Edit tour

Windows Analysis Report
https://download.instalki.org/programy/Windows/Multimedia/kodeki/Microsoft.HEVCVideoExtension_2.0.60961.0_neutral_~_8wekyb3d8bbwe.AppxBundle

Overview

General Information

Sample URL:	https://download.instalki.org/programy/Windows/Multimedia/kodeki/Microsoft.HEVCVideoExtension_2.0.60961.0_neutral_~_8wekyb3d8bbwe.AppxBundle
Analysis ID:	1353152
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Creates files inside the system directory

Drops certificate files (DER)

Queries the volume information (name, serial number etc) of a device

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5844 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2016,i,2334675341297148897,9102047593537286946,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6564 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://download.instalki.org/programy/Windows/Multimedia/kodeki/Microsoft.HEVCVideoExtension_2.0.60961.0_neutral_~_8wekyb3d8bbwe.AppxBundle MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

AppInstaller.exe (PID: 2796 cmdline: "C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe" -ServerName:App.AppX9rwyqtrq9gw3wnmrap9a412nsc7145qh.mca MD5: D4B46459B6A0FB33EB4690FF2B6CE2EF)

cleanup

Joe Sandbox Signatures

• Compliance
• Networking
• E-Banking Fraud
• System Summary
• Boot Survival
• Hooking and other Techniques for Hiding and Protection
• Anti Debugging
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49721 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49724 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49721 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /programy/Windows/Multimedia/kodeki/Microsoft.HEVCVideoExtension_2.0.60961.0_neutral_~_8wekyb3d8bbwe.AppxBundle HTTP/1.1Host: download.instalki.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pD8ZeYd1arRPXwn&MD=moArR7gm HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pD8ZeYd1arRPXwn&MD=moArR7gm HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: unknown

DNS traffic detected: queries for: accounts.google.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4

Source: AppInstaller.exe, 00000008.00000003.2816583920.00000230939C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.mic
Source: AppInstaller.exe, 00000008.00000003.2831767864.0000023094EB6000.00000004.00000020.00020000.00000000.sdmp, AppInstaller.exe, 00000008.00000003.2822842559.0000023094EB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft
Source: AppInstaller.exe, 00000008.00000003.2835185381.0000023094A2D000.00000004.00000020.00020000.00000000.sdmp, AppInstaller.exe, 00000008.00000003.2826352621.0000023094EDA000.00000004.00000020.00020000.00000000.sdmp, AppInstaller.exe, 00000008.00000003.2836142522.0000023094A24000.00000004.00000020.00020000.00000000.sdmp, AppInstaller.exe, 00000008.00000003.2829686622.0000023094ED8000.00000004.00000020.00020000.00000000.sdmp, AppInstaller.exe, 00000008.00000003.2827261016.0000023094ED3000.00000004.00000020.00020000.00000000.sdmp, AppInstaller.exe, 00000008.00000003.2821193605.0000023094EDC000.00000004.00000020.00020000.00000000.sdmp, AppInstaller.exe, 00000008.00000003.2836613891.0000023094A25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://microsoft.sharepoint.com/teams/appxmanifest/SitePages/Home.aspx
Source: AppInstaller.exe, 00000008.00000003.2836613891.0000023094A25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://osgwiki.com/wiki/Manifest_Request

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49724 version: TLS 1.2

Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\Temp\APPX.801mlz9ersf1xblnyxpu62l9e.tmp			Jump to dropped file
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\Temp\APPX.98p4rbu3k3gdgwo1n2an8_jad.tmp			Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_5844_1425555956

Jump to behavior

Source: classification engine

Classification label: clean2.win@18/22@8/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe

File created: C:\Users\user\AppData\Local\Packages\microsoft.desktopappinstaller_8wekyb3d8bbwe\AC\Temp\APPX.f28mwy1k8h5lxgw7bqk498_be.tmp

Jump to behavior

Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2016,i,2334675341297148897,9102047593537286946,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://download.instalki.org/programy/Windows/Multimedia/kodeki/Microsoft.HEVCVideoExtension_2.0.60961.0_neutral_~_8wekyb3d8bbwe.AppxBundle
Source: unknown	Process created: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe "C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe" -ServerName:App.AppX9rwyqtrq9gw3wnmrap9a412nsc7145qh.mca
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2016,i,2334675341297148897,9102047593537286946,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalCache\Microsoft.HEVCVideoExtension_2.0.60961.0_x64__8wekyb3d8bbwe{b01fa7b7-fbda-4f1c-a4c6-06d741b2bef9}_temp.pri VolumeInformation			Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	11 System Information Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Ingress Tool Transfer			Data Destruction	Virtual Private Server	Employee Names

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://download.instalki.org/programy/Windows/Multimedia/kodeki/Microsoft.HEVCVideoExtension_2.0.60961.0_neutral_~_8wekyb3d8bbwe.AppxBundle	0%	Avira URL Cloud	safe
https://download.instalki.org/programy/Windows/Multimedia/kodeki/Microsoft.HEVCVideoExtension_2.0.60961.0_neutral_~_8wekyb3d8bbwe.AppxBundle	1%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
download.instalki.org	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://go.mic	0%	URL Reputation	safe
http://schemas.microsoft	0%	URL Reputation	safe
https://microsoft.sharepoint.com/teams/appxmanifest/SitePages/Home.aspx	0%	Avira URL Cloud	safe
https://microsoft.sharepoint.com/teams/appxmanifest/SitePages/Home.aspx	0%	Virustotal		Browse

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
accounts.google.com	172.253.115.84	true	false		high
download.instalki.org	195.162.24.106	true	false	1%, Virustotal, Browse	unknown
www.google.com	172.253.63.104	true	false		high
clients.l.google.com	142.251.179.102	true	false		high
clients2.google.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
https://download.instalki.org/programy/Windows/Multimedia/kodeki/Microsoft.HEVCVideoExtension_2.0.60961.0_neutral_~_8wekyb3d8bbwe.AppxBundle	false	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false	high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://osgwiki.com/wiki/Manifest_Request	AppInstaller.exe, 00000008.00000003.2836613891.0000023094A25000.00000004.00000020.00020000.00000000.sdmp	false		high
https://microsoft.sharepoint.com/teams/appxmanifest/SitePages/Home.aspx	AppInstaller.exe, 00000008.00000003.2835185381.0000023094A2D000.00000004.00000020.00020000.00000000.sdmp, AppInstaller.exe, 00000008.00000003.2826352621.0000023094EDA000.00000004.00000020.00020000.00000000.sdmp, AppInstaller.exe, 00000008.00000003.2836142522.0000023094A24000.00000004.00000020.00020000.00000000.sdmp, AppInstaller.exe, 00000008.00000003.2829686622.0000023094ED8000.00000004.00000020.00020000.00000000.sdmp, AppInstaller.exe, 00000008.00000003.2827261016.0000023094ED3000.00000004.00000020.00020000.00000000.sdmp, AppInstaller.exe, 00000008.00000003.2821193605.0000023094EDC000.00000004.00000020.00020000.00000000.sdmp, AppInstaller.exe, 00000008.00000003.2836613891.0000023094A25000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://go.mic	AppInstaller.exe, 00000008.00000003.2816583920.00000230939C3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.microsoft	AppInstaller.exe, 00000008.00000003.2831767864.0000023094EB6000.00000004.00000020.00020000.00000000.sdmp, AppInstaller.exe, 00000008.00000003.2822842559.0000023094EB4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
195.162.24.106	download.instalki.org	Poland	48505	KYLOS-ASPL	false
172.253.63.104	www.google.com	United States	15169	GOOGLEUS	false
142.251.179.102	clients.l.google.com	United States	15169	GOOGLEUS	false
172.253.115.84	accounts.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1353152
Start date and time:	2023-12-04 14:23:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://download.instalki.org/programy/Windows/Multimedia/kodeki/Microsoft.HEVCVideoExtension_2.0.60961.0_neutral_~_8wekyb3d8bbwe.AppxBundle
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@18/22@8/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.167.94, 34.104.35.123, 23.205.104.11, 72.21.81.240, 192.229.211.108, 142.251.111.94
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v4.5 to extract, compression method=store
Category:	dropped
Size (bytes):	7916
Entropy (8bit):	7.939532335795095
Encrypted:	false
SSDEEP:	192:4jKU6y4QHR+2ySKRIaygrdbCWFpjazvBWnzlRS4KeULXllI:Gqydx+2yLrFVjiBWnJRSdeUB2
MD5:	CDA3070A374AC52194B4181A60DCD5E6
SHA1:	AE22B42069137F581FBDDF98F15A4AD148477447
SHA-256:	92841D90C33CE10545252FED74F131FA2843974604CF035CC940843ADD772632
SHA-512:	1A9F32EFCB1839613A79E03E26DD9F63CC1F0A086E0DB39E244D1172EA696C0924D22B36E641328737D8D25D782E6D47ABF82E33E2028B25B894CD23228E57B7
Malicious:	false
Reputation:	low
Preview:	PK..-......e.V............5...Microsoft.HEVCVideoExtension_8wekyb3d8bbwe.arm64.appxPK..-......V................arm64/HEVCDECODER_STORE.dll..\|...?\|ff..n... Hn....e..$.L6....m.....5..}0.....D.O...fc.<5(...>A.r..m....j.T.".Qa...........\|...ag.....}..\..;...........?...o.WR..X........k=.+..Z..o.hX.....;.}w....V.sg^.y....-....]..h.P......v..Sm\..:..7.7.f..}.z.~_{......[..Mr....g........f...j....q...7.~...n.e........V../&...16.....}.v+..t/2fg.K........<\.I..aC7.g...I....~..!......+..^..G......<fMe..<.+J]x.6...w..L.L/.......o..n.V.Z/'.....%..l..w70v.D.'+..kia.d..L...( B...ln.....y.eDYy.#...X.b.yqh.a......;...$#.....=._....._s....._........3 ...]....~.y......._.H.[......./...]!... ..,..)..L.. ...yU%.cYL...R\..G.c...l_.p.R..N..LW......,EV=6..z.Le..#..\|...}...o.T..h.-..jn.Yo..JfYX. ..:..y.jk.....w..>t..C..O..A.z..-....=MH..r5O....H..9.B.K...G+.w.X\|$'.....#..0.Ir./.O...F...O~.....K....{[b\|F...N.....0.N..:;VV..S.......Rz....R.j..fCg.., ..

Process:	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (39741), with CRLF line terminators
Category:	dropped
Size (bytes):	39797
Entropy (8bit):	5.822429867362017
Encrypted:	false
SSDEEP:	384:aeqF5hXmvtXhpkTKk/AsyLJy/znvYIPXgqFV+GtMVq9VtJ28JjGrHB7pWxUP/1Vw:iF5UtxXJy/73oqJtHtb47xPIYTd0
MD5:	988EA52A44AE562316CF0E7B91F43DE3
SHA1:	A9C1DF9CC0031AC1FCC810756CDD97C7C0C2B024
SHA-256:	6EA28E4EA97F5113D9CEA03CA176A92845A02D49BF96167F789DD58B8EAB3C9E
SHA-512:	6F78121841256477B09AED5ED1011C55DB6138C8D5D7410193753909F2529987B63D5B69150E9C15722DD706B0A1D819994B1D43ED3EF7D81A2AFAB2156B03AC
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>..<BlockMap xmlns="http://schemas.microsoft.com/appx/2010/blockmap" xmlns:b4="http://schemas.microsoft.com/appx/2021/blockmap" IgnorableNamespaces="b4" HashMethod="http://www.w3.org/2001/04/xmlenc#sha256"><File Name="Assets\contrast-black\HEVCCodecAppList.scale-100_contrast-black.png" Size="233" LfhSize="97"><Block Hash="ds01Dllzs3KG5PlbvUuaQa7u0NhhiF2bKU7QPPxFge4="/></File><File Name="Assets\contrast-black\HEVCCodecAppList.scale-150_contrast-black.png" Size="317" LfhSize="97"><Block Hash="4bmB+rNRaNgeYK+yqe/ehpZOMG736CLef+5YyE4iBJg="/></File><File Name="Assets\contrast-black\HEVCCodecAppList.scale-125_contrast-black.png" Size="267" LfhSize="97"><Block Hash="JtKhIgjkLrJW7AxQOurniRF62RqnJWs1l3yNPEpinaY="/></File><File Name="Assets\contrast-black\HEVCCodecAppList.scale-200_contrast-black.png" Size="390" LfhSize="97"><Block Hash="AXWk56pqMxgYi8Lz5oqXW7s58PYO7jYKF3BYJR5TQP0="/></File><File Name="Assets\contrast-black\HEVCCodecAppList.sc

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2023 14:24:14.592925072 CET	56294	53	192.168.2.5	1.1.1.1
Dec 4, 2023 14:24:14.593053102 CET	49841	53	192.168.2.5	1.1.1.1
Dec 4, 2023 14:24:14.593359947 CET	57808	53	192.168.2.5	1.1.1.1
Dec 4, 2023 14:24:14.593723059 CET	58177	53	192.168.2.5	1.1.1.1
Dec 4, 2023 14:24:14.647624969 CET	53	52092	1.1.1.1	192.168.2.5
Dec 4, 2023 14:24:14.688168049 CET	53	56294	1.1.1.1	192.168.2.5
Dec 4, 2023 14:24:14.688388109 CET	53	57808	1.1.1.1	192.168.2.5
Dec 4, 2023 14:24:14.688616991 CET	53	49841	1.1.1.1	192.168.2.5
Dec 4, 2023 14:24:14.688678980 CET	53	58177	1.1.1.1	192.168.2.5
Dec 4, 2023 14:24:15.308080912 CET	53	62010	1.1.1.1	192.168.2.5
Dec 4, 2023 14:24:16.113693953 CET	61350	53	192.168.2.5	1.1.1.1
Dec 4, 2023 14:24:16.114236116 CET	64979	53	192.168.2.5	1.1.1.1
Dec 4, 2023 14:24:16.888647079 CET	53	61350	1.1.1.1	192.168.2.5
Dec 4, 2023 14:24:16.945610046 CET	53	64979	1.1.1.1	192.168.2.5
Dec 4, 2023 14:24:19.022881031 CET	62728	53	192.168.2.5	1.1.1.1
Dec 4, 2023 14:24:19.023169041 CET	50812	53	192.168.2.5	1.1.1.1
Dec 4, 2023 14:24:19.117988110 CET	53	62728	1.1.1.1	192.168.2.5
Dec 4, 2023 14:24:19.118033886 CET	53	50812	1.1.1.1	192.168.2.5
Dec 4, 2023 14:24:32.453305960 CET	53	50143	1.1.1.1	192.168.2.5
Dec 4, 2023 14:24:51.519187927 CET	53	52628	1.1.1.1	192.168.2.5
Dec 4, 2023 14:25:13.809108019 CET	53	61395	1.1.1.1	192.168.2.5
Dec 4, 2023 14:25:14.327630043 CET	53	49547	1.1.1.1	192.168.2.5

Timestamp	Bytes transferred	Direction	Data
2023-12-04 13:24:14 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2023-12-04 13:24:14 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-12-04 13:24:15 UTC	1627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 43 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 50 72 Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=utf-8Access-Control-Allow-Origin: https://www.google.comAccess-Control-Allow-Credentials: trueX-Content-Type-Options: nosniffCache-Control: no-cache, no-store, max-age=0, must-revalidatePr
2023-12-04 13:24:15 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-12-04 13:24:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2023-12-04 13:24:14 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-04 13:24:15 UTC	732	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 73 63 72 69 70 74 2d 73 72 63 20 27 72 65 70 6f 72 74 2d 73 61 6d 70 6c 65 27 20 27 6e 6f 6e 63 65 2d 52 70 4b 51 44 56 4d 6b 34 7a 2d 4a 65 78 49 72 69 6c 6e 56 6f 51 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 73 74 72 69 63 74 2d 64 79 6e 61 6d 69 63 27 20 68 74 74 70 73 3a 20 68 74 74 70 3a 3b 6f 62 6a 65 63 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 72 65 70 6f 72 74 2d 75 72 69 20 68 74 74 70 73 3a 2f 2f 63 73 70 2e 77 69 74 68 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 73 70 2f 63 6c 69 65 6e 74 75 70 64 61 74 65 2d 61 75 73 2f 31 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c Data Ascii: HTTP/1.1 200 OKContent-Security-Policy: script-src 'report-sample' 'nonce-RpKQDVMk4z-JexIrilnVoQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control
2023-12-04 13:24:15 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 38 31 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 31 39 34 35 35 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6181" elapsed_seconds="19455"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-12-04 13:24:15 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-12-04 13:24:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2023-12-04 13:24:17 UTC	774	OUT	GET /programy/Windows/Multimedia/kodeki/Microsoft.HEVCVideoExtension_2.0.60961.0_neutral_~_8wekyb3d8bbwe.AppxBundle HTTP/1.1 Host: download.instalki.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-04 13:24:17 UTC	276	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 30 34 20 44 65 63 20 32 30 32 33 20 31 33 3a 32 34 3a 31 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 0d 0a 55 70 67 72 61 64 65 3a 20 68 32 2c 68 32 63 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 55 70 67 72 61 64 65 2c 20 63 6c 6f 73 65 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f 6e 2c 20 30 31 20 4d 61 79 20 32 30 32 33 20 31 38 3a 30 32 3a 34 35 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 39 30 65 31 32 66 2d 35 66 61 61 35 61 31 34 35 35 39 65 30 22 0d 0a 41 63 63 65 70 74 2d 52 61 6e 67 65 73 3a 20 62 79 74 65 73 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 39 34 39 34 38 33 31 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e Data Ascii: HTTP/1.1 200 OKDate: Mon, 04 Dec 2023 13:24:17 GMTServer: Apache/2Upgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Mon, 01 May 2023 18:02:45 GMTETag: "90e12f-5faa5a14559e0"Accept-Ranges: bytesContent-Length: 9494831Vary: Accept-En
2023-12-04 13:24:17 UTC	7916	IN	Data Raw: 50 4b 03 04 2d 00 08 00 00 00 02 65 8a 56 00 00 00 00 00 00 00 00 00 00 00 00 35 00 00 00 4d 69 63 72 6f 73 6f 66 74 2e 48 45 56 43 56 69 64 65 6f 45 78 74 65 6e 73 69 6f 6e 5f 38 77 65 6b 79 62 33 64 38 62 62 77 65 2e 61 72 6d 36 34 2e 61 70 70 78 50 4b 03 04 2d 00 08 00 08 00 e4 9c 8a 56 00 00 00 00 00 00 00 00 00 00 00 00 1b 00 00 00 61 72 6d 36 34 2f 48 45 56 43 44 45 43 4f 44 45 52 5f 53 54 4f 52 45 2e 64 6c 6c ec bd 0b 7c 14 d5 dd 3f 7c 66 66 93 ec 6e ee d9 dc 20 48 6e 2a c9 e2 15 c2 65 8b c8 24 01 4c 36 08 92 04 af 6d 93 80 da 0d 88 35 e0 0d 7d 30 1b b0 9a 10 d1 8c 44 f1 b1 4f 1b 90 da 66 63 a9 3c 35 28 db 9b 04 da 3e 41 aa 72 d1 f6 6d fb ef 03 91 6a 03 54 0b 22 9a 51 61 ff df df 99 99 dd d9 cd 06 a2 f6 b9 7c de f7 cd 87 61 67 ce 9c eb ef 9c f3 fd Data Ascii: PK-eV5Microsoft.HEVCVideoExtension_8wekyb3d8bbwe.arm64.appxPK-Varm64/HEVCDECODER_STORE.dll\|?\|ffn Hn*e$L6m5}0DOfc<5(>ArmjT"Qa\|ag
2023-12-04 13:24:18 UTC	8000	IN	Data Raw: b8 75 f6 50 2b b5 21 cf d9 ae d6 7d a8 7b 21 99 30 d6 5b 4d 38 4c e5 9d ac 97 77 f2 04 96 7d 44 72 38 5b 8a 42 f9 7d 06 f9 7d 86 d6 98 c5 ca 1f 0e 14 b2 5a 8e 97 bb ad 1c 2f 39 ce e1 de c0 c7 a2 c6 65 a3 c2 47 5e df 14 2e a2 be 3b e1 de 1a 59 e7 f0 47 75 de 6e aa f3 4b be 6c 9d 2b a5 6a c3 9a b2 83 b3 c0 51 a7 a3 ce 57 e1 52 51 ef 05 de 67 c6 be 2b 8d 71 5a 48 17 21 3d d2 41 f7 9e 6d 38 c8 f4 f5 ae 1b 49 3e 43 81 8d b4 57 98 d6 fe 74 0a 46 dd a6 3b 37 a7 84 64 75 2d 64 35 dd d0 43 7a 7f 21 3d 43 e5 1a a9 cc a3 29 ef 97 6e e3 28 ef 21 91 35 51 d9 76 ad 79 66 ac 51 be 01 b4 49 43 cf d2 7a 9c 7b 63 d9 f6 df a2 7c 99 7a f9 6a 63 43 e5 cb 4f 0d 95 2f 03 e5 33 dc 07 4c 6d 24 19 ee 7f 60 1c 93 b7 69 6d 55 9b 2b f4 a6 f1 76 bd cd c4 4f b6 45 f2 93 53 88 4b 8b d3 Data Ascii: uP+!}{!0[M8Lw}Dr8[B}}Z/9eG^.;YGunKl+jQWRQg+qZH!=Am8I>CWtF;7du-d5Cz!=C)n(!5QvyfQICz{c\|zjcCO/3Lm$`imU+vOESK
2023-12-04 13:24:18 UTC	8000	IN	Data Raw: 42 4e 63 e2 fc aa ad f4 0d 62 c8 da 79 41 9b 63 1e 64 fd c2 45 eb 1d 6d 42 7c 95 e6 d7 11 3f 11 f5 f2 da 94 c7 1d 77 14 4b 39 5b 11 2f 8f 13 f1 b9 33 ae 75 cf 13 92 dc 18 b3 b9 27 22 ae a5 89 f3 e2 e7 a3 ae f7 a0 de b5 f4 33 dc 3d c8 5b e5 f2 75 8e 4b 90 b7 17 d0 36 d6 21 de 37 e9 5b cd 68 5b ce 54 4a 8f e5 1c 47 9b a2 f4 28 1f ee 09 b3 8b 49 be 3f 82 9f 7f e0 f9 3f ae 6a 29 fa ce 90 26 27 6a b3 86 ac 88 7b df b4 44 f6 0f a2 bd ef 11 be 5f 4d 73 8d d6 d4 31 4e 9b c0 26 1d bd 79 c6 fd d4 37 6a 73 64 3f f5 93 07 e3 58 2a f5 99 5b 72 19 c7 24 ea 4b d4 8f fa 81 79 d6 6f 58 6b 9a 25 eb 32 e9 cf 81 5a d2 1d 72 61 8c b2 fb f3 51 e0 cc 92 39 ae 41 41 ef e3 8f 46 e9 e3 0e 71 c4 3e 6e d8 b2 81 cb ca 8f d7 9c 7f af 49 bf 1a 28 e9 5f 9e 50 53 57 6e 1b 3a 2a 15 39 eb Data Ascii: BNcbyAcdEmB\|?wK9[/3u'"3=[uK6!7[h[TJG(I??j)&'j{D_Ms1N&y7jsd?X[r$KyoXk%2ZraQ9AAFq>nI(_PSWn:9
2023-12-04 13:24:18 UTC	8000	IN	Data Raw: 69 3b 0b 63 7e de bf c3 33 d9 ab 46 41 9e cf 40 ae 3b d0 d7 3e e5 f1 39 6b 4f f9 4d cf 25 16 9f 8b 6c 2f d0 7b fb 45 32 13 73 bd ef 84 e7 e0 2f 1d 5f 7c 21 7a f0 53 91 e7 e1 ba 1d fd b9 03 e3 c4 fd 02 99 29 f2 5c 9b 33 8d 75 a9 af c0 3e f0 b1 b1 77 dc f9 a5 58 5f 38 57 3f b5 7c bf d4 e5 23 c7 af 14 65 30 7b 71 68 99 a0 30 3e df f1 62 0e da 92 3b 26 11 62 25 13 e8 a5 79 34 a7 ed 10 d0 1f 84 3e 86 eb c4 38 de 5f d9 49 e8 bc 5d 2c 57 0a cb 83 c4 ca eb f3 60 46 ee 86 64 bc 26 3b b7 97 e7 b4 c3 7e 00 34 31 ff 86 99 eb 7b fc 19 b7 a8 f3 24 28 51 11 c6 82 d3 50 5f e0 98 2d c4 9c a8 a1 9d 2f dc c5 3a 94 9b c9 c5 98 b5 bf 84 f1 3f e1 cc 5c 5c 8b 21 c9 69 61 3d 7e b0 28 a3 47 32 7b f0 1c 87 f7 c2 d0 f7 ad ec ac 59 23 86 27 1a ce 57 a0 bd 0f 3d 26 b8 ae 99 cc c7 f5 Data Ascii: i;c~3FA@;>9kOM%l/{E2s/_\|!zS)\3u>wX_8W?\|#e0{qh0>b;&b%y4>8_I],W`Fd&;~41{$(QP_-/:?\\!ia=~(G2{Y#'W=&
2023-12-04 13:24:18 UTC	8000	IN	Data Raw: da f7 01 3e fd 7a ff 7a 4c e7 11 bc 75 12 bd 75 b0 5f 91 34 bf 69 62 27 87 f1 97 a2 f3 07 b8 68 fe a2 61 35 9b 35 c8 df 21 83 3f e7 41 9f 67 e7 28 fc 45 e3 22 d8 1c 8d bf ce 41 7b 1a c1 9b cb 25 ab 06 6f 0e 9d b7 f2 a1 f6 eb ac 05 ad 4e 49 b8 20 bd 86 de 12 5c ed 25 f2 26 a2 ed be 7d 09 bc f5 9e 0f 67 3b 00 ef 73 b2 37 67 33 c6 e7 d1 67 c1 6e 19 cf 66 e0 59 bc 3a 1b 21 cf ea 4b a8 f3 f5 f3 5a df 8e f6 9d a2 61 09 a6 46 62 63 c6 fb 02 f0 d6 32 f6 96 e1 17 d5 dc a3 f9 46 a3 f9 43 5d 5f 86 3f b4 21 91 fb 43 a7 10 57 36 e8 71 e5 a7 b4 37 e0 31 c6 fb 68 be 30 45 71 bf cf 72 28 c6 bc 06 3c 3f 70 9c ed da 46 f1 24 3e 77 65 94 ab 34 5f f0 08 74 62 32 da 7c 97 99 95 12 ad 99 f8 ee dc 2f 2a fe ba 6b 14 8a a7 63 b5 67 be 34 30 bb 1e 36 5c bc c3 d7 23 6e eb fa 84 60 Data Ascii: >zzLuu_4ib'ha55!?Ag(E"A{%oNI \%&}g;s7g3gnfY:!KZaFbc2FC]_?!CW6q71h0Eqr(<?pF$>we4_tb2\|/*kcg406\#n`
2023-12-04 13:24:18 UTC	8000	IN	Data Raw: 07 2f 58 14 d8 8a d2 96 17 2c f6 c0 1e af fd b9 d7 f4 df af 59 c8 27 38 54 d6 fa 25 3a 7b 6c a7 79 a0 40 11 2b a1 79 a1 ea 22 b4 cb 86 28 19 ee 13 62 ca 90 df e5 03 bd 27 9d 3f 48 67 7d 9f 47 df c3 77 b2 f1 8e 22 99 df 3d e4 c6 a7 20 5c 3e d3 01 bc 3e 5a 33 a4 39 d2 3b 9c a1 62 7d ee d3 5c 19 5b 6f 7e 49 b9 44 d1 bf e9 1c 4a 75 98 05 51 5e f1 75 67 70 ff 63 00 36 e9 76 f4 8d 3f cd d5 ee a6 2a 85 2c 69 ff 10 87 73 69 70 bf c7 bb ee af fb 3d b5 22 53 76 22 26 de 8a 3a 03 1d 5e 7b 7d 86 48 fb 0b 4b c4 3a ed 2e 99 9a 42 51 99 fd 93 70 f3 43 68 f3 03 75 9a ad 58 89 36 5a 99 e1 e4 63 5b fd 7a fd 7c ff 3e b3 e2 10 b4 f6 78 1a ed 61 c0 46 8e 7b ae 22 2d 8f a7 5f 6f b7 7f 05 1c 9b ef eb d9 36 27 a1 e9 0c 6c d6 f2 64 16 9a 3d 8e ed e2 e7 16 5a af 56 9e b9 cb 19 f2 Data Ascii: /X,Y'8T%:{ly@+y"(b'?Hg}Gw"= \>>Z39;b}\[o~IDJuQ^ugpc6v?*,isip="Sv"&:^{}HK:.BQpChuX6Zc[z\|>xaF{"-_o6'ld=ZV
2023-12-04 13:24:18 UTC	8000	IN	Data Raw: 4d 49 d0 ee 46 a3 31 d3 34 de d7 d3 3f ae eb 93 8a f1 3e 0f c9 70 32 6c 97 fb 39 c6 d7 40 97 de c9 ce 2d fd 05 7b b5 62 ae a0 e2 9d 5a dd 20 05 33 f1 be fa 5a 16 a2 33 fd d5 0d 26 b2 77 3d d4 16 d5 4b 58 28 dc 66 b1 53 2c e3 e0 7b 3e 27 45 fa d3 87 a2 e3 1d 99 fc ee c9 43 b0 b1 f8 19 61 77 c1 0b cf eb 99 d4 e8 f9 06 64 b4 4b 62 99 94 3f 81 ee 9e e1 ed 9e 37 7a bb 3b a0 33 7f 84 4d 76 1d 67 8a 76 77 e9 24 9e 3f 21 16 8d 94 23 f5 52 f0 8f 86 3b 1e 5f 85 e0 6b 06 f8 5a 0f be 4c e3 b5 98 90 f0 c5 aa ab 46 1c ca db 4e 30 f1 fa 61 bc ba 9c a8 2b 0b 75 ad 44 5d d4 ee d5 88 7b e5 5b 5d c1 41 5f 87 f8 9d 32 3a bf 24 cb 5a 69 9a 32 74 07 76 e6 08 38 1f c6 84 4b c1 cd ef 9b 02 ee 78 78 e3 f2 96 dc e8 39 ba 40 bf c3 c8 a2 d7 67 19 bd 3e d2 ed 3c c8 c3 3b 45 db 33 9c Data Ascii: MIF14?>p2l9@-{bZ 3Z3&w=KX(fS,{>'ECawdKb?7z;3Mvgvw$?!#R;_kZLFN0a+uD]{[]A_2:$Zi2tv8Kxx9@g><;E3
2023-12-04 13:24:18 UTC	8000	IN	Data Raw: 39 65 fd 3f 18 f8 ae 8e 29 b8 a1 df ee 08 96 19 4e a6 d5 2a df bf dd 35 26 17 07 e4 e2 5f 06 c2 fd 09 c2 09 de f9 f8 3e f8 54 8d 2d f5 15 3e bb 8a 67 d9 8d c3 2c 65 37 e4 b3 fb 71 53 76 b0 fc 7c e5 f6 c9 d1 57 fe 08 94 77 b1 8a 75 f0 9f 29 e3 76 99 e8 71 30 d6 95 01 fb 00 9d 74 99 67 d9 6d ba b4 c8 cd bb 7f 15 97 3d 7c 8c a5 cc 25 f9 44 b2 ca 6a d4 bb 70 e5 69 53 cb d3 b0 2b 44 7d 7b c1 6e 3b 84 ba 5d f3 93 1a 9b e9 43 96 72 68 01 6b 4a 02 cd 37 b8 91 45 44 2f 09 b4 6a 41 b3 57 c6 4d 82 a5 09 34 6b a0 db 1e 95 66 35 68 92 fe 63 a1 7f 81 b1 04 8a 4f 71 48 57 11 17 3f d2 9f f1 6b 45 37 ee ff 52 f4 d1 4e ff 37 14 66 67 a0 cd 1b 78 f2 2b 9e 01 7e 9c fd eb 0c b6 7f 6e c4 cb 88 62 1e 8a 4f ed b5 f7 c9 8b 82 db eb 71 69 f4 91 2c 81 a1 2e af ad 62 8e b5 06 e6 a1 Data Ascii: 9e?)N*5&_>T->g,e7qSv\|Wwu)vq0tgm=\|%DjpiS+D}{n;]CrhkJ7ED/jAWM4kf5hcOqHW?kE7RN7fgx+~nbOqi,.b
2023-12-04 13:24:18 UTC	8000	IN	Data Raw: 29 b4 cf 44 ee 53 b7 65 ca e3 08 b4 76 65 f7 6c b6 59 2e 5b b9 d5 23 8f b1 96 2a e3 3f be 77 be 33 d0 5b a1 4f 7a bf fb 6c a4 a3 9d e7 a5 dd cb 91 be d4 de 9f 7a a6 a5 ae bd c6 28 ed 8e e7 b3 29 de ee 27 05 57 eb 6c 5e 4a dd c2 1c d9 15 de e6 f6 7e a3 dc 66 d1 f8 c4 2a e4 9d d7 63 a0 fd ea 7d b3 2a af f5 b4 87 5e 63 3b 4e 7e ca 9c d3 6c 99 e7 d7 51 76 ca 6f ab 3a cf dd 4a 6b 1c cd cc f1 3f 97 2b 67 dc df c3 b1 2c f9 3d 70 f0 17 f5 dd 1b b4 be 99 de 6d e7 a4 37 d4 77 5d 68 67 9b d8 c8 22 1a 0f a9 85 ec 4c 90 cd 0b e0 f5 8d b3 6f d7 25 b3 ce 78 3a b3 49 19 2b 4a b0 54 cb e3 26 49 ce 5d d1 34 6e 92 20 8f 15 51 3c 8a 43 e3 26 44 e3 db e0 ad 12 74 12 e4 b9 f7 04 79 8e f8 b4 89 da b7 c0 71 1c e3 04 ed 9a 35 e6 82 ed 4b c0 1e e9 f9 41 7b 26 54 fb d2 39 59 fb 12 Data Ascii: )DSevelY.[#?w3[Ozlz()'Wl^J~fc}*^c;N~lQvo:Jk?+g,=pm7w]hg"Lo%x:I+JT&I]4n Q<C&Dtyq5KA{&T9Y

Timestamp	Bytes transferred	Direction	Data
2023-12-04 13:24:19 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-12-04 13:24:19 UTC	436	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 41 70 69 56 65 72 73 69 6f 6e 3a 20 44 69 73 74 72 69 62 75 74 65 20 31 2e 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 63 6f 6e 66 69 67 2e 6a 73 6f 6e 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 55 54 46 2d 38 27 27 63 6f 6e 66 69 67 2e 6a 73 6f 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 54 61 67 3a 20 22 30 78 36 34 36 36 37 46 37 30 37 46 46 30 37 44 36 32 42 37 33 33 44 42 43 42 37 39 45 46 45 33 38 35 35 45 36 38 38 36 43 39 39 37 35 42 30 43 30 42 34 36 37 44 34 36 32 33 31 42 33 46 41 35 45 37 22 0d 0a 4c 61 73 74 2d 4d 6f 64 69 Data Ascii: HTTP/1.1 200 OKApiVersion: Distribute 1.1Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.jsonContent-Type: application/octet-streamETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"Last-Modi

Timestamp	Bytes transferred	Direction	Data
2023-12-04 13:24:19 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-12-04 13:24:20 UTC	774	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 54 75 65 2c 20 31 36 20 4d 61 79 20 32 30 31 37 20 32 32 3a 35 38 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 30 78 36 34 36 36 37 46 37 30 37 46 46 30 37 44 36 32 42 37 33 33 44 42 43 42 37 39 45 46 45 33 38 35 35 45 36 38 38 36 43 39 39 37 35 42 30 43 30 42 34 36 37 44 34 36 32 33 31 42 33 46 41 35 45 37 22 0d 0a 41 70 69 56 65 72 73 69 6f 6e 3a 20 44 69 73 74 72 69 62 75 74 65 20 31 2e 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 63 6f 6e 66 69 67 2e 6a 73 6f 6e 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 55 54 46 2d 38 27 27 63 6f 6e 66 69 67 2e 6a 73 6f 6e 0d 0a 58 2d 43 Data Ascii: HTTP/1.1 200 OKLast-Modified: Tue, 16 May 2017 22:58:00 GMTETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"ApiVersion: Distribute 1.1Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.jsonX-C
2023-12-04 13:24:20 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2023-12-04 13:24:32 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pD8ZeYd1arRPXwn&MD=moArR7gm HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-12-04 13:24:32 UTC	560	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f 6e 2c 20 30 31 20 4a 61 6e 20 30 30 30 31 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 58 41 6f 70 61 7a 56 30 30 58 44 57 6e 4a 43 77 6b 6d 45 57 52 76 36 4a 6b 62 6a 52 41 39 51 53 53 5a 32 2b 65 2f 33 4d 7a 45 6b 3d 5f 32 38 38 30 22 0d 0a 4d 53 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 3a 20 66 64 37 63 66 34 61 61 2d 64 32 65 36 2d 34 32 64 66 2d Data Ascii: HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: application/octet-streamExpires: -1Last-Modified: Mon, 01 Jan 0001 00:00:00 GMTETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"MS-CorrelationId: fd7cf4aa-d2e6-42df-
2023-12-04 13:24:32 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2023-12-04 13:24:32 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2023-12-04 13:25:09 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pD8ZeYd1arRPXwn&MD=moArR7gm HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-12-04 13:25:10 UTC	560	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f 6e 2c 20 30 31 20 4a 61 6e 20 30 30 30 31 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 4d 78 31 52 6f 4a 48 2f 71 45 77 70 57 66 4b 6c 6c 78 37 73 62 73 6c 32 38 41 75 45 52 7a 35 49 59 64 63 73 76 74 54 4a 63 67 4d 3d 5f 32 31 36 30 22 0d 0a 4d 53 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 3a 20 34 34 34 34 65 62 33 65 2d 30 62 37 31 2d 34 66 34 30 2d Data Ascii: HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: application/octet-streamExpires: -1Last-Modified: Mon, 01 Jan 0001 00:00:00 GMTETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160"MS-CorrelationId: 4444eb3e-0b71-4f40-
2023-12-04 13:25:10 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2023-12-04 13:25:10 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	14:24:10
Start date:	04/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	14:24:12
Start date:	04/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2016,i,2334675341297148897,9102047593537286946,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	14:24:14
Start date:	04/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://download.instalki.org/programy/Windows/Multimedia/kodeki/Microsoft.HEVCVideoExtension_2.0.60961.0_neutral_~_8wekyb3d8bbwe.AppxBundle
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	14:25:32
Start date:	04/12/2023
Path:	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe" -ServerName:App.AppX9rwyqtrq9gw3wnmrap9a412nsc7145qh.mca
Imagebase:	0x7ff72d420000
File size:	2'035'200 bytes
MD5 hash:	D4B46459B6A0FB33EB4690FF2B6CE2EF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://download.instalki.org/programy/Windows/Multimedia/kodeki/Microsoft.HEVCVideoExtension_2.0.60961.0_neutral_~_8wekyb3d8bbwe.AppxBundle

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

E-Banking Fraud

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

(copy)

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\Temp\APPX.292jh9wjq193ba21q7ndlsm3.tmp

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\Temp\APPX.3pm4zi4wds_6ynk90tsijp68b.tmp

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\Temp\APPX.801mlz9ersf1xblnyxpu62l9e.tmp

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\Temp\APPX.98p4rbu3k3gdgwo1n2an8_jad.tmp

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\Temp\APPX.9zk2d5vnf4iiuinwfb7cvgzgb.tmp

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\Temp\APPX._5a3yeu95hgt64x8v0zfzrqef.tmp

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\Temp\APPX.b838dv0zyzzcu8y_cvdyeqxkh.tmp

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\Temp\APPX.f28mwy1k8h5lxgw7bqk498_be.tmp

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\Temp\APPX.hd5j8s12ud67xdn4h8xkd2pme.tmp

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\Temp\APPX.ol5izemie70x7nwbj3js5blxd.tmp

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\Temp\APPX.ubu_7zlh5nxsjpysy8hmd42cc.tmp

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalCache\Microsoft.HEVCVideoExtension_2.0.60961.0_x64__8wekyb3d8bbwe{b01fa7b7-fbda-4f1c-a4c6-06d741b2bef9}_temp.pri

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Downloads\349fbd0d-43dd-4625-8144-50c9c8baf6c4.tmp

C:\Users\user\Downloads\Microsoft.HEVCVideoExtension_2.0.60961.0_neutral_~_8wekyb3d8bbwe.AppxBundle.crdownload

Chrome Cache Entry: 70

Static File Info

File Icon

Network Behavior

Windows Analysis Report
https://download.instalki.org/programy/Windows/Multimedia/kodeki/Microsoft.HEVCVideoExtension_2.0.60961.0_neutral_~_8wekyb3d8bbwe.AppxBundle

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre