Edit tour

Windows Analysis Report
installer64v4.0.3.msi

Overview

General Information

Sample name:installer64v4.0.3.msi
Analysis ID:1581876
MD5:132022ad0e077c241c3f3cc3d626227e
SHA1:5a156967a0218001219d8007a23653d7ce07bee5
SHA256:bb067b2fcb12d954eea06ac3807416a3164f6f3694942f8bccec5394127dce3d
Tags:msiSilverFoxValleyRATwinosuser-wwwab
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Hides threads from debuggers
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Checks for available system drives (often done to infect USB drives)
Checks if the current process is being debugged
Creates files inside the system directory
Deletes files inside the Windows folder
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Found dropped PE file which has not been started or loaded
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w10x64
  • msiexec.exe (PID: 5052 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\installer64v4.0.3.msi" MD5: E5DA170027542E25EDE42FC54C929077)
  • msiexec.exe (PID: 5492 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
    • msiexec.exe (PID: 4768 cmdline: C:\Windows\System32\MsiExec.exe -Embedding DDD0E16C579AD407A23D65B8BE2CDB51 E Global\MSI0000 MD5: E5DA170027542E25EDE42FC54C929077)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: C:\Program Files (x86)\Windows NT\hrsv.tacReversingLabs: Detection: 18%
Source: C:\Program Files (x86)\Windows NT\hrsv.tacVirustotal: Detection: 25%Perma Link
Source: C:\Windows\Installer\MSIA331.tmpReversingLabs: Detection: 18%
Source: C:\Windows\Installer\MSIA331.tmpVirustotal: Detection: 25%Perma Link
Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: c:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior

System Summary

barindex
Source: MSIA331.tmp.1.drStatic PE information: section name: .cE%
Source: hrsv.tac.3.drStatic PE information: section name: .cE%
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\679b41.msiJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipiJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{836C0019-EFBF-4F79-8C1F-5269FDA1AD48}Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI9D25.tmpJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\679b43.msiJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\679b43.msiJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIA331.tmpJump to behavior
Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\679b43.msiJump to behavior
Source: Joe Sandbox ViewDropped File: C:\Program Files (x86)\Windows NT\hrsv.tac C719EC19E1E00A334D48760CB39609C69FDD0AC7458700A6255DDF41FEB43BEE
Source: installer64v4.0.3.msiBinary or memory string: OriginalFilenameReachFramework.resources.dll4 vs installer64v4.0.3.msi
Source: classification engineClassification label: mal60.evad.winMSI@4/22@0/0
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Windows NT\file.datJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\TEMP\~DFD20C3584D7E7C7C8.TMPJump to behavior
Source: installer64v4.0.3.msiStatic file information: TRID: Microsoft Windows Installer (60509/1) 88.31%
Source: unknownProcess created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\installer64v4.0.3.msi"
Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding DDD0E16C579AD407A23D65B8BE2CDB51 E Global\MSI0000
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding DDD0E16C579AD407A23D65B8BE2CDB51 E Global\MSI0000Jump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: srpapi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: msihnd.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: srclient.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: spp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: vssapi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: vsstrace.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: rstrtmgr.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
Source: installer64v4.0.3.msiStatic file information: File size 7655424 > 1048576
Source: MSIA331.tmp.1.drStatic PE information: section name: .00cfg
Source: MSIA331.tmp.1.drStatic PE information: section name: _RDATA
Source: MSIA331.tmp.1.drStatic PE information: section name: .cE%
Source: hrsv.tac.3.drStatic PE information: section name: .00cfg
Source: hrsv.tac.3.drStatic PE information: section name: _RDATA
Source: hrsv.tac.3.drStatic PE information: section name: .cE%
Source: MSIA331.tmp.1.drStatic PE information: section name: .text entropy: 7.08800768947479
Source: hrsv.tac.3.drStatic PE information: section name: .text entropy: 7.08800768947479
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Windows NT\hrsv.tacJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIA331.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIA331.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Windows NT\hrsv.tacJump to dropped file
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Source: C:\Windows\System32\msiexec.exeSystem information queried: FirmwareTableInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Windows NT\hrsv.tacJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSIA331.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeLast function: Thread delayed
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformationJump to behavior

Anti Debugging

barindex
Source: C:\Windows\System32\msiexec.exeThread information set: HideFromDebuggerJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Replication Through Removable Media
Windows Management Instrumentation1
DLL Side-Loading
1
Process Injection
31
Masquerading
OS Credential Dumping31
Security Software Discovery
Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading
21
Virtualization/Sandbox Evasion
LSASS Memory21
Virtualization/Sandbox Evasion
Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Software Packing
Security Account Manager1
Process Discovery
SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Process Injection
NTDS11
Peripheral Device Discovery
Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
DLL Side-Loading
LSA Secrets11
System Information Discovery
SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Obfuscated Files or Information
Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
File Deletion
DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1581876 Sample: installer64v4.0.3.msi Startdate: 29/12/2024 Architecture: WINDOWS Score: 60 19 Multi AV Scanner detection for dropped file 2->19 21 PE file contains section with special chars 2->21 6 msiexec.exe 75 29 2->6         started        9 msiexec.exe 5 2->9         started        process3 file4 15 C:\Windows\Installer\MSIA331.tmp, PE32+ 6->15 dropped 11 msiexec.exe 1 6->11         started        process5 file6 17 C:\Program Files (x86)\Windows NT\hrsv.tac, PE32+ 11->17 dropped 23 Query firmware table information (likely to detect VMs) 11->23 25 Hides threads from debuggers 11->25 signatures7

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
No Antivirus matches
SourceDetectionScannerLabelLink
C:\Program Files (x86)\Windows NT\hrsv.tac18%ReversingLabs
C:\Program Files (x86)\Windows NT\hrsv.tac25%VirustotalBrowse
C:\Windows\Installer\MSIA331.tmp18%ReversingLabs
C:\Windows\Installer\MSIA331.tmp25%VirustotalBrowse
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
No contacted IP infos
Joe Sandbox version:41.0.0 Charoite
Analysis ID:1581876
Start date and time:2024-12-29 08:15:09 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 26s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:6
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:installer64v4.0.3.msi
Detection:MAL
Classification:mal60.evad.winMSI@4/22@0/0
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Found application associated with file extension: .msi
  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
  • Excluded IPs from analysis (whitelisted): 13.107.246.63, 172.202.163.200
  • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
No simulations
No context
No context
No context
No context
MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
C:\Program Files (x86)\Windows NT\hrsv.tacinstaller64v3.5.9.msiGet hashmaliciousUnknownBrowse
    installer64v3.6.3.msiGet hashmaliciousUnknownBrowse
      installer64v3.2.3.msiGet hashmaliciousUnknownBrowse
        installer64v3.2.6.msiGet hashmaliciousUnknownBrowse
          installer64v2.3.6.msiGet hashmaliciousUnknownBrowse
            installer64v2.6.8.msiGet hashmaliciousUnknownBrowse
              installer64v2.3.9.msiGet hashmaliciousUnknownBrowse
                installer64v1.0.4.msiGet hashmaliciousUnknownBrowse
                  installer64v2.3.5.msiGet hashmaliciousUnknownBrowse
                    installer64v1.0.0.msiGet hashmaliciousUnknownBrowse
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):6078182
                      Entropy (8bit):7.3911436078005694
                      Encrypted:false
                      SSDEEP:98304:rguaE99X1NNBNUpVzglP/szL6lD6E97b1ScJFhs9kwfgdvC3OiXpNmz:UA5ZvUp5g+KQE9319vExJXpNmz
                      MD5:0CD4F771F40EABDC196AE7DCDB0383AD
                      SHA1:E6D5AC6BF6FEFB20F93FC125145433595FAD570E
                      SHA-256:06784741770AD3EE5B5EF37F2F4A88C6B17447D21861B5E6C9D283B9589A14B4
                      SHA-512:A8945F5FA7AB48FA1DE912EA8B6FADFE99FC0416C00834538A5A6D5E36373B264AC4105FE66FB0B4F014BD2ECC1A979FF4EA5F5FCFF3D6777874657C1EF281DC
                      Malicious:false
                      Reputation:low
                      Preview:...@IXOS.@.....@...Y.@.....@.....@.....@.....@.....@......&.{836C0019-EFBF-4F79-8C1F-5269FDA1AD48}..Setup..installer64v4.0.3.msi.@.....@.....@.....@........&.{AD42D2CA-D67A-4BB6-96C7-F32097180263}.....@.....@.....@.....@.......@.....@.....@.......@......Setup......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{125CBCBA-000D-4311-82CD-4ABABCD734C4}&.{836C0019-EFBF-4F79-8C1F-5269FDA1AD48}.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]..".C:\Program Files (x86)\Windows NT\....*.C:\Program Files (x86)\Windows NT\file.dat...._K..._.@A.......\.MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....og.........." ........................................................0]......]...`.............................................`...0...(.....].......\.,7........... ].x.......................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):1543184
                      Entropy (8bit):7.999877543801716
                      Encrypted:true
                      SSDEEP:24576:rHGVMKs+MT/GRGABjbyMk7EmJBZLpZ3ejRZLzxXSxJwUDSZ3y78xfAvsGC:rmVRsLe7yMk7Ei7phej/hiOpf9GC
                      MD5:79CE273611906292517A1ADD8AAD65EB
                      SHA1:3704837E5F3E2B10E7714C718C6F56E4FE97398D
                      SHA-256:1131485DDF06B777333594A2FB38CA4B45DF0D9A095B0F366EEE7E6F0D4454D4
                      SHA-512:B75055E8572F7C32D3C8466617FFB17C49B159F8F37C0AF5040CE538F0D31ACFAD5DD540E48EE0DF98EB36E57B96F47165B4D99BE08AE53094BF6EC6E4A12557
                      Malicious:false
                      Reputation:low
                      Preview:.@S.......Lw................9...$.7....E.._...v9U...S.%....R.==PB....M.$!85._g..C...d.....c>P*sk...i.'r5'v|z.K@K..>..0.+..8.j...........i...V.k!....O`......9..+.F....7=jg~.;J>......:....!e.aI.GrXE'0,.yJ.........z.m@....W..._}~.t..GA..@....N.F..z"5..y..1...~.;..0b65.5k.h.K"..."H...N}...w..dL/..p...=.b<.sS..8v...2.Yy.....K.4......;....R.<]._...J5!.q...:r._..{..d@..]...W.Xv...+.x.6v."_.uf.C....%....g.b....0.. jE.%..1YTGT4..0.!.O..-.....S.............4v.Q...X...m....n.#..1DQ.E..u..,H{'6.......'.c....%6.l..^o.;.d...T.~p.l..V8O@.2f....h.o.xI..i.9.%D.-.....o.7f..L..I.."..h...........+m......Y-.i._`.P#...2^.y;BR.2T.......K.. ..k#.c.K.y{u*#:.O...^.{..2.!Xu.L.!.*....t...?...1..x.yD.09....v.v.b.l=..z\.LL..9..I.)..8)"...F.....D.x...$.......7.....!6.e.If..}...Z..(y.(.l._...T.6.*k&.....dS.(..P.......I...W..n,....3.l.>...O.....,|p..~.F...&:cb.-.....}"...I......&Nt:..g.Gi..d.h..4.z.(.,.i..=..W...5....LI2.u.#.2T.h.$...i..m.}Tp...l..u&..T.$.F...f...w.-..!..
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                      Category:dropped
                      Size (bytes):6070784
                      Entropy (8bit):7.391209406124013
                      Encrypted:false
                      SSDEEP:98304:KguaE99X1NNBNUpVzglP/szL6lD6E97b1ScJFhs9kwfgdvC3OiXpNm:jA5ZvUp5g+KQE9319vExJXpNm
                      MD5:F2667D49F895F5A458B245725B8B8E06
                      SHA1:0B9B0375BBDDD7A8049C69AC8894350FA742D374
                      SHA-256:C719EC19E1E00A334D48760CB39609C69FDD0AC7458700A6255DDF41FEB43BEE
                      SHA-512:89126FCED8A2E49DE22ACD27D5D29BB1A0ED726120813D0179094CAA90BAC5725A7978606BB68EDA25A8E1ECDB1D86730AB87069957144A1C8B1D8525B00167D
                      Malicious:true
                      Antivirus:
                      • Antivirus: ReversingLabs, Detection: 18%
                      • Antivirus: Virustotal, Detection: 25%, Browse
                      Joe Sandbox View:
                      • Filename: installer64v3.5.9.msi, Detection: malicious, Browse
                      • Filename: installer64v3.6.3.msi, Detection: malicious, Browse
                      • Filename: installer64v3.2.3.msi, Detection: malicious, Browse
                      • Filename: installer64v3.2.6.msi, Detection: malicious, Browse
                      • Filename: installer64v2.3.6.msi, Detection: malicious, Browse
                      • Filename: installer64v2.6.8.msi, Detection: malicious, Browse
                      • Filename: installer64v2.3.9.msi, Detection: malicious, Browse
                      • Filename: installer64v1.0.4.msi, Detection: malicious, Browse
                      • Filename: installer64v2.3.5.msi, Detection: malicious, Browse
                      • Filename: installer64v1.0.0.msi, Detection: malicious, Browse
                      Reputation:moderate, very likely benign file
                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....og.........." ........................................................0]......]...`.............................................`...0...(.....].......\.,7........... ].x...............................(....)..@...............0............................text...n........................... ..`.rdata...k.......l..................@..@.data...Tg...`...F...B..............@....pdata...6....2..8....2.............@..@.00cfg..8.....3.......2.............@..@.tls......... 3.......2.............@..._RDATA.......03.......2.............@..@.cE%......)..@3...)...2............. ..h.rsrc.........].......\.............@..@.reloc..x.... ].......\.............@..B........................................................................................................................................................................................................................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Setup, Author: Netease, Keywords: Installer, Comments: dsferyft, Template: Intel;1033, Revision Number: {AD42D2CA-D67A-4BB6-96C7-F32097180263}, Create Time/Date: Sun Dec 29 03:35:08 2024, Last Saved Time/Date: Sun Dec 29 03:35:08 2024, Number of Pages: 300, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
                      Category:dropped
                      Size (bytes):7655424
                      Entropy (8bit):7.574414463409086
                      Encrypted:false
                      SSDEEP:196608:SzgsBitCLA5ZvUp+g+KQE9319vExJXpNm:SUtSKZsFHavXm
                      MD5:132022AD0E077C241C3F3CC3D626227E
                      SHA1:5A156967A0218001219D8007A23653D7CE07BEE5
                      SHA-256:BB067B2FCB12D954EEA06AC3807416A3164F6F3694942F8BCCEC5394127DCE3D
                      SHA-512:EAB213059F4ED0D3AB64D74DC4E10DA7D05B28BCBDED3ADE24ECB63B51307329D15609798F0525D7B3298A0693784CB8F50ECC06C47248B19A6A92E6A3CF7D7D
                      Malicious:false
                      Reputation:low
                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Setup, Author: Netease, Keywords: Installer, Comments: dsferyft, Template: Intel;1033, Revision Number: {AD42D2CA-D67A-4BB6-96C7-F32097180263}, Create Time/Date: Sun Dec 29 03:35:08 2024, Last Saved Time/Date: Sun Dec 29 03:35:08 2024, Number of Pages: 300, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
                      Category:dropped
                      Size (bytes):7655424
                      Entropy (8bit):7.574414463409086
                      Encrypted:false
                      SSDEEP:196608:SzgsBitCLA5ZvUp+g+KQE9319vExJXpNm:SUtSKZsFHavXm
                      MD5:132022AD0E077C241C3F3CC3D626227E
                      SHA1:5A156967A0218001219D8007A23653D7CE07BEE5
                      SHA-256:BB067B2FCB12D954EEA06AC3807416A3164F6F3694942F8BCCEC5394127DCE3D
                      SHA-512:EAB213059F4ED0D3AB64D74DC4E10DA7D05B28BCBDED3ADE24ECB63B51307329D15609798F0525D7B3298A0693784CB8F50ECC06C47248B19A6A92E6A3CF7D7D
                      Malicious:false
                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):6072484
                      Entropy (8bit):7.39123052829842
                      Encrypted:false
                      SSDEEP:98304:ZguaE99X1NNBNUpVzglP/szL6lD6E97b1ScJFhs9kwfgdvC3OiXpNmP:KA5ZvUp5g+KQE9319vExJXpNmP
                      MD5:0B97323370912DA4CDAE7B236F387ADD
                      SHA1:AC4254A90AAD7D2D88A69BAA69D457546C47C55F
                      SHA-256:6FBA756140286428F2AF7F6E1557CE8EEA08C74DF1B75AF27F2D02BDF1B3B6F7
                      SHA-512:AA545087B51E1A228EF76EEF81BCFC610BF061443F3C2A6AD030DD88EA9D6181479F194FCAE04C0F146D5B6237D545029DD697362626A69A59399DE8EE9B6D46
                      Malicious:false
                      Preview:...@IXOS.@.....@...Y.@.....@.....@.....@.....@.....@......&.{836C0019-EFBF-4F79-8C1F-5269FDA1AD48}..Setup..installer64v4.0.3.msi.@.....@.....@.....@........&.{AD42D2CA-D67A-4BB6-96C7-F32097180263}.....@.....@.....@.....@.......@.....@.....@.......@......Setup......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{125CBCBA-000D-4311-82CD-4ABABCD734C4}*.C:\Program Files (x86)\Windows NT\file.dat.@.......@.....@.....@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]...@.....@.....@......".C:\Program Files (x86)\Windows NT\....1\gujfn150\|Windows NT\......Please insert the disk: ..cab1.cab.@.....@......C:\Windows\Installer\679b41.msi.........@........file.dat..l4d..file.dat.@.....@.....@.......@.............@.........@.....@.....@y.'6.@..b..@Qz...@..e......_....J..._.@A.......\.MZx.....................@..........................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                      Category:modified
                      Size (bytes):6070784
                      Entropy (8bit):7.391209406124013
                      Encrypted:false
                      SSDEEP:98304:KguaE99X1NNBNUpVzglP/szL6lD6E97b1ScJFhs9kwfgdvC3OiXpNm:jA5ZvUp5g+KQE9319vExJXpNm
                      MD5:F2667D49F895F5A458B245725B8B8E06
                      SHA1:0B9B0375BBDDD7A8049C69AC8894350FA742D374
                      SHA-256:C719EC19E1E00A334D48760CB39609C69FDD0AC7458700A6255DDF41FEB43BEE
                      SHA-512:89126FCED8A2E49DE22ACD27D5D29BB1A0ED726120813D0179094CAA90BAC5725A7978606BB68EDA25A8E1ECDB1D86730AB87069957144A1C8B1D8525B00167D
                      Malicious:true
                      Antivirus:
                      • Antivirus: ReversingLabs, Detection: 18%
                      • Antivirus: Virustotal, Detection: 25%, Browse
                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....og.........." ........................................................0]......]...`.............................................`...0...(.....].......\.,7........... ].x...............................(....)..@...............0............................text...n........................... ..`.rdata...k.......l..................@..@.data...Tg...`...F...B..............@....pdata...6....2..8....2.............@..@.00cfg..8.....3.......2.............@..@.tls......... 3.......2.............@..._RDATA.......03.......2.............@..@.cE%......)..@3...)...2............. ..h.rsrc.........].......\.............@..@.reloc..x.... ].......\.............@..B........................................................................................................................................................................................................................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:Composite Document File V2 Document, Cannot read section info
                      Category:dropped
                      Size (bytes):20480
                      Entropy (8bit):1.1683390847053925
                      Encrypted:false
                      SSDEEP:12:JSbX72FjIAGiLIlHVRpwh/7777777777777777777777777vDHF75Z0gXCIhjXlN:JuQI5YnHCIMF
                      MD5:002E400395FD73725C647A823C2D6D71
                      SHA1:FCD75ADEDFFD1E57BA75670CF590569578C0F2CA
                      SHA-256:143088AD884117813221BEA9F8B2CACF68D57E7D214994C0BAA8759AC0DE024D
                      SHA-512:C856DDDD3BC019CE5875710BE947C4B8547ED24ACDEF54BA2F846997D8740939161379F354A1E27743C47872EDD4459D68881611BA63854AABC6025D20D0CD40
                      Malicious:false
                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:Composite Document File V2 Document, Cannot read section info
                      Category:dropped
                      Size (bytes):20480
                      Entropy (8bit):1.4678783894026077
                      Encrypted:false
                      SSDEEP:48:k8PhAuRc06WXJEnT5d1kdeS5urideSIW6brO:7hA1HnTz15pi6vO
                      MD5:20A228532107046FA42B4EDFD9D56C85
                      SHA1:54B7F74294F2008C42140FC3355AB53A0AD80356
                      SHA-256:CEA81CE8F4E4BBCA9BA5AF5BF5BEE771DEDE6BD7AC0878991C752746B7EEE2D1
                      SHA-512:9A4510F91E2297386856665D44D792D8C0A31ACC369D1AD3501304CA7239BFE88E5B3BDAD703EE581D80CE8113EA3A027011EA59D3D35248669C8454FD051540
                      Malicious:false
                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                      Category:dropped
                      Size (bytes):364484
                      Entropy (8bit):5.365493067134708
                      Encrypted:false
                      SSDEEP:1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauG:zTtbmkExhMJCIpEF
                      MD5:F77D1F9A2AF1358AB9E33516A94758AD
                      SHA1:8F98E416B9D8C0570A0BF6B9A80359B0A98E247C
                      SHA-256:358E9CC303BE91E929A05C99C697BB1B19817D4FE04E8090C85154E12EFA5D7D
                      SHA-512:A83E31FC7A60EB149781A800300D50E3BDEB10D8C1C592F188B806DF3F8B3AFF03B3C5ACAD61C012FCEDEE0C0720C725177C92265139D232F273C98142EBB4F9
                      Malicious:false
                      Preview:.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:Composite Document File V2 Document, Cannot read section info
                      Category:dropped
                      Size (bytes):20480
                      Entropy (8bit):1.4678783894026077
                      Encrypted:false
                      SSDEEP:48:k8PhAuRc06WXJEnT5d1kdeS5urideSIW6brO:7hA1HnTz15pi6vO
                      MD5:20A228532107046FA42B4EDFD9D56C85
                      SHA1:54B7F74294F2008C42140FC3355AB53A0AD80356
                      SHA-256:CEA81CE8F4E4BBCA9BA5AF5BF5BEE771DEDE6BD7AC0878991C752746B7EEE2D1
                      SHA-512:9A4510F91E2297386856665D44D792D8C0A31ACC369D1AD3501304CA7239BFE88E5B3BDAD703EE581D80CE8113EA3A027011EA59D3D35248669C8454FD051540
                      Malicious:false
                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):512
                      Entropy (8bit):0.0
                      Encrypted:false
                      SSDEEP:3::
                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                      Malicious:false
                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):512
                      Entropy (8bit):0.0
                      Encrypted:false
                      SSDEEP:3::
                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                      Malicious:false
                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:Composite Document File V2 Document, Cannot read section info
                      Category:dropped
                      Size (bytes):32768
                      Entropy (8bit):1.1825841868673517
                      Encrypted:false
                      SSDEEP:48:onoujNveFXJbT5H1kdeS5urideSIW6brO:WovDTB15pi6vO
                      MD5:02AF6E9825323102EC2DFC86FBC94385
                      SHA1:3CD0974E2A3367CEE2610180426A94522E17924A
                      SHA-256:CBE4E148BCD43C4C3B91E8A89AFC8075BE04AE43155A67AD8E9D944B267F6DCD
                      SHA-512:26F40A3E13761A2FDFDDE8473ED576249BE278F71618BE60B0E679D1EF059E882CCC48CBFF194D6D8D639A8EBA1D9A9C5DA53EF069EE16140AEFC60060CD45E9
                      Malicious:false
                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:Composite Document File V2 Document, Cannot read section info
                      Category:dropped
                      Size (bytes):32768
                      Entropy (8bit):1.1825841868673517
                      Encrypted:false
                      SSDEEP:48:onoujNveFXJbT5H1kdeS5urideSIW6brO:WovDTB15pi6vO
                      MD5:02AF6E9825323102EC2DFC86FBC94385
                      SHA1:3CD0974E2A3367CEE2610180426A94522E17924A
                      SHA-256:CBE4E148BCD43C4C3B91E8A89AFC8075BE04AE43155A67AD8E9D944B267F6DCD
                      SHA-512:26F40A3E13761A2FDFDDE8473ED576249BE278F71618BE60B0E679D1EF059E882CCC48CBFF194D6D8D639A8EBA1D9A9C5DA53EF069EE16140AEFC60060CD45E9
                      Malicious:false
                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):512
                      Entropy (8bit):0.0
                      Encrypted:false
                      SSDEEP:3::
                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                      Malicious:false
                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):512
                      Entropy (8bit):0.0
                      Encrypted:false
                      SSDEEP:3::
                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                      Malicious:false
                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):512
                      Entropy (8bit):0.0
                      Encrypted:false
                      SSDEEP:3::
                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                      Malicious:false
                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):32768
                      Entropy (8bit):0.07450410465540323
                      Encrypted:false
                      SSDEEP:6:2/9LG7iVCnLG7iVrKOzPLHKOejla5Yu0gXTRkIltCVky6ljX:2F0i8n0itFzDHF75Z0gXCIhjX
                      MD5:007988709E85E8351BF1738F06C5C85C
                      SHA1:4F8E8993960E2EDCBE1DB30B613B8A61EE96A3B9
                      SHA-256:4649F603DDC99A345A41DBE12644D6A2EDDCEBEB33AD9A538254665365D06AEB
                      SHA-512:3AB43476F014245048CF3BD07F582F55B716628A30718D9ADCDCABB492D375F7983F945F2A0593FC88020D08DA95EAD6EB4EBBEA5B449BEFD98B29B57E28DACB
                      Malicious:false
                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):69632
                      Entropy (8bit):0.1043880821924482
                      Encrypted:false
                      SSDEEP:24:VzbrOGHZLdB5GipVGdB5GipV7VQwG9Plrkgb+f:RbrOGHldeScdeS5urbw
                      MD5:9539B3C3F2F433E7FE79CF5A40A2AE3A
                      SHA1:A00B5DBD21984BCB63F996B849E6083AA9291DC2
                      SHA-256:F62CBEFC48B361CEE774924E1C84C9C6A831D0578871CCB4785992CDE6CF9BFD
                      SHA-512:05E9A140E658C32B95F3B19855558B2820DA5537347FB8096C37681BD108B523F2E86401392EBA6390C8FB12FF033C995005B948B3FBFA0C32D2744E5AC19323
                      Malicious:false
                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:Composite Document File V2 Document, Cannot read section info
                      Category:dropped
                      Size (bytes):20480
                      Entropy (8bit):1.4678783894026077
                      Encrypted:false
                      SSDEEP:48:k8PhAuRc06WXJEnT5d1kdeS5urideSIW6brO:7hA1HnTz15pi6vO
                      MD5:20A228532107046FA42B4EDFD9D56C85
                      SHA1:54B7F74294F2008C42140FC3355AB53A0AD80356
                      SHA-256:CEA81CE8F4E4BBCA9BA5AF5BF5BEE771DEDE6BD7AC0878991C752746B7EEE2D1
                      SHA-512:9A4510F91E2297386856665D44D792D8C0A31ACC369D1AD3501304CA7239BFE88E5B3BDAD703EE581D80CE8113EA3A027011EA59D3D35248669C8454FD051540
                      Malicious:false
                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                      Process:C:\Windows\System32\msiexec.exe
                      File Type:Composite Document File V2 Document, Cannot read section info
                      Category:dropped
                      Size (bytes):32768
                      Entropy (8bit):1.1825841868673517
                      Encrypted:false
                      SSDEEP:48:onoujNveFXJbT5H1kdeS5urideSIW6brO:WovDTB15pi6vO
                      MD5:02AF6E9825323102EC2DFC86FBC94385
                      SHA1:3CD0974E2A3367CEE2610180426A94522E17924A
                      SHA-256:CBE4E148BCD43C4C3B91E8A89AFC8075BE04AE43155A67AD8E9D944B267F6DCD
                      SHA-512:26F40A3E13761A2FDFDDE8473ED576249BE278F71618BE60B0E679D1EF059E882CCC48CBFF194D6D8D639A8EBA1D9A9C5DA53EF069EE16140AEFC60060CD45E9
                      Malicious:false
                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                      File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Setup, Author: Netease, Keywords: Installer, Comments: dsferyft, Template: Intel;1033, Revision Number: {AD42D2CA-D67A-4BB6-96C7-F32097180263}, Create Time/Date: Sun Dec 29 03:35:08 2024, Last Saved Time/Date: Sun Dec 29 03:35:08 2024, Number of Pages: 300, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
                      Entropy (8bit):7.574414463409086
                      TrID:
                      • Microsoft Windows Installer (60509/1) 88.31%
                      • Generic OLE2 / Multistream Compound File (8008/1) 11.69%
                      File name:installer64v4.0.3.msi
                      File size:7'655'424 bytes
                      MD5:132022ad0e077c241c3f3cc3d626227e
                      SHA1:5a156967a0218001219d8007a23653d7ce07bee5
                      SHA256:bb067b2fcb12d954eea06ac3807416a3164f6f3694942f8bccec5394127dce3d
                      SHA512:eab213059f4ed0d3ab64d74dc4e10da7d05b28bcbded3ade24ecb63b51307329d15609798f0525d7b3298a0693784cb8f50ecc06c47248b19a6a92e6a3cf7d7d
                      SSDEEP:196608:SzgsBitCLA5ZvUp+g+KQE9319vExJXpNm:SUtSKZsFHavXm
                      TLSH:6B76013659B7B0BCF693D6B58AB78777A037379117265CBF00A5E3301A32A104B46B72
                      File Content Preview:........................>......................................................................................................................................................................................................................................
                      Icon Hash:2d2e3797b32b2b99
                      No network behavior found
                      050100s020406080100

                      Click to jump to process

                      050100s0.00102030MB

                      Click to jump to process

                      Target ID:0
                      Start time:02:15:59
                      Start date:29/12/2024
                      Path:C:\Windows\System32\msiexec.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\installer64v4.0.3.msi"
                      Imagebase:0x7ff7fd040000
                      File size:69'632 bytes
                      MD5 hash:E5DA170027542E25EDE42FC54C929077
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:true
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                      Target ID:1
                      Start time:02:15:59
                      Start date:29/12/2024
                      Path:C:\Windows\System32\msiexec.exe
                      Wow64 process (32bit):false
                      Commandline:C:\Windows\system32\msiexec.exe /V
                      Imagebase:0x7ff7fd040000
                      File size:69'632 bytes
                      MD5 hash:E5DA170027542E25EDE42FC54C929077
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:false
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                      There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                      Target ID:3
                      Start time:02:16:01
                      Start date:29/12/2024
                      Path:C:\Windows\System32\msiexec.exe
                      Wow64 process (32bit):false
                      Commandline:C:\Windows\System32\MsiExec.exe -Embedding DDD0E16C579AD407A23D65B8BE2CDB51 E Global\MSI0000
                      Imagebase:0x7ff7fd040000
                      File size:69'632 bytes
                      MD5 hash:E5DA170027542E25EDE42FC54C929077
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:true

                      No disassembly