Edit tour

Windows Analysis Report
ahx8PyqunR.msi

Overview

General Information

Sample name:	ahx8PyqunR.msi renamed because original name is a hash value
Original sample name:	abc72097f51360b0d2ec6cee38f61f2416177e6b4bf55f48ff3221ce58e5ce2b.msi
Analysis ID:	1442379
MD5:	ffa79d6b5eb84e8a714f185eb55278e4
SHA1:	d9841949fc96bb4f72c1cf377333d12fae0f8c5a
SHA256:	abc72097f51360b0d2ec6cee38f61f2416177e6b4bf55f48ff3221ce58e5ce2b
Tags:	bankerdotnetjanela-ratmsi
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Msiexec Initiated Connection

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 5836 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\ahx8PyqunR.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 5988 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 2376 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding F4F39D2FDBE76F97FC567DD010874426 MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Sigma Signatures

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 194.180.191.24, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 2376, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49699

Snort Signatures

ETPRO MALWARE TakeMyFile User-Agent - Source IP: 192.168.2.7 - Destination IP: 54.221.197.204

Timestamp:	05/16/24-04:42:14.345778
SID:	2849814
Source Port:	49700
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE TakeMyFile Installer Checkin - Source IP: 192.168.2.7 - Destination IP: 54.221.197.204

Timestamp:	05/16/24-04:42:14.345778
SID:	2849813
Source Port:	49700
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: unknown

HTTPS traffic detected: 194.180.191.24:443 -> 192.168.2.7:49699 version: TLS 1.2

Source:	Binary string: wininet.pdb source: shi435A.tmp.3.dr
Source:	Binary string: C:\JobRelease\win\Release\bin\x86\embeddeduiproxy.pdb source: ahx8PyqunR.msi, 4a3deb.msi.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: ahx8PyqunR.msi, MSI432F.tmp.2.dr, 4a3deb.msi.2.dr
Source:	Binary string: d3d12.pdbUGP source: shi43C8.tmp.3.dr
Source:	Binary string: d3d12.pdb source: shi43C8.tmp.3.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb\ source: ahx8PyqunR.msi, MSI432F.tmp.2.dr, 4a3deb.msi.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdbu source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr
Source:	Binary string: wininet.pdbUGP source: shi435A.tmp.3.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdb source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: ahx8PyqunR.msi, MSI4291.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI42FF.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbg source: ahx8PyqunR.msi, MSI4291.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI42FF.tmp.2.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2849814 ETPRO MALWARE TakeMyFile User-Agent 192.168.2.7:49700 -> 54.221.197.204:80
Source: Traffic	Snort IDS: 2849813 ETPRO MALWARE TakeMyFile Installer Checkin 192.168.2.7:49700 -> 54.221.197.204:80

Source: Joe Sandbox View

ASN Name: AMAZON-AESUS AMAZON-AESUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic

HTTP traffic detected: GET /v7icosaza/bts.bmp HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: presteservicosaz.pro

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /v7icosaza/bts.bmp HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: presteservicosaz.pro

Source: global traffic	DNS traffic detected: DNS query: presteservicosaz.pro
Source: global traffic	DNS traffic detected: DNS query: collect.installeranalytics.com
Source: global traffic	DNS traffic detected: DNS query: time.windows.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64)Host: collect.installeranalytics.comContent-Length: 167Cache-Control: no-cache

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 16 May 2024 02:42:07 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 283Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: shi435A.tmp.3.dr	String found in binary or memory: http://.css
Source: shi435A.tmp.3.dr	String found in binary or memory: http://.jpg
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr	String found in binary or memory: http://collect.installeranalytics.com
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: shi435A.tmp.3.dr	String found in binary or memory: http://html4/loose.dtd
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: http://t2.symcb.com0
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: http://tl.symcd.com0&
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr	String found in binary or memory: https://collect.installeranalytics.com
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr	String found in binary or memory: https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic
Source: ahx8PyqunR.msi, 4a3deb.msi.2.dr	String found in binary or memory: https://presteservicosaz.pro/v7icosaza/bts.bmp
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	String found in binary or memory: https://www.thawte.com/repository0W

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699

Source: unknown

HTTPS traffic detected: 194.180.191.24:443 -> 192.168.2.7:49699 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4a3deb.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3F33.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3FD1.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4291.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI42FF.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI432F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4DCF.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4DFF.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4E9C.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4ECC.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{4F8A97A7-22E3-4751-BCDE-A81270EE5EA8}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4F3A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5A38.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI3F33.tmp

Jump to behavior

Source: ahx8PyqunR.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs ahx8PyqunR.msi
Source: ahx8PyqunR.msi	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs ahx8PyqunR.msi
Source: ahx8PyqunR.msi	Binary or memory string: OriginalFilenameInstallerAnalytics.dllF vs ahx8PyqunR.msi
Source: ahx8PyqunR.msi	Binary or memory string: OriginalFilenameembeddeduiproxy.dllF vs ahx8PyqunR.msi

Source: shi435A.tmp.3.dr

Binary string: \Device\NameResTrk\RecordNrtCloneOpenPacket

Source: classification engine

Classification label: mal48.winMSI@4/27@3/2

Source: C:\Windows\SysWOW64\msiexec.exe

File created: C:\Users\user\AppData\Local\AdvinstAnalytics

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF0AA2C5A24A268AEC.TMP

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\ahx8PyqunR.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F4F39D2FDBE76F97FC567DD010874426
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F4F39D2FDBE76F97FC567DD010874426	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

File written: C:\Users\user\AppData\Local\AdvinstAnalytics\6644d99620a59ade4c23836a\7.6.8.4\tracking.ini

Jump to behavior

Source: ahx8PyqunR.msi

Static file information: File size 8183792 > 1048576

Source:	Binary string: wininet.pdb source: shi435A.tmp.3.dr
Source:	Binary string: C:\JobRelease\win\Release\bin\x86\embeddeduiproxy.pdb source: ahx8PyqunR.msi, 4a3deb.msi.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: ahx8PyqunR.msi, MSI432F.tmp.2.dr, 4a3deb.msi.2.dr
Source:	Binary string: d3d12.pdbUGP source: shi43C8.tmp.3.dr
Source:	Binary string: d3d12.pdb source: shi43C8.tmp.3.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb\ source: ahx8PyqunR.msi, MSI432F.tmp.2.dr, 4a3deb.msi.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdbu source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr
Source:	Binary string: wininet.pdbUGP source: shi435A.tmp.3.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdb source: ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: ahx8PyqunR.msi, MSI4291.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI42FF.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbg source: ahx8PyqunR.msi, MSI4291.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI42FF.tmp.2.dr

Source: shi43C8.tmp.3.dr

Static PE information: 0x96D7AA59 [Sat Mar 12 16:44:09 2050 UTC]

Source: shi435A.tmp.3.dr	Static PE information: section name: .wpp_sf
Source: shi435A.tmp.3.dr	Static PE information: section name: .didat

Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shi43C8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4E9C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3FD1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4ECC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5A38.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4DCF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI42FF.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shi435A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4291.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4DFF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3F33.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI432F.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4E9C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3FD1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4ECC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5A38.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4DCF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI42FF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4291.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4DFF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3F33.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI432F.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi43C8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI4E9C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI3FD1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5A38.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI4ECC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI4DCF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI42FF.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi435A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI4291.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI4DFF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI3F33.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI432F.tmp	Jump to dropped file

Source: C:\Windows\SysWOW64\msiexec.exe TID: 4856	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 4828	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\msiexec.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: 4a3deb.msi.2.dr

Binary or memory string: 01234567890.0.0.0.%dVMware, Inc.VMware Virtual PlatformVMware7,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IROOT\CIMV2SELECT * FROM Win32_ComputerSystemSELECT * FROM Win32_BIOSManufacturerModelVersionGetting system informationManufacturer [Model [BIOS [IsWow64Processkernel32Software\Microsoft\Windows NT\CurrentVersionSYSTEM\CurrentControlSet\Control\ProductOptionsCurrentMajorVersionNumberCurrentMinorVersionNumberCurrentVersionCurrentBuildNumberReleaseIdCSDVersionProductTypeProductSuiteWinNTServerNTSmall BusinessEnterpriseBackOfficeCommunicationServerTerminal ServerSmall Business(Restricted)EmbeddedNTDataCenterPersonalBladeEmbedded(Restricted)Security ApplianceStorage ServerCompute Server Failed to create IWbemLocator object. Error code: \\Could not connect to WMI provider. Error code: Failed to initialize security. Error code: Could not set proxy blanket. Error code: WQLWMI Query failed: []. Error code:

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	3 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	21 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	32 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ahx8PyqunR.msi	5%	ReversingLabs
ahx8PyqunR.msi	2%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\shi435A.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi435A.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\shi43C8.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi43C8.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSI3F33.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI3F33.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSI3FD1.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI3FD1.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSI4291.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI4291.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSI42FF.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI42FF.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSI432F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI432F.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSI4DCF.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI4DCF.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSI4DFF.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI4DFF.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSI4E9C.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI4E9C.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSI4ECC.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI4ECC.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSI5A38.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5A38.tmp	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
collect.installeranalytics.com	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
windowsupdatebg.s.llnwi.net	0%	Virustotal	Browse
time.windows.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.advancedinstaller.com	0%	URL Reputation	safe
https://www.thawte.com/cps0/	0%	URL Reputation	safe
https://www.thawte.com/repository0W	0%	URL Reputation	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
http://.css	0%	Avira URL Cloud	safe
https://presteservicosaz.pro/v7icosaza/bts.bmp	0%	Avira URL Cloud	safe
http://collect.installeranalytics.com	0%	Avira URL Cloud	safe
http://collect.installeranalytics.com/	0%	Avira URL Cloud	safe
http://.jpg	0%	Avira URL Cloud	safe
https://collect.installeranalytics.com	0%	Avira URL Cloud	safe
http://collect.installeranalytics.com/	0%	Virustotal		Browse
https://presteservicosaz.pro/v7icosaza/bts.bmp	2%	Virustotal		Browse
https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic	0%	Avira URL Cloud	safe
http://collect.installeranalytics.com	0%	Virustotal		Browse
https://collect.installeranalytics.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
collect.installeranalytics.com	54.221.197.204	true	true	0%, Virustotal, Browse	unknown
presteservicosaz.pro	194.180.191.24	true	false		unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown
windowsupdatebg.s.llnwi.net	208.111.136.0	true	false	0%, Virustotal, Browse	unknown
time.windows.com	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://presteservicosaz.pro/v7icosaza/bts.bmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://collect.installeranalytics.com/	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://html4/loose.dtd	shi435A.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://www.advancedinstaller.com	ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	false	URL Reputation: safe	unknown
http://collect.installeranalytics.com	ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.thawte.com/cps0/	ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	false	URL Reputation: safe	unknown
http://.css	shi435A.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://.jpg	shi435A.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://www.thawte.com/repository0W	ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI432F.tmp.2.dr, MSI4291.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, MSI3FD1.tmp.2.dr, MSI4E9C.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr, MSI42FF.tmp.2.dr	false	URL Reputation: safe	unknown
https://collect.installeranalytics.com	ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic	ahx8PyqunR.msi, MSI4ECC.tmp.2.dr, MSI5A38.tmp.2.dr, MSI4DFF.tmp.2.dr, 4a3deb.msi.2.dr, MSI4DCF.tmp.2.dr, MSI3F33.tmp.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
54.221.197.204	collect.installeranalytics.com	United States		14618	AMAZON-AESUS	true
194.180.191.24	presteservicosaz.pro	unknown		39798	MIVOCLOUDMD	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1442379
Start date and time:	2024-05-16 04:41:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ahx8PyqunR.msi renamed because original name is a hash value
Original Sample Name:	abc72097f51360b0d2ec6cee38f61f2416177e6b4bf55f48ff3221ce58e5ce2b.msi
Detection:	MAL
Classification:	mal48.winMSI@4/27@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.119.6.228, 40.68.123.157, 20.242.39.171, 52.165.164.15
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, twc.trafficmanager.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
04:42:03	API Interceptor	3x Sleep call for process: msiexec.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	https://l.mypad.in/OCw8in	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://bencrump.com	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://domclickext.xyz	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://ewual7pkgjtkd.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://xxc51-secondary.z15.web.core.windows.net/werrx01USAHTML/?bcda=1-833-293-0116	Get hash	malicious	TechSupportScam	Browse	192.229.211.108
	https://abrahamgiraldo.com/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://temptingupdates.z13.web.core.windows.net/index.html	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://1-directshipmtdhlsexpress-order.help/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://bafybeiec3wmyxb23wbvdjjxs6plvmpqewunly4ciqcz7m4advmaszql7ru.ipfs.cf-ipfs.com/	Get hash	malicious	HTMLPhisher	Browse	192.229.211.108
	https://large-exuberant-lantern.glitch.me/perm78665an897nt.html	Get hash	malicious	HTMLPhisher	Browse	192.229.211.108
collect.installeranalytics.com	speke.msi	Get hash	malicious	Unknown	Browse	54.165.34.233
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse	54.158.107.210
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse	54.158.107.210
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse	52.7.13.177
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	52.7.13.177
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse	52.7.13.177
	sq5W8v3VZV.exe	Get hash	malicious	Unknown	Browse	54.158.107.210
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	52.7.13.177
	Advanced.Installer-15.9.exe	Get hash	malicious	Unknown	Browse	54.204.90.110
	iguufjAqnn.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer	Browse	54.165.145.62
windowsupdatebg.s.llnwi.net	http://auth.tic.tictoc.ai	Get hash	malicious	Unknown	Browse	208.111.136.128
	https://claytonobrien.autos/twenty/flop/?moon=tBxm3SRH	Get hash	malicious	TechSupportScam	Browse	208.111.136.128
	https://dataweb12.z19.web.core.windows.net/Win01securityMyohelpline0041/index.html	Get hash	malicious	TechSupportScam	Browse	208.111.136.128
	https://tsw87k63wc0.jp.larksuite.com/wiki/Silvw6umRiDii8k3d5EjSVIYpZ2	Get hash	malicious	Unknown	Browse	38.96.206.192
	http://www.tinyurl.com/gamks929sk?pt3kt2YdFUY0XQQZU7seiJ2ZpJZPTXB02_WZcOJZXZlbHluQG5hbGV6eXR5LmNvbcOIPh9QAwFRcL3LXbxrhpGIqUzwaVw	Get hash	malicious	Unknown	Browse	38.96.206.192
	https://7f39c4ee.keloaeadk.pages.dev/	Get hash	malicious	Unknown	Browse	208.111.136.128
	https://dhl-ausparcel-retreive.com/Login/?64686c2d61757370617263656c2d72657472656976652e636f6d	Get hash	malicious	Unknown	Browse	208.111.136.0
	https://biggesttubesite.z13.web.core.windows.net/index.html	Get hash	malicious	TechSupportScam	Browse	208.111.136.0
	https://apieventemitter.com	Get hash	malicious	Unknown	Browse	208.111.136.128
	https://u44366195.ct.sendgrid.net/ls/click?upn=u001.O63XBoM-2FeiLTUnHLzGIceQlz9Js9cqY-2FCLJNEyBdtooo-2BFW1wgrOrLqLNpEzIhvv-2FuGq-2FwU2hCdunUfUDYzy0ob0DvgjCRR3PD8PTSvkkCjIgSC2DX2IZXMrHw1rO8vNb3O-2ByHlafMVOHf560B9bmnbnY0K0X38fsKLvx0lZgC1E-2BrPsyjMBIob5kRD-2BsY8kI5JNCabTMFHdBQtgls2ZsA-3D-3DSwDY_YLW4m0fdfh4ujMTkptdPaCuKK1GzmOQ3Jo4Vfb43nNK07t30-2BLFIal1OAbwycPrZRIAjDMgE0bkhjuEmlj1b3jBKXOuJb91tLmA1QJCfs7lBXlXSa3XMfAeISudHwqVN3MnrLmaCuamZZKRhtcsr-2BYLUMJGNUgt5jssvyUWEBsJS-2FcIaxn2i-2FIRRgPgHkIV0H-2FHmzVcL5Cpl30OW21qAEbHpDAnYo2mX8d0ocj8oKEo-3D	Get hash	malicious	HTMLPhisher	Browse	68.142.107.4
bg.microsoft.map.fastly.net	https://bencrump.com	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://auth.tic.tictoc.ai	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://domclickext.xyz	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://ewual7pkgjtkd.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://xxc51-secondary.z15.web.core.windows.net/werrx01USAHTML/?bcda=1-833-293-0116	Get hash	malicious	TechSupportScam	Browse	199.232.210.172
	https://abrahamgiraldo.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://temptingupdates.z13.web.core.windows.net/index.html	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://bafybeiec3wmyxb23wbvdjjxs6plvmpqewunly4ciqcz7m4advmaszql7ru.ipfs.cf-ipfs.com/	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	https://claytonobrien.autos/twenty/flop/?moon=tBxm3SRH	Get hash	malicious	TechSupportScam	Browse	199.232.210.172
	https://claytonobrien.autos/twenty/flop/?moontBxm3SRH	Get hash	malicious	TechSupportScam	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	https://airtable.com/appSsZHhPikydUCS7/shrIr4TVjqQ1mNmQ0	Get hash	malicious	HTMLPhisher	Browse	18.211.142.209
	https://1-directshipmtdhlsexpress-order.help/	Get hash	malicious	Unknown	Browse	52.55.106.120
	https://large-exuberant-lantern.glitch.me/perm78665an897nt.html	Get hash	malicious	HTMLPhisher	Browse	52.2.135.84
	https://acrobat.adobe.com/id/urn:aaid:sc:EU:b16cefb3-39c1-4a56-9dcd-a9bf6a2b97dd	Get hash	malicious	HTMLPhisher	Browse	18.212.47.155
	msg_Payroll Benefits Encrypted.htm	Get hash	malicious	HTMLPhisher	Browse	54.225.90.78
	https://url2.mailanyone.net/scanner?m=1s6rPP-0008sd-4C&d=4%7Cmail%2F90%2F1715689800%2F1s6rPP-0008sd-4C%7Cin2j%7C57e1b682%7C28613012%7C14303582%7C66435B0BE2CD9AF5D6544C1223A918D6&o=%2Fphtu%3A%2Fptsacblmus.i-mdktcnai.ypos.%2F%2Faicm5sor35feg%2Fa-5ce90-285-f10f8-1963002105daD%2Fc%2FVUdIrElEDsAARo5yA9IeAgIAxRtaA%3F%25ge%3Dtrr27BeTag%252%25ltUA223r%25sh%2522tp%252tF%2553252%25A2wh52tghsFuorew%25.cmat2F252s%2552h%252F%2522C22%25tiRepecOdr2nti3%252%25os5BA%25222%257%25lA2%252ul%253n22C%253%252%2521DlAn7%257%25ultiD%26zes%3Ddg1XyrCPui1PH6vX5ow9XSBON05ZyjxwBE%2527%252bBp3GYb%26s%25DxfersestVrce7%3Dio9585nabd7b3d4ab263bb84fd43ee51eb&s=jhUhAkCpAiNjYs9SORDRIQdvPh0	Get hash	malicious	HTMLPhisher	Browse	3.229.81.248
	https://rb.gy/01bsg6	Get hash	malicious	Unknown	Browse	52.5.33.162
	Environmental Intelligence Remittance.zip	Get hash	malicious	HTMLPhisher	Browse	54.160.164.209
	New Time-Sheet Report May 15 2024.eml	Get hash	malicious	HTMLPhisher	Browse	54.87.148.249
	https://drive.google.com/file/d/11Nff_nSTj-qAFgshL0mhor7fJP9kHxH0/view?usp=drive_web	Get hash	malicious	Quasar	Browse	52.202.204.11
MIVOCLOUDMD	6YGziTTmDp.msi	Get hash	malicious	PrivateLoader, VMdetect	Browse	185.225.19.29
	MUlklsWPpT.msi	Get hash	malicious	PrivateLoader, VMdetect	Browse	185.225.19.95
	M2tc9LNZ8n.msi	Get hash	malicious	VMdetect	Browse	185.225.19.92
	zTegZAXLub.msi	Get hash	malicious	VMdetect	Browse	185.225.19.39
	NFs_76042.msi	Get hash	malicious	PrivateLoader, VMdetect	Browse	185.225.19.92
	yyyyyyyyyyyy.msg	Get hash	malicious	DarkGate, MailPassView	Browse	5.252.177.188
	Phish Alert EXTERNAL SUSPECTED SPAM Re RFQ for SMART 924.msg	Get hash	malicious	DarkGate, MailPassView	Browse	5.252.177.188
	MS_EXCEL_DOCUMENT_HELPER.hta	Get hash	malicious	DarkGate, MailPassView	Browse	5.252.177.188
	reports_239900.html	Get hash	malicious	Unknown	Browse	94.158.244.112
	NFs_98776.msi	Get hash	malicious	VMdetect	Browse	194.180.191.23

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Keys deposit.js	Get hash	malicious	PureLog Stealer	Browse	194.180.191.24
	UCMwrxAxzG.exe	Get hash	malicious	RisePro Stealer	Browse	194.180.191.24
	FI_1000_AR_00008909_20240510_183705.xlsm	Get hash	malicious	Unknown	Browse	194.180.191.24
	zzzzz.xlsm	Get hash	malicious	Unknown	Browse	194.180.191.24
	zzzzz.xlsm	Get hash	malicious	Unknown	Browse	194.180.191.24
	file.exe	Get hash	malicious	Amadey	Browse	194.180.191.24
	http://console.hawaengltd.com	Get hash	malicious	HTMLPhisher	Browse	194.180.191.24
	file.exe	Get hash	malicious	RisePro Stealer	Browse	194.180.191.24
	91trXZr1Ts.exe	Get hash	malicious	LummaC	Browse	194.180.191.24
	uVFobVTcu5.xlsx	Get hash	malicious	Unknown	Browse	194.180.191.24

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\shi435A.tmp	speke.msi	Get hash	malicious	Unknown	Browse
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse
	sq5W8v3VZV.exe	Get hash	malicious	Unknown	Browse
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse
	Advanced.Installer-15.9.exe	Get hash	malicious	Unknown	Browse
	iguufjAqnn.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer	Browse
C:\Users\user\AppData\Local\Temp\shi43C8.tmp	speke.msi	Get hash	malicious	Unknown	Browse
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse
	sq5W8v3VZV.exe	Get hash	malicious	Unknown	Browse
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse
	Advanced.Installer-15.9.exe	Get hash	malicious	Unknown	Browse
	iguufjAqnn.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\AdvinstAnalytics\6644d99620a59ade4c23836a\7.6.8.4\tracking.ini

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.0081320258334
Encrypted:	false
SSDEEP:	3:1EyEMyvn:1BEN
MD5:	6BC190DD42A169DFA14515484427FC8E
SHA1:	B53BD614A834416E4A20292AA291A6D2FC221A5E
SHA-256:	B3395B660EB1EDB00FF91ECE4596E3ABE99FA558B149200F50AABF2CB77F5087
SHA-512:	5B7011ED628B673217695809A38A800E9C8A42CEB0C54AB6F8BC39DBA0745297A4FBD66D6B09188FCC952C08217152844DFC3ADA7CF468C3AAFCEC379C0B16B6
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[General]..Active = true..

C:\Users\user\AppData\Local\AdvinstAnalytics\6644d99620a59ade4c23836a\7.6.8.4\{D8AEF8C3-CEF6-431D-A272-E1D18ECE6B1E}.session

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13388
Entropy (8bit):	5.383254782224033
Encrypted:	false
SSDEEP:	384:2kPzn8D9CM5vqKkD8aJs947KfLJh66qDsGmF4uOwyBeg4DN:2kPzn8D9CM5vqKkD8aJs947KfLf66qDq
MD5:	3AA8AF9B163AED48F684CF1D4ABA7697
SHA1:	47507352198F0B95116D27FFC11D512B553E27FE
SHA-256:	D5F9717F7F8984703F4D155B83C4B48CD92C2045E7C8F3783CD6ED34B43DF715
SHA-512:	02BDC7A1108EB23BE588E21F98D7E5345DC36A5709D985D6FAEC052E07C29F9A372DF4376D9EDE850B7F511DAFD51F3F59D0D0D8778F8720A3FFB834FB969B3C
Malicious:	false
Reputation:	low
Preview:	[Hit {025EC8A1-EB6F-44D8-A85E-4543A9657292}]..Queue Time = 31..Hit Type = lifecycle..Life control = start..Protocol Version = 3..Application ID = 6644d99620a59ade4c23836a..Application Version = 7.6.8.4..Client ID = 40801375D2DBA40CA91A388E8E9D0713A6250E8F..Session ID = {D8AEF8C3-CEF6-431D-A272-E1D18ECE6B1E}....[Hit {47DE1FD3-60E5-421D-8653-566339F57224}]..Queue Time = 0..Hit Type = property..Label = VersionNT..Value = 1000..Protocol Version = 3..Application ID = 6644d99620a59ade4c23836a..Application Version = 7.6.8.4..Client ID = 40801375D2DBA40CA91A388E8E9D0713A6250E8F..Session ID = {D8AEF8C3-CEF6-431D-A272-E1D18ECE6B1E}....[Hit {CB892975-C606-404D-872B-B59CC2BAAC4D}]..Queue Time = 0..Hit Type = property..Label = VersionNT64..Value = 1000..Protocol Version = 3..Application ID = 6644d99620a59ade4c23836a..Application Version = 7.6.8.4..Client ID = 40801375D2DBA40CA91A388E8E9D0713A6250E8F..Session ID = {D8AEF8C3-CEF6-431D-A272-E1D18ECE6B1E}....[Hit {84B90396-589B-4B38-A8D7-A43CEA8D1B37}]

C:\Users\user\AppData\Local\Temp\shi435A.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4509696
Entropy (8bit):	6.100941182830929
Encrypted:	false
SSDEEP:	49152:jm+XAVAMPLfOyim8iTRxYUOQSfLTZZZ2y38lb7Cjn3mboy4+MT7ujWx/Tl0ng48e:CzVAwiKTOpfLTDQyaNoy787ujWx/TlR
MD5:	F6153E803F1533042AC7E6988237C2C3
SHA1:	DDA81BB8BC8CC14877C9CB9B7C664DEFD81EBB4F
SHA-256:	F42A771D310C762C05A5BE3DE0CFDB9BEC28D3DFCCAEF800C901F551A0DF30ED
SHA-512:	7AE76A4CB58A9929C09B1D6376073268622C74B1E3F0C346AFA7A7829E2EF136CCF091F58CCA28BFE83C665573C23D9DB6AF51A44275DA0CC2CF8C1306ADDBAC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: speke.msi, Detection: malicious, Browse Filename: d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe, Detection: malicious, Browse Filename: d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe, Detection: malicious, Browse Filename: 69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe, Detection: malicious, Browse Filename: w1J9KDIC0m.exe, Detection: malicious, Browse Filename: 69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe, Detection: malicious, Browse Filename: sq5W8v3VZV.exe, Detection: malicious, Browse Filename: w1J9KDIC0m.exe, Detection: malicious, Browse Filename: Advanced.Installer-15.9.exe, Detection: malicious, Browse Filename: iguufjAqnn.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.._.._..V.X.=..K..S..K..X..K..W.._.....K..^..K..-..K..D..K.4.^..K..^..Rich_..........................PE..L....+.X...........!.....dA.........P.3.......A....c.........................@E.......E...@A.........................i@.K&..L.A.......B.H.....................D..-......T....................O...... .................A.H....C@......................text.....@.......@................. ..`.wpp_sf.......@.......@............. ..`.data....6....A......hA.............@....idata...1....A..2...nA.............@..@.didat..4.....B.......A.............@....rsrc...H.....B.......A.............@..@.reloc...-....D.......C.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shi43C8.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83128
Entropy (8bit):	6.654653670108596
Encrypted:	false
SSDEEP:	1536:0jIdYoF2CwmzOVStYMAuNWrmaTk++ouMOczT0ud4x41xmPS:0jRoFZwmr+bDk/MOcv0G4sxm
MD5:	125B0F6BF378358E4F9C837FF6682D94
SHA1:	8715BEB626E0F4BD79A14819CC0F90B81A2E58AD
SHA-256:	E99EAB3C75989B519F7F828373042701329ACBD8CEADF4F3FF390F346AC76193
SHA-512:	B63BB6BFDA70D42472868B5A1D3951CF9B2E00A7FADB08C1F599151A1801A19F5A75CFC3ACE94C952CFD284EB261C7D6F11BE0EBBCAA701B75036D3A6B442DB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: speke.msi, Detection: malicious, Browse Filename: d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe, Detection: malicious, Browse Filename: d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe, Detection: malicious, Browse Filename: 69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe, Detection: malicious, Browse Filename: w1J9KDIC0m.exe, Detection: malicious, Browse Filename: 69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe, Detection: malicious, Browse Filename: sq5W8v3VZV.exe, Detection: malicious, Browse Filename: w1J9KDIC0m.exe, Detection: malicious, Browse Filename: Advanced.Installer-15.9.exe, Detection: malicious, Browse Filename: iguufjAqnn.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.T...:...:...:.....&.:...9...:...;...:...;...:...:...:...4...:...?...:......:...>...:......:...8...:.Rich..:.................PE..L...Y.............!.........H.......n..............................................;.....@A........................P........B.......`............... ...$...p..........T............................................@...............................text.../........................... ..`.data....!..........................@....idata..H....@......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\snoop.ses

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.2516291673878226
Encrypted:	false
SSDEEP:	3:gpyn:g4n
MD5:	A067F5EC97BA51B576825B69BC855E58
SHA1:	907D296538A45D5B593512881D721C7D347B8E04
SHA-256:	CF3E339D25C3C023C9417FFC5D8E73F1DA828B18FEECAF14FDB9C24D04E49BA0
SHA-512:	F6058F37CF764E6CD807D9C0E9DE881849E4C94EC1D2E0C0EB504ABF77147E77CB09113B087E1C10E790C3EC45780E5986D29B2A84B364C5F697F884B1549F4D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	NULL..

C:\Windows\Installer\4a3deb.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {11E5E293-7A17-400D-B5B1-C5B73318ED6A}, Number of Words: 10, Subject: KJDUR NRR MR, Author: KJDUR NRR MR, Name of Creating Application: Advanced Installer 18.3 build e2a0201b, Template: ;1046, Comments: A base dados do instalador contm a lgicaKJDUR NRR MR cessrios para instalar o KJDUR NRR MR., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	8183792
Entropy (8bit):	7.786766319454845
Encrypted:	false
SSDEEP:	196608:F9YuWsRVjVJFAoGgSWhGGO9AaLF+AXvkmxxrRq:F99WsRVj7esoqax+g9Fq
MD5:	FFA79D6B5EB84E8A714F185EB55278E4
SHA1:	D9841949FC96BB4F72C1CF377333D12FAE0F8C5A
SHA-256:	ABC72097F51360B0D2EC6CEE38F61F2416177E6B4BF55F48FF3221CE58E5CE2B
SHA-512:	667B0A6025B629F02A096C245842117782DE12C10216BE2ACBAF3205F8FB19578985B1306B0D10555E532D708F93268861175DE7A72ABB02FC7BEB6E15E99A49
Malicious:	false
Preview:	......................>...................&...................................................................................................................J...K...L...M...N...O...P...Q...R...S...T...U...............................................................................................................................................................................................................................................................................................................................c...............%...7........................................................................................... ...!..."...#...$.../...0...'...(...)...*...+...,...-...........1...5...2...3...4...8...6...@...C...9...:...;...<...=...>...?...Q...A...B...H...D...E...F...G...p...a...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`.......b...d...u...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...v.......w...x...y...z...

C:\Windows\Installer\MSI3F33.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI3FD1.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388064
Entropy (8bit):	6.407392408414975
Encrypted:	false
SSDEEP:	6144:U7C5QB3/CNG2HBOqf2BLuoZSKYfuAO8DOE09VKYnyZwYW:qB3WBOG2BPDKSf9VtyZNW
MD5:	20C782EB64C81AC14C83A853546A8924
SHA1:	A1506933D294DE07A7A2AE1FBC6BE468F51371D6
SHA-256:	0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
SHA-512:	AFF21E3E00B39F8983D101A0C616CA84CC3DC72D6464A0DD331965CF6BECCF9B45025A7DB2042D6E8B05221D3EB5813445C8ADA69AE96E2727A607398A3DE3D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......b2..&S..&S..&S..28..+S..28..S...'..)S...'..1S...'..aS..28..?S..28..'S..28..;S..&S..wR...'..tS...'..'S...'+.'S..&SC.'S...'..'S..Rich&S..........................PE..L.....`.........."!.................Z..............................................a.....@.........................@n.......v..........0.......................d?..X...p...............................@............... ............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...0...........................@..@.reloc..d?.......@..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4291.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388064
Entropy (8bit):	6.407392408414975
Encrypted:	false
SSDEEP:	6144:U7C5QB3/CNG2HBOqf2BLuoZSKYfuAO8DOE09VKYnyZwYW:qB3WBOG2BPDKSf9VtyZNW
MD5:	20C782EB64C81AC14C83A853546A8924
SHA1:	A1506933D294DE07A7A2AE1FBC6BE468F51371D6
SHA-256:	0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
SHA-512:	AFF21E3E00B39F8983D101A0C616CA84CC3DC72D6464A0DD331965CF6BECCF9B45025A7DB2042D6E8B05221D3EB5813445C8ADA69AE96E2727A607398A3DE3D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......b2..&S..&S..&S..28..+S..28..S...'..)S...'..1S...'..aS..28..?S..28..'S..28..;S..&S..wR...'..tS...'..'S...'+.'S..&SC.'S...'..'S..Rich&S..........................PE..L.....`.........."!.................Z..............................................a.....@.........................@n.......v..........0.......................d?..X...p...............................@............... ............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...0...........................@..@.reloc..d?.......@..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI42FF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388064
Entropy (8bit):	6.407392408414975
Encrypted:	false
SSDEEP:	6144:U7C5QB3/CNG2HBOqf2BLuoZSKYfuAO8DOE09VKYnyZwYW:qB3WBOG2BPDKSf9VtyZNW
MD5:	20C782EB64C81AC14C83A853546A8924
SHA1:	A1506933D294DE07A7A2AE1FBC6BE468F51371D6
SHA-256:	0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
SHA-512:	AFF21E3E00B39F8983D101A0C616CA84CC3DC72D6464A0DD331965CF6BECCF9B45025A7DB2042D6E8B05221D3EB5813445C8ADA69AE96E2727A607398A3DE3D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......b2..&S..&S..&S..28..+S..28..S...'..)S...'..1S...'..aS..28..?S..28..'S..28..;S..&S..wR...'..tS...'..'S...'+.'S..&SC.'S...'..'S..Rich&S..........................PE..L.....`.........."!.................Z..............................................a.....@.........................@n.......v..........0.......................d?..X...p...............................@............... ............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...0...........................@..@.reloc..d?.......@..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI432F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	878560
Entropy (8bit):	6.452749824306929
Encrypted:	false
SSDEEP:	24576:QK8S3AccKkqSojmrhCMou5vk3Y+ukDln/hFRFNUEekB:QK8tKk5ojmrhCMz5vk3ukDln/hFRFNU0
MD5:	D51A7E3BCE34C74638E89366DEEE2AAB
SHA1:	0E68022B52C288E8CDFFE85739DE1194253A7EF0
SHA-256:	7C6BDF16A0992DB092B7F94C374B21DE5D53E3043F5717A6EECAE614432E0DF5
SHA-512:	8ED246747CDD05CAC352919D7DED3F14B1E523CCC1F7F172DB85EED800B0C5D24475C270B34A7C25E7934467ACE7E363542A586CDEB156BFC484F7417C3A4AB0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j{..............`.......`..W...<.......<.......<.......`.......`.......`..............>.......>.......>...............>.......Rich....................PE..L...}.`.........."!.........\|...........................................................@............................t...T........................N..............X}..p....................~.......}..@............................................text............................... ..`.rdata..............................@..@.data...\...........................@....rsrc................^..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4DCF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4DFF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4E9C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388064
Entropy (8bit):	6.407392408414975
Encrypted:	false
SSDEEP:	6144:U7C5QB3/CNG2HBOqf2BLuoZSKYfuAO8DOE09VKYnyZwYW:qB3WBOG2BPDKSf9VtyZNW
MD5:	20C782EB64C81AC14C83A853546A8924
SHA1:	A1506933D294DE07A7A2AE1FBC6BE468F51371D6
SHA-256:	0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
SHA-512:	AFF21E3E00B39F8983D101A0C616CA84CC3DC72D6464A0DD331965CF6BECCF9B45025A7DB2042D6E8B05221D3EB5813445C8ADA69AE96E2727A607398A3DE3D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......b2..&S..&S..&S..28..+S..28..S...'..)S...'..1S...'..aS..28..?S..28..'S..28..;S..&S..wR...'..tS...'..'S...'+.'S..&SC.'S...'..'S..Rich&S..........................PE..L.....`.........."!.................Z..............................................a.....@.........................@n.......v..........0.......................d?..X...p...............................@............... ............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...0...........................@..@.reloc..d?.......@..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4ECC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4F3A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	2426
Entropy (8bit):	5.574248892317593
Encrypted:	false
SSDEEP:	48:RzU1yhlA4ngGdv314+mQ1AX6AI31ZuOEnY14Xj3v/QI6fty72hpXN1w:RzUElAURpmQ1i6haOEYOz3vorfRp9W
MD5:	567A21F7511D4C1AFE23719F2B5D407E
SHA1:	5C1C81895A715DE71EEDAC8BBE6E5824850FC71A
SHA-256:	10358646B79581E9C885C0D511A20A97CB4AAFCA6210A4E5E5EBAA5814A0CCE8
SHA-512:	ECE433E99825E54A5688DEA8DD9B36F384ED8EC774C76F8B2118F35F9455A0192997C282CE5E877762E02F580169957230142304615421CAF2349DBC52D098C6
Malicious:	false
Preview:	...@IXOS.@.....@B%.X.@.....@.....@.....@.....@.....@......&.{4F8A97A7-22E3-4751-BCDE-A81270EE5EA8}..KJDUR NRR MR..ahx8PyqunR.msi.@.....@.....@.....@........&.{11E5E293-7A17-400D-B5B1-C5B73318ED6A}.....@.....@.....@.....@.......@.....@.....@.......@......KJDUR NRR MR......Rollback..A.....o. .d.e. .r.e.s.t.a.u.r.a.....o.....RollbackCleanup..Removendo arquivos de backup..Arquivo: [1]...@.......@........ProcessComponents%.Atualizando o registro de componentes...@.....@.....@.]....&.{7399CE35-7852-4BF6-A7DD-751EBE4A4179}=.C:\Users\user\AppData\Roaming\KJDUR NRR MR\KJDUR NRR MR\.@.......@.....@.....@......&.{35330EDD-EA65-4DE8-9D1E-5B2B20683601}..01:\Software\KJDUR NRR MR\KJDUR NRR MR\Version.@.......@.....@.....@......&.{08F8CDE5-1AA2-4B59-8198-C0615019CD3F}M.01:\Software\KJDUR NRR MR\{4F8A97A7-22E3-4751-BCDE-A81270EE5EA8}\AI_IA_ENABLE.@.......@.....@.....@........CreateFolders..Criando novas pastas..Pasta: [1]".=.C:\Users\user\AppData\Roaming\KJDUR NRR MR\KJDUR NRR MR\.@........W

C:\Windows\Installer\MSI5A38.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{4F8A97A7-22E3-4751-BCDE-A81270EE5EA8}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1641951888377486
Encrypted:	false
SSDEEP:	12:JSbX72FjE/liAGiLIlHVRpZh/7777777777777777777777777vDHFzi/chit/lN:JGIQI5tVKiF
MD5:	B2C627E56547331D3A371287B313EC18
SHA1:	CDC4E19DF2D2FC6BAF517AF2D06D96114A16287B
SHA-256:	2E068B487146F864C2CBBB8FC3C19A5505DF2152691FA440822053FBEFDFC7C1
SHA-512:	225ADBE125BA5AB4B2D170BEF7A1D28F9B2B6CF40345F92C6286EFC801A8CEC0717413B57447452B5690E14AA02D1847200BE7D7A7FB404D4F940A4FF5470A39
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.8413178665023457
Encrypted:	false
SSDEEP:	48:QFS8PhhuRc06WXJMFT5OT36PmeS+PmEAE+lCyozTMS8xfoHswXGcp4ru2xBxYxMP:whh1vFTcT36vrSZlCc5co2WG7vrW+
MD5:	A419FBE7A1BB84055FF25439953CC181
SHA1:	8FBC32194B44DBFDB0274CAF867FB511A1969DAA
SHA-256:	758EF2832F125535064ECA12CB95191767F9889960C51C6DEFDD9FA9D3B05CDA
SHA-512:	361F221CE325B8EA9342E859724C3D7514CE7F7AD700467200C730C0F0757769A161D934DC1CCE811E437B5F5DA4A7511C7FD14EBD4342666F36436223F9B11E
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362980550701125
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgau0:zTtbmkExhMJCIpEp
MD5:	C536D612700ACB798D779D1A59A88D29
SHA1:	B98FC883DC22AF599D9E73B6216C24BCD86F40AD
SHA-256:	59707798634B7E7219C09E1B7515F3C1046DB5FA778A8EE7DAA65C31B8AC6F6D
SHA-512:	BE87C4F1C5209F5FFCFB551035B83EC069A81DEBFD2F899E40818D31DEDB38380E7F56F4D74FCCD700BF9ABDD7B19F3274FE22FCC2853E6814C49F9655955D49
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF05E8441A682C8DC6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2078276780531825
Encrypted:	false
SSDEEP:	48:khwZuNO+CFXJBT55UVyfT36PmeS+PmEAE+lCyozTMS8xfoHswXGcp4ru2xBxYxMP:3ZFZT38ST36vrSZlCc5co2WG7vrW+
MD5:	785AF0E56C1F59175DD5C2B6EABE1C2B
SHA1:	344F6C0439B35B2EA2D14692A5E9B95DCC4EDEA1
SHA-256:	46C2DD6E1AB0881484211F660DCE7729FE6453331B1F59E34F9E22AC3C124FA3
SHA-512:	60205B57E037DDD53CF06C07D8DB41E04A12E1E5EA74B38AD32A1267EEC25597EABADCB26ADA3F99F264E0B96409AF885D0198A14E01F79D0E33A8B7B46E040F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0AA2C5A24A268AEC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.30635473637740857
Encrypted:	false
SSDEEP:	48:YU162ETSPmeS+PmbPmeS+PmEAE+lCyozTMS8xfoHswXGcp4ru2xBxYxMxqxrxbxC:Y+zvrCvrSZlCc5co2WGQ3D
MD5:	AD182CD4448C843AAACF91CD84ED7E15
SHA1:	482B0F9A3AA2532D72CAB242491478E79DCB3461
SHA-256:	BF1C48A67874B6C4D9B6301B98C90C52ECBA5DA7670FF619FA53A2FA703B0FAE
SHA-512:	DEE046A86DB55221463E5280C6C049F4AD11328F4E2EF04AF007D277FDC0B863139249AEC9F4A58003530CB3978A12084D2F2C85B1BFCB57DB71C0897DE9A840
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9FF3B395E69518BF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.8413178665023457
Encrypted:	false
SSDEEP:	48:QFS8PhhuRc06WXJMFT5OT36PmeS+PmEAE+lCyozTMS8xfoHswXGcp4ru2xBxYxMP:whh1vFTcT36vrSZlCc5co2WG7vrW+
MD5:	A419FBE7A1BB84055FF25439953CC181
SHA1:	8FBC32194B44DBFDB0274CAF867FB511A1969DAA
SHA-256:	758EF2832F125535064ECA12CB95191767F9889960C51C6DEFDD9FA9D3B05CDA
SHA-512:	361F221CE325B8EA9342E859724C3D7514CE7F7AD700467200C730C0F0757769A161D934DC1CCE811E437B5F5DA4A7511C7FD14EBD4342666F36436223F9B11E
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC7DA4418694E58CE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD495FE53232D82C5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07152163661010089
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOJUETsf/cHstgVky6lit/:2F0i8n0itFzDHFzi/cMZit/
MD5:	FEC8535399A693349BD6357222EBF66E
SHA1:	CB267CA3FBD421B5915454DC9469A2B8ACF82609
SHA-256:	811F66CD3940ECD67F3C04C3923BE4F88B6A60301196AEF1BC1D67C62EAF0333
SHA-512:	CDEFC0B7C05D27A4D26FD07BB2181B31483C0B1BAEE65E0E87FEDE1DEF83C0E7D2A946009B127A3EA11CFB01EB8C8F457492EBF61F6195407108877E37489197
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFAEF90E705AE94BD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

**\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON**

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.588108324205336
Encrypted:	false
SSDEEP:	3:ydlX85I2Y1AnLU1lt8lLn:yndG4KLn
MD5:	6F1BAC6EDA8D866AFEB95600956E8750
SHA1:	DFCE213AB1708243B3E374DFA3655C9F1BD4DA41
SHA-256:	F53A138DB745D42A259C18B83B91EE17A7800E5AB7D1B3A8FF1DED4D6B6DA3FD
SHA-512:	D423E97BABF5497DA2A18A829101FE478D6D7C640F6D107EC100318708007F327C4E9A647BD617123DA7F9809E720AB03A11A660949274E26D8402403C58CF95
Malicious:	false
Preview:	....8.1.8.2.2.5.....\MAILSLOT\NET\GETDCF783EE75.................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {11E5E293-7A17-400D-B5B1-C5B73318ED6A}, Number of Words: 10, Subject: KJDUR NRR MR, Author: KJDUR NRR MR, Name of Creating Application: Advanced Installer 18.3 build e2a0201b, Template: ;1046, Comments: A base dados do instalador contm a lgicaKJDUR NRR MR cessrios para instalar o KJDUR NRR MR., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Entropy (8bit):	7.786766319454845
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	ahx8PyqunR.msi
File size:	8'183'792 bytes
MD5:	ffa79d6b5eb84e8a714f185eb55278e4
SHA1:	d9841949fc96bb4f72c1cf377333d12fae0f8c5a
SHA256:	abc72097f51360b0d2ec6cee38f61f2416177e6b4bf55f48ff3221ce58e5ce2b
SHA512:	667b0a6025b629f02a096c245842117782de12c10216be2acbaf3205f8fb19578985b1306b0d10555e532d708f93268861175de7a72abb02fc7beb6e15e99a49
SSDEEP:	196608:F9YuWsRVjVJFAoGgSWhGGO9AaLF+AXvkmxxrRq:F99WsRVj7esoqax+g9Fq
TLSH:	9686021275CA8732EA7E8534A5BADB3664FA3FE01BB194DF63D4192A0E705C201B1F17
File Content Preview:	........................>...................&...................................................................................................................J...K...L...M...N...O...P...Q...R...S...T...U..................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/16/24-04:42:14.345778	TCP	2849814	ETPRO MALWARE TakeMyFile User-Agent	49700	80	192.168.2.7	54.221.197.204
05/16/24-04:42:14.345778	TCP	2849813	ETPRO MALWARE TakeMyFile Installer Checkin	49700	80	192.168.2.7	54.221.197.204

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 16, 2024 04:42:06.417944908 CEST	49699	443	192.168.2.7	194.180.191.24
May 16, 2024 04:42:06.417980909 CEST	443	49699	194.180.191.24	192.168.2.7
May 16, 2024 04:42:06.418051958 CEST	49699	443	192.168.2.7	194.180.191.24
May 16, 2024 04:42:06.429291010 CEST	49699	443	192.168.2.7	194.180.191.24
May 16, 2024 04:42:06.429306030 CEST	443	49699	194.180.191.24	192.168.2.7
May 16, 2024 04:42:06.999833107 CEST	443	49699	194.180.191.24	192.168.2.7
May 16, 2024 04:42:06.999908924 CEST	49699	443	192.168.2.7	194.180.191.24
May 16, 2024 04:42:07.002636909 CEST	49699	443	192.168.2.7	194.180.191.24
May 16, 2024 04:42:07.002645016 CEST	443	49699	194.180.191.24	192.168.2.7
May 16, 2024 04:42:07.002902985 CEST	443	49699	194.180.191.24	192.168.2.7
May 16, 2024 04:42:07.045983076 CEST	49699	443	192.168.2.7	194.180.191.24
May 16, 2024 04:42:07.049182892 CEST	49699	443	192.168.2.7	194.180.191.24
May 16, 2024 04:42:07.092123985 CEST	443	49699	194.180.191.24	192.168.2.7
May 16, 2024 04:42:07.550837040 CEST	443	49699	194.180.191.24	192.168.2.7
May 16, 2024 04:42:07.551037073 CEST	443	49699	194.180.191.24	192.168.2.7
May 16, 2024 04:42:07.551094055 CEST	49699	443	192.168.2.7	194.180.191.24
May 16, 2024 04:42:07.553788900 CEST	49699	443	192.168.2.7	194.180.191.24
May 16, 2024 04:42:07.553803921 CEST	443	49699	194.180.191.24	192.168.2.7
May 16, 2024 04:42:07.553817987 CEST	49699	443	192.168.2.7	194.180.191.24
May 16, 2024 04:42:07.553822994 CEST	443	49699	194.180.191.24	192.168.2.7
May 16, 2024 04:42:08.357626915 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:08.489718914 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:08.489814997 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:08.490015030 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:08.490144014 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:08.621975899 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:08.622047901 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:08.629513979 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:08.629576921 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:08.790291071 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:08.790540934 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:08.922486067 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:08.929481030 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:08.929697990 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:08.935235023 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:08.935336113 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.067382097 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:09.077168941 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:09.077266932 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.080255985 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.080298901 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.212272882 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:09.219554901 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:09.219639063 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.223685026 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.223722935 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.355710030 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:09.370189905 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:09.370317936 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.376192093 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.376192093 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.508172035 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:09.515156031 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:09.515228987 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.520294905 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.520433903 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.652369976 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:09.660440922 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:09.660499096 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.661719084 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.661895037 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.793824911 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:09.800803900 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:09.800885916 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.801894903 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.802011013 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.934506893 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:09.946228981 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:09.946320057 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.947459936 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:09.947540998 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.079473972 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:10.087580919 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:10.087788105 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.089412928 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.089443922 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.221435070 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:10.228492022 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:10.228595972 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.230223894 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.230285883 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.364821911 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:10.372190952 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:10.372277975 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.373547077 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.373624086 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.505542994 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:10.512823105 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:10.512895107 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.514081955 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.514133930 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.646073103 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:10.654156923 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:10.654215097 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.656063080 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.656105995 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.789071083 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:10.796681881 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:10.796746016 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.798016071 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.798118114 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.929995060 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:10.937678099 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:10.937753916 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.939299107 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:10.939451933 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.071360111 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:11.078484058 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:11.078807116 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.129023075 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.129165888 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.261121035 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:11.267376900 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:11.267435074 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.270662069 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.270750046 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.402770996 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:11.410870075 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:11.410942078 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.412802935 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.412854910 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.545790911 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:11.555500031 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:11.555557013 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.556766033 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.556766033 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.689428091 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:11.696563005 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:11.696639061 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.697784901 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.697845936 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.829802036 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:11.836520910 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:11.837112904 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.838390112 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.838426113 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.970350027 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:11.978198051 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:11.978287935 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.979671001 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:11.979722023 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.111768007 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:12.118927956 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:12.119009018 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.120992899 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.121037960 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.253015995 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:12.260911942 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:12.260981083 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.262370110 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.262440920 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.394354105 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:12.401886940 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:12.401954889 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.403271914 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.403351068 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.535229921 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:12.543386936 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:12.543489933 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.544778109 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.544816971 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.678071976 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:12.685200930 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:12.685281992 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.686405897 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.686486006 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.818444967 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:12.825625896 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:12.825720072 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.845892906 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.845944881 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.977936983 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:12.984716892 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:12.984776974 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.986229897 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:12.986267090 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.118199110 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:13.126019955 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:13.126096010 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.127391100 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.127458096 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.259357929 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:13.266900063 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:13.267107010 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.268435001 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.268518925 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.400445938 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:13.407656908 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:13.407716036 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.409476042 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.409503937 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.541465044 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:13.549118996 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:13.550822020 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.623631001 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.623744011 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.755619049 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:13.763701916 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:13.763767958 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.765256882 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.765333891 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.897222996 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:13.904340982 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:13.904412031 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.906250954 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:13.906440020 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:14.038410902 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:14.048527002 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:14.048589945 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:14.049762011 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:14.049817085 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:14.181807041 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:14.189699888 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:14.191239119 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:14.205003023 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:14.205075979 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:14.337018013 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:14.344145060 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:14.344202042 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:14.345777988 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:14.345798016 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:14.477763891 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:14.493298054 CEST	80	49700	54.221.197.204	192.168.2.7
May 16, 2024 04:42:14.494893074 CEST	49700	80	192.168.2.7	54.221.197.204
May 16, 2024 04:42:14.780926943 CEST	49700	80	192.168.2.7	54.221.197.204

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 16, 2024 04:42:06.060910940 CEST	50938	53	192.168.2.7	1.1.1.1
May 16, 2024 04:42:06.388176918 CEST	53	50938	1.1.1.1	192.168.2.7
May 16, 2024 04:42:08.229661942 CEST	58807	53	192.168.2.7	1.1.1.1
May 16, 2024 04:42:08.351625919 CEST	53	58807	1.1.1.1	192.168.2.7
May 16, 2024 04:42:12.852288961 CEST	62421	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 16, 2024 04:42:06.060910940 CEST	192.168.2.7	1.1.1.1	0x2c0	Standard query (0)	presteservicosaz.pro	A (IP address)	IN (0x0001)	false
May 16, 2024 04:42:08.229661942 CEST	192.168.2.7	1.1.1.1	0x4539	Standard query (0)	collect.installeranalytics.com	A (IP address)	IN (0x0001)	false
May 16, 2024 04:42:12.852288961 CEST	192.168.2.7	1.1.1.1	0x6dd0	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 16, 2024 04:42:06.388176918 CEST	1.1.1.1	192.168.2.7	0x2c0	No error (0)	presteservicosaz.pro		194.180.191.24	A (IP address)	IN (0x0001)	false
May 16, 2024 04:42:08.351625919 CEST	1.1.1.1	192.168.2.7	0x4539	No error (0)	collect.installeranalytics.com		54.221.197.204	A (IP address)	IN (0x0001)	false
May 16, 2024 04:42:08.351625919 CEST	1.1.1.1	192.168.2.7	0x4539	No error (0)	collect.installeranalytics.com		54.227.134.57	A (IP address)	IN (0x0001)	false
May 16, 2024 04:42:12.961051941 CEST	1.1.1.1	192.168.2.7	0x6dd0	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
May 16, 2024 04:42:18.664206982 CEST	1.1.1.1	192.168.2.7	0xb5d7	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
May 16, 2024 04:42:18.664206982 CEST	1.1.1.1	192.168.2.7	0xb5d7	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
May 16, 2024 04:42:18.753519058 CEST	1.1.1.1	192.168.2.7	0x84dc	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 16, 2024 04:42:18.753519058 CEST	1.1.1.1	192.168.2.7	0x84dc	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
May 16, 2024 04:42:32.011432886 CEST	1.1.1.1	192.168.2.7	0xacec	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 16, 2024 04:42:32.011432886 CEST	1.1.1.1	192.168.2.7	0xacec	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
May 16, 2024 04:42:58.298871040 CEST	1.1.1.1	192.168.2.7	0x6538	No error (0)	windowsupdatebg.s.llnwi.net		208.111.136.0	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

presteservicosaz.pro

collect.installeranalytics.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	54.221.197.204	80	2376	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 04:42:08.490015030 CEST	241	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 167 Cache-Control: no-cache
May 16, 2024 04:42:08.490144014 CEST	167	OUT	Data Raw: 71 74 3d 34 39 33 32 35 33 31 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 73 74 61 72 74 26 76 3d 33 26 61 69 64 3d 36 36 34 34 64 39 39 36 32 30 61 35 39 61 64 65 34 63 32 33 38 33 36 61 26 61 76 3d 37 2e 36 2e 38 2e 34 26 63 69 64 3d 34 30 Data Ascii: qt=4932531&t=lifecycle&lc=start&v=3&aid=6644d99620a59ade4c23836a&av=7.6.8.4&cid=40801375D2DBA40CA91A388E8E9D0713A6250E8F&sid=%7BD8AEF8C3-CEF6-431D-A272-E1D18ECE6B1E%7D
May 16, 2024 04:42:08.629513979 CEST	338	IN	HTTP/1.1 200 OK Cache-control: no-cache="set-cookie" Date: Thu, 16 May 2024 02:42:08 GMT Set-Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D;PATH=/;MAX-AGE=600 X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:08.790291071 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 179 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:08.790540934 CEST	179	OUT	Data Raw: 71 74 3d 34 39 33 33 35 36 32 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 65 72 73 69 6f 6e 4e 54 26 76 61 6c 3d 31 30 30 30 26 76 3d 33 26 61 69 64 3d 36 36 34 34 64 39 39 36 32 30 61 35 39 61 64 65 34 63 32 33 38 33 36 61 26 61 76 3d 37 2e Data Ascii: qt=4933562&t=property&lb=VersionNT&val=1000&v=3&aid=6644d99620a59ade4c23836a&av=7.6.8.4&cid=40801375D2DBA40CA91A388E8E9D0713A6250E8F&sid=%7BD8AEF8C3-CEF6-431D-A272-E1D18ECE6B1E%7D
May 16, 2024 04:42:08.929481030 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:08 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:08.935235023 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 181 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:08.935336113 CEST	181	OUT	Data Raw: 71 74 3d 34 39 33 33 37 30 33 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 65 72 73 69 6f 6e 4e 54 36 34 26 76 61 6c 3d 31 30 30 30 26 76 3d 33 26 61 69 64 3d 36 36 34 34 64 39 39 36 32 30 61 35 39 61 64 65 34 63 32 33 38 33 36 61 26 61 76 3d Data Ascii: qt=4933703&t=property&lb=VersionNT64&val=1000&v=3&aid=6644d99620a59ade4c23836a&av=7.6.8.4&cid=40801375D2DBA40CA91A388E8E9D0713A6250E8F&sid=%7BD8AEF8C3-CEF6-431D-A272-E1D18ECE6B1E%7D
May 16, 2024 04:42:09.077168941 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:09 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:09.080255985 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 184 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:09.080298901 CEST	184	OUT	Data Raw: 71 74 3d 34 39 33 33 38 35 39 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 50 68 79 73 69 63 61 6c 4d 65 6d 6f 72 79 26 76 61 6c 3d 38 31 39 31 26 76 3d 33 26 61 69 64 3d 36 36 34 34 64 39 39 36 32 30 61 35 39 61 64 65 34 63 32 33 38 33 36 61 26 Data Ascii: qt=4933859&t=property&lb=PhysicalMemory&val=8191&v=3&aid=6644d99620a59ade4c23836a&av=7.6.8.4&cid=40801375D2DBA40CA91A388E8E9D0713A6250E8F&sid=%7BD8AEF8C3-CEF6-431D-A272-E1D18ECE6B1E%7D
May 16, 2024 04:42:09.219554901 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:09 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:09.223685026 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 180 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:09.223722935 CEST	180	OUT	Data Raw: 71 74 3d 34 39 33 34 30 30 30 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 65 72 73 69 6f 6e 4d 73 69 26 76 61 6c 3d 35 2e 30 30 26 76 3d 33 26 61 69 64 3d 36 36 34 34 64 39 39 36 32 30 61 35 39 61 64 65 34 63 32 33 38 33 36 61 26 61 76 3d 37 Data Ascii: qt=4934000&t=property&lb=VersionMsi&val=5.00&v=3&aid=6644d99620a59ade4c23836a&av=7.6.8.4&cid=40801375D2DBA40CA91A388E8E9D0713A6250E8F&sid=%7BD8AEF8C3-CEF6-431D-A272-E1D18ECE6B1E%7D
May 16, 2024 04:42:09.370189905 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:09 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:09.376192093 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 174 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:09.376192093 CEST	174	OUT	Data Raw: 71 74 3d 34 39 33 34 31 35 36 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 55 49 4c 65 76 65 6c 26 76 61 6c 3d 33 26 76 3d 33 26 61 69 64 3d 36 36 34 34 64 39 39 36 32 30 61 35 39 61 64 65 34 63 32 33 38 33 36 61 26 61 76 3d 37 2e 36 2e 38 2e 34 Data Ascii: qt=4934156&t=property&lb=UILevel&val=3&v=3&aid=6644d99620a59ade4c23836a&av=7.6.8.4&cid=40801375D2DBA40CA91A388E8E9D0713A6250E8F&sid=%7BD8AEF8C3-CEF6-431D-A272-E1D18ECE6B1E%7D
May 16, 2024 04:42:09.515156031 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:09 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:09.520294905 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 183 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:09.520433903 CEST	183	OUT	Data Raw: 71 74 3d 34 39 33 34 32 39 36 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 69 72 74 75 61 6c 4d 65 6d 6f 72 79 26 76 61 6c 3d 36 38 30 31 26 76 3d 33 26 61 69 64 3d 36 36 34 34 64 39 39 36 32 30 61 35 39 61 64 65 34 63 32 33 38 33 36 61 26 61 Data Ascii: qt=4934296&t=property&lb=VirtualMemory&val=6801&v=3&aid=6644d99620a59ade4c23836a&av=7.6.8.4&cid=40801375D2DBA40CA91A388E8E9D0713A6250E8F&sid=%7BD8AEF8C3-CEF6-431D-A272-E1D18ECE6B1E%7D
May 16, 2024 04:42:09.660440922 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:09 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:09.661719084 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 183 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:09.661895037 CEST	183	OUT	Data Raw: 71 74 3d 34 39 33 34 34 33 37 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 4d 73 69 4e 54 50 72 6f 64 75 63 74 54 79 70 65 26 76 61 6c 3d 31 26 76 3d 33 26 61 69 64 3d 36 36 34 34 64 39 39 36 32 30 61 35 39 61 64 65 34 63 32 33 38 33 36 61 26 61 Data Ascii: qt=4934437&t=property&lb=MsiNTProductType&val=1&v=3&aid=6644d99620a59ade4c23836a&av=7.6.8.4&cid=40801375D2DBA40CA91A388E8E9D0713A6250E8F&sid=%7BD8AEF8C3-CEF6-431D-A272-E1D18ECE6B1E%7D
May 16, 2024 04:42:09.800803900 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:09 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:09.801894903 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 183 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:09.802011013 CEST	183	OUT	Data Raw: 71 74 3d 34 39 33 34 35 37 38 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 53 65 72 76 69 63 65 50 61 63 6b 4c 65 76 65 6c 26 76 61 6c 3d 30 26 76 3d 33 26 61 69 64 3d 36 36 34 34 64 39 39 36 32 30 61 35 39 61 64 65 34 63 32 33 38 33 36 61 26 61 Data Ascii: qt=4934578&t=property&lb=ServicePackLevel&val=0&v=3&aid=6644d99620a59ade4c23836a&av=7.6.8.4&cid=40801375D2DBA40CA91A388E8E9D0713A6250E8F&sid=%7BD8AEF8C3-CEF6-431D-A272-E1D18ECE6B1E%7D
May 16, 2024 04:42:09.946228981 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:09 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:09.947459936 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 185 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:09.947540998 CEST	185	OUT	Data Raw: 71 74 3d 34 39 33 34 37 31 38 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 50 72 6f 64 75 63 74 4c 61 6e 67 75 61 67 65 26 76 61 6c 3d 31 30 34 36 26 76 3d 33 26 61 69 64 3d 36 36 34 34 64 39 39 36 32 30 61 35 39 61 64 65 34 63 32 33 38 33 36 61 Data Ascii: qt=4934718&t=property&lb=ProductLanguage&val=1046&v=3&aid=6644d99620a59ade4c23836a&av=7.6.8.4&cid=40801375D2DBA40CA91A388E8E9D0713A6250E8F&sid=%7BD8AEF8C3-CEF6-431D-A272-E1D18ECE6B1E%7D
May 16, 2024 04:42:10.087580919 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:10 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:10.089412928 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 195 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:10.228492022 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:10 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:10.230223894 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 192 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:10.372190952 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:10 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:10.373547077 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 195 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:10.512823105 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:10 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:10.514081955 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 192 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:10.654156923 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:10 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:10.656063080 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 194 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:10.796681881 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:10 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:10.798016071 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 210 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:10.937678099 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:10 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:10.939299107 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 211 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:11.078484058 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:11 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:11.129023075 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 193 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:11.267376900 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:11 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:11.270662069 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 207 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:11.410870075 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:11 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:11.412802935 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 199 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:11.555500031 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:11 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:11.556766033 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 201 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:11.696563005 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:11 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:11.697784901 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 201 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:11.836520910 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:11 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:11.838390112 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 203 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:11.978198051 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:11 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:11.979671001 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 202 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:12.118927956 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:12 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:12.120992899 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 204 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:12.260911942 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:12 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:12.262370110 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 204 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:12.401886940 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:12 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:12.403271914 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 207 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:12.543386936 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:12 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:12.544778109 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 206 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:12.685200930 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:12 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:12.686405897 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 201 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:12.825625896 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:12 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:12.845892906 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 208 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:12.984716892 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:12 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:12.986229897 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 212 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:13.126019955 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:13 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:13.127391100 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 191 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:13.266900063 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:13 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:13.268435001 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 183 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:13.407656908 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:13 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:13.409476042 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 176 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:13.549118996 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:13 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:13.623631001 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 184 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:13.763701916 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:13 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:13.765256882 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 184 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:13.904340982 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:13 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:13.906250954 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 172 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:14.048527002 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:13 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:14.049762011 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 179 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:14.189699888 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:14 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:14.205003023 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 219 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:14.344145060 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:14 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
May 16, 2024 04:42:14.345777988 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 181 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB8011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
May 16, 2024 04:42:14.493298054 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 16 May 2024 02:42:14 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	194.180.191.24	443	2376	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-16 02:42:07 UTC	171	OUT	GET /v7icosaza/bts.bmp HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: presteservicosaz.pro
2024-05-16 02:42:07 UTC	180	IN	HTTP/1.1 404 Not Found Date: Thu, 16 May 2024 02:42:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 283 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-05-16 02:42:07 UTC	283	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 70 72 65 73 74 65 73 65 72 76 69 63 6f 73 61 7a 2e 70 72 6f 20 50 6f 72 74 20 34 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at presteservicosaz.pro Port 4

Target ID:	0
Start time:	04:41:58
Start date:	16/05/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\ahx8PyqunR.msi"
Imagebase:	0x7ff798310000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:41:58
Start date:	16/05/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff798310000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	04:41:59
Start date:	16/05/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding F4F39D2FDBE76F97FC567DD010874426
Imagebase:	0x810000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ahx8PyqunR.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\AdvinstAnalytics\6644d99620a59ade4c23836a\7.6.8.4\tracking.ini

C:\Users\user\AppData\Local\AdvinstAnalytics\6644d99620a59ade4c23836a\7.6.8.4\{D8AEF8C3-CEF6-431D-A272-E1D18ECE6B1E}.session

C:\Users\user\AppData\Local\Temp\shi435A.tmp

C:\Users\user\AppData\Local\Temp\shi43C8.tmp

C:\Users\user\AppData\Local\Temp\snoop.ses

C:\Windows\Installer\4a3deb.msi

C:\Windows\Installer\MSI3F33.tmp

C:\Windows\Installer\MSI3FD1.tmp

C:\Windows\Installer\MSI4291.tmp

C:\Windows\Installer\MSI42FF.tmp

C:\Windows\Installer\MSI432F.tmp

C:\Windows\Installer\MSI4DCF.tmp

C:\Windows\Installer\MSI4DFF.tmp

C:\Windows\Installer\MSI4E9C.tmp

C:\Windows\Installer\MSI4ECC.tmp

C:\Windows\Installer\MSI4F3A.tmp

C:\Windows\Installer\MSI5A38.tmp

C:\Windows\Installer\SourceHash{4F8A97A7-22E3-4751-BCDE-A81270EE5EA8}

C:\Windows\Installer\inprogressinstallinfo.ipi

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

C:\Windows\Temp\~DF05E8441A682C8DC6.TMP

C:\Windows\Temp\~DF0AA2C5A24A268AEC.TMP

C:\Windows\Temp\~DF9FF3B395E69518BF.TMP

Windows Analysis Report
ahx8PyqunR.msi

**\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON**