86-INTL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe

File read: C:\Users\user\AppData\Local\Temp\ZNW50FA\manifest.ini

Jump to behavior

Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: VS80sp1-KB954961-X86-INTL.exe	String found in binary or memory: </install>
Source: VS80sp1-KB954961-X86-INTL.exe	String found in binary or memory: </addsource>
Source: VS80sp1-KB954961-X86-INTL.exe	String found in binary or memory: <update executable file name> /addsource "C:\Product MSI\Visual Studio\enu\vs_setup.msi" /addsource "C:\Product MSI\Net\Netfx.msi"
Source: VS80sp1-KB954961-X86-INTL.exe	String found in binary or memory: <update executable file name> /addsource "C:\Product MSI\Visual Studio\enu\vs_setup.msi" /addsource "C:\Product MSI\Net\Netfx.msi"
Source: VS80sp1-KB954961-X86-INTL.exe	String found in binary or memory: <update executable file name> /addsource "C:\Product MSI\Visual Studio\enu\vs_setup.msi" /addsource "C:\Product MSI\Net\Netfx.msi"
Source: VS80sp1-KB954961-X86-INTL.exe	String found in binary or memory: <update executable file name> /addsource "C:\Product MSI\Visual Studio\enu\vs_setup.msi" /addsource "C:\Product MSI\Net\Netfx.msi"
Source: VS80sp1-KB954961-X86-INTL.exe	String found in binary or memory: <update executable file name> /addsource "C:\Product MSI\Visual Studio\enu\vs_setup.msi" /addsource "C:\Product MSI\Net\Netfx.msi"
Source: VS80sp1-KB954961-X86-INTL.exe	String found in binary or memory: <update executable file name> /addsource "C:\Product MSI\Visual Studio\enu\vs_setup.msi" /addsource "C:\Product MSI\Net\Netfx.msi"
Source: VS80sp1-KB954961-X86-INTL.exe	String found in binary or memory: <update executable file name> /addsource "C:\Product MSI\Visual Studio\enu\vs_setup.msi" /addsource "C:\Product MSI\Net\Netfx.msi"
Source: VS80sp1-KB954961-X86-INTL.exe	String found in binary or memory: <update executable file name> /addsource "C:\Product MSI\Visual Studio\enu\vs_setup.msi" /addsource "C:\Product MSI\Net\Netfx.msi"

Source: unknown	Process created: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe "C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe"
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" REBOOT=ReallySuppress /p "C:\Users\user\AppData\Local\Temp\ZNW50FA\VS80sp1-KB954961-X86-INTL.msp" /l*v C:\Users\user\AppData\Local\Temp\VS80sp1-KB954961-X86-INTL\VS80sp1-KB954961-X86-INTL-msi.0.log
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" REBOOT=ReallySuppress /q /i C:\Users\user\AppData\Local\Temp\ZNW50FA\dw20shared.msi APPGUID={AB1098F4-4E8B-4BC1-9979-6367DF53ED51} REINSTALL=all REINSTALLMODE=vomus
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding D94135EDDA44CEACEF1298338DEB1A49
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 31C2B4F4F21467A963096029BA61CEDC E Global\MSI0000
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" REBOOT=ReallySuppress /p "C:\Users\user\AppData\Local\Temp\ZNW50FA\VS80sp1-KB954961-X86-INTL.msp" /l*v C:\Users\user\AppData\Local\Temp\VS80sp1-KB954961-X86-INTL\VS80sp1-KB954961-X86-INTL-msi.0.log	Jump to behavior
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" REBOOT=ReallySuppress /q /i C:\Users\user\AppData\Local\Temp\ZNW50FA\dw20shared.msi APPGUID={AB1098F4-4E8B-4BC1-9979-6367DF53ED51} REINSTALL=all REINSTALLMODE=vomus	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding D94135EDDA44CEACEF1298338DEB1A49	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 31C2B4F4F21467A963096029BA61CEDC E Global\MSI0000	Jump to behavior

Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: es.dll	Jump to behavior

Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe

File written: C:\Users\user\AppData\Local\Temp\ZNW50FA\manifest.ini

Jump to behavior

PE / OLE file has a valid certificate

Source: VS80sp1-KB954961-X86-INTL.exe

Static PE information: certificate valid

PE /OLE file has a valid certificate with Microsoft as Issuer

Source: initial sample

Static PE information: Valid certificate with Microsoft Issuer

Submission file is bigger than most known malware samples

Source: VS80sp1-KB954961-X86-INTL.exe

Static file information: File size 12779920 > 1048576

Uses new MSVCR Dlls

Source: C:\Windows\System32\msiexec.exe

File opened: C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcr80.dll

Jump to behavior

PE file has a big raw section

Source: VS80sp1-KB954961-X86-INTL.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0xc02200

PE file contains a debug data directory

Source: VS80sp1-KB954961-X86-INTL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: msvcm80.i386.pdb source: msvcm80.dll.4.dr
Source:	Binary string: ddsetca.pdb source: 5E0E.tmp.0.dr, 5CE2.tmp.0.dr, 5B27.tmp.0.dr, VS80sp1-KB954961-X86-INTL.msp.0.dr, 5D90.tmp.0.dr, 5D31.tmp.0.dr
Source:	Binary string: t:\dw\x86\ship\0\dw20.pdb source: DW20.EXE.4.dr
Source:	Binary string: t:\dw\x86\ship\0\dw20.pdb\x86\ship\0\dw20.exe\bbtopt\dw20O.pdb source: DW20.EXE.4.dr
Source:	Binary string: t:\dw\x86\ship\0\dwtrig20.pdb\ship\0\dwtrig20.exe\bbtopt\dwtrig20O.pdb", source: DWTRIG20.EXE.4.dr
Source:	Binary string: h:\nt.obj.x86fre\base\wcp\tools\msmcustomaction\objfre\i386\msmcustomaction.pdb source: dw20shared.msi.0.dr, 5d6f33.msi.4.dr
Source:	Binary string: C:\BriqsBuildDirectories\BriqsSourceDirectory\target\briqs3.4\retail\i386\DDPatch.pdb source: 5497.tmp.0.dr, 55A4.tmp.0.dr, 5AA8.tmp.0.dr, 582D.tmp.0.dr, 5E0E.tmp.0.dr, 5CE2.tmp.0.dr, 5FA7.tmp.0.dr, 590C.tmp.0.dr, 573E.tmp.0.dr, 5B27.tmp.0.dr, 5C24.tmp.0.dr, 5EFB.tmp.0.dr, VS80sp1-KB954961-X86-INTL.msp.0.dr, 594B.tmp.0.dr, 5AE7.tmp.0.dr, 5565.tmp.0.dr, 5BC5.tmp.0.dr, 58BC.tmp.0.dr, 5CA3.tmp.0.dr, 5C63.tmp.0.dr, 5467.tmp.0.dr, 5437.tmp.0.dr, 59BA.tmp.0.dr, 5525.tmp.0.dr, 5D90.tmp.0.dr, 5D31.tmp.0.dr, 56CF.tmp.0.dr, 585D.tmp.0.dr, 60C7.tmp.0.dr, 6036.tmp.0.dr, 570F.tmp.0.dr
Source:	Binary string: t:\dw\x86\ship\0\dwtrig20.pdb source: DWTRIG20.EXE.4.dr
Source:	Binary string: t:\msishared\x86\ship\0\CustomActions\dwsens.pdb source: MSI7204.tmp.4.dr, dw20shared.msi.0.dr, MSI738B.tmp.4.dr, 5d6f33.msi.4.dr, MSI7194.tmp.4.dr
Source:	Binary string: \x86\ship\0\dw20.exe\bbtopt\dw20O.pdb source: DW20.EXE.4.dr
Source:	Binary string: t:\msishared\x86\ship\0\CustomActions\dwsens.pdbPu source: MSI7204.tmp.4.dr, dw20shared.msi.0.dr, MSI738B.tmp.4.dr, 5d6f33.msi.4.dr, MSI7194.tmp.4.dr
Source:	Binary string: C:\razzle\binaries\BRIQSSHARED.x86ret\bin\i386\wrapdrvr.pdb source: VS80sp1-KB954961-X86-INTL.exe
Source:	Binary string: msvcp80.i386.pdb source: msvcp80.dll.4.dr
Source:	Binary string: t:\msishared\x86\ship\0\CustomActions\dw20sharedca.pdb source: dw20shared.msi.0.dr, 5d6f33.msi.4.dr
Source:	Binary string: \ship\0\dwtrig20.exe\bbtopt\dwtrig20O.pdb source: DWTRIG20.EXE.4.dr
Source:	Binary string: t:\msishared\x86\ship\0\CustomActions\AbortMsiCA.pdb source: dw20shared.msi.0.dr, MSI70E6.tmp.4.dr, 5d6f33.msi.4.dr
Source:	Binary string: FileHashFixup.pdb source: filehashfixup.exe.0.dr

Persistence and Installation Behavior

Drops PE files

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI738B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7195.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	File created: C:\Users\user\AppData\Local\Temp\ZNW50FA\filehashfixup.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7144.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7204.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7174.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\DW\DWTRIG20.EXE	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI70E6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcp80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcr80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcm80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\DW\DW20.EXE	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI738B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7195.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7144.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7204.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7174.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI70E6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcp80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcr80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcm80.dll	Jump to dropped file

Boot Survival

Creates or modifies windows services

Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\VS80sp1-KB954961-X86-INTL

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found dropped PE file which has not been started or loaded

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI738B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7195.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ZNW50FA\filehashfixup.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7144.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7204.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7174.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\DW\DWTRIG20.EXE	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI70E6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcp80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcr80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcm80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\DW\DW20.EXE	Jump to dropped file

Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Windows\SysWOW64\msiexec.exe

Code function: 3_2_04C3F42C LdrInitializeThunk,

3_2_04C3F42C

Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" REBOOT=ReallySuppress /p "C:\Users\user\AppData\Local\Temp\ZNW50FA\VS80sp1-KB954961-X86-INTL.msp" /l*v C:\Users\user\AppData\Local\Temp\VS80sp1-KB954961-X86-INTL\VS80sp1-KB954961-X86-INTL-msi.0.log			Jump to behavior
Source: C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" REBOOT=ReallySuppress /q /i C:\Users\user\AppData\Local\Temp\ZNW50FA\dw20shared.msi APPGUID={AB1098F4-4E8B-4BC1-9979-6367DF53ED51} REINSTALL=all REINSTALLMODE=vomus			Jump to behavior

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	21 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
VS80sp1-KB954961-X86-INTL.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\Common Files\Microsoft Shared\DW\DW20.EXE	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Microsoft Shared\DW\DWTRIG20.EXE	0%	ReversingLabs
C:\Windows\Installer\MSI70E6.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI7144.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI7174.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI7195.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI7204.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI738B.tmp	0%	ReversingLabs
C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcm80.dll	0%	ReversingLabs
C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcp80.dll	0%	ReversingLabs
C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcr80.dll	0%	ReversingLabs

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428262
Start date and time:	2024-04-18 18:35:32 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	VS80sp1-KB954961-X86-INTL.exe
Detection:	CLEAN
Classification:	clean7.winEXE@10/83@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target VS80sp1-KB954961-X86-INTL.exe, PID 380 because there are no executed function
Execution Graph export aborted for target msiexec.exe, PID 5660 because there are no executed function
VT rate limit hit for: VS80sp1-KB954961-X86-INTL.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Installer\MSI7195.tmp	https://download.brother.com/welcome/dlfp100270/cltw10100a.exe	Get hash	malicious	Unknown	Browse
	amd-demo-pingpong-v1.4.msi	Get hash	malicious	Unknown	Browse
	AMD-Demo-PingPong-v1.5 (2).msi	Get hash	malicious	Unknown	Browse
	zero.sfx.exe	Get hash	malicious	Unknown	Browse
	zero.sfx.exe	Get hash	malicious	Hidden Macro 4.0, Masscan	Browse
	cryptor.exe	Get hash	malicious	Unknown	Browse
	cryptor.exe	Get hash	malicious	Conti	Browse
	cryptor.exe	Get hash	malicious	Unknown	Browse
	cryptor.exe	Get hash	malicious	Conti	Browse
	cryptor.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\5d6f32.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	21945
Entropy (8bit):	5.668299507612215
Encrypted:	false
SSDEEP:	384:2zYd3Ul7iuLNR0pt4tdU2DDtPrIII673j7m7vMBXx:2z1wuLNR0pt4tTTHI673jCOh
MD5:	D89830ADB96C909F64448192B8660B19
SHA1:	D751BDFD432CF40CE2EBE137003E5DCC9A10B266
SHA-256:	F41534C79D3F9209C5A32EE12BDB711A2AD14C445220B9CE91EA10680B02C1D7
SHA-512:	9AEB10592A0FF219C4F7F87E312607E4FB3481316E9A2388ACFBA6D9529AFC2AC0A51D1F4483C5DAEF48479889B8EE1B8DB59B63C6A9D622CF97D9950E63FC7B
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@...X.@.....@.....@.....@.....@.....@......&.{95120000-00B9-0409-0000-0000000FF1CE}%.Microsoft Application Error Reporting..dw20shared.msi.@.....@\|....@.....@........&.{420F351B-33A5-4A58-A856-69B2EDEDC8F7}.....@.....@.....@.....@.......@.....@.....@.......@....%.Microsoft Application Error Reporting......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....MsiPublishAssemblies..Publishing assembly information.Application Context:[1], Assembly Name:[2]$..@....1.Software\Classes\Installer\Win32Assemblies\Global...@....(.&.t.Microsoft.VC80.CRT,version="8.0.50727.42",type="win32",processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b".{(MvWD*8A$!!!!!MKKSk>_j0,Y]s!Soe8MkbIdFwU.$..@....1.Software\Classes\Installer\Win32Assemblies\Globalx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....'.&...policy.8.0.Microsoft.VC80.CRT,version="8.0.50727.42",type="win32-

C:\Program Files (x86)\Common Files\Microsoft Shared\DW\DW20.EXE

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	816528
Entropy (8bit):	7.087590746459818
Encrypted:	false
SSDEEP:	24576:S42qomAJxOKA/1UE4wVcZYV3+0egjLHgZpJEcAb:SfqoRsUE4wVciVAgjLHkJEcI
MD5:	A602E56B9043EAA4A4BC52586EEDD023
SHA1:	602A70F7B5276D1B04D2E682B4CBFE7F41E943DE
SHA-256:	FA4C04800C07A3F89626508AD801D6F30205A05A8C3A4A729ECE3B2C00F7EBFB
SHA-512:	44331534C161828CB3E2E151219BE295C5BC3EF8145088287685D4000C619F790090F824B840BBDF83335BF50923414B59C014564455B4736421FC0A699D5BEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y.................=...................:+.....).....:+.....:+..^.....................:+.....:+..A..:+.....Rich...........PE..L......E.....................h......q..............0.........................0............@.....................................T........6...........P...%.......U......8...........................XL..@...............t............................text............................... ..`.data...............................@....rsrc....6.......8..................@..@.reloc...U.......V..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\DW\DWTRIG20.EXE

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	437160
Entropy (8bit):	7.298064948752363
Encrypted:	false
SSDEEP:	6144:lUTxxIXB0iS0GaYApLhTrKUfdOtvHGKrr4Kdyj7XKUTa8m23d7KJqKWMJcjo+eCG:lUtNL8YcL5YHzI7XHgZQKhJgeCm7CO
MD5:	9435C1C2D2111573111367F92F208C1F
SHA1:	ED04C0A9E0FA1C21A59676C879D99CDB3E090EDB
SHA-256:	BB49ED0292602541148C0722902B628F793B5E860249968E780CBD289E60014E
SHA-512:	DBCCBE17C0F18D5F4145CCFC62A3B7164E578F359A2C5A5D28E339F5A94069554B2F94871BB43F7CC075B84212DA6E1236CF43E63570614F285BD06FE0D612DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........fe..............~p......%....../.V.......p.....K.u.......v.......f.......V.....&$................w.......e.......s.....Rich............................PE..L......E.................F.........................0.................................W....@..................................B...........................%..........`U..8...........................H...@...............P....B..@....................text....E.......F.................. ..`.data...8_...`.......J..............@....rsrc................\..............@..@.reloc........... ...f..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5437.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232448
Entropy (8bit):	6.37664585650164
Encrypted:	false
SSDEEP:	1536:1ItTWEi4FaZNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhe:14TWEHWNtvOeTUvIiFbwIh/B/Zt4B5
MD5:	89161DEE5EB99913537C3FA4113A73CF
SHA1:	BF44859CBEB35144711E3866295D97C600B87720
SHA-256:	DDF3C5946E2A1E24BE8F3286D8F7E6A91B088DEBFF5EAE62A960A0ACE72EEC6B
SHA-512:	06C3E191F656234D832C5BED7FF52E3CDC0630E6E80C298500A49ABC06EF50638308A383284A6FB989A51C4F1ACEC82E84FAA71D71E5035CC444F738D230870E
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................i...j...k...............................................................................................................................................................................................................................................................................................................................................................................................................................................d...............................Y...c............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......Z...[...\...]...^..._...`...a...b...e...........f...g...h...................m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5467.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232448
Entropy (8bit):	6.37241948768982
Encrypted:	false
SSDEEP:	3072:dDX9uKUNtvOeTUvIiFbwIh/B/Zt4B5s8:v0dTUnbwIhBUbs
MD5:	3FB53EE1A5C68BB04AEC03C95A42D523
SHA1:	45AAE2D9F9554623541EEC7033741818581CA0F9
SHA-256:	DD0145FB3C37A898AC56C37A5717DCD931819E090BA16E5370602ECDDA957125
SHA-512:	83799B52D8B5C155C1C902C11650EE065C50702A6CC724D124299BDFD81B56CA3E2CF5FBDD2182FDAF5DD99D94D89FBF80125F0224D1AD22695C64750C949D3A
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................i...j...k...............................................................................................................................................................................................................................................................................................................................................................................................................................................d...............................Y...c............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......Z...[...\...]...^..._...`...a...b...e...........f...g...h...................m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5497.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232960
Entropy (8bit):	6.373747611880198
Encrypted:	false
SSDEEP:	3072:w/7DT0j7iNtvOeTUvIiFbwIh/B/Zt4B5c:w/wSdTUnbwIhBUb
MD5:	639907DEFC4F82204983AB8382E76B81
SHA1:	E06A7A334BCF75CE3B7C997792DCDFEEF28F9439
SHA-256:	49FDEF4E74C5903C141AD2C8FFC3966CC9133DC13120D23B84F7F6C47631AA53
SHA-512:	6E44F24CCCFEB2F84FDA89EB30CF60CFDD95DEE823AD6EA0588ACA2BF814E5CE3175808DCB8302C6D1C046C09F3B887B9F8DC899795566BE5C8374D6DA4EEECD
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................j...k...l...............................................................................................................................................................................................................................................................................................................................................................................................................................................e...............................Z...d............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y.......[...\...]...^..._...`...a...b...c...f...........g...h...i...................n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\54D6.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232960
Entropy (8bit):	6.375572238392686
Encrypted:	false
SSDEEP:	3072:BDiLTGxJNtvOeTUvIiFbwIh/B/Zt4B58:KodTUnbwIhBUb
MD5:	1A8078C9A5B84FCA88301A1F9ECE4E6A
SHA1:	6265A462ED65D574E08490E2DF94112F0B5592B2
SHA-256:	3C5F07D7BCBDCB9435DE6967648059747DC406EBB6AC0CF5B6257F5B017924B5
SHA-512:	E9AF7155041123F9B4EB63D7B8FE11A3A9AE5FA414AF08DB576A69D02EFA77DFBCFCD54D874E8EC18F8021085AF53228627B171B19DAD5F096B6F69A57FA560C
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................j...k...l...............................................................................................................................................................................................................................................................................................................................................................................................................................................e...............................Z...d............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y.......[...\...]...^..._...`...a...b...c...f...........g...h...i...................n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5525.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232960
Entropy (8bit):	6.375391523018054
Encrypted:	false
SSDEEP:	3072:YDiUTVxJNtvOeTUvIiFbwIh/B/Zt4B5A:eVdTUnbwIhBUb
MD5:	D88D362A755EE687DB2EE6AD50E43CC8
SHA1:	784B91C269EDA57B574EA37AA26D2951DB1E5344
SHA-256:	3FE8E08940201F773F4EB66D424399E1C88A67AAD2B7F51AB8D41A777F7CDEE5
SHA-512:	15B87718B1DD411068454C69FB01ACEAB22D3D65F89BCBA478867CDC6394CDE4BB40B2B09E144494B3FE3DB9E120A22005BA86A0A99CB4CD6A9457436E249310
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................j...k...l...............................................................................................................................................................................................................................................................................................................................................................................................................................................e...............................Z...d............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y.......[...\...]...^..._...`...a...b...c...f...........g...h...i...................n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5565.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232960
Entropy (8bit):	6.377593601299753
Encrypted:	false
SSDEEP:	1536:dC758DeUSTJo3NsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+JM:zDTSTJKNtvOeTUvIiFbwIh/B/Zt4B5o
MD5:	75811EF7C41166BA8584E937BABE66F5
SHA1:	0A02DD38EB7122E5D216C73C6178CEF0DA6F8BE2
SHA-256:	0786D81FF3AA4D2F97D4B33EF8A1DCE326B7798F922B531EBD8C510F5482E6F3
SHA-512:	FF88A12693258E84DE6A9EF743F7DB4F70944EAC44E33A937A69936E602F5914BEEF6FD4A5156EC8645DF019F657B86842BF9385069BB3DF9EEF468197F915BF
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................j...k...l...............................................................................................................................................................................................................................................................................................................................................................................................................................................e...............................Z...d............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y.......[...\...]...^..._...`...a...b...c...f...........g...h...i...................n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\55A4.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	230400
Entropy (8bit):	6.39121647059163
Encrypted:	false
SSDEEP:	1536:yS+c6jYSfNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhg/8:ujYQNtvOeTUvIiFbwIh/B/Zt4B5v
MD5:	34189600CAC7B24603338728932EE94E
SHA1:	60A06FAB2C94EFF1AB56C1AC2345B659D3F919E9
SHA-256:	1787BA74287FF09443D4F41045715D094199CC759B285157640666834045642E
SHA-512:	7D8482AD586D025AFD013F3060202D5CC94ECFEDEA76AB41CA4AC601761AD706C102CF67006853D7FD8406414A58FCD53B695B0D55F14ADB54FD932392A2B263
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................f...g...h...............................................................................................................................................................................................................................................................................................................................................................................................................................................a...............................V...`............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U.......W...X...Y...Z...[...\...]...^..._...b...........c...d...e...................j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5603.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	230912
Entropy (8bit):	6.391281839707024
Encrypted:	false
SSDEEP:	1536:JesR6TCWQDNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhgq:0TC3NtvOeTUvIiFbwIh/B/Zt4B5uED
MD5:	69CDC271EE027800C79236B3CFD4D388
SHA1:	ABE4AA3A22686199056784A139A5F91F9CF61E19
SHA-256:	4353F4B5747C5DD8F1ECC9756FD91DDB28AA1B3868B52FA85A83578261AB9A26
SHA-512:	5F667A9A3B6A04E5E7DE7D28BB38E7A4177A7F0E0E610CF3E7E146D7FD1947BA7896FB26CD298893F07521F600D3EA2AD8ED93FC2652DC1BD32A0B28EFC94913
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................g...h...i...............................................................................................................................................................................................................................................................................................................................................................................................................................................b...............................W...a............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V.......X...Y...Z...[...\...]...^..._...`...c...........d...e...f...................k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\56CF.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	230912
Entropy (8bit):	6.393416359350267
Encrypted:	false
SSDEEP:	1536:xSfp6Ut/2HONsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhj:LUtrNtvOeTUvIiFbwIh/B/Zt4B52pq
MD5:	C17FC94E243132007149DAF47E835FCC
SHA1:	9EEB261F22FC33AFD75FEB033F7C40EBA039B418
SHA-256:	7CE6D304F4304E1A49EEBFB4CBFBFA29D8A2EF2519E782EE61D13DBB430A5C2C
SHA-512:	B0311230FBC0035D924BC169859D408F8B0B6C30839B4C58F51D84C9159404C166F49535F4B0FD73E2DFD61F24608FAD98995F4EC32A0B4214FB33E8EF581B02
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................g...h...i...............................................................................................................................................................................................................................................................................................................................................................................................................................................b...............................W...a............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V.......X...Y...Z...[...\...]...^..._...`...c...........d...e...f...................k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\570F.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	230912
Entropy (8bit):	6.393123605386672
Encrypted:	false
SSDEEP:	1536:1SGV6vq/2HONsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+JfhH:MvqrNtvOeTUvIiFbwIh/B/Zt4B5apq
MD5:	0A89D6A9CAFADCD2E23F1F37E552F3F0
SHA1:	51BB135314FECAB8C132D61E29BD2F567A5D5253
SHA-256:	DAB59A6623730A8F6A561D752F3F1C176CC697A7E9B352B1D21CE1C8D5EE1AA9
SHA-512:	B7D0F13378C2900638B38BF909DF713FA3AC28CAF40FD101B970E9FDA9A0C5A5920C24BF8694FC1B66B236F522D37A6AB0EE9DD2C43B93201590CB3B9D58C5BE
Malicious:	false
Preview:	......................>.......................................................g...h...i...............................................................................................................................................................................................................................................................................................................................................................................................................................................b...............................W...a............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V.......X...Y...Z...[...\...]...^..._...`...c...........d...e...f...................k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\573E.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	230912
Entropy (8bit):	6.394669529526701
Encrypted:	false
SSDEEP:	1536:o+L61sAQmNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhg/H:oD1s0NtvOeTUvIiFbwIh/B/Zt4B5fED
MD5:	276A2EB059BF05EA89127C915C34F04A
SHA1:	3B99587A065B8BD5B8879FD6561C44CBF18C48F9
SHA-256:	6B0D74783905AD5D5E8CDE9D08DE3CCD4ED3CAFD968A4F24DE18ACD7F5A4EEE1
SHA-512:	BC9C9D5163CEE46B6D597F5E9F5B96921A294DC8B87B95F24677F9360084A1BADCCEDDAE78A2A2F7905A1B56A3FCCC8192C1E09125A6CB5321EE670174275C29
Malicious:	false
Preview:	......................>.......................................................g...h...i...............................................................................................................................................................................................................................................................................................................................................................................................................................................b...............................W...a............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V.......X...Y...Z...[...\...]...^..._...`...c...........d...e...f...................k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\577E.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232960
Entropy (8bit):	6.399061244459198
Encrypted:	false
SSDEEP:	1536:SlxHoDYRxNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhg/N:FYRxNtvOeTUvIiFbwIh/B/Zt4B5tO
MD5:	DB8A924552B57DA09FCD50B0DE683D01
SHA1:	18D656D5B050AB61640568EE6CB2BCA1D70A2746
SHA-256:	DC57A20816C9EC2704BF7B129D152772A752E1838CF96A0E9C9D86D60A0AB2C5
SHA-512:	66E54F3D745CFF142AA05BB188CA8F303B4C835DA383AE9BF2ADE90355CA4CFB635809870F5AC9FD6ADE7AB95A3900CC3C6D09C4FE781BBE926436165CDEADA0
Malicious:	false
Preview:	......................>.......................................................j...k...l...............................................................................................................................................................................................................................................................................................................................................................................................................................................e...............................Z...d............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y.......[...\...]...^..._...`...a...b...c...f...........g...h...i...................n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\57BD.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	233472
Entropy (8bit):	6.401515180818087
Encrypted:	false
SSDEEP:	1536:EIYDG+VMzWNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhgm:MG+uaNtvOeTUvIiFbwIh/B/Zt4B5
MD5:	E00E8D5CD8CD57565CD13D23A8CA7786
SHA1:	113CEA69C15F7E347AD6C26A866F0CBD3CCFA0D2
SHA-256:	D842A42D57637AE6EBE55DFC3DC6AC985C080DE8BEE05E3ADD566252896F568E
SHA-512:	C8C49D9B3280A2F9F319DB43390575EEBB5241B2D16FAD553C6A27ECE2A32104DE0A2FEC81BB2C8DC9743E147237C3B2DF7024C1E908814E53FCDEA2C4C3704B
Malicious:	false
Preview:	......................>.......................................................k...l...m...............................................................................................................................................................................................................................................................................................................................................................................................................................................f...............................[...e............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z.......\...]...^..._...`...a...b...c...d...g...........h...i...j...................o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\57ED.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	233472
Entropy (8bit):	6.401256937113345
Encrypted:	false
SSDEEP:	1536:jeTQfDRXAIDNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhw:qgRXNNtvOeTUvIiFbwIh/B/Zt4B56
MD5:	B82C2A1510C3BA4734FF09B0B5621B06
SHA1:	78A82254167F7A247FAB1F3DE565A798F08ABC55
SHA-256:	753F728A5A89BBBF36681B845F837775BBB30F1A818D406A94146B25D32031CF
SHA-512:	49E4B5CBE0E62B71EB5D75472A14E6FDE77788B113FBD015EEBBB39EA3FCF8502F47A4C5B39099B317536803BE2905B56C91CA05FFB29F369FB59588A4A3DFE2
Malicious:	false
Preview:	......................>.......................................................k...l...m...............................................................................................................................................................................................................................................................................................................................................................................................................................................f...............................[...e............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z.......\...]...^..._...`...a...b...c...d...g...........h...i...j...................o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\582D.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	233472
Entropy (8bit):	6.401185677600789
Encrypted:	false
SSDEEP:	1536:seTcfDWQvIDNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhw:n0WQsNtvOeTUvIiFbwIh/B/Zt4B56
MD5:	08E07F66C89AC91A5623ACD942E6BD99
SHA1:	5481B75F0ABF16F13BEBEF4D908FFCA91F6A9AF7
SHA-256:	AF78B92DBBFCCA70B3C65E40F4B7B829F94D04EDF2BE7F9A5A41C8281DF95AAC
SHA-512:	4209343DA12A42F50C89BD03914C8098A4A0FCA49F43EEF49B3589336FB7E5E6E5DA0DFDC4F389657808B118642D3B36CC3F50556DA4AA72E8FE510A889500A4
Malicious:	false
Preview:	......................>.......................................................k...l...m...............................................................................................................................................................................................................................................................................................................................................................................................................................................f...............................[...e............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z.......\...]...^..._...`...a...b...c...d...g...........h...i...j...................o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\585D.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	233472
Entropy (8bit):	6.404762965667183
Encrypted:	false
SSDEEP:	1536:jMYDc09MzWNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhgm:7c0GaNtvOeTUvIiFbwIh/B/Zt4B5
MD5:	A27DC264EE704A4AE64D23D72DE67887
SHA1:	627D7D4A379C6DCA6D1898CDF05FF56D8D86717F
SHA-256:	C84EB65838820988DDF314DF7E103D1C786C510429C5FF7C0847899F42742CA8
SHA-512:	23469CA9A01F102BDB4F9C9FAF5F043683F151E1AA59428AAB874FE19B57D5DFABB70CFD20384D17BD6894D6A7BF7224001E056BC1C4C02CF0DC88A6742C7599
Malicious:	false
Preview:	......................>.......................................................k...l...m...............................................................................................................................................................................................................................................................................................................................................................................................................................................f...............................[...e............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z.......\...]...^..._...`...a...b...c...d...g...........h...i...j...................o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\588D.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	231936
Entropy (8bit):	6.374972991895497
Encrypted:	false
SSDEEP:	1536:VAymAVhhKNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhg/s:mAVCNtvOeTUvIiFbwIh/B/Zt4B5Y63
MD5:	10382CA722481F9155222188DE325920
SHA1:	4C08243A1BD64B84FE832F13C3106225FB69725F
SHA-256:	0B43364EB48B0B5D27BED60EF7C31258E51C5C0B808CA4A5458BFCCE5BEDC1E0
SHA-512:	452642BF1FFE123C476FB78F9C58C0C1B39A32E727B5B36906DD2588A60626D8821D9B59013232AA374EFD8ED8FF7B10E7F7887DB404F9C6ADEDBF05E7B8057B
Malicious:	false
Preview:	......................>.......................................................h...i...j...............................................................................................................................................................................................................................................................................................................................................................................................................................................c...............................X...b............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W.......Y...Z...[...\...]...^..._...`...a...d...........e...f...g...................l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\58BC.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232448
Entropy (8bit):	6.377175502101963
Encrypted:	false
SSDEEP:	1536:btmhnJaNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhg/e8g:Yhn8NtvOeTUvIiFbwIh/B/Zt4B5t
MD5:	0FCBB16EF8CD9A55512FBF90F3299A39
SHA1:	97384A370CE08BFF34096D9BB9E383C6859E75B3
SHA-256:	17F3F5D4A29348A4FB85E1365502CBDEFAF4394A98A374B91F31D8C21B95376D
SHA-512:	D8BD8DD48BA177D3E400F0DD0E03237960A51FA7FDDE33903116DCF8296352CA76C9DF7F7AAEBD0E75E760512DEA7498C0C8DD4D2462BA49D1FBF7C0EE6B2A28
Malicious:	false
Preview:	......................>.......................................................i...j...k...............................................................................................................................................................................................................................................................................................................................................................................................................................................d...............................Y...c............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......Z...[...\...]...^..._...`...a...b...e...........f...g...h...................m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\590C.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232448
Entropy (8bit):	6.37846394265091
Encrypted:	false
SSDEEP:	1536:aowVmei9dNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhg/h:tZei9dNtvOeTUvIiFbwIh/B/Zt4B5o
MD5:	7C9F3CB72991B747CFB6377E33291108
SHA1:	CBE7B225DD74513299B5B0D5344A813780F97A96
SHA-256:	69DE307AE7A4AE8F21B84AEC2714C533D50BF0CC4FA3BA6E6DD5B84869DB1C00
SHA-512:	B9DCF32A3A781F3538FA5855C7C7B3D7D1718CCDA4E914DC0F7B3D7757FD0B05D713FD20BAB77C0D88D5D8216E057AFA3F0A3787E56441C66D2ADB8E5AF51F6F
Malicious:	false
Preview:	......................>.......................................................i...j...k...............................................................................................................................................................................................................................................................................................................................................................................................................................................d...............................Y...c............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......Z...[...\...]...^..._...`...a...b...e...........f...g...h...................m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\594B.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232448
Entropy (8bit):	6.3780099238881975
Encrypted:	false
SSDEEP:	1536:tVj/m9R9dNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhg/F:ny9R9dNtvOeTUvIiFbwIh/B/Zt4B5c
MD5:	B871D6E017656C99E294D60E70510CF8
SHA1:	58F299C9A35ADD00E643A4CE6AB9A5B9D74361F1
SHA-256:	50DCBBA27D44C7DFF9F828BA8194E016669DDB919BF2FEE85A5AA671A317CBD4
SHA-512:	45DD22B92DAF3C0D3F66092F9F51D8BBF3CDEF2090F5612CB24009C58DA637978F5098F2552AE212CDC9B9D72B484A53D8C85FD466B5B8BBED56757DB05EFC3C
Malicious:	false
Preview:	......................>.......................................................i...j...k...............................................................................................................................................................................................................................................................................................................................................................................................................................................d...............................Y...c............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......Z...[...\...]...^..._...`...a...b...e...........f...g...h...................m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\598B.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232448
Entropy (8bit):	6.380023982395122
Encrypted:	false
SSDEEP:	1536:sQmnhvPNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhg/e89:4nhnNtvOeTUvIiFbwIh/B/Zt4B54
MD5:	17833A0696899BD0B5471CABBC308972
SHA1:	3857A303DDEB5C7EDB802CAA7E958AAE755DB4BB
SHA-256:	32A81A4A699E1FBE30003646DA65CE5F8F90745CB166DB28B5B05588FC9D78E1
SHA-512:	592A6C5ABF9AB65F96BE0FFCF2423743A35A29BEE22F93DC6CF670E2035EBC4456BA22882822A76106606889595C8582AB42A86941ABDFE6AD0EE79D88C18258
Malicious:	false
Preview:	......................>.......................................................i...j...k...............................................................................................................................................................................................................................................................................................................................................................................................................................................d...............................Y...c............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......Z...[...\...]...^..._...`...a...b...e...........f...g...h...................m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\59BA.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	231424
Entropy (8bit):	6.401922059973978
Encrypted:	false
SSDEEP:	1536:xBIXYOONMHnufzNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+W:/oYRNMO7NtvOeTUvIiFbwIh/B/Zt4B5
MD5:	CF286539F725B8E664430B800B4A5B86
SHA1:	8F9B30F3F9B3A61A4508169D99776251B4FB25A2
SHA-256:	E113BA9910D011B8E469691E5CC89947DEC7753B1589DCB4296C1583F3FE23B0
SHA-512:	B839F6AD1615CD389576C42EBFCF4A19ED578F44F7D8C5AC8882E6BD2414959F6CAAAB9BC34FCE0CA3AF57DBD212D2347B8B9074E587A8BF167504D374A25167
Malicious:	false
Preview:	......................>.......................................................h...i...j...............................................................................................................................................................................................................................................................................................................................................................................................................................................c...............................X...b............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W.......Y...Z...[...\...]...^..._...`...a...d...........e...f...g...................l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\59FA.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	231936
Entropy (8bit):	6.402546386990333
Encrypted:	false
SSDEEP:	1536:psk20Owb4/XNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfh/:QLwb4/XNtvOeTUvIiFbwIh/B/Zt4B5
MD5:	57F6ADB0F5A263D59CDAD3D45A94B38C
SHA1:	FF03B31E790FE566EF201E205DFDB5E544AFCA07
SHA-256:	205A6B525FDBD0FC877AC3D54E2D8322DB7F1359F007554AD3A3179082C1A6B5
SHA-512:	8E026BEAF6A8211C355BE52476E8406AA542735C6F83A926789F5A8A72AB192C73AF3FEC4B509CD328B00BA7A8B17CB5233A729A99B2498F7135A0B70A10B7C0
Malicious:	false
Preview:	......................>.......................................................i...j...k...............................................................................................................................................................................................................................................................................................................................................................................................................................................d...............................Y...c............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......Z...[...\...]...^..._...`...a...b...e...........f...g...h...................m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5A2A.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232448
Entropy (8bit):	6.394711049771187
Encrypted:	false
SSDEEP:	1536:7BEjrO1rnFNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+JfhgI:7Byq1rnFNtvOeTUvIiFbwIh/B/Zt4B5
MD5:	A8906A2925A00A2F56D54AC8FE08C241
SHA1:	3CAB3D82722D85CCF1FD983B6EB40406C1989F6E
SHA-256:	AE9CEAF9FF875023789F1A6BBE4002722F35EE0568870E5E81E7CCDB73C0888C
SHA-512:	BA505B673D9E31E62A4021CAAB8D1DDCD6B7BDEEA613474F05286B50187A48171DF9CA3B9368707E7584EFE851FAFC8B118D6211CBAA55A0F11EDFB6DFDF8F78
Malicious:	false
Preview:	......................>.......................................................i...j...k...............................................................................................................................................................................................................................................................................................................................................................................................................................................d...............................Y...c............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......Z...[...\...]...^..._...`...a...b...e...........f...g...h...................m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5AA8.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232448
Entropy (8bit):	6.3944491500244585
Encrypted:	false
SSDEEP:	1536:oBuUrOErSFNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhgc:oBHqErSFNtvOeTUvIiFbwIh/B/Zt4B5
MD5:	21CB2ECB39FB6D6D43D543F2058DF432
SHA1:	39814F61A8D9120F867FAC878572796AB0E1C93B
SHA-256:	04598497D374351B29FE194FFB350A7E0B36AC89A23FDD5F97C67686F47963C7
SHA-512:	D470625A55634F04E54627F0475DFF783FAB5E2D3B960667707270D9606FD1E6322EB5EA0BD3AA70D3CFA0D901A1D221BF101F37E486E6175142E1B20215DC48
Malicious:	false
Preview:	......................>.......................................................i...j...k...............................................................................................................................................................................................................................................................................................................................................................................................................................................d...............................Y...c............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......Z...[...\...]...^..._...`...a...b...e...........f...g...h...................m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5AE7.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232448
Entropy (8bit):	6.39712288260649
Encrypted:	false
SSDEEP:	1536:Pxhsp0OOrrndNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfw:+LOrrndNtvOeTUvIiFbwIh/B/Zt4B5
MD5:	CA1218719505514C904781E997827A04
SHA1:	B385613F9E0C30C54380193898675C4D37788D27
SHA-256:	352FF08671B7522622CF6EB7110DEE4ED8D9739A49C733CC752608104761D7FE
SHA-512:	72879B9FA0C883670275CBF4B5BD8AB44A000A11E07E1036F1B4D816BEB7D6CD63785443D179270B1E61BD5DCB00E2AC250E4139F948D7886D6D51C186BCA8FA
Malicious:	false
Preview:	......................>.......................................................i...j...k...............................................................................................................................................................................................................................................................................................................................................................................................................................................d...............................Y...c............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......Z...[...\...]...^..._...`...a...b...e...........f...g...h...................m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5B27.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	820736
Entropy (8bit):	5.804257611576101
Encrypted:	false
SSDEEP:	6144:cbdTUnbwIhBUbXAAOSeUAh9K9MXvDi0z7IRttGW1GgJZmmmMUbi:cJonb/XGwkeh9KUvDi0HI/t71GEd
MD5:	5AE257C0736C382E2112CF6C624F1AE8
SHA1:	F332106333876942FB8A3E6CB405A0BDBFE64F53
SHA-256:	4F91237C849D4D3984990878C73FAED521C8E87A69DD464DBE34D9642C067A95
SHA-512:	E470D748E6B786A669978580F06A54C39DD2BAC8BE241335787D7B3F3808700C85B43608E3BE4B6DB106D877066E6B8E6D425C5716898BE2DADBA8BE9AA2A20F
Malicious:	false
Preview:	......................>.......................................................f...g...h...............................................................................................................................................................................................................................................................................................................................................................................................................................................a...............................V..._............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U.......W...X...Y...Z...[...\...]...^...`.......b.......c...d...e...;...............j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5B76.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	231936
Entropy (8bit):	6.372028265692154
Encrypted:	false
SSDEEP:	1536:phBE8v1NsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhg/e8i:m8v1NtvOeTUvIiFbwIh/B/Zt4B5
MD5:	2936765B9C23084A3401E2F492CCC557
SHA1:	14C719826E04508C00455789B46AD115A182B78F
SHA-256:	285822267988E900AB1DCF3482A03A4E2065CE3D4E044C2DC4F8312D829947B5
SHA-512:	DCB52BEA918F26F689A86B38D5024488D0254CA6E6CA045B81988A4532FD6FB29F86D04EC70A5FB18C20DBE7C6965419B64184C8B48B687D565E07691A1643E8
Malicious:	false
Preview:	......................>.......................................................h...i...j...............................................................................................................................................................................................................................................................................................................................................................................................................................................c...............................X...b............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W.......Y...Z...[...\...]...^..._...`...a...d...........e...f...g...................l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5BC5.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232448
Entropy (8bit):	6.372933886341181
Encrypted:	false
SSDEEP:	1536:0mWPEcz6ZaJNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhj:0Kc+CNtvOeTUvIiFbwIh/B/Zt4B5
MD5:	A324D17055F54932910DB5B9A822FF81
SHA1:	3C6FDC8FEAAA3292613564DFAB95A435102250DC
SHA-256:	C526D3C2C707F3CA9DB3E68AE4CF47C06CC0409DA20A3F786B3CAB2ADDED1CE5
SHA-512:	E550CFE660B39BE259018CA549621132E8FD110FB59878727DD348176B218D0C62587773D83755CDF00BED214C9BBF41A2C6ABC89C9556F42656A61B0452592F
Malicious:	false
Preview:	......................>.......................................................i...j...k...............................................................................................................................................................................................................................................................................................................................................................................................................................................d...............................Y...c............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......Z...[...\...]...^..._...`...a...b...e...........f...g...h...................m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5C24.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232448
Entropy (8bit):	6.377363700927884
Encrypted:	false
SSDEEP:	1536:lmpBc/EfznkaJNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jl:lSf7pNtvOeTUvIiFbwIh/B/Zt4B5
MD5:	1F517448293AF92C9761B43CE4806460
SHA1:	CA7246B3813E155FD1A04D13BD8CFC7DB4DA641B
SHA-256:	AA1CA546304793B7DD4E8340730C994DADA19C65A73ABCA41B1FEB2E383286BC
SHA-512:	DDFD6AB69325026D650926547D57199E57B7C255B55D51C1BCC1B68EE57B52180917FBEDA4490E5E011A77397C29D24947957BF1E9509BF4521BB3AAEB00C18F
Malicious:	false
Preview:	......................>.......................................................i...j...k...............................................................................................................................................................................................................................................................................................................................................................................................................................................d...............................Y...c............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......Z...[...\...]...^..._...`...a...b...e...........f...g...h...................m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5C63.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232448
Entropy (8bit):	6.373848533062735
Encrypted:	false
SSDEEP:	1536:hTE6lycQENsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhg/+:O6k2NtvOeTUvIiFbwIh/B/Zt4B5
MD5:	B61D1930EDD9807DEAD02DC785222B0B
SHA1:	D5BA37814A2712F9935D127E7728E93064B2752E
SHA-256:	7D3765D72808821321B6E29AA6E4107D1A7DB5547AD4A73DC2EE753F94C8B1A6
SHA-512:	3CE274DAAD61946B3E13A0923B37F70A1C7344B41A5B6CC23CB5251CB97D662AED9A2C1B1C29043E2AF7A7E7CF19D0EE6923A24D7D38BE8033E4D13A1EA3D621
Malicious:	false
Preview:	......................>.......................................................i...j...k...............................................................................................................................................................................................................................................................................................................................................................................................................................................d...............................Y...c............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......Z...[...\...]...^..._...`...a...b...e...........f...g...h...................m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5CA3.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232960
Entropy (8bit):	6.371008463473991
Encrypted:	false
SSDEEP:	1536:xcG4yE52WiEkNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jft:xE5FoNtvOeTUvIiFbwIh/B/Zt4B5
MD5:	9BF48C78FCF9EC0A1FD0C3EA77AE3377
SHA1:	B1233778464603C305BD9EC23B5D45D1ED070124
SHA-256:	C132627540690208121687E1B72B45C2F575C1FAE9550EDA5C4DA7F33C3C166A
SHA-512:	237A0AFFDCDB5DF8D7732531DD28BFBA34FF0F2F32D6D931A28CD82B3C47E424600031ACC2B5B93BBA9B2196AA83B3E4F10C7D79712398CF780DF17096F4F89A
Malicious:	false
Preview:	......................>.......................................................j...k...l...............................................................................................................................................................................................................................................................................................................................................................................................................................................e...............................Z...d............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y.......[...\...]...^..._...`...a...b...c...f...........g...h...i...................n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5CE2.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	821248
Entropy (8bit):	5.80481050388562
Encrypted:	false
SSDEEP:	6144:TQAdTUnbwIhBUbnqAOSeUAh9K9MXvDi0z7IRttGW1GgJZmmmMUbixh:Ttonb/XGqkeh9KUvDi0HI/t71GEdxh
MD5:	8FA4342501CBBED90C917E33C21ED75D
SHA1:	442B26A50AC72F0210517B496D90907C263F1A69
SHA-256:	C055AF60F782E0962BD73682ACA63426F042794F9D74552CD33360153D4C8BC6
SHA-512:	4F183408AB7171F0A2A152A71F556872245428EC71FB97C82F5532F4C55AADFC953874CB2635C2723F8DAC383F55FB0A04DD45B148E53CCF5645934BE813B829
Malicious:	false
Preview:	......................>.......................................................g...h...i...............................................................................................................................................................................................................................................................................................................................................................................................................................................b...............................W...a............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V.......X...Y...Z...[...\...]...^..._...`...c...........d...e...f...<...............k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5D31.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	821248
Entropy (8bit):	5.804812609717442
Encrypted:	false
SSDEEP:	6144:xQCdTUnbwIhBUbnqAOSeUAh9K9MXvDi0z7IRttGW1GgJZmmmMUbiVs:x5onb/XGqkeh9KUvDi0HI/t71GEdVs
MD5:	06B7A4FBE340066F61AC008544D076EA
SHA1:	187EE0E7C587F35BB0A7328801FE6785CD9BA78C
SHA-256:	F2680FF9DD89A831DAA198F87110C3B3537B47FC9294E549DC33E7C3C244B59F
SHA-512:	11641476599D44480285007514D1D450E65447A24C67BE4DF19CEA7F50111BCEAA0E6FF4519BF1D64BA288A1C20F80C1EAA4CA1CA19FA9F52912B46827461896
Malicious:	false
Preview:	......................>.......................................................g...h...i...............................................................................................................................................................................................................................................................................................................................................................................................................................................b...............................W...a............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V.......X...Y...Z...[...\...]...^..._...`...c...........d...e...f...<...............k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5D90.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	821248
Entropy (8bit):	5.804735588681236
Encrypted:	false
SSDEEP:	6144:03CdTUnbwIhBUbnqAOSeUAh9K9MXvDi0z7IRttGW1GgJZmmmMUbiVs:0conb/XGqkeh9KUvDi0HI/t71GEdVs
MD5:	0E89F90F0D6A4B41AECBFEF41E6950DD
SHA1:	781B3E3657E2EC8B28198858C7A75DCDF2872E5A
SHA-256:	DBFA27EF5FABF80F97C9674426AE43FABA9612A39F9AC3EE68944C0ACFB74C91
SHA-512:	E78BB4EE0EE2C94CC7A4B363737F91F92C9D277AF337501C2E1F9CB7FBBEE4601DF6E1FD7074257B37EC2558A3BE29514852A0C2B53BA0C96C5C9422C8F9CD12
Malicious:	false
Preview:	......................>.......................................................g...h...i...............................................................................................................................................................................................................................................................................................................................................................................................................................................b...............................W...a............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V.......X...Y...Z...[...\...]...^..._...`...c...........d...e...f...<...............k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5E0E.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	821248
Entropy (8bit):	5.806172379109186
Encrypted:	false
SSDEEP:	6144:0uAdTUnbwIhBUbnqAOSeUAh9K9MXvDi0z7IRttGW1GgJZmmmMUbiJB:0/onb/XGqkeh9KUvDi0HI/t71GEdJB
MD5:	72AF4C35EE02AAF62E9F690393DA4DA7
SHA1:	0167A0CF08D07C296EB0208616D06B8D115C3FC8
SHA-256:	7BC32F21289C034ED6C0BAFE439201B14EC0883B640814891B0856AC34A0748F
SHA-512:	DC5FC63183F5145E3F95A27B4D9CED6CEBF857BF7A518CD39A1E82D78C2A7D508E4CDFD807F496011C597DCB5B8E68F7DE21122E2D5D0F9D6E1941FBAB44BE78
Malicious:	false
Preview:	......................>.......................................................g...h...i...............................................................................................................................................................................................................................................................................................................................................................................................................................................b...............................W...a............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V.......X...Y...Z...[...\...]...^..._...`...c...........d...e...f...<...............k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5EAB.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	233472
Entropy (8bit):	6.399971866377153
Encrypted:	false
SSDEEP:	3072:rGCvdHInBNtvOeTUvIiFbwIh/B/Zt4B5sw:7KBdTUnbwIhBUb
MD5:	C884203A8EF65D8E335CF4B29D71E317
SHA1:	6204FF8143C5236C6C5727273A46CD2271D006AF
SHA-256:	F49346505DF21CACCA255255EF2CDDCCD5E609172450F732702654A007D558EC
SHA-512:	6751A4536334B7F0A0CE920F46CAE1E2F7509C73095423504256CDDC1F9D45118335690668BA0C35E90EA4C651AE9EEFC5D2062AF77F3C4D4F961574D756ED0A
Malicious:	false
Preview:	......................>.......................................................k...l...m...............................................................................................................................................................................................................................................................................................................................................................................................................................................f...............................[...e............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z.......\...]...^..._...`...a...b...c...d...g...........h...i...j...................o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5EFB.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	233472
Entropy (8bit):	6.406730120699621
Encrypted:	false
SSDEEP:	1536:hvD3+KHV4ONsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhgr:gKHjNtvOeTUvIiFbwIh/B/Zt4B5Re
MD5:	EA4426BB40D70B056386A431D10E2706
SHA1:	A33F07F363CD425EA3F2A50BFC66D7F7D412D640
SHA-256:	9030839FF727BD49EEAD7F2104F842449FAC8E1A7F24F7BBA43E998EA18C5AEB
SHA-512:	F6E1E2C3673E6C7F0109777CEC011878CB02F606EAF6F1F094FFE090039D50B1A8D2C9E177F7CAFFA3778932795C98B40DA7CE6DD10FDE0ED096111912936D18
Malicious:	false
Preview:	......................>.......................................................k...l...m...............................................................................................................................................................................................................................................................................................................................................................................................................................................f...............................[...e............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z.......\...]...^..._...`...a...b...c...d...g...........h...i...j...................o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\5FA7.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	233472
Entropy (8bit):	6.410880021261008
Encrypted:	false
SSDEEP:	1536:gle+zaDX+7zNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfh7:2zayzNtvOeTUvIiFbwIh/B/Zt4B5Jj
MD5:	D3201DC65DEC726235A7CAE68EC3E40A
SHA1:	3D369B835C6F95D8246FD959827A663E0E262341
SHA-256:	32FC653B9C4108EDA7B28A0B45019609B15D8D05D14515942FE0BFF5B1E77E7C
SHA-512:	7412888BCC0DB2D46154BF732DD3A7097BE24F39F310B20297B268434488389313D6E868F0B7AE9EC2C97BF592136E450DA513612713B991BA4CD787418076D5
Malicious:	false
Preview:	......................>.......................................................k...l...m...............................................................................................................................................................................................................................................................................................................................................................................................................................................f...............................[...e............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z.......\...]...^..._...`...a...b...c...d...g...........h...i...j...................o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\6016.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	233472
Entropy (8bit):	6.410435734856909
Encrypted:	false
SSDEEP:	1536:ZoU+wFDX+7zNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfh3:KwFyzNtvOeTUvIiFbwIh/B/Zt4B5J/
MD5:	D61D68EAECEECDE9955807B11BF67F90
SHA1:	DA37A5777FDBDAA05C94DF559A5EBBFAE3D82A63
SHA-256:	19E4F486F372CBE2934842B89C7183E7A1D4939597555FA55C9928ED0A29EB40
SHA-512:	5818D4F8CD23060EEFE4AA154DF22DC171E02D29BEFF512D82DCB215E0EBE75973E462815E3393AC30FA8DDF7E1721AFC801667B0FEF062068FB17C7490CEB56
Malicious:	false
Preview:	......................>.......................................................k...l...m...............................................................................................................................................................................................................................................................................................................................................................................................................................................f...............................[...e............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z.......\...]...^..._...`...a...b...c...d...g...........h...i...j...................o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\6036.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	233984
Entropy (8bit):	6.401152282852368
Encrypted:	false
SSDEEP:	1536:z+7oD+G8sZ4INsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+JfY:3iGVFNtvOeTUvIiFbwIh/B/Zt4B5RO
MD5:	FF3ED85EF2CDE87108E21E8EB16E69F9
SHA1:	0FDAA9A10F8DE16CF011EA67E38A892D50DAD7E8
SHA-256:	129E28EA73A746C4BACD04B07D1C0317F099DE07FB0F8D78E0B24DFD8AE7B9B4
SHA-512:	2828B79561CEFBD7A775DC83240FD8660E51CB0F0FF64446708C10DE864A439E7C0ED7FA20C6260C90DEF00835AF619262F63663624A8F76F3225DCF227FC669
Malicious:	false
Preview:	......................>.......................................................l...m...n...............................................................................................................................................................................................................................................................................................................................................................................................................................................g...............................\...f............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[.......]...^..._...`...a...b...c...d...e...h...........i...j...k...................p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\6085.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	231936
Entropy (8bit):	6.372045014560123
Encrypted:	false
SSDEEP:	1536:ugbtMVVubNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfhg/L:vMVVubNtvOeTUvIiFbwIh/B/Zt4B5
MD5:	C6BB9C58A3C4C05FFA95219BCD81B32E
SHA1:	1F17354165D14927D2A9867A65BBA2FCCAF714D9
SHA-256:	E9D3316D1C5C595B0FA0CAE1A84DA0AB6E41A4FF9D3E9E061122BD8A2BCC987E
SHA-512:	DD9FE24DE55E5E14D45E602347DC690C2E7551FF26A3A8FFADD396BE9E8217B5B7FC99002D09018A30193DEBBE3F1F48CDD4ECC259BC218505837DCA9771D95B
Malicious:	false
Preview:	......................>.......................................................h...i...j...............................................................................................................................................................................................................................................................................................................................................................................................................................................c...............................X...b............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W.......Y...Z...[...\...]...^..._...`...a...d...........e...f...g...................l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\6096.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232448
Entropy (8bit):	6.372650300420041
Encrypted:	false
SSDEEP:	1536:4qNtbGE2srayNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+Jfd:4GbGEnLNtvOeTUvIiFbwIh/B/Zt4B5
MD5:	C571B19F0354BB873A397E9A81159A9F
SHA1:	CB12B4C58874AD6B7E2FE21CAB1DE0263ECAFF16
SHA-256:	D63EC57549E0923B714A771FA5B1E0C62C8BB4A3607507A4A67A1EF32D4A52D5
SHA-512:	BFF0AADEAC1D4FB786D86292FE9FE6B776087900DB9CC27B2DC29E93EB69E4607168DA00EAD2B86A871E90B653F127A8C59F841943AA051210A60418D4606823
Malicious:	false
Preview:	......................>.......................................................i...j...k...............................................................................................................................................................................................................................................................................................................................................................................................................................................d...............................Y...c............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......Z...[...\...]...^..._...`...a...b...e...........f...g...h...................m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\60B6.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232448
Entropy (8bit):	6.374030240248473
Encrypted:	false
SSDEEP:	1536:NtYWE8F4QUNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+JfhgV:7YWEcaNtvOeTUvIiFbwIh/B/Zt4B5
MD5:	FF44D314BBFEF1D4BE78351951D37372
SHA1:	B8F0199456546A8F1F2BDB4C4B3775B38D3A4DCF
SHA-256:	E20462E7EA55A5922E31622C8F14FCFD5D8437BF58E26D2B74D6E90B0B46159B
SHA-512:	92B5FA4A573C9CB179342A4D1B4CD0C90ABA19C536FAFB714C2FD81EF308C9291FD4A6C32E2FC9B298B4F77E604833EF41D62F2CBE8704753B27FC0268C15F5D
Malicious:	false
Preview:	......................>.......................................................i...j...k...............................................................................................................................................................................................................................................................................................................................................................................................................................................d...............................Y...c............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......Z...[...\...]...^..._...`...a...b...e...........f...g...h...................m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\60C7.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	232448
Entropy (8bit):	6.373515240673056
Encrypted:	false
SSDEEP:	1536:Rilt9WESo4QUNsavOecCGLqTUbYglzkkpyeeNpiUvU1A0pKJUw4+gT1Ws7Dp+JfM:U9WE/aNtvOeTUvIiFbwIh/B/Zt4B5
MD5:	3BCCC06C064BB8ECE6AC7447E3423290
SHA1:	9C440FA27091CBC8C6B205CD020C3FA10D47B9EF
SHA-256:	E00B48EC3B4FD5D5D23E05797D76F1DF43A3027D1E2FC7BFCC279B580E307FC3
SHA-512:	78EF76D183C61303563E107FF6ABC77832B967A1E30AEDFE1C02383EBE573B361DB45DDB8C61587A772216DBA89C0EF72B78AEC7957C09BDB6E2013C87989E2C
Malicious:	false
Preview:	......................>.......................................................i...j...k...............................................................................................................................................................................................................................................................................................................................................................................................................................................d...............................Y...c............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......Z...[...\...]...^..._...`...a...b...e...........f...g...h...................m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\MSId7441.LOG

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	838
Entropy (8bit):	3.722019951914111
Encrypted:	false
SSDEEP:	24:QkU3YKoSHLGPkWQULFjmBHg0RKOaVnTypQ:hKPoSrGPYxi0Yjy6
MD5:	BD75ACD45A1839154E1908C22B03107F
SHA1:	DCB5DB238635769B2D918C672E945F355B91F880
SHA-256:	8422FB5CCA8DC6C67793A75C17FBC1A09B0F50060A26FFB410ED9E7517529C2A
SHA-512:	B5FEA522064C14889736AB83E12FDF6FCD8B20AD4AC8AEF7E9F7766F0E7F0BD1E4CD00C153383547BE2736AEB38934FA99021C0ED7EF3F8EE01672B9A5F10F11
Malicious:	false
Preview:	..E.r.r.o.r. .1.9.3.5... .A.n. .e.r.r.o.r. .o.c.c.u.r.r.e.d. .d.u.r.i.n.g. .t.h.e. .i.n.s.t.a.l.l.a.t.i.o.n. .o.f. .a.s.s.e.m.b.l.y. .'.M.i.c.r.o.s.o.f.t...V.C.8.0...C.R.T.,.v.e.r.s.i.o.n.=.".8...0...5.0.7.2.7...4.2.".,.t.y.p.e.=.".w.i.n.3.2.".,.p.r.o.c.e.s.s.o.r.A.r.c.h.i.t.e.c.t.u.r.e.=.".x.8.6.".,.p.u.b.l.i.c.K.e.y.T.o.k.e.n.=.".1.f.c.8.b.3.b.9.a.1.e.1.8.e.3.b.".'... .P.l.e.a.s.e. .r.e.f.e.r. .t.o. .H.e.l.p. .a.n.d. .S.u.p.p.o.r.t. .f.o.r. .m.o.r.e. .i.n.f.o.r.m.a.t.i.o.n... .H.R.E.S.U.L.T.:. .0.x.8.0.0.7.0.4.2.2... .a.s.s.e.m.b.l.y. .i.n.t.e.r.f.a.c.e.:. .I.A.s.s.e.m.b.l.y.C.a.c.h.e.I.t.e.m.,. .f.u.n.c.t.i.o.n.:. .C.o.m.m.i.t.,. .c.o.m.p.o.n.e.n.t.:. .{.9.8.C.B.2.4.A.D.-.5.2.F.B.-.D.B.5.F.-.A.0.1.F.-.C.8.B.3.B.9.A.1.E.1.8.E.}.....=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.8./.0.4./.2.0.2.4. . .1.8.:.3.6.:.2.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\TFR6DB8.tmp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	3.771296630904785
Encrypted:	false
SSDEEP:	12:QaNyKJ6yzhBQ1oaEaUfzQ1oaEadOlQNeYA7VMGiflvrv9+9W0pD+gno2vaGNw4:QaIy/fsy/flrYA5GZ+8R+JdNf
MD5:	6195EC371858760BADEB306B88F4D965
SHA1:	80EFCC793406721F34504CCBB8150DB535FBAF1F
SHA-256:	599E768491BAF692108D143A57A0FCD1B2C2A68B6B4E13B4E069385217875FFF
SHA-512:	F19997DE6BB864A1CE845AB12E0A5F5E9ADDA0AD499416BCB106A851EBBCD106F57B5DC9624F863A24F5A2A1B0BF770571076363FF3CAFB041AD5FF8D62AB255
Malicious:	false
Preview:	......V.e.r.s.i.o.n.=.1.3.1.0.7.2.....G.e.n.e.r.a.l._.A.p.p.N.a.m.e.=.V.S.8.0.s.p.1.-.K.B.9.5.4.9.6.1.-.X.8.6.-.I.N.T.L.....U.I. .L.C.I.D.=.2.0.5.7.....F.i.l.e.s.T.o.K.e.e.p.=.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.V.S.8.0.s.p.1.-.K.B.9.5.4.9.6.1.-.X.8.6.-.I.N.T.L.\.V.S.8.0.s.p.1.-.K.B.9.5.4.9.6.1.-.X.8.6.-.I.N.T.L.-.w.r.a.p.p.e.r...l.o.g.\|.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.V.S.8.0.s.p.1.-.K.B.9.5.4.9.6.1.-.X.8.6.-.I.N.T.L.\.V.S.8.0.s.p.1.-.K.B.9.5.4.9.6.1.-.X.8.6.-.I.N.T.L.-.m.s.i...0...l.o.g.....U.I.F.l.a.g.s.=.0.....R.e.p.o.r.t.i.n.g.F.l.a.g.s.=.2.0.4.8.....Q.u.e.u.e.d._.E.v.e.n.t.D.e.s.c.r.i.p.t.i.o.n.=.Q.u.e.u.e. .S.e.r.v.i.c.i.n.g. .R.e.p.o.r.t.....E.v.e.n.t.T.y.p.e.=.V.i.s.u.a.l.S.t.u.d.i.o.7.x.8.0.U.p.d.a.t.e.....E.v.e.n.t.L.o.g.S.o.u.r.c.e.=.N.a.t.i.v.e.W.r.a.p.p.e.r.....P.3.=.K.B.9.5.4.9.6.1.....P.4.=.2.0.5.7.....P.5.=.6.6.a.....P.1.=.m.s.i.e.x.e.c...e.x.e.....P.6.=.F.....P.2.=.1...0...8.0.4...2.1.3.8.....P.7.

C:\Users\user\AppData\Local\Temp\VS80sp1-KB954961-X86-INTL\VS80sp1-KB954961-X86-INTL-wrapper.log

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	32367
Entropy (8bit):	4.821001674258272
Encrypted:	false
SSDEEP:	384:66ZRGb5hQI7YAvhZDZkZVZSZVZrZ0AuZ/Z89Z99ZO3wZ1Z0ZuZ6Z+ZHYZenZrZ1F:66O9zNj
MD5:	247F73200BCFFF5A92C868121AD6009C
SHA1:	3BC31698E2AB211FA8BE383E3D7E48206D791107
SHA-256:	B1A61EEFB6FB757D9AA44EF81111407EF75F55B7A03EE70A111ADD75971DC46B
SHA-512:	8D63343D875957D01493B71BB9D48DF6F77E107D052DE026718F35CE7FD3FD46FC776FE1B9F59438492CBC02BC2691EE0C7B8B827A56EE3258850EF62E5096A5
Malicious:	false
Preview:	+ Launching the patch wrapper.. + Initializing patch object from manifest file.. + Initializing manifest reader.. - Initializing manifest reader.. + Loading patch info.. - Loading patch info.. - Initializing patch object from manifest file.. + Processing command line.. Command line: .. + Replacing Switch Abbreviations.. - Replacing Switch Abbreviations.. + Validate allowed switch combinations.. - Validate allowed switch combinations.. + Forcing MSI Logging.. - Forcing MSI Logging.. + Add Source path to MSI Source List.. ERROR [16389].. ERROR [16389].. - Add Source path to MSI Source List.. - Processing command line.. + Initializing watson data.. + AddFileToKeep Logging.. - AddFileToKeep Logging.. - Initializing watson data.. + Executing Action.. + Prepare to apply the patch to all products.. + Extracting Items.. Item 2 to C:\Users\user\AppData\Local\Temp\ZN

C:\Users\user\AppData\Local\Temp\ZNW50FA\VS80sp1-KB954961-X86-INTL.msp

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	18733056
Entropy (8bit):	6.947813373281824
Encrypted:	false
SSDEEP:	196608:6ZNvMP9QCRfFLZuVqo1Ma9G5Uw2PPna3EHpaoKmRmCZKHMx8LHRG8PHj2NNHa0R0:ehXZ18E8aN0gBTHiobs09MRi
MD5:	BCDAFF82B608D92381689C87F82BC23D
SHA1:	A224251490BA83421CCEECAA8B05526517038A8A
SHA-256:	664CB1814F0B94A5877EB2B6FAFA6ABF3B8293DBA88744CC1C35F745A2A9BBD7
SHA-512:	685755B3F107DE7C5FD9F383FA9C713CB16FF614D6F7C660A64861D163F35BB5ABBC52CC261D1EA64D757BAB873859751FF94778976F7718899FC1BBA7CFDDF4
Malicious:	false
Preview:	......................>.......................................]...}6..................s...............?...............w...x...y.......F...G...H...............u...............B...............t...u...v.......>...?...@...............i...............4...............o...p...q.......?...@...A...............p...............@............ ..v ..w ..x ...!..B"..C"..D"...$...$...$..q%...%...%...%..>'...'...'...(..s)..t)..u).....@+..A+..B+...-...-...-..n.......................................X3..Y3..Z3...4.."5..#5......................................k...........................c........................................................... ...!..."...#...$...%...&...'...(...)......+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\ZNW50FA\dw20shared.msi

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1850368
Entropy (8bit):	7.864460324790716
Encrypted:	false
SSDEEP:	49152:sKwOEFA6sLPHF+NQZNW1nAm6HuhVWPwPxUxufR+MAAf97:Lc1O+NQZNYA4MwPxSWAAf9
MD5:	57677B56DBD1D07BE20109ED5C2CD577
SHA1:	2AE1A280383A5CE26724CCD628B12F922B0F44E8
SHA-256:	9783D94A823FF54255680E7BBF3DACA93FE087A7A0197F16773081D05AD655A8
SHA-512:	C8E9A6CFCE9575FE6B40CFBD9A7AF87477D86429EB6DCB45D4D23888E40C385162D87B152DFFBC7C50E632548B039046A7CD41999068D8C5CA90C020B6468B01
Malicious:	false
Preview:	......................>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................._.......................\......."...!...$...#...8...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...:...9...J...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...L...K...[...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...........2...^...`.......a...b...c...l...e...f...g...h...i...j...k...]...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\ZNW50FA\filehashfixup.exe

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	83480
Entropy (8bit):	6.4723618909078
Encrypted:	false
SSDEEP:	1536:5+CZzGagygkrr2i9b0d2PObzgBC3uDuPzkG0/oj3tcfm8Cy/S:w2z3bTAzWE3tcfm8Cy/S
MD5:	24844BC62FCF6DF7EFC4E6FA3A0ADB7B
SHA1:	3E4197436CBB85E86FE8184A84D3299AA00A4BFB
SHA-256:	1045D5B742A65BC42474C405482256ACFF09C2D48D5590CFDEE2E9B67C5F66EC
SHA-512:	5C87AC191E029DF333CA65C5103BB1FAD55DE0880A1B5273D1D4D955A9919B38D33376F9447058EDA859C0A035E30893078A7B83F9A909DF1DCDA2898D79AD7F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|.2..\|a..\|a..\|ax.!a..\|a..}a..\|a...a..\|a...a..\|a...a..\|a...a..\|a...a..\|a...a..\|aRich..\|a................PE..L...J`3H.....................4......"W....... ....@..........................`......~............ ..........................d...<....P..............."...$.......................................... <..@...............l............................text............................... ..`.data...(.... ......................@....rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZNW50FA\filehashfixup.exe.data

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1800
Entropy (8bit):	4.298329864251592
Encrypted:	false
SSDEEP:	48:E7xhDVHzg92zeq4iL/OYCI0SsEx5R63dbPwNygm46zb4:Eblg92aq4D/IVsEwtOm4ck
MD5:	7921F620DE922C9FC35EC98DA7D93601
SHA1:	2E2FAF78E0EDD163CC99CEA9A18E24B24AE96B4D
SHA-256:	332BB4C4A24C4525F9009DC3AA2CC6DDAB9D191110E40A574708C9BD029F484B
SHA-512:	D4519CCCF82AFD6EE7243E5A9A35FD320849E9328DB35701C90B93F11E11194F39F98E5565D2FBBD53A3F75E69F556486E92298D7935FD7600E2E3336983D7EF
Malicious:	false
Preview:	{005F0404-FAC6-472F-A910-A4F55FE19767}..{005F0410-0F6F-4EF2-8CD0-2CCD96343F4E}..{005F0412-7771-462B-9F29-1D3D5A587E61}..{00610407-7C6C-486A-BB1D-80CEAC7E076B}..{0E576911-0D5D-4D29-A900-EF8EE836B389}..{1862162E-3BBC-448F-AA63-49F33152D54A}..{1B041548-33BC-4174-8B97-ADC9B7948488}..{205F0407-9325-4DC4-BEAE-0F65C1A45F11}..{23BF4ECE-5C12-406B-AF67-F6BB7AD75861}..{24F8C49D-429E-4C13-9A01-4A60ECA8783C}..{2637607E-DC6E-46E7-88D6-BF42D2789FC9}..{2A945E2F-2695-46E6-9322-FB7673EB84B6}..{3AD87667-690E-48C5-B12C-30EF913D6672}..{40610C0A-B084-41E9-A591-0695B548FF2A}..{437AB8E0-FB69-4222-B280-A64F3DE22591}..{44FF800C-3A33-42D9-B0CC-09DA70C3C12C}..{45CF1FC5-44DF-4DE6-981C-BBB5E6465E5A}..{464B27B4-BE14-4195-A08F-46DB01C8B4DF}..{468D6A3C-0220-45E0-8193-EEE205010458}..{4E65220F-1554-4ABF-AA88-2A2B8AB75666}..{505F040C-97F6-4BAE-BBDB-A0CAF4FE72D0}..{517B0FB0-A249-43FA-AE2F-755200C3D684}..{57261387-0537-4097-A1F7-B1A46BA3A2E0}..{65C67A85-40C5-4529-BDD4-0AA10F7D9345}..{7C4F9223-A657-461B-A255-68A4E922579C}..

C:\Users\user\AppData\Local\Temp\ZNW50FA\manifest.ini

Download File

Process:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.376940715596332
Encrypted:	false
SSDEEP:	3:Y0RxGQukzB1U2d6s0UFnE/BH38iikHJAYpNMsF9LokwY5W4XI9jlGAkcEcV:Y0RxHPm66s0UFnE/HikHJfFahwW4Qjl5
MD5:	4C88A732E75875CF2E7546D5C40A599E
SHA1:	6CA8DD85094043B2291B5B8698C7AE108A91A2E1
SHA-256:	2ADF3236CF8895BE115C677F71EB6EB2819911BF30C0D6048E8E172A0175556C
SHA-512:	31CD8FA04A6E822C0A8A44650F784672E0F1F767F617BF530A2E6B3B23A7087519A566FA1DF3305B36B9940C3F9E377776B97B44195EAF9F9B96BC30BCD2DA9D
Malicious:	false
Preview:	[Patch Attributes]..PatchCode={AB1098F4-4E8B-4BC1-9979-6367DF53ED51}..ID=KB954961..Uninstallable=1..[Wrapper Config]..PatchTitle=VS80sp1-KB954961-X86-INTL..KBArticle=954961..

C:\Windows\Installer\5d6f30.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft Application Error Reporting, Author: Microsoft Corporation, Keywords: Installer, MSI, Database, Release, Comments: This Installer database contains the logic and data required to install Microsoft Application Error Reporting., Template: Intel;1033, Number of Pages: 200, Number of Words: 2, Security: 2, Revision Number: {420F351B-33A5-4A58-A856-69B2EDEDC8F7}, Create Time/Date: Fri Mar 9 08:56:39 2007, Last Saved Time/Date: Fri Mar 9 08:56:39 2007, Name of Creating Application: Windows Installer XML v2.0.3508.0 (candle/light)
Category:	dropped
Size (bytes):	1850368
Entropy (8bit):	7.864460324790716
Encrypted:	false
SSDEEP:	49152:sKwOEFA6sLPHF+NQZNW1nAm6HuhVWPwPxUxufR+MAAf97:Lc1O+NQZNYA4MwPxSWAAf9
MD5:	57677B56DBD1D07BE20109ED5C2CD577
SHA1:	2AE1A280383A5CE26724CCD628B12F922B0F44E8
SHA-256:	9783D94A823FF54255680E7BBF3DACA93FE087A7A0197F16773081D05AD655A8
SHA-512:	C8E9A6CFCE9575FE6B40CFBD9A7AF87477D86429EB6DCB45D4D23888E40C385162D87B152DFFBC7C50E632548B039046A7CD41999068D8C5CA90C020B6468B01
Malicious:	false
Preview:	......................>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................._.......................\......."...!...$...#...8...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...:...9...J...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...L...K...[...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...........2...^...`.......a...b...c...l...e...f...g...h...i...j...k...]...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\5d6f33.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Microsoft Application Error Reporting, Author: Microsoft Corporation, Keywords: Installer, MSI, Database, Release, Comments: This Installer database contains the logic and data required to install Microsoft Application Error Reporting., Template: Intel;1033, Number of Pages: 200, Number of Words: 2, Security: 2, Revision Number: {420F351B-33A5-4A58-A856-69B2EDEDC8F7}, Create Time/Date: Fri Mar 9 08:56:39 2007, Last Saved Time/Date: Fri Mar 9 08:56:39 2007, Name of Creating Application: Windows Installer XML v2.0.3508.0 (candle/light)
Category:	dropped
Size (bytes):	1850368
Entropy (8bit):	7.864460324790716
Encrypted:	false
SSDEEP:	49152:sKwOEFA6sLPHF+NQZNW1nAm6HuhVWPwPxUxufR+MAAf97:Lc1O+NQZNYA4MwPxSWAAf9
MD5:	57677B56DBD1D07BE20109ED5C2CD577
SHA1:	2AE1A280383A5CE26724CCD628B12F922B0F44E8
SHA-256:	9783D94A823FF54255680E7BBF3DACA93FE087A7A0197F16773081D05AD655A8
SHA-512:	C8E9A6CFCE9575FE6B40CFBD9A7AF87477D86429EB6DCB45D4D23888E40C385162D87B152DFFBC7C50E632548B039046A7CD41999068D8C5CA90C020B6468B01
Malicious:	false
Preview:	......................>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................._.......................\......."...!...$...#...8...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...:...9...J...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...L...K...[...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...........2...^...`.......a...b...c...l...e...f...g...h...i...j...k...]...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI70E6.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65896
Entropy (8bit):	6.534864671806427
Encrypted:	false
SSDEEP:	768:vC+n3KDxYy59XgEDPqNC8dN2f6UdFtKuuxK3WArMpY/vXgzcKy/jRae8L:vHn6l59XhDJfqu5WArMp4gz5y/FaeY
MD5:	170F3FB03508231141E76F25685E9E5E
SHA1:	66E575400553014343C3F355F6B45E9E923ACBA6
SHA-256:	3DAE2DD9669983C6B08D33039A66F9EE2643EF4C4BA1CD58D4A0BF9882EECD9E
SHA-512:	C0628402D2B0D12DD13314590836712B79BA2C4018EC6AF6E89B2B4E567CD020232AD768F6880062D260464E03CF84547CB97D6671824DDA40D7F354E1478EA2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U....p...p...p..6....p..6...sp.."R...p.......p...x...p...p..jp..6....p..6...:p..6....p..Rich.p..........PE..L...S..E...........!.........N.......6............@..........................0............@.............................s.......P.......................h%..........................................`)..@...............T............................text............................... ..`.data....;..........................@....reloc..v...........................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI7144.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	66408
Entropy (8bit):	6.5626847686816525
Encrypted:	false
SSDEEP:	1536:1DkQoKscZDQD992uN25dWFzWWcZgRy/Fae2:1DkQs+ofw5VWcZgRy/Ep
MD5:	879551F5F71451E1BCDA945EE66816A2
SHA1:	A929F900311453FEC5DB083EECC8E253633A904F
SHA-256:	4BF97754455B12BE853B36FA18C42A4085D4F325E03F973A3977BE979240C5CE
SHA-512:	7D23D773509D70E86A1C499C8F441E4AEF19BC1A651F8AB31821E7B1E3C5E0418C35E8C125FCC814ECCD0825A31A923EFD96DA2816411E1218F7B34CC2B6C7DD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..I............(.......(...m...<.............................(.......(...%...(.......Rich....................PE..L.....E...........!.........N.......9............@..........................0......d.....@.................................d...P.......................h%...........................................+..@...............l............................text...]........................... ..`.data....;..........................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI7174.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	66408
Entropy (8bit):	6.5626847686816525
Encrypted:	false
SSDEEP:	1536:1DkQoKscZDQD992uN25dWFzWWcZgRy/Fae2:1DkQs+ofw5VWcZgRy/Ep
MD5:	879551F5F71451E1BCDA945EE66816A2
SHA1:	A929F900311453FEC5DB083EECC8E253633A904F
SHA-256:	4BF97754455B12BE853B36FA18C42A4085D4F325E03F973A3977BE979240C5CE
SHA-512:	7D23D773509D70E86A1C499C8F441E4AEF19BC1A651F8AB31821E7B1E3C5E0418C35E8C125FCC814ECCD0825A31A923EFD96DA2816411E1218F7B34CC2B6C7DD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..I............(.......(...m...<.............................(.......(...%...(.......Rich....................PE..L.....E...........!.........N.......9............@..........................0......d.....@.................................d...P.......................h%...........................................+..@...............l............................text...]........................... ..`.data....;..........................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI7194.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	95584
Entropy (8bit):	6.601574277316505
Encrypted:	false
SSDEEP:	1536:PscYTEfRPsvIsp35YxKTUtmPesIkB7FBHSUa6AJ5PYF5cyBnGAsp1gLy/Fae0THd:sNIklFdwHYZXa1gLy/Elr
MD5:	EC15860C697ABAA9E72E54BFB70541C5
SHA1:	1FCED104C365B47F6908DE4F52AB241D80A9B3DE
SHA-256:	9F45A201B3D383D2418E5007CBDC4FB764AC0EC8E50FA5002AA40F633ECF1CB8
SHA-512:	B55010F77B34E8D2FDB7CD5FE2CE8D1869317D4F8F5D83D00DE43C36D54985D2937DBF6836B2F7D2EAC9F1C3A4E71136CBBBFC4FF8DB2A90A95484E2E705D7CF
Malicious:	false
Preview:	...@IXOS.@.....@...X.@.....@.....@.....@.....@.....@......&.{95120000-00B9-0409-0000-0000000FF1CE}%.Microsoft Application Error Reporting..dw20shared.msi.@.....@\|....@.....@........&.{420F351B-33A5-4A58-A856-69B2EDEDC8F7}.....@.....@.....@.....@.......@.....@.....@.......@....%.Microsoft Application Error Reporting......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........MsiPublishAssemblies..Publishing assembly information*.Application Context:[1], Assembly Name:[2]\|...WatsonShared(.{98CB24AD-52FB-DB5F-A01F-C8B3B9A1E18E}.2.@......t.Microsoft.VC80.CRT,version="8.0.50727.42",type="win32",processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b"\|...(.{63E949F6-03BC-5C40-A01F-C8B3B9A1E18E}.2.@........policy.8.0.Microsoft.VC80.CRT,version="8.0.50727.42",type="win32-policy",processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b"....ProcessComponents..Updating component registration.....@X....@.....@.]....&.{98CB24AD-52FB-DB5F-A

C:\Windows\Installer\MSI7195.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.741623752383387
Encrypted:	false
SSDEEP:	192:XOdG/6G4nnykxsdYZ+mrv2ySzLUHypLGgjuXFw5acHKBNtHjhuHWrkA9uBP1WWzT:P6GuZBrvkzAHyxxHKBdaA2dWWzm0ZH
MD5:	85221B3BCBA8DBE4B4A46581AA49F760
SHA1:	746645C92594BFC739F77812D67CFD85F4B92474
SHA-256:	F6E34A4550E499346F5AB1D245508F16BF765FF24C4988984B89E049CA55737F
SHA-512:	060E35C4DE14A03A2CDA313F968E372291866CC4ACD59977D7A48AC3745494ABC54DF83FFF63CF30BE4E10FF69A3B3C8B6C38F43EBD2A8D23D6C86FBEE7BA87D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: amd-demo-pingpong-v1.4.msi, Detection: malicious, Browse Filename: AMD-Demo-PingPong-v1.5 (2).msi, Detection: malicious, Browse Filename: zero.sfx.exe, Detection: malicious, Browse Filename: zero.sfx.exe, Detection: malicious, Browse Filename: cryptor.exe, Detection: malicious, Browse Filename: cryptor.exe, Detection: malicious, Browse Filename: cryptor.exe, Detection: malicious, Browse Filename: cryptor.exe, Detection: malicious, Browse Filename: cryptor.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........CnuS".&S".&S".&t.}&P".&S".&.".&t.{&X".&t.m&^".&t.z&R".&t.n&R".&t.x&R".&RichS".&........................PE..L...\..C...........!.....@... .......6.......P....@..........................p......I................................B.......=..x............................`......0...............................x...@............................................text....2.......@.................. ..`.data...h....P.......P..............@....reloc..<....`.......`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI7204.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	79200
Entropy (8bit):	6.584639403161452
Encrypted:	false
SSDEEP:	1536:b35YxKTUtmPesIkB7FBHSUa6AJ5PYF5cyBnGAsp1gLy/Fae:jIklFdwHYZXa1gLy/E
MD5:	58C97608EBD9CD718D2ACC1EA59ADBF3
SHA1:	62BE1256C0F2F693267584794C384C0EDE9CB1B5
SHA-256:	7995B25B1B505FA1FD426BDE4AF52F28B0734AEE317F7F9F4384E8BBD258721B
SHA-512:	FCED402BAA0F8522DBBA209D7C34BB35B01E470BC39170FB0AE7ACEA6D097FFD8BE75A8A2FE1BAA5F6C768F8BAD3CB962FDAE2B268437A2A3728B1AB99338FE6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3ejMw...w...w...P.y.g...P.i.....D&!.u.....Y.u.....Y.u...d.Y.r...w.......P.~.v...P.j.]...P.\|.v...Richw...................PE..L...S..E...........!.........P.......T............@..........................`......Y.....@.............................f...D...x.......................`%...@.......................................7..@............................................text...V........................... ..`.data....;..........................@....reloc..<....@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI738B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	79200
Entropy (8bit):	6.584639403161452
Encrypted:	false
SSDEEP:	1536:b35YxKTUtmPesIkB7FBHSUa6AJ5PYF5cyBnGAsp1gLy/Fae:jIklFdwHYZXa1gLy/E
MD5:	58C97608EBD9CD718D2ACC1EA59ADBF3
SHA1:	62BE1256C0F2F693267584794C384C0EDE9CB1B5
SHA-256:	7995B25B1B505FA1FD426BDE4AF52F28B0734AEE317F7F9F4384E8BBD258721B
SHA-512:	FCED402BAA0F8522DBBA209D7C34BB35B01E470BC39170FB0AE7ACEA6D097FFD8BE75A8A2FE1BAA5F6C768F8BAD3CB962FDAE2B268437A2A3728B1AB99338FE6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3ejMw...w...w...P.y.g...P.i.....D&!.u.....Y.u.....Y.u...d.Y.r...w.......P.~.v...P.j.]...P.\|.v...Richw...................PE..L...S..E...........!.........P.......T............@..........................`......Y.....@.............................f...D...x.......................`%...@.......................................7..@............................................text...V........................... ..`.data....;..........................@....reloc..<....@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{95120000-00B9-0409-0000-0000000FF1CE}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.164484408667641
Encrypted:	false
SSDEEP:	12:JSbX72FjGiliAGiLIlHVRpZh/7777777777777777777777777vDHFPjwtit/l0G:JiQI5tNxiF
MD5:	FE14EEE674146054E8BDDA17C39C2EF3
SHA1:	05BA549B0B1FF068496C0CA82A1D87D269323BC9
SHA-256:	0D6635B4EE092090EB6249F51BDEE6D71B64D590F5C69E90C97E02B696ECAA7C
SHA-512:	C206B2EEC3EB6FC5400AA57A9887D4D5706AEF3D7D709959D7923EADEE44A11521CA00384F37DA6F94B9A9503C807ACA1ECBD03EBDE668CACC2A0A66D3240D1C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5190858611079077
Encrypted:	false
SSDEEP:	48:M8Phj7uRc06WXJsFT5afPa960iSaG5Me7lSBmAREa:jhj71PFT03wBiZGtq0
MD5:	ED71336625207805875A50181A0EB02E
SHA1:	EB8D55FFB80C05603B0614ABC270AB46103B146F
SHA-256:	07CAF072E508ACBFB51CF678E0113A51101579D0D6690594CCF7ED4DEF6CE85A
SHA-512:	B23A1972FBDB70B226570DCD502C357412A9BB74FD33415C9F36E49CA5AE0018759D587527BC55D3725C6E74E5678E67FDDAA28416E2BF55A30CCB005C9C088F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	364484
Entropy (8bit):	5.36550285850806
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaua:zTtbmkExhMJCIpEl
MD5:	794BFF83437E9D766DDCDA7EAF5335B5
SHA1:	D1583E9E708F685F5EB0CD55DD3E2CD363200979
SHA-256:	4BF0F3F7EF52B035C30744B20B84054EA5908045F8FDA4139E075EB99769C370
SHA-512:	5EFE0BD27B2BDCCE8B269095093C1257DFBEEA2C4697A2AA0243015BC5A73BEF5654A271BF160211EF4685E9BE7BA3602334A7D1E643A88D0D53952BF04CBA0E
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF04986A27EF2EDB8C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.11967065223986066
Encrypted:	false
SSDEEP:	24:Ra/RaipV7mlipVAG5MeVQpGv3SY9F+dyaci:Ra/RaSBmlSaG5Me79F6yaci
MD5:	980B9245ADBD8118880A58FC9F86D132
SHA1:	8A24F9F4C3D26235E28AEE724AA99A343D49CACB
SHA-256:	94A90873F0774EDB17EA19791590884EE3ACE367B797EF6D9370D37BA8F49327
SHA-512:	1D43554EDBBE50ADAE7993CFBC83AF82CCACAE9015099D961B7AB147E55FB169F050B4D3392A1B2A047731CF1A5F2B5182A64F5C4A82B173B418965E266B1B09
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5BEF3F78EDE40078.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF66D803FE7697B449.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF716BFC04081639DB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7301E52B3BD21423.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2207620054816297
Encrypted:	false
SSDEEP:	48:9Kr7uJthHFXJhT5PfPa960iSaG5Me7lSBmAREa:cr7u5Th3wBiZGtq0
MD5:	7A7B091CF55BAAA092820C91C4FF8714
SHA1:	684A502F1EA929C20B7725165ABC4E0945D2BE47
SHA-256:	6DC7258D4BF4BCB4F6CF8D958B0B778FCEAB37833AC82F0279BB64232BAB79AC
SHA-512:	9E247573ABB78E59776ED071E8F554B2AD4EAF4D014EF33C6038AFA09ABC0C402CF8534800C416E723B4A56081DBB37CDCBBFD707B51AF8B50F53EF2E92A75E5
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9522B2AC5C30865D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2207620054816297
Encrypted:	false
SSDEEP:	48:9Kr7uJthHFXJhT5PfPa960iSaG5Me7lSBmAREa:cr7u5Th3wBiZGtq0
MD5:	7A7B091CF55BAAA092820C91C4FF8714
SHA1:	684A502F1EA929C20B7725165ABC4E0945D2BE47
SHA-256:	6DC7258D4BF4BCB4F6CF8D958B0B778FCEAB37833AC82F0279BB64232BAB79AC
SHA-512:	9E247573ABB78E59776ED071E8F554B2AD4EAF4D014EF33C6038AFA09ABC0C402CF8534800C416E723B4A56081DBB37CDCBBFD707B51AF8B50F53EF2E92A75E5
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE958ECDC27330956.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07120022337231893
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKO9VcqHQAgVky6lit/:2F0i8n0itFzDHFPjwait/
MD5:	7F29D15DB24DD3D58216D9A113E0DE10
SHA1:	7B1728587F856C59FCAC3A9D494DD0198049D974
SHA-256:	ECB6FBC1459CFA5A47852B7DDD3F59E5736C754B74C327765919079EDF9BC9A7
SHA-512:	484F872D3AE4132D06D6C3CD742207763CC2A8554269131050B75BDC122BECF79712C3B312A1A88D73CC00EBA6004B4130DFA3221F15F8CF14401091DE86877C
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFFC4750B55285911.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5190858611079077
Encrypted:	false
SSDEEP:	48:M8Phj7uRc06WXJsFT5afPa960iSaG5Me7lSBmAREa:jhj71PFT03wBiZGtq0
MD5:	ED71336625207805875A50181A0EB02E
SHA1:	EB8D55FFB80C05603B0614ABC270AB46103B146F
SHA-256:	07CAF072E508ACBFB51CF678E0113A51101579D0D6690594CCF7ED4DEF6CE85A
SHA-512:	B23A1972FBDB70B226570DCD502C357412A9BB74FD33415C9F36E49CA5AE0018759D587527BC55D3725C6E74E5678E67FDDAA28416E2BF55A30CCB005C9C088F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcm80.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	479232
Entropy (8bit):	6.027914999981497
Encrypted:	false
SSDEEP:	6144:M+jWTky1zFs1602urkPJPK60Wkot9+/b88u//b88Q/b88u0FJrNYiwvTAtYgzGjk:Moy1z6YtK6INYHAtY0b
MD5:	CDCC63E967D64ECE3729246720AF4FCC
SHA1:	856ABCCDACD3B0C78A57158505AE9B9EFE2110EC
SHA-256:	C75E2F91A7B2032D3757EEAC12502112381E0CB6F0E6E308ADC74AC30C8A7EC7
SHA-512:	49744BDF0C3FCA108DD2536BBF39DF0A11380FEF129802B45A8FDE59EAA62E277A985BBC642F2029312ECFAED3999D35AA341A66FB9383F5F83B51BBF0DF0961
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5.r.T.!.T.!.T.!Q[.!.T.!.T.!.T.!...!.T.!...!.T.!...!.T.!...!.T.!...!.T.!...!.T.!...!.T.!...!.T.!Rich.T.!................PE..L.....3C...........!.........@......PR............L\|.................................j..................................] ..T...d.....................................................................@..............................H............text...Kv.......................... ..`.rdata..]\.......`..................@..@.data...,........ ..................@....rsrc...............................@..@.reloc...#.......0... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcp80.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	548864
Entropy (8bit):	6.393702958885723
Encrypted:	false
SSDEEP:	12288:BuYZhMltDoD+OSt+ujajk5RnchUgiW6QR7t553Ooc8NHkC2euB:oOhMltDoqvpjajk59g3Ooc8NHkC2eW
MD5:	2BC650257FB0867ABD54FD460EC2BAFC
SHA1:	EC063526AA14BCADEEFFA6D859B39A80680015B7
SHA-256:	9FC2E85BA84CF0459AAB0DC2EFAC734AD7B5B4C99BA19871FE8F6E35D0191838
SHA-512:	903966F1739727D166131B42DF6A7CD77D4F734C01437F7D96F18E8CB2C60A8E49BD952452FDE8F0D3A92A002D2404EE78B97472821C190B300C594A5525C0A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................H...?.....Z=......?......?......?......?......?......?.....Rich...........PE..L....3C...........!.....@... ......z........P....B\|.........................p.......*..............................`.......,...<............................ ...2...S..............................@e..@............P...............................text....7.......@.................. ..`.rdata.......P.......P..............@..@.data...`&....... ..................@....rsrc...............................@..@.reloc...A... ...P..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\WinSxS\InstallTemp\20240418183627404.0\msvcr80.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	626688
Entropy (8bit):	6.831644690760087
Encrypted:	false
SSDEEP:	6144:c4b7/ooikc5yxKK/euYpsZ4Q64ma9tiGVKkfhkQ6slProtGMSq4AOZ1ORCAOutSC:c4Rc5VE31XqaJusxGhr46CYtQ9mGyc
MD5:	16D7DDF3B659F7CF1CB9F4DCFF4219F0
SHA1:	A61454131940799F01C26943F1594EE6E7409D11
SHA-256:	120CD25F5D6002FFD9069CF9550BC16C682BCD3323053B95146E7CD3BA2215AC
SHA-512:	979907E2B13557C99CF90B76BCD57DAF0A1A699EA5D00C23E5D5AEBFAA36DB3443C99D9BA5D524BA2156ED3A8904AFE8DB1D076FFFB9A8CC3235C33484D470F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L.........@................!......;.............d.......................Rich...................PE..L...U.3C...........!.....0...p.......#.......@.....x.................................................................q..O}..Pc..<....`.......................p..L3...B...............................F..@............@...............................text...j".......0.................. ..`.rdata.......@.......@..............@..@.data...Li.......P..................@....rsrc........`.......@..............@..@.reloc...7...p...@...P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\WinSxS\InstallTemp\20240418183627404.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7423
Entropy (8bit):	7.311154707110282
Encrypted:	false
SSDEEP:	96:tl0SFdzQMLy+Cgzdew5mog+MSNWDPDaxDPDaFOgkHDPDab3v7DPDapDhD743xoO9:T0mTL/CldolMGo3OuqoM3h5j0kWvtuAp
MD5:	FABF51CADF6DDC1695CDC1D069F5A324
SHA1:	75A6F0F26D0C80EECAC1249C9EDD582CA6241D83
SHA-256:	935DF4549E21123A2EFB986A707F54475380A037519679510E4B4DFC4BDB5767
SHA-512:	34772AF0C64C5A3AF2D2CA871A6E3F2B99A322A937ED1B712D6CBEC763BD0D1F8593D754C4D97DC373FE2C3267FEFBB7CEA60F56ED301AB8A365D219DE0B7401
Malicious:	false
Preview:	0......H..........0......1.0...+......0..u..+.....7.....f0..b0...+.....7.....+~Kc...D........050923140120Z0...+.....7.....0...0....RA.A.D.0.5.8.A.9.0.7.4.7.9.0.4.0.C.9.1.E.E.3.5.6.9.D.C.3.E.B.9.8.1.5.B.0.2.1.7.9...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........X..G.@...V.....!y0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....M.i.c.r.o.s.o.f.t...V.C.8.0...C.R.T...m.a.n...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........X..G.@...V.....!y0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0...0..-.......G....RFC..mH.1.0....H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H........

C:\Windows\WinSxS\InstallTemp\20240418183627404.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.manifest

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504), with CRLF line terminators
Category:	dropped
Size (bytes):	1868
Entropy (8bit):	5.384476274011321
Encrypted:	false
SSDEEP:	48:3SlK+hMg4l09kkKdGzWkR809kkKUwzvRd09kkKZzY:ClthAlXk6GCkOXkuVdXkk8
MD5:	953B7388B958713EE9F48D3C5FD733FA
SHA1:	AAD058A907479040C91EE3569DC3EB9815B02179
SHA-256:	B19C81F6BBBD4A0F0A1C50283D83BD4CBE6BEB596FB0A0B9181510F0B31FA787
SHA-512:	DEC0E216382940AFF9B4B4318C82173D7D0B252961FC1ED10C3EB62AFB662985BF6E4469518EF7ECDE64A1467B8796C6EF82F3F7AAA3BBD2F485437DDE7F2BB7
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50727.42" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr80.dll" hash="2a0d797a8c5eac76e54e98db9682e0938c614b45" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>phRUExlAeZ8BwmlD8VlO5udAnRE=</dsig:DigestValue></asmv2:hash></file>.. <file name="msvcp80.dll" hash="cc4ca55fb6aa6b7bb8577ab4b649ab77e42f8f91" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmln

C:\Windows\WinSxS\InstallTemp\20240418183627498.0\8.0.50727.42.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7441
Entropy (8bit):	7.3080317573532065
Encrypted:	false
SSDEEP:	192:ESZ/7TL/CldolMGo3OuqoM3h5j00CWqdT:E4LCcMe/os0T
MD5:	72B2B74CF17E5531EFD282A5CBC215AF
SHA1:	7E93B6F5715FEE7B54C52C2BFAD414906B945CD2
SHA-256:	BD83DCE340498E7C363093C2FC74DFB58E1EC17770453905172C7471FADD9333
SHA-512:	EC9B3F4E7E6E1D456CCD2A2690F66643961E19BFF4BD73B21C30308A15BC79AD250141E13DA69168CEC1FB79DE317692298BB00683893E834E546656AECB5410
Malicious:	false
Preview:	0......H..........0......1.0...+......0..o..+.....7.....`0..\0...+.....7......,62:(.H.Il...+...050923064809Z0...+.....7.....0...0....R1.3.9.1.E.8.6.F.E.5.8.F.4.7.5.0.8.B.E.6.8.8.2.2.A.0.8.6.4.3.7.3.B.D.A.E.8.5.F.B...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........o.GP.."..Cs....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0...(8...0...5.0.7.2.7...4.2...p.o.l.i.c.y...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........o.GP.."..Cs....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0...0..-.......G....RFC..mH.1.0....H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H.............0

C:\Windows\WinSxS\InstallTemp\20240418183627498.0\8.0.50727.42.policy

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	712
Entropy (8bit):	5.166775833959757
Encrypted:	false
SSDEEP:	12:TMHdt7IBeBFJn53SN+nhPIvgVuNny3Nhu53SNK+hcgVuNnyv23+L6fgiNR:2dtMEDJ5iN+nhQvg4NnjiNK+hcg4NnMc
MD5:	374B0D45B489E08CBB2EB0A67FE1CCA7
SHA1:	1391E86FE58F47508BE68822A0864373BDAE85FB
SHA-256:	BE71C90AF2022043CB1AA66A364A416CB7E0106EC20D29260A0A6E45A650E850
SHA-512:	DA88558994B0A5238CF5C611F7B211F7EE894AA0E1F9485BAE939FA886EE4AF42B8EB5B8481D6DBAA21CD0B8F5FEDEC2DFBFD7F7B43C5F4D5216AC0022F387FF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright . 1981-2001 Microsoft Corporation -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.... <assemblyIdentity type="win32-policy" name="policy.8.0.Microsoft.VC80.CRT" version="8.0.50727.42" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <bindingRedirect oldVersion="8.0.41204.256-8.0.50608.0" newVersion="8.0.50727.42"/>.. .. </dependentAssembly>.. </dependency>....</assembly>..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.988289793655857
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	VS80sp1-KB954961-X86-INTL.exe
File size:	12'779'920 bytes
MD5:	de6843e7937dfe0704b9eadfe589e691
SHA1:	c07566c6abc50cd9350d33209520bda798dda3e8
SHA256:	b4ad9fb4f0fc28c41b1a32ba309c8f8cf8b0c1eacb40107d7687288a040eb317
SHA512:	52faaeda1ffcca964c1f28f606f34b58749017d3a9a3c3c05a73b3818aa89b79c7d7e71b250f13d45f58f295ef50396f30ee2d5e40e4c1d554592a7debdbc760
SSDEEP:	393216:7Ey49hfvGKCp7X5v0d6Ffw39qcltJsM8n:54HWJpv0A1w3blLy
TLSH:	7AD6330267FB8234F1F35B355975026A8A7BBD419C78DA0E232D248D4FB7A90DA74723
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......MO...............! ......!".......~.........................3...........................Rich............................PE..L..

File Icon


Icon Hash:	ad2e3795272b0b99

Static PE Info

General

Entrypoint:	0x413364
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x48FE50BB [Tue Oct 21 21:59:23 2008 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	7f55a5807fc04f3bdb96697986509b73

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	15/12/2020 22:31:45 02/12/2021 22:31:45
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	658DCC2A890351DF97DC9F05146283C0
Thumbprint SHA-1:	ABDCA79AF9DD48A0EA702AD45260B3C03093FB4B
Thumbprint SHA-256:	E39CC80A0DF6F2BED821D11B49717306138C1D19FD20190336BF1C4297638A79
Serial:	33000001DF6BF02E92A74AB4D00000000001DF

Entrypoint Preview

Instruction
call 00007F2110D72E82h
jmp 00007F2110D7101Bh
jmp 00007F2110D71214h
cmp ecx, dword ptr [0042B19Ch]
jne 00007F2110D71204h
rep ret
jmp 00007F2110D72EFDh
push 0000000Ch
push 00428ED8h
call 00007F2110D72C5Fh
mov esi, dword ptr [ebp+08h]
test esi, esi
je 00007F2110D71277h
cmp dword ptr [0042F6C8h], 03h
jne 00007F2110D71245h
push 00000004h
call 00007F2110D731D3h
pop ecx
and dword ptr [ebp-04h], 00000000h
push esi
call 00007F2110D73241h
pop ecx
mov dword ptr [ebp-1Ch], eax
test eax, eax
je 00007F2110D7120Bh
push esi
push eax
call 00007F2110D7325Dh
pop ecx
pop ecx
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007F2110D71210h
cmp dword ptr [ebp-1Ch], 00000000h
jne 00007F2110D71239h
push dword ptr [ebp+08h]
jmp 00007F2110D7120Ch
push 00000004h
call 00007F2110D730C1h
pop ecx
ret
push esi
push 00000000h
push dword ptr [0042CC6Ch]
call dword ptr [00401050h]
test eax, eax
jne 00007F2110D71218h
call 00007F2110D72FC5h
mov esi, eax
call dword ptr [00401034h]
push eax
call 00007F2110D72F7Ch
mov dword ptr [esi], eax
pop ecx
call 00007F2110D72C23h
ret
push 0000000Ch
push 00428EF8h
call 00007F2110D72BD1h
mov ecx, dword ptr [ebp+08h]
xor edi, edi
cmp ecx, edi
jbe 00007F2110D71230h
push FFFFFFE0h
pop eax
xor edx, edx
div ecx

Rich Headers

Programming Language:

[ASM] VS2005 build 50727
[ C ] VS2005 build 50727
[C++] VS2005 build 50727
[RES] VS2005 build 50727
[LNK] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29f04	0xb4	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x30000	0xc02030	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xc2de00	0x2390	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1350	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4b68	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x2cc	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29e0a	0x2a000	503cca636ea10c777351bb67a07d7ee7	False	0.5704926990327381	data	6.631145569533157	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x2b000	0x47f8	0x1800	531bb325eb45441d4a3d3cfd7f47401c	False	0.31982421875	Matlab v4 mat-file (little endian) type_info@@, sparse, rows 4206816, columns 4199280	3.356880315005309	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x30000	0xc02030	0xc02200	f7b692f228766c6b82befa9a1a2bd670	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
BINARY	0x3122c	0xbced99	Microsoft Cabinet archive data, many, 12381593 bytes, 5 files, at 0x2c +A "manifest.ini" +A "filehashfixup.exe", number 1, 631 datablocks, 0x1 compression	English	United States	0.9997081756591797
RT_ICON	0xbfffc8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colors	English	United States	0.43548387096774194
RT_DIALOG	0xc002b0	0x8c	data	Arabic	Saudi Arabia	0.7642857142857142
RT_DIALOG	0xc0033c	0x84	data	Chinese	Taiwan	0.7348484848484849
RT_DIALOG	0xc003c0	0x84	data	Czech	Czech Republic	0.7272727272727273
RT_DIALOG	0xc00444	0x84	data	Danish	Denmark	0.7272727272727273
RT_DIALOG	0xc004c8	0x84	data	German	Germany	0.7272727272727273
RT_DIALOG	0xc0054c	0x84	data	Greek	Greece	0.7272727272727273
RT_DIALOG	0xc005d0	0x84	data	English	United States	0.7272727272727273
RT_DIALOG	0xc00654	0x84	data	Finnish	Finland	0.7272727272727273
RT_DIALOG	0xc006d8	0x84	data	French	France	0.7272727272727273
RT_DIALOG	0xc0075c	0x8c	data	Hebrew	Israel	0.7642857142857142
RT_DIALOG	0xc007e8	0x84	data	Hungarian	Hungary	0.7272727272727273
RT_DIALOG	0xc0086c	0x84	data	Italian	Italy	0.7272727272727273
RT_DIALOG	0xc008f0	0x7c	data	Japanese	Japan	0.7661290322580645
RT_DIALOG	0xc0096c	0x84	data	Korean	North Korea	0.7348484848484849
RT_DIALOG	0xc0096c	0x84	data	Korean	South Korea	0.7348484848484849
RT_DIALOG	0xc009f0	0x84	data	Dutch	Netherlands	0.7272727272727273
RT_DIALOG	0xc00a74	0x84	data	Norwegian	Norway	0.7272727272727273
RT_DIALOG	0xc00af8	0x84	data	Polish	Poland	0.7272727272727273
RT_DIALOG	0xc00b7c	0x84	data	Portuguese	Brazil	0.7272727272727273
RT_DIALOG	0xc00c00	0x84	data	Russian	Russia	0.7348484848484849
RT_DIALOG	0xc00c84	0x84	data	Swedish	Sweden	0.7272727272727273
RT_DIALOG	0xc00d08	0x8c	data	Turkish	Turkey	0.7071428571428572
RT_DIALOG	0xc00d94	0x84	data	Chinese	China	0.7348484848484849
RT_DIALOG	0xc00e18	0x84	data	Portuguese	Portugal	0.7272727272727273
RT_DIALOG	0xc00e9c	0x90	data			0.7291666666666666
RT_DIALOG	0xc00f2c	0x274	data	Arabic	Saudi Arabia	0.44745222929936307
RT_DIALOG	0xc011a0	0x16c	data	Chinese	Taiwan	0.6236263736263736
RT_DIALOG	0xc0130c	0x254	data	Czech	Czech Republic	0.4714765100671141
RT_DIALOG	0xc01560	0x298	data	Danish	Denmark	0.45331325301204817
RT_DIALOG	0xc017f8	0x2c0	data	German	Germany	0.4446022727272727
RT_DIALOG	0xc01ab8	0x310	data	Greek	Greece	0.45663265306122447
RT_DIALOG	0xc01dc8	0x25c	data	English	United States	0.4602649006622517
RT_DIALOG	0xc02024	0x2dc	data	Finnish	Finland	0.38114754098360654
RT_DIALOG	0xc02300	0x304	data	French	France	0.41321243523316065
RT_DIALOG	0xc02604	0x254	data	Hebrew	Israel	0.5
RT_DIALOG	0xc02858	0x2a8	data	Hungarian	Hungary	0.48823529411764705
RT_DIALOG	0xc02b00	0x2bc	data	Italian	Italy	0.4614285714285714
RT_DIALOG	0xc02dbc	0x1a8	data	Japanese	Japan	0.6061320754716981
RT_DIALOG	0xc02f64	0x1d0	data	Korean	North Korea	0.6099137931034483
RT_DIALOG	0xc02f64	0x1d0	data	Korean	South Korea	0.6099137931034483
RT_DIALOG	0xc03134	0x2cc	data	Dutch	Netherlands	0.41899441340782123
RT_DIALOG	0xc03400	0x298	data	Norwegian	Norway	0.4397590361445783
RT_DIALOG	0xc03698	0x338	data	Polish	Poland	0.404126213592233
RT_DIALOG	0xc039d0	0x2c0	data	Portuguese	Brazil	0.43607954545454547
RT_DIALOG	0xc03c90	0x28c	data	Russian	Russia	0.455521472392638
RT_DIALOG	0xc03f1c	0x274	data	Swedish	Sweden	0.45063694267515925
RT_DIALOG	0xc04190	0x2b8	data	Turkish	Turkey	0.4324712643678161
RT_DIALOG	0xc04448	0x164	data	Chinese	China	0.6292134831460674
RT_DIALOG	0xc045ac	0x2b0	data	Portuguese	Portugal	0.45058139534883723
RT_DIALOG	0xc0485c	0x29c	data			0.4416167664670659
RT_DIALOG	0xc04af8	0x2a0	data	Arabic	Saudi Arabia	0.49851190476190477
RT_DIALOG	0xc04d98	0x1d8	data	Chinese	Taiwan	0.6038135593220338
RT_DIALOG	0xc04f70	0x2c0	data	Czech	Czech Republic	0.5227272727272727
RT_DIALOG	0xc05230	0x2f8	data	Danish	Denmark	0.48947368421052634
RT_DIALOG	0xc05528	0x300	data	German	Germany	0.47265625
RT_DIALOG	0xc05828	0x338	data	Greek	Greece	0.4987864077669903
RT_DIALOG	0xc05b60	0x2e4	data	English	United States	0.4810810810810811
RT_DIALOG	0xc05e44	0x28c	data	Finnish	Finland	0.5015337423312883
RT_DIALOG	0xc060d0	0x308	data	French	France	0.48195876288659795
RT_DIALOG	0xc063d8	0x274	data	Hebrew	Israel	0.5143312101910829
RT_DIALOG	0xc0664c	0x2f4	data	Hungarian	Hungary	0.49867724867724866
RT_DIALOG	0xc06940	0x308	data	Italian	Italy	0.47680412371134023
RT_DIALOG	0xc06c48	0x224	data	Japanese	Japan	0.583941605839416
RT_DIALOG	0xc06e6c	0x244	data	Korean	North Korea	0.6241379310344828
RT_DIALOG	0xc06e6c	0x244	data	Korean	South Korea	0.6241379310344828
RT_DIALOG	0xc070b0	0x2f8	data	Dutch	Netherlands	0.48157894736842105
RT_DIALOG	0xc073a8	0x2b0	data	Norwegian	Norway	0.48546511627906974
RT_DIALOG	0xc07658	0x308	data	Polish	Poland	0.5051546391752577
RT_DIALOG	0xc07960	0x310	data	Portuguese	Brazil	0.47831632653061223
RT_DIALOG	0xc07c70	0x324	data	Russian	Russia	0.4975124378109453
RT_DIALOG	0xc07f94	0x2d0	data	Swedish	Sweden	0.5027777777777778
RT_DIALOG	0xc08264	0x30c	data	Turkish	Turkey	0.4935897435897436
RT_DIALOG	0xc08570	0x1e0	data	Chinese	China	0.6083333333333333
RT_DIALOG	0xc08750	0x310	data	Portuguese	Portugal	0.46938775510204084
RT_DIALOG	0xc08a60	0x320	data			0.4675
RT_DIALOG	0xc08d80	0x1ec	data	Arabic	Saudi Arabia	0.5894308943089431
RT_DIALOG	0xc08f6c	0x134	data	Chinese	Taiwan	0.7435064935064936
RT_DIALOG	0xc090a0	0x204	data	Czech	Czech Republic	0.5833333333333334
RT_DIALOG	0xc092a4	0x200	data	Danish	Denmark	0.525390625
RT_DIALOG	0xc094a4	0x278	data	German	Germany	0.5268987341772152
RT_DIALOG	0xc0971c	0x240	data	Greek	Greece	0.5885416666666666
RT_DIALOG	0xc0995c	0x1f8	data	English	United States	0.5496031746031746
RT_DIALOG	0xc09b54	0x1f4	data	Finnish	Finland	0.554
RT_DIALOG	0xc09d48	0x244	data	French	France	0.5275862068965518
RT_DIALOG	0xc09f8c	0x1b4	data	Hebrew	Israel	0.6146788990825688
RT_DIALOG	0xc0a140	0x1c8	data	Hungarian	Hungary	0.5921052631578947
RT_DIALOG	0xc0a308	0x210	data	Italian	Italy	0.5492424242424242
RT_DIALOG	0xc0a518	0x16c	data	Japanese	Japan	0.7554945054945055
RT_DIALOG	0xc0a684	0x164	data	Korean	North Korea	0.7865168539325843
RT_DIALOG	0xc0a684	0x164	data	Korean	South Korea	0.7865168539325843
RT_DIALOG	0xc0a7e8	0x21c	data	Dutch	Netherlands	0.5351851851851852
RT_DIALOG	0xc0aa04	0x1e0	data	Norwegian	Norway	0.5604166666666667
RT_DIALOG	0xc0abe4	0x1fc	data	Polish	Poland	0.5787401574803149
RT_DIALOG	0xc0ade0	0x20c	data	Portuguese	Brazil	0.5477099236641222
RT_DIALOG	0xc0afec	0x218	data	Russian	Russia	0.5652985074626866
RT_DIALOG	0xc0b204	0x1e8	data	Swedish	Sweden	0.555327868852459
RT_DIALOG	0xc0b3ec	0x218	data	Turkish	Turkey	0.5578358208955224
RT_DIALOG	0xc0b604	0x134	data	Chinese	China	0.762987012987013
RT_DIALOG	0xc0b738	0x224	data	Portuguese	Portugal	0.5346715328467153
RT_DIALOG	0xc0b95c	0x228	data			0.5362318840579711
RT_STRING	0xc0bb84	0x1430	Matlab v4 mat-file (little endian) *\006H\006A\0061\006 , numeric, rows 0, columns 0	Arabic	Saudi Arabia	0.30089009287925694
RT_STRING	0xc0cfb4	0xcb6	Matlab v4 mat-file (little endian) \206N\376s\011g\204v , numeric, rows 0, columns 0	Chinese	Taiwan	0.43853718500307315
RT_STRING	0xc0dc6c	0x176e	Matlab v4 mat-file (little endian) r, numeric, rows 0, columns 0	Czech	Czech Republic	0.2917639213071024
RT_STRING	0xc0f3dc	0x174c	Matlab v4 mat-file (little endian) e, numeric, rows 0, columns 0	Danish	Denmark	0.2701207243460765
RT_STRING	0xc10b28	0x18b2	Matlab v4 mat-file (little endian) u, numeric, rows 0, columns 0	German	Germany	0.2674786459981019
RT_STRING	0xc123dc	0x1b5e	Matlab v4 mat-file (little endian) \272\003\304\003\314\003\302\003 , numeric, rows 0, columns 0	Greek	Greece	0.28860976306023406
RT_STRING	0xc13f3c	0x1638	Matlab v4 mat-file (little endian) h, numeric, rows 0, columns 0	English	United States	0.2619549929676512
RT_STRING	0xc15574	0x1628	Matlab v4 mat-file (little endian) i, numeric, rows 0, columns 0	Finnish	Finland	0.2794428772919605
RT_STRING	0xc16b9c	0x1974	Matlab v4 mat-file (little endian) e, numeric, rows 0, columns 0	French	France	0.2572130141190915
RT_STRING	0xc18510	0x137c	Matlab v4 mat-file (little endian) \320\005\344\005\351\005\350\005\325\005\331\005\325\005\352\005 , numeric, rows 0, columns 0	Hebrew	Israel	0.3103448275862069
RT_STRING	0xc1988c	0x1928	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0	Hungarian	Hungary	0.2796583850931677
RT_STRING	0xc1b1b4	0x19ac	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	Italian	Italy	0.25380401704199634
RT_STRING	0xc1cb60	0xfec	Matlab v4 mat-file (little endian) X[n0 , numeric, rows 0, columns 0	Japanese	Japan	0.37389597644749756
RT_STRING	0xc1db4c	0xf84	Matlab v4 mat-file (little endian) \230\267 , numeric, rows 0, columns 0	Korean	North Korea	0.39224572004028196
RT_STRING	0xc1db4c	0xf84	Matlab v4 mat-file (little endian) \230\267 , numeric, rows 0, columns 0	Korean	South Korea	0.39224572004028196
RT_STRING	0xc1ead0	0x1944	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	Dutch	Netherlands	0.25865800865800864
RT_STRING	0xc20414	0x16b4	Matlab v4 mat-file (little endian) \370, numeric, rows 0, columns 0	Norwegian	Norway	0.2703028217481074
RT_STRING	0xc21ac8	0x19dc	Matlab v4 mat-file (little endian) p, numeric, rows 0, columns 0	Polish	Poland	0.277190332326284
RT_STRING	0xc234a4	0x180c	Matlab v4 mat-file (little endian) s, numeric, rows 0, columns 0	Portuguese	Brazil	0.27225471085120206
RT_STRING	0xc24cb0	0x18e2	Matlab v4 mat-file (little endian) ;\0045\0044\004C\004N\004I\0048\0045\004 , numeric, rows 0, columns 0	Russian	Russia	0.2902668759811617
RT_STRING	0xc26594	0x1648	Matlab v4 mat-file (little endian) \366, numeric, rows 0, columns 0	Swedish	Sweden	0.2699859747545582
RT_STRING	0xc27bdc	0x17ce	Matlab v4 mat-file (little endian) e, numeric, rows 0, columns 0	Turkish	Turkey	0.28897276009189365
RT_STRING	0xc293ac	0xc50	Matlab v4 mat-file (little endian) \260s\011g\204v , numeric, rows 0, columns 0	Chinese	China	0.440989847715736
RT_STRING	0xc29ffc	0x18ca	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	Portuguese	Portugal	0.2677277024897573
RT_STRING	0xc2b8c8	0x199c	Matlab v4 mat-file (little endian) e, numeric, rows 0, columns 0			0.2614399023794997
RT_STRING	0xc2d264	0x116	Targa image data - Color 1571 x 58 x 32 +1582 +1591 "*\006E\006 "	Arabic	Saudi Arabia	0.5755395683453237
RT_STRING	0xc2d37c	0xc0	data	Chinese	Taiwan	0.7916666666666666
RT_STRING	0xc2d43c	0x144	data	Czech	Czech Republic	0.5771604938271605
RT_STRING	0xc2d580	0x140	data	Danish	Denmark	0.55625
RT_STRING	0xc2d6c0	0x162	data	German	Germany	0.5282485875706214
RT_STRING	0xc2d824	0x19c	data	Greek	Greece	0.5631067961165048
RT_STRING	0xc2d9c0	0x13c	data	English	United States	0.5284810126582279
RT_STRING	0xc2dafc	0x148	data	Finnish	Finland	0.5274390243902439
RT_STRING	0xc2dc44	0x16c	data	French	France	0.510989010989011
RT_STRING	0xc2ddb0	0x10c	data	Hebrew	Israel	0.5895522388059702
RT_STRING	0xc2debc	0x16c	data	Hungarian	Hungary	0.5494505494505495
RT_STRING	0xc2e028	0x186	data	Italian	Italy	0.4564102564102564
RT_STRING	0xc2e1b0	0xe4	Targa image data - Color 12540 x 58 x 32 +12456 +12521 "\2420\2570\2730\2710)jP\226n0\322b&T\010"	Japanese	Japan	0.75
RT_STRING	0xc2e294	0x10a	data	Korean	North Korea	0.8007518796992481
RT_STRING	0xc2e294	0x10a	data	Korean	South Korea	0.8007518796992481
RT_STRING	0xc2e3a0	0x150	Targa image data - Color 117 x 116 x 32 +70 +111 ":"	Dutch	Netherlands	0.5238095238095238
RT_STRING	0xc2e4f0	0x11e	data	Norwegian	Norway	0.5524475524475524
RT_STRING	0xc2e610	0x13e	data	Polish	Poland	0.550314465408805
RT_STRING	0xc2e750	0x158	Targa image data - Color 114 x 111 x 32 +69 +114 ":"	Portuguese	Brazil	0.4941860465116279
RT_STRING	0xc2e8a8	0x16c	data	Russian	Russia	0.5604395604395604
RT_STRING	0xc2ea14	0x11e	Targa image data - Color 108 x 58 x 32 +70 +101 "\305"	Swedish	Sweden	0.583916083916084
RT_STRING	0xc2eb34	0x148	Targa image data - Color 116 x 97 x 32 +72 +97 ":"	Turkish	Turkey	0.551829268292683
RT_STRING	0xc2ec7c	0xb0	data	Chinese	China	0.7897727272727273
RT_STRING	0xc2ed2c	0x156	data	Portuguese	Portugal	0.5146198830409356
RT_STRING	0xc2ee84	0x160	data			0.4914772727272727
RT_STRING	0xc2efe4	0x152	data	Arabic	Saudi Arabia	0.5118343195266272
RT_STRING	0xc2f138	0x8e	data	Chinese	Taiwan	0.7676056338028169
RT_STRING	0xc2f1c8	0x156	data	Czech	Czech Republic	0.5146198830409356
RT_STRING	0xc2f320	0x1c8	data	Danish	Denmark	0.4342105263157895
RT_STRING	0xc2f4e8	0x1a0	data	German	Germany	0.45913461538461536
RT_STRING	0xc2f688	0x222	data	Greek	Greece	0.4652014652014652
RT_STRING	0xc2f8ac	0x17c	data	English	United States	0.48157894736842105
RT_STRING	0xc2fa28	0x192	data	Finnish	Finland	0.47512437810945274
RT_STRING	0xc2fbbc	0x1c0	data	French	France	0.44642857142857145
RT_STRING	0xc2fd7c	0x11c	data	Hebrew	Israel	0.5528169014084507
RT_STRING	0xc2fe98	0x158	data	Hungarian	Hungary	0.5319767441860465
RT_STRING	0xc2fff0	0x16a	data	Italian	Italy	0.47790055248618785
RT_STRING	0xc3015c	0xec	data	Japanese	Japan	0.6567796610169492
RT_STRING	0xc30248	0xb6	data	Korean	North Korea	0.8076923076923077
RT_STRING	0xc30248	0xb6	data	Korean	South Korea	0.8076923076923077
RT_STRING	0xc30300	0x19c	data	Dutch	Netherlands	0.4975728155339806
RT_STRING	0xc3049c	0x1b6	data	Norwegian	Norway	0.4292237442922374
RT_STRING	0xc30654	0x194	data	Polish	Poland	0.4975247524752475
RT_STRING	0xc307e8	0x166	data	Portuguese	Brazil	0.4720670391061452
RT_STRING	0xc30950	0x158	data	Russian	Russia	0.49127906976744184
RT_STRING	0xc30aa8	0x1ae	data	Swedish	Sweden	0.4604651162790698
RT_STRING	0xc30c58	0x176	data	Turkish	Turkey	0.5106951871657754
RT_STRING	0xc30dd0	0x88	data	Chinese	China	0.7867647058823529
RT_STRING	0xc30e58	0x18c	data	Portuguese	Portugal	0.4722222222222222
RT_STRING	0xc30fe4	0x192	data			0.4527363184079602
RT_GROUP_ICON	0xc31178	0x14	data	English	United States	1.2
RT_VERSION	0xc3118c	0xb18	data	English	United States	0.3503521126760563
RT_MANIFEST	0xc31ca4	0x38b	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.47739801543550164

Imports

DLL	Import
KERNEL32.dll	InterlockedExchange, GetLastError, EnterCriticalSection, CreateMutexA, DeleteCriticalSection, ReleaseMutex, LocalFree, GetCommandLineA, HeapFree, GetVersionExA, HeapAlloc, GetProcessHeap, GetStartupInfoA, VirtualAlloc, GetProcAddress, GetModuleHandleA, GetSystemInfo, HeapReAlloc, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, HeapDestroy, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, IsDebuggerPresent, Sleep, HeapSize, LoadLibraryA, GetCPInfo, GetACP, GetOEMCP, RtlUnwind, GetLocaleInfoA, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, ReadFile, GetConsoleCP, GetThreadLocale, LocalFileTimeToFileTime, SetFileAttributesA, SetFileTime, DosDateTimeToFileTime, CreateThread, ResumeThread, SuspendThread, SetFilePointer, GetUserDefaultLangID, FindNextFileA, GetPrivateProfileStringA, FindClose, RemoveDirectoryA, FindFirstFileA, CreateDirectoryA, GetPrivateProfileIntA, DeleteFileA, GetTempPathA, CloseHandle, DuplicateHandle, GetCurrentDirectoryA, LockResource, CreateFileMappingA, GetTempFileNameA, RaiseException, SetEndOfFile, WriteConsoleW, GetConsoleOutputCP, FlushFileBuffers, GetSystemDirectoryA, CreateProcessA, WriteConsoleA, SetStdHandle, GetConsoleMode, MultiByteToWideChar, LeaveCriticalSection, WideCharToMultiByte, InitializeCriticalSection, FormatMessageA, FreeLibrary, CreateFileA, FindResourceA, MapViewOfFile, UnmapViewOfFile, LoadResource, WaitForSingleObject, SetEvent, FindResourceExA, SizeofResource, CreateEventA, GetFileAttributesA, GetExitCodeProcess
USER32.dll	ExitWindowsEx, CharNextA, LoadStringA, DispatchMessageA, ShowWindow, GetWindowLongA, SetWindowLongA, TranslateMessage, IsDialogMessageA, PostQuitMessage, CreateDialogParamA, GetMessageA, UnregisterClassA, DestroyWindow, PostMessageA, IsWindow, SetForegroundWindow, LoadIconA, SendMessageA, MessageBoxA, GetDlgItem, SetWindowTextA
msi.dll
ole32.dll	CoTaskMemFree, StgCreateDocfile, StgOpenStorage, CoInitialize, CoUninitialize
SHELL32.dll	SHGetPathFromIDListA, SHBrowseForFolderA
VERSION.dll	GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA
COMCTL32.dll	InitCommonControlsEx
ADVAPI32.dll	LookupPrivilegeValueA, OpenProcessToken, InitiateSystemShutdownA, RegCloseKey, RegOpenKeyExA, RegCreateKeyExA, RegQueryValueExA, RegSetValueExA, AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Arabic	Saudi Arabia
Chinese	Taiwan
Czech	Czech Republic
Danish	Denmark
German	Germany
Greek	Greece
Finnish	Finland
French	France
Hebrew	Israel
Hungarian	Hungary
Italian	Italy
Japanese	Japan
Korean	North Korea
Korean	South Korea
Dutch	Netherlands
Norwegian	Norway
Polish	Poland
Portuguese	Brazil
Russian	Russia
Swedish	Sweden
Turkish	Turkey
Chinese	China
Portuguese	Portugal

Target ID:	0
Start time:	18:36:18
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\VS80sp1-KB954961-X86-INTL.exe"
Imagebase:	0x400000
File size:	12'779'920 bytes
MD5 hash:	DE6843E7937DFE0704B9EADFE589E691
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:36:22
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\msiexec.exe" REBOOT=ReallySuppress /p "C:\Users\user\AppData\Local\Temp\ZNW50FA\VS80sp1-KB954961-X86-INTL.msp" /l*v C:\Users\user\AppData\Local\Temp\VS80sp1-KB954961-X86-INTL\VS80sp1-KB954961-X86-INTL-msi.0.log
Imagebase:	0x810000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:36:26
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\msiexec.exe" REBOOT=ReallySuppress /q /i C:\Users\user\AppData\Local\Temp\ZNW50FA\dw20shared.msi APPGUID={AB1098F4-4E8B-4BC1-9979-6367DF53ED51} REINSTALL=all REINSTALLMODE=vomus
Imagebase:	0x810000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:36:26
Start date:	18/04/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6d3ae0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	18:36:26
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding D94135EDDA44CEACEF1298338DEB1A49
Imagebase:	0x810000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:36:27
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 31C2B4F4F21467A963096029BA61CEDC E Global\MSI0000
Imagebase:	0x810000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 0108A191 Relevance: .7, Instructions: 700COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2093715180.0000000001084000.00000004.00000020.00020000.00000000.sdmp, Offset: 01084000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1084000_VS80sp1-KB954961-X86-INTL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ac550fff5270e6b02552b3337e28a7f3eb97b718b1a351f6500a6051abdb8be
Instruction ID: cf5553dc6bb20ac8efabdd2f71a96426b54f8e5f492f751f2ed360325065756d
Opcode Fuzzy Hash: 3ac550fff5270e6b02552b3337e28a7f3eb97b718b1a351f6500a6051abdb8be
Instruction Fuzzy Hash: AE42DE9294E3C18FCB6B9770187A951BF702D2301835ECACFC5C64F8A3E6899446E767

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: msiexec.exePID: 5660, Parent PID: 380COMMON

Non-executed Functions

Function 04C3F42C Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2093539767.0000000004C3F000.00000004.00000010.00020000.00000000.sdmp, Offset: 04C3F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c3f000_msiexec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecfe6f03c2f0cf878f42f6ca62676e028b67904d693ee3b93f0f390e8db44dd6
Instruction ID: 6c7af25025752a8c26f3dd44b2c0cc16a16cdf62e10960aedab90dae06115a14
Opcode Fuzzy Hash: ecfe6f03c2f0cf878f42f6ca62676e028b67904d693ee3b93f0f390e8db44dd6
Instruction Fuzzy Hash: 08F0541558E7C14FDB038B3548761A5BF308E4715470E54CBC4C1CF0B3C5196A1AEBA2

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report VS80sp1-KB954961-X86-INTL.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\5d6f32.rbs

C:\Program Files (x86)\Common Files\Microsoft Shared\DW\DW20.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\DW\DWTRIG20.EXE

C:\Users\user\AppData\Local\Temp\5437.tmp

C:\Users\user\AppData\Local\Temp\5467.tmp

C:\Users\user\AppData\Local\Temp\5497.tmp

C:\Users\user\AppData\Local\Temp\54D6.tmp

C:\Users\user\AppData\Local\Temp\5525.tmp

C:\Users\user\AppData\Local\Temp\5565.tmp

C:\Users\user\AppData\Local\Temp\55A4.tmp

C:\Users\user\AppData\Local\Temp\5603.tmp

C:\Users\user\AppData\Local\Temp\56CF.tmp

C:\Users\user\AppData\Local\Temp\570F.tmp

C:\Users\user\AppData\Local\Temp\573E.tmp

C:\Users\user\AppData\Local\Temp\577E.tmp

C:\Users\user\AppData\Local\Temp\57BD.tmp

C:\Users\user\AppData\Local\Temp\57ED.tmp

C:\Users\user\AppData\Local\Temp\582D.tmp

C:\Users\user\AppData\Local\Temp\585D.tmp

C:\Users\user\AppData\Local\Temp\588D.tmp

C:\Users\user\AppData\Local\Temp\58BC.tmp

C:\Users\user\AppData\Local\Temp\590C.tmp

C:\Users\user\AppData\Local\Temp\594B.tmp

C:\Users\user\AppData\Local\Temp\598B.tmp

C:\Users\user\AppData\Local\Temp\59BA.tmp

Windows Analysis Report
VS80sp1-KB954961-X86-INTL.exe