Edit tour

Windows Analysis Report
build.msi

Overview

General Information

Sample name:	build.msi
Analysis ID:	1648463
MD5:	cc9a4fbbbabad106e40b7577f6dbbcc1
SHA1:	4edf9195188e721a7b5f394032ddb987144f918e
SHA256:	0b268732e81427c10afaa9679c60485a5c8a71c839f268b6e0e0d7c57efb3832
Tags:	HUNmsiuser-smica83
Infos:

Detection

Score:	72
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Checks for available system drives (often done to infect USB drives)

Contains capabilities to detect virtual machines

Creates files inside the system directory

Deletes files inside the Windows folder

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Msiexec Initiated Connection

Yara detected AdvancedInstaller

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 9184 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\build.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 5624 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 8376 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 6E1DB9555CE64326EDD6942FBB93A68E MD5: 9D09DC1EDA745A5F87553048E57620CF)

launcher.exe (PID: 564 cmdline: "C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe" MD5: C02DC2CA96FE9841963883C0FE177399)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_AdvancedInstaller	Yara detected AdvancedInstaller	Joe Security

Sigma Signatures

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 104.21.64.101, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 8376, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49721

Suricata Signatures

ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-25T21:01:49.311225+0100	2829202	1	A Network Trojan was detected	192.168.2.5	49721	104.21.64.101	443	TCP

Joe Sandbox Signatures

• AV Detection
• Compliance
• Spreading
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://shaundoose.com/diagnostics.phpAI_DOWNGRADE4010AI_PRESERVE_INSTALL_TYPEPreserveInstallTypeAI_

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\logd.bat

Avira: detection malicious, Label: BAT/Wincir.chwfc

Multi AV Scanner detection for submitted file

Source: build.msi	Virustotal: Detection: 31%			Perma Link
Source: build.msi	ReversingLabs: Detection: 25%

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\LICENSE.electron.txt

Jump to behavior

Source: unknown

HTTPS traffic detected: 104.21.64.101:443 -> 192.168.2.5:49721 version: TLS 1.2

Source:	Binary string: C:\ReleaseAI\win\Release\bin\x86\embeddeduiproxy.pdb= source: build.msi
Source:	Binary string: c:\repos\clink\.build\release\~working\.build\vs2019\bin\final\clink_dll_x86.pdb source: clink_dll_x86.dll.4.dr
Source:	Binary string: ucrtbase.pdb source: build.msi
Source:	Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: ffmpeg.dll.4.dr
Source:	Binary string: Microsoft.Web.WebView2.Core.pdbGCTL source: build.msi
Source:	Binary string: d:\build\ob\bora-16964525\cayman_libsigcpp2\libsigcpp2\src\MSVC_Net2015\Win32\Release\sigc-2.0.pdb## source: sigc-2.0.dll.4.dr
Source:	Binary string: C:\ReleaseAI\win\Release\WinUiBootstrapperEui\WinUiBootstrapperEui.pdb source: build.msi
Source:	Binary string: Unable to get temp pathcopy_dllclink\dll_cache\1.4.6.8b1dec_%08xUnable to create path '%s'\clink_dll_x64.dll.originFailed to create origin file at '%s'Failed to copy DLL to '%s'.pdbUnable to get DLL version for '%s'check_dll_version\Unable to query DLL version info for '%s'DLL version: %08x %08x%s%swait_monitor::on_waited source: clink_dll_x64.dll.4.dr
Source:	Binary string: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\crashinfo\libmupdf.pdb source: launcher.exe, 00000009.00000002.2597059561.000001D54B1E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: libmupdf.pdb source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\_work\1\s\140_release\vcrt_fwd_x86_release\Release\msvcp140_app.pdb source: build.msi
Source:	Binary string: Bookmark Shortcuts%.2flnkfitwidthfitpage"%s" -page %d -view "%s" -zoom %s -scroll %d,%dfitcontentSelect folder with PDF filesBookmark shortcut to page %s of %s.xps;.oxps.pdf.ps;.eps.djvu.chm.cbz;.cbr;.cb7;.cbt.svgSVG documents.mobi.epub.pdb;.prc.fb2;.fb2z;.zfb2;.fb2.zip.bmp;.dib;.gif;.jpg;.jpeg;.jxr;.png;.tga;.tif;.tiff;.webp;.heic;.avifImagesAll supported documents.txt;.log;.nfo;file_id.diz;read.me;*.tcrVK_DOWN source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: SumatraPDF-dll.pdb source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: E:\BA\201\s\140_release\vcrt_fwd_x86_release\Release\vcomp140_app.pdb source: build.msi
Source:	Binary string: D:\a\1\s\Win32\Release\Microsoft.Toolkit.Win32.UI.XamlApplication\Microsoft.Toolkit.Win32.UI.XamlHost.pdb!! source: build.msi
Source:	Binary string: C:\Users\kjk\src\sumatrapdf\out\rel64\SumatraPDF.pdb source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: -64.pdb.lzsa source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: </html>.pdb<<html> source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\s\Win32\Release\Microsoft.Toolkit.Win32.UI.XamlApplication\Microsoft.Toolkit.Win32.UI.XamlHost.pdb source: build.msi
Source:	Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: vk_swiftshader.dll.4.dr
Source:	Binary string: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\crashinfo\SumatraPDF-dll.pdb source: launcher.exe, 00000009.00000002.2597059561.000001D54B1E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Web.WebView2.Core.pdb source: build.msi
Source:	Binary string: ucrtbase.pdbUGP source: build.msi
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: build.msi, MSI6E8B.tmp.4.dr, MSI6501.tmp.4.dr
Source:	Binary string: ITSF.txt.js.json.xml.logfile_id.dizread.me.nfo.tcr.ps.ps.gz.eps.fb2.fb2z.fbz.zfb2.fb2.zip.cbz.cbr.cb7.cbt.pdf.xps.oxps.chm.png.jpg.jpeg.gif.tif.tiff.bmp.tga.jxr.hdp.wdp.webp.epub.mobi.prc.azw.azw1.azw3.pdb.html.htm.xhtml.svg.djvu.jp2.zip.rar.7z.heic.avif.tarfoo.epubfoo.JP2Rar! source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\crashinfo\SumatraPDF.pdb source: launcher.exe, 00000009.00000002.2597059561.000001D54B1E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: elevate.exe.4.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdb source: build.msi
Source:	Binary string: C:\ReleaseAI\win\Release\WinUiBootstrapperEui\WinUiBootstrapperEui.pdb)) source: build.msi
Source:	Binary string: d:\build\ob\bora-16964525\cayman_libsigcpp2\libsigcpp2\src\MSVC_Net2015\Win32\Release\sigc-2.0.pdb source: sigc-2.0.dll.4.dr
Source:	Binary string: c:\repos\clink\.build\release\~working\.build\vs2019\bin\final\clink_dll_x64.pdb source: clink_dll_x64.dll.4.dr
Source:	Binary string: Unable to get temp pathcopy_dllclink\dll_cache\1.4.6.8b1dec_%08xUnable to create path '%s'\clink_dll_x86.dll.originFailed to create origin file at '%s'Failed to copy DLL to '%s'.pdbUnable to get DLL version for '%s'check_dll_version\Unable to query DLL version info for '%s'DLL version: %08x %08x%s%swait_monitor::on_waited source: clink_dll_x86.dll.4.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdbj source: build.msi
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: build.msi
Source:	Binary string: E:\BA\201\s\140_release\vcrt_fwd_x86_release\Release\vcamp140_app.pdb source: build.msi
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdbGCTL source: build.msi
Source:	Binary string: E:\BA\201\s\140_release\vcrt_fwd_x86_release\Release\vccorlib140_app.pdb source: build.msi
Source:	Binary string: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\crashinfo\libmupdf.pdbK_ source: launcher.exe, 00000009.00000002.2597059561.000001D54B1E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\crashinfo\SumatraPDF-dll.pdbo Verfa source: launcher.exe, 00000009.00000002.2597059561.000001D54B1E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: build.msi
Source:	Binary string: D:\build\ob\bora-21139696\bora\build\build\LIBRARIES\adjperm\win32\release\adjperm.pdb source: adjperm.dll.4.dr
Source:	Binary string: https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsaI source: launcher.exe, 00000009.00000002.2597059561.000001D54B1E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsa source: launcher.exe, 00000009.00000002.2597059561.000001D54B1E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\a\_work\1\s\BuildOutput\Release\x86\Microsoft.UI.Xaml\Microsoft.UI.Xaml.pdb source: build.msi
Source:	Binary string: D:\a\_work\1\s\140_release\vcrt_fwd_x86_release\Release\vcruntime140_app.pdb source: build.msi
Source:	Binary string: SumatraPDF.pdb source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\bin\x86\embeddeduiproxy.pdb source: build.msi
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: build.msi
Source:	Binary string: SumatraPDF.pdbSumatraPDF-dll.pdblibmupdf.pdbInstallCrashHandler: skipping because !crashDumpPath source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdbGCTL source: build.msi

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2829202 - Severity 1 - ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA : 192.168.2.5:49721 -> 104.21.64.101:443

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: shaundoose.com

Source: unknown

HTTP traffic detected: POST /diagnostics.php HTTP/1.1Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: AdvancedInstallerHost: shaundoose.comContent-Length: 53Cache-Control: no-cache

Source: build.msi	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: adjperm.dll.4.dr, sigc-2.0.dll.4.dr, rufus-4.6p.exe.4.dr, elevate.exe.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: build.msi	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: adjperm.dll.4.dr, sigc-2.0.dll.4.dr, elevate.exe.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: adjperm.dll.4.dr, sigc-2.0.dll.4.dr, rufus-4.6p.exe.4.dr, elevate.exe.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: adjperm.dll.4.dr, sigc-2.0.dll.4.dr, rufus-4.6p.exe.4.dr, elevate.exe.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: build.msi	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: rufus-4.6p.exe.4.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: rufus-4.6p.exe.4.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: rufus-4.6p.exe.4.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: elevate.exe.4.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: elevate.exe.4.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: adjperm.dll.4.dr, sigc-2.0.dll.4.dr, rufus-4.6p.exe.4.dr, elevate.exe.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: build.msi	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: build.msi	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: adjperm.dll.4.dr, sigc-2.0.dll.4.dr, elevate.exe.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: adjperm.dll.4.dr, sigc-2.0.dll.4.dr, rufus-4.6p.exe.4.dr, elevate.exe.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: elevate.exe.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: build.msi	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: build.msi	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: build.msi	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: adjperm.dll.4.dr, sigc-2.0.dll.4.dr, elevate.exe.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: build.msi	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0K
Source: build.msi	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: rufus-4.6p.exe.4.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: rufus-4.6p.exe.4.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: elevate.exe.4.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: elevate.exe.4.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://docs.oasis-open.org/ns/office/1.2/meta/odf#ContentFile
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://docs.oasis-open.org/ns/office/1.2/meta/odf#StylesFile
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://docs.oasis-open.org/ns/office/1.2/meta/pkg#
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://docs.oasis-open.org/ns/office/1.2/meta/pkg#Document
Source: elevate.exe.4.dr	String found in binary or memory: http://int3.de/
Source: rufus-4.6p.exe.4.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: adjperm.dll.4.dr, sigc-2.0.dll.4.dr, elevate.exe.4.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: adjperm.dll.4.dr, sigc-2.0.dll.4.dr, rufus-4.6p.exe.4.dr, elevate.exe.4.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: build.msi, adjperm.dll.4.dr, sigc-2.0.dll.4.dr, rufus-4.6p.exe.4.dr, elevate.exe.4.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: build.msi	String found in binary or memory: http://ocsp.digicert.com0K
Source: build.msi	String found in binary or memory: http://ocsp.digicert.com0N
Source: build.msi	String found in binary or memory: http://ocsp.digicert.com0O
Source: adjperm.dll.4.dr, sigc-2.0.dll.4.dr, rufus-4.6p.exe.4.dr, elevate.exe.4.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: rufus-4.6p.exe.4.dr, elevate.exe.4.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: rufus-4.6p.exe.4.dr	String found in binary or memory: http://ocsp.sectigo.com0$
Source: clink.bat.4.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://schemas.openxps.org/oxps/v1.0/documentstructure
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://schemas.openxps.org/oxps/v1.0/fixedrepresentation
Source: Info.plist0.4.dr, CodeResources.4.dr, Info.plist.4.dr	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.daisy.org/z3986/2005/ncx/
Source: build.msi, adjperm.dll.4.dr, sigc-2.0.dll.4.dr, elevate.exe.4.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.gribuser.ru/xml/fictionbook/2.0
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.idpf.org/2007/opf
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.idpf.org/2007/opfapplication/xhtml
Source: adjperm.dll.4.dr, sigc-2.0.dll.4.dr	String found in binary or memory: http://www.vmware.com/0/
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://://https://translate.google.com/?op=translate&sl=auto&tl=$
Source: build.msi	String found in binary or memory: https://aka.ms/winui2/webview2download/Reload():
Source: clink_dll_x86.dll.4.dr, clink_dll_x64.dll.4.dr	String found in binary or memory: https://api.github.com/repos/%s/releases/latest
Source: clink_dll_x86.dll.4.dr, clink_dll_x64.dll.4.dr	String found in binary or memory: https://chrisant996.github.io/clink/clink.html#using-history-expansion
Source: el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	String found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: bg.pak.4.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=bg&category=theme81https://myactivity.google.com/myactivity/?u
Source: bg.pak.4.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=bgCtrl$1
Source: el.pak.4.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=el&category=theme81https://myactivity.google.com/myactivity/?u
Source: el.pak.4.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=elCtrl$1
Source: es.pak.4.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=es&category=theme81https://myactivity.google.com/myactivity/?u
Source: es.pak.4.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=esCtrl$1
Source: fr.pak.4.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=fr&category=theme81https://myactivity.google.com/myactivity/?u
Source: fr.pak.4.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=frCtrl$1
Source: el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	String found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: clink_dll_x64.dll.4.dr	String found in binary or memory: https://github.com/%s/releases
Source: elevate.exe.4.dr	String found in binary or memory: https://github.com/Eugeny/tabby#readme0
Source: clink_dll_x86.dll.4.dr, clink_dll_x64.dll.4.dr	String found in binary or memory: https://github.com/chrisant996/clink
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/106);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/107);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/111);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/113);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/114);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/118);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/13)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/16)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/17)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/18)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/20);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/25);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/28);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/32);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/33);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/35)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/41);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/42);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/44);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/45);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/46);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/47);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/48);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/50);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/57);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/60);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/61);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/62);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/64);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/66);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/67);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/69);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/70);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/73);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/74);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/76);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/77);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/78);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/79);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/80);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/82);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/84);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/92);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/93);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/94);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/96);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/97);
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/chrisant996/clink/issues/99)).
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/cmderdev/cmder/issues/2536)).
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/microsoft/detours)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/172)).
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/206)).
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/257)).
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/258)).
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/342)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/365)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/372)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/420)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/422)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/442)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/453)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/456)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/465)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/480)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/487)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/501)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/503)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/512)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/516)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/519)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/520)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/537)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/543)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/mridgers/clink/issues/544)
Source: CHANGES.4.dr	String found in binary or memory: https://github.com/skywind3000/z.lua)
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/blob/master/AUTHORS
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/blob/master/AUTHORShttps://github.com/sumatrapdfreade
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/blob/master/TRANSLATORS
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/commit/%s)
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/commit/646d1feddcc80b3b51072c5b27a1446487904175
Source: launcher.exe, 00000009.00000002.2597059561.000001D54B1E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/commit/646d1feddcc80b3b51072c5b27a1446487904175)
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/discussions
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/discussions/2316
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/discussionsSumatraPDF
Source: el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	String found in binary or memory: https://myactivity.google.com/
Source: el.pak.4.dr, bg.pak.4.dr	String found in binary or memory: https://passwords.google.com
Source: fr.pak.4.dr	String found in binary or memory: https://passwords.google.comCompte
Source: es.pak.4.dr	String found in binary or memory: https://passwords.google.comcuenta
Source: el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	String found in binary or memory: https://policies.google.com/
Source: rufus-4.6p.exe.4.dr	String found in binary or memory: https://rufus.ie
Source: rufus-4.6p.exe.4.dr, elevate.exe.4.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: build.msi	String found in binary or memory: https://shaundoose.com/diagnostics.phpAI_DOWNGRADE4010AI_PRESERVE_INSTALL_TYPEPreserveInstallTypeAI_
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://sumatra-website.onrender.com/update-check-rel.txt
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://sumatra-website.onrender.com/update-check-rel.txtInstaller64LatestInstaller32InstallerArm64P
Source: el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: el.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: es.pak.4.dr	String found in binary or memory: https://support.google.com/chrome/answer/6098869?hl=es
Source: el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.deepl.com/translator#-/$
Source: build.msi	String found in binary or memory: https://www.digicert.com/CPS0
Source: rufus-4.6p.exe.4.dr	String found in binary or memory: https://www.gnu.org/licenses/gpl-3.0.htmlD
Source: el.pak.4.dr, bg.pak.4.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: fr.pak.4.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html&AideG
Source: es.pak.4.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlAy&udaGestionado
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/URLUpdateInfohttps://www.sumatrapdfreader.org/docs/Version-history.
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/dl/prerel/PRE_RELEASE_VER/SumatraPDF-prerel
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2
Source: launcher.exe, 00000009.00000002.2597059561.000001D54B1E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsa
Source: launcher.exe, 00000009.00000002.2597059561.000001D54B1E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsaI
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/docs/Contribute-translation
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/docs/Corrupted-installation
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/docs/Installer-cmd-line-arguments
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/docs/Keyboard-shortcuts
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/docs/Keyboard-shortcutssumatrapdfrestrict.inihttps://www.sumatrapdf
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/docs/Submit-crash-report.html
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/docs/Submit-crash-report.htmlShowCrashHandlerMessage:
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/docs/Version-history.html
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/download-free-pdf-viewer
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/download-free-pdf-viewer-------------
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/manual
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/manualArialwebsiteArial
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/settings/settings3-5-1.html
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/settings/settings3-5-1.html8.33
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/update-check-rel.txt
Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/update-check-rel.txtnotifUpdateCheckInProgress

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443

Source: unknown

HTTPS traffic detected: 104.21.64.101:443 -> 192.168.2.5:49721 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\605253.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6389.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6501.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6560.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI659F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI65EE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6E8B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{3A2F5F1E-36B0-4920-A5FF-BCB162944D96}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI717A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\605256.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\605256.msi	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI6389.tmp

Jump to behavior

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\7z.dll 882063948D675EE41B5AE68DB3E84879350EC81CF88D15B9BABF2FA08E332863
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\7z.exe E2CA3EC168AE9C0B4115CD4FE220145EA9B2DC4B6FC79D765E91F415B34D00DE

Source: rufus-4.6p.exe.4.dr

Static PE information: Resource name: RT_RCDATA type: DOS executable (COM)

Source: TPClntloc.dll.4.dr	Static PE information: No import functions for PE file found
Source: TPClntdeu.dll.4.dr	Static PE information: No import functions for PE file found
Source: TPClntjpn.dll.4.dr	Static PE information: No import functions for PE file found

Source: build.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs build.msi
Source: build.msi	Binary or memory string: OriginalFilenameDataUploader.dllF vs build.msi
Source: build.msi	Binary or memory string: OriginalFilenameucrtbase.dllj% vs build.msi
Source: build.msi	Binary or memory string: OriginalFilenamevcruntime140.dllT vs build.msi
Source: build.msi	Binary or memory string: OriginalFilenamemsvcp140.dllT vs build.msi
Source: build.msi	Binary or memory string: OriginalFilenameMicrosoft.Web.WebView2.Core.dll vs build.msi
Source: build.msi	Binary or memory string: OriginalFilenameMicrosoft.UI.Xaml.dllD vs build.msi
Source: build.msi	Binary or memory string: OriginalFilenameembeddeduiproxy.dllF vs build.msi

Source: rufus-4.6p.exe.4.dr

Static PE information: Section: UPX1 ZLIB complexity 0.9995281382631407

Source: vk_swiftshader.dll.4.dr	Binary string: ..\..\third_party\swiftshader\src\Device\Sampler.hpp
Source: vk_swiftshader.dll.4.dr	Binary string: ..\..\third_party\swiftshader\src\Device\Blitter.cpp
Source: vk_swiftshader.dll.4.dr	Binary string: ..\..\third_party\swiftshader\src\Device\Context.cpp%s:%d WARNING: UNSUPPORTED: VkIndexType %d
Source: vk_swiftshader.dll.4.dr	Binary string: ..\..\third_party\swiftshader\src\Device\Context.cpp
Source: vk_swiftshader.dll.4.dr	Binary string: ..\..\third_party\swiftshader\src\Device\Sampler.hpp%s:%d WARNING: UNSUPPORTED: VkImageViewType %d
Source: vk_swiftshader.dll.4.dr	Binary string: ..\..\third_party\swiftshader\src\Device\Blitter.cpp%s:%d WARNING: UNSUPPORTED: Blitter source format %d
Source: vk_swiftshader.dll.4.dr	Binary string: =..\..\third_party\swiftshader\src\Device\Renderer.cpp%s:%d WARNING: UNSUPPORTED: polygon mode: %d
Source: vk_swiftshader.dll.4.dr	Binary string: =..\..\third_party\swiftshader\src\Device\Renderer.cpp

Source: clink_dll_x86.dll.4.dr

Binary or memory string: ...Slnt

Source: classification engine

Classification label: mal72.winMSI@6/117@1/1

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CML723F.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe

Mutant created: NULL

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF13CF08A5848E8701.TMP

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload

Jump to behavior

Source: build.msi	Virustotal: Detection: 31%
Source: build.msi	ReversingLabs: Detection: 25%

Source: launcher.exe	String found in binary or memory: sv:Kunde inte hitta SumatraPDF-installation. ta:PDF . th:
Source: launcher.exe	String found in binary or memory: 64-.\n\n 64- tl:Nag-i-install ka n

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\build.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6E1DB9555CE64326EDD6942FBB93A68E
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe "C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6E1DB9555CE64326EDD6942FBB93A68E	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe "C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe"	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Section loaded: dwrite.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: build.msi

Static file information: File size 65046016 > 1048576

Source:	Binary string: C:\ReleaseAI\win\Release\bin\x86\embeddeduiproxy.pdb= source: build.msi
Source:	Binary string: c:\repos\clink\.build\release\~working\.build\vs2019\bin\final\clink_dll_x86.pdb source: clink_dll_x86.dll.4.dr
Source:	Binary string: ucrtbase.pdb source: build.msi
Source:	Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: ffmpeg.dll.4.dr
Source:	Binary string: Microsoft.Web.WebView2.Core.pdbGCTL source: build.msi
Source:	Binary string: d:\build\ob\bora-16964525\cayman_libsigcpp2\libsigcpp2\src\MSVC_Net2015\Win32\Release\sigc-2.0.pdb## source: sigc-2.0.dll.4.dr
Source:	Binary string: C:\ReleaseAI\win\Release\WinUiBootstrapperEui\WinUiBootstrapperEui.pdb source: build.msi
Source:	Binary string: Unable to get temp pathcopy_dllclink\dll_cache\1.4.6.8b1dec_%08xUnable to create path '%s'\clink_dll_x64.dll.originFailed to create origin file at '%s'Failed to copy DLL to '%s'.pdbUnable to get DLL version for '%s'check_dll_version\Unable to query DLL version info for '%s'DLL version: %08x %08x%s%swait_monitor::on_waited source: clink_dll_x64.dll.4.dr
Source:	Binary string: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\crashinfo\libmupdf.pdb source: launcher.exe, 00000009.00000002.2597059561.000001D54B1E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: libmupdf.pdb source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\_work\1\s\140_release\vcrt_fwd_x86_release\Release\msvcp140_app.pdb source: build.msi
Source:	Binary string: Bookmark Shortcuts%.2flnkfitwidthfitpage"%s" -page %d -view "%s" -zoom %s -scroll %d,%dfitcontentSelect folder with PDF filesBookmark shortcut to page %s of %s.xps;.oxps.pdf.ps;.eps.djvu.chm.cbz;.cbr;.cb7;.cbt.svgSVG documents.mobi.epub.pdb;.prc.fb2;.fb2z;.zfb2;.fb2.zip.bmp;.dib;.gif;.jpg;.jpeg;.jxr;.png;.tga;.tif;.tiff;.webp;.heic;.avifImagesAll supported documents.txt;.log;.nfo;file_id.diz;read.me;*.tcrVK_DOWN source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: SumatraPDF-dll.pdb source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: E:\BA\201\s\140_release\vcrt_fwd_x86_release\Release\vcomp140_app.pdb source: build.msi
Source:	Binary string: D:\a\1\s\Win32\Release\Microsoft.Toolkit.Win32.UI.XamlApplication\Microsoft.Toolkit.Win32.UI.XamlHost.pdb!! source: build.msi
Source:	Binary string: C:\Users\kjk\src\sumatrapdf\out\rel64\SumatraPDF.pdb source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: -64.pdb.lzsa source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: </html>.pdb<<html> source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\s\Win32\Release\Microsoft.Toolkit.Win32.UI.XamlApplication\Microsoft.Toolkit.Win32.UI.XamlHost.pdb source: build.msi
Source:	Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: vk_swiftshader.dll.4.dr
Source:	Binary string: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\crashinfo\SumatraPDF-dll.pdb source: launcher.exe, 00000009.00000002.2597059561.000001D54B1E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Web.WebView2.Core.pdb source: build.msi
Source:	Binary string: ucrtbase.pdbUGP source: build.msi
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: build.msi, MSI6E8B.tmp.4.dr, MSI6501.tmp.4.dr
Source:	Binary string: ITSF.txt.js.json.xml.logfile_id.dizread.me.nfo.tcr.ps.ps.gz.eps.fb2.fb2z.fbz.zfb2.fb2.zip.cbz.cbr.cb7.cbt.pdf.xps.oxps.chm.png.jpg.jpeg.gif.tif.tiff.bmp.tga.jxr.hdp.wdp.webp.epub.mobi.prc.azw.azw1.azw3.pdb.html.htm.xhtml.svg.djvu.jp2.zip.rar.7z.heic.avif.tarfoo.epubfoo.JP2Rar! source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\crashinfo\SumatraPDF.pdb source: launcher.exe, 00000009.00000002.2597059561.000001D54B1E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: elevate.exe.4.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdb source: build.msi
Source:	Binary string: C:\ReleaseAI\win\Release\WinUiBootstrapperEui\WinUiBootstrapperEui.pdb)) source: build.msi
Source:	Binary string: d:\build\ob\bora-16964525\cayman_libsigcpp2\libsigcpp2\src\MSVC_Net2015\Win32\Release\sigc-2.0.pdb source: sigc-2.0.dll.4.dr
Source:	Binary string: c:\repos\clink\.build\release\~working\.build\vs2019\bin\final\clink_dll_x64.pdb source: clink_dll_x64.dll.4.dr
Source:	Binary string: Unable to get temp pathcopy_dllclink\dll_cache\1.4.6.8b1dec_%08xUnable to create path '%s'\clink_dll_x86.dll.originFailed to create origin file at '%s'Failed to copy DLL to '%s'.pdbUnable to get DLL version for '%s'check_dll_version\Unable to query DLL version info for '%s'DLL version: %08x %08x%s%swait_monitor::on_waited source: clink_dll_x86.dll.4.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdbj source: build.msi
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: build.msi
Source:	Binary string: E:\BA\201\s\140_release\vcrt_fwd_x86_release\Release\vcamp140_app.pdb source: build.msi
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdbGCTL source: build.msi
Source:	Binary string: E:\BA\201\s\140_release\vcrt_fwd_x86_release\Release\vccorlib140_app.pdb source: build.msi
Source:	Binary string: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\crashinfo\libmupdf.pdbK_ source: launcher.exe, 00000009.00000002.2597059561.000001D54B1E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\crashinfo\SumatraPDF-dll.pdbo Verfa source: launcher.exe, 00000009.00000002.2597059561.000001D54B1E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: build.msi
Source:	Binary string: D:\build\ob\bora-21139696\bora\build\build\LIBRARIES\adjperm\win32\release\adjperm.pdb source: adjperm.dll.4.dr
Source:	Binary string: https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsaI source: launcher.exe, 00000009.00000002.2597059561.000001D54B1E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsa source: launcher.exe, 00000009.00000002.2597059561.000001D54B1E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\a\_work\1\s\BuildOutput\Release\x86\Microsoft.UI.Xaml\Microsoft.UI.Xaml.pdb source: build.msi
Source:	Binary string: D:\a\_work\1\s\140_release\vcrt_fwd_x86_release\Release\vcruntime140_app.pdb source: build.msi
Source:	Binary string: SumatraPDF.pdb source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\bin\x86\embeddeduiproxy.pdb source: build.msi
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: build.msi
Source:	Binary string: SumatraPDF.pdbSumatraPDF-dll.pdblibmupdf.pdbInstallCrashHandler: skipping because !crashDumpPath source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdbGCTL source: build.msi

Source: launcher.exe.4.dr	Static PE information: section name: _RDATA
Source: libssl-1_1-x64.dll.4.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll.4.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.4.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll.4.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.4.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll.4.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll.4.dr	Static PE information: section name: _RDATA
Source: clink_dll_x64.dll.4.dr	Static PE information: section name: _RDATA
Source: clink_dll_x64.dll.4.dr	Static PE information: section name: .detourc
Source: clink_dll_x64.dll.4.dr	Static PE information: section name: .detourd
Source: clink_dll_x86.dll.4.dr	Static PE information: section name: .detourc
Source: clink_dll_x86.dll.4.dr	Static PE information: section name: .detourd
Source: ffmpeg.dll.4.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll.4.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll.4.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.4.dr	Static PE information: section name: .gxfg
Source: libEGL.dll.4.dr	Static PE information: section name: .retplne
Source: libEGL.dll.4.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.4.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll.4.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll.4.dr	Static PE information: section name: _RDATA
Source: MSI6389.tmp.4.dr	Static PE information: section name: .fptable
Source: MSI6501.tmp.4.dr	Static PE information: section name: .fptable
Source: MSI6560.tmp.4.dr	Static PE information: section name: .fptable
Source: MSI659F.tmp.4.dr	Static PE information: section name: .fptable
Source: MSI65EE.tmp.4.dr	Static PE information: section name: .fptable
Source: MSI6E8B.tmp.4.dr	Static PE information: section name: .fptable

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\gmodule-2.0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vmclientcore.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6E8B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\extras\clink\clink_dll_x86.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\TPClntloc.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vmnetBridge.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vmeventmsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\elevate.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\7z.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\extras\clink\clink_x64.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\ffmpeg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\libEGL.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\adjperm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\zlib1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6389.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\sigc-2.0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\extras\UAC.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\TPClntjpn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI65EE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\mksSandbox.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\libssl-1_1-x64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\rufus-4.6p.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\extras\clink\clink_x86.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\gthread-2.0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6501.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\libcds.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\basichttp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\libGLESv2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6560.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vk_swiftshader.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\TPClntdeu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\7z.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vmauthd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI659F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\extras\clink\clink_dll_x64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vulkan-1.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6E8B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6501.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6560.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6389.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI659F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI65EE.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\LICENSE.electron.txt

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe

Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\gmodule-2.0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vmclientcore.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6E8B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\extras\clink\clink_dll_x86.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\TPClntloc.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vmnetBridge.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vmeventmsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\elevate.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\7z.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\extras\clink\clink_x64.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\libEGL.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\ffmpeg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\adjperm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\zlib1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6389.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\sigc-2.0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\extras\UAC.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\TPClntjpn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI65EE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\mksSandbox.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\libssl-1_1-x64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\rufus-4.6p.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\extras\clink\clink_x86.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\gthread-2.0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6501.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\libcds.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\libGLESv2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\basichttp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6560.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vk_swiftshader.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\TPClntdeu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\7z.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vmauthd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\extras\clink\clink_dll_x64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI659F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vulkan-1.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: mksSandbox.exe.4.dr	Binary or memory string: VMware
Source: mksSandbox.exe.4.dr	Binary or memory string: Disabling GL due to software/VMware card found.
Source: mksSandbox.exe.4.dr	Binary or memory string: Check the mksSandbox.log and vmware.log for more details.
Source: adjperm.dll.4.dr	Binary or memory string: 1998-2023 VMware, Inc.@
Source: mksSandbox.exe.4.dr	Binary or memory string: VMware VMGI Translator (shader %u)
Source: sigc-2.0.dll.4.dr	Binary or memory string: VMware, Inc.1!0
Source: MSI717A.tmp.4.dr	Binary or memory string: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vmnetBridge.dll
Source: MSI717A.tmp.4.dr	Binary or memory string: &{7426186F-614E-467C-B53F-944BB30B0D91}LC:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vmnetBridge.dll@
Source: MSI717A.tmp.4.dr	Binary or memory string: vmnetBridge.dll@@
Source: adjperm.dll.4.dr	Binary or memory string: CreateVMwareGroup
Source: ffmpeg.dll.4.dr	Binary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tga
Source: mksSandbox.exe.4.dr	Binary or memory string: mks.gl.allowSoftwareAndVMwareDrivers
Source: sigc-2.0.dll.4.dr	Binary or memory string: http://www.vmware.com/0/
Source: sigc-2.0.dll.4.dr	Binary or memory string: VMware, Inc.1
Source: MSI717A.tmp.4.dr	Binary or memory string: vmnetBridge.dll
Source: adjperm.dll.4.dr	Binary or memory string: ProductNameVMware WorkstationP
Source: mksSandbox.exe.4.dr	Binary or memory string: 8andcallccasecontinuecontinueccutderiv_rtxderiv_rtydiscarddivdp2emitemitThenCutendswitcheqftoiftougeiaddieqigeiltimadimaximinimulineinegishlishritofldld_msltcustomdatamovcnenotorresinforetcround_neround_niround_piround_zsamplesample_csample_c_lzsample_lsample_dsample_bsqrtswitchudivultugeumulumadumaxuminushrutofxordcl_resourcedcl_constantBufferdcl_samplerdcl_indexRangedcl_outputTopologydcl_inputPrimitivedcl_max_output_vertex_countdcl_inputdcl_input_sgvdcl_input_sivdcl_input_psdcl_input_ps_sgvdcl_input_ps_sivdcl_outputdcl_output_sgvdcl_output_sivdcl_tempsdcl_indexableTempdcl_globalFlagsvmwarelodgather4samplepossampleinforeserved1hs_declshs_control_point_phasehs_fork_phasehs_join_phaseemit_streamcut_streamemitThenCut_streaminterface_callbufinfoderiv_rtx_coarsederiv_rtx_finederiv_rty_coarsederiv_rty_finegather4_cgather4_pogather4_po_cf32tof16f16tof32uaddcusubbcountbitsfirstbit_hifirstbit_lofirstbit_shiubfeibfebfibfrevswapcdcl_streamdcl_function_bodydcl_function_tabledcl_interfacedcl_input_control_point_countdcl_output_control_point_countdcl_tess_domaindcl_tess_partitioningdcl_tess_output_primitivedcl_hs_max_tessfactordcl_hs_fork_phase_instance_countdcl_hs_join_phase_instance_countdcl_thread_groupdcl_uav_typeddcl_uav_rawdcl_uav_structureddcl_tgsm_rawdcl_tgsm_structureddcl_resource_rawdcl_resource_structuredld_uav_typedstore_uav_typedld_rawstore_rawld_structuredstore_structuredatomic_andatomic_oratomic_xoratomic_cmp_storeatomic_iaddatomic_imaxatomic_iminatomic_umaxatomic_uminimm_atomic_allocimm_atomic_consumeimm_atomic_iaddimm_atomic_andimm_atomic_orimm_atomic_xorimm_atomic_exchimm_atomic_cmp_exchimm_atomic_imaximm_atomic_iminimm_atomic_umaximm_atomic_uminsyncdadddmaxdmindmuldeqdgedltdnedmovdmovcdtofftodeval_snappedeval_sample_indexeval_centroiddcl_gs_instance_countabortdebug_breakddivdfmadrcpmsaddtoidtouitodutodidivdfrcdrsq
Source: build.msi	Binary or memory string: vmnetBridge.dllx~
Source: adjperm.dll.4.dr	Binary or memory string: CompanyNameVMware, Inc.@
Source: mksSandbox.exe.4.dr	Binary or memory string: vmware-mksMKSRoleMain: Initializing Preference...
Source: mksSandbox.exe.4.dr	Binary or memory string: SPV_EXT_demote_to_helper_invocationSPV_KHR_float_controlsGLSL.std.450VMW.001VMware VMGI Translator (shader %u)%sBufArrayvmgi2spirv: Dynamic constant buffers are not supported.They will always be mapped to buffer 0.
Source: adjperm.dll.4.dr	Binary or memory string: name="VMware.VMware.adjperm"
Source: sigc-2.0.dll.4.dr	Binary or memory string: noreply@vmware.com0
Source: MSI717A.tmp.4.dr	Binary or memory string: VMNETB~1.DLL\|vmnetBridge.dll
Source: mksSandbox.exe.4.dr	Binary or memory string: vmware
Source: mksSandbox.exe.4.dr	Binary or memory string: mks.consolePTUseVMwareVID
Source: adjperm.dll.4.dr	Binary or memory string: SeInteractiveLogonRightSOFTWARE\VMware, Inc.\SIDVMware User Group__vmware__
Source: mksSandbox.exe.4.dr	Binary or memory string: vmware-mks
Source: mksSandbox.exe.4.dr	Binary or memory string: bora\mks\role\common\mksRoleMain.cvmware-%u-mks-%u.logcustom@&!@@(msg.log.initFailed)Unable to proceed without a log file.
Source: mksSandbox.exe.4.dr	Binary or memory string: vmware-%u-mks-%u.log
Source: adjperm.dll.4.dr	Binary or memory string: adjperm.dllCreateVMwareGroupDeleteVMwareGroupLimitFileAccessSecureKeyAdminReadSecureRegEntries<>
Source: mksSandbox.exe.4.dr	Binary or memory string: GLBasic: VMwareSVGA3DllvmpipeMesaDisabling GL due to software/VMware card found.
Source: adjperm.dll.4.dr	Binary or memory string: DeleteVMwareGroup
Source: ffmpeg.dll.4.dr	Binary or memory string: VMware Screen Codec / VMware Video

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe "C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe"

Jump to behavior

Source: launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp

Binary or memory string: Shell_TrayWndKillProcessesUsingInstallation()

Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe

Code function: 9_2_00007FF7362F4F68 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

9_2_00007FF7362F4F68

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	21 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
build.msi	31%	Virustotal		Browse
build.msi	25%	ReversingLabs	Win32.Trojan.Wincir

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\logd.bat	100%	Avira	BAT/Wincir.chwfc
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\7z.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\TPClntdeu.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\TPClntjpn.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\TPClntloc.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\adjperm.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\basichttp.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\gmodule-2.0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\gthread-2.0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\libcds.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\libssl-1_1-x64.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\mksSandbox.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\elevate.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\extras\UAC.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\extras\clink\clink_dll_x64.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\extras\clink\clink_dll_x86.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\extras\clink\clink_x64.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\resources\extras\clink\clink_x86.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\rufus-4.6p.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\sigc-2.0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vmauthd.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vmclientcore.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vmeventmsg.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vmnetBridge.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\zlib1.dll	0%	ReversingLabs
C:\Windows\Installer\MSI6389.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6501.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6560.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI659F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI65EE.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6E8B.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.idpf.org/2007/opfapplication/xhtml	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/manualArialwebsiteArial	0%	Avira URL Cloud	safe
http://www.gribuser.ru/xml/fictionbook/2.0	0%	Avira URL Cloud	safe
http://www.daisy.org/z3986/2005/ncx/	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/settings/settings3-5-1.html8.33	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/update-check-rel.txtnotifUpdateCheckInProgress	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/docs/Version-history.html	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/docs/Keyboard-shortcutssumatrapdfrestrict.inihttps://www.sumatrapdf	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/download-free-pdf-viewer-------------	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/dl/prerel/PRE_RELEASE_VER/SumatraPDF-prerel	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/settings/settings3-5-1.html	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/update-check-rel.txt	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsaI	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/URLUpdateInfohttps://www.sumatrapdfreader.org/docs/Version-history.	0%	Avira URL Cloud	safe
https://sumatra-website.onrender.com/update-check-rel.txtInstaller64LatestInstaller32InstallerArm64P	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/docs/Submit-crash-report.html	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/download-free-pdf-viewer	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/docs/Corrupted-installation	0%	Avira URL Cloud	safe
https://shaundoose.com/diagnostics.phpAI_DOWNGRADE4010AI_PRESERVE_INSTALL_TYPEPreserveInstallTypeAI_	100%	Avira URL Cloud	malware
http://www.idpf.org/2007/opf	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
shaundoose.com	104.21.64.101	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.github.com/repos/%s/releases/latest	clink_dll_x86.dll.4.dr, clink_dll_x64.dll.4.dr	false		high
https://github.com/chrisant996/clink/issues/57);	CHANGES.4.dr	false		high
https://www.sumatrapdfreader.org/settings/settings3-5-1.html8.33	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/chrisant996/clink/issues/107);	CHANGES.4.dr	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	elevate.exe.4.dr	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	rufus-4.6p.exe.4.dr	false		high
https://github.com/chrisant996/clink/issues/76);	CHANGES.4.dr	false		high
https://support.google.com/chrome/answer/6098869?hl=es	es.pak.4.dr	false		high
https://support.google.com/chrome/answer/6098869	el.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	false		high
https://www.google.com/chrome/privacy/eula_text.html	el.pak.4.dr, bg.pak.4.dr	false		high
https://github.com/chrisant996/clink/issues/18)	CHANGES.4.dr	false		high
https://www.google.com/chrome/privacy/eula_text.htmlAy&udaGestionado	es.pak.4.dr	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	rufus-4.6p.exe.4.dr	false		high
https://passwords.google.comcuenta	es.pak.4.dr	false		high
https://www.sumatrapdfreader.org/manualArialwebsiteArial	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mridgers/clink/issues/372)	CHANGES.4.dr	false		high
https://github.com/sumatrapdfreader/sumatrapdf/discussions/2316	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false		high
https://chrome.google.com/webstore?hl=es&category=theme81https://myactivity.google.com/myactivity/?u	es.pak.4.dr	false		high
https://github.com/chrisant996/clink/issues/41);	CHANGES.4.dr	false		high
https://github.com/chrisant996/clink/issues/60);	CHANGES.4.dr	false		high
http://docs.oasis-open.org/ns/office/1.2/meta/odf#StylesFile	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false		high
https://github.com/mridgers/clink/issues/465)	CHANGES.4.dr	false		high
https://github.com/mridgers/clink/issues/453)	CHANGES.4.dr	false		high
http://www.gribuser.ru/xml/fictionbook/2.0	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/chrisant996/clink/issues/46);	CHANGES.4.dr	false		high
https://photos.google.com/settings?referrer=CHROME_NTP	el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	false		high
https://github.com/chrisant996/clink/issues/69);	CHANGES.4.dr	false		high
https://github.com/chrisant996/clink/issues/118);	CHANGES.4.dr	false		high
https://github.com/chrisant996/clink/issues/42);	CHANGES.4.dr	false		high
https://github.com/chrisant996/clink/issues/114);	CHANGES.4.dr	false		high
https://www.sumatrapdfreader.org/dl/prerel/PRE_RELEASE_VER/SumatraPDF-prerel	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	false		high
https://chrome.google.com/webstore?hl=elCtrl$1	el.pak.4.dr	false		high
https://www.sumatrapdfreader.org/update-check-rel.txtnotifUpdateCheckInProgress	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/chrisant996/clink/issues/35)	CHANGES.4.dr	false		high
https://passwords.google.com	el.pak.4.dr, bg.pak.4.dr	false		high
https://www.sumatrapdfreader.org/docs/Keyboard-shortcutssumatrapdfrestrict.inihttps://www.sumatrapdf	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mridgers/clink/issues/480)	CHANGES.4.dr	false		high
https://aka.ms/winui2/webview2download/Reload():	build.msi	false		high
https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22	el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	false		high
https://www.sumatrapdfreader.org/docs/Version-history.html	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://www.daisy.org/z3986/2005/ncx/	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	elevate.exe.4.dr	false		high
http://www.idpf.org/2007/opfapplication/xhtml	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/chrisant996/clink	clink_dll_x86.dll.4.dr, clink_dll_x64.dll.4.dr	false		high
https://www.google.com/chrome/privacy/eula_text.html&AideG	fr.pak.4.dr	false		high
https://github.com/chrisant996/clink/issues/79);	CHANGES.4.dr	false		high
https://github.com/mridgers/clink/issues/516)	CHANGES.4.dr	false		high
https://support.google.com/chromebook?p=app_intent	el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	false		high
https://chrome.google.com/webstore?hl=frCtrl$1	fr.pak.4.dr	false		high
https://github.com/chrisant996/clink/issues/33);	CHANGES.4.dr	false		high
https://github.com/mridgers/clink/issues/172)).	CHANGES.4.dr	false		high
https://github.com/sumatrapdfreader/sumatrapdf/commit/646d1feddcc80b3b51072c5b27a1446487904175)	launcher.exe, 00000009.00000002.2597059561.000001D54B1E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ns/office/1.2/meta/pkg#Document	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false		high
https://www.sumatrapdfreader.org/download-free-pdf-viewer-------------	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mridgers/clink/issues/544)	CHANGES.4.dr	false		high
https://www.sumatrapdfreader.org/settings/settings3-5-1.html	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/sumatrapdfreader/sumatrapdf/blob/master/AUTHORShttps://github.com/sumatrapdfreade	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false		high
https://github.com/mridgers/clink/issues/520)	CHANGES.4.dr	false		high
https://chrome.google.com/webstore?hl=el&category=theme81https://myactivity.google.com/myactivity/?u	el.pak.4.dr	false		high
https://github.com/chrisant996/clink/issues/82);	CHANGES.4.dr	false		high
https://github.com/mridgers/clink/issues/487)	CHANGES.4.dr	false		high
https://github.com/mridgers/clink/issues/342)	CHANGES.4.dr	false		high
https://www.sumatrapdfreader.org/update-check-rel.txt	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0$	rufus-4.6p.exe.4.dr	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	false		high
https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsaI	launcher.exe, 00000009.00000002.2597059561.000001D54B1E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/chrisant996/clink/issues/45);	CHANGES.4.dr	false		high
https://github.com/chrisant996/clink/issues/64);	CHANGES.4.dr	false		high
https://github.com/mridgers/clink/issues/503)	CHANGES.4.dr	false		high
https://sumatra-website.onrender.com/update-check-rel.txtInstaller64LatestInstaller32InstallerArm64P	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	elevate.exe.4.dr	false		high
https://github.com/chrisant996/clink/issues/111);	CHANGES.4.dr	false		high
https://github.com/chrisant996/clink/issues/13)	CHANGES.4.dr	false		high
https://github.com/mridgers/clink/issues/257)).	CHANGES.4.dr	false		high
https://support.google.com/chrome/a/answer/9122284	el.pak.4.dr, es.pak.4.dr, bg.pak.4.dr, fr.pak.4.dr	false		high
https://www.sumatrapdfreader.org/docs/Corrupted-installation	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/docs/Submit-crash-report.html	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://shaundoose.com/diagnostics.phpAI_DOWNGRADE4010AI_PRESERVE_INSTALL_TYPEPreserveInstallTypeAI_	build.msi	false	Avira URL Cloud: malware	unknown
https://github.com/chrisant996/clink/issues/94);	CHANGES.4.dr	false		high
https://github.com/mridgers/clink/issues/422)	CHANGES.4.dr	false		high
https://www.sumatrapdfreader.org/URLUpdateInfohttps://www.sumatrapdfreader.org/docs/Version-history.	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mridgers/clink/issues/543)	CHANGES.4.dr	false		high
https://github.com/mridgers/clink/issues/365)	CHANGES.4.dr	false		high
https://github.com/mridgers/clink)	CHANGES.4.dr	false		high
https://www.deepl.com/translator#-/$	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false		high
https://www.sumatrapdfreader.org/download-free-pdf-viewer	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://www.idpf.org/2007/opf	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/chrisant996/clink/issues/32);	CHANGES.4.dr	false		high
https://github.com/chrisant996/clink/issues/78);	CHANGES.4.dr	false		high
http://ocsp.sectigo.com0	rufus-4.6p.exe.4.dr, elevate.exe.4.dr	false		high
https://github.com/chrisant996/clink/issues/97);	CHANGES.4.dr	false		high
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false		high
https://github.com/mridgers/clink/issues/258)).	CHANGES.4.dr	false		high
https://github.com/microsoft/detours)	CHANGES.4.dr	false		high
https://github.com/mridgers/clink/issues/206)).	CHANGES.4.dr	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	rufus-4.6p.exe.4.dr	false		high
http://docs.oasis-open.org/ns/office/1.2/meta/odf#ContentFile	launcher.exe, 00000009.00000000.1496555390.00007FF7364CE000.00000002.00000001.01000000.00000004.sdmp	false		high
https://github.com/chrisant996/clink/issues/62);	CHANGES.4.dr	false		high
https://passwords.google.comCompte	fr.pak.4.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.64.101	shaundoose.com	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1648463
Start date and time:	2025-03-25 21:00:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	build.msi
Detection:	MAL
Classification:	mal72.winMSI@6/117@1/1
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.31.69.3, 4.245.163.56, 20.24.125.47, 150.171.28.10
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, g.bing.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target launcher.exe, PID 564 because there are no executed function
Not all processes where analyzed, report is missing behavior information

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.64.101	r3gIOL7UsA.msi	Get hash	malicious	Unknown	Browse
104.21.64.101	build.msi	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
shaundoose.com	r3gIOL7UsA.msi	Get hash	malicious	Unknown	Browse	104.21.64.101
shaundoose.com	build.msi	Get hash	malicious	Unknown	Browse	104.21.64.101

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Play Voicemail Transcription. (387.KB).svg	Get hash	malicious	HTMLPhisher	Browse	104.17.201.1
	https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR~QDcqg1KugH/rhrqqgrWni2pyg1KugH/og75AgMRA37Cu37x!i2GzU2ZBRIJzYIFyRp4R0KWU0rWugMmJiYWAVpWKV1K4i6V8hIZ5SM0ZiLWEW1OmR5/DRLcQX0iG12ODR6m0Z2uCX54XhMGr31/03pyTfZ6rYZi~XpqUQYOHR1KUiJS11Z/0T2qVjY4XRZcYgpc9i5uJWYR7g20EjL0/YM46gJCqg7mLRrm6jJc4gn5DVr69X0OQV6WNfKt6Z1h7XJOYhqWIX20v3pR/S20XfZm6f1WH4qtBZKWOY6Wx4rKpZ0Onh80BSLOY4Mh83r/3ZsWx36GrQYOHS2SniIWZV507V1OzioqTfo0xY7S5jJhCSsiRhLiZZI4L35OUYZm~hJ/~js4tfpuWh5qOiIJ9fMm8gK0CTM04fsiv4555ipVyRpOyTY0xjK0AT1mQYYOfW5uUS842iqiCjr4qXIJ73o0Sg80RRoqYjI0~j0uN1qiWWpmz3sJBS6Z701OyRrSBfH5DWpWo3oSC02OW1JKCi5/DRsSt4KS/RImw1KZyRp49hsi~f6uZRsioj2uZR2mUg0KsQYOHiEK6RJ0/W8SoQYOHXZuJSoGRTMqP3rS2gr/t01xD4MF70sSmSLOOZ64Xh1/fi7bCW6G9f5OMVsGNgYW8XIqsSMq~TJR8RJxBgKq0XE09hr/5jqmJZ6mxR2STVryCZpC3WrcNf0JESsVDZM35QYOLRs0GRZc44pm4jYKUQYOLfM0xZ2W8X8iMf04SQYOLWIG7jpOt2EWBf1mNj1iTZ5NBhoqX4qhB4IV5Y5W7QYOHZZ/zgLb60KGB4sOxWZyqWqKnj1u01pWE3YOEiJms1MhB08uJjLiDZZBC00WSjMmq1ImDX6mPVYS0X0KYZ7yL4sKD3oGL4Jh912KMW2FDY0tBYEVE315DYZ65XZ4uTZiKXYixi6SOS5VDSZC5WsmSfKG5R53BjL6xfEKwSKuG12SX0KGAZ8W7R5WBSLl812iWf1Kq3r0vTLqHX5/LR50UWZ06TYKNRrcVd~FG88JcGJ/FGF88986aFHbKbb/JIIK/89KHGK8IHaG/I8KIcbba6c7cKI68GGKI7?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiMTVjN2QxOWQyYmUwNTY1NzUzNWNiMjU5MjdlZDQxYTo3OjBjYTc6YjUxOGI0N2MzNmJhYjUzNGU2MzNkZWE3MDBkNGExYmIwNzljNzhmMDU2MmNkNzkwZDBhMjM3MDE5NjU0YTZkNTpoOlQ6VA	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.24.14
	https://business.peppercontent.io/items/1EeoNExLmk9	Get hash	malicious	Unknown	Browse	104.26.13.204
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	file.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	https://ergc.onirique5.com/xRmONkR9H3tSwgZ6bakdPQM/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.157.109
	Revised - Hartzellprop.com 2025 Handbook29828.doc	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.26.0.100
	CAPITAT SC 2025-2..exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Revised - Cwalker 2025 Handbook25807.doc	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.70.233
	http://hak5.com	Get hash	malicious	Unknown	Browse	104.18.86.42

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	SAMHWA.vbs	Get hash	malicious	GuLoader	Browse	104.21.64.101
	SAMHWA.vbs	Get hash	malicious	GuLoader	Browse	104.21.64.101
	Patch-HWMonitor.Pro.1.3x.exe	Get hash	malicious	Unknown	Browse	104.21.64.101
	HWMonitorPro_x64.exe	Get hash	malicious	Unknown	Browse	104.21.64.101
	znicegreatveryspecialguestyourareforme.hta	Get hash	malicious	Remcos	Browse	104.21.64.101
	rPedidodeCota____o-20250325_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.64.101
	867194897_fedex-factura.bat	Get hash	malicious	GuLoader	Browse	104.21.64.101
	Hesap Hareketleri 24-03-2025.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.64.101
	Pedido de Cota.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.64.101
	Ll57CUTdDq.exe	Get hash	malicious	NetSupport RAT	Browse	104.21.64.101

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\7z.exe	r3gIOL7UsA.msi	Get hash	malicious	Unknown	Browse
	build.msi	Get hash	malicious	Unknown	Browse
	7T7bCyA.exe	Get hash	malicious	Unknown	Browse
	#U70b9#U51fb#U6b64#U5904-#U5b89#U88c5#U7b80#U4f53#U4e2d#U6587#U53051.exe	Get hash	malicious	MicroClip	Browse
C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\7z.dll	r3gIOL7UsA.msi	Get hash	malicious	Unknown	Browse
	build.msi	Get hash	malicious	Unknown	Browse
	7T7bCyA.exe	Get hash	malicious	Unknown	Browse
	#U70b9#U51fb#U6b64#U5904-#U5b89#U88c5#U7b80#U4f53#U4e2d#U6587#U53051.exe	Get hash	malicious	MicroClip	Browse

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	23978
Entropy (8bit):	5.787317377031681
Encrypted:	false
SSDEEP:	384:hdjhRnij3e8TiTbB4Nw+sz8BgGzPEftQCmz8TYJjPx1G1GfiF:hdjhRij30TbB4Nw+szcgUZPx1+/
MD5:	6EAC3B207E4708F025307AD19635C092
SHA1:	4E297294F363B429D4D5C8776EFE28423E56A1ED
SHA-256:	C70477582C4C655CF3C66AD123EDF44BEEA87078B280C84F1935341DC8729617
SHA-512:	60E670042641F829FD87DB28565F428C45CC01A4B159607160CC2CE2FD3B2CAAF853944A1F7429CA50FDB951024FD0FA1C1A09E0575B0E8B48F26D7EEB634F14
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@:.yZ.@.....@.....@.....@.....@.....@......&.{3A2F5F1E-36B0-4920-A5FF-BCB162944D96}..Klio Verfair Tools..build.msi.@.....@.....@.....@......icon_23.exe..&.{5573CB6A-FBB7-4DDB-BB6F-286B726CF22B}.....@.....@.....@.....@.......@.....@.....@.......@......Klio Verfair Tools......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{7D0977D7-319F-41E6-AC22-4C628AFB5366}&.{3A2F5F1E-36B0-4920-A5FF-BCB162944D96}.@......&.{00541E92-B30A-43FA-9AD1-62A7BF8D6B85}&.{3A2F5F1E-36B0-4920-A5FF-BCB162944D96}.@......&.{0A71947E-5499-4B27-8695-F2466C030D57}&.{3A2F5F1E-36B0-4920-A5FF-BCB162944D96}.@......&.{40974B72-6EF2-4796-AFED-87826DA707E4}&.{3A2F5F1E-36B0-4920-A5FF-BCB162944D96}.@......&.{F4E863DB-C2DD-42C9-A0A8-23116650C890}&.{3A2F5F1E-36B0-4920-A5FF-BCB162944D96}.@......&.{9E2EDF55-187D-47C4-ABCE-D11BC516C477}&.{3A2F5F1E-36B0-4920-A5FF-BCB162944D96}.@......&.{36EF000F-B295-468F-95A1-F3B736FB6086}&.{

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {5573CB6A-FBB7-4DDB-BB6F-286B726CF22B}, Number of Words: 10, Subject: Klio Verfair Tools, Author: TasovCoop, Name of Creating Application: Klio Verfair Tools, Template: ;1033, Comments: This installer database contains the logic and data required to install Klio Verfair Tools., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Sun Mar 23 16:43:52 2025, Last Saved Time/Date: Sun Mar 23 16:43:52 2025, Last Printed: Sun Mar 23 16:43:52 2025, Number of Pages: 450
Entropy (8bit):	7.31982440208669
TrID:	Windows SDK Setup Transform Script (63028/2) 88.73% Generic OLE2 / Multistream Compound File (8008/1) 11.27%
File name:	build.msi
File size:	65'046'016 bytes
MD5:	cc9a4fbbbabad106e40b7577f6dbbcc1
SHA1:	4edf9195188e721a7b5f394032ddb987144f918e
SHA256:	0b268732e81427c10afaa9679c60485a5c8a71c839f268b6e0e0d7c57efb3832
SHA512:	059a987598cd67f4603ccdb1721e136890bc07da30527105e0a86bbf68bb657f1c9c32539e29d09524cb804496fd925931aa2efcf8a7d373f1ef71318c4546bc
SSDEEP:	786432:D0zVmrjV7eIAtC9OTZm/lD0qKZIr6KmOwCHu5PVpraze:DSVmrjV7eI/9OTZ0PmOC5W
TLSH:	94E77C01B3FA4148F2F75EB17EBA45A594BABD521B30C0EF1204660E1B72BC25BB5763
File Content Preview:	........................>............................................#..................................................................z...............................................................................................g......................

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2025 21:01:49.035160065 CET	49721	443	192.168.2.5	104.21.64.101
Mar 25, 2025 21:01:49.035195112 CET	443	49721	104.21.64.101	192.168.2.5
Mar 25, 2025 21:01:49.035286903 CET	49721	443	192.168.2.5	104.21.64.101
Mar 25, 2025 21:01:49.037451982 CET	49721	443	192.168.2.5	104.21.64.101
Mar 25, 2025 21:01:49.037462950 CET	443	49721	104.21.64.101	192.168.2.5
Mar 25, 2025 21:01:49.259216070 CET	443	49721	104.21.64.101	192.168.2.5
Mar 25, 2025 21:01:49.259298086 CET	49721	443	192.168.2.5	104.21.64.101
Mar 25, 2025 21:01:49.308525085 CET	49721	443	192.168.2.5	104.21.64.101
Mar 25, 2025 21:01:49.308547020 CET	443	49721	104.21.64.101	192.168.2.5
Mar 25, 2025 21:01:49.309120893 CET	443	49721	104.21.64.101	192.168.2.5
Mar 25, 2025 21:01:49.309187889 CET	49721	443	192.168.2.5	104.21.64.101
Mar 25, 2025 21:01:49.311006069 CET	49721	443	192.168.2.5	104.21.64.101
Mar 25, 2025 21:01:49.311131954 CET	49721	443	192.168.2.5	104.21.64.101
Mar 25, 2025 21:01:49.311156988 CET	443	49721	104.21.64.101	192.168.2.5
Mar 25, 2025 21:01:50.553378105 CET	443	49721	104.21.64.101	192.168.2.5
Mar 25, 2025 21:01:50.553484917 CET	443	49721	104.21.64.101	192.168.2.5
Mar 25, 2025 21:01:50.553556919 CET	49721	443	192.168.2.5	104.21.64.101
Mar 25, 2025 21:01:50.721992016 CET	49721	443	192.168.2.5	104.21.64.101
Mar 25, 2025 21:01:50.722012043 CET	443	49721	104.21.64.101	192.168.2.5

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2025 21:01:48.920177937 CET	58989	53	192.168.2.5	1.1.1.1
Mar 25, 2025 21:01:49.028214931 CET	53	58989	1.1.1.1	192.168.2.5

Timestamp	Bytes transferred	Direction	Data
2025-03-25 20:01:49 UTC	196	OUT	POST /diagnostics.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvancedInstaller Host: shaundoose.com Content-Length: 53 Cache-Control: no-cache
2025-03-25 20:01:49 UTC	53	OUT	Data Raw: 44 61 74 65 3d 32 35 25 32 46 30 33 25 32 46 32 30 32 35 26 44 69 73 6b 50 72 6f 6d 70 74 3d 25 35 42 31 25 35 44 26 56 65 72 73 69 6f 6e 4e 54 3d 31 30 30 30 Data Ascii: Date=25%2F03%2F2025&DiskPrompt=%5B1%5D&VersionNT=1000
2025-03-25 20:01:50 UTC	845	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 20:01:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: no-store cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bPaEVFNOQSXoRafSpHq2TIJy4i2m%2F3ozpLl%2FHBbEcioaW5fuKtreo%2BxHfxBROv7dKQyeTXJ9zLl3fyPpEWLg1i7c6MRm%2FTEiR4Yov%2FzHmSw5eHiSkkQ1qi9kiEriT4vmdg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9261009c09c2c674-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=100598&min_rtt=99906&rtt_var=21793&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2832&recv_bytes=909&delivery_rate=37287&cwnd=238&unsent_bytes=0&cid=ab5a8d8c329be8c5&ts=1307&x=0"
2025-03-25 20:01:50 UTC	6	IN	Data Raw: 31 0d 0a 30 0d 0a Data Ascii: 10
2025-03-25 20:01:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	3
Start time:	16:01:42
Start date:	25/03/2025
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\build.msi"
Imagebase:	0x7ff79ef00000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	16:01:43
Start date:	25/03/2025
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff79ef00000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	16:01:47
Start date:	25/03/2025
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 6E1DB9555CE64326EDD6942FBB93A68E
Imagebase:	0xf10000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	16:02:00
Start date:	25/03/2025
Path:	C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\launcher.exe"
Imagebase:	0x7ff735da0000
File size:	16'065'496 bytes
MD5 hash:	C02DC2CA96FE9841963883C0FE177399
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	false

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report build.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\605255.rbs

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\diagnostics[1].htm

C:\Users\user\AppData\Roaming\Microsoft\Installer\{3A2F5F1E-36B0-4920-A5FF-BCB162944D96}\icon_23.exe

C:\Users\user\AppData\Roaming\Microsoft\Installer\{3A2F5F1E-36B0-4920-A5FF-BCB162944D96}\rufus4.6p.exe

C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\7z.dll

C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\7z.exe

C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\LICENSE.electron.txt

C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\Same.lnk

C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\Same.lnk~RF608569.TMP (copy)

C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\SumatraPDF-settings.txt

C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\TPClntdeu.dll

C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\TPClntjpn.dll

C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\TPClntloc.dll

C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\adjperm.dll

C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\basichttp.dll

C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\chrome_100_percent.pak

C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\chrome_200_percent.pak

C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\d3dcompiler_47.dll

C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\ffmpeg.dll

C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\gmodule-2.0.dll

C:\Users\user\AppData\Roaming\TasovCoop\Klio Verfair Tools\gthread-2.0.dll

Windows Analysis Report
build.msi

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre