Edit tour

Windows Analysis Report
Skype_translate6.3.1.msi

Overview

General Information

Sample name:	Skype_translate6.3.1.msi
Analysis ID:	1525177
MD5:	83319da2936aadc100ef5055c14fbada
SHA1:	d5b3747ece0b07359189ecda49c3ba50cb46462d
SHA256:	d1344fbb55e72f7cb1914e649ec603f867665550c09ac7eb234c479a517068d9
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Loading BitLocker PowerShell Module

Sigma detected: Execution from Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Program Location with Network Connections

Yara detected Generic Downloader

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries information about the installed CPU (vendor, model number etc)

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Stores files to the Windows start menu directory

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64_ra

msiexec.exe (PID: 1552 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Skype_translate6.3.1.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6268 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6796 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 689976F0CEEA8AC9AF52C308CCEF2DF8 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 2452 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 193F5A0F0B6BA7095C04F9C165853480 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6912 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding D93E99CDD3F787BE83789AF97206A1B8 E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

powershell.exe (PID: 2076 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6408 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4480 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defenderr' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WsTaskLoad.exe (PID: 6092 cmdline: "C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe" MD5: FAF4A129B091A57C3FF694DC721D4F3B)

TaskLoad.exe (PID: 4540 cmdline: C:\Users\Public\Documents\TaskLoad.exe MD5: FAF4A129B091A57C3FF694DC721D4F3B)

rundll32.exe (PID: 2044 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

Skype.exe (PID: 1092 cmdline: "C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe" MD5: 01D77221DDB17824B6B42ED325D991DB)

Skype.tmp (PID: 6392 cmdline: "C:\Users\user\AppData\Local\Temp\is-MICD6.tmp\Skype.tmp" /SL5="$201F6,89112581,404480,C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe" MD5: D836F5ABB87998795EDD2A9FFED410D9)

Skype.exe (PID: 1460 cmdline: "C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe" /SPAWNWND=$20136 /NOTIFYWND=$201F6 MD5: 01D77221DDB17824B6B42ED325D991DB)

Skype.tmp (PID: 6624 cmdline: "C:\Users\user\AppData\Local\Temp\is-F6T49.tmp\Skype.tmp" /SL5="$50028,89112581,404480,C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe" /SPAWNWND=$20136 /NOTIFYWND=$201F6 MD5: D836F5ABB87998795EDD2A9FFED410D9)

taskkill.exe (PID: 2076 cmdline: "C:\Windows\System32\taskkill.exe" /f /im Skype.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\ProgramData\1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Finkit.ManicTime.Shared.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\ProgramData\Finkit.ManicTime.Common.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\netstandard.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000015.00000000.1498418619.0000000000401000.00000020.00000001.01000000.00000006.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Documents\TaskLoad.exe, CommandLine: C:\Users\Public\Documents\TaskLoad.exe, CommandLine|base64offset|contains: , Image: C:\Users\Public\Documents\TaskLoad.exe, NewProcessName: C:\Users\Public\Documents\TaskLoad.exe, OriginalFileName: C:\Users\Public\Documents\TaskLoad.exe, ParentCommandLine: "C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe" , ParentImage: C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe, ParentProcessId: 6092, ParentProcessName: WsTaskLoad.exe, ProcessCommandLine: C:\Users\Public\Documents\TaskLoad.exe, ProcessId: 4540, ProcessName: TaskLoad.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData', CommandLine|base64offset|contains: *&, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding D93E99CDD3F787BE83789AF97206A1B8 E Global\MSI0000, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 6912, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData', ProcessId: 2076, ProcessName: powershell.exe

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 45.115.127.166, DestinationIsIpv6: false, DestinationPort: 6180, EventID: 3, Image: C:\Users\Public\Documents\TaskLoad.exe, Initiated: true, ProcessId: 4540, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 49735

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData', CommandLine|base64offset|contains: *&, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding D93E99CDD3F787BE83789AF97206A1B8 E Global\MSI0000, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 6912, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData', ProcessId: 2076, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 87.2% probability

Source: C:\Windows\SysWOW64\msiexec.exe	Directory created: C:\Program Files\Windows Defenderr	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory created: C:\Program Files\Windows Defenderr\xf7JbcXqtF	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory created: C:\Program Files\Windows Defenderr\xf7JbcXqtF\WS_Log.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory created: C:\Program Files\Windows Defenderr\xf7JbcXqtF\FourierTransformLib8.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory created: C:\Program Files\Windows Defenderr\xf7JbcXqtF\ImageRestoreLib8.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory created: C:\Program Files\Windows Defenderr\xf7JbcXqtF\wavelet_3_8.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory created: C:\Program Files\Windows Defenderr\xf7JbcXqtF\_8	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory created: C:\Program Files\Windows Defenderr\xf7JbcXqtF\dll1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory created: C:\Program Files\Windows Defenderr\xf7JbcXqtF\COMSupport.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Directory created: C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe	Jump to behavior
Source: C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe	Directory created: C:\Program Files\Windows Defenderr\xf7JbcXqtF\Log
Source: C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe	Directory created: C:\Program Files\Windows Defenderr\xf7JbcXqtF\Log\WsTaskLoad.txt

Source: C:\Users\user\AppData\Local\Temp\is-F6T49.tmp\Skype.tmp

File created: C:\Users\user\AppData\Local\Temp\Setup Log 2024-10-03 #001.txt

Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: z:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: x:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: v:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: t:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: r:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: p:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: n:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: l:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: j:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: h:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: f:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: b:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: y:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: w:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: u:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: s:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: q:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: o:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: m:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: k:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: i:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: g:
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: e:
Source: C:\Users\user\AppData\Local\Temp\is-F6T49.tmp\Skype.tmp	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior
Source: C:\Users\Public\Documents\TaskLoad.exe	File opened: [:

Networking

Yara detected Generic Downloader

Source: Yara match	File source: C:\ProgramData\Finkit.ManicTime.Shared.dll, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Finkit.ManicTime.Common.dll, type: DROPPED
Source: Yara match	File source: C:\ProgramData\netstandard.dll, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.16:49735 -> 45.115.127.166:6180

Source: Joe Sandbox View

ASN Name: POWERLINE-AS-APPOWERLINEDATACENTERHK POWERLINE-AS-APPOWERLINEDATACENTERHK

Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166
Source: unknown	TCP traffic detected without corresponding DNS query: 45.115.127.166

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\646b65.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7662.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI76B1.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI76D1.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{3E1181C7-5D55-4008-BAF8-0264326DC618}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7849.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3E1181C7-5D55-4008-BAF8-0264326DC618}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3E1181C7-5D55-4008-BAF8-0264326DC618}\Skype.exe	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI7662.tmp

Jump to behavior

Source: Finkit.ManicTime.Common.O.dll.1.dr, -.cs

Base64 encoded string: 'WT/mY3IKPIJJDEszF9MCAUmdPg9zSXSNJVQ0hj1rbhzGfG9dBhVoNcJcMzcLTRSbQE47amV0VHlwZUZyb20uYW5kbGU7Z2V0X05hbWU7SW5kZXhPZjtFeGl0O2dldF9GcmFtZUNvdW50O2dldF9MZW5ndGg7UmVhZFN0cmluZztBZGQ7Z2V0X1Bvc2l0aW9uO2dldF9DdXJyZW50RG9tYWluO1NldERhdGE7UnVudGltZU1ldGhvZDtTeXN0ZW0uRGlhZ25vc3RpY3MuU3RhY2tUcmFjZTtTeXN0ZW0uRGlhZ25vc3RpY3MuU3RhY2tGcmFtZTsxNDc2OTtTeXN0ZW0uRW52aXJvbm1lbnQ7ZGU0ZG90O1NpbXBsZUFzc2VtYmx5RXhwbG9yZXI7YmFiZWx2bTtzbW9rZXRlc3Q='

Source: classification engine

Classification label: mal72.troj.evad.winMSI@31/537@0/1

Source: C:\Windows\SysWOW64\msiexec.exe

File created: C:\Program Files\Windows Defenderr

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Skype_setup

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6352:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1060:120:WilError_03
Source: C:\Users\Public\Documents\TaskLoad.exe	Mutant created: \Sessions\1\BaseNamedObjects\Run2019
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7132:120:WilError_03
Source: C:\Users\Public\Documents\TaskLoad.exe	Mutant created: \Sessions\1\BaseNamedObjects\YYddedabfacc

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSI3060.tmp

Jump to behavior

Source: Yara match	File source: 00000015.00000000.1498418619.0000000000401000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\1, type: DROPPED
Source: Yara match	File source: C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe, type: DROPPED

Source: C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Documents\TaskLoad.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-MICD6.tmp\Skype.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-F6T49.tmp\Skype.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = '360tray.exe'
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'QQPCTray.exe'
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process Where Name = 'HipsTray.exe'

Source: C:\Windows\System32\msiexec.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_USERS.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-F6T49.tmp\Skype.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Skype_translate6.3.1.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 689976F0CEEA8AC9AF52C308CCEF2DF8 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 193F5A0F0B6BA7095C04F9C165853480
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding D93E99CDD3F787BE83789AF97206A1B8 E Global\MSI0000
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defenderr'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe "C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe	Process created: C:\Users\Public\Documents\TaskLoad.exe C:\Users\Public\Documents\TaskLoad.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe "C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe"
Source: C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe	Process created: C:\Users\user\AppData\Local\Temp\is-MICD6.tmp\Skype.tmp "C:\Users\user\AppData\Local\Temp\is-MICD6.tmp\Skype.tmp" /SL5="$201F6,89112581,404480,C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe"
Source: C:\Users\user\AppData\Local\Temp\is-MICD6.tmp\Skype.tmp	Process created: C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe "C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe" /SPAWNWND=$20136 /NOTIFYWND=$201F6
Source: C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe	Process created: C:\Users\user\AppData\Local\Temp\is-F6T49.tmp\Skype.tmp "C:\Users\user\AppData\Local\Temp\is-F6T49.tmp\Skype.tmp" /SL5="$50028,89112581,404480,C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe" /SPAWNWND=$20136 /NOTIFYWND=$201F6
Source: C:\Users\user\AppData\Local\Temp\is-F6T49.tmp\Skype.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\System32\taskkill.exe" /f /im Skype.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 689976F0CEEA8AC9AF52C308CCEF2DF8 C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 193F5A0F0B6BA7095C04F9C165853480	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding D93E99CDD3F787BE83789AF97206A1B8 E Global\MSI0000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents'	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defenderr'	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe "C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe"	Jump to behavior
Source: C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe	Process created: C:\Users\Public\Documents\TaskLoad.exe C:\Users\Public\Documents\TaskLoad.exe
Source: C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe	Process created: C:\Users\user\AppData\Local\Temp\is-MICD6.tmp\Skype.tmp "C:\Users\user\AppData\Local\Temp\is-MICD6.tmp\Skype.tmp" /SL5="$201F6,89112581,404480,C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe"
Source: C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe	Process created: C:\Users\user\AppData\Local\Temp\is-F6T49.tmp\Skype.tmp "C:\Users\user\AppData\Local\Temp\is-F6T49.tmp\Skype.tmp" /SL5="$50028,89112581,404480,C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe" /SPAWNWND=$20136 /NOTIFYWND=$201F6
Source: C:\Users\user\AppData\Local\Temp\is-F6T49.tmp\Skype.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\System32\taskkill.exe" /f /im Skype.exe

Source: AutoMapper.dll.1.dr, DictionaryMapper.cs	.Net Code: Map
Source: Finkit.ManicTime.Common.O.dll.1.dr, -.cs	.Net Code: _E000 System.Reflection.Assembly.Load(byte[])

Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\a8	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Finkit.ManicTime.Shared.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\a9	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\4	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\a6	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft.Data.Sqlite.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\a10	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Finkit.ManicTime.Common.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Interop.UIAutomationClient.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\netstandard.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Finkit.ManicTime.Common.O.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Finkit.ManicTime.Shared.XmlSerializers.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\IdentityModel.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Finkit.ManicTime.Tracker.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft.Extensions.Options.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft.Extensions.Logging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft.IdentityModel.Tokens.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft.IdentityModel.Logging.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\IdentityModel.OidcClient.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Irony.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\14	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\15	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft.Extensions.Logging.Abstractions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\1	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\2	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft.Win32.Registry.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-F6T49.tmp\Skype.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
Source: C:\Users\user\AppData\Local\Temp\is-F6T49.tmp\Skype.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype\Skype.lnk

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8429	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 855	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7522	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1679	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7668
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1257

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4308	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3596	Thread sleep count: 7522 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1092	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1736	Thread sleep count: 1679 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 552	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3016	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809
Source: C:\Users\Public\Documents\TaskLoad.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Users\Public\Documents\TaskLoad.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809
Source: C:\Users\user\AppData\Local\Temp\is-MICD6.tmp\Skype.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Users\user\AppData\Local\Temp\is-MICD6.tmp\Skype.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809
Source: C:\Users\user\AppData\Local\Temp\is-F6T49.tmp\Skype.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Users\user\AppData\Local\Temp\is-F6T49.tmp\Skype.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Public\Documents\TaskLoad.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Program Files\Windows Defenderr\xf7JbcXqtF\WsTaskLoad.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\Public\Documents\TaskLoad.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	33 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	2 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 File Deletion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Source	Detection	Scanner
C:\Program Files (x86)\Microsoft\Skype for Desktop\API-MS-Win-core-xstate-l2-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\SkypeContext.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-console-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-datetime-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-debug-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-errorhandling-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-file-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-file-l1-2-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-file-l2-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-handle-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-heap-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-interlocked-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-libraryloader-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-louserzation-l1-2-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-memory-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-namedpipe-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-processenvironment-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-processthreads-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-processthreads-l1-1-1.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-profile-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-rtlsupport-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-string-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-synch-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-synch-l1-2-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-sysinfo-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-timezone-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-util-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-crt-conio-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-crt-convert-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-crt-environment-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-crt-filesystem-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-crt-heap-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-crt-locale-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-crt-math-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-crt-multibyte-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-crt-private-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-crt-process-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-crt-runtime-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-crt-stdio-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-crt-string-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-crt-time-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-crt-utility-l1-1-0.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\d3dcompiler_47.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\ffmpeg.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-0PH04.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-1IGRH.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-1T5UL.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-23KPT.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-3730D.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-3AACR.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-3J3U4.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-4H416.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-5RBAJ.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-5UKO7.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-78UGL.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-7TIRP.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-9N9E1.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-BG57V.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-BOGAM.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-C4HQB.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-CFD9B.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-D51FC.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-D7J13.tmp	0%	ReversingLabs
C:\Program Files (x86)\Microsoft\Skype for Desktop\is-EHJ05.tmp	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
p-9999.p-dc-msedge.net	150.171.86.254	true	false	unknown
t-9999.t-msedge.net	13.107.246.254	true	false	unknown
mcr-9999.mcr-msedge.net	150.171.69.254	true	false	unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525177
Start date and time:	2024-10-03 20:35:37 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Skype_translate6.3.1.msi
Detection:	MAL
Classification:	mal72.troj.evad.winMSI@31/537@0/1
Cookbook Comments:	Found application associated with file extension: .msi

Time	Type	Description
14:36:32	API Interceptor	1x Sleep call for process: msiexec.exe modified
14:36:35	API Interceptor	52x Sleep call for process: powershell.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t-9999.t-msedge.net	gold.exe	Get hash	malicious	RedLine	Browse	13.107.213.254
	22.08.2024.exe	Get hash	malicious	Xmrig	Browse	13.107.213.254
	TWC Electronic Audit Appt Letter LIGHTYEAR DEALER TECHNOLOGIES LLC.docx	Get hash	malicious	Unknown	Browse	13.107.213.254
	K-Lite_Codec_Pack_1848_Basic.exe	Get hash	malicious	Unknown	Browse	13.107.246.254
	Setup (1).exe	Get hash	malicious	Unknown	Browse	13.107.246.254
	K3CloudClientPortal.exe	Get hash	malicious	Unknown	Browse	13.107.246.254
	QPT 8.9 for PowerPoint.exe	Get hash	malicious	Unknown	Browse	13.107.246.254
	https://rentry.co/webitokt/raw	Get hash	malicious	Unknown	Browse	13.107.213.254
	Skeeyah.A' in file 'ibaAnalyzerInstall_v6.6.4.exe'	Get hash	malicious	Unknown	Browse	13.107.213.254
	8VwmFai4QF.exe	Get hash	malicious	FormBook	Browse	13.107.246.254
mcr-9999.mcr-msedge.net	https://www.google.md/url?url=https://demeropkdfzdbi&uxzs=zemleptc&icmeyuc=zn0&ywprgz=icmeyuc&uxzs=zemleptc&ywprgz=icmeyuc&fzdbi=demeropkd&znzn=ywprgzuxzs&q=amp%2Fdecentafrica.com%2Flok%2F1160851136%2FZHVzdGluLmZpY2NvQHZvc3Nsb2guY29t	Get hash	malicious	Unknown	Browse	150.171.69.254
	Sch#U00e9maplic Client-7.6.1166.0.exe	Get hash	malicious	Havoc	Browse	150.171.70.254
	gold.exe	Get hash	malicious	RedLine	Browse	150.171.70.254
	sky_spf.exe	Get hash	malicious	Unknown	Browse	150.171.69.254
	ProcShellcodeExec.exe	Get hash	malicious	Unknown	Browse	150.171.70.254
	https://larandeteknik.se/reports.php	Get hash	malicious	Unknown	Browse	150.171.70.254
	invoice 700898 for wallcentre.com.shtml	Get hash	malicious	Unknown	Browse	150.171.70.254
	https://www.ammyy.com/it/downloads.html	Get hash	malicious	Flawedammyy	Browse	150.171.69.254

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
POWERLINE-AS-APPOWERLINEDATACENTERHK	novo.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	156.253.238.101
	x86.elf	Get hash	malicious	Mirai	Browse	156.242.206.51
	PURCHASE ORDER.exe	Get hash	malicious	FormBook	Browse	156.242.132.82
	Product Data Specifications_PDF.exe	Get hash	malicious	FormBook	Browse	45.114.171.236
	NVOICE FOR THE MONTH OF AUG-24.exe	Get hash	malicious	FormBook	Browse	156.242.132.82
	rAGROTIS10599242024.exe	Get hash	malicious	FormBook	Browse	154.215.72.110
	QlHhDu2uh1.exe	Get hash	malicious	FormBook	Browse	45.114.171.236
	oO3ZmCAeLQ.exe	Get hash	malicious	FormBook	Browse	154.215.72.110
	FvYlbhvZrZ.rtf	Get hash	malicious	FormBook	Browse	154.215.72.110
	SecuriteInfo.com.Win32.SuspectCrc.23106.21095.xlsx	Get hash	malicious	FormBook	Browse	154.215.72.110

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Microsoft\Skype for Desktop\API-MS-Win-core-xstate-l2-1-0.dll (copy)	https://download2.easeus.com/installer_rss_new.php	Get hash	malicious	Unknown	Browse
	001l802151BTT921S0AT4R1F003.msi	Get hash	malicious	Unknown	Browse
	T1SN5sRQjf.exe	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-console-l1-1-0.dll (copy)	https://www.totalav.com/free-download-3?exit	Get hash	malicious	Unknown	Browse
	https://www.totalav.com/free-download-3?exit	Get hash	malicious	Unknown	Browse
	https://updatecdn.meeting.qq.com/cos/37a67c4f1858c83dff9f22a27bb8f27d/VooVMeeting_1410000197_3.23.1.510.publish.exe	Get hash	malicious	Unknown	Browse
	https://download2.easeus.com/installer_rss_new.php	Get hash	malicious	Unknown	Browse
	OneLaunch - EarthView3D_3o3f1.exe	Get hash	malicious	Unknown	Browse
	PdfConverters.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.FileRepMalware.6915.17186.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.FileRepMalware.6915.17186.exe	Get hash	malicious	Unknown	Browse
	1.exe	Get hash	malicious	Unknown	Browse
	1.exe	Get hash	malicious	Unknown	Browse

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Skype_translate6.3.1.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$RECYLLE.BIN\TorchWooc

C:\Config.Msi\646b66.rbs

C:\Program Files (x86)\Microsoft\Skype for Desktop\API-MS-Win-core-xstate-l2-1-0.dll (copy)

C:\Program Files (x86)\Microsoft\Skype for Desktop\LICENSES.chromium.html (copy)

C:\Program Files (x86)\Microsoft\Skype for Desktop\NOTICE.txt (copy)

C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe (copy)

C:\Program Files (x86)\Microsoft\Skype for Desktop\SkypeContext.dll (copy)

C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-console-l1-1-0.dll (copy)

C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-datetime-l1-1-0.dll (copy)

C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-debug-l1-1-0.dll (copy)

C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-errorhandling-l1-1-0.dll (copy)

C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-file-l1-1-0.dll (copy)

C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-file-l1-2-0.dll (copy)

C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-file-l2-1-0.dll (copy)

C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-handle-l1-1-0.dll (copy)

C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-heap-l1-1-0.dll (copy)

C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-interlocked-l1-1-0.dll (copy)

C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-libraryloader-l1-1-0.dll (copy)

C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-louserzation-l1-2-0.dll (copy)

C:\Program Files (x86)\Microsoft\Skype for Desktop\api-ms-win-core-memory-l1-1-0.dll (copy)

Windows Analysis Report
Skype_translate6.3.1.msi

Process:	C:\Users\Public\Documents\TaskLoad.exe
File Type:	data
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	6.727856146083383
Encrypted:	false
SSDEEP:	1536:3ooVMAAO251kn06TNcUOE2oPuQ0elOVucs+Pl:4YAOj+7oPxfNM
MD5:	D5F298DE13970F9FC125525BCC223821
SHA1:	89031F8349E09584BDBF06773EB2F9A1747D4956
SHA-256:	8F1F5A5AA1BF446D0D734C6404F6C4A12D69855E9A07D8A68D31841BCC732A86
SHA-512:	F193954E34446C70FCB23B1767DE3DD1D107084E3A1A76D7D2C6B37D4AF135D66734191555103A947D37189B327BA0713EED98AA82D8D0F9839C19F113CFA881
Malicious:	false
Preview:	...0E..EF0F...B0...EB0F.@EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0H..KB.O.!.C\|.!T-+Cfpr*%B'm &#^(ote Ufru+bY( D...+od l=K.$EB0F..E.wP..c:..&x...>..E1..&x.e.4..c:..:t...>.L.4..&x...4..c:..9\|...>..c;.,&x.N.c..c:.a9s...>.'\|>..&x..Y%h.c:.F..EB0F..EB0F..E.uF.LDF0\|.!#B0F..EB0...dI1@...B0F..EB0F.M.B0F..EB0G..EB F..EB F..EB0F..EF0F..EB0F..EB F..EB0D..EB0V..UB0F..EB F..EB0V..ER.G.>EB0N..E.0F..EB0F..EB0F..EB0F..EB0F..5C0z..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0G..GB0F..EB0F..EB0F..EB0F..EB0hte=60F...B0F..EB.F..UB0F..EB0F..EB0f..%lB"at$B0. .EB0G..uB0F..EB0F..EB0F..E.0F@.!#D'..E..F..uC0F0.EB.G..EB0F..EB0F.@EB.hre)-SF."NB0Fp.EB F..%C0F..EB0F..EB0....B0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0F..EB0

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	38869
Entropy (8bit):	4.921698147939128
Encrypted:	false
SSDEEP:	768:AqqpZiITYAwfryPGe5u8LRVCwEbfQGolQC2GfscOfK00JaMlaMdbWINB6vv0SXY6:OBLNYd1OmWkpYOX6fbYaU2sn0JdFEAyJ
MD5:	3EB5302388307E04E2EEADE0BA689A02
SHA1:	B066F122F6A434724BB31EA39D93D2040698FD3C
SHA-256:	70D86AFD9F38D0D4FAFBF883178B920B576604C0153FC32C33ED3068B71C4BFA
SHA-512:	ED38689B677BC4231CF5BBDDC8386A676D326867DCF467095803EB5532628DC74404F0B594D1F8852655709BF0425C17F5E6D905382726E9EAB6C86DDAB2477F
Malicious:	false
Preview:	...@IXOS.@.....@.tCY.@.....@.....@.....@.....@.....@......&.{3E1181C7-5D55-4008-BAF8-0264326DC618}..Skype_setup..Skype_translate6.3.1.msi.@.....@.....@.....@........&.{11D029A9-5BAA-4CCA-AED5-D23DD712D775}.....@.....@.....@.....@.......@.....@.....@.......@......Skype_setup......Rollback..ck(W.V.n.d\O:.....RollbackCleanup..ck(W Rd..Y.N.e.N...e.N:. .[.1.].....ProcessComponents..ck(W.f.e.~.N.l.Qh...&.{D90835D1-284E-47D8-BEF0-9BA2BF4EC591}&.{3E1181C7-5D55-4008-BAF8-0264326DC618}.@......&.{4916E309-E58D-417C-BE51-63CCC0656193}&.{3E1181C7-5D55-4008-BAF8-0264326DC618}.@......&.{E6B504F9-C54E-478E-A4C9-1D268333C9DF}&.{3E1181C7-5D55-4008-BAF8-0264326DC618}.@......&.{D547ACFD-1129-4C9A-A663-9917E96FDB42}&.{3E1181C7-5D55-4008-BAF8-0264326DC618}.@......&.{F76B109F-41D6-403D-AD74-BB5882771A5C}&.{3E1181C7-5D55-4008-BAF8-0264326DC618}.@......&.{F5ECA939-E331-41FB-9E21-BCD61E5EC78A}&.{3E1181C7-5D55-4008-BAF8-0264326DC618}.@......&.{2AC225EF-1A71-43FE-9D15-7E4C8AC8B1A4}&.{3E1181C7-5D55-4008-BAF8-02643

Process:	C:\Users\user\AppData\Local\Temp\is-F6T49.tmp\Skype.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	3.553306613801888
Encrypted:	false
SSDEEP:	24:eH1GSbNj0QEVsXnpkDtf5bdtI1AIZW0HRNfiV9h7r35WWdPO6PN7:y5jWOnputf5bdtIOIZWU7fSh/5WwG2
MD5:	9E683825EAE3B6375CBD63623196BE96
SHA1:	1B30500A36883BF7E3EB63476E6B49151D51AF78
SHA-256:	CBD3FEF707ABF622B150DB1D10B5443264EB6DA8F4D7AA2ADC97C50A22D4D594
SHA-512:	C4316F38ECC0BBF3ADCF1C2B67CE79453C0C292AA2D0637BF400BC10A1751E595885083C79023BE58BD1953A5E30D8E6EBEF4B4AF849F680ADBCB9E5AE820C11
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: 001l802151BTT921S0AT4R1F003.msi, Detection: malicious, Browse Filename: T1SN5sRQjf.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.PE..L.....}B...........!......................... ...............................0......_.....@.......................................... ..................................T............................................................................text............................... ..`.rsrc........ ......................@..@......}B........:...T...T.........}B........d.................}B....................RSDS.....}....o?.......api-ms-win-core-xstate-l2-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................}B....d...............(...@...X...............)...X.......................D...u...............api-ms-win-core-xstate-l2-1-0.dll.CopyContext.kernel32.CopyContext.GetEnabledXStateFeatures.kernel32.GetEnabledXStateFeatures.GetXSt

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.028729023455996
Encrypted:	false
SSDEEP:	1536:108j/ceNw/dHivDMHVzVXWOf3C8g04ExOr:m8zNw/8aVk8ggY
MD5:	7A9254CB9D697A26F0D00B02A62F797E
SHA1:	35E12AAC4D525BA80C807EEC8961475C3B212A2C
SHA-256:	1F93E6C00170E8BFD054724076230AFE8ADC50D44E2CCACA4DD7CABEE948A10A
SHA-512:	79851F669C4E3CE76950B351A0CA03861B65A2CCEE12914B4A266443E33E220FF220EDE84215107429E75CF220498CF69D377833B664A55ED88A7E2FB066DE66
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.....t...t...t...)...t...z...t.m.....t.m.~...t.m.p...t.4.....t.4.p...t...u...t.......t...p...t.Rich..t.................PE..L......f...........!.....p...p.......g..................................................................................................................................................................................\|............................text...xg.......p.................. ..`.rdata...9.......@..................@..@.data...............................@....reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	22372
Entropy (8bit):	5.614047751813677
Encrypted:	false
SSDEEP:	384:0Kz3Gj8h01hxsBMOXJC71zeeAkzZvrtWQwiaVjJwVCP9qprV8GGSp:Jg8hsxsyOXUZSepdtvfaNJH9mp9R
MD5:	7CFA88652076898FDB78FCE5E2DE72FC
SHA1:	93EA40F121A5B9595CF62D655D9DF45CD07D2D3F
SHA-256:	0787BB0169256C329C366CD7E97BAF43C4EA16A092480B7DE911AB465C8398A6
SHA-512:	E88490453DB2D805FE44B0FFE230AAF66D64B614591BF25C5AB61A12F7681B2C320C9DBE7AB29D54AFC8AA2D3DF2DEB4BF1A70ABB9D0C664087B60C324E6E869
Malicious:	false
Preview:	@...e.....................I.p.h.D.../.X..............@..........H...............o..b~.D.poM...O..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.............System.Management.Automation4...............<."..Ke@...j..........System.Core.0.................Vn.F..kLsw..........System..4.................%...K... ...........System.Xml..L.................gQ?O.....x5.\|.....#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4..................~..2K..}...0".......System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D....................+.H..!...e........System.Configuration.Ins

Process:	C:\Users\user\AppData\Roaming\Skype_setup\Skype.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1480608
Entropy (8bit):	6.213350669516901
Encrypted:	false
SSDEEP:	24576:bnbbPImgK4brDi4IxgRqzwqNb+Yz73P2EMZbG0JEtXlCbWqx9qn:THeKh4nqzF3PYdStVCb7E
MD5:	D836F5ABB87998795EDD2A9FFED410D9
SHA1:	201EA1C596A8E9B5DA43F731FAF740A9794D529F
SHA-256:	1B812058D6B590EBD881DA15EF4A3EAF22AED5F213C56C1768A5C74132B5E61B
SHA-512:	ED54AEAF665E2652FBA30A4C886965A412019A4A1DE99B09C03BD93B75F86C0F788A3F08B94CED40F0DA7979F717EBAF6E1A7512025A86DD20FF316A756B6312
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...Rm"[.....................V.......%.......0....@..........................0.......`....@......@..............................@8...@...............p...'...................................0.......................................................text............................... ..`.itext.............................. ..`.data....0...0...2..................@....bss.....a...p.......L...................idata..@8.......:...L..............@....tls....<.... ...........................rdata.......0......................@..@.rsrc........@......................@..@....................................@..@........................................................................................................................................

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 936, Revision Number: {11D029A9-5BAA-4CCA-AED5-D23DD712D775}, Number of Words: 2, Subject: Skype_setup, Author: Skype_setup, Name of Creating Application: Skype_setup, Template: ;2052, Comments: Installer Skype_setup , Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Tue Oct 1 08:23:18 2024, Number of Pages: 200
Entropy (8bit):	7.994825569064446
TrID:	Windows SDK Setup Transform Script (63028/2) 43.45% Microsoft Windows Installer (60509/1) 41.72% Visual Basic Script (13500/0) 9.31% Generic OLE2 / Multistream Compound File (8008/1) 5.52%
File name:	Skype_translate6.3.1.msi
File size:	99'616'256 bytes
MD5:	83319da2936aadc100ef5055c14fbada
SHA1:	d5b3747ece0b07359189ecda49c3ba50cb46462d
SHA256:	d1344fbb55e72f7cb1914e649ec603f867665550c09ac7eb234c479a517068d9
SHA512:	9c325275ff7e7a1c5be253ef169e4bf9ec5f1e424deb429b49ceaedb46de40b556cb81ecba55da0f9085537c61e7407a6b8cdeb687d40586c6810bbbbe297619
SSDEEP:	1572864:JuSA0QcNn1TYJsT4NixjWGotPOtp5KNJn0NfM3nD8TD01BynQvJnu9bO:JnVQcN1TY0tjdotGKbnGMDynQJu9bO
TLSH:	D22833323587CA36C69F507AD9A8FF0E48397E63473002D7A7D87C7E84798C26275A52
File Content Preview:	........................>.......................................................M.......}.......\|...}...~.......................*...+...,...-......./...0...1...2...............k.......S......................................................................

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 20:37:20.021109104 CEST	1.1.1.1	192.168.2.16	0x2	No error (0)	p-ring.p-9999.p-msedge.net	p-9999.p-dc-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 20:37:20.021109104 CEST	1.1.1.1	192.168.2.16	0x2	No error (0)	p-9999.p-dc-msedge.net		150.171.86.254	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:37:20.021109104 CEST	1.1.1.1	192.168.2.16	0x2	No error (0)	p-9999.p-dc-msedge.net		150.171.87.254	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:37:21.694025040 CEST	1.1.1.1	192.168.2.16	0xb5a4	No error (0)	t-ring.t-9999.t-msedge.net	t-9999.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 20:37:21.694025040 CEST	1.1.1.1	192.168.2.16	0xb5a4	No error (0)	t-9999.t-msedge.net		13.107.246.254	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:37:21.694025040 CEST	1.1.1.1	192.168.2.16	0xb5a4	No error (0)	t-9999.t-msedge.net		13.107.213.254	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:38:01.953429937 CEST	1.1.1.1	192.168.2.16	0x5cb6	No error (0)	mcr-ring.mcr-9999.mcr-msedge.net	mcr-9999.mcr-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 20:38:01.953429937 CEST	1.1.1.1	192.168.2.16	0x5cb6	No error (0)	mcr-9999.mcr-msedge.net		150.171.69.254	A (IP address)	IN (0x0001)	false
Oct 3, 2024 20:38:01.953429937 CEST	1.1.1.1	192.168.2.16	0x5cb6	No error (0)	mcr-9999.mcr-msedge.net		150.171.70.254	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	14:36:09
Start date:	03/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Skype_translate6.3.1.msi"
Imagebase:	0x7ff704dd0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	14:36:27
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 193F5A0F0B6BA7095C04F9C165853480
Imagebase:	0x6b0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true