Create Interactive Tour

Windows Analysis Report
POSM 360 Viewer.msi

Overview

General Information

Sample Name:	POSM 360 Viewer.msi
Analysis ID:	892882
MD5:	bb734a0d251787699d889bee4e136d26
SHA1:	1f1466df483ffc1e46b5deee8e58bfb6fc315816
SHA256:	d97ab4e3c67bbad44a550fb37ab706c5d477f3e022549eb5e5935fe5f528f320
Infos:

Detection

Score:	13
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Creates an undocumented autostart registry key

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Drops PE files

Tries to load missing DLLs

Deletes files inside the Windows folder

Drops PE files to the windows directory (C:\Windows)

Creates files inside the system directory

PE file contains sections with non-standard names

Binary contains a suspicious time stamp

Stores files to the Windows start menu directory

PE file contains more sections than normal

Checks for available system drives (often done to infect USB drives)

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Creates a process in suspended mode (likely to inject code)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Process Tree

System is w10x64

msiexec.exe (PID: 7344 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\POSM 360 Viewer.msi" MD5: 4767B71A318E201188A0D0A420C8B608)

msiexec.exe (PID: 7400 cmdline: C:\Windows\system32\msiexec.exe /V MD5: 4767B71A318E201188A0D0A420C8B608)

msiexec.exe (PID: 7452 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 9BFA3EB4694D64196BEA6967F2BB6AD4 C MD5: 12C17B5A5C2A7B97342C362CA467E9A2)

msiexec.exe (PID: 7788 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 6DAB697481ADD8AE203CC84DD5A77455 MD5: 12C17B5A5C2A7B97342C362CA467E9A2)

DatasteadRTSPFilterInstaller.exe (PID: 7964 cmdline: "C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe" /Install /WITHOUT_YOUTUBE /SILENT MD5: 32A0D280465C2B9DCE851470BD97EA99)

DatasteadRTSPFilterInstaller.tmp (PID: 7188 cmdline: "C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp" /SL5="$40134,56785293,776704,C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe" /Install /WITHOUT_YOUTUBE /SILENT MD5: 361525C36CB6083C4CF8BA92D936C1FF)

regsvr32.exe (PID: 4744 cmdline: C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\DatasteadRtspSource_x86.ax MD5: 426E7499F6A7346F0410DEAD0805586B)

regsvr32.exe (PID: 1556 cmdline: C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\DatasteadRtspSource_x64.ax MD5: D78B75FC68247E8A63ACBA846182740E)

cleanup

Joe Sandbox Signatures

• Compliance
• Spreading
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Boot Survival
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\unins000.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-FQRJM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-RRIFO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-GEA0G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-87I3C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-96UU0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-KTT0G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-0NGV4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-5KGJJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-QP226.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-J21KD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-QRGTP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-DFSJT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-VDR6P.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\licenses	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\licenses\is-D8GQA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\licenses\is-T3K67.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\licenses\is-7A1L2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\licenses\is-4VRVG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-A1QKT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\unins000.msg	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Datastead_RTSP_RTMP_HTTP_ONVIF_DSSource_is1

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp

File opened: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\msvcr100.dll

Jump to behavior

Source:	Binary string: F:\gs2\VS\out\binaries\x86ret\bin\i386\DPCA.pdb source: POSM 360 Viewer.msi
Source:	Binary string: F:\gs2\VS\out\binaries\x86ret\bin\i386\DPCA.pdb= source: POSM 360 Viewer.msi
Source:	Binary string: msvcr100.amd64.pdb source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://WWW-Authenticate:Proxy-Authenticate:Content-Encoding:gzip1.2.11Content-Length:socket
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://dashif.org/guidelines/last-segment-number
Source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://dashif.org/guidelines/trickmode
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: is-QP226.tmp.9.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://relaxng.org/ns/structure/1.0
Source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://relaxng.org/ns/structure/1.0Memory
Source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://standards.iso.org/ittf/PubliclyAvailableStandards/MPEG-DASH_schema_files/DASH-MPD.xsd
Source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.588825145.0000000000DF6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.datastead.com
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547416623.0000000002480000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.556437242.0000000003520000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.datastead.com0http://www.datastead.com0http://www.datastead.com
Source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.588825145.0000000000DF6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.datastead.com9j
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.590816147.0000000002226000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.datastead.comAh
Source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd
Source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd-//OASIS//DTD
Source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/)
Source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-QP226.tmp.9.dr	String found in binary or memory: http://www.openssl.org/V
Source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005628000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005AED000.00000004.00001000.00020000.00000000.sdmp, is-QP226.tmp.9.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005628000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005AED000.00000004.00001000.00020000.00000000.sdmp, is-QP226.tmp.9.dr	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND
Source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.smpte-ra.org/schemas/2067-3/2013#standard-markers
Source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.smpte-ra.org/schemas/2067-3/2013#standard-markersMainImageSequenceStereoscopic
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000000.546911060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, DatasteadRTSPFilterInstaller.exe.1.dr	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: is-5KGJJ.tmp.9.dr	String found in binary or memory: https://streams.videolan.org/upload/
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002480000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.exe, 00000007.00000003.550135513.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000000.553463436.0000000000401000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002480000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.exe, 00000007.00000003.550135513.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000000.553463436.0000000000401000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.remobjects.com/ps

Source: POSM 360 Viewer.msi

Binary or memory string: OriginalFilenameDPCA.DLLT vs POSM 360 Viewer.msi

Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll			Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIA511.tmp

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\4a9449.msi

Jump to behavior

Source: is-QRGTP.tmp.9.dr	Static PE information: Number of sections : 17 > 10
Source: is-0NGV4.tmp.9.dr	Static PE information: Number of sections : 12 > 10
Source: is-VDR6P.tmp.9.dr	Static PE information: Number of sections : 12 > 10
Source: is-EPSK4.tmp.9.dr	Static PE information: Number of sections : 11 > 10
Source: is-KS0G6.tmp.9.dr	Static PE information: Number of sections : 12 > 10
Source: is-RI9NK.tmp.9.dr	Static PE information: Number of sections : 11 > 10
Source: is-KTT0G.tmp.9.dr	Static PE information: Number of sections : 12 > 10
Source: is-96UU0.tmp.9.dr	Static PE information: Number of sections : 12 > 10
Source: is-5KGJJ.tmp.9.dr	Static PE information: Number of sections : 12 > 10
Source: is-4T1V4.tmp.9.dr	Static PE information: Number of sections : 11 > 10
Source: is-PGLRQ.tmp.9.dr	Static PE information: Number of sections : 11 > 10
Source: is-LSKA9.tmp.9.dr	Static PE information: Number of sections : 18 > 10
Source: is-8VN99.tmp.9.dr	Static PE information: Number of sections : 11 > 10
Source: is-QP226.tmp.9.dr	Static PE information: Number of sections : 17 > 10
Source: is-2T0G8.tmp.9.dr	Static PE information: Number of sections : 18 > 10
Source: is-0ULI5.tmp.9.dr	Static PE information: Number of sections : 11 > 10
Source: is-DFSJT.tmp.9.dr	Static PE information: Number of sections : 12 > 10

Source: DatasteadRTSPFilterInstaller.tmp.7.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-FQRJM.tmp.9.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\POSM 360 Viewer.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9BFA3EB4694D64196BEA6967F2BB6AD4 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6DAB697481ADD8AE203CC84DD5A77455
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe "C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe" /Install /WITHOUT_YOUTUBE /SILENT
Source: C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe	Process created: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp "C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp" /SL5="$40134,56785293,776704,C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe" /Install /WITHOUT_YOUTUBE /SILENT
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\DatasteadRtspSource_x86.ax
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\DatasteadRtspSource_x64.ax
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9BFA3EB4694D64196BEA6967F2BB6AD4 C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6DAB697481ADD8AE203CC84DD5A77455	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe "C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe" /Install /WITHOUT_YOUTUBE /SILENT	Jump to behavior
Source: C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe	Process created: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp "C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp" /SL5="$40134,56785293,776704,C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe" /Install /WITHOUT_YOUTUBE /SILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\DatasteadRtspSource_x86.ax	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\DatasteadRtspSource_x64.ax	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: POSM 360 Viewer.lnk.1.dr	LNK file: ..\..\..\..\..\Windows\Installer\{4C4ADD3B-44AE-49DE-9498-E5983A738CCA}\_AA507B2E32652D84AC1592.exe
Source: POSM 360 Viewer.lnk0.1.dr	LNK file: ..\..\..\Windows\Installer\{4C4ADD3B-44AE-49DE-9498-E5983A738CCA}\_5A0AEBA4D933481755910C.exe

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\POSM Software LLC

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\Public\Desktop\POSM 360 Viewer.lnk

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSI8663.tmp

Jump to behavior

Source: classification engine

Classification label: clean13.winMSI@14/106@0/0

Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Automated click: Next >
Source: C:\Windows\System32\msiexec.exe	Automated click: Next >
Source: C:\Windows\System32\msiexec.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Automated click: Next

Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: POSM 360 Viewer.msi

Static file information: File size 70180864 > 1048576

Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\unins000.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-FQRJM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-RRIFO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-GEA0G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-87I3C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-96UU0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-KTT0G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-0NGV4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-5KGJJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-QP226.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-J21KD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-QRGTP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-DFSJT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-VDR6P.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\licenses	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\licenses\is-D8GQA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\licenses\is-T3K67.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\licenses\is-7A1L2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\licenses\is-4VRVG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-A1QKT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Directory created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\unins000.msg	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Datastead_RTSP_RTMP_HTTP_ONVIF_DSSource_is1

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp

File opened: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\msvcr100.dll

Jump to behavior

Source:	Binary string: F:\gs2\VS\out\binaries\x86ret\bin\i386\DPCA.pdb source: POSM 360 Viewer.msi
Source:	Binary string: F:\gs2\VS\out\binaries\x86ret\bin\i386\DPCA.pdb= source: POSM 360 Viewer.msi
Source:	Binary string: msvcr100.amd64.pdb source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp

Source: DatasteadRTSPFilterInstaller.exe.1.dr	Static PE information: section name: .didata
Source: DatasteadRTSPFilterInstaller.tmp.7.dr	Static PE information: section name: .didata
Source: is-96UU0.tmp.9.dr	Static PE information: section name: .xdata
Source: is-KTT0G.tmp.9.dr	Static PE information: section name: .xdata
Source: is-0NGV4.tmp.9.dr	Static PE information: section name: .xdata
Source: is-5KGJJ.tmp.9.dr	Static PE information: section name: .xdata
Source: is-QP226.tmp.9.dr	Static PE information: section name: .xdata
Source: is-QP226.tmp.9.dr	Static PE information: section name: /4
Source: is-QP226.tmp.9.dr	Static PE information: section name: /19
Source: is-QP226.tmp.9.dr	Static PE information: section name: /31
Source: is-QP226.tmp.9.dr	Static PE information: section name: /45
Source: is-QP226.tmp.9.dr	Static PE information: section name: /57
Source: is-J21KD.tmp.9.dr	Static PE information: section name: _CONST
Source: is-J21KD.tmp.9.dr	Static PE information: section name: text
Source: is-QRGTP.tmp.9.dr	Static PE information: section name: .xdata
Source: is-QRGTP.tmp.9.dr	Static PE information: section name: /4
Source: is-QRGTP.tmp.9.dr	Static PE information: section name: /19
Source: is-QRGTP.tmp.9.dr	Static PE information: section name: /31
Source: is-QRGTP.tmp.9.dr	Static PE information: section name: /45
Source: is-QRGTP.tmp.9.dr	Static PE information: section name: /57
Source: is-DFSJT.tmp.9.dr	Static PE information: section name: .xdata
Source: is-VDR6P.tmp.9.dr	Static PE information: section name: .xdata
Source: is-FQRJM.tmp.9.dr	Static PE information: section name: .didata
Source: is-KS0G6.tmp.9.dr	Static PE information: section name: .rodata
Source: is-KS0G6.tmp.9.dr	Static PE information: section name: .eh_fram
Source: is-0ULI5.tmp.9.dr	Static PE information: section name: .eh_fram
Source: is-8VN99.tmp.9.dr	Static PE information: section name: .eh_fram
Source: is-4T1V4.tmp.9.dr	Static PE information: section name: .eh_fram
Source: is-RI9NK.tmp.9.dr	Static PE information: section name: .eh_fram
Source: is-LSKA9.tmp.9.dr	Static PE information: section name: /4
Source: is-LSKA9.tmp.9.dr	Static PE information: section name: /14
Source: is-LSKA9.tmp.9.dr	Static PE information: section name: /29
Source: is-LSKA9.tmp.9.dr	Static PE information: section name: /41
Source: is-LSKA9.tmp.9.dr	Static PE information: section name: /55
Source: is-LSKA9.tmp.9.dr	Static PE information: section name: /67
Source: is-LSKA9.tmp.9.dr	Static PE information: section name: /80
Source: is-LSKA9.tmp.9.dr	Static PE information: section name: /91
Source: is-2T0G8.tmp.9.dr	Static PE information: section name: /4
Source: is-2T0G8.tmp.9.dr	Static PE information: section name: /14
Source: is-2T0G8.tmp.9.dr	Static PE information: section name: /29
Source: is-2T0G8.tmp.9.dr	Static PE information: section name: /41
Source: is-2T0G8.tmp.9.dr	Static PE information: section name: /55
Source: is-2T0G8.tmp.9.dr	Static PE information: section name: /67
Source: is-2T0G8.tmp.9.dr	Static PE information: section name: /80
Source: is-2T0G8.tmp.9.dr	Static PE information: section name: /91
Source: is-EPSK4.tmp.9.dr	Static PE information: section name: .eh_fram
Source: is-PGLRQ.tmp.9.dr	Static PE information: section name: .eh_fram
Source: is-RRIFO.tmp.9.dr	Static PE information: section name: _CONST
Source: is-RRIFO.tmp.9.dr	Static PE information: section name: text

Source: POSM360Viewer.exe.1.dr

Static PE information: 0xCCE322FF [Mon Dec 5 03:48:15 2078 UTC]

Source: initial sample	Static PE information: section name: .text entropy: 6.909044922675825
Source: initial sample	Static PE information: section name: .text entropy: 6.909044922675825

Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-FQRJM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\avfilter_dtstd_c3_x86-9.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\avfilter_dtstd_c3_x64-9.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\swresample_dtstd_c3_x64-4.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\POSM360Viewer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\avcodec_dtstd_c3_x86-60.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-LSKA9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-VDR6P.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA511.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-8VN99.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\avutil_dtstd_c3_x64-58.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\msvcr100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-2T0G8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\swresample_dtstd_c3_x86-4.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\sdts_x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\DatasteadRtspSource_x86.ax (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-KTT0G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-0NGV4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-J21KD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\DatasteadRtspSource_x64.ax (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA64B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\avdevice_dtstd_c3_x86-60.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\avformat_dtstd_c3_x86-60.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\ldts_x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\avutil_dtstd_c3_x86-58.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-EPSK4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-QP226.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\avformat_dtstd_c3_x64-60.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\avdevice_dtstd_c3_x64-60.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI8663.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-N771S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\swscale_dtstd_c3_x86-7.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-96UU0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-87I3C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-QRGTP.tmp	Jump to dropped file
Source: C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\swscale_dtstd_c3_x64-7.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\ldts_x86.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-HO8F2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\sdts_x86.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-5KGJJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-RI9NK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-PGLRQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-0ULI5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-RRIFO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Users\user\AppData\Local\Temp\is-1ICH3.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-4T1V4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\VideoGrabberNET.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-DFSJT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-GEA0G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-6H40T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-KS0G6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI87EA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\msvcr100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	File created: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\avcodec_dtstd_c3_x64-60.dll (copy)	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA64B.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA511.tmp			Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Windows\System32\regsvr32.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{55D1139D-5E0D-4123-9AED-575D7B039569} FriendlyName

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\POSM 360 Viewer.lnk

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\avdevice_dtstd_c3_x64-60.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-N771S.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\POSM360Viewer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-96UU0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-87I3C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-QRGTP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-LSKA9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-VDR6P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-HO8F2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-8VN99.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-5KGJJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-PGLRQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-RI9NK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-0ULI5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-RRIFO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\msvcr100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-1ICH3.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-4T1V4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-2T0G8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-DFSJT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-GEA0G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-6H40T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-0NGV4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-KTT0G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-KS0G6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-J21KD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA64B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\avdevice_dtstd_c3_x86-60.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI87EA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-EPSK4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\msvcr100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	Dropped PE file which has not been started: C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-QP226.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: VMware Screen Codec / VMware Video

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe "C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe" /Install /WITHOUT_YOUTUBE /SILENT

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	Windows Management Instrumentation	1 Windows Service	1 Windows Service	23 Masquerading	OS Credential Dumping	1 Security Software Discovery	1 Replication Through Removable Media	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	11 Process Injection	11 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	1 Obfuscated Files or Information	Security Account Manager	11 Peripheral Device Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	1 DLL Side-Loading	1 Software Packing	NTDS	2 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 DLL Side-Loading	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 File Deletion	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
POSM 360 Viewer.msi	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-2T0G8.tmp	0%	ReversingLabs
C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-6H40T.tmp	0%	ReversingLabs
C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-LSKA9.tmp	2%	ReversingLabs
C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-N771S.tmp	0%	ReversingLabs
C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\ldts_x86.dll (copy)	2%	ReversingLabs
C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\msvcr100.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\sdts_x86.dll (copy)	0%	ReversingLabs
C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-FQRJM.tmp	0%	ReversingLabs
C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-J21KD.tmp	0%	ReversingLabs
C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-QP226.tmp	0%	ReversingLabs
C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-QRGTP.tmp	0%	ReversingLabs
C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\is-RRIFO.tmp	0%	ReversingLabs
C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\ldts_x64.dll (copy)	0%	ReversingLabs
C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\msvcr100.dll (copy)	0%	ReversingLabs
C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\sdts_x64.dll (copy)	0%	ReversingLabs
C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\unins000.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI8663.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI87EA.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-1ICH3.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIA511.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIA64B.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://dashif.org/guidelines/last-segment-number	0%	URL Reputation	safe
http://dashif.org/guidelines/last-segment-number	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
https://www.remobjects.com/ps	0%	URL Reputation	safe
https://www.innosetup.com/	0%	URL Reputation	safe
http://WWW-Authenticate:Proxy-Authenticate:Content-Encoding:gzip1.2.11Content-Length:socket	0%	Avira URL Cloud	safe
http://dashif.org/guidelines/trickmode	0%	URL Reputation	safe
http://www.datastead.com	0%	Avira URL Cloud	safe
http://relaxng.org/ns/structure/1.0	0%	URL Reputation	safe
http://www.datastead.com9j	0%	Avira URL Cloud	safe
http://www.datastead.com0http://www.datastead.com0http://www.datastead.com	0%	Avira URL Cloud	safe
http://www.smpte-ra.org/schemas/2067-3/2013#standard-markers	0%	Virustotal		Browse
http://www.smpte-ra.org/schemas/2067-3/2013#standard-markersMainImageSequenceStereoscopic	0%	Avira URL Cloud	safe
http://relaxng.org/ns/structure/1.0Memory	0%	Avira URL Cloud	safe
http://www.smpte-ra.org/schemas/2067-3/2013#standard-markers	0%	Avira URL Cloud	safe
http://www.datastead.com	0%	Virustotal		Browse
http://www.smpte-ra.org/schemas/2067-3/2013#standard-markersMainImageSequenceStereoscopic	0%	Virustotal		Browse
http://www.datastead.comAh	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	DatasteadRTSPFilterInstaller.exe, 00000007.00000000.546911060.0000000000401000.00000020.00000001.01000000.00000003.sdmp, DatasteadRTSPFilterInstaller.exe.1.dr	false		high
http://WWW-Authenticate:Proxy-Authenticate:Content-Encoding:gzip1.2.11Content-Length:socket	DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://sectigo.com/CPS0	DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	is-QP226.tmp.9.dr	false	URL Reputation: safe	unknown
http://www.openssl.org/V	DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-QP226.tmp.9.dr	false		high
http://www.smpte-ra.org/schemas/2067-3/2013#standard-markersMainImageSequenceStereoscopic	DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	false	URL Reputation: safe	unknown
http://standards.iso.org/ittf/PubliclyAvailableStandards/MPEG-DASH_schema_files/DASH-MPD.xsd	DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	false	URL Reputation: safe	unknown
http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd	DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd-//OASIS//DTD	DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	false		high
http://dashif.org/guidelines/last-segment-number	DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.smpte-ra.org/schemas/2067-3/2013#standard-markers	DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005628000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005AED000.00000004.00001000.00020000.00000000.sdmp, is-QP226.tmp.9.dr	false		high
http://www.datastead.com	DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.588825145.0000000000DF6000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.htmlRAND	DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005628000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005AED000.00000004.00001000.00020000.00000000.sdmp, is-QP226.tmp.9.dr	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002569000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005B20000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000002.590009897.000000000018D000.00000004.00000010.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp, is-2T0G8.tmp.9.dr, is-5KGJJ.tmp.9.dr, is-QP226.tmp.9.dr	false	URL Reputation: safe	unknown
https://streams.videolan.org/upload/	is-5KGJJ.tmp.9.dr	false		high
https://www.remobjects.com/ps	DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002480000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.exe, 00000007.00000003.550135513.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000000.553463436.0000000000401000.00000020.00000001.01000000.00000006.sdmp	false	URL Reputation: safe	unknown
http://www.datastead.com9j	DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.588825145.0000000000DF6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.innosetup.com/	DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547842602.0000000002480000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.exe, 00000007.00000003.550135513.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000000.553463436.0000000000401000.00000020.00000001.01000000.00000006.sdmp	false	URL Reputation: safe	unknown
http://dashif.org/guidelines/trickmode	DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.datastead.com0http://www.datastead.com0http://www.datastead.com	DatasteadRTSPFilterInstaller.exe, 00000007.00000003.547416623.0000000002480000.00000004.00001000.00020000.00000000.sdmp, DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.556437242.0000000003520000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://relaxng.org/ns/structure/1.0Memory	DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://relaxng.org/ns/structure/1.0	DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005652000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.openssl.org/)	DatasteadRTSPFilterInstaller.tmp, 00000009.00000003.586137176.0000000005460000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.datastead.comAh	DatasteadRTSPFilterInstaller.exe, 00000007.00000003.590816147.0000000002226000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	892882
Start date and time:	2023-06-22 18:06:31 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	POSM 360 Viewer.msi
Detection:	CLEAN
Classification:	clean13.winMSI@14/106@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msi Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 13 icons, 32x32, 16 colors, 4 bits/pixel, 16x16, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	60884
Entropy (8bit):	5.4983565388426126
Encrypted:	false
SSDEEP:	1536:RvPTHpvRYtBersMxdddddddddddd9cBdAyK/dddddddddddd:FTHBStBexX
MD5:	F981BDB295EBE11A5F01AEEC4FE439CD
SHA1:	898B871F1019644111B14702CBC22B156299DE58
SHA-256:	17C34D868D7AE04466153A05E1EBC67C98A7DF4577C2C8BB83016E2EC650C946
SHA-512:	3151A17BA5CB9EE27B60899421D7B6DD510ADCF59A204FAC43A6A8F0CE09DD9906280F3AF91C97D9828C1129A41B3E6FC5A1125A0723D271305530A063306211
Malicious:	false
Reputation:	low
Preview:	...... ......................(.......00.............. ......................h...6......... ..$...!..@@.... .(B..LF..00.... ..%..t...((.... .h....... .... ............... .....,......... ............... .h...l...(... ...@...............................................................................................ttEDTDTEDDTEDTDWFffffffffffffffdV.....n..nnn..ndF......n..n.nnndF.....n..ffnn.ndF......ngx.vnnndV.....nf....nnndF......x....v..dF.....g......nndF............nndV....g.......nndF....x.......f.dF...f........vndF...g........v.dV...h........vndF..............dF..f.......p..ndF.fg..........ndFfwG...........dG4.(.........v.d.............v.d........w....wfdduuw....w.....wdFfffx...w...p..DFnnng...x...v..pF.nnfX.....fdu.pVn...fw..wfn.dwdF.nnnnffff.nnnfeFnnnnnnnnnnnnnndF..............dvffffffffffffffdtFDFDFDFDFDFDFDw................................................................................................................................(....... .................................

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.038757123363281
Encrypted:	false
SSDEEP:	3:vFWWMNHUz/cIMOoT02V7VKXRAmIRMNHjFHr0lUfEyhTRG4+RAW4QIMOov:TMV0kI002V7VQ7VJdfEyFRFuAW4QIm
MD5:	68675E0D405C8C76102802FA624EB895
SHA1:	F8CF5E4A678B4574365057FF91019ADEB2F9D4A0
SHA-256:	B839CDD1C3F55651CD4D0E54A679BCE5AC60ED7618A7B74BFC8EF8CA311E53ED
SHA-512:	C712C1BC97C9B7282262622367F399C18DD73156ACD09C80D151A92C78D4119AF9101BF902678B3FE767E9CC9FFF95B6AAFB858D179C7FF7D2721D1E9171CC3D
Malicious:	false
Preview:	<?xml version="1.0"?>..<configuration>...<startup><supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.7.2"/>...</startup>..</configuration>..

Process:	C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3119560
Entropy (8bit):	6.382132312942039
Encrypted:	false
SSDEEP:	49152:TEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVs3338N:n92bz2Eb6pd7B6bAGx76333+
MD5:	361525C36CB6083C4CF8BA92D936C1FF
SHA1:	02A983A8ABC2B21DA06548D368649B7F5EE0CA69
SHA-256:	90F3913F0F68CD563AF66282376F87BC2622F7C01A77ACA8DF2C037D1DD397EB
SHA-512:	057C0DE20E803A278A0BD18681BF5C80B730021C9863FBAC5A2D13B7A9C8BB1129DC6BCD6CABC72885192F18118B935D2522F36FC7CB3251EFB0C20DD47B1BB1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...(..`.................:,..0......`F,......P,...@..........................P0......./...@......@....................-......p-.29....-.@R...........n/..+....................................-......................y-.......-......................text.....,.......,................. ..`.itext...(... ,..*....,............. ..`.data........P,......>,.............@....bss.....y....,..........................idata..29...p-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-.......-.............@..@.rsrc...@R....-..T....-.............@..@..............1.......0.............@..@........................................................

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {51AC6EF0-C2BF-4AA9-884C-39ECA2A963A2}, Title: POSM 360 Viewer, Author: POSM Software LLC, Comments: POSM 360 Viewer, Number of Words: 2, Last Saved Time/Date: Mon Jun 12 17:30:05 2023, Last Printed: Mon Jun 12 17:30:05 2023
Entropy (8bit):	7.996178759864568
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	POSM 360 Viewer.msi
File size:	70180864
MD5:	bb734a0d251787699d889bee4e136d26
SHA1:	1f1466df483ffc1e46b5deee8e58bfb6fc315816
SHA256:	d97ab4e3c67bbad44a550fb37ab706c5d477f3e022549eb5e5935fe5f528f320
SHA512:	9467f71e40a3f2bf0eb007fab95562c3971e8bb5b7a7bc0177a4da3bed85d68dd848779b007a452a1ab2ed97b8e841fc53563de3c79417a5d4d62a52890e8a2a
SSDEEP:	1572864:Z6HcTZZkepepOH6qiP7Tvj0DkJOta+mKqEF7I30QYnxpZcuWdyH0:MHqXebq0njQNqkm0nnxXcHW
TLSH:	2DF733B338889F34DAD36134D3366B3C486A2F505F675145E2DAFE732631EB045B9A82
File Content Preview:	........................>.................../...............8...................f...g...h...i...j.......:.......^..._...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S..

Target ID:	0
Start time:	18:07:28
Start date:	22/06/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\POSM 360 Viewer.msi"
Imagebase:	0x7ff626710000
File size:	66048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	1
Start time:	18:07:30
Start date:	22/06/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff626710000
File size:	66048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	2
Start time:	18:07:31
Start date:	22/06/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 9BFA3EB4694D64196BEA6967F2BB6AD4 C
Imagebase:	0xc10000
File size:	59904 bytes
MD5 hash:	12C17B5A5C2A7B97342C362CA467E9A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	5
Start time:	18:08:44
Start date:	22/06/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 6DAB697481ADD8AE203CC84DD5A77455
Imagebase:	0xc10000
File size:	59904 bytes
MD5 hash:	12C17B5A5C2A7B97342C362CA467E9A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	7
Start time:	18:08:53
Start date:	22/06/2023
Path:	C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe" /Install /WITHOUT_YOUTUBE /SILENT
Imagebase:	0x400000
File size:	57637160 bytes
MD5 hash:	32A0D280465C2B9DCE851470BD97EA99
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low

Target ID:	9
Start time:	18:08:56
Start date:	22/06/2023
Path:	C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-MIUMI.tmp\DatasteadRTSPFilterInstaller.tmp" /SL5="$40134,56785293,776704,C:\Program Files (x86)\POSM Software LLC\POSM 360 Viewer\DatasteadRTSPFilterInstaller.exe" /Install /WITHOUT_YOUTUBE /SILENT
Imagebase:	0x400000
File size:	3119560 bytes
MD5 hash:	361525C36CB6083C4CF8BA92D936C1FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low

Target ID:	10
Start time:	18:09:10
Start date:	22/06/2023
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\DatasteadRtspSource_x86.ax
Imagebase:	0xf70000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	11
Start time:	18:09:11
Start date:	22/06/2023
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Datastead\RTSP_RTMP_HTTP_ONVIF\DatasteadRtspSource_x64.ax
Imagebase:	0x7ff75a870000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report POSM 360 Viewer.msi

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

4a944b.rbf (copy)

C:\Config.Msi\4a944a.rbs

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\DatasteadRtspSource_x86.ax (copy)

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\avcodec_dtstd_c3_x86-60.dll (copy)

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\avdevice_dtstd_c3_x86-60.dll (copy)

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\avfilter_dtstd_c3_x86-9.dll (copy)

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\avformat_dtstd_c3_x86-60.dll (copy)

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\avutil_dtstd_c3_x86-58.dll (copy)

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-0ULI5.tmp

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-2T0G8.tmp

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-4T1V4.tmp

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-6H40T.tmp

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-8VN99.tmp

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-EPSK4.tmp

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-HO8F2.tmp

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-KS0G6.tmp

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-LSKA9.tmp

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-N771S.tmp

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-PGLRQ.tmp

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\is-RI9NK.tmp

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\ldts_x86.dll (copy)

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\licenses\FFmpeg_LGPL_License.htm (copy)

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\licenses\Live555_LGPL_License.htm (copy)

C:\Program Files (x86)\Datastead\RTSP_RTMP_HTTP_ONVIF\licenses\OpenH264_License.txt (copy)

Windows Analysis Report
POSM 360 Viewer.msi

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre