Edit tour

Windows Analysis Report
Fatrr_wakMkxp.msi

Overview

General Information

Sample Name:	Fatrr_wakMkxp.msi
Analysis ID:	896111
MD5:	27d8c23579018eff34ce61459e18f7f1
SHA1:	ad64565c41d3a3581621238ac4c65411e7cc30bc
SHA256:	5995f2e1327a4a820695aa97f9e18926ecc900f1a036d8b11573c572d0fd47fd
Tags:	msi
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Drops PE files

Tries to load missing DLLs

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Drops PE files to the windows directory (C:\Windows)

Creates files inside the system directory

PE file contains sections with non-standard names

Binary contains a suspicious time stamp

Creates a start menu entry (Start Menu\Programs\Startup)

Stores files to the Windows start menu directory

Checks for available system drives (often done to infect USB drives)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 5740 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Fatrr_wakMkxp.msi" MD5: 4767B71A318E201188A0D0A420C8B608)

msiexec.exe (PID: 6940 cmdline: C:\Windows\system32\msiexec.exe /V MD5: 4767B71A318E201188A0D0A420C8B608)

msiexec.exe (PID: 3872 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 366E9C1149556BC0F11E4B9E382385C6 MD5: 12C17B5A5C2A7B97342C362CA467E9A2)

cleanup

Snort Signatures

ETPRO MALWARE TakeMyFile User-Agent - Source IP: 192.168.2.6 - Destination IP: 54.198.235.9

Timestamp:	192.168.2.654.198.235.949711802849814 06/29/23-09:12:32.141900
SID:	2849814
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE TakeMyFile Installer Checkin - Source IP: 192.168.2.6 - Destination IP: 54.198.235.9

Timestamp:	192.168.2.654.198.235.949711802849813 06/29/23-09:12:32.141900
SID:	2849813
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST / HTTP/1.1Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64)Host: collect.installeranalytics.comContent-Length: 167Cache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: collect.installeranalytics.com

Source: Fatrr_wakMkxp.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs Fatrr_wakMkxp.msi
Source: Fatrr_wakMkxp.msi	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs Fatrr_wakMkxp.msi
Source: Fatrr_wakMkxp.msi	Binary or memory string: OriginalFilenameInstallerAnalytics.dllF vs Fatrr_wakMkxp.msi
Source: Fatrr_wakMkxp.msi	Binary or memory string: OriginalFilenameembeddeduiproxy.dllF vs Fatrr_wakMkxp.msi

Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIE100.tmp

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\3ddde4.msi

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Fatrr_wakMkxp.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 366E9C1149556BC0F11E4B9E382385C6
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 366E9C1149556BC0F11E4B9E382385C6	Jump to behavior

Source: identity_helper.lnk.2.dr

LNK file: ..\..\..\..\..\..\..\..\Public\Documents\identity_helper.exe

Source: C:\Windows\SysWOW64\msiexec.exe

File created: C:\Users\user\AppData\Local\AdvinstAnalytics

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF5991F4C5103D2B15.TMP

Jump to behavior

Source: shiE3EE.tmp.2.dr

Binary string: o\Device\NameResTrk\RecordNrtCloneOpenPacketW

Source: C:\Windows\SysWOW64\msiexec.exe

File written: C:\Users\user\AppData\Local\AdvinstAnalytics\649bc0e995075a1a74755442\7.7.6.4\tracking.ini

Jump to behavior

Source: classification engine

Classification label: mal48.winMSI@4/27@1/1

Source: C:\Windows\SysWOW64\msiexec.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Fatrr_wakMkxp.msi

Static file information: File size 2252288 > 1048576

Source:	Binary string: wininet.pdb source: shiE3EE.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\bin\x86\embeddeduiproxy.pdb source: Fatrr_wakMkxp.msi, 3ddde4.msi.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: Fatrr_wakMkxp.msi, 3ddde4.msi.1.dr, MSIE395.tmp.1.dr
Source:	Binary string: d3d12.pdbUGP source: shiE4AB.tmp.2.dr
Source:	Binary string: d3d12.pdb source: shiE4AB.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb\ source: Fatrr_wakMkxp.msi, 3ddde4.msi.1.dr, MSIE395.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdbu source: Fatrr_wakMkxp.msi, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSI79.tmp.1.dr
Source:	Binary string: wininet.pdbUGP source: shiE3EE.tmp.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdb source: Fatrr_wakMkxp.msi, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSI79.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIEAFA.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbg source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIEAFA.tmp.1.dr

Source: shiE4AB.tmp.2.dr	Static PE information: section name: .text_hf
Source: shiE4AB.tmp.2.dr	Static PE information: section name: .didat
Source: shiE4AB.tmp.2.dr	Static PE information: section name: .DDIData
Source: shiE3EE.tmp.2.dr	Static PE information: section name: .wpp_sf
Source: shiE3EE.tmp.2.dr	Static PE information: section name: .didat

Source: shiE3EE.tmp.2.dr

Static PE information: 0x84CD8294 [Wed Aug 8 17:47:00 2040 UTC]

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE100.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEAFA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE269.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE2F6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI79.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shiE4AB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE80B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE395.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE365.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shiE3EE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE77E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEB69.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE100.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEAFA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE269.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE2F6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI79.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE80B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE395.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE365.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE77E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEB69.tmp	Jump to dropped file

Source: C:\Windows\SysWOW64\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\identity_helper.lnk

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\zino.ps1			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\identity_helper.lnk			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe TID: 5540

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIEAFA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE2F6.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shiE4AB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE80B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE365.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shiE3EE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE77E.tmp	Jump to dropped file

Source: C:\Windows\SysWOW64\msiexec.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\SysWOW64\msiexec.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: MSIE395.tmp.1.dr

Binary or memory string: 01234567890.0.0.0.%dVMware, Inc.VMware Virtual PlatformVMware7,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IROOT\CIMV2SELECT * FROM Win32_ComputerSystemSELECT * FROM Win32_BIOSManufacturerModelVersionGetting system informationManufacturer [Model [BIOS [IsWow64Processkernel32Software\Microsoft\Windows NT\CurrentVersionSYSTEM\CurrentControlSet\Control\ProductOptionsCurrentMajorVersionNumberCurrentMinorVersionNumberCurrentVersionCurrentBuildNumberReleaseIdCSDVersionProductTypeProductSuiteWinNTServerNTSmall BusinessEnterpriseBackOfficeCommunicationServerTerminal ServerSmall Business(Restricted)EmbeddedNTDataCenterPersonalBladeEmbedded(Restricted)Security ApplianceStorage ServerCompute Server Failed to create IWbemLocator object. Error code: \\Could not connect to WMI provider. Error code: Failed to initialize security. Error code: Could not set proxy blanket. Error code: WQLWMI Query failed: []. Error code:

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	3 Windows Management Instrumentation	2 Registry Run Keys / Startup Folder	1 Process Injection	21 Masquerading	OS Credential Dumping	21 Security Software Discovery	1 Replication Through Removable Media	Data from Local System	Exfiltration Over Other Network Medium	2 Non-Application Layer Protocol	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	2 Registry Run Keys / Startup Folder	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	2 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 DLL Side-Loading	1 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Timestomp	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 File Deletion	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	32 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Fatrr_wakMkxp.msi	5%	ReversingLabs
Fatrr_wakMkxp.msi	5%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\shiE3EE.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shiE4AB.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI79.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIE100.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIE269.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIE2F6.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIE365.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIE395.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIE77E.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIE80B.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIEAFA.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIEB69.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://HTTP/1.1	0%	Avira URL Cloud	safe
http://.jpg	0%	Avira URL Cloud	safe
http://.css	0%	Avira URL Cloud	safe
https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
collect.installeranalytics.com	54.198.235.9	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://collect.installeranalytics.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://html4/loose.dtd	shiE3EE.tmp.2.dr	false	Avira URL Cloud: safe	low
https://www.advancedinstaller.com	Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	false		high
https://HTTP/1.1	shiE3EE.tmp.2.dr	false	Avira URL Cloud: safe	low
http://collect.installeranalytics.com	Fatrr_wakMkxp.msi, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSI79.tmp.1.dr	false		high
https://www.thawte.com/cps0/	Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	false		high
http://.css	shiE3EE.tmp.2.dr	false	Avira URL Cloud: safe	low
http://.jpg	shiE3EE.tmp.2.dr	false	Avira URL Cloud: safe	low
https://www.thawte.com/repository0W	Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	false		high
https://collect.installeranalytics.com	Fatrr_wakMkxp.msi, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSI79.tmp.1.dr	false		high
https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic	Fatrr_wakMkxp.msi, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSI79.tmp.1.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
54.198.235.9	collect.installeranalytics.com	United States		14618	AMAZON-AESUS	false

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	896111
Start date and time:	2023-06-29 09:11:12 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Fatrr_wakMkxp.msi
Detection:	MAL
Classification:	mal48.winMSI@4/27@1/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe
Excluded IPs from analysis (whitelisted): 142.251.36.170, 142.251.36.202, 142.251.36.234, 142.251.37.10, 172.217.16.170
Excluded domains from analysis (whitelisted): fiebasestorage.googleapis.com

Simulations

Behavior and APIs

Time	Type	Description
09:12:16	API Interceptor	3x Sleep call for process: msiexec.exe modified
09:12:25	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\identity_helper.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54.198.235.9	Fatrr_UewhcWF.msi	Get hash	malicious	Unknown	Browse	collect.installeranalytics.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
collect.installeranalytics.com	Fatrr_UewhcWF.msi	Get hash	malicious	Unknown	Browse	54.198.235.9
	54zEUp34e1.exe	Get hash	malicious	Unknown	Browse	52.73.64.126
	54zEUp34e1.exe	Get hash	malicious	Unknown	Browse	54.198.235.9
	ECnCJ4QWok.exe	Get hash	malicious	Unknown	Browse	52.73.64.126
	ECnCJ4QWok.exe	Get hash	malicious	Unknown	Browse	52.73.64.126
	IcEL4U66yX.exe	Get hash	malicious	Unknown	Browse	54.198.235.9
	IcEL4U66yX.exe	Get hash	malicious	Unknown	Browse	52.73.64.126
	hWiWP9kOC9.exe	Get hash	malicious	PrivateLoader	Browse	54.198.235.9
	hWiWP9kOC9.exe	Get hash	malicious	Unknown	Browse	54.198.235.9
	S4iK1tSHGc.exe	Get hash	malicious	Unknown	Browse	52.73.64.126
	S4iK1tSHGc.exe	Get hash	malicious	Unknown	Browse	52.73.64.126
	WCYoS776qm.exe	Get hash	malicious	Nymaim	Browse	54.198.235.9
	a1rzxoicOg.exe	Get hash	malicious	Unknown	Browse	52.73.64.126
	a1rzxoicOg.exe	Get hash	malicious	Unknown	Browse	54.198.235.9
	8UvPumbygi.exe	Get hash	malicious	Nymaim	Browse	54.198.235.9
	8UvPumbygi.exe	Get hash	malicious	Nymaim	Browse	52.73.64.126
	Levelogger-4.6.2-Installer.exe	Get hash	malicious	Unknown	Browse	54.225.226.3
	21REzKeOgq.exe	Get hash	malicious	Nymaim	Browse	54.204.22.198
	21REzKeOgq.exe	Get hash	malicious	Nymaim	Browse	3.222.139.61
	V1lIaJpTZP.exe	Get hash	malicious	MinerDownloader, Nymaim, RedLine, Vidar, Xmrig	Browse	54.204.22.198

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	http://www.baidu.com/link?url=6b0x2vBMoi19gcvmLERCKZXmU7WzFg5ZY5UJRWTvWvpXNRf5rzJAbvuTny4JSJ3e	Get hash	malicious	Unknown	Browse	3.94.218.138
	https://trello.com/1/cards/6472186672e129dd4e4e04ba/attachments/64724be54a21719e16eef32e/download/Meta_Ads_Manager.exe	Get hash	malicious	Unknown	Browse	3.94.72.89
	WH4sXnS5bA.exe	Get hash	malicious	Unknown	Browse	3.94.72.89
	https://bio.site/sanskd4?hjntgi8v	Get hash	malicious	Unknown	Browse	54.236.68.122
	http://marcus1644.hocoos.com/	Get hash	malicious	Unknown	Browse	3.94.218.138
	https://principal.na1.adobesign.com/public/esign?tsid=CBFCIBAA3AAABLblqZhD9IJKKjdmtXT9i8IvIGEoAoh9aCd_p3MTUjzZb0YqnNn6lGq6e3CFngjLgNDRH-1VZxYxPqrpKK6ev_T3uHL28&	Get hash	malicious	Unknown	Browse	52.71.63.230
	https://catsystem.wufoo.com/forms/z12966vp1lumcy6/	Get hash	malicious	Unknown	Browse	54.227.163.251
	https://www.bing.com/ck/a?!&&p=6434192ee04e6ee3JmltdHM9MTY4NzM5MjAwMCZpZ3VpZD0yNmUxYjczNC03MDJiLTZhZTMtMDgwNi1hNDBjNzExMDZiOTQmaW5zaWQ9NTE2NQ&ptn=3&hsh=3&fclid=26e1b734-702b-6ae3-0806-a40c71106b94&u=a1aHR0cHM6Ly93d3cubmFjaG90ZWxzLmNvbS8#Y2xlaXRuZXJAdGVuYXNrYS5jb20=	Get hash	malicious	HTMLPhisher	Browse	34.204.41.25
	https://walli.shanga.co/image/view/?id=1375	Get hash	malicious	Unknown	Browse	52.7.7.171
	https://www.affaritaliani.it/	Get hash	malicious	Unknown	Browse	54.204.174.60
	Fatrr_UewhcWF.msi	Get hash	malicious	Unknown	Browse	54.198.235.9
	PXPz45kM78.elf	Get hash	malicious	Mirai	Browse	100.25.20.79
	eOF9g6JYAX.elf	Get hash	malicious	Unknown	Browse	54.211.50.102
	fDtncWP2T2.elf	Get hash	malicious	Unknown	Browse	34.232.174.101
	rM1MLEPWb4.elf	Get hash	malicious	Mirai	Browse	18.209.137.146
	https://chipotle.app.link/?$3p=e_et&$fallback_url=https://quattropublicidades.com.br/owa/aa/brian.herman@viewtrade.com	Get hash	malicious	Unknown	Browse	44.210.162.14
	3EYm3kgcui.exe	Get hash	malicious	AsyncRAT	Browse	3.88.20.74
	Invoice.xlsx	Get hash	malicious	HTMLPhisher	Browse	3.233.147.185
	Invoice.xlsx	Get hash	malicious	HTMLPhisher	Browse	3.233.152.246
	https://ct.turing.com/?ti=XnKxebcpeDwvWdbRVlUADzrVRSEAbsLtZmQpeGyzdrlemfqvIS&rd=http%3A%2F%2Fhatbaemama.com/marvel/XnKxebcpeDwvWdbRVlUADzrVRSEAbsLtZmQpeGyzdrlemfqvIS/bW5ld3NvbWVAZ2NnYW1pbmcuY29t	Get hash	malicious	Unknown	Browse	54.144.133.96

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\shiE3EE.tmp	Fatrr_UewhcWF.msi	Get hash	malicious	Unknown	Browse
	54zEUp34e1.exe	Get hash	malicious	Unknown	Browse
	54zEUp34e1.exe	Get hash	malicious	Unknown	Browse
	ECnCJ4QWok.exe	Get hash	malicious	Unknown	Browse
	ECnCJ4QWok.exe	Get hash	malicious	Unknown	Browse
	IcEL4U66yX.exe	Get hash	malicious	Unknown	Browse
	IcEL4U66yX.exe	Get hash	malicious	Unknown	Browse
	hWiWP9kOC9.exe	Get hash	malicious	PrivateLoader	Browse
	hWiWP9kOC9.exe	Get hash	malicious	Unknown	Browse
	S4iK1tSHGc.exe	Get hash	malicious	Unknown	Browse
	S4iK1tSHGc.exe	Get hash	malicious	Unknown	Browse
	WCYoS776qm.exe	Get hash	malicious	Nymaim	Browse
	a1rzxoicOg.exe	Get hash	malicious	Unknown	Browse
	a1rzxoicOg.exe	Get hash	malicious	Unknown	Browse
	8UvPumbygi.exe	Get hash	malicious	Nymaim	Browse
	8UvPumbygi.exe	Get hash	malicious	Nymaim	Browse
	Levelogger-4.6.2-Installer.exe	Get hash	malicious	Unknown	Browse
	21REzKeOgq.exe	Get hash	malicious	Nymaim	Browse
	21REzKeOgq.exe	Get hash	malicious	Nymaim	Browse
	https://tinyurl.com/2abosd8k	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\AdvinstAnalytics\649bc0e995075a1a74755442\7.7.6.4\tracking.ini

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.0081320258334
Encrypted:	false
SSDEEP:	3:1EyEMyvn:1BEN
MD5:	6BC190DD42A169DFA14515484427FC8E
SHA1:	B53BD614A834416E4A20292AA291A6D2FC221A5E
SHA-256:	B3395B660EB1EDB00FF91ECE4596E3ABE99FA558B149200F50AABF2CB77F5087
SHA-512:	5B7011ED628B673217695809A38A800E9C8A42CEB0C54AB6F8BC39DBA0745297A4FBD66D6B09188FCC952C08217152844DFC3ADA7CF468C3AAFCEC379C0B16B6
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[General]..Active = true..

C:\Users\user\AppData\Local\AdvinstAnalytics\649bc0e995075a1a74755442\7.7.6.4\{A48D7727-831E-442E-97DA-BEA1F4086C9A}.session

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13732
Entropy (8bit):	5.372532855650223
Encrypted:	false
SSDEEP:	384:BqhFnQSoxgUXgq8jcKkHVg27z5aH10fhpbzikaKFfhQtwUS27D0:BqhFnQSoxgUXgq8AKkHVg27z5aHKJpbj
MD5:	33D0F4D2AB84437011C5226E391A24B9
SHA1:	91363895099E84BD9BBCE620B97B5C431F182349
SHA-256:	2DBF97968196154608D162EBE31767463A23013FEC5F3DA86E760C06E8442C44
SHA-512:	D90A289855DD344E7E6EF9324DE739040B4D4196343BC002DB878E59B271459231804A92DBEA8ECC20BCF5B9BF02F442DD6DDA54DB845FBB9204659DD3D20073
Malicious:	false
Reputation:	low
Preview:	[Hit {19E14C13-03BA-400F-9555-08E7CC1742E6}]..Queue Time = 0..Hit Type = lifecycle..Life control = start..Protocol Version = 3..Application ID = 649bc0e995075a1a74755442..Application Version = 7.7.6.4..Client ID = 457F7464C7CDCB1132F3915F5D7B8EA8EDC6D3C5..Session ID = {A48D7727-831E-442E-97DA-BEA1F4086C9A}....[Hit {3A8102C3-EDF3-42BA-B63D-D52BC994AF1D}]..Queue Time = 0..Hit Type = property..Label = VersionNT..Value = 1000..Protocol Version = 3..Application ID = 649bc0e995075a1a74755442..Application Version = 7.7.6.4..Client ID = 457F7464C7CDCB1132F3915F5D7B8EA8EDC6D3C5..Session ID = {A48D7727-831E-442E-97DA-BEA1F4086C9A}....[Hit {17004166-C226-4E41-8F41-90AD4E22C657}]..Queue Time = 0..Hit Type = property..Label = VersionNT64..Value = 1000..Protocol Version = 3..Application ID = 649bc0e995075a1a74755442..Application Version = 7.7.6.4..Client ID = 457F7464C7CDCB1132F3915F5D7B8EA8EDC6D3C5..Session ID = {A48D7727-831E-442E-97DA-BEA1F4086C9A}....[Hit {4E184282-7649-4F5F-A526-7F40A42E5570}].

C:\Users\user\AppData\Local\Temp\shiE3EE.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3015168
Entropy (8bit):	6.488798060334229
Encrypted:	false
SSDEEP:	49152:sS4Q3T9DntJVJZy+PDGffBlj+mBLZESa9cxpy4AiE6CxdNnstH/9hGwQn+rV:x4QpDnDVJZySGfX1uSa9y9evdNnstH/n
MD5:	2BED2F1B8B7975B5F317813B9D2DC150
SHA1:	DC9C89E36F2BC4E01907E0CE698881BB267EAE34
SHA-256:	A1804D8C5127E13C27F664CDD3427C185FAE6ED2AB36108B501859C670F328BD
SHA-512:	49FFB70F169198F1F60C5AB6B15AA535D6905988623DF875A976D3A0ABD5E5EA1F09969B26F50F2E6C56DFC5624BAD84E73CB4238FC9F94B9E252775C691B3EE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Fatrr_UewhcWF.msi, Detection: malicious, Browse Filename: 54zEUp34e1.exe, Detection: malicious, Browse Filename: 54zEUp34e1.exe, Detection: malicious, Browse Filename: ECnCJ4QWok.exe, Detection: malicious, Browse Filename: ECnCJ4QWok.exe, Detection: malicious, Browse Filename: IcEL4U66yX.exe, Detection: malicious, Browse Filename: IcEL4U66yX.exe, Detection: malicious, Browse Filename: hWiWP9kOC9.exe, Detection: malicious, Browse Filename: hWiWP9kOC9.exe, Detection: malicious, Browse Filename: S4iK1tSHGc.exe, Detection: malicious, Browse Filename: S4iK1tSHGc.exe, Detection: malicious, Browse Filename: WCYoS776qm.exe, Detection: malicious, Browse Filename: a1rzxoicOg.exe, Detection: malicious, Browse Filename: a1rzxoicOg.exe, Detection: malicious, Browse Filename: 8UvPumbygi.exe, Detection: malicious, Browse Filename: 8UvPumbygi.exe, Detection: malicious, Browse Filename: Levelogger-4.6.2-Installer.exe, Detection: malicious, Browse Filename: 21REzKeOgq.exe, Detection: malicious, Browse Filename: 21REzKeOgq.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g....l..l..l.~....l..bo..l..bm..l..bi..l..m.I.l..bh..l..bl..l..bb...l..b...l..bn..l.Rich..l.................PE..L.................!...............P.............c.........................`............@A..........................).K&.......... +...................... -..=...:..T....................N.......#......................e)......................text.....).......)................. ..`.wpp_sf.:.....).......)............. ..`.data...@4........................@....idata..\|/......0.................@..@.didat..H.....+....................@....rsrc........ +....................@..@.reloc...=... -..>....,.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shiE4AB.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1299560
Entropy (8bit):	6.717180055414863
Encrypted:	false
SSDEEP:	24576:MhGigXBH4snfDLhfxTdLXWVjpUVAs7ImLKrVA16yiLo+aegfNoZFag9WM1KOn:AGigXBHvfD1f3Li9UVlerVWhNcag97sY
MD5:	84A28C3CF7B811847D74CE68C894FBA0
SHA1:	3140559C1BF1FF76A481C2E264808B3D094008FE
SHA-256:	A95C72F5B9FB9274AC9DAF554B24300E32C5E300AC92B6CE5EC8DB11F5745104
SHA-512:	E1DED6FBA8FC17DAECF97E5B0004FF6064D4403E3B02086CFCB3A2F04C36E7617D96DE9CC993B12AA00B64613BC766E985CEE25F818AC214196B8D16A2BCC2B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Wh..9;..9;..9;...;..9;..::.9;..=:.9;..8:..9;..<:..9;..8;..9;..7:..9;..9:..9;...;..9;..;:..9;Rich..9;................PE..L..................!.....\|...h............................................... ............@A........................ ........#.. ....`..................hN...P......`...T...................DV.......S............... ...............................text...)\|.......~.................. ..`.text_hf............................ ..`.data...........(..................@....idata..V.... ... ..................@..@.didat..<....@......................@....DDIData.....P......................@....rsrc........`......................@..@.reloc.......P......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\identity_helper.lnk

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	880
Entropy (8bit):	3.2421499879593454
Encrypted:	false
SSDEEP:	12:8wl05RsXUd9CVJEIQGbBIWtEqYIAvmNJS4t2Y+xIBjK:8t+IG2KZcCJO7aB
MD5:	14820CB37F2B8A01F49E62BF826F9B8A
SHA1:	6CE79C8C9225E8959F27FE95CA7C04DBCA9DF31E
SHA-256:	E5F8FB412CAE20A46BA6CE083FED8F13AB80773AEF15C1C30BAF0682C58BFEA7
SHA-512:	35DA4BC78AACC901093B2EBDED3ACCB4CB1111BC4B1A1E4D130B99728E757FA279E9CCB16DDA86E407E8E89045E801B792A5C4E71F9365EF4C64D6C4590EE261
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........Public..>............................................P.u.b.l.i.c.....\.1...........Documents.D............................................D.o.c.u.m.e.n.t.s.....z.2...........identity_helper.exe.X............................................i.d.e.n.t.i.t.y._.h.e.l.p.e.r...e.x.e..."...<.....\.....\.....\.....\.....\.....\.....\.....\.P.u.b.l.i.c.\.D.o.c.u.m.e.n.t.s.\.i.d.e.n.t.i.t.y._.h.e.l.p.e.r...e.x.e...C.:.\.U.s.e.r.s.\.P.u.b.l.i.c.\.D.o.c.u.m.e.n.t.s.\.............-............$H...E...ye.64-...............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.8.5.3.3.2.1.9.3.5.-.2.1.2.5.5.6.3.2.0.9.-.4.0.5.3.0.6.2.3.3.2.-.1.0.0.2.................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\zino.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.2516291673878226
Encrypted:	false
SSDEEP:	3:gpyn:g4n
MD5:	A067F5EC97BA51B576825B69BC855E58
SHA1:	907D296538A45D5B593512881D721C7D347B8E04
SHA-256:	CF3E339D25C3C023C9417FFC5D8E73F1DA828B18FEECAF14FDB9C24D04E49BA0
SHA-512:	F6058F37CF764E6CD807D9C0E9DE881849E4C94EC1D2E0C0EB504ABF77147E77CB09113B087E1C10E790C3EC45780E5986D29B2A84B364C5F697F884B1549F4D
Malicious:	false
Preview:	NULL..

C:\Windows\Installer\3ddde4.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {110F24C8-EE59-4BBD-9263-668DE75D4081}, Number of Words: 10, Subject: IANI INSIHERWOO, Author: IANI INSIHERWOO, Name of Creating Application: Advanced Installer 18.3 build e2a0201b, Template: ;1046, Comments: IANI INSIHERWOO, Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	2252288
Entropy (8bit):	6.488906903454377
Encrypted:	false
SSDEEP:	49152:w/VDxGSFVtaN4AyK8tKk5ojmrhCMz5vk3ukDln/hFRFNUEekBIWsRkn4frUMXjDA:qxM4AeKknz5vqu0sRe4frUMXjTY
MD5:	27D8C23579018EFF34CE61459E18F7F1
SHA1:	AD64565C41D3A3581621238AC4C65411E7CC30BC
SHA-256:	5995F2E1327A4A820695AA97F9E18926ECC900F1A036D8B11573C572D0FD47FD
SHA-512:	6B7D2F4ABEC942AB2E53612B2A9EFB562B286D88DDB629EA4FA971A364119DB8EFD883BB746BE84CD73E1B3DA63A82BA6188B57BDC86A8C937247BCCA5D192EF
Malicious:	false
Preview:	......................>...................#...................................................................................................................J...K...L...M...N...O...P...Q...R...S...T...U...............................................................................................................................................................................................................................................................................................................................c...............%...7........................................................................................... ...!..."...#...$.../...0...'...(...)...*...+...,...-...........1...5...2...3...4...8...6...@...C...9...:...;...<...=...>...?...R...A...B...H...D...E...F...G...q...I...b...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a.......d...u...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...v.......w...x...y...z...

C:\Windows\Installer\MSI79.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE100.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE269.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388064
Entropy (8bit):	6.407392408414975
Encrypted:	false
SSDEEP:	6144:U7C5QB3/CNG2HBOqf2BLuoZSKYfuAO8DOE09VKYnyZwYW:qB3WBOG2BPDKSf9VtyZNW
MD5:	20C782EB64C81AC14C83A853546A8924
SHA1:	A1506933D294DE07A7A2AE1FBC6BE468F51371D6
SHA-256:	0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
SHA-512:	AFF21E3E00B39F8983D101A0C616CA84CC3DC72D6464A0DD331965CF6BECCF9B45025A7DB2042D6E8B05221D3EB5813445C8ADA69AE96E2727A607398A3DE3D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......b2..&S..&S..&S..28..+S..28..S...'..)S...'..1S...'..aS..28..?S..28..'S..28..;S..&S..wR...'..tS...'..'S...'+.'S..&SC.'S...'..'S..Rich&S..........................PE..L.....`.........."!.................Z..............................................a.....@.........................@n.......v..........0.......................d?..X...p...............................@............... ............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...0...........................@..@.reloc..d?.......@..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE2F6.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388064
Entropy (8bit):	6.407392408414975
Encrypted:	false
SSDEEP:	6144:U7C5QB3/CNG2HBOqf2BLuoZSKYfuAO8DOE09VKYnyZwYW:qB3WBOG2BPDKSf9VtyZNW
MD5:	20C782EB64C81AC14C83A853546A8924
SHA1:	A1506933D294DE07A7A2AE1FBC6BE468F51371D6
SHA-256:	0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
SHA-512:	AFF21E3E00B39F8983D101A0C616CA84CC3DC72D6464A0DD331965CF6BECCF9B45025A7DB2042D6E8B05221D3EB5813445C8ADA69AE96E2727A607398A3DE3D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......b2..&S..&S..&S..28..+S..28..S...'..)S...'..1S...'..aS..28..?S..28..'S..28..;S..&S..wR...'..tS...'..'S...'+.'S..&SC.'S...'..'S..Rich&S..........................PE..L.....`.........."!.................Z..............................................a.....@.........................@n.......v..........0.......................d?..X...p...............................@............... ............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...0...........................@..@.reloc..d?.......@..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE365.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388064
Entropy (8bit):	6.407392408414975
Encrypted:	false
SSDEEP:	6144:U7C5QB3/CNG2HBOqf2BLuoZSKYfuAO8DOE09VKYnyZwYW:qB3WBOG2BPDKSf9VtyZNW
MD5:	20C782EB64C81AC14C83A853546A8924
SHA1:	A1506933D294DE07A7A2AE1FBC6BE468F51371D6
SHA-256:	0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
SHA-512:	AFF21E3E00B39F8983D101A0C616CA84CC3DC72D6464A0DD331965CF6BECCF9B45025A7DB2042D6E8B05221D3EB5813445C8ADA69AE96E2727A607398A3DE3D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......b2..&S..&S..&S..28..+S..28..S...'..)S...'..1S...'..aS..28..?S..28..'S..28..;S..&S..wR...'..tS...'..'S...'+.'S..&SC.'S...'..'S..Rich&S..........................PE..L.....`.........."!.................Z..............................................a.....@.........................@n.......v..........0.......................d?..X...p...............................@............... ............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...0...........................@..@.reloc..d?.......@..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE395.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	878560
Entropy (8bit):	6.452749824306929
Encrypted:	false
SSDEEP:	24576:QK8S3AccKkqSojmrhCMou5vk3Y+ukDln/hFRFNUEekB:QK8tKk5ojmrhCMz5vk3ukDln/hFRFNU0
MD5:	D51A7E3BCE34C74638E89366DEEE2AAB
SHA1:	0E68022B52C288E8CDFFE85739DE1194253A7EF0
SHA-256:	7C6BDF16A0992DB092B7F94C374B21DE5D53E3043F5717A6EECAE614432E0DF5
SHA-512:	8ED246747CDD05CAC352919D7DED3F14B1E523CCC1F7F172DB85EED800B0C5D24475C270B34A7C25E7934467ACE7E363542A586CDEB156BFC484F7417C3A4AB0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j{..............`.......`..W...<.......<.......<.......`.......`.......`..............>.......>.......>...............>.......Rich....................PE..L...}.`.........."!.........\|...........................................................@............................t...T........................N..............X}..p....................~.......}..@............................................text............................... ..`.rdata..............................@..@.data...\...........................@....rsrc................^..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE77E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE80B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIEAFA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388064
Entropy (8bit):	6.407392408414975
Encrypted:	false
SSDEEP:	6144:U7C5QB3/CNG2HBOqf2BLuoZSKYfuAO8DOE09VKYnyZwYW:qB3WBOG2BPDKSf9VtyZNW
MD5:	20C782EB64C81AC14C83A853546A8924
SHA1:	A1506933D294DE07A7A2AE1FBC6BE468F51371D6
SHA-256:	0ED6836D55180AF20F71F7852E3D728F2DEFE22AA6D2526C54CFBBB4B48CC6A1
SHA-512:	AFF21E3E00B39F8983D101A0C616CA84CC3DC72D6464A0DD331965CF6BECCF9B45025A7DB2042D6E8B05221D3EB5813445C8ADA69AE96E2727A607398A3DE3D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......b2..&S..&S..&S..28..+S..28..S...'..)S...'..1S...'..aS..28..?S..28..'S..28..;S..&S..wR...'..tS...'..'S...'+.'S..&SC.'S...'..'S..Rich&S..........................PE..L.....`.........."!.................Z..............................................a.....@.........................@n.......v..........0.......................d?..X...p...............................@............... ............................text............................... ..`.rdata.............................@..@.data...............................@....rsrc...0...........................@..@.reloc..d?.......@..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIEB69.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	780768
Entropy (8bit):	6.387720196228063
Encrypted:	false
SSDEEP:	12288:8tlNr2btWAp/wEqjh/lNKCQSZ1YVzsRiiqn6BbFAmrhymkM49+Og2Z04KHjJaI/5:8tlNrgpSZKVsRkn4frUMXjJaI/tWogPa
MD5:	573F5E653258BF622AE1C0AD118880A2
SHA1:	E243C761983908D14BAF6C7C0879301C8437415D
SHA-256:	371D1346EC9CA236B257FED5B5A5C260114E56DFF009F515FA543E11C4BB81F7
SHA-512:	DFFF15345DBF62307C3E6A4C0B363C133D1A0B8B368492F1200273407C2520B33ACB20BFF90FEAC356305990492F800844D849EE454E7124395F945DE39F39EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#P.Qg1..g1..g1..sZ..j1..sZ...1...E..v1...E..p1...E..51..sZ...1..sZ..f1..sZ..z1..g1..T0...E..+1...E..f1...Ex.f1..g1..e1...E..f1..Richg1..........PE..L.../.`.........."!.........B......4................................................j....@..........................;......@=...............................0......X%..p....................&.......%..@............................................text............................... ..`.rdata..............................@..@.data.......P.......@..............@....rsrc...............................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIEC64.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	1435
Entropy (8bit):	5.552941237389376
Encrypted:	false
SSDEEP:	24:drgc9YgufmvlTi6OZhEu6ANVgeCniZSOZgXQS9Bx/6+1sCz1f0xX6yw9IZL+Cn:drf9JLA44+iUL9e+1vz1AX6F969n
MD5:	9C087EA69D5C2D5B87373EE54478C3C1
SHA1:	746CCED2091052FBD8ED68FA4249C19C4F669AE7
SHA-256:	6F5EEFCFAA294A5744CAA78BEEFAEF73387861AFA02DE1B4F7953897957E0BA9
SHA-512:	E2BA4D3CCEB40F189E954C377F17A362925FF6FF0C95D3F95F61A45177DE646E9312056A82AF6DF1D0263FF737C63FFEAB803AE7213EFC774C0611426073291B
Malicious:	false
Preview:	...@IXOS.@.....@.I.V.@.....@.....@.....@.....@.....@......&.{63FC12FA-28FE-46D0-A887-FDF850492E2A}..IANI INSIHERWOO..Fatrr_wakMkxp.msi.@.....@.....@.....@........&.{110F24C8-EE59-4BBD-9263-668DE75D4081}.....@.....@.....@.....@.......@.....@.....@.......@......IANI INSIHERWOO......Rollback..A.....o. .d.e. .r.e.s.t.a.u.r.a.....o.....RollbackCleanup..Removendo arquivos de backup..Arquivo: [1]...@.......@........ProcessComponents%.Atualizando o registro de componentes...@.....@.....@.]....&.{4A93904F-7705-476D-B8C8-B7E8C8636CD0}D.C:\Users\user\AppData\Roaming\IANI INSIHERWOO\IANI INSIHERWOO\.@.......@.....@.....@......&.{FE012DD9-2710-4A25-B2BC-E1ACE500FEA4}6.01:\Software\IANI INSIHERWOO\IANI INSIHERWOO\Version.@.......@.....@.....@......&.{9C16F5A2-3C60-4506-BD74-3C345B093BC7}Q.01:\Software\IANI INSIHERWOO\{63FC12FA-28FE-46D0-A887-FDF850492E2A}\AI_IA_ENABLE.@.......@.....@.....@........CreateFolders..Criando novas pastas..Pasta: [1]".D.C:\Users\user\AppData\Roaming\IANI IN

C:\Windows\Installer\SourceHash{63FC12FA-28FE-46D0-A887-FDF850492E2A}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1654636921796426
Encrypted:	false
SSDEEP:	12:JSbX72FjkfAGiLIlHVRpEh/7777777777777777777777777vDHFJVqF/l0i8Q:JqfQI5UzF
MD5:	FB7E5100F004FE9DEAF0AC9029A7F029
SHA1:	CE8E2228644D9CC9D50324267D3E8015F7684AB7
SHA-256:	4424D9FC818A4698ACD1A9ADA72CA129E2DEA1AE13880C33D12157F0260406B3
SHA-512:	5C5F69BD0D823C34DC3E0593AB3EEA07260D23A1AA34E56F09D74518BD47CE0AA2D4756763E2C0C255B5C7203A03A76072BAC4D2389AE7A14788ADA9EF39D5D3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.8535671813167014
Encrypted:	false
SSDEEP:	48:m8PhBuRc06WXJIFT5KwLMJqSiJYAEbCyXLo8xqo8x4swXGcp4ru2xBxYxMxqxrxK:5hB1rFTFfhwCSk87K4Gp
MD5:	F47A68478055BDAE45CAC9E3390419EA
SHA1:	53252ACC74384F99F66542ABF8DD6B524C06EA0E
SHA-256:	FA95A829AF39E694C6686B8D2CBB4DA1DDF2DFCDC8BC2E5A66BBC41143404FB6
SHA-512:	EDE89DA08663B6F0F474CBB73A0392C45737FE57793636A19B13111347BC9F7C92B1C173A198AB33FE029204F93C88E3CAC8564FC7A8951AB71D236AAA89DB3D
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	120125
Entropy (8bit):	5.369124642609082
Encrypted:	false
SSDEEP:	768:NSXZf5Y2mhq+Lswt33IyCr7el3OEmSoay55QIxVV9lQ2es9YU/tYcxywq9D+crLn:NSc2mhbT1pAcuYf
MD5:	E6492CBED1BB0264B66A45302B236C94
SHA1:	DF26617012D06B9CF939DA7A0C30A953A7A43D54
SHA-256:	F54FC6EEA08783B71998BE6F57CCE180090457BEF0AB0FA95C42A1395BC56498
SHA-512:	0A18E32FC1689F79AA5025871A59AC449C7670F1F141A5E71FFA66F09BBC1C7C584D014681B2FF7B2AF1B874E6AEB0CB2BF701E61DFCF7D18C058C214DE5E213
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..07/23/2020 11:01:16.006 [3252]: Command line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install Microsoft.Office.Tools.Word, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A /queue:3 /NoDependencies ..07/23/2020 11:01:16.021 [3252]: ngen returning 0x00000000..07/23/2020 11:01:16.068 [1236]: Command line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A /queue:3 /NoDependencies ..07/23/2020 11:01:16.084 [1236]: ngen returning 0x00000000..07/23/2020 11:01:16.131 [4512]: Command line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A /queue:3 /NoDependencies ..07/23/2020 1

C:\Windows\Temp\~DF19F35B293638B6CC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF25B2F3C222B44E1F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.215579000942495
Encrypted:	false
SSDEEP:	48:c+5uAO+CFXJNT55UVyHwLMJqSiJYAEbCyXLo8xqo8x4swXGcp4ru2xBxYxMxqxrI:b5qlT38bfhwCSk87K4Gp
MD5:	CEF2659CF33B3FC8A5645D3F1E2C12C8
SHA1:	0FC6B3C23ABB7C01B7DF29FDE9CFA0776B3A321C
SHA-256:	0D688EE5419CF739FB0D0777C3F0E6A23B5D519A8339CF798C9960C60B0E250F
SHA-512:	17C83DAAA2654E4E3A57709B5585703BB66FB4A61F531BFC10014F70028DA74738FBF9ECA68C67AAAA24ED16D2F8A867DEF200C25996DD20675CC47C770CB769
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5991F4C5103D2B15.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.31214213383433903
Encrypted:	false
SSDEEP:	48:a2TOJqSiJDJqSiJYAEbCyXLo8xqo8x4swXGcp4ru2xBxYxMxqxrxbxEoyMboqIV5:b+hwCSk87K4Gq
MD5:	DB0D826404B2F1203CB2BDDF37C746EC
SHA1:	3BC296280329B7DB61B69907DB2F5CCE40D8FA75
SHA-256:	309CF78EC87AB0C1A8C9F44727D1BB28E4F5A893C03B09F84AD1CD962E16500D
SHA-512:	44593A9433F4A8D584849E17B166C5C31D9C6FA5887822667DF73DF25B84DFEAAA4FF662CF53B564A593117BA24FAF6B63E8F3173365116422A06B2EF096830A
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF66566F2BB30AB988.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07271125470716047
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOs+0pMVqSoyGSVky6lV1:2F0i8n0itFzDHFJVqF/
MD5:	C359BBE6D7CA697D38E01660B90E7B18
SHA1:	4D3E74CD028C03BB023A603FDA225303431C3503
SHA-256:	A9B82042A127EAB6EE482D8780636BD8C14114FC2075426AFCA9302DDB7411B5
SHA-512:	F622CAFA4A203F56F259542B44F18163E9B9EA2D906B0F094C9797EA76C0105F890D1C720A97D45B62FF11BC81AC13AC6B7D8D049EACCCB7AC07505867CA686C
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6EDAF435BE364346.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAB9525BE0F8E80CE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.8535671813167014
Encrypted:	false
SSDEEP:	48:m8PhBuRc06WXJIFT5KwLMJqSiJYAEbCyXLo8xqo8x4swXGcp4ru2xBxYxMxqxrxK:5hB1rFTFfhwCSk87K4Gp
MD5:	F47A68478055BDAE45CAC9E3390419EA
SHA1:	53252ACC74384F99F66542ABF8DD6B524C06EA0E
SHA-256:	FA95A829AF39E694C6686B8D2CBB4DA1DDF2DFCDC8BC2E5A66BBC41143404FB6
SHA-512:	EDE89DA08663B6F0F474CBB73A0392C45737FE57793636A19B13111347BC9F7C92B1C173A198AB33FE029204F93C88E3CAC8564FC7A8951AB71D236AAA89DB3D
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {110F24C8-EE59-4BBD-9263-668DE75D4081}, Number of Words: 10, Subject: IANI INSIHERWOO, Author: IANI INSIHERWOO, Name of Creating Application: Advanced Installer 18.3 build e2a0201b, Template: ;1046, Comments: IANI INSIHERWOO, Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Entropy (8bit):	6.488906903454377
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	Fatrr_wakMkxp.msi
File size:	2'252'288 bytes
MD5:	27d8c23579018eff34ce61459e18f7f1
SHA1:	ad64565c41d3a3581621238ac4c65411e7cc30bc
SHA256:	5995f2e1327a4a820695aa97f9e18926ecc900f1a036d8b11573c572d0fd47fd
SHA512:	6b7d2f4abec942ab2e53612b2a9efb562b286d88ddb629ea4fa971a364119db8efd883bb746be84cd73e1b3da63a82ba6188b57bdc86a8c937247bcca5d192ef
SSDEEP:	49152:w/VDxGSFVtaN4AyK8tKk5ojmrhCMz5vk3ukDln/hFRFNUEekBIWsRkn4frUMXjDA:qxM4AeKknz5vqu0sRe4frUMXjTY
TLSH:	CEA58D1275DA8732EA7E8134A5AAD73620FA3FE01BB154DF53D4593A0EB05C242B2F17
File Content Preview:	........................>...................#...................................................................................................................J...K...L...M...N...O...P...Q...R...S...T...U..................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.654.198.235.949711802849814 06/29/23-09:12:32.141900	TCP	2849814	ETPRO MALWARE TakeMyFile User-Agent	49711	80	192.168.2.6	54.198.235.9
192.168.2.654.198.235.949711802849813 06/29/23-09:12:32.141900	TCP	2849813	ETPRO MALWARE TakeMyFile Installer Checkin	49711	80	192.168.2.6	54.198.235.9

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 29, 2023 09:12:22.599138975 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:22.743721008 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:22.743931055 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:22.744097948 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:22.744224072 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:22.888964891 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:22.888995886 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:22.893744946 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:22.893811941 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:22.908423901 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:22.908689022 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.053363085 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:23.058007956 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:23.058157921 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.061031103 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.061081886 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.205655098 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:23.209997892 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:23.210094929 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.212035894 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.212068081 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.356630087 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:23.361252069 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:23.361337900 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.363569975 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.363610983 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.508203983 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:23.677093029 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:23.677195072 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.679141998 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.679191113 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.823868036 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:23.828052044 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:23.828166008 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.830219984 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.830250025 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.974687099 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:23.978843927 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:23.978904963 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.980468035 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:23.980504990 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:24.124917030 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:24.129103899 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:24.129262924 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:24.131448984 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:24.131491899 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:24.276138067 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:24.280221939 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:24.280396938 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:24.304454088 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:24.304508924 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:24.449124098 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:24.497173071 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:24.497262001 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:24.499382019 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:24.499423027 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:24.644035101 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:24.648010015 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:24.648070097 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:24.709417105 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:24.709465981 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:24.854089022 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:24.858303070 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:24.858413935 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:24.860522985 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:24.860573053 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.005717993 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:25.009401083 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:25.009614944 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.011497974 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.011548042 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.156207085 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:25.160713911 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:25.160924911 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.163140059 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.163197994 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.307801962 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:25.312741995 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:25.312961102 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.314994097 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.315053940 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.459520102 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:25.464030981 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:25.464302063 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.466587067 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.466643095 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.611366034 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:25.616415977 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:25.616543055 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.618115902 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.618150949 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.762722015 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:25.977701902 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:25.977878094 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.979614019 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:25.979669094 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:26.124430895 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:26.144462109 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:26.144542933 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:26.147082090 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:26.147118092 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:26.291666985 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:26.312097073 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:26.312238932 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:26.492394924 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:26.492394924 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:26.637156963 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:26.653212070 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:26.653352022 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:26.772605896 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:26.774967909 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:26.919516087 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:27.036645889 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:27.036850929 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:27.115964890 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:27.116199017 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:27.260730982 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:27.266004086 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:27.266143084 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:27.270143032 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:27.270546913 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:27.415059090 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:27.419230938 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:27.419456959 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:28.159878969 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:28.160922050 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:28.305524111 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:28.309272051 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:28.309345007 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:28.311434031 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:28.311471939 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:28.456073046 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:28.461035967 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:28.461596966 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:28.463573933 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:28.463614941 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:28.608151913 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:28.612556934 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:28.612663031 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:28.619282007 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:28.619339943 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:28.764111042 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:28.768834114 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:28.769134998 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:30.296303988 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:30.296359062 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:30.441066027 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:30.445123911 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:30.445353031 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:30.448096991 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:30.448240042 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:30.592868090 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:30.597773075 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:30.597942114 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:30.612315893 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:30.612315893 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:30.756921053 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:30.760802031 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:30.760911942 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:30.762387991 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:30.762432098 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:30.907049894 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:30.912590981 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:30.912683010 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:30.914988995 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:30.915040016 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.059660912 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:31.063843966 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:31.064059019 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.066152096 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.066175938 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.210701942 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:31.215243101 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:31.215404034 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.219666958 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.219713926 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.364417076 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:31.369254112 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:31.369508982 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.380455017 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.380501986 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.525120974 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:31.529424906 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:31.529556036 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.534956932 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.534956932 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.680074930 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:31.684124947 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:31.684242964 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.685992956 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.685992956 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.830946922 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:31.834897041 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:31.834988117 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.836307049 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.837394953 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.981978893 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:31.988282919 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:31.988435984 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.990396976 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:31.990425110 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:32.134974957 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:32.139602900 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:32.139734030 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:32.141900063 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:32.141900063 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:32.286854982 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:32.298681974 CEST	80	49711	54.198.235.9	192.168.2.6
Jun 29, 2023 09:12:32.298883915 CEST	49711	80	192.168.2.6	54.198.235.9
Jun 29, 2023 09:12:32.522074938 CEST	49711	80	192.168.2.6	54.198.235.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 29, 2023 09:12:22.564824104 CEST	65198	53	192.168.2.6	8.8.8.8
Jun 29, 2023 09:12:22.587354898 CEST	53	65198	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 29, 2023 09:12:22.564824104 CEST	192.168.2.6	8.8.8.8	0xf608	Standard query (0)	collect.installeranalytics.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 29, 2023 09:12:22.587354898 CEST	8.8.8.8	192.168.2.6	0xf608	No error (0)	collect.installeranalytics.com		54.198.235.9	A (IP address)	IN (0x0001)	false
Jun 29, 2023 09:12:22.587354898 CEST	8.8.8.8	192.168.2.6	0xf608	No error (0)	collect.installeranalytics.com		52.73.64.126	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

collect.installeranalytics.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49711	54.198.235.9	80	C:\Windows\SysWOW64\msiexec.exe

Timestamp	kBytes transferred	Direction	Data
Jun 29, 2023 09:12:22.744097948 CEST	101	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 167 Cache-Control: no-cache
Jun 29, 2023 09:12:22.744224072 CEST	101	OUT	Data Raw: 71 74 3d 34 31 32 33 32 36 35 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 73 74 61 72 74 26 76 3d 33 26 61 69 64 3d 36 34 39 62 63 30 65 39 39 35 30 37 35 61 31 61 37 34 37 35 35 34 34 32 26 61 76 3d 37 2e 37 2e 36 2e 34 26 63 69 64 3d 34 35 Data Ascii: qt=4123265&t=lifecycle&lc=start&v=3&aid=649bc0e995075a1a74755442&av=7.7.6.4&cid=457F7464C7CDCB1132F3915F5D7B8EA8EDC6D3C5&sid=%7BA48D7727-831E-442E-97DA-BEA1F4086C9A%7D
Jun 29, 2023 09:12:22.893744946 CEST	101	IN	HTTP/1.1 200 OK Cache-control: no-cache="set-cookie" Date: Thu, 29 Jun 2023 07:12:22 GMT Set-Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7;PATH=/;MAX-AGE=600 X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:22.908423901 CEST	102	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 179 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:22.908689022 CEST	102	OUT	Data Raw: 71 74 3d 34 31 32 33 37 31 38 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 65 72 73 69 6f 6e 4e 54 26 76 61 6c 3d 31 30 30 30 26 76 3d 33 26 61 69 64 3d 36 34 39 62 63 30 65 39 39 35 30 37 35 61 31 61 37 34 37 35 35 34 34 32 26 61 76 3d 37 2e Data Ascii: qt=4123718&t=property&lb=VersionNT&val=1000&v=3&aid=649bc0e995075a1a74755442&av=7.7.6.4&cid=457F7464C7CDCB1132F3915F5D7B8EA8EDC6D3C5&sid=%7BA48D7727-831E-442E-97DA-BEA1F4086C9A%7D
Jun 29, 2023 09:12:23.058007956 CEST	102	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:22 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:23.061031103 CEST	103	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 181 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:23.061081886 CEST	103	OUT	Data Raw: 71 74 3d 34 31 32 33 38 37 35 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 65 72 73 69 6f 6e 4e 54 36 34 26 76 61 6c 3d 31 30 30 30 26 76 3d 33 26 61 69 64 3d 36 34 39 62 63 30 65 39 39 35 30 37 35 61 31 61 37 34 37 35 35 34 34 32 26 61 76 3d Data Ascii: qt=4123875&t=property&lb=VersionNT64&val=1000&v=3&aid=649bc0e995075a1a74755442&av=7.7.6.4&cid=457F7464C7CDCB1132F3915F5D7B8EA8EDC6D3C5&sid=%7BA48D7727-831E-442E-97DA-BEA1F4086C9A%7D
Jun 29, 2023 09:12:23.209997892 CEST	103	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:23 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:23.212035894 CEST	104	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 184 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:23.212068081 CEST	104	OUT	Data Raw: 71 74 3d 34 31 32 34 30 31 35 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 50 68 79 73 69 63 61 6c 4d 65 6d 6f 72 79 26 76 61 6c 3d 38 31 39 31 26 76 3d 33 26 61 69 64 3d 36 34 39 62 63 30 65 39 39 35 30 37 35 61 31 61 37 34 37 35 35 34 34 32 26 Data Ascii: qt=4124015&t=property&lb=PhysicalMemory&val=8191&v=3&aid=649bc0e995075a1a74755442&av=7.7.6.4&cid=457F7464C7CDCB1132F3915F5D7B8EA8EDC6D3C5&sid=%7BA48D7727-831E-442E-97DA-BEA1F4086C9A%7D
Jun 29, 2023 09:12:23.361252069 CEST	104	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:23 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:23.363569975 CEST	105	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 180 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:23.363610983 CEST	105	OUT	Data Raw: 71 74 3d 34 31 32 34 31 37 31 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 65 72 73 69 6f 6e 4d 73 69 26 76 61 6c 3d 35 2e 30 30 26 76 3d 33 26 61 69 64 3d 36 34 39 62 63 30 65 39 39 35 30 37 35 61 31 61 37 34 37 35 35 34 34 32 26 61 76 3d 37 Data Ascii: qt=4124171&t=property&lb=VersionMsi&val=5.00&v=3&aid=649bc0e995075a1a74755442&av=7.7.6.4&cid=457F7464C7CDCB1132F3915F5D7B8EA8EDC6D3C5&sid=%7BA48D7727-831E-442E-97DA-BEA1F4086C9A%7D
Jun 29, 2023 09:12:23.677093029 CEST	105	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:23 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:23.679141998 CEST	106	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 174 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:23.679191113 CEST	106	OUT	Data Raw: 71 74 3d 34 31 32 34 35 31 35 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 55 49 4c 65 76 65 6c 26 76 61 6c 3d 33 26 76 3d 33 26 61 69 64 3d 36 34 39 62 63 30 65 39 39 35 30 37 35 61 31 61 37 34 37 35 35 34 34 32 26 61 76 3d 37 2e 37 2e 36 2e 34 Data Ascii: qt=4124515&t=property&lb=UILevel&val=3&v=3&aid=649bc0e995075a1a74755442&av=7.7.6.4&cid=457F7464C7CDCB1132F3915F5D7B8EA8EDC6D3C5&sid=%7BA48D7727-831E-442E-97DA-BEA1F4086C9A%7D
Jun 29, 2023 09:12:23.828052044 CEST	106	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:23 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:23.830219984 CEST	107	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 183 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:23.830250025 CEST	107	OUT	Data Raw: 71 74 3d 34 31 32 34 36 37 31 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 56 69 72 74 75 61 6c 4d 65 6d 6f 72 79 26 76 61 6c 3d 36 38 37 33 26 76 3d 33 26 61 69 64 3d 36 34 39 62 63 30 65 39 39 35 30 37 35 61 31 61 37 34 37 35 35 34 34 32 26 61 Data Ascii: qt=4124671&t=property&lb=VirtualMemory&val=6873&v=3&aid=649bc0e995075a1a74755442&av=7.7.6.4&cid=457F7464C7CDCB1132F3915F5D7B8EA8EDC6D3C5&sid=%7BA48D7727-831E-442E-97DA-BEA1F4086C9A%7D
Jun 29, 2023 09:12:23.978843927 CEST	107	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:23 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:23.980468035 CEST	108	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 183 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:23.980504990 CEST	108	OUT	Data Raw: 71 74 3d 34 31 32 34 37 36 35 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 4d 73 69 4e 54 50 72 6f 64 75 63 74 54 79 70 65 26 76 61 6c 3d 31 26 76 3d 33 26 61 69 64 3d 36 34 39 62 63 30 65 39 39 35 30 37 35 61 31 61 37 34 37 35 35 34 34 32 26 61 Data Ascii: qt=4124765&t=property&lb=MsiNTProductType&val=1&v=3&aid=649bc0e995075a1a74755442&av=7.7.6.4&cid=457F7464C7CDCB1132F3915F5D7B8EA8EDC6D3C5&sid=%7BA48D7727-831E-442E-97DA-BEA1F4086C9A%7D
Jun 29, 2023 09:12:24.129103899 CEST	108	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:24 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:24.131448984 CEST	108	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 183 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:24.131491899 CEST	109	OUT	Data Raw: 71 74 3d 34 31 32 34 39 36 38 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 53 65 72 76 69 63 65 50 61 63 6b 4c 65 76 65 6c 26 76 61 6c 3d 30 26 76 3d 33 26 61 69 64 3d 36 34 39 62 63 30 65 39 39 35 30 37 35 61 31 61 37 34 37 35 35 34 34 32 26 61 Data Ascii: qt=4124968&t=property&lb=ServicePackLevel&val=0&v=3&aid=649bc0e995075a1a74755442&av=7.7.6.4&cid=457F7464C7CDCB1132F3915F5D7B8EA8EDC6D3C5&sid=%7BA48D7727-831E-442E-97DA-BEA1F4086C9A%7D
Jun 29, 2023 09:12:24.280221939 CEST	109	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:24 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:24.304454088 CEST	109	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 185 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:24.304508924 CEST	110	OUT	Data Raw: 71 74 3d 34 31 32 35 31 32 35 26 74 3d 70 72 6f 70 65 72 74 79 26 6c 62 3d 50 72 6f 64 75 63 74 4c 61 6e 67 75 61 67 65 26 76 61 6c 3d 31 30 34 36 26 76 3d 33 26 61 69 64 3d 36 34 39 62 63 30 65 39 39 35 30 37 35 61 31 61 37 34 37 35 35 34 34 32 Data Ascii: qt=4125125&t=property&lb=ProductLanguage&val=1046&v=3&aid=649bc0e995075a1a74755442&av=7.7.6.4&cid=457F7464C7CDCB1132F3915F5D7B8EA8EDC6D3C5&sid=%7BA48D7727-831E-442E-97DA-BEA1F4086C9A%7D
Jun 29, 2023 09:12:24.497173071 CEST	110	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:24 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:24.499382019 CEST	110	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 197 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:24.648010015 CEST	111	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:24 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:24.709417105 CEST	111	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 192 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:24.858303070 CEST	112	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:24 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:24.860522985 CEST	112	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 195 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:25.009401083 CEST	113	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:24 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:25.011497974 CEST	113	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 201 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:25.160713911 CEST	114	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:25 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:25.163140059 CEST	114	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 192 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:25.312741995 CEST	115	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:25 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:25.314994097 CEST	115	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 194 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:25.464030981 CEST	116	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:25 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:25.466587067 CEST	116	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 210 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:25.616415977 CEST	117	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:25 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:25.618115902 CEST	117	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 211 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:25.977701902 CEST	118	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:25 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:25.979614019 CEST	118	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 193 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:26.144462109 CEST	119	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:26 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:26.147082090 CEST	119	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 207 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:26.312097073 CEST	120	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:26 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:26.492394924 CEST	120	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 199 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:26.653212070 CEST	121	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:26 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:26.772605896 CEST	121	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 201 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:27.036645889 CEST	122	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:26 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:27.115964890 CEST	122	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 201 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:27.266004086 CEST	123	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:27 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:27.270143032 CEST	123	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 203 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:27.419230938 CEST	123	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:27 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:28.159878969 CEST	124	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 202 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:28.309272051 CEST	124	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:28 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:28.311434031 CEST	125	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 204 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:28.461035967 CEST	125	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:28 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:28.463573933 CEST	126	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 204 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:28.612556934 CEST	126	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:28 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:28.619282007 CEST	127	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 207 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:28.768834114 CEST	127	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:28 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:30.296303988 CEST	128	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 206 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:30.445123911 CEST	128	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:30 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:30.448096991 CEST	129	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 201 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:30.597773075 CEST	129	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:30 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:30.612315893 CEST	130	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 208 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:30.760802031 CEST	160	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:30 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:30.762387991 CEST	160	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 212 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:30.912590981 CEST	161	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:30 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:30.914988995 CEST	162	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 191 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:31.063843966 CEST	162	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:30 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:31.066152096 CEST	163	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 183 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:31.215243101 CEST	163	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:31 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:31.219666958 CEST	164	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 176 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:31.369254112 CEST	164	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:31 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:31.380455017 CEST	164	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 184 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:31.529424906 CEST	165	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:31 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:31.534956932 CEST	165	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 184 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:31.684124947 CEST	166	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:31 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:31.685992956 CEST	166	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 172 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:31.834897041 CEST	167	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:31 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:31.836307049 CEST	167	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 179 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:31.988282919 CEST	168	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:31 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:31.990396976 CEST	168	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 219 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:32.139602900 CEST	169	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:32 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive
Jun 29, 2023 09:12:32.141900063 CEST	169	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.17134 ; x64) Host: collect.installeranalytics.com Content-Length: 181 Cache-Control: no-cache Cookie: AWSELB=D7177B5704D1BF661882EF94F6A835B9FB0EACE97C49CE22FDEE1CA1001AFF5F71AA12E5F06B26C30D4C68D2091FE6ED40F621B6434D87C1489153A94C392995E08A8228A7
Jun 29, 2023 09:12:32.298681974 CEST	170	IN	HTTP/1.1 200 OK Date: Thu, 29 Jun 2023 07:12:32 GMT X-Powered-By: Express Content-Length: 0 Connection: keep-alive

Target ID:	0
Start time:	09:12:11
Start date:	29/06/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Fatrr_wakMkxp.msi"
Imagebase:	0x7ff65e700000
File size:	66'048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	1
Start time:	09:12:11
Start date:	29/06/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff65e700000
File size:	66'048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	2
Start time:	09:12:13
Start date:	29/06/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 366E9C1149556BC0F11E4B9E382385C6
Imagebase:	0xfa0000
File size:	59'904 bytes
MD5 hash:	12C17B5A5C2A7B97342C362CA467E9A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: Traffic	Snort IDS: 2849814 ETPRO MALWARE TakeMyFile User-Agent 192.168.2.6:49711 -> 54.198.235.9:80
Source: Traffic	Snort IDS: 2849813 ETPRO MALWARE TakeMyFile Installer Checkin 192.168.2.6:49711 -> 54.198.235.9:80

Source: shiE3EE.tmp.2.dr	String found in binary or memory: http://.css
Source: shiE3EE.tmp.2.dr	String found in binary or memory: http://.jpg
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Fatrr_wakMkxp.msi, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: http://collect.installeranalytics.com
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: shiE3EE.tmp.2.dr	String found in binary or memory: http://html4/loose.dtd
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: http://t2.symcb.com0
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: http://tl.symcd.com0&
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: shiE3EE.tmp.2.dr	String found in binary or memory: https://HTTP/1.1
Source: Fatrr_wakMkxp.msi, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: https://collect.installeranalytics.com
Source: Fatrr_wakMkxp.msi, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: Fatrr_wakMkxp.msi, MSIE269.tmp.1.dr, MSIE365.tmp.1.dr, MSIE100.tmp.1.dr, MSIEB69.tmp.1.dr, 3ddde4.msi.1.dr, MSIE2F6.tmp.1.dr, MSIE80B.tmp.1.dr, MSIE77E.tmp.1.dr, MSIEAFA.tmp.1.dr, MSIE395.tmp.1.dr, MSI79.tmp.1.dr	String found in binary or memory: https://www.thawte.com/repository0W

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Fatrr_wakMkxp.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\AdvinstAnalytics\649bc0e995075a1a74755442\7.7.6.4\tracking.ini

C:\Users\user\AppData\Local\AdvinstAnalytics\649bc0e995075a1a74755442\7.7.6.4\{A48D7727-831E-442E-97DA-BEA1F4086C9A}.session

C:\Users\user\AppData\Local\Temp\shiE3EE.tmp

C:\Users\user\AppData\Local\Temp\shiE4AB.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\identity_helper.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\zino.ps1

C:\Windows\Installer\3ddde4.msi

C:\Windows\Installer\MSI79.tmp

C:\Windows\Installer\MSIE100.tmp

C:\Windows\Installer\MSIE269.tmp

C:\Windows\Installer\MSIE2F6.tmp

C:\Windows\Installer\MSIE365.tmp

C:\Windows\Installer\MSIE395.tmp

C:\Windows\Installer\MSIE77E.tmp

C:\Windows\Installer\MSIE80B.tmp

C:\Windows\Installer\MSIEAFA.tmp

C:\Windows\Installer\MSIEB69.tmp

C:\Windows\Installer\MSIEC64.tmp

C:\Windows\Installer\SourceHash{63FC12FA-28FE-46D0-A887-FDF850492E2A}

C:\Windows\Installer\inprogressinstallinfo.ipi

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

C:\Windows\Temp\~DF19F35B293638B6CC.TMP

C:\Windows\Temp\~DF25B2F3C222B44E1F.TMP

Windows Analysis Report
Fatrr_wakMkxp.msi