Loading ...

Analysis Report

Overview

General Information

Joe Sandbox Version:23.0.0
Analysis ID:622264
Start time:13:20:19
Joe Sandbox Product:Cloud
Start date:30.07.2018
Overall analysis duration:0h 23m 30s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:pdfescape-desktop-asian-and-extended.msi
Cookbook file name:defaultwindowsmsicookbook.jbs
Analysis system description:Windows 7 x64 (Office 2003 SP3, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 41, Firefox 36)
Number of analysed new started processes analysed:41
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies
  • HCA enabled
  • EGA enabled
  • HDC enabled
Analysis stop reason:Timeout
Detection:MAL
Classification:mal44.rans.adwa.evad.mine.winMSI@503/506@3/5
EGA Information:
  • Successful, ratio: 100%
HDC Information:
  • Successful, ratio: 66% (good quality ratio 56.1%)
  • Quality average: 56.6%
  • Quality standard deviation: 32.6%
HCA Information:
  • Successful, ratio: 99%
  • Number of executed functions: 147
  • Number of non-executed functions: 241
Cookbook Comments:
  • Adjust boot time
  • Correcting counters for adjusted boot time
  • Found application associated with file extension: .msi
Warnings:
Show All
  • Max analysis timeout: 600s exceeded, the analysis took too long
  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
  • Report creation exceeded maximum time and may have missing behavior and disassembly information.
  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size exceeded maximum capacity and may have missing disassembly code.
  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
  • Report size getting too big, too many NtCreateFile calls found.
  • Report size getting too big, too many NtDeviceIoControlFile calls found.
  • Report size getting too big, too many NtEnumerateKey calls found.
  • Report size getting too big, too many NtFsControlFile calls found.
  • Report size getting too big, too many NtOpenFile calls found.
  • Report size getting too big, too many NtOpenKeyEx calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.
  • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
  • Report size getting too big, too many NtReadFile calls found.
  • Report size getting too big, too many NtSetInformationFile calls found.
  • Report size getting too big, too many NtWriteFile calls found.
  • Report size getting too big, too many NtWriteVirtualMemory calls found.
  • Skipping Hybrid Code Analysis (implementation is based on Java, .Net, VB or Delphi, or parses a document) for: msiexec.exe, msiexec.exe, mscorsvw.exe, mscorsvw.exe
  • Too many dropped files, some of them have not been restored

Detection

StrategyScoreRangeReportingDetection
Threshold440 - 100Report FP / FNmalicious

Confidence

StrategyScoreRangeFurther Analysis Required?Confidence
Threshold50 - 5false
ConfidenceConfidence


Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox
Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook
Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook
Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior



Signature Overview

Click to jump to signature section


AV Detection:

barindex
Antivirus detection for dropped fileShow sources
Source: C:\Windows\System32\xbox-service.exeAvira: Label: HEUR/AGEN.1013443
Multi AV Scanner detection for submitted fileShow sources
Source: pdfescape-desktop-asian-and-extended.msivirustotal: Detection: 22%Perma Link
Antivirus detection for unpacked fileShow sources
Source: 8.1.xbox-service.exe.13f1b0000.0.unpackAvira: Label: HEUR/AGEN.1013443
Source: 8.2.xbox-service.exe.13f1b0000.0.unpackAvira: Label: HEUR/AGEN.1013443
Source: 8.0.xbox-service.exe.13f1b0000.2.unpackAvira: Label: HEUR/AGEN.1013443
Source: 9.1.xbox-service.exe.13fbc0000.0.unpackAvira: Label: HEUR/AGEN.1013443
Source: 9.0.xbox-service.exe.13fbc0000.0.unpackAvira: Label: HEUR/AGEN.1013443
Source: 8.0.xbox-service.exe.13f1b0000.0.unpackAvira: Label: HEUR/AGEN.1013443
Source: 8.0.xbox-service.exe.13f1b0000.3.unpackAvira: Label: HEUR/AGEN.1013443
Source: 8.0.xbox-service.exe.13f1b0000.1.unpackAvira: Label: HEUR/AGEN.1013443

Cryptography:

barindex
Public key (encryption) foundShow sources
Source: tmp2C70.tmp.7.drBinary or memory string: -----BEGIN PUBLIC KEY-----

Bitcoin Miner:

barindex
Found strings related to Crypto-MiningShow sources
Source: pagefile.sys.9.drString found in binary or memory: "cpu_threads_conf" : [ { "low_power_mode" : false, "no_prefetch" : true, "affine_to_cpu" : 0 }, ], "use_slow_memory" : "warn", "Nicehash_nonce" : false, "aes_override" : null, "use_tls" : false, "tls_secure_algo" : true, "tls_fingerprint" : "", "pool_address" : "monerohash.com:80", "wallet_address" :

Spreading:

barindex
Checks for available system drives (often done to infect USB drives)Show sources
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: z:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: x:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: v:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: t:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: r:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: p:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: n:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: l:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: j:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: h:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: f:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: b:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: y:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: w:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: u:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: s:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: q:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: o:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: m:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: k:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: i:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: g:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: e:Jump to behavior
Source: C:\Windows\System32\svchost.exeFile opened: c:Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile opened: a:Jump to behavior
Contains functionality to enumerate / list files inside a directoryShow sources
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF3941F30 FindFirstFileExW,7_1_000007FEF3941F30
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF3959598 FindFirstFileExA,7_1_000007FEF3959598
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1D33D4 FindFirstFileExA,8_2_000000013F1D33D4
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBE33D4 FindFirstFileExA,9_1_000000013FBE33D4
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800C9C70 FindFirstFileExA,10_1_00000001800C9C70
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800C9C70 FindFirstFileExA,12_1_00000001800C9C70

Networking:

barindex
Connects to IPs without corresponding DNS lookupsShow sources
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknownUDP traffic detected without corresponding DNS query: 239.255.255.250
Uses a known web browser user agent for HTTP communicationShow sources
Source: global trafficHTTP traffic detected: GET /module/glamour HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: download-desktop.pdfescape.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /download/pdfescape/pdfescape1/glamour HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: cdn.lulusoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /pdfescape3/glamour/PDFescape_Desktop_Installer_3.0.25.584.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: download-desktop-msi.pdfescape.comConnection: Keep-Alive
Contains functionality to download additional files from the internetShow sources
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF3942F30 DeleteUrlCacheEntry,URLDownloadToFileA,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,7_1_000007FEF3942F30
Downloads filesShow sources
Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GOPT6FQ2Jump to behavior
Downloads files from webservers via HTTPShow sources
Source: global trafficHTTP traffic detected: GET /module/glamour HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: download-desktop.pdfescape.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /download/pdfescape/pdfescape1/glamour HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: cdn.lulusoft.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /pdfescape3/glamour/PDFescape_Desktop_Installer_3.0.25.584.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: download-desktop-msi.pdfescape.comConnection: Keep-Alive
Performs DNS lookupsShow sources
Source: unknownDNS traffic detected: queries for: download-desktop.pdfescape.com
Urls found in memory or binary dataShow sources
Source: tmp2C70.tmp.7.drString found in binary or memory: file://
Source: tmp2C70.tmp.7.drString found in binary or memory: file://%s
Source: tmp2C70.tmp.7.drString found in binary or memory: file://%sresource://blankEndHTMLStartHTMLEndFragmentStartFragmentVersion:1.0
Source: tmp2C70.tmp.7.drString found in binary or memory: file://hostname/
Source: tmp2C70.tmp.7.drString found in binary or memory: ftp://
Source: tmp2C70.tmp.7.drString found in binary or memory: ftp://%s:%s
Source: tmp2C70.tmp.7.drString found in binary or memory: ftp://;type=AcceptAccept:
Source: pagefile.sys.9.drString found in binary or memory: http://%s/h
Source: pagefile.sys.9.drString found in binary or memory: http://%s/hHostLocation
Source: tmp2C70.tmp.7.drString found in binary or memory: http://%s:%d
Source: tmp2C70.tmp.7.drString found in binary or memory: http://%s:%d5
Source: tmp2C70.tmp.7.drString found in binary or memory: http://bugreport.pdfescape.com/service.asmxW
Source: tmp2C70.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: tmp2C70.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: tmp2C70.tmp.7.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: tmp2C70.tmp.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: tmp2C70.tmp.7.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: tmp2C70.tmp.7.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: tmp2C70.tmp.7.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://data28.somee.com/data32.zip
Source: msiexec.exe, pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://desktop.sodapdf.com/
Source: pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://desktop.sodapdf.com/SOFTWARE
Source: msiexec.exe, pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://desktop.sodapdf.com/module/glamour
Source: pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://desktop.sodapdf.com/module/glamourhttp://download8.sodapdf.com/module/glamourhttp://download-
Source: msiexec.exe, pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://download-desktop.pdfescape.com/
Source: pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://download-desktop.pdfescape.com/SOFTWARE
Source: msiexec.exe, pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://download-desktop.pdfescape.com/module/glamour
Source: msiexec.exe, pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://download2018.pdf-suite.com/
Source: pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://download2018.pdf-suite.com/SOFTWARE
Source: msiexec.exe, pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://download2018.pdf-suite.com/module/glamour
Source: msiexec.exe, pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://download8.sodapdf.com/
Source: pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://download8.sodapdf.com/SOFTWARE
Source: msiexec.exe, pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://download8.sodapdf.com/module/glamour
Source: msiexec.exe, pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://downloads.docudesk.com/
Source: pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://downloads.docudesk.com/SOFTWARE
Source: msiexec.exe, pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://downloads.docudesk.com/module/glamour
Source: tmp2C70.tmp.7.drString found in binary or memory: http://ftp://
Source: tmp2C70.tmp.7.drString found in binary or memory: http://jtracking-gate.lulusoft.comIEH
Source: tmp2C70.tmp.7.drString found in binary or memory: http://ocsp.digicert.com0C
Source: tmp2C70.tmp.7.drString found in binary or memory: http://ocsp.digicert.com0N
Source: tmp2C70.tmp.7.drString found in binary or memory: http://ocsp.thawte.com0
Source: tmp2C70.tmp.7.drString found in binary or memory: http://paygw.pdfescape.com/redirect/http://download-desktop.pdfescape.com/pdfescape-desktop&&version
Source: tmp2C70.tmp.7.drString found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: tmp2C70.tmp.7.drString found in binary or memory: http://s.symcd.com06
Source: tmp2C70.tmp.7.drString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: tmp2C70.tmp.7.drString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/arrayType
Source: tmp2C70.tmp.7.drString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/arrayType0
Source: tmp2C70.tmp.7.drString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: tmp2C70.tmp.7.drString found in binary or memory: http://sodapdf.com/fr/confidentialite#privacy-dehttp://sodapdf.com/de/datenschutz#privacy-it#privacy
Source: tmp2C70.tmp.7.drString found in binary or memory: http://sodapdf.com/privacy/
Source: tmp2C70.tmp.7.drString found in binary or memory: http://stats.pdfescape.com/Tracking.asmx
Source: tmp2C70.tmp.7.drString found in binary or memory: http://tempuri.org/
Source: tmp2C70.tmp.7.drString found in binary or memory: http://tempuri.org/AddBug
Source: tmp2C70.tmp.7.drString found in binary or memory: http://tempuri.org/CompressSimpleTrackSetup
Source: tmp2C70.tmp.7.drString found in binary or memory: http://tempuri.org/GetVersionInfo
Source: tmp2C70.tmp.7.drString found in binary or memory: http://tempuri.org/http://tempuri.org/VersionVersionparamparamNameName
Source: tmp2C70.tmp.7.drString found in binary or memory: http://tempuri.org/http://tempuri.org/datadata
Source: tmp2C70.tmp.7.drString found in binary or memory: http://terrainformatica.com/forums/topic.php?id=1772
Source: tmp2C70.tmp.7.drString found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: tmp2C70.tmp.7.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: tmp2C70.tmp.7.drString found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: tmp2C70.tmp.7.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: tmp2C70.tmp.7.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: tmp2C70.tmp.7.drString found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: tmp2C70.tmp.7.drString found in binary or memory: http://upclick.com/
Source: tmp2C70.tmp.7.drString found in binary or memory: http://upclick.com/GetLocationInfo
Source: tmp2C70.tmp.7.drString found in binary or memory: http://upclick.com/http://upclick.com/
Source: tmp2C70.tmp.7.drString found in binary or memory: http://update.pdfescape.com/Service.asmx
Source: tmp2C70.tmp.7.drString found in binary or memory: http://webcompanion.com/nano_download.php?partner=
Source: tmp2C70.tmp.7.drString found in binary or memory: http://webcompanion.com/nano_download.php?partner=&campaign=
Source: pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://winservice32.website.tk/m.html
Source: pagefile.sys.9.drString found in binary or memory: http://winservice32.website.tk/m.htmldata
Source: tmp2C70.tmp.7.drString found in binary or memory: http://wsgeoip.pdfescape.com/ipservice.asmx
Source: Identity-UTF16-V.2.drString found in binary or memory: http://www.artifex.com/licensing/
Source: Identity-UTF16-V.2.drString found in binary or memory: http://www.ghostscript.com/licensing/.
Source: pagefile.sys.9.drString found in binary or memory: http://www.openssl.org/support/faq.html
Source: pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://www.pdfescape.com/privacy/
Source: msiexec.exe, 00000001.00000003.12378422218.000000000050A000.00000004.sdmp, pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://www.redsoftware.com/
Source: msiexec.exe, 00000001.00000003.12667191155.0000000000586000.00000004.sdmp, msiexec.exe, 00000001.00000003.12378422218.000000000050A000.00000004.sdmp, pdfescape-desktop-asian-and-extended.msiString found in binary or memory: http://www.redsoftware.com/contact/
Source: tmp2C70.tmp.7.drString found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: tmp2C70.tmp.7.drString found in binary or memory: https://d.symcb.com/cps0%
Source: tmp2C70.tmp.7.drString found in binary or memory: https://d.symcb.com/rpa0
Source: tmp2C70.tmp.7.drString found in binary or memory: https://d.symcb.com/rpa0.
Source: tmp2C70.tmp.7.drString found in binary or memory: https://www.digicert.com/CPS0
Source: rundll32.exe, pagefile.sys.9.drString found in binary or memory: https://www.google-analytics.com/collect?v=1&tid=UA-108153473-1&cid=

Spam, unwanted Advertisements and Ransom Demands:

barindex
Modifies the hosts fileShow sources
Source: C:\Windows\System32\msiexec.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior

DDoS:

barindex
Too many similar processes foundShow sources
Source: unknownProcess created: 391

Operating System Destruction:

barindex
Mass deletion, destroys many filesShow sources
Source: c:\windows\system32\xbox-service.exeFile deleted: Number of file deletion 463 exceeds threshold 400

System Summary:

barindex
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)Show sources
Source: C:\Windows\SysWOW64\msiexec.exeMemory allocated: 77080000 page execute and read and writeJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeMemory allocated: 771A0000 page execute and read and writeJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeMemory allocated: 77080000 page execute and read and writeJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeMemory allocated: 771A0000 page execute and read and writeJump to behavior
Contains functionality to delete servicesShow sources
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1BB640 OpenSCManagerA,LoadStringA,MessageBoxA,OpenServiceA,CloseServiceHandle,LoadStringA,ControlService,GetLastError,MessageBoxA,DeleteService,CloseServiceHandle,CloseServiceHandle,MessageBoxA,RegDeleteValueA,RegCloseKey,RegCloseKey,8_2_000000013F1BB640
Creates driver filesShow sources
Source: C:\Windows\System32\xbox-service.exeFile created: C:\Windows\pagefile.sys
Creates files inside the system directoryShow sources
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\51df1b.msiJump to behavior
Deletes files inside the Windows folderShow sources
Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\51df1c.ipiJump to behavior
Detected potential crypto functionShow sources
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF394E7A87_1_000007FEF394E7A8
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF3952BD07_1_000007FEF3952BD0
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF395938C7_1_000007FEF395938C
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF395696C7_1_000007FEF395696C
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF39589247_1_000007FEF3958924
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF395CF807_1_000007FEF395CF80
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF395E6F47_1_000007FEF395E6F4
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF39566F47_1_000007FEF39566F4
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF3957DE87_1_000007FEF3957DE8
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF3947D487_1_000007FEF3947D48
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF395BDA07_1_000007FEF395BDA0
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF394EDAC7_1_000007FEF394EDAC
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF394F50C7_1_000007FEF394F50C
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1BB6408_2_000000013F1BB640
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1C97548_2_000000013F1C9754
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1C17708_2_000000013F1C1770
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1BA5F08_2_000000013F1BA5F0
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1B7EA08_2_000000013F1B7EA0
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1D4ED48_2_000000013F1D4ED4
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1D65108_2_000000013F1D6510
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1CB5E08_2_000000013F1CB5E0
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1B14908_2_000000013F1B1490
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1C8CA88_2_000000013F1C8CA8
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1CAAE88_2_000000013F1CAAE8
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1D8B6C8_2_000000013F1D8B6C
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1CBB898_2_000000013F1CBB89
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1DA3888_2_000000013F1DA388
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1C9A388_2_000000013F1C9A38
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1DC2748_2_000000013F1DC274
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1D7A948_2_000000013F1D7A94
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1B32848_2_000000013F1B3284
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1B4AE08_2_000000013F1B4AE0
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1B59208_2_000000013F1B5920
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1C715C8_2_000000013F1C715C
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1D31C88_2_000000013F1D31C8
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1CB0BC8_2_000000013F1CB0BC
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBD17709_1_000000013FBD1770
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBC14909_1_000000013FBC1490
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBC32849_1_000000013FBC3284
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBC59209_1_000000013FBC5920
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBDB0BC9_1_000000013FBDB0BC
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBD97549_1_000000013FBD9754
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBC7EA09_1_000000013FBC7EA0
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBE4ED49_1_000000013FBE4ED4
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBCA5F09_1_000000013FBCA5F0
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBCB6409_1_000000013FBCB640
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBDB5E09_1_000000013FBDB5E0
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBE65109_1_000000013FBE6510
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBD8CA89_1_000000013FBD8CA8
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBDBB899_1_000000013FBDBB89
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBEA3889_1_000000013FBEA388
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBE8B6C9_1_000000013FBE8B6C
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBDAAE89_1_000000013FBDAAE8
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBE7A949_1_000000013FBE7A94
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBEC2749_1_000000013FBEC274
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBC4AE09_1_000000013FBC4AE0
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBD9A389_1_000000013FBD9A38
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBE31C89_1_000000013FBE31C8
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBD715C9_1_000000013FBD715C
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005800410_1_0000000180058004
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800D404C10_1_00000001800D404C
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018001A05010_1_000000018001A050
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800B414010_1_00000001800B4140
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800101C010_1_00000001800101C0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800D21EC10_1_00000001800D21EC
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005421110_1_0000000180054211
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018001E23010_1_000000018001E230
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018008A2A010_1_000000018008A2A0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800D02AC10_1_00000001800D02AC
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800582DF10_1_00000001800582DF
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005230010_1_0000000180052300
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018002A36010_1_000000018002A360
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800B43BC10_1_00000001800B43BC
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018002C41010_1_000000018002C410
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018001041010_1_0000000180010410
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005444010_1_0000000180054440
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800C244410_1_00000001800C2444
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005246010_1_0000000180052460
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005A48010_1_000000018005A480
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800745B010_1_00000001800745B0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005260A10_1_000000018005260A
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800B463810_1_00000001800B4638
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800CC63410_1_00000001800CC634
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005867010_1_0000000180058670
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018001067010_1_0000000180010670
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800566E010_1_00000001800566E0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005475010_1_0000000180054750
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005688310_1_0000000180056883
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005889010_1_0000000180058890
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018004C8E010_1_000000018004C8E0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800528F310_1_00000001800528F3
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018001092010_1_0000000180010920
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005498010_1_0000000180054980
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800529E010_1_00000001800529E0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180058A7010_1_0000000180058A70
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800A4B1C10_1_00000001800A4B1C
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800D2B4810_1_00000001800D2B48
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180056B6310_1_0000000180056B63
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180062B9010_1_0000000180062B90
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018001ABB010_1_000000018001ABB0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180066BC010_1_0000000180066BC0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180056C1110_1_0000000180056C11
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180050C4010_1_0000000180050C40
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180056C5010_1_0000000180056C50
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180054C6010_1_0000000180054C60
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180088C7010_1_0000000180088C70
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180026CC010_1_0000000180026CC0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800D0D0010_1_00000001800D0D00
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018004CD4010_1_000000018004CD40
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180010D5010_1_0000000180010D50
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180040DA010_1_0000000180040DA0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018000CE5010_1_000000018000CE50
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180098E9C10_1_0000000180098E9C
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180054EE010_1_0000000180054EE0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180008F7010_1_0000000180008F70
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180062FB010_1_0000000180062FB0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800BEFBC10_1_00000001800BEFBC
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005302010_1_0000000180053020
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005904010_1_0000000180059040
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018007B06010_1_000000018007B060
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800550B110_1_00000001800550B1
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018001511010_1_0000000180015110
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800D71B010_1_00000001800D71B0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018002922010_1_0000000180029220
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018001123010_1_0000000180011230
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800BD25010_1_00000001800BD250
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018003126010_1_0000000180031260
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018003128010_1_0000000180031280
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018004B2B010_1_000000018004B2B0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800312F010_1_00000001800312F0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800C92F810_1_00000001800C92F8
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018002131010_1_0000000180021310
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018003138010_1_0000000180031380
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800BB3D810_1_00000001800BB3D8
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018003140010_1_0000000180031400
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005745010_1_0000000180057450
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800D34DC10_1_00000001800D34DC
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800074E010_1_00000001800074E0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005357010_1_0000000180053570
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005560A10_1_000000018005560A
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018007B63010_1_000000018007B630
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005964010_1_0000000180059640
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005F64010_1_000000018005F640
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005767010_1_0000000180057670
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800536D010_1_00000001800536D0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005577010_1_0000000180055770
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018001178010_1_0000000180011780
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800A77D410_1_00000001800A77D4
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018004580010_1_0000000180045800
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800CF81810_1_00000001800CF818
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018004585010_1_0000000180045850
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018004588010_1_0000000180045880
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005387910_1_0000000180053879
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018005989010_1_0000000180059890
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800BD8AC10_1_00000001800BD8AC
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800458D010_1_00000001800458D0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018003D8F010_1_000000018003D8F0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018003B96010_1_000000018003B960
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018007B98010_1_000000018007B980
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800159E010_1_00000001800159E0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800C9A6410_1_00000001800C9A64
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180099A9810_1_0000000180099A98
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180077AD010_1_0000000180077AD0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180055AE010_1_0000000180055AE0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180053B5510_1_0000000180053B55
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800C7B8010_1_00000001800C7B80
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800C5C4010_1_00000001800C5C40
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180053C5010_1_0000000180053C50
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_0000000180011C6010_1_0000000180011C60
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_000000018007BCA010_1_000000018007BCA0
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800CFD1410_1_00000001800CFD14
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005800412_1_0000000180058004
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800D404C12_1_00000001800D404C
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018001A05012_1_000000018001A050
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800B414012_1_00000001800B4140
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800101C012_1_00000001800101C0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800D21EC12_1_00000001800D21EC
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005421112_1_0000000180054211
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018001E23012_1_000000018001E230
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018008A2A012_1_000000018008A2A0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800D02AC12_1_00000001800D02AC
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800582DF12_1_00000001800582DF
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005230012_1_0000000180052300
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018002A36012_1_000000018002A360
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800B43BC12_1_00000001800B43BC
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018002C41012_1_000000018002C410
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018001041012_1_0000000180010410
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005444012_1_0000000180054440
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800C244412_1_00000001800C2444
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005246012_1_0000000180052460
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005A48012_1_000000018005A480
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800745B012_1_00000001800745B0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005260A12_1_000000018005260A
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800B463812_1_00000001800B4638
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800CC63412_1_00000001800CC634
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005867012_1_0000000180058670
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018001067012_1_0000000180010670
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800566E012_1_00000001800566E0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005475012_1_0000000180054750
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005688312_1_0000000180056883
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005889012_1_0000000180058890
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018004C8E012_1_000000018004C8E0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800528F312_1_00000001800528F3
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018001092012_1_0000000180010920
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005498012_1_0000000180054980
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800529E012_1_00000001800529E0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180058A7012_1_0000000180058A70
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800A4B1C12_1_00000001800A4B1C
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800D2B4812_1_00000001800D2B48
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180056B6312_1_0000000180056B63
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180062B9012_1_0000000180062B90
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018001ABB012_1_000000018001ABB0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180066BC012_1_0000000180066BC0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180056C1112_1_0000000180056C11
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180050C4012_1_0000000180050C40
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180056C5012_1_0000000180056C50
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180054C6012_1_0000000180054C60
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180088C7012_1_0000000180088C70
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180026CC012_1_0000000180026CC0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800D0D0012_1_00000001800D0D00
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018004CD4012_1_000000018004CD40
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180010D5012_1_0000000180010D50
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180040DA012_1_0000000180040DA0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018000CE5012_1_000000018000CE50
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180098E9C12_1_0000000180098E9C
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180054EE012_1_0000000180054EE0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180008F7012_1_0000000180008F70
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180062FB012_1_0000000180062FB0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800BEFBC12_1_00000001800BEFBC
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005302012_1_0000000180053020
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005904012_1_0000000180059040
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018007B06012_1_000000018007B060
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800550B112_1_00000001800550B1
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018001511012_1_0000000180015110
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800D71B012_1_00000001800D71B0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018002922012_1_0000000180029220
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018001123012_1_0000000180011230
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800BD25012_1_00000001800BD250
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018003126012_1_0000000180031260
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018003128012_1_0000000180031280
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018004B2B012_1_000000018004B2B0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800312F012_1_00000001800312F0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800C92F812_1_00000001800C92F8
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018002131012_1_0000000180021310
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018003138012_1_0000000180031380
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800BB3D812_1_00000001800BB3D8
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018003140012_1_0000000180031400
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005745012_1_0000000180057450
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800D34DC12_1_00000001800D34DC
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800074E012_1_00000001800074E0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005357012_1_0000000180053570
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005560A12_1_000000018005560A
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018007B63012_1_000000018007B630
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005964012_1_0000000180059640
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005F64012_1_000000018005F640
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005767012_1_0000000180057670
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800536D012_1_00000001800536D0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005577012_1_0000000180055770
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018001178012_1_0000000180011780
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800A77D412_1_00000001800A77D4
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018004580012_1_0000000180045800
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800CF81812_1_00000001800CF818
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018004585012_1_0000000180045850
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018004588012_1_0000000180045880
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005387912_1_0000000180053879
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018005989012_1_0000000180059890
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800BD8AC12_1_00000001800BD8AC
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800458D012_1_00000001800458D0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018003D8F012_1_000000018003D8F0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018003B96012_1_000000018003B960
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018007B98012_1_000000018007B980
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800159E012_1_00000001800159E0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800C9A6412_1_00000001800C9A64
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180099A9812_1_0000000180099A98
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180077AD012_1_0000000180077AD0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180055AE012_1_0000000180055AE0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180053B5512_1_0000000180053B55
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800C7B8012_1_00000001800C7B80
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800C5C4012_1_00000001800C5C40
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180053C5012_1_0000000180053C50
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180011C6012_1_0000000180011C60
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_000000018007BCA012_1_000000018007BCA0
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_00000001800CFD1412_1_00000001800CFD14
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180053E3012_1_0000000180053E30
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180057E7012_1_0000000180057E70
Source: C:\Windows\System32\rundll32.exeCode function: 12_1_0000000180069E8012_1_0000000180069E80
Enables security privilegesShow sources
Source: C:\Windows\System32\msiexec.exeProcess token adjusted: SecurityJump to behavior
Found potential string decryption / allocating functionsShow sources
Source: C:\Windows\System32\rundll32.exeCode function: String function: 0000000180034730 appears 301 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 000000018008B730 appears 48 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 00000001800340E0 appears 219 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 0000000180033EB0 appears 70 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 000000018003CFB0 appears 37 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 000000018008B5CC appears 38 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 0000000180030EF0 appears 32 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 0000000180037140 appears 54 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 00000001800345E0 appears 42 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 000000018008EF10 appears 1421 times
Source: C:\Windows\System32\rundll32.exeCode function: String function: 0000000180037A10 appears 1090 times
PE file contains executable resources (Code or Archives)Show sources
Source: xbox-service.exe.7.drStatic PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract
Source: PDFescape_Desktop_Installer_3.0.25.584[1].exe.7.drStatic PE information: Resource name: DLL type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: PDFescape_Desktop_Installer_3.0.25.584[1].exe.7.drStatic PE information: Resource name: IDT_SZSR type: Zip archive data, at least v2.0 to extract
PE file contains strange resourcesShow sources
Source: PDFescape_Desktop_Installer_3.0.25.584[1].exe.7.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: pagefile.sys.9.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: pagefile.sys.9.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: pagefile.sys.9.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Reads the hosts fileShow sources
Source: C:\Windows\System32\msiexec.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\msiexec.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\msiexec.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\msiexec.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Sample file is different than original file name gathered from version infoShow sources
Source: pdfescape-desktop-asian-and-extended.msiBinary or memory string: OriginalFilenameprinteula.dllL vs pdfescape-desktop-asian-and-extended.msi
Tries to load missing DLLsShow sources
Source: C:\Windows\System32\xbox-service.exeSection loaded: ext-ms-win-kernel32-package-current-l1-1-0.dllJump to behavior
Source: C:\Windows\System32\xbox-service.exeSection loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)Show sources
Source: xbox-service.exe.7.drStatic PE information: Section: .rsrc ZLIB complexity 0.998208776846
Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)Show sources
Source: metadata-2.2.drBinary string: buttonup_off.png22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
Source: metadata-2.2.drBinary string: scenes_intro_bg_pal.wmv22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
Source: metadata-2.2.drBinary string: keypad.xml22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\99program files\dvd maker\shared\dvdstyles\specialoccasion,,specialnavigationup_selectionsubpicture.png22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}
Source: metadata-2.2.drBinary string: acxtrnal.dll22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\((windows\diagnostics\system\device\en-us
Source: metadata-2.2.drBinary string: journal.exe22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}
Source: metadata-2.2.drBinary string: sbdrop.dll22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
Source: metadata-2.2.drBinary string: system.web.dynamicdata.dll22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\BBprogram files (x86)\windows sidebar\gadgets\weather.gadget\images33docked_black_moon-waxing-gibbous_partly-cloudy.png22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}
Source: metadata-2.2.drBinary string: system.addin.contract.dll22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
Source: metadata-2.2.drBinary string: wmplayer.exe.mui22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\BBprogram files (x86)\windows sidebar\gadgets\weather.gadget\images**undocked_black_moon-new_partly-cloudy.png22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\((windows\diagnostics\system\device\en-us
Source: metadata-2.2.drBinary string: highlight.png22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\66program files\windows sidebar\gadgets\rssfeeds.gadgeticon.png22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
Classification labelShow sources
Source: classification engineClassification label: mal44.rans.adwa.evad.mine.winMSI@503/506@3/5
Contains functionality to create servicesShow sources
Source: C:\Windows\System32\xbox-service.exeCode function: GetModuleFileNameA,OpenSCManagerA,MessageBoxA,CreateServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,8_2_000000013F1B8DA0
Source: C:\Windows\System32\xbox-service.exeCode function: GetModuleFileNameA,OpenSCManagerA,MessageBoxA,CreateServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,9_1_000000013FBC8DA0
Contains functionality to instantiate COM classesShow sources
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1B6360 CoCreateInstance,8_2_000000013F1B6360
Contains functionality to load and extract PE file embedded resourcesShow sources
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF3943870 GetWindowsDirectoryA,FindResourceA,LoadResource,LockResource,SizeofResource,Sleep,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,7_1_000007FEF3943870
Contains functionality to modify services (start/stop/modify)Show sources
Source: C:\Windows\System32\msiexec.exeCode function: 7_1_000007FEF3943560 OpenSCManagerA,OpenServiceA,ChangeServiceConfigA,StartServiceA,CloseServiceHandle,CloseServiceHandle,7_1_000007FEF3943560
Contains functionality to register a service control handler (likely the sample is a service DLL)Show sources
Source: C:\Windows\System32\xbox-service.exeCode function: 8_2_000000013F1BB330 RegQueryValueExA,StartServiceCtrlDispatcherA,GetLastError,RegCloseKey,RegCloseKey,8_2_000000013F1BB330
Source: C:\Windows\System32\xbox-service.exeCode function: 9_1_000000013FBCB330 RegQueryValueExA,StartServiceCtrlDispatcherA,GetLastError,RegCloseKey,RegCloseKey,9_1_000000013FBCB330
Creates files inside the program directoryShow sources
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files\PDFescape DesktopJump to behavior
Creates temporary filesShow sources
Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user~1\AppData\Local\Temp\~DFA7C98E8F99864179.TMPJump to behavior
Reads ini filesShow sources
Source: C:\Windows\SysWOW64\msiexec.exeFile read: C:\Windows\win.iniJump to behavior
Reads software policiesShow sources
Source: C:\Windows\SysWOW64\msiexec.exeKey opened: HKEY_USERS\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Runs a DLL by calling functionsShow sources
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
SQL strings found in memory and binary dataShow sources
Source: tmp2C70.tmp.7.drBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: tmp2C70.tmp.7.drBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: tmp2C70.tmp.7.drBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: tmp2C70.tmp.7.drBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Sample is known by AntivirusShow sources
Source: pdfescape-desktop-asian-and-extended.msivirustotal: Detection: 22%
Spawns processesShow sources
Source: unknownProcess created: C:\Windows\SysWOW64\msiexec.exe 'C:\Windows\System32\msiexec.exe' /i 'C:\Users\user\Desktop\pdfescape-desktop-asian-and-extended.msi'
Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: unknownProcess created: C:\Windows\System32\VSSVC.exe C:\Windows\system32\vssvc.exe
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k swprv
Source: unknownProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
Source: unknownProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\MsiExec.exe -Embedding D0DE56A5A4E90E630E24D08AB2B60C38
Source: unknownProcess created: C:\Windows\System32\xbox-service.exe C:\Windows\system32\xbox-service.exe -service
Source: unknownProcess created: C:\Windows\System32\xbox-service.exe C:\Windows\system32\xbox-service.exe
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: unknownProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\MsiExec.exe -Embedding D0DE56A5A4E90E630E24D08AB2B60C38Jump to behavior
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\xbox-service.exe C:\Windows\system32\xbox-service.exe -serviceJump to behavior
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: C:\Windows\System32\rundll32.exe rundll32 C:\Windows\pagefile.sys,dll
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Source: C:\Windows\System32\xbox-service.exeProcess created: unknown unknown
Uses an in-process (OLE) Automation serverShow sources
Source: C:\Windows\SysWOW64\msiexec.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{000C103E-0000-0000-C000-000000000046}\InProcServer32Jump to behavior
Found GUI installer (many successful clicks)Show sources
Source: C:\Windows\SysWOW64\msiexec.exeAutomated click: I accept the terms in the License Agreement
Source: C:\Windows\SysWOW64\msiexec.exeAutomated click: Install
Found installer window with terms and condition textShow sources
Source: C:\Windows\SysWOW64\msiexec.exeWindow detected: WixUI_Bmp_DialogI &accept the terms in the License Agreement&Print&Back&InstallCancelThe software that is subject to this End User's Software License Agreement ("EULA") is the PDFescape Desktop software (the "Licensed Software" as more fully defined below). This EULA is a legally binding agreement between the end user (the "Licensee") and Red Software (the "Licensor") pursuant to which the Licensor licenses the use of the Licensed Software to the end user (the "Licensee").Please read it carefully. If you have any questions concerning this EULA please contact the Licensor. Any installing copying accessing or using the Licensed Software by you (the "Licensee") constitutes Licensee's acceptance of and promise to comply with all of the terms and conditions of this EULA.Revised 2016-04-04LICENSE TERMS1. SOFTWARE CONTENTThe "Licensed Software" includes all of the contents of the files disk(s) CD-ROM(s) DVDs or other media for which this EULA is provided including:(1)third party computer information or software that
Creates a directory in C:\Program FilesShow sources
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape DesktopJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resourcesJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMapJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\78-EUC-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\78-EUC-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\78-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\78-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\78-RKSJ-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\78-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\78ms-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\78ms-RKSJ-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\83pv-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\90ms-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\90ms-RKSJ-UCS2Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\90ms-RKSJ-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\90msp-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\90msp-RKSJ-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\90pv-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\90pv-RKSJ-UCS2Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\90pv-RKSJ-UCS2CJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\90pv-RKSJ-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Add-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Add-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Add-RKSJ-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Add-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-CNS1-0Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-CNS1-1Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-CNS1-2Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-CNS1-3Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-CNS1-4Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-CNS1-5Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-CNS1-B5pcJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-CNS1-ETenms-B5Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-CNS1-H-CIDJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-CNS1-H-HostJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-CNS1-H-MacJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-CNS1-UCS2Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-GB1-0Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-GB1-1Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-GB1-2Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-GB1-3Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-GB1-4Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-GB1-5Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-GB1-GBK-EUCJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-GB1-GBpc-EUCJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-GB1-H-CIDJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-GB1-H-HostJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-GB1-H-MacJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-GB1-UCS2Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Japan1-0Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Japan1-1Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Japan1-2Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Japan1-3Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Japan1-4Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Japan1-5Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Japan1-6Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Japan1-90ms-RKSJJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Japan1-90pv-RKSJJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Japan1-H-CIDJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Japan1-H-HostJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Japan1-H-MacJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Japan1-PS-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Japan1-PS-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Japan1-UCS2Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Japan2-0Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Korea1-0Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Korea1-1Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Korea1-2Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Korea1-H-CIDJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Korea1-H-HostJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Korea1-H-MacJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Korea1-KSCms-UHCJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Korea1-KSCpc-EUCJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Adobe-Korea1-UCS2Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\B5-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\B5-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\B5pc-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\B5pc-UCS2Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\B5pc-UCS2CJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\B5pc-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\CNS-EUC-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\CNS-EUC-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\CNS01-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\CNS02-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\CNS03-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\CNS04-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\CNS05-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\CNS06-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\CNS07-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\CNS1-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\CNS1-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\CNS15-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\CNS2-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\CNS2-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\ETen-B5-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\ETen-B5-UCS2Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\ETen-B5-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\ETenms-B5-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\ETenms-B5-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\ETHK-B5-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\ETHK-B5-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\EUC-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\EUC-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Ext-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Ext-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Ext-RKSJ-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Ext-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GB-EUC-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GB-EUC-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GB-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GB-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GB-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBK-EUC-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBK-EUC-UCS2Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBK-EUC-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBK2K-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBK2K-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBKp-EUC-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBKp-EUC-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBpc-EUC-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBpc-EUC-UCS2Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBpc-EUC-UCS2CJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBpc-EUC-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBT-EUC-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBT-EUC-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBT-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBT-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBT-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBTpc-EUC-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\GBTpc-EUC-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\HankakuJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\HiraganaJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\HK-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\HKdla-B5-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\HKdla-B5-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\HKdlb-B5-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\HKdlb-B5-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\HKgccs-B5-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\HKgccs-B5-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\HKm314-B5-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\HKm314-B5-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\HKm471-B5-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\HKm471-B5-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\HKscs-B5-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\HKscs-B5-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Hojo-EUC-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Hojo-EUC-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Hojo-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Hojo-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Hojo-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Identity-UTF16-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\Identity-UTF16-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KatakanaJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KSC-EUC-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KSC-EUC-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KSC-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KSC-Johab-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KSC-Johab-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KSC-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KSC-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KSC2-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KSCms-UHC-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KSCms-UHC-HW-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KSCms-UHC-HW-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KSCms-UHC-UCS2Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KSCms-UHC-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KSCpc-EUC-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KSCpc-EUC-UCS2Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KSCpc-EUC-UCS2CJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\KSCpc-EUC-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\NWP-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\NWP-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\RKSJ-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\RomanJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\TCVN-RKSJ-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UCS2-90ms-RKSJJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UCS2-90pv-RKSJJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UCS2-B5pcJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UCS2-ETen-B5Jump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UCS2-GBK-EUCJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UCS2-GBpc-EUCJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UCS2-KSCms-UHCJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UCS2-KSCpc-EUCJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniCNS-UCS2-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniCNS-UCS2-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniCNS-UTF16-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniCNS-UTF16-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniCNS-UTF32-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniCNS-UTF32-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniCNS-UTF8-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniCNS-UTF8-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniGB-UCS2-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniGB-UCS2-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniGB-UTF16-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniGB-UTF16-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniGB-UTF32-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniGB-UTF32-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniGB-UTF8-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniGB-UTF8-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniHojo-UCS2-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniHojo-UCS2-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniHojo-UTF16-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniHojo-UTF16-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniHojo-UTF32-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniHojo-UTF32-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniHojo-UTF8-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniHojo-UTF8-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJIS-UCS2-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJIS-UCS2-HW-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJIS-UCS2-HW-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJIS-UCS2-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJIS-UTF16-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJIS-UTF16-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJIS-UTF32-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJIS-UTF32-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJIS-UTF8-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJIS-UTF8-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJIS2004-UTF16-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJIS2004-UTF16-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJIS2004-UTF32-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJIS2004-UTF32-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJIS2004-UTF8-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJIS2004-UTF8-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJISPro-UCS2-HW-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJISPro-UCS2-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJISPro-UTF8-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJISX0213-UTF32-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJISX0213-UTF32-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJISX02132004-UTF32-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniJISX02132004-UTF32-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniKS-UCS2-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniKS-UCS2-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniKS-UTF16-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniKS-UTF16-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniKS-UTF32-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniKS-UTF32-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniKS-UTF8-HJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\UniKS-UTF8-VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\VJump to behavior
Source: C:\Windows\System32\msiexec.exeDirectory created: C:\Program Files\PDFescape Desktop\resources\CMap\WP-SymbolJump to behavior
Creates a software uninstall entryShow sources
Source: C:\Windows\System32\msiexec.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Uninstall\{B52074CE-AD76-4FB0-A18E-750A76508F5E}Jump to behavior
Submission file is bigger than most known malware samplesShow sources
Source: pdfescape-desktop-asian-and-extended.msiStatic file information: File size 5918720 > 1048576
Binary contains paths to debug symbolsShow sources
Source: Binary string: C:\progects\mining-service\xmr\build\x64\Release\service64.pdb" source: xbox-service.exe, 00000009.00000001.12620962077.000000013FBF0000.00000002.sdmp, pdfescape-desktop-asian-and-extended.msi
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM -D"WINVER=0x0501" -D"_WIN32_WINNT=0x0501" -D"_USING_V110_SDK71_" source: tmp2C70.tmp.7.dr
Source: Binary string: D:\LULU\TempBuilds\TemporaryBuilds\CAN_Installer_Builder_1\9\s\_bin\PDFescape\Win32\PDFescapeDesktopInstaller.pdb". source: tmp2C70.tmp.7.dr
Source: Binary string: C:\progects\mining-service\xmr\build\Release\service32.pdb source: pdfescape-desktop-asian-and-extended.msi
Source: Binary string: C:\progects\mining-service\xmr\build\x64\Release\service64.pdb source: xbox-service.exe, 00000009.00000001.12620962077.000000013FBF0000.00000002.sdmp, pdfescape-desktop-asian-and-extended.msi
Source: Binary string: D:\LULU\TempBuilds\TemporaryBuilds\CAN_Installer_Builder_1\9\s\_bin\PDFescape\Win32\PDFescapeStatisticsDll.pdb source: tmp2C70.tmp.7.dr
Source: Binary string: D:\LULU\TempBuilds\TemporaryBuilds\CAN_Installer_Builder_1\9\s\_bin\PDFescape\Win32\PDFescapeDesktopInstaller.pdb source: tmp2C70.tmp.7.dr
Source: Binary string: ?crypto\stack\stack.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM -D"WINVER=0x0501" -D"_WIN32_WINNT=0x0501" -D"_USING_V110_SDK71_"crypto\bio\bio_lib.c source: tmp2C70.tmp.7.dr
Source: Binary string: C:\delivery\Dev\wix30_public\build\ship\x86\PrintEula.pdb source: pdfescape-desktop-asian-and-extended.msi

Data Obfuscation:

barindex
Contains functionality to dynamically determine API callsShow sources
Source: C:\Windows\System32\rundll32.exeCode function: 10_1_00000001800A2778 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,10_1_00000001800A2778
PE file contains an invalid checksumShow sources
Source: xbox-service.exe.7.drStatic PE information: real checksum: 0x0 should be: 0xf91e3
Source: pagefile.sys.9.drStatic PE information: real checksum: 0x176fd5 should be:
Source: PDFescape_Desktop_Installer_3.0.25.584[1].exe.7.drStatic PE information: real checksum: 0xb9e019 should be:

Persistence and Installation Behavior:

barindex
Drops executables to the windows directory (C:\Windows) and starts themShow sources
Source: C:\Windows\System32\msiexec.exeExecutable created and started: C:\Windows\system32\xbox-service.exeJump to behavior
Drops PE filesShow sources
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\System32\xbox-service.exeJump to dropped file
Source: C:\Windows\System32\xbox-service.exeFile created: C:\Windows\pagefile.sysJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIB0F.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user~1\AppData\Local\Temp\tmp2C70.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GOPT6FQ2\PDFescape_Desktop_Installer_3.0.25.584[1].exeJump to dropped file
Drops PE files to the windows directory (C:\Windows)Show sources
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\System32\xbox-service.exeJump to dropped file
Source: C:\Windows\System32\xbox-service.exeFile created: C:\Windows\pagefile.sysJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIB0F.tmpJump to dropped file
May use bcdedit to modify the Windows boot settingsShow sources
Source: metadata-2.2.drBinary or memory string: bcdedit.exe22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\
Source: metadata-2.2.drBinary or memory string: bcdedit.exe.mui22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\

Boot Survival:

bar