Edit tour

Windows Analysis Report
0cjB1Kh8zU.msi

Overview

General Information

Sample name:	0cjB1Kh8zU.msi renamed because original name is a hash value
Original sample name:	13bdc90827ceec3e3dfa9fb31dee7b21c73331f212b659243e383383abe64502.msi
Analysis ID:	1466510
MD5:	b8acb7e4b05d91dd4050cb707069143e
SHA1:	b16dc0ab44904f7e4c82192bcec3ba4a2397e2ce
SHA256:	13bdc90827ceec3e3dfa9fb31dee7b21c73331f212b659243e383383abe64502
Tags:	latammsirat
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic

AI detected suspicious sample

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Msiexec Initiated Connection

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 3472 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\0cjB1Kh8zU.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 1208 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 5692 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 11E696952DD6B03AAA33864004BDDF5F MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Sigma Signatures

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 172.67.149.157, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 5692, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Snort Signatures

ETPRO MALWARE TakeMyFile Installer Checkin - Source IP: 192.168.2.6 - Destination IP: 54.165.254.88

Timestamp:	07/03/24-00:52:15.674499
SID:	2849813
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE TakeMyFile User-Agent - Source IP: 192.168.2.6 - Destination IP: 54.165.254.88

Timestamp:	07/03/24-00:52:15.674499
SID:	2849814
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 82.4% probability

Source: unknown

HTTPS traffic detected: 172.67.149.157:443 -> 192.168.2.6:49711 version: TLS 1.2

Source:	Binary string: wininet.pdb source: shi8051.tmp.3.dr
Source:	Binary string: C:\JobRelease\win\Release\bin\x86\embeddeduiproxy.pdb source: 0cjB1Kh8zU.msi, 3a7d63.msi.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: 0cjB1Kh8zU.msi, 3a7d63.msi.2.dr, MSI8026.tmp.2.dr
Source:	Binary string: d3d12.pdbUGP source: shi81E8.tmp.3.dr
Source:	Binary string: d3d12.pdb source: shi81E8.tmp.3.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb\ source: 0cjB1Kh8zU.msi, 3a7d63.msi.2.dr, MSI8026.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdbu source: 0cjB1Kh8zU.msi, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI7ECA.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr
Source:	Binary string: wininet.pdbUGP source: shi8051.tmp.3.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdb source: 0cjB1Kh8zU.msi, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI7ECA.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbg source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2849814 ETPRO MALWARE TakeMyFile User-Agent 192.168.2.6:49712 -> 54.165.254.88:80
Source: Traffic	Snort IDS: 2849813 ETPRO MALWARE TakeMyFile Installer Checkin 192.168.2.6:49712 -> 54.165.254.88:80

Source: Joe Sandbox View

ASN Name: AMAZON-AESUS AMAZON-AESUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic

HTTP traffic detected: GET /caju1.png HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: elcxbm.processosdigital.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /caju1.png HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: elcxbm.processosdigital.com

Source: global traffic	DNS traffic detected: DNS query: elcxbm.processosdigital.com
Source: global traffic	DNS traffic detected: DNS query: collect.installeranalytics.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64)Host: collect.installeranalytics.comContent-Length: 167Cache-Control: no-cache

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 02 Jul 2024 22:52:03 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReferrer-Policy: same-originCache-Control: max-age=15Expires: Tue, 02 Jul 2024 22:52:18 GMTReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f6z5%2FE3OcaA5%2FKtAU9zy8RpPZmOLoqY9ePQD%2Fb2HR5gI2pxtMn6lDCyOh7MhnoL2J1o0GGji3GMHbWj9f2NnHJMEmeKEfOztlO0WN8RQGIAZufBE3LcMwkns5qxxhEaCfToXbCKZ4%2B9aZmeh8IE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 89d2343a0d574346-EWRalt-svc: h3=":443"; ma=86400

Source: shi8051.tmp.3.dr	String found in binary or memory: http://.css
Source: shi8051.tmp.3.dr	String found in binary or memory: http://.jpg
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: 0cjB1Kh8zU.msi, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI7ECA.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: http://collect.installeranalytics.com
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: shi8051.tmp.3.dr	String found in binary or memory: http://html4/loose.dtd
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: http://t2.symcb.com0
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: http://tl.symcd.com0&
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: msiexec.exe	String found in binary or memory: https://ELcXBm.processosdigital.com/caju1.png
Source: 0cjB1Kh8zU.msi, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI7ECA.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: https://collect.installeranalytics.com
Source: 0cjB1Kh8zU.msi, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI7ECA.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: IOAsNN.png.3.dr	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	String found in binary or memory: https://www.thawte.com/repository0W

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443

Source: unknown

HTTPS traffic detected: 172.67.149.157:443 -> 192.168.2.6:49711 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3a7d63.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7ECA.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7F87.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7FB7.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8006.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8026.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8BFE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8C4E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8CFA.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8D2A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{5FABA36A-ECA6-4633-964F-369C3AFA2A7A}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8D99.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA2F6.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI7ECA.tmp

Jump to behavior

Source: 0cjB1Kh8zU.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs 0cjB1Kh8zU.msi
Source: 0cjB1Kh8zU.msi	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs 0cjB1Kh8zU.msi
Source: 0cjB1Kh8zU.msi	Binary or memory string: OriginalFilenameInstallerAnalytics.dllF vs 0cjB1Kh8zU.msi
Source: 0cjB1Kh8zU.msi	Binary or memory string: OriginalFilenameembeddeduiproxy.dllF vs 0cjB1Kh8zU.msi

Source: shi8051.tmp.3.dr

Binary string: \Device\NameResTrk\RecordNrtCloneOpenPacket

Source: classification engine

Classification label: mal52.winMSI@4/29@2/2

Source: C:\Windows\SysWOW64\msiexec.exe

File created: C:\Users\user\AppData\Local\AdvinstAnalytics

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF73CECE7117D5E336.TMP

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\0cjB1Kh8zU.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 11E696952DD6B03AAA33864004BDDF5F
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 11E696952DD6B03AAA33864004BDDF5F	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: zipfldr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

File written: C:\Users\user\AppData\Local\AdvinstAnalytics\6683aaa585f1fb8548fe6d24\8.7.8.9\tracking.ini

Jump to behavior

Source: 0cjB1Kh8zU.msi

Static file information: File size 4970880 > 1048576

Source:	Binary string: wininet.pdb source: shi8051.tmp.3.dr
Source:	Binary string: C:\JobRelease\win\Release\bin\x86\embeddeduiproxy.pdb source: 0cjB1Kh8zU.msi, 3a7d63.msi.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: 0cjB1Kh8zU.msi, 3a7d63.msi.2.dr, MSI8026.tmp.2.dr
Source:	Binary string: d3d12.pdbUGP source: shi81E8.tmp.3.dr
Source:	Binary string: d3d12.pdb source: shi81E8.tmp.3.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb\ source: 0cjB1Kh8zU.msi, 3a7d63.msi.2.dr, MSI8026.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdbu source: 0cjB1Kh8zU.msi, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI7ECA.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr
Source:	Binary string: wininet.pdbUGP source: shi8051.tmp.3.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdb source: 0cjB1Kh8zU.msi, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI7ECA.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbg source: 0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr

Source: shi81E8.tmp.3.dr

Static PE information: 0x96D7AA59 [Sat Mar 12 16:44:09 2050 UTC]

Source: shi8051.tmp.3.dr	Static PE information: section name: .wpp_sf
Source: shi8051.tmp.3.dr	Static PE information: section name: .didat

Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shi8051.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shi81E8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8C4E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8BFE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7ECA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7FB7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7F87.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8D2A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8006.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA2F6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8026.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8CFA.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8C4E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8BFE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7ECA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7FB7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7F87.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8D2A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8006.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA2F6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8026.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8CFA.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi8051.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi81E8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8C4E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8BFE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7ECA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7FB7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7F87.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8D2A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8006.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA2F6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8026.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8CFA.tmp	Jump to dropped file

Source: C:\Windows\SysWOW64\msiexec.exe TID: 6508	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 5492	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\msiexec.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: MSI8026.tmp.2.dr

Binary or memory string: 01234567890.0.0.0.%dVMware, Inc.VMware Virtual PlatformVMware7,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IROOT\CIMV2SELECT * FROM Win32_ComputerSystemSELECT * FROM Win32_BIOSManufacturerModelVersionGetting system informationManufacturer [Model [BIOS [IsWow64Processkernel32Software\Microsoft\Windows NT\CurrentVersionSYSTEM\CurrentControlSet\Control\ProductOptionsCurrentMajorVersionNumberCurrentMinorVersionNumberCurrentVersionCurrentBuildNumberReleaseIdCSDVersionProductTypeProductSuiteWinNTServerNTSmall BusinessEnterpriseBackOfficeCommunicationServerTerminal ServerSmall Business(Restricted)EmbeddedNTDataCenterPersonalBladeEmbedded(Restricted)Security ApplianceStorage ServerCompute Server Failed to create IWbemLocator object. Error code: \\Could not connect to WMI provider. Error code: Failed to initialize security. Error code: Could not set proxy blanket. Error code: WQLWMI Query failed: []. Error code:

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\Users\user\IOAsNN\VNgnVm\IOAsNN.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	3 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	21 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	32 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
0cjB1Kh8zU.msi	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\shi8051.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi81E8.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI7ECA.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI7F87.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI7FB7.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI8006.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI8026.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI8BFE.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI8C4E.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI8CFA.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI8D2A.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIA2F6.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://www.thawte.com/cps0/	0%	URL Reputation	safe
https://www.thawte.com/repository0W	0%	URL Reputation	safe
http://collect.installeranalytics.com/	0%	Avira URL Cloud	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://ELcXBm.processosdigital.com/caju1.png	0%	Avira URL Cloud	safe
https://www.advancedinstaller.com	0%	Avira URL Cloud	safe
http://.css	0%	Avira URL Cloud	safe
http://collect.installeranalytics.com	0%	Avira URL Cloud	safe
http://.jpg	0%	Avira URL Cloud	safe
https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic	0%	Avira URL Cloud	safe
https://www.cloudflare.com/5xx-error-landing	0%	Avira URL Cloud	safe
https://collect.installeranalytics.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
collect.installeranalytics.com	54.165.254.88	true	true	unknown
elcxbm.processosdigital.com	172.67.149.157	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://collect.installeranalytics.com/	true	Avira URL Cloud: safe	unknown
https://elcxbm.processosdigital.com/caju1.png	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://html4/loose.dtd	shi8051.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://ELcXBm.processosdigital.com/caju1.png	msiexec.exe	false	Avira URL Cloud: safe	unknown
https://www.thawte.com/cps0/	0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	false	URL Reputation: safe	unknown
https://www.thawte.com/repository0W	0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	false	URL Reputation: safe	unknown
https://www.advancedinstaller.com	0cjB1Kh8zU.msi, MSI7FB7.tmp.2.dr, MSI8CFA.tmp.2.dr, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI8006.tmp.2.dr, MSI7F87.tmp.2.dr, MSI7ECA.tmp.2.dr, MSI8026.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://collect.installeranalytics.com	0cjB1Kh8zU.msi, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI7ECA.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://.css	shi8051.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://.jpg	shi8051.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://collect.installeranalytics.com	0cjB1Kh8zU.msi, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI7ECA.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic	0cjB1Kh8zU.msi, MSI8C4E.tmp.2.dr, 3a7d63.msi.2.dr, MSI7ECA.tmp.2.dr, MSI8D2A.tmp.2.dr, MSIA2F6.tmp.2.dr, MSI8BFE.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://www.cloudflare.com/5xx-error-landing	IOAsNN.png.3.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.149.157	elcxbm.processosdigital.com	United States		13335	CLOUDFLARENETUS	false
54.165.254.88	collect.installeranalytics.com	United States		14618	AMAZON-AESUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466510
Start date and time:	2024-07-03 00:51:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0cjB1Kh8zU.msi renamed because original name is a hash value
Original Sample Name:	13bdc90827ceec3e3dfa9fb31dee7b21c73331f212b659243e383383abe64502.msi
Detection:	MAL
Classification:	mal52.winMSI@4/29@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.165.165.26, 13.95.31.18, 173.222.108.226, 173.222.108.210, 20.166.126.56
Excluded domains from analysis (whitelisted): client.wns.windows.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 0cjB1Kh8zU.msi

Simulations

Behavior and APIs

Time	Type	Description
18:52:00	API Interceptor	3x Sleep call for process: msiexec.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
collect.installeranalytics.com	2ztvLMT477.msi	Get hash	malicious	Unknown	Browse	54.227.134.57
	ahx8PyqunR.msi	Get hash	malicious	Unknown	Browse	54.221.197.204
	speke.msi	Get hash	malicious	Unknown	Browse	54.165.34.233
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse	54.158.107.210
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse	54.158.107.210
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse	52.7.13.177
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	52.7.13.177
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse	52.7.13.177
	sq5W8v3VZV.exe	Get hash	malicious	Unknown	Browse	54.158.107.210
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	52.7.13.177
fp2e7a.wpc.phicdn.net	http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://3jryhyqvpxiqpvx.duckdns.org/	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://pub-2e7429ed1f544f43a4684eeceb978dbb.r2.dev/home.html	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://pub-1b634168cd404e2d8bece63d5ebb4798.r2.dev/uint.html?schweissdoors	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	http://helpdesk-advertising-review-id-9865133.d3m7n55z273utf.amplifyapp.com/index.html	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://delivery.attempt.failure.ebbs.co.za/public/MY096OineFzTCVJ56qDw3aMDByE0CDQ1	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://dana-aktivasi-paylater.myindo.me/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://mail.support-xfinity.152-42-227-61.cprapid.com/Billing_Pay_Online.html?Review-VerificationMyAccount	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://mail.support-xfinity.152-42-227-61.cprapid.com/Billing-Online.html?Review-VerificationMyAccount	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://www.telegramkv.com/	Get hash	malicious	Unknown	Browse	192.229.221.95
bg.microsoft.map.fastly.net	http://pub-2e7429ed1f544f43a4684eeceb978dbb.r2.dev/home.html	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://pub-1b634168cd404e2d8bece63d5ebb4798.r2.dev/uint.html?schweissdoors	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	http://helpdesk-advertising-review-id-9865133.d3m7n55z273utf.amplifyapp.com/index.html	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://delivery.attempt.failure.ebbs.co.za/public/MY096OineFzTCVJ56qDw3aMDByE0CDQ1	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://mail.support-xfinity.152-42-227-61.cprapid.com/Billing-Online.html?Review-VerificationMyAccount	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://www.telegramkv.com/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://request-remove-violation-here.surge.sh/next.html	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://mysterymint-s10.vercel.app/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://iwahadxi.hosted.phplist.com/lists/lt.php/?tid=eU1SAFEEUlZTABhUAVAGGAZWVFsfXVQLWkkDBQIAUAwCAgcAAldPWwdaBlNRVAgYVwEEXh9QClxcSQcAUlcbWgQGAAJVVwRXBAoBSQcBAVALVA8LHwIEXVtJUg8GVxsAVVMHGA5SB1EBC1YDAQQBDA	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://we-whatsapp-kf.top/	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	https://delivery.attempt.failure.ebbs.co.za/public/MY096OineFzTCVJ56qDw3aMDByE0CDQ1	Get hash	malicious	Unknown	Browse	44.205.42.17
	http://multichaindappsx.pages.dev/	Get hash	malicious	Unknown	Browse	54.161.57.47
	https://swans-muffin-1id4964-7304421.netlify.app/form	Get hash	malicious	Unknown	Browse	34.235.22.120
	https://reg1a-g4ad23-269fe50-lqng5s.netlify.app/dev.html/	Get hash	malicious	Unknown	Browse	54.156.218.98
	https://hr.economictimes.indiatimes.com/etl.php?url=https://hr.economictimes.indiatimes.com/etl.php?url=//dolar2go.com/new/auth//klqsxqvkkosgj/%2F/ZG9uYWxkLmRvbm92YW5AbWJ1LmVkdQ==	Get hash	malicious	HTMLPhisher	Browse	3.227.135.8
	https://hr.economictimes.indiatimes.com/etl.php?url=https://hr.economictimes.indiatimes.com/etl.php?url=//littlelassies.com/ejk/xlpd//j40gstqcualqm/%2F/ZG9uYWxkLmRvbm92YW5AbWJ1LmVkdQ==	Get hash	malicious	HTMLPhisher	Browse	18.214.17.35
	http://texadasoftware.com	Get hash	malicious	Unknown	Browse	3.86.141.109
	The Siedenburg Group #24-051-553861 Project.pdf	Get hash	malicious	Unknown	Browse	54.224.241.105
	https://gcc.dcv.ms/i8Kf7mgiA8	Get hash	malicious	Unknown	Browse	18.233.173.50
	Informational-severity alert_ Creation of forwarding_redirect rule Case ID_FqJxoz8.eml	Get hash	malicious	Unknown	Browse	3.5.20.65
CLOUDFLARENETUS	http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://services.business-manange.com/	Get hash	malicious	Unknown	Browse	172.67.138.117
	http://pub-2e7429ed1f544f43a4684eeceb978dbb.r2.dev/home.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://pub-1b634168cd404e2d8bece63d5ebb4798.r2.dev/uint.html?schweissdoors	Get hash	malicious	HTMLPhisher	Browse	104.26.10.155
	https://pub-9445ce0d74714d1c934c51ffcf83c3f2.r2.dev/slnt.html?nycsbs	Get hash	malicious	HTMLPhisher	Browse	104.26.10.155
	http://helpdesk-advertising-review-id-9865133.d3m7n55z273utf.amplifyapp.com/index.html	Get hash	malicious	Unknown	Browse	172.67.69.226
	http://www.anuihafw369.xyz/m/register/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://delivery.attempt.failure.ebbs.co.za/public/MY096OineFzTCVJ56qDw3aMDByE0CDQ1	Get hash	malicious	Unknown	Browse	104.21.234.144
	http://www.telegramkv.com/	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://supp-review9482.eu/	Get hash	malicious	Unknown	Browse	104.21.50.66

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	SecuriteInfo.com.Win32.Evo-gen.21718.4342.exe	Get hash	malicious	BlackMoon	Browse	172.67.149.157
	SecuriteInfo.com.Win32.Evo-gen.21718.4342.exe	Get hash	malicious	BlackMoon	Browse	172.67.149.157
	1.scr	Get hash	malicious	Unknown	Browse	172.67.149.157
	1.scr	Get hash	malicious	Unknown	Browse	172.67.149.157
	SecuriteInfo.com.Win32.BootkitX-gen.5272.14841.exe	Get hash	malicious	LummaC	Browse	172.67.149.157
	Informational-severity alert_ Creation of forwarding_redirect rule Case ID_FqJxoz8.eml	Get hash	malicious	Unknown	Browse	172.67.149.157
	file.exe	Get hash	malicious	LummaC	Browse	172.67.149.157
	Secured_Document.Docx	Get hash	malicious	Unknown	Browse	172.67.149.157
	invoicepast.pdf.lnk.mal.lnk	Get hash	malicious	ScreenConnect Tool	Browse	172.67.149.157
	710_SO_TO_CHITTAGONG1_CFS-SOE777_PKCGP2410001-AMD-8248-HBL_DRAFT.scr.exe	Get hash	malicious	DBatLoader, Remcos	Browse	172.67.149.157

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\shi81E8.tmp	2ztvLMT477.msi	Get hash	malicious	Unknown	Browse
	ahx8PyqunR.msi	Get hash	malicious	Unknown	Browse
	speke.msi	Get hash	malicious	Unknown	Browse
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse
	sq5W8v3VZV.exe	Get hash	malicious	Unknown	Browse
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\shi8051.tmp	2ztvLMT477.msi	Get hash	malicious	Unknown	Browse
	ahx8PyqunR.msi	Get hash	malicious	Unknown	Browse
	speke.msi	Get hash	malicious	Unknown	Browse
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse
	sq5W8v3VZV.exe	Get hash	malicious	Unknown	Browse
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\AdvinstAnalytics\6683aaa585f1fb8548fe6d24\8.7.8.9\tracking.ini

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.0081320258334
Encrypted:	false
SSDEEP:	3:1EyEMyvn:1BEN
MD5:	6BC190DD42A169DFA14515484427FC8E
SHA1:	B53BD614A834416E4A20292AA291A6D2FC221A5E
SHA-256:	B3395B660EB1EDB00FF91ECE4596E3ABE99FA558B149200F50AABF2CB77F5087
SHA-512:	5B7011ED628B673217695809A38A800E9C8A42CEB0C54AB6F8BC39DBA0745297A4FBD66D6B09188FCC952C08217152844DFC3ADA7CF468C3AAFCEC379C0B16B6
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[General]..Active = true..

C:\Users\user\AppData\Local\AdvinstAnalytics\6683aaa585f1fb8548fe6d24\8.7.8.9\{FA5B8B9A-3776-46FC-AA1F-39AC224FF43F}.session

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13387
Entropy (8bit):	5.414472528403359
Encrypted:	false
SSDEEP:	384:mRuRzRGRN0RcRURSRDR1RuvRiRuReR5RiRMRcR7WR9RARtR2YRjRXRChRcR3zRUT:mwt0caigJ/wv0goHIWCNWLeHoY5RUuFS
MD5:	658F134F6BBA9821B15B323CF97CD7AB
SHA1:	0EA2BD4EB5678AB9007C2570BE3DE2DD3D974B72
SHA-256:	5188A08F73F2CB10C58DC57ED3295216B14B6D6D5AB4A42D45738F789D85C0C4
SHA-512:	4F3DC68D9EFFA4D9A0062CA059021B052E2170D55B87CC502D117536A8DA8A5DBDEF4DC1C6913F12640CBAE90D1F60633E0840151B2269A7396152C97C15EBF7
Malicious:	false
Reputation:	low
Preview:	[Hit {8390F065-E664-4039-9C3F-0942EB860645}]..Queue Time = 0..Hit Type = lifecycle..Life control = start..Protocol Version = 3..Application ID = 6683aaa585f1fb8548fe6d24..Application Version = 8.7.8.9..Client ID = DF7942F70C5F63E22DD3C93671DB882D1C26CFBD..Session ID = {FA5B8B9A-3776-46FC-AA1F-39AC224FF43F}....[Hit {F8F5D69F-B488-4B00-97E1-2E8B4ECDAB37}]..Queue Time = 0..Hit Type = property..Label = VersionNT..Value = 1000..Protocol Version = 3..Application ID = 6683aaa585f1fb8548fe6d24..Application Version = 8.7.8.9..Client ID = DF7942F70C5F63E22DD3C93671DB882D1C26CFBD..Session ID = {FA5B8B9A-3776-46FC-AA1F-39AC224FF43F}....[Hit {0AD2F99A-0393-4B7E-A2F0-E642ADDB2BB1}]..Queue Time = 0..Hit Type = property..Label = VersionNT64..Value = 1000..Protocol Version = 3..Application ID = 6683aaa585f1fb8548fe6d24..Application Version = 8.7.8.9..Client ID = DF7942F70C5F63E22DD3C93671DB882D1C26CFBD..Session ID = {FA5B8B9A-3776-46FC-AA1F-39AC224FF43F}....[Hit {C6FD2E62-BADD-44E1-9594-FC5BF638F24A}].

C:\Users\user\AppData\Local\Temp\shi8051.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4509696
Entropy (8bit):	6.100941182830929
Encrypted:	false
SSDEEP:	49152:jm+XAVAMPLfOyim8iTRxYUOQSfLTZZZ2y38lb7Cjn3mboy4+MT7ujWx/Tl0ng48e:CzVAwiKTOpfLTDQyaNoy787ujWx/TlR
MD5:	F6153E803F1533042AC7E6988237C2C3
SHA1:	DDA81BB8BC8CC14877C9CB9B7C664DEFD81EBB4F
SHA-256:	F42A771D310C762C05A5BE3DE0CFDB9BEC28D3DFCCAEF800C901F551A0DF30ED
SHA-512:	7AE76A4CB58A9929C09B1D6376073268622C74B1E3F0C346AFA7A7829E2EF136CCF091F58CCA28BFE83C665573C23D9DB6AF51A44275DA0CC2CF8C1306ADDBAC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 2ztvLMT477.msi, Detection: malicious, Browse Filename: ahx8PyqunR.msi, Detection: malicious, Browse Filename: speke.msi, Detection: malicious, Browse Filename: d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe, Detection: malicious, Browse Filename: d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe, Detection: malicious, Browse Filename: 69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe, Detection: malicious, Browse Filename: w1J9KDIC0m.exe, Detection: malicious, Browse Filename: 69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe, Detection: malicious, Browse Filename: sq5W8v3VZV.exe, Detection: malicious, Browse Filename: w1J9KDIC0m.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.._.._..V.X.=..K..S..K..X..K..W.._.....K..^..K..-..K..D..K.4.^..K..^..Rich_..........................PE..L....+.X...........!.....dA.........P.3.......A....c.........................@E.......E...@A.........................i@.K&..L.A.......B.H.....................D..-......T....................O...... .................A.H....C@......................text.....@.......@................. ..`.wpp_sf.......@.......@............. ..`.data....6....A......hA.............@....idata...1....A..2...nA.............@..@.didat..4.....B.......A.............@....rsrc...H.....B.......A.............@..@.reloc...-....D.......C.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shi81E8.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83128
Entropy (8bit):	6.654653670108596
Encrypted:	false
SSDEEP:	1536:0jIdYoF2CwmzOVStYMAuNWrmaTk++ouMOczT0ud4x41xmPS:0jRoFZwmr+bDk/MOcv0G4sxm
MD5:	125B0F6BF378358E4F9C837FF6682D94
SHA1:	8715BEB626E0F4BD79A14819CC0F90B81A2E58AD
SHA-256:	E99EAB3C75989B519F7F828373042701329ACBD8CEADF4F3FF390F346AC76193
SHA-512:	B63BB6BFDA70D42472868B5A1D3951CF9B2E00A7FADB08C1F599151A1801A19F5A75CFC3ACE94C952CFD284EB261C7D6F11BE0EBBCAA701B75036D3A6B442DB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 2ztvLMT477.msi, Detection: malicious, Browse Filename: ahx8PyqunR.msi, Detection: malicious, Browse Filename: speke.msi, Detection: malicious, Browse Filename: d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe, Detection: malicious, Browse Filename: d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe, Detection: malicious, Browse Filename: 69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe, Detection: malicious, Browse Filename: w1J9KDIC0m.exe, Detection: malicious, Browse Filename: 69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe, Detection: malicious, Browse Filename: sq5W8v3VZV.exe, Detection: malicious, Browse Filename: w1J9KDIC0m.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.T...:...:...:.....&.:...9...:...;...:...;...:...:...:...4...:...?...:......:...>...:......:...8...:.Rich..:.................PE..L...Y.............!.........H.......n..............................................;.....@A........................P........B.......`............... ...$...p..........T............................................@...............................text.../........................... ..`.data....!..........................@....idata..H....@......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tampa.ses

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.2516291673878226
Encrypted:	false
SSDEEP:	3:gpyn:g4n
MD5:	A067F5EC97BA51B576825B69BC855E58
SHA1:	907D296538A45D5B593512881D721C7D347B8E04
SHA-256:	CF3E339D25C3C023C9417FFC5D8E73F1DA828B18FEECAF14FDB9C24D04E49BA0
SHA-512:	F6058F37CF764E6CD807D9C0E9DE881849E4C94EC1D2E0C0EB504ABF77147E77CB09113B087E1C10E790C3EC45780E5986D29B2A84B364C5F697F884B1549F4D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	NULL..

C:\Users\user\IOAsNN\VNgnVm\IOAsNN.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text, with very long lines (394)
Category:	dropped
Size (bytes):	4521
Entropy (8bit):	5.017740795216092
Encrypted:	false
SSDEEP:	96:1j9jwIjYj5jDK/D5DMF+C8gZqXKHvpIkdNCrR49PaQxJbGD:1j9jhjYj9K/Vo+nVaHvFdNCrO9ieJGD
MD5:	4ADD539B2A4B58D39A767FB198F575E1
SHA1:	144F4651E4260E3EFAD2F00A3724A1C5CC530B14
SHA-256:	DBFE77244D6E3BE122C9EFFAA930CD6D8E6E5C060D292E1B1EBF5474918B87A4
SHA-512:	99B4BA23C887C25E2461BE917BB1E9E5FC9F077A4344B8E63DBB95E11626FB0D7D83410E1E9B60896DAE3D19DFBC79FF8FF69ACEF976C8DDBFB8BC82B16DFCD8
Malicious:	false
Preview:	<!DOCTYPE html>. [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->. [if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->. [if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->.<head>.<title>Attention Required! \| Cloudflare</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]-->.<style>body{margin:0;padding:0}</style>... [if gte IE 10]> >.<script>. if (!navigator.cookieEnabled) {. window.addEventListener('DOMContentLoaded', f

C:\Users\user\IOAsNN\VNgnVm\IOAsNN.zip (copy)

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text, with very long lines (394)
Category:	dropped
Size (bytes):	4521
Entropy (8bit):	5.017740795216092
Encrypted:	false
SSDEEP:	96:1j9jwIjYj5jDK/D5DMF+C8gZqXKHvpIkdNCrR49PaQxJbGD:1j9jhjYj9K/Vo+nVaHvFdNCrO9ieJGD
MD5:	4ADD539B2A4B58D39A767FB198F575E1
SHA1:	144F4651E4260E3EFAD2F00A3724A1C5CC530B14
SHA-256:	DBFE77244D6E3BE122C9EFFAA930CD6D8E6E5C060D292E1B1EBF5474918B87A4
SHA-512:	99B4BA23C887C25E2461BE917BB1E9E5FC9F077A4344B8E63DBB95E11626FB0D7D83410E1E9B60896DAE3D19DFBC79FF8FF69ACEF976C8DDBFB8BC82B16DFCD8
Malicious:	false
Preview:	<!DOCTYPE html>. [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->. [if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->. [if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->.<head>.<title>Attention Required! \| Cloudflare</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]-->.<style>body{margin:0;padding:0}</style>... [if gte IE 10]> >.<script>. if (!navigator.cookieEnabled) {. window.addEventListener('DOMContentLoaded', f

C:\Windows\Installer\3a7d63.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {06EC4DEC-49D2-42F0-B4E3-AF9C7D0F65E8}, Number of Words: 10, Subject: ACB BNR M L, Author: ACB BNR M L, Name of Creating Application: Advanced Installer 18.3 build e2a0201b, Template: ;1046, Comments: A base dados do instalador contm a lgica e os dados necACB BNR M L essrios para instalar o ACB BNR M L., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	4970880
Entropy (8bit):	7.553844378739272
Encrypted:	false
SSDEEP:	98304:kxMZAtKknz5vqussRe4frUMXjcYSFLlMlWB26RP6OBK3XD+HE:k9YussRVjiFLlMlW5Z6OBAXDuE
MD5:	B8ACB7E4B05D91DD4050CB707069143E
SHA1:	B16DC0AB44904F7E4C82192BCEC3BA4A2397E2CE
SHA-256:	13BDC90827CEEC3E3DFA9FB31DEE7B21C73331F212B659243E383383ABE64502
SHA-512:	785CB71C06892D28A878A94DC1F829F566D0384035350420A609ED2BAFCCA6C54DEB2F4A90E7B761C997FE735692B9DDB1BE4CDA1D48ED8068D41CD353AB0F3C
Malicious:	false
Preview:	......................>...................$...................................................................................................................J...K...L...M...N...O...P...Q...R...S...T...U...............................................................................................................................................................................................................................................................................................................................c...............%...7........................................................................................... ...!..."...#...$.../...0...'...(...)...*...+...,...-...........1...5...2...3...4...8...6...@...C...9...:...;...<...=...>...?...Q...A...B...H...D...E...F...G...p...a...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`.......b...d...u...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...v.......w...x...y...z...

C:\Windows\Installer\MSI7ECA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI7F87.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388064
Entropy (8bit):	6.407392408414975
Encrypted:	false
SSDEEP:	6144:U7C5QB3/CNG2HBOqf2BLuoZSKYfuAO8DOE09VKYnyZwYW:qB3WBOG2BPDKSf9VtyZNW
MD5:	20C782EB64C81AC14C83A853546A8924
SHA1:	A1506933D294DE07A7A2AE1FBC6BE468F51371D6
SHA-256:	0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
SHA-512:	AFF21E3E00B39F8983D101A0C616CA84CC3DC72D6464A0DD331965CF6BECCF9B45025A7DB2042D6E8B05221D3EB5813445C8ADA69AE96E2727A607398A3DE3D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......b2..&S..&S..&S..28..+S..28..S...'..)S...'..1S...'..aS..28..?S..28..'S..28..;S..&S..wR...'..tS...'..'S...'+.'S..&SC.'S...'..'S..Rich&S..........................PE..L.....`.........."!.................Z..............................................a.....@.........................@n.......v..........0.......................d?..X...p...............................@............... ............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...0...........................@..@.reloc..d?.......@..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI7FB7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388064
Entropy (8bit):	6.407392408414975
Encrypted:	false
SSDEEP:	6144:U7C5QB3/CNG2HBOqf2BLuoZSKYfuAO8DOE09VKYnyZwYW:qB3WBOG2BPDKSf9VtyZNW
MD5:	20C782EB64C81AC14C83A853546A8924
SHA1:	A1506933D294DE07A7A2AE1FBC6BE468F51371D6
SHA-256:	0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
SHA-512:	AFF21E3E00B39F8983D101A0C616CA84CC3DC72D6464A0DD331965CF6BECCF9B45025A7DB2042D6E8B05221D3EB5813445C8ADA69AE96E2727A607398A3DE3D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......b2..&S..&S..&S..28..+S..28..S...'..)S...'..1S...'..aS..28..?S..28..'S..28..;S..&S..wR...'..tS...'..'S...'+.'S..&SC.'S...'..'S..Rich&S..........................PE..L.....`.........."!.................Z..............................................a.....@.........................@n.......v..........0.......................d?..X...p...............................@............... ............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...0...........................@..@.reloc..d?.......@..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8006.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388064
Entropy (8bit):	6.407392408414975
Encrypted:	false
SSDEEP:	6144:U7C5QB3/CNG2HBOqf2BLuoZSKYfuAO8DOE09VKYnyZwYW:qB3WBOG2BPDKSf9VtyZNW
MD5:	20C782EB64C81AC14C83A853546A8924
SHA1:	A1506933D294DE07A7A2AE1FBC6BE468F51371D6
SHA-256:	0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
SHA-512:	AFF21E3E00B39F8983D101A0C616CA84CC3DC72D6464A0DD331965CF6BECCF9B45025A7DB2042D6E8B05221D3EB5813445C8ADA69AE96E2727A607398A3DE3D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......b2..&S..&S..&S..28..+S..28..S...'..)S...'..1S...'..aS..28..?S..28..'S..28..;S..&S..wR...'..tS...'..'S...'+.'S..&SC.'S...'..'S..Rich&S..........................PE..L.....`.........."!.................Z..............................................a.....@.........................@n.......v..........0.......................d?..X...p...............................@............... ............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...0...........................@..@.reloc..d?.......@..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8026.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	878560
Entropy (8bit):	6.452749824306929
Encrypted:	false
SSDEEP:	24576:QK8S3AccKkqSojmrhCMou5vk3Y+ukDln/hFRFNUEekB:QK8tKk5ojmrhCMz5vk3ukDln/hFRFNU0
MD5:	D51A7E3BCE34C74638E89366DEEE2AAB
SHA1:	0E68022B52C288E8CDFFE85739DE1194253A7EF0
SHA-256:	7C6BDF16A0992DB092B7F94C374B21DE5D53E3043F5717A6EECAE614432E0DF5
SHA-512:	8ED246747CDD05CAC352919D7DED3F14B1E523CCC1F7F172DB85EED800B0C5D24475C270B34A7C25E7934467ACE7E363542A586CDEB156BFC484F7417C3A4AB0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j{..............`.......`..W...<.......<.......<.......`.......`.......`..............>.......>.......>...............>.......Rich....................PE..L...}.`.........."!.........\|...........................................................@............................t...T........................N..............X}..p....................~.......}..@............................................text............................... ..`.rdata..............................@..@.data...\...........................@....rsrc................^..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8BFE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8C4E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8CFA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388064
Entropy (8bit):	6.407392408414975
Encrypted:	false
SSDEEP:	6144:U7C5QB3/CNG2HBOqf2BLuoZSKYfuAO8DOE09VKYnyZwYW:qB3WBOG2BPDKSf9VtyZNW
MD5:	20C782EB64C81AC14C83A853546A8924
SHA1:	A1506933D294DE07A7A2AE1FBC6BE468F51371D6
SHA-256:	0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
SHA-512:	AFF21E3E00B39F8983D101A0C616CA84CC3DC72D6464A0DD331965CF6BECCF9B45025A7DB2042D6E8B05221D3EB5813445C8ADA69AE96E2727A607398A3DE3D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......b2..&S..&S..&S..28..+S..28..S...'..)S...'..1S...'..aS..28..?S..28..'S..28..;S..&S..wR...'..tS...'..'S...'+.'S..&SC.'S...'..'S..Rich&S..........................PE..L.....`.........."!.................Z..............................................a.....@.........................@n.......v..........0.......................d?..X...p...............................@............... ............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...0...........................@..@.reloc..d?.......@..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8D2A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8D99.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	2421
Entropy (8bit):	5.503365533390363
Encrypted:	false
SSDEEP:	24:Zgy9ywlTi6OZhEu6ANjIYlMkf6xelAqx/6+oE1f0xX6ywe4X74ng+Tdu3zrx0sqJ:Z55A4+hfl++T1AX61Eng8dB5cfblt7zw
MD5:	884C0C3DC9C7D371D5CAEE64567FA76C
SHA1:	8EB52437DEE4FF9B58C99798D0B54F875857863F
SHA-256:	598FA25F785D52BD71FB24608EA79C4E19356C32EF62A00E32D61C99F1313D36
SHA-512:	198AC97AC77132CDD26AF779FFE8DAE065A1DDCE445365A4A4E28CB18BBBFAC734013F09E953FA06106C2AC71433EEBD0507CA886FC6A2778108F0C8F5C3DAFB
Malicious:	false
Preview:	...@IXOS.@.....@...X.@.....@.....@.....@.....@.....@......&.{5FABA36A-ECA6-4633-964F-369C3AFA2A7A}..ACB BNR M L..0cjB1Kh8zU.msi.@.....@.....@.....@........&.{06EC4DEC-49D2-42F0-B4E3-AF9C7D0F65E8}.....@.....@.....@.....@.......@.....@.....@.......@......ACB BNR M L......Rollback..A.....o. .d.e. .r.e.s.t.a.u.r.a.....o.....RollbackCleanup..Removendo arquivos de backup..Arquivo: [1]...@.......@........ProcessComponents%.Atualizando o registro de componentes...@.....@.....@.]....&.{F35630B1-6A18-4376-A2F8-017D547298D3}:.C:\Users\user\AppData\Roaming\ACB BNR M L\ACB BNR M L\.@.......@.....@.....@......&.{409534FB-1F13-4C5B-B159-AB69FC5C6249},.01:\Software\ACB BNR M L\ACB BNR M L\Version.@.......@.....@.....@......&.{79B414DB-F8BA-48C8-874B-4FCDA83CC75B}L.01:\Software\ACB BNR M L\{5FABA36A-ECA6-4633-964F-369C3AFA2A7A}\AI_IA_ENABLE.@.......@.....@.....@........CreateFolders..Criando novas pastas..Pasta: [1]".:.C:\Users\user\AppData\Roaming\ACB BNR M L\ACB BNR M L\.@........WriteRegistr

C:\Windows\Installer\MSIA2F6.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{5FABA36A-ECA6-4633-964F-369C3AFA2A7A}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1646840513292058
Encrypted:	false
SSDEEP:	12:JSbX72FjIiAGiLIlHVRpZh/7777777777777777777777777vDHFO7+372it/l0G:J5QI5tn3DiF
MD5:	41A255A50BA50F27CDBDEDFA74F336AB
SHA1:	F0C87C0505A9475CC37A62697ED81DAB48310E52
SHA-256:	37665E8AEEF896831E9613FCB5DC43887B9B09C68D128D1A5DB249C01D355319
SHA-512:	CA40E7B155B0852041C81ECDD8A861AFD6DCA48EF520B9205D6F7574544F97AC51F178F192AEB46AA38500630A19EA277B5F9E4A83967A1334BD23AA683FCAFF
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.8332665858324426
Encrypted:	false
SSDEEP:	48:P8PhquRc06WXJSFT5A8kOoS0qAEbCycY8xfoHswXGcp4ru2xBxYxMxqxrxbxEoyw:Ohq1JFTq8kOo3xwCXco2WGXo3QJ
MD5:	49C93D042D6FD11F71811762E9C255D0
SHA1:	A7C36D570A1B7A072415E56503DFFB3D6C5C623D
SHA-256:	5759A34154D0D2A4ED579646C78980479948AD1E4FB5CA4C465E8E9AF5CB02FA
SHA-512:	68F55ED6D697D9C5E39AE7C51D7DE5B4F91F5B0CF04292853FF525E9FDB314223B68A19380B9B520A1B87BF71658996C542A57154CF7E10502447B49F9D804C0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362995016800785
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaub:zTtbmkExhMJCIpEm
MD5:	4BDA1EBAF63D0C8FB4EBBA67BF2ACA04
SHA1:	0576CE89FAA9D4F8C34C6F47E92333E0AC13301B
SHA-256:	1B8CA5E64A9ACDCABC045F63D7ED04C9590AF7D644A0F679F8024909DC29D4F5
SHA-512:	D38DE4B89C25173548A9FFE693B83F4E8F78C57B4D8AB4429A6BB2A860A838CB79023F77AAD6830F8A6B4CE078933DD270AB8C041D7F34CE51AAF000E5EA9093
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF28E8959115D03820.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4B5EBF01DD2BB8C3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2032473789024438
Encrypted:	false
SSDEEP:	48:vWdiugO+CFXJjT55UVyu8kOoS0qAEbCycY8xfoHswXGcp4ru2xBxYxMxqxrxbxEA:6ii7T38D8kOo3xwCXco2WGXo3QJ
MD5:	4CD54CA97B49A4979A28622A76A22E85
SHA1:	E9027EA3F3E6A01AEBBCA587D4BBB9CAC7B1FD13
SHA-256:	E82FB43A9F81BA0CB23A51447061C86D15AF789E04347A5C56113F9DF68025B2
SHA-512:	5A7B604869F24219CFA6E6364E135CA2784D8141C2A0F5CDF67FAC44918500451786BEC01F593EB114D743509C17D7A6156E329342909C7D07E0AAA0AC2F6C97
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4E607DEED9B2AAB9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.8332665858324426
Encrypted:	false
SSDEEP:	48:P8PhquRc06WXJSFT5A8kOoS0qAEbCycY8xfoHswXGcp4ru2xBxYxMxqxrxbxEoyw:Ohq1JFTq8kOo3xwCXco2WGXo3QJ
MD5:	49C93D042D6FD11F71811762E9C255D0
SHA1:	A7C36D570A1B7A072415E56503DFFB3D6C5C623D
SHA-256:	5759A34154D0D2A4ED579646C78980479948AD1E4FB5CA4C465E8E9AF5CB02FA
SHA-512:	68F55ED6D697D9C5E39AE7C51D7DE5B4F91F5B0CF04292853FF525E9FDB314223B68A19380B9B520A1B87BF71658996C542A57154CF7E10502447B49F9D804C0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF57940C5C110C965D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF73CECE7117D5E336.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.30320961399826407
Encrypted:	false
SSDEEP:	48:IEr+2tTIoS01oS0qAEbCycY8xfoHswXGcp4ru2xBxYxMxqxrxbxEoyMboLt2IXGj:FJeo31o3xwCXco2WG+kL
MD5:	56C723A13312D38B834711441C2B8E51
SHA1:	8C2F70111DCD18885D5654D4C5BF60CFBD889F23
SHA-256:	AE63A5DC4D20491C8D30A0EA22590B28595847C4C6BC87FB5FF04296C826BFEB
SHA-512:	EA383AAE9368278C03D0D8840010EA600A7613475A7BAB7F235390A1B19AD41ECDA440AA29F3A3B689F6D0E999E0C2D47A7F69695A7B5A516E2A6505E9124BE9
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA32313B41CC028EE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07193462680146535
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKO4wG7J7s37o2RltgVky6lit/:2F0i8n0itFzDHFO7+37pit/
MD5:	296A7CCB7A25CE089C2B0CE675D5F819
SHA1:	6C1BF9AF34F0251239BDA304072A3AD80D075570
SHA-256:	67B3EFB0397853A3CA890F402C71F50C62FF3F25C3A94B74BEC088132EF82274
SHA-512:	AE5E9F32328EE132F133BC84AA33A80B8AC66DFACAEA4A8B64FE33F9D6548F121D945D40E3732D695EC8292915B3C3FD30C786B0E2627DD16F87A5CFA5C89F1E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

**\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON**

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.5020180897627275
Encrypted:	false
SSDEEP:	3:2lc5I2Y1AnODlll/ulLn:CtGul/qLn
MD5:	CB0C7DCB0760D9F90947EE9E9B44C335
SHA1:	2EB8E8DC8E8AF4244FBC2D3A5205AF33BDFD1E7F
SHA-256:	BD360F52262A600F9B714BCA7B35C9F3FAD468C7CF19C9FA3E89814F231E1F64
SHA-512:	FD79C1D3D6D5EAB0CA008928B7B59A76F17F3E63EFC39534888A0A206B38A0AAE34E738FD03F0920C34DC217897CEF019A6FAD4CAB6E24F2172D1257C0CDD71F
Malicious:	false
Preview:	....4.9.4.1.2.6.....\MAILSLOT\NET\GETDC142142AE.................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {06EC4DEC-49D2-42F0-B4E3-AF9C7D0F65E8}, Number of Words: 10, Subject: ACB BNR M L, Author: ACB BNR M L, Name of Creating Application: Advanced Installer 18.3 build e2a0201b, Template: ;1046, Comments: A base dados do instalador contm a lgica e os dados necACB BNR M L essrios para instalar o ACB BNR M L., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Entropy (8bit):	7.553844378739272
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	0cjB1Kh8zU.msi
File size:	4'970'880 bytes
MD5:	b8acb7e4b05d91dd4050cb707069143e
SHA1:	b16dc0ab44904f7e4c82192bcec3ba4a2397e2ce
SHA256:	13bdc90827ceec3e3dfa9fb31dee7b21c73331f212b659243e383383abe64502
SHA512:	785cb71c06892d28a878a94dc1f829f566d0384035350420a609ed2bafcca6c54deb2f4a90e7b761c997fe735692b9ddb1be4cda1d48ed8068d41cd353ab0f3c
SSDEEP:	98304:kxMZAtKknz5vqussRe4frUMXjcYSFLlMlWB26RP6OBK3XD+HE:k9YussRVjiFLlMlW5Z6OBAXDuE
TLSH:	9436E11275CA8736EA7E853065AADB3660FA3FE11BB154DF53C4593A0E705C202B2F27
File Content Preview:	........................>...................$...................................................................................................................J...K...L...M...N...O...P...Q...R...S...T...U..................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/03/24-00:52:15.674499	TCP	2849813	ETPRO MALWARE TakeMyFile Installer Checkin	49712	80	192.168.2.6	54.165.254.88
07/03/24-00:52:15.674499	TCP	2849814	ETPRO MALWARE TakeMyFile User-Agent	49712	80	192.168.2.6	54.165.254.88

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 00:52:02.621084929 CEST	49711	443	192.168.2.6	172.67.149.157
Jul 3, 2024 00:52:02.621164083 CEST	443	49711	172.67.149.157	192.168.2.6
Jul 3, 2024 00:52:02.621249914 CEST	49711	443	192.168.2.6	172.67.149.157
Jul 3, 2024 00:52:02.624283075 CEST	49711	443	192.168.2.6	172.67.149.157
Jul 3, 2024 00:52:02.624308109 CEST	443	49711	172.67.149.157	192.168.2.6
Jul 3, 2024 00:52:03.092921972 CEST	443	49711	172.67.149.157	192.168.2.6
Jul 3, 2024 00:52:03.093082905 CEST	49711	443	192.168.2.6	172.67.149.157
Jul 3, 2024 00:52:03.112442970 CEST	49711	443	192.168.2.6	172.67.149.157
Jul 3, 2024 00:52:03.112463951 CEST	443	49711	172.67.149.157	192.168.2.6
Jul 3, 2024 00:52:03.112828970 CEST	443	49711	172.67.149.157	192.168.2.6
Jul 3, 2024 00:52:03.155265093 CEST	49711	443	192.168.2.6	172.67.149.157
Jul 3, 2024 00:52:03.276999950 CEST	49711	443	192.168.2.6	172.67.149.157
Jul 3, 2024 00:52:03.324493885 CEST	443	49711	172.67.149.157	192.168.2.6
Jul 3, 2024 00:52:03.574117899 CEST	443	49711	172.67.149.157	192.168.2.6
Jul 3, 2024 00:52:03.574156046 CEST	443	49711	172.67.149.157	192.168.2.6
Jul 3, 2024 00:52:03.574177027 CEST	443	49711	172.67.149.157	192.168.2.6
Jul 3, 2024 00:52:03.574218035 CEST	49711	443	192.168.2.6	172.67.149.157
Jul 3, 2024 00:52:03.574234009 CEST	443	49711	172.67.149.157	192.168.2.6
Jul 3, 2024 00:52:03.574280977 CEST	49711	443	192.168.2.6	172.67.149.157
Jul 3, 2024 00:52:03.574362993 CEST	443	49711	172.67.149.157	192.168.2.6
Jul 3, 2024 00:52:03.574436903 CEST	443	49711	172.67.149.157	192.168.2.6
Jul 3, 2024 00:52:03.574485064 CEST	49711	443	192.168.2.6	172.67.149.157
Jul 3, 2024 00:52:03.578291893 CEST	49711	443	192.168.2.6	172.67.149.157
Jul 3, 2024 00:52:03.578315973 CEST	443	49711	172.67.149.157	192.168.2.6
Jul 3, 2024 00:52:07.957669973 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:07.962672949 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:07.962753057 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:07.965403080 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:07.965481043 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:07.970395088 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:07.970413923 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:08.470376015 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:08.470530987 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:08.493006945 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:08.493047953 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:08.497914076 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:08.497997999 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:08.612132072 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:08.612196922 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:08.613512039 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:08.613563061 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:08.618364096 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:08.618374109 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:08.732316017 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:08.732388020 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:08.733628035 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:08.733681917 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:08.738399029 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:08.738601923 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:09.805138111 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:09.805262089 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:09.806900024 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:09.807079077 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:09.807163954 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:09.807307005 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:09.807852983 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:09.808037043 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:09.808264017 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:09.808331966 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:09.811795950 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:09.812108994 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:09.987482071 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:09.989564896 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:09.993889093 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:09.994070053 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:09.998812914 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:09.999074936 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:10.165796995 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:10.165879965 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:10.170548916 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:10.171081066 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:10.175467014 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:10.175904036 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:10.341598988 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:10.342190027 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:10.386570930 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:10.386619091 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:10.391544104 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:10.391729116 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:10.558665991 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:10.558743954 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:10.560085058 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:10.560120106 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:10.564946890 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:10.565126896 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:10.734062910 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:10.734149933 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:10.735692024 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:10.735809088 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:10.740628958 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:10.740642071 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:10.927839041 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:10.928193092 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:10.929373026 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:10.929399967 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:10.934241056 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:10.934389114 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:11.105117083 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:11.105185986 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.106544971 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.106594086 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.111402035 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:11.111478090 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:11.277678013 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:11.277848959 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.279211044 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.279268980 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.284006119 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:11.284193993 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:11.454046965 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:11.454119921 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.455524921 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.455554008 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.460534096 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:11.461071014 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:11.632477999 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:11.632556915 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.634011984 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.634068012 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.647969961 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:11.761626959 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:11.761718988 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.762917042 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.763015985 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.767788887 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:11.767905951 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:11.944778919 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:11.945297956 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.946531057 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.946531057 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:11.960145950 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:12.079381943 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:12.079687119 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.080862045 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.080987930 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.085689068 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:12.085869074 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:12.253134966 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:12.253353119 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.254610062 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.254689932 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.259531021 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:12.259617090 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:12.426189899 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:12.426523924 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.427812099 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.427812099 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.432789087 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:12.547314882 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:12.547410965 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.548513889 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.548664093 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.553456068 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:12.666599989 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:12.666866064 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.668143034 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.668261051 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.673074961 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:12.673324108 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:12.842065096 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:12.850076914 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.858031988 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.862030983 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:12.862940073 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:12.866913080 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.029406071 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.029481888 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.031795979 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.031838894 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.036890984 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.151704073 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.151863098 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.153160095 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.153196096 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.158015013 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.158130884 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.325474024 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.325550079 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.327069998 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.327142954 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.331912041 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.332026005 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.502655029 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.502726078 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.504103899 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.504153013 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.508934021 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.509061098 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.678040981 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.678113937 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.679189920 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.679265022 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.684119940 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.797960997 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.798023939 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.799576044 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.799604893 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.810302019 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.810319901 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.973704100 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.973768950 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.975078106 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.975130081 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:13.980004072 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:13.980042934 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:14.149854898 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:14.149921894 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.151268959 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.151438951 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.156156063 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:14.156256914 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:14.325221062 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:14.325330973 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.326494932 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.326520920 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.331413984 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:14.331458092 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:14.497618914 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:14.497705936 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.500302076 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.500323057 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.505143881 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:14.505235910 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:14.673593044 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:14.673650980 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.677396059 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.677469015 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.682318926 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:14.796391010 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:14.796461105 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.797725916 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.797817945 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.802530050 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:14.802840948 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:14.969175100 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:14.969238043 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.970477104 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.970504045 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:14.975302935 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:14.975431919 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:15.142137051 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:15.146137953 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:15.149646997 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:15.149764061 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:15.154522896 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:15.154778957 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:15.322299004 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:15.322913885 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:15.325324059 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:15.326523066 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:15.330319881 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:15.331406116 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:15.498889923 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:15.498961926 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:15.500102997 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:15.500152111 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:15.505058050 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:15.505425930 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:15.673332930 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:15.673412085 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:15.674499035 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:15.674530029 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:15.679317951 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:15.679577112 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:15.851475954 CEST	80	49712	54.165.254.88	192.168.2.6
Jul 3, 2024 00:52:15.851556063 CEST	49712	80	192.168.2.6	54.165.254.88
Jul 3, 2024 00:52:15.948101044 CEST	49712	80	192.168.2.6	54.165.254.88

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 00:52:02.600671053 CEST	54863	53	192.168.2.6	1.1.1.1
Jul 3, 2024 00:52:02.616743088 CEST	53	54863	1.1.1.1	192.168.2.6
Jul 3, 2024 00:52:07.876960993 CEST	60434	53	192.168.2.6	1.1.1.1
Jul 3, 2024 00:52:07.907663107 CEST	53	60434	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 00:52:02.600671053 CEST	192.168.2.6	1.1.1.1	0x3a28	Standard query (0)	elcxbm.processosdigital.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 00:52:07.876960993 CEST	192.168.2.6	1.1.1.1	0xcb34	Standard query (0)	collect.installeranalytics.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 00:52:02.616743088 CEST	1.1.1.1	192.168.2.6	0x3a28	No error (0)	elcxbm.processosdigital.com		172.67.149.157	A (IP address)	IN (0x0001)	false
Jul 3, 2024 00:52:02.616743088 CEST	1.1.1.1	192.168.2.6	0x3a28	No error (0)	elcxbm.processosdigital.com		104.21.29.187	A (IP address)	IN (0x0001)	false
Jul 3, 2024 00:52:07.907663107 CEST	1.1.1.1	192.168.2.6	0xcb34	No error (0)	collect.installeranalytics.com		54.165.254.88	A (IP address)	IN (0x0001)	false
Jul 3, 2024 00:52:07.907663107 CEST	1.1.1.1	192.168.2.6	0xcb34	No error (0)	collect.installeranalytics.com		54.204.31.229	A (IP address)	IN (0x0001)	false
Jul 3, 2024 00:52:14.414756060 CEST	1.1.1.1	192.168.2.6	0xb446	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 00:52:14.414756060 CEST	1.1.1.1	192.168.2.6	0xb446	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jul 3, 2024 00:53:15.721900940 CEST	1.1.1.1	192.168.2.6	0x7a3a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jul 3, 2024 00:53:15.721900940 CEST	1.1.1.1	192.168.2.6	0x7a3a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

elcxbm.processosdigital.com

collect.installeranalytics.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49712	54.165.254.88	80	5692	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 00:52:07.965403080 CEST	241	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 167 Cache-Control: no-cache
Jul 3, 2024 00:52:07.965481043 CEST	167	OUT	Data Raw: 71 74 3d 33 39 30 32 36 37 31 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 73 74 61 72 74 26 76 3d 33 26 61 69 64 3d 36 36 38 33 61 61 61 35 38 35 66 31 66 62 38 35 34 38 66 65 36 64 32 34 26 61 76 3d 38 2e 37 2e 38 2e 39 26 63 69 64 3d 44 46 Data Ascii: qt=3902671&t=lifecycle&lc=start&v=3&aid=6683aaa585f1fb8548fe6d24&av=8.7.8.9&cid=DF7942F70C5F63E22DD3C93671DB882D1C26CFBD&sid=%7BFA5B8B9A-3776-46FC-AA1F-39AC224FF43F%7D
Jul 3, 2024 00:52:08.470376015 CEST	338	IN	HTTP/1.1 200 OK Cache-control: no-cache="set-cookie" Date: Tue, 02 Jul 2024 22:52:08 GMT Set-Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D;PATH=/;MAX-AGE=600 X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:08.493006945 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 179 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:08.493047953 CEST	179	OUT	Data Raw: 71 74 3d 33 39 30 34 31 34 30 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 65 72 73 69 6f 6e 4e 54 26 76 61 6c 3d 31 30 30 30 26 76 3d 33 26 61 69 64 3d 36 36 38 33 61 61 61 35 38 35 66 31 66 62 38 35 34 38 66 65 36 64 32 34 26 61 76 3d 38 2e Data Ascii: qt=3904140&t=property&lb=VersionNT&val=1000&v=3&aid=6683aaa585f1fb8548fe6d24&av=8.7.8.9&cid=DF7942F70C5F63E22DD3C93671DB882D1C26CFBD&sid=%7BFA5B8B9A-3776-46FC-AA1F-39AC224FF43F%7D
Jul 3, 2024 00:52:08.612132072 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:08 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:08.613512039 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 181 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:08.613563061 CEST	181	OUT	Data Raw: 71 74 3d 33 39 30 34 32 36 35 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 65 72 73 69 6f 6e 4e 54 36 34 26 76 61 6c 3d 31 30 30 30 26 76 3d 33 26 61 69 64 3d 36 36 38 33 61 61 61 35 38 35 66 31 66 62 38 35 34 38 66 65 36 64 32 34 26 61 76 3d Data Ascii: qt=3904265&t=property&lb=VersionNT64&val=1000&v=3&aid=6683aaa585f1fb8548fe6d24&av=8.7.8.9&cid=DF7942F70C5F63E22DD3C93671DB882D1C26CFBD&sid=%7BFA5B8B9A-3776-46FC-AA1F-39AC224FF43F%7D
Jul 3, 2024 00:52:08.732316017 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:08 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:08.733628035 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 184 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:08.733681917 CEST	184	OUT	Data Raw: 71 74 3d 33 39 30 34 33 39 30 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 50 68 79 73 69 63 61 6c 4d 65 6d 6f 72 79 26 76 61 6c 3d 38 31 39 31 26 76 3d 33 26 61 69 64 3d 36 36 38 33 61 61 61 35 38 35 66 31 66 62 38 35 34 38 66 65 36 64 32 34 26 Data Ascii: qt=3904390&t=property&lb=PhysicalMemory&val=8191&v=3&aid=6683aaa585f1fb8548fe6d24&av=8.7.8.9&cid=DF7942F70C5F63E22DD3C93671DB882D1C26CFBD&sid=%7BFA5B8B9A-3776-46FC-AA1F-39AC224FF43F%7D
Jul 3, 2024 00:52:09.805138111 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:08 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:09.806900024 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 180 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:09.807079077 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:08 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:09.807307005 CEST	180	OUT	Data Raw: 71 74 3d 33 39 30 35 34 35 33 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 65 72 73 69 6f 6e 4d 73 69 26 76 61 6c 3d 35 2e 30 30 26 76 3d 33 26 61 69 64 3d 36 36 38 33 61 61 61 35 38 35 66 31 66 62 38 35 34 38 66 65 36 64 32 34 26 61 76 3d 38 Data Ascii: qt=3905453&t=property&lb=VersionMsi&val=5.00&v=3&aid=6683aaa585f1fb8548fe6d24&av=8.7.8.9&cid=DF7942F70C5F63E22DD3C93671DB882D1C26CFBD&sid=%7BFA5B8B9A-3776-46FC-AA1F-39AC224FF43F%7D
Jul 3, 2024 00:52:09.807852983 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:08 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:09.808264017 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:08 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:09.987482071 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:09 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:09.993889093 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 174 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:09.994070053 CEST	174	OUT	Data Raw: 71 74 3d 33 39 30 35 36 34 30 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 55 49 4c 65 76 65 6c 26 76 61 6c 3d 33 26 76 3d 33 26 61 69 64 3d 36 36 38 33 61 61 61 35 38 35 66 31 66 62 38 35 34 38 66 65 36 64 32 34 26 61 76 3d 38 2e 37 2e 38 2e 39 Data Ascii: qt=3905640&t=property&lb=UILevel&val=3&v=3&aid=6683aaa585f1fb8548fe6d24&av=8.7.8.9&cid=DF7942F70C5F63E22DD3C93671DB882D1C26CFBD&sid=%7BFA5B8B9A-3776-46FC-AA1F-39AC224FF43F%7D
Jul 3, 2024 00:52:10.165796995 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:10 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:10.170548916 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 183 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:10.171081066 CEST	183	OUT	Data Raw: 71 74 3d 33 39 30 35 38 31 32 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 69 72 74 75 61 6c 4d 65 6d 6f 72 79 26 76 61 6c 3d 36 37 38 38 26 76 3d 33 26 61 69 64 3d 36 36 38 33 61 61 61 35 38 35 66 31 66 62 38 35 34 38 66 65 36 64 32 34 26 61 Data Ascii: qt=3905812&t=property&lb=VirtualMemory&val=6788&v=3&aid=6683aaa585f1fb8548fe6d24&av=8.7.8.9&cid=DF7942F70C5F63E22DD3C93671DB882D1C26CFBD&sid=%7BFA5B8B9A-3776-46FC-AA1F-39AC224FF43F%7D
Jul 3, 2024 00:52:10.341598988 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:10 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:10.386570930 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 183 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:10.386619091 CEST	183	OUT	Data Raw: 71 74 3d 33 39 30 36 30 30 30 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 4d 73 69 4e 54 50 72 6f 64 75 63 74 54 79 70 65 26 76 61 6c 3d 31 26 76 3d 33 26 61 69 64 3d 36 36 38 33 61 61 61 35 38 35 66 31 66 62 38 35 34 38 66 65 36 64 32 34 26 61 Data Ascii: qt=3906000&t=property&lb=MsiNTProductType&val=1&v=3&aid=6683aaa585f1fb8548fe6d24&av=8.7.8.9&cid=DF7942F70C5F63E22DD3C93671DB882D1C26CFBD&sid=%7BFA5B8B9A-3776-46FC-AA1F-39AC224FF43F%7D
Jul 3, 2024 00:52:10.558665991 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:10 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:10.560085058 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 183 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:10.560120106 CEST	183	OUT	Data Raw: 71 74 3d 33 39 30 36 32 30 33 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 53 65 72 76 69 63 65 50 61 63 6b 4c 65 76 65 6c 26 76 61 6c 3d 30 26 76 3d 33 26 61 69 64 3d 36 36 38 33 61 61 61 35 38 35 66 31 66 62 38 35 34 38 66 65 36 64 32 34 26 61 Data Ascii: qt=3906203&t=property&lb=ServicePackLevel&val=0&v=3&aid=6683aaa585f1fb8548fe6d24&av=8.7.8.9&cid=DF7942F70C5F63E22DD3C93671DB882D1C26CFBD&sid=%7BFA5B8B9A-3776-46FC-AA1F-39AC224FF43F%7D
Jul 3, 2024 00:52:10.734062910 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:10 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:10.735692024 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 185 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:10.735809088 CEST	185	OUT	Data Raw: 71 74 3d 33 39 30 36 33 39 30 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 50 72 6f 64 75 63 74 4c 61 6e 67 75 61 67 65 26 76 61 6c 3d 31 30 34 36 26 76 3d 33 26 61 69 64 3d 36 36 38 33 61 61 61 35 38 35 66 31 66 62 38 35 34 38 66 65 36 64 32 34 Data Ascii: qt=3906390&t=property&lb=ProductLanguage&val=1046&v=3&aid=6683aaa585f1fb8548fe6d24&av=8.7.8.9&cid=DF7942F70C5F63E22DD3C93671DB882D1C26CFBD&sid=%7BFA5B8B9A-3776-46FC-AA1F-39AC224FF43F%7D
Jul 3, 2024 00:52:10.927839041 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:10 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:10.929373026 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 195 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:11.105117083 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:11 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:11.106544971 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 192 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:11.277678013 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:11 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:11.279211044 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 195 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:11.454046965 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:11 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:11.455524921 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 192 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:11.632477999 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:11 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:11.634011984 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 194 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:11.761626959 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:11 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:11.762917042 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 210 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:11.944778919 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:11 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:11.946531057 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 211 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:12.079381943 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:12 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:12.080862045 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 193 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:12.253134966 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:12 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:12.254610062 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 207 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:12.426189899 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:12 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:12.427812099 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 199 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:12.547314882 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:12 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:12.548513889 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 201 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:12.666599989 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:12 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:12.668143034 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 201 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:12.842065096 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:12 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:12.858031988 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 203 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:13.029406071 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:12 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:13.031795979 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 202 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:13.151704073 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:13 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:13.153160095 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 204 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:13.325474024 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:13 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:13.327069998 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 204 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:13.502655029 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:13 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:13.504103899 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 207 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:13.678040981 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:13 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:13.679189920 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 206 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:13.797960997 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:13 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:13.799576044 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 201 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:13.973704100 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:13 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:13.975078106 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 208 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:14.149854898 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:14 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:14.151268959 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 212 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:14.325221062 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:14 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:14.326494932 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 191 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:14.497618914 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:14 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:14.500302076 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 183 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:14.673593044 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:14 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:14.677396059 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 176 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:14.796391010 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:14 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:14.797725916 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 184 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:14.969175100 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:14 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:14.970477104 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 184 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:15.142137051 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:15 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:15.149646997 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 172 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:15.322299004 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:15 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:15.325324059 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 179 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:15.498889923 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:15 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:15.500102997 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 219 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:15.673332930 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:15 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jul 3, 2024 00:52:15.674499035 CEST	396	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 181 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D011F13AD531ABC9A901D897C5D4125673CC3FD11D154C49B372271AF195BAE1D
Jul 3, 2024 00:52:15.851475954 CEST	122	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 22:52:15 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	172.67.149.157	443	5692	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 22:52:03 UTC	170	OUT	GET /caju1.png HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: elcxbm.processosdigital.com
2024-07-02 22:52:03 UTC	699	IN	HTTP/1.1 403 Forbidden Date: Tue, 02 Jul 2024 22:52:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Tue, 02 Jul 2024 22:52:18 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f6z5%2FE3OcaA5%2FKtAU9zy8RpPZmOLoqY9ePQD%2Fb2HR5gI2pxtMn6lDCyOh7MhnoL2J1o0GGji3GMHbWj9f2NnHJMEmeKEfOztlO0WN8RQGIAZufBE3LcMwkns5qxxhEaCfToXbCKZ4%2B9aZmeh8IE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d2343a0d574346-EWR alt-svc: h3=":443"; ma=86400
2024-07-02 22:52:03 UTC	670	IN	Data Raw: 31 31 61 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 11a9<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-07-02 22:52:03 UTC	1369	IN	Data Raw: 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 63 73 73 22 20 2f 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 27 63 66 5f 73 74 79 6c 65 73 2d 69 65 2d 63 73 73 27 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 Data Ascii: id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />...[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script>
2024-07-02 22:52:03 UTC	1369	IN	Data Raw: 61 70 70 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 73 20 74 77 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 62 6c 6f 63 6b 65 64 5f 77 68 79 5f 68 65 61 64 6c 69 6e 65 22 3e 57 68 79 20 68 61 76 65 20 49 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 3f 3c 2f 68 32 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 62 6c 6f 63 6b 65 64 5f 77 68 79 5f 64 65 74 61 69 6c 22 3e 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 75 73 69 6e 67 20 61 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 Data Ascii: apper"> <div class="cf-columns two"> <div class="cf-column"> <h2 data-translate="blocked_why_headline">Why have I been blocked?</h2> <p data-translate="blocked_why_detail">This website is using a security service
2024-07-02 22:52:03 UTC	1121	IN	Data Raw: 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 68 69 64 64 65 6e 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 0a 20 20 20 20 20 20 59 6f 75 72 20 49 50 3a 0a 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 2d 62 74 6e 22 3e 43 6c 69 63 6b 20 74 6f 20 72 65 76 65 61 6c 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 Data Ascii: ="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-footer-ip-reveal" class="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.33</span> <span class="cf-f
2024-07-02 22:52:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	18:51:56
Start date:	02/07/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\0cjB1Kh8zU.msi"
Imagebase:	0x7ff6de740000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:51:56
Start date:	02/07/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6de740000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	18:51:57
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 11E696952DD6B03AAA33864004BDDF5F
Imagebase:	0x540000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0cjB1Kh8zU.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\AdvinstAnalytics\6683aaa585f1fb8548fe6d24\8.7.8.9\tracking.ini

C:\Users\user\AppData\Local\AdvinstAnalytics\6683aaa585f1fb8548fe6d24\8.7.8.9\{FA5B8B9A-3776-46FC-AA1F-39AC224FF43F}.session

C:\Users\user\AppData\Local\Temp\shi8051.tmp

C:\Users\user\AppData\Local\Temp\shi81E8.tmp

C:\Users\user\AppData\Local\Temp\tampa.ses

C:\Users\user\IOAsNN\VNgnVm\IOAsNN.png

C:\Users\user\IOAsNN\VNgnVm\IOAsNN.zip (copy)

C:\Windows\Installer\3a7d63.msi

C:\Windows\Installer\MSI7ECA.tmp

C:\Windows\Installer\MSI7F87.tmp

C:\Windows\Installer\MSI7FB7.tmp

C:\Windows\Installer\MSI8006.tmp

C:\Windows\Installer\MSI8026.tmp

C:\Windows\Installer\MSI8BFE.tmp

C:\Windows\Installer\MSI8C4E.tmp

C:\Windows\Installer\MSI8CFA.tmp

C:\Windows\Installer\MSI8D2A.tmp

C:\Windows\Installer\MSI8D99.tmp

C:\Windows\Installer\MSIA2F6.tmp

C:\Windows\Installer\SourceHash{5FABA36A-ECA6-4633-964F-369C3AFA2A7A}

C:\Windows\Installer\inprogressinstallinfo.ipi

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Windows Analysis Report
0cjB1Kh8zU.msi

**\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON**