Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
1.msi

Overview

General Information

Sample name:1.msi
Analysis ID:1581906
MD5:ad0e0c82dab53f0a2652c626bfc759bb
SHA1:ecd54bc030343b3d538d69e4776175b69bc6ed80
SHA256:a63db2daf426ced44b66e30ec3b50697dab533dd087cf4e00a7b82f2c6371630
Tags:backdoormsisilverfoxwinosuser-zhuzhu0009
Infos:

Detection

Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Hides threads from debuggers
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Checks for available system drives (often done to infect USB drives)
Checks if the current process is being debugged
Creates files inside the system directory
Deletes files inside the Windows folder
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Found dropped PE file which has not been started or loaded
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info

Classification

  • System is w10x64
  • msiexec.exe (PID: 7548 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\1.msi" MD5: E5DA170027542E25EDE42FC54C929077)
  • msiexec.exe (PID: 7584 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
    • msiexec.exe (PID: 7684 cmdline: C:\Windows\System32\MsiExec.exe -Embedding 567E882632BBCB879F56658346895DC6 E Global\MSI0000 MD5: E5DA170027542E25EDE42FC54C929077)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: C:\Program Files (x86)\Windows NT\hrsv.tacReversingLabs: Detection: 18%
Source: C:\Program Files (x86)\Windows NT\hrsv.tacVirustotal: Detection: 40%Perma Link
Source: C:\Windows\Installer\MSIC6E5.tmpReversingLabs: Detection: 18%
Source: C:\Windows\Installer\MSIC6E5.tmpVirustotal: Detection: 40%Perma Link
Source: 1.msiVirustotal: Detection: 31%Perma Link
Source: 1.msiReversingLabs: Detection: 28%
Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: c:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior

System Summary

barindex
Source: MSIC6E5.tmp.1.drStatic PE information: section name: .cE%
Source: hrsv.tac.2.drStatic PE information: section name: .cE%
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\50c176.msiJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipiJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{1C3E8ABA-6E5B-4F90-B97A-DDBE685F9798}Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIC32B.tmpJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\50c178.msiJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\50c178.msiJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIC6E5.tmpJump to behavior
Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\50c178.msiJump to behavior
Source: Joe Sandbox ViewDropped File: C:\Program Files (x86)\Windows NT\hrsv.tac C719EC19E1E00A334D48760CB39609C69FDD0AC7458700A6255DDF41FEB43BEE
Source: Joe Sandbox ViewDropped File: C:\Windows\Installer\MSIC6E5.tmp C719EC19E1E00A334D48760CB39609C69FDD0AC7458700A6255DDF41FEB43BEE
Source: 1.msiBinary or memory string: OriginalFilenameReachFramework.resources.dll4 vs 1.msi
Source: classification engineClassification label: mal68.evad.winMSI@4/22@0/0
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Windows NT\file.datJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\TEMP\~DFD40B1040FFB0B8E5.TMPJump to behavior
Source: 1.msiStatic file information: TRID: Microsoft Windows Installer (60509/1) 88.31%
Source: 1.msiVirustotal: Detection: 31%
Source: 1.msiReversingLabs: Detection: 28%
Source: unknownProcess created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\1.msi"
Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 567E882632BBCB879F56658346895DC6 E Global\MSI0000
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 567E882632BBCB879F56658346895DC6 E Global\MSI0000Jump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: srpapi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: msihnd.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: srclient.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: spp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: vssapi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: vsstrace.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: rstrtmgr.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
Source: 1.msiStatic file information: File size 7802880 > 1048576
Source: MSIC6E5.tmp.1.drStatic PE information: section name: .00cfg
Source: MSIC6E5.tmp.1.drStatic PE information: section name: _RDATA
Source: MSIC6E5.tmp.1.drStatic PE information: section name: .cE%
Source: hrsv.tac.2.drStatic PE information: section name: .00cfg
Source: hrsv.tac.2.drStatic PE information: section name: _RDATA
Source: hrsv.tac.2.drStatic PE information: section name: .cE%
Source: MSIC6E5.tmp.1.drStatic PE information: section name: .text entropy: 7.08800768947479
Source: hrsv.tac.2.drStatic PE information: section name: .text entropy: 7.08800768947479
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIC6E5.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Windows NT\hrsv.tacJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIC6E5.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Program Files (x86)\Windows NT\hrsv.tacJump to dropped file
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Source: C:\Windows\System32\msiexec.exeSystem information queried: FirmwareTableInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSIC6E5.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Program Files (x86)\Windows NT\hrsv.tacJump to dropped file
Source: C:\Windows\System32\msiexec.exeLast function: Thread delayed
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformationJump to behavior

Anti Debugging

barindex
Source: C:\Windows\System32\msiexec.exeThread information set: HideFromDebuggerJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Replication Through Removable Media
Windows Management Instrumentation1
DLL Side-Loading
1
Process Injection
31
Masquerading
OS Credential Dumping31
Security Software Discovery
Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading
21
Virtualization/Sandbox Evasion
LSASS Memory21
Virtualization/Sandbox Evasion
Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Software Packing
Security Account Manager1
Process Discovery
SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Process Injection
NTDS11
Peripheral Device Discovery
Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
DLL Side-Loading
LSA Secrets11
System Information Discovery
SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Obfuscated Files or Information
Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
File Deletion
DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
1.msi32%VirustotalBrowse
1.msi29%ReversingLabsWin64.Trojan.Generic
SourceDetectionScannerLabelLink
C:\Program Files (x86)\Windows NT\hrsv.tac18%ReversingLabs
C:\Program Files (x86)\Windows NT\hrsv.tac40%VirustotalBrowse
C:\Windows\Installer\MSIC6E5.tmp18%ReversingLabs
C:\Windows\Installer\MSIC6E5.tmp40%VirustotalBrowse
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
No contacted IP infos
Joe Sandbox version:41.0.0 Charoite
Analysis ID:1581906
Start date and time:2024-12-29 11:15:10 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 27s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:7
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:1.msi
Detection:MAL
Classification:mal68.evad.winMSI@4/22@0/0
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Found application associated with file extension: .msi
  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
  • Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63
  • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
  • Not all processes where analyzed, report is missing behavior information
No simulations
No context
No context
No context
No context
MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
C:\Windows\Installer\MSIC6E5.tmpinstaller64v43.2.6.msiGet hashmaliciousUnknownBrowse
    installer64v8.2.9.msiGet hashmaliciousUnknownBrowse
      installer64v9.2.7.msiGet hashmaliciousUnknownBrowse
        installer64v6.2.8.msiGet hashmaliciousUnknownBrowse
          installer64v6.3.2.msiGet hashmaliciousUnknownBrowse
            installer64v5.3.7.msiGet hashmaliciousUnknownBrowse
              installer64v5.2.7.msiGet hashmaliciousUnknownBrowse
                installer64v4.2.0.msiGet hashmaliciousUnknownBrowse
                  installer64v5.2.6.msiGet hashmaliciousUnknownBrowse
                    installer64v3.25.msiGet hashmaliciousUnknownBrowse
                      C:\Program Files (x86)\Windows NT\hrsv.tacinstaller64v43.2.6.msiGet hashmaliciousUnknownBrowse
                        installer64v8.2.9.msiGet hashmaliciousUnknownBrowse
                          installer64v9.2.7.msiGet hashmaliciousUnknownBrowse
                            installer64v6.2.8.msiGet hashmaliciousUnknownBrowse
                              installer64v6.3.2.msiGet hashmaliciousUnknownBrowse
                                installer64v5.3.7.msiGet hashmaliciousUnknownBrowse
                                  installer64v5.2.7.msiGet hashmaliciousUnknownBrowse
                                    installer64v4.2.0.msiGet hashmaliciousUnknownBrowse
                                      installer64v5.2.6.msiGet hashmaliciousUnknownBrowse
                                        installer64v3.25.msiGet hashmaliciousUnknownBrowse
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):6078146
                                          Entropy (8bit):7.391100872341349
                                          Encrypted:false
                                          SSDEEP:98304:+guaE99X1NNBNUpVzglP/szL6lD6E97b1ScJFhs9kwfgdvC3OiXpNmo:nA5ZvUp5g+KQE9319vExJXpNmo
                                          MD5:2092E6AFE73C47E390AD42DF7355A9B1
                                          SHA1:911228F95EC39F48332369D0A0048670AF9651A2
                                          SHA-256:BC8860219607F27C1999C83CE16026F44185A9FC8E1D4D8067058D3FF655507B
                                          SHA-512:0E5F0F4D8453F6072D72FAB680266723C23649EAEBF9F2F7CF99A6BB2144425C1B94D2904A819D92C2098BD892DB3BD9E7705109F8DFE001A80F384847D13ECD
                                          Malicious:false
                                          Reputation:low
                                          Preview:...@IXOS.@.....@.*.Y.@.....@.....@.....@.....@.....@......&.{1C3E8ABA-6E5B-4F90-B97A-DDBE685F9798}..Setup..1.msi.@.....@.....@.....@........&.{DDB2C592-F0D1-400A-AC71-F8B9D3954872}.....@.....@.....@.....@.......@.....@.....@.......@......Setup......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{125CBCBA-000D-4311-82CD-4ABABCD734C4}&.{1C3E8ABA-6E5B-4F90-B97A-DDBE685F9798}.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]..".C:\Program Files (x86)\Windows NT\....*.C:\Program Files (x86)\Windows NT\file.dat...._K..._.@A.......\.MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....og.........." ........................................................0]......]...`.............................................`...0...(.....].......\.,7........... ].x...............................(....)..
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):1689488
                                          Entropy (8bit):7.999885008892668
                                          Encrypted:true
                                          SSDEEP:24576:zXvgGJETADKo2dEMnxTAuuoSbYk15+Jv+2MS71Jrul4vRW3M734cn6LVQiOZGg9k:z4GEIQD1AupSkzvT71Jrul4vRW3MlCus
                                          MD5:2D8FE2E2298FB17C93F3A42B1A35F5CA
                                          SHA1:8DB4472A53DEDBA2604B173AAE3AF9AAE7752BCF
                                          SHA-256:1C16CF56BA1C983CEBAB5D0F92627B8DDD7B11B34E51E300D3B1D687921E8F1C
                                          SHA-512:F9E76D033E9FDE3B68FED8D4B8C080DF4C92B02D626CAD604538B0EE71926C1C0CA3B69DAF02299C4863C69B43903D0A49C39B6527CB0F1AB50204EB4EC7AC63
                                          Malicious:false
                                          Reputation:low
                                          Preview:.@S.........;.................Z......,3'....&.D...}..A...../w.....)#,.H$...9..q.^y....7.}..~&..k*.......l.\.;d>.[...|.....bm".....3>.. .g.=s...{c.3?....C.r....6.k.............W9.....N...m.z..g..".y....n....o..'.+X.]7.k&N2.s.... .s....,x~#.d.&.R.b,'....}E..o..>...\.j.=...-b_..S5..3..Br.8)...)za..(.p.=...@.A.Le....~.....?...i.-.\'.I..u!=:...Z.I'P.{..tf.f.G.8....Wb_(....We..#.]Y..W.A.0.).......U...eD.:T.&.DBA....h.y.....;B..1...2..l...n..Z8.e]Hr..GQ..v<l.i.}hu.Q.u..ox.....G.4..p..(..........0 ..u.6J.!.+.5.8.T...y....>}..:.../.R2../.y..^L..U..<.E.....e....1..v....Q.`.+sc.i.. ....T....,njJ...;...X>M....R.K&.g........x.H..1X..._.k..f$y...H..V.......U....SZr.O....<...../...GK.UX..C8..7._..M.7=.h..m8..N....2.Y..9Z\Tf.KZ]./......D...r..|...a..'...!-......(.v.a+U...2d..Z|D.b.........7.U.{.X.oQ..'..8.#..X....a>..5i.P....Q.e......n5........?|..?1Y.u..>.......W.k........S.|y...../.....k.(.MhV.#."..6....B.R......u.U.7..?....;....BL..N..,..d.,0..O.
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                          Category:dropped
                                          Size (bytes):6070784
                                          Entropy (8bit):7.391209406124013
                                          Encrypted:false
                                          SSDEEP:98304:KguaE99X1NNBNUpVzglP/szL6lD6E97b1ScJFhs9kwfgdvC3OiXpNm:jA5ZvUp5g+KQE9319vExJXpNm
                                          MD5:F2667D49F895F5A458B245725B8B8E06
                                          SHA1:0B9B0375BBDDD7A8049C69AC8894350FA742D374
                                          SHA-256:C719EC19E1E00A334D48760CB39609C69FDD0AC7458700A6255DDF41FEB43BEE
                                          SHA-512:89126FCED8A2E49DE22ACD27D5D29BB1A0ED726120813D0179094CAA90BAC5725A7978606BB68EDA25A8E1ECDB1D86730AB87069957144A1C8B1D8525B00167D
                                          Malicious:true
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 18%
                                          • Antivirus: Virustotal, Detection: 40%, Browse
                                          Joe Sandbox View:
                                          • Filename: installer64v43.2.6.msi, Detection: malicious, Browse
                                          • Filename: installer64v8.2.9.msi, Detection: malicious, Browse
                                          • Filename: installer64v9.2.7.msi, Detection: malicious, Browse
                                          • Filename: installer64v6.2.8.msi, Detection: malicious, Browse
                                          • Filename: installer64v6.3.2.msi, Detection: malicious, Browse
                                          • Filename: installer64v5.3.7.msi, Detection: malicious, Browse
                                          • Filename: installer64v5.2.7.msi, Detection: malicious, Browse
                                          • Filename: installer64v4.2.0.msi, Detection: malicious, Browse
                                          • Filename: installer64v5.2.6.msi, Detection: malicious, Browse
                                          • Filename: installer64v3.25.msi, Detection: malicious, Browse
                                          Reputation:moderate, very likely benign file
                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....og.........." ........................................................0]......]...`.............................................`...0...(.....].......\.,7........... ].x...............................(....)..@...............0............................text...n........................... ..`.rdata...k.......l..................@..@.data...Tg...`...F...B..............@....pdata...6....2..8....2.............@..@.00cfg..8.....3.......2.............@..@.tls......... 3.......2.............@..._RDATA.......03.......2.............@..@.cE%......)..@3...)...2............. ..h.rsrc.........].......\.............@..@.reloc..x.... ].......\.............@..B........................................................................................................................................................................................................................
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Setup, Author: Netease, Keywords: Installer, Comments: bstgegf, Template: Intel;1033, Revision Number: {DDB2C592-F0D1-400A-AC71-F8B9D3954872}, Create Time/Date: Sun Dec 29 03:35:12 2024, Last Saved Time/Date: Sun Dec 29 03:35:12 2024, Number of Pages: 300, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
                                          Category:dropped
                                          Size (bytes):7802880
                                          Entropy (8bit):7.587119857121015
                                          Encrypted:false
                                          SSDEEP:196608:R/GwhdseFSqFA5ZvUp2g+KQE9319vExJXpNm:8O2ewqFKZslHavXm
                                          MD5:AD0E0C82DAB53F0A2652C626BFC759BB
                                          SHA1:ECD54BC030343B3D538D69E4776175B69BC6ED80
                                          SHA-256:A63DB2DAF426CED44B66E30EC3B50697DAB533DD087CF4E00A7B82F2C6371630
                                          SHA-512:08117E084D94DC8CE5D0BB8288D677F550393D3B0AD29CD53BD6F91CFBDBC2D0815D87F74690EF9C84D1DECA91724E36C0433EEE1F32A1F9F36DB80A4CD5FEF1
                                          Malicious:false
                                          Reputation:low
                                          Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Setup, Author: Netease, Keywords: Installer, Comments: bstgegf, Template: Intel;1033, Revision Number: {DDB2C592-F0D1-400A-AC71-F8B9D3954872}, Create Time/Date: Sun Dec 29 03:35:12 2024, Last Saved Time/Date: Sun Dec 29 03:35:12 2024, Number of Pages: 300, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
                                          Category:dropped
                                          Size (bytes):7802880
                                          Entropy (8bit):7.587119857121015
                                          Encrypted:false
                                          SSDEEP:196608:R/GwhdseFSqFA5ZvUp2g+KQE9319vExJXpNm:8O2ewqFKZslHavXm
                                          MD5:AD0E0C82DAB53F0A2652C626BFC759BB
                                          SHA1:ECD54BC030343B3D538D69E4776175B69BC6ED80
                                          SHA-256:A63DB2DAF426CED44B66E30EC3B50697DAB533DD087CF4E00A7B82F2C6371630
                                          SHA-512:08117E084D94DC8CE5D0BB8288D677F550393D3B0AD29CD53BD6F91CFBDBC2D0815D87F74690EF9C84D1DECA91724E36C0433EEE1F32A1F9F36DB80A4CD5FEF1
                                          Malicious:false
                                          Reputation:low
                                          Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):6072465
                                          Entropy (8bit):7.391223322293949
                                          Encrypted:false
                                          SSDEEP:98304:gguaE99X1NNBNUpVzglP/szL6lD6E97b1ScJFhs9kwfgdvC3OiXpNmy:BA5ZvUp5g+KQE9319vExJXpNmy
                                          MD5:DF5C34DBDED361A838E32A9C355F5FC3
                                          SHA1:EBB2B9C62C846FD00DE1E9CC96D218BFEA1BBFEF
                                          SHA-256:DAAAE191FAADAB823AD29065A3A7D4BF3F4DACF678C2708B88C868630EEEEA34
                                          SHA-512:085A173B7D9917E07262BE2EF4A8E37402E2C2544B510C5BED9B7C572F37FA5496CC3DE1D670C2A4290B50177F2FD56867BF3336B5B460FE6DF535E64FE24157
                                          Malicious:false
                                          Reputation:low
                                          Preview:...@IXOS.@.....@.*.Y.@.....@.....@.....@.....@.....@......&.{1C3E8ABA-6E5B-4F90-B97A-DDBE685F9798}..Setup..1.msi.@.....@.....@.....@........&.{DDB2C592-F0D1-400A-AC71-F8B9D3954872}.....@.....@.....@.....@.......@.....@.....@.......@......Setup......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{125CBCBA-000D-4311-82CD-4ABABCD734C4}*.C:\Program Files (x86)\Windows NT\file.dat.@.......@.....@.....@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]...@.....@.....@......".C:\Program Files (x86)\Windows NT\....1\gujfn150\|Windows NT\......Please insert the disk: ..cab1.cab.@.....@......C:\Windows\Installer\50c176.msi.........@........file.dat..l4d..file.dat.@.....@.....@.......@.............@.........@.....@.....@-....@)..|.@..+.@.5......._....J..._.@A.......\.MZx.....................@...................................x......
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                          Category:modified
                                          Size (bytes):6070784
                                          Entropy (8bit):7.391209406124013
                                          Encrypted:false
                                          SSDEEP:98304:KguaE99X1NNBNUpVzglP/szL6lD6E97b1ScJFhs9kwfgdvC3OiXpNm:jA5ZvUp5g+KQE9319vExJXpNm
                                          MD5:F2667D49F895F5A458B245725B8B8E06
                                          SHA1:0B9B0375BBDDD7A8049C69AC8894350FA742D374
                                          SHA-256:C719EC19E1E00A334D48760CB39609C69FDD0AC7458700A6255DDF41FEB43BEE
                                          SHA-512:89126FCED8A2E49DE22ACD27D5D29BB1A0ED726120813D0179094CAA90BAC5725A7978606BB68EDA25A8E1ECDB1D86730AB87069957144A1C8B1D8525B00167D
                                          Malicious:true
                                          Antivirus:
                                          • Antivirus: ReversingLabs, Detection: 18%
                                          • Antivirus: Virustotal, Detection: 40%, Browse
                                          Joe Sandbox View:
                                          • Filename: installer64v43.2.6.msi, Detection: malicious, Browse
                                          • Filename: installer64v8.2.9.msi, Detection: malicious, Browse
                                          • Filename: installer64v9.2.7.msi, Detection: malicious, Browse
                                          • Filename: installer64v6.2.8.msi, Detection: malicious, Browse
                                          • Filename: installer64v6.3.2.msi, Detection: malicious, Browse
                                          • Filename: installer64v5.3.7.msi, Detection: malicious, Browse
                                          • Filename: installer64v5.2.7.msi, Detection: malicious, Browse
                                          • Filename: installer64v4.2.0.msi, Detection: malicious, Browse
                                          • Filename: installer64v5.2.6.msi, Detection: malicious, Browse
                                          • Filename: installer64v3.25.msi, Detection: malicious, Browse
                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....og.........." ........................................................0]......]...`.............................................`...0...(.....].......\.,7........... ].x...............................(....)..@...............0............................text...n........................... ..`.rdata...k.......l..................@..@.data...Tg...`...F...B..............@....pdata...6....2..8....2.............@..@.00cfg..8.....3.......2.............@..@.tls......... 3.......2.............@..._RDATA.......03.......2.............@..@.cE%......)..@3...)...2............. ..h.rsrc.........].......\.............@..@.reloc..x.... ].......\.............@..B........................................................................................................................................................................................................................
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:Composite Document File V2 Document, Cannot read section info
                                          Category:dropped
                                          Size (bytes):20480
                                          Entropy (8bit):1.1616500284395395
                                          Encrypted:false
                                          SSDEEP:12:JSbX72FjQAGiLIlHVRpgh/7777777777777777777777777vDHF0/YGMuJpjl0i5:JOQI5oC/zMuGF
                                          MD5:2E889F14A2635A9AAD06BAE8C8C47836
                                          SHA1:1D41A62BAF71F23B5E310235FEB823B10EA27A87
                                          SHA-256:DA75A3546788A6042B88CE03DD71DF30FB233724123F34D0C8231B332099943F
                                          SHA-512:5FA8C59F7FFCD274FED557F41B685ED52B70753DD1CD6A28B595801956473273355BC37E2D7B234FD866025A4020688F8ED6CD0C5D9EC5FE2BA374BBF8156DA9
                                          Malicious:false
                                          Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:Composite Document File V2 Document, Cannot read section info
                                          Category:dropped
                                          Size (bytes):20480
                                          Entropy (8bit):1.4573517719026605
                                          Encrypted:false
                                          SSDEEP:48:K8PhtuRc06WXOKnT5ZmkRdeS5otrydeSIyXs:Vht1MnTfLyhGXs
                                          MD5:BBA94F3DA3BAE2585753A7EBEF6BBBFE
                                          SHA1:1ACE96AEBBA27C7A472899536245F9E6DF7018CA
                                          SHA-256:15F750D7F19BA1983787A410F4FE66FD412519793D53DA990DDDB232C390F610
                                          SHA-512:153B64E6A6A97141F36A15B3346021E5FE3767AB479A892749A33360FAD765B48AAD5FCF254E0861000EF91B93A6E3886C730F1F7F9F26D278D11F1E40C38ED1
                                          Malicious:false
                                          Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):432221
                                          Entropy (8bit):5.375174433048454
                                          Encrypted:false
                                          SSDEEP:1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgau8:zTtbmkExhMJCIpErV
                                          MD5:C34151F071E87B1EB99C4CC637BE1BEC
                                          SHA1:96FA71023F515779C34A29D8F8B55D3EA10E9D3F
                                          SHA-256:80E53C20583722A5B5636F9394255B1A64700A5F4A5B22D375B1B8EEF347C5F9
                                          SHA-512:8C09D3C5F03ED1F54EF7519ACE118169918F979D0D2F852A65D7AAD44D80C43269A4B13E7A92D51176DA15241E27E33AE8A08DA96F9BBFFA7089C0D97249F481
                                          Malicious:false
                                          Preview:.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:Composite Document File V2 Document, Cannot read section info
                                          Category:dropped
                                          Size (bytes):20480
                                          Entropy (8bit):1.4573517719026605
                                          Encrypted:false
                                          SSDEEP:48:K8PhtuRc06WXOKnT5ZmkRdeS5otrydeSIyXs:Vht1MnTfLyhGXs
                                          MD5:BBA94F3DA3BAE2585753A7EBEF6BBBFE
                                          SHA1:1ACE96AEBBA27C7A472899536245F9E6DF7018CA
                                          SHA-256:15F750D7F19BA1983787A410F4FE66FD412519793D53DA990DDDB232C390F610
                                          SHA-512:153B64E6A6A97141F36A15B3346021E5FE3767AB479A892749A33360FAD765B48AAD5FCF254E0861000EF91B93A6E3886C730F1F7F9F26D278D11F1E40C38ED1
                                          Malicious:false
                                          Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):512
                                          Entropy (8bit):0.0
                                          Encrypted:false
                                          SSDEEP:3::
                                          MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                          SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                          SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                          SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                          Malicious:false
                                          Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):512
                                          Entropy (8bit):0.0
                                          Encrypted:false
                                          SSDEEP:3::
                                          MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                          SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                          SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                          SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                          Malicious:false
                                          Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:Composite Document File V2 Document, Cannot read section info
                                          Category:dropped
                                          Size (bytes):20480
                                          Entropy (8bit):1.4573517719026605
                                          Encrypted:false
                                          SSDEEP:48:K8PhtuRc06WXOKnT5ZmkRdeS5otrydeSIyXs:Vht1MnTfLyhGXs
                                          MD5:BBA94F3DA3BAE2585753A7EBEF6BBBFE
                                          SHA1:1ACE96AEBBA27C7A472899536245F9E6DF7018CA
                                          SHA-256:15F750D7F19BA1983787A410F4FE66FD412519793D53DA990DDDB232C390F610
                                          SHA-512:153B64E6A6A97141F36A15B3346021E5FE3767AB479A892749A33360FAD765B48AAD5FCF254E0861000EF91B93A6E3886C730F1F7F9F26D278D11F1E40C38ED1
                                          Malicious:false
                                          Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:Composite Document File V2 Document, Cannot read section info
                                          Category:dropped
                                          Size (bytes):32768
                                          Entropy (8bit):1.1751593131961942
                                          Encrypted:false
                                          SSDEEP:48:TWVu+srMLFXOZT5MmkRdeS5otrydeSIyXs:aVzUTyLyhGXs
                                          MD5:7FBD383937DC76B3EABC770C6A8A15C8
                                          SHA1:B69F4FEEEC0402B396264848B87CCFD7D36DB57C
                                          SHA-256:018D806A7F7428D3AFB81A11DFB6F10DE12D14F6F2D5E971E7804E29EC9EE84E
                                          SHA-512:D9A9717AAA6FA20473BECBC1970EF7238FFFD971A3C8F0CCD2F462B14C8CE086DF0CD7788C7E34A6014867E8BB1A3E0159B2732210D0C2B550ED149FFA3CF0A9
                                          Malicious:false
                                          Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):512
                                          Entropy (8bit):0.0
                                          Encrypted:false
                                          SSDEEP:3::
                                          MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                          SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                          SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                          SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                          Malicious:false
                                          Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):512
                                          Entropy (8bit):0.0
                                          Encrypted:false
                                          SSDEEP:3::
                                          MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                          SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                          SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                          SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                          Malicious:false
                                          Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):32768
                                          Entropy (8bit):0.0680623379005078
                                          Encrypted:false
                                          SSDEEP:6:2/9LG7iVCnLG7iVrKOzPLHKO0/QxfGroGtCVky6lh1:2F0i8n0itFzDHF0/YGMoj
                                          MD5:5B5666943B2D0F58843D71AA1E059799
                                          SHA1:0E80E71F69DBF1B4B6E13954BE9FF16EB3059B9F
                                          SHA-256:A7D5A32938993BF48EFD6638CD4FD64CA378FFA164748587B2F752C141A993F8
                                          SHA-512:12D7BE202F38B4D0FE7D5D66C9FCB20E75A6A2B7C0D87952FB3DC615BA682A934639649D774D0BABED910B5948711184C02D6A80006654F1804F057E21788461
                                          Malicious:false
                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):512
                                          Entropy (8bit):0.0
                                          Encrypted:false
                                          SSDEEP:3::
                                          MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                          SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                          SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                          SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                          Malicious:false
                                          Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):69632
                                          Entropy (8bit):0.10046225379307311
                                          Encrypted:false
                                          SSDEEP:24:+1sIDzZLdB5GipVGdB5GipV7V2BwGJlrkgv+ZQR:UsOzldeScdeS5otrvzR
                                          MD5:B3DB3E0CE9A64A3B3BEC044105E3BFF6
                                          SHA1:653C97D01C40644666E08AE99C986C6025F39CE9
                                          SHA-256:9DB11C4B473EA954DCA65B508C356B6CF066FECEE815980CD58D04FC42470BEC
                                          SHA-512:D09523816BAB0E90A877D311B3C911434881FB8A6CDEB1C69541F5E59ADFB3702793E2BB62CC7B1F60A9741C43DFA0C13D585E6A36828853DCC5F4935464EFD3
                                          Malicious:false
                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:Composite Document File V2 Document, Cannot read section info
                                          Category:dropped
                                          Size (bytes):32768
                                          Entropy (8bit):1.1751593131961942
                                          Encrypted:false
                                          SSDEEP:48:TWVu+srMLFXOZT5MmkRdeS5otrydeSIyXs:aVzUTyLyhGXs
                                          MD5:7FBD383937DC76B3EABC770C6A8A15C8
                                          SHA1:B69F4FEEEC0402B396264848B87CCFD7D36DB57C
                                          SHA-256:018D806A7F7428D3AFB81A11DFB6F10DE12D14F6F2D5E971E7804E29EC9EE84E
                                          SHA-512:D9A9717AAA6FA20473BECBC1970EF7238FFFD971A3C8F0CCD2F462B14C8CE086DF0CD7788C7E34A6014867E8BB1A3E0159B2732210D0C2B550ED149FFA3CF0A9
                                          Malicious:false
                                          Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                          Process:C:\Windows\System32\msiexec.exe
                                          File Type:Composite Document File V2 Document, Cannot read section info
                                          Category:dropped
                                          Size (bytes):32768
                                          Entropy (8bit):1.1751593131961942
                                          Encrypted:false
                                          SSDEEP:48:TWVu+srMLFXOZT5MmkRdeS5otrydeSIyXs:aVzUTyLyhGXs
                                          MD5:7FBD383937DC76B3EABC770C6A8A15C8
                                          SHA1:B69F4FEEEC0402B396264848B87CCFD7D36DB57C
                                          SHA-256:018D806A7F7428D3AFB81A11DFB6F10DE12D14F6F2D5E971E7804E29EC9EE84E
                                          SHA-512:D9A9717AAA6FA20473BECBC1970EF7238FFFD971A3C8F0CCD2F462B14C8CE086DF0CD7788C7E34A6014867E8BB1A3E0159B2732210D0C2B550ED149FFA3CF0A9
                                          Malicious:false
                                          Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                          File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Setup, Author: Netease, Keywords: Installer, Comments: bstgegf, Template: Intel;1033, Revision Number: {DDB2C592-F0D1-400A-AC71-F8B9D3954872}, Create Time/Date: Sun Dec 29 03:35:12 2024, Last Saved Time/Date: Sun Dec 29 03:35:12 2024, Number of Pages: 300, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
                                          Entropy (8bit):7.587119857121015
                                          TrID:
                                          • Microsoft Windows Installer (60509/1) 88.31%
                                          • Generic OLE2 / Multistream Compound File (8008/1) 11.69%
                                          File name:1.msi
                                          File size:7'802'880 bytes
                                          MD5:ad0e0c82dab53f0a2652c626bfc759bb
                                          SHA1:ecd54bc030343b3d538d69e4776175b69bc6ed80
                                          SHA256:a63db2daf426ced44b66e30ec3b50697dab533dd087cf4e00a7b82f2c6371630
                                          SHA512:08117e084d94dc8ce5d0bb8288d677f550393d3b0ad29cd53bd6f91cfbdbc2d0815d87f74690ef9c84d1deca91724e36c0433eee1f32a1f9f36db80a4cd5fef1
                                          SSDEEP:196608:R/GwhdseFSqFA5ZvUp2g+KQE9319vExJXpNm:8O2ewqFKZslHavXm
                                          TLSH:D476013659B7B0BCF693D6B58AB78777A037379117265CBF00A6E3301632A005B46A73
                                          File Content Preview:........................>......................................................................................................................................................................................................................................
                                          Icon Hash:2d2e3797b32b2b99
                                          No network behavior found

                                          Click to jump to process

                                          Click to jump to process

                                          Click to jump to process

                                          Target ID:0
                                          Start time:05:16:00
                                          Start date:29/12/2024
                                          Path:C:\Windows\System32\msiexec.exe
                                          Wow64 process (32bit):false
                                          Commandline:"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\1.msi"
                                          Imagebase:0x7ff679400000
                                          File size:69'632 bytes
                                          MD5 hash:E5DA170027542E25EDE42FC54C929077
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          Target ID:1
                                          Start time:05:16:00
                                          Start date:29/12/2024
                                          Path:C:\Windows\System32\msiexec.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\system32\msiexec.exe /V
                                          Imagebase:0x7ff679400000
                                          File size:69'632 bytes
                                          MD5 hash:E5DA170027542E25EDE42FC54C929077
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:false

                                          Target ID:2
                                          Start time:05:16:02
                                          Start date:29/12/2024
                                          Path:C:\Windows\System32\msiexec.exe
                                          Wow64 process (32bit):false
                                          Commandline:C:\Windows\System32\MsiExec.exe -Embedding 567E882632BBCB879F56658346895DC6 E Global\MSI0000
                                          Imagebase:0x7ff679400000
                                          File size:69'632 bytes
                                          MD5 hash:E5DA170027542E25EDE42FC54C929077
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:high
                                          Has exited:true

                                          No disassembly