Edit tour

Windows Analysis Report
r3Zor4OEe5.msi

Overview

General Information

Sample name:	r3Zor4OEe5.msi renamed because original name is a hash value
Original sample name:	bb193b20d415134b38b673f30b232325f9cabff21732957266d2d207e2b7e170.msi
Analysis ID:	1500624
MD5:	7b9e449d03cc0e3e5fd65dd019505bcb
SHA1:	26eb5c00591fa4307cbf71c95d9a0b63ca6cd5d3
SHA256:	bb193b20d415134b38b673f30b232325f9cabff21732957266d2d207e2b7e170
Tags:	msiRobotDropper
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Msiexec Initiated Connection

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 7268 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\r3Zor4OEe5.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7300 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7420 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding ACEE42F6E57521698C9A0D746A0AD34D MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Sigma Signatures

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 188.114.96.3, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 7420, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Suricata Signatures

ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA - Source IP: 192.168.2.5 - Destination IP: 188.114.96.3

Timestamp:	2024-08-28T18:47:05.379095+0200
SID:	2829202
Severity:	1
Source Port:	49704
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B1B66780-D60D-433F-9DFF-34A6F436A96E}

Jump to behavior

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49704 version: TLS 1.2

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: api-ms-win-core-synch-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdb source: r3Zor4OEe5.msi, 570a0b.msi.1.dr
Source:	Binary string: dt_shmem.pdb source: dt_shmem.dll.1.dr
Source:	Binary string: rmid.pdb source: rmid.exe.1.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.1.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: api-ms-win-core-processthreads-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: api-ms-win-core-file-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.1.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: api-ms-win-core-processenvironment-l1-1-0.dll.1.dr
Source:	Binary string: j2pcsc.pdb source: j2pcsc.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdbj source: r3Zor4OEe5.msi, 570a0b.msi.1.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.1.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: r3Zor4OEe5.msi, MSI1B27.tmp.1.dr, 570a0b.msi.1.dr, MSI117F.tmp.1.dr, MSIF7A.tmp.1.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: api-ms-win-crt-heap-l1-1-0.dll.1.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2829202 - Severity 1 - ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA : 192.168.2.5:49704 -> 188.114.96.3:443

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: get-license4.com

Source: unknown

HTTP traffic detected: POST /licenseUser.php HTTP/1.1Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: AdvancedInstallerHost: get-license4.comContent-Length: 44Cache-Control: no-cache

Source: dt_shmem.dll.1.dr, j2pcsc.dll.1.dr, rmid.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: dt_shmem.dll.1.dr, j2pcsc.dll.1.dr, rmid.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: dt_shmem.dll.1.dr, j2pcsc.dll.1.dr, rmid.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: dt_shmem.dll.1.dr, j2pcsc.dll.1.dr, rmid.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: dt_shmem.dll.1.dr, j2pcsc.dll.1.dr, rmid.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: dt_shmem.dll.1.dr, j2pcsc.dll.1.dr, rmid.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: dt_shmem.dll.1.dr, j2pcsc.dll.1.dr, rmid.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: dt_shmem.dll.1.dr, j2pcsc.dll.1.dr, rmid.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: dt_shmem.dll.1.dr, j2pcsc.dll.1.dr, rmid.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: dt_shmem.dll.1.dr, j2pcsc.dll.1.dr, rmid.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: vlc.mo8.1.dr	String found in binary or memory: http://forum.videolan.org
Source: dt_shmem.dll.1.dr, j2pcsc.dll.1.dr, rmid.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: dt_shmem.dll.1.dr, j2pcsc.dll.1.dr, rmid.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: dt_shmem.dll.1.dr, j2pcsc.dll.1.dr, rmid.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: vlc.mo8.1.dr	String found in binary or memory: http://wiki.videolan.org
Source: vlc.mo8.1.dr	String found in binary or memory: http://wiki.videolan.org/Documentation:Play_HowTo
Source: vlc.mo8.1.dr	String found in binary or memory: http://wiki.videolan.org/Documentation:Streaming_HowTo
Source: vlc.mo8.1.dr	String found in binary or memory: http://wiki.videolan.org/Documentation:VLC_for_dummies
Source: vlc.mo8.1.dr	String found in binary or memory: http://wiki.videolan.org/Hotkeys
Source: vlc.mo8.1.dr	String found in binary or memory: http://wiki.videolan.org/Knowledge_Base
Source: vlc.mo7.1.dr	String found in binary or memory: http://www.last.fm/join/
Source: vlc.mo8.1.dr	String found in binary or memory: http://www.videolan.org/
Source: vlc.mo8.1.dr	String found in binary or memory: http://www.videolan.org/contribute/
Source: vlc.mo8.1.dr	String found in binary or memory: http://www.videolan.org/support/faq.html
Source: vlc.mo8.1.dr	String found in binary or memory: http://www.videolan.org/vlc/lists.html
Source: r3Zor4OEe5.msi, 570a0b.msi.1.dr	String found in binary or memory: https://get-license4.com/licenseUser.phpAI_DOWNGRADE4010AI_PREPARE_UPGRADEPrepareUpgradeAI_PRESERVE_
Source: dt_shmem.dll.1.dr, j2pcsc.dll.1.dr, rmid.exe.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: vlc.mo7.1.dr	String found in binary or memory: https://www.transifex.com/yaron/teams/16553/cs/)
Source: vlc.mo8.1.dr	String found in binary or memory: https://www.videolan.org/
Source: vlc.mo8.1.dr	String found in binary or memory: https://www.videolan.org/contribute/

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\570a0b.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE7F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF7A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI117F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI120D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1346.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1B27.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1B57.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{B1B66780-D60D-433F-9DFF-34A6F436A96E}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2134.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\570a0e.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\570a0e.msi	Jump to behavior

Source: api-ms-win-core-handle-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-2-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found

Source: r3Zor4OEe5.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs r3Zor4OEe5.msi
Source: r3Zor4OEe5.msi	Binary or memory string: OriginalFilenameDataUploader.dllF vs r3Zor4OEe5.msi

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\r3Zor4OEe5.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding ACEE42F6E57521698C9A0D746A0AD34D
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding ACEE42F6E57521698C9A0D746A0AD34D	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior

Source: UnRAR.exe.1.dr	Static PE information: section name: _RDATA
Source: rnpkeys.exe.1.dr	Static PE information: section name: .00cfg
Source: rnpkeys.exe.1.dr	Static PE information: section name: .voltbl
Source: rnpkeys.exe.1.dr	Static PE information: section name: _RDATA

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF7A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\rmid.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\w2k_lsa_auth.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\fontmanager.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-console-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\jlink.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\j2pcsc.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\jimage.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE7F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\instrument.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\attach.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\freetype.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\rnpkeys.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\jaas.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\dt_shmem.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1B57.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI117F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\j2pkcs11.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\srv\jvm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1B27.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1346.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\prefs.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\rmi.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\jli.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI120D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\j2gss.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\net.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\UnRAR.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\nio.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF7A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\rmid.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\w2k_lsa_auth.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\fontmanager.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\jlink.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-console-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\jimage.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\j2pcsc.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE7F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\instrument.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\attach.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\freetype.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\rnpkeys.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\jaas.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\dt_shmem.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1B57.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI117F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\j2pkcs11.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\srv\jvm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1B27.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1346.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\prefs.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\rmi.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\jli.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI120D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\j2gss.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\net.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\UnRAR.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\nio.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	Windows Management Instrumentation	1 Windows Service	1 Windows Service	21 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Process Injection	1 Process Injection	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Timestomp	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\UnRAR.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-console-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-multibyte-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-private-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\attach.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\dt_shmem.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\fontmanager.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\freetype.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\instrument.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\j2gss.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\j2pcsc.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\j2pkcs11.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\jaas.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\jimage.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\jli.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\jlink.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\net.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\nio.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\prefs.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\rmi.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\rmid.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\rnpkeys.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\srv\jvm.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\w2k_lsa_auth.dll	0%	ReversingLabs
C:\Windows\Installer\MSI117F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI120D.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI1346.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI1B27.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI1B57.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIE7F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIF7A.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://wiki.videolan.org/Knowledge_Base	0%	Avira URL Cloud	safe
http://wiki.videolan.org/Documentation:Streaming_HowTo	0%	Avira URL Cloud	safe
http://www.videolan.org/vlc/lists.html	0%	Avira URL Cloud	safe
http://www.videolan.org/support/faq.html	0%	Avira URL Cloud	safe
http://wiki.videolan.org/Documentation:VLC_for_dummies	0%	Avira URL Cloud	safe
http://wiki.videolan.org	0%	Avira URL Cloud	safe
http://wiki.videolan.org/Hotkeys	0%	Avira URL Cloud	safe
http://forum.videolan.org	0%	Avira URL Cloud	safe
https://www.transifex.com/yaron/teams/16553/cs/)	0%	Avira URL Cloud	safe
https://www.videolan.org/	0%	Avira URL Cloud	safe
http://www.videolan.org/	0%	Avira URL Cloud	safe
http://www.last.fm/join/	0%	Avira URL Cloud	safe
http://www.videolan.org/contribute/	0%	Avira URL Cloud	safe
https://get-license4.com/licenseUser.phpAI_DOWNGRADE4010AI_PREPARE_UPGRADEPrepareUpgradeAI_PRESERVE_	0%	Avira URL Cloud	safe
https://www.videolan.org/contribute/	0%	Avira URL Cloud	safe
https://get-license4.com/licenseUser.php	0%	Avira URL Cloud	safe
http://wiki.videolan.org/Documentation:Play_HowTo	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://wiki.videolan.org/Knowledge_Base	vlc.mo8.1.dr	false	Avira URL Cloud: safe	unknown
http://www.videolan.org/support/faq.html	vlc.mo8.1.dr	false	Avira URL Cloud: safe	unknown
http://www.videolan.org/vlc/lists.html	vlc.mo8.1.dr	false	Avira URL Cloud: safe	unknown
http://wiki.videolan.org	vlc.mo8.1.dr	false	Avira URL Cloud: safe	unknown
http://wiki.videolan.org/Documentation:VLC_for_dummies	vlc.mo8.1.dr	false	Avira URL Cloud: safe	unknown
https://www.transifex.com/yaron/teams/16553/cs/)	vlc.mo7.1.dr	false	Avira URL Cloud: safe	unknown
http://wiki.videolan.org/Documentation:Streaming_HowTo	vlc.mo8.1.dr	false	Avira URL Cloud: safe	unknown
http://wiki.videolan.org/Hotkeys	vlc.mo8.1.dr	false	Avira URL Cloud: safe	unknown
https://www.videolan.org/	vlc.mo8.1.dr	false	Avira URL Cloud: safe	unknown
http://forum.videolan.org	vlc.mo8.1.dr	false	Avira URL Cloud: safe	unknown
http://www.videolan.org/	vlc.mo8.1.dr	false	Avira URL Cloud: safe	unknown
https://get-license4.com/licenseUser.phpAI_DOWNGRADE4010AI_PREPARE_UPGRADEPrepareUpgradeAI_PRESERVE_	r3Zor4OEe5.msi, 570a0b.msi.1.dr	false	Avira URL Cloud: safe	unknown
http://www.last.fm/join/	vlc.mo7.1.dr	false	Avira URL Cloud: safe	unknown
http://www.videolan.org/contribute/	vlc.mo8.1.dr	false	Avira URL Cloud: safe	unknown
http://wiki.videolan.org/Documentation:Play_HowTo	vlc.mo8.1.dr	false	Avira URL Cloud: safe	unknown
https://www.videolan.org/contribute/	vlc.mo8.1.dr	false	Avira URL Cloud: safe	unknown

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500624
Start date and time:	2024-08-28 18:46:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	r3Zor4OEe5.msi renamed because original name is a hash value
Original Sample Name:	bb193b20d415134b38b673f30b232325f9cabff21732957266d2d207e2b7e170.msi
Detection:	MAL
Classification:	mal48.winMSI@4/110@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msi

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	PO_GM_list_28082024202003180817418280824_purchase_doc_00000(991KB).bat	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	www.katasoo.com/7qad/
	709876765465.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.coinwab.com/kqqj/
	http://allegro-8888.com/	Get hash	malicious	Unknown	Browse	allegro-8888.com/xml/index.html
	PO_112234525626823775.js	Get hash	malicious	Lokibot	Browse	werdotx.shop/Devil/PWS/fre.php
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse	web.ad87h92j.com/4/t.bmp
	pXm5oVO3Go.exe	Get hash	malicious	Nitol	Browse	web.ad87h92j.com/4/t.bmp
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/0U9QqTZ6/download
	FedEx Shipping Document.scr.exe	Get hash	malicious	Azorult	Browse	l0h5.shop/CM341/index.php
	Quote 1T PN40 082624.exe	Get hash	malicious	FormBook	Browse	www.lampgm.pro/em9t/
	weave.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	671893cm.n9shka.top/eternalpipeLowProcessDbDatalifewpPublicCdn.php

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
get-license4.com	x64_x32_installer__v4.0.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	x64_x32_installer__v4.4.9.msi	Get hash	malicious	Unknown	Browse	188.114.97.3
	x64_x32_installer__v4.4.3.msi	Get hash	malicious	Unknown	Browse	188.114.97.3
	x64_x32_installer__v4.3.0.msi	Get hash	malicious	Unknown	Browse	188.114.97.3
	x64_x32_installer__v4.2.2.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	x64_x32_installer__v4.1.8.msi	Get hash	malicious	Unknown	Browse	188.114.96.3

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report r3Zor4OEe5.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\570a0d.rbs

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\licenseUser[1].htm

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\UnRAR.exe

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-console-l1-1-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-console-l1-2-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-datetime-l1-1-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-debug-l1-1-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-errorhandling-l1-1-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-file-l1-1-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-file-l1-2-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-file-l2-1-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-handle-l1-1-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-heap-l1-1-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-interlocked-l1-1-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-libraryloader-l1-1-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-localization-l1-2-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-memory-l1-1-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-namedpipe-l1-1-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-processenvironment-l1-1-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-processthreads-l1-1-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-processthreads-l1-1-1.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-profile-l1-1-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-rtlsupport-l1-1-0.dll

C:\Users\user\AppData\Roaming\Icuuq Cmpq\IcuApp\api-ms-win-core-string-l1-1-0.dll

Windows Analysis Report
r3Zor4OEe5.msi

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	x64_x32_installer__v4.0.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://cb1cd44761364cecb21c459c42a86757.svc.dynamics.com/t/t/oIX7RshqCPFFtVxUphHklxDHFg31zySxgRv75vmlL2Yx/ipf8JYDu9fTBRLVxBJ5f98zUiqcPZCqXAj98vZXuDQkx	Get hash	malicious	Unknown	Browse	104.16.76.142
	https://www.linkedin.com/redir/redirect?url=https://assets-usa.mkt.dynamics.com/2143bba1-f463-ef11-a66d-6045bd003910/digitalassets/standaloneforms/3d28dcfa-8464-ef11-bfe2-0022480a9151&urlhash=OzMH&trk=article-ssr-frontend-pulse_little-text-block	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://assets-usa.mkt.dynamics.com/c9f731e3-0864-ef11-a66d-6045bd003021/digitalassets/standaloneforms/0424cf3e-7364-ef11-bfe2-6045bd055762	Get hash	malicious	HTMLPhisher	Browse	104.18.3.35
	https://oh3y.ulvantiro.su/82xG/	Get hash	malicious	HTMLPhisher	Browse	104.21.78.226
	https://oh3y.ulvantiro.su/82xG/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://imgsservices.ie/	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://shoutout.wix.com/so/1cP6H1VAL/c?w=L7pua50bZIFuawn8wEC-GMcwrkjbzspUanxhOP-akj4.eyJ1IjoiaHR0cHM6Ly93aDEzNzExNjMuaXNwb3QuY2MvNzIzMl8zY1BGdU1LYlZDL0pnb0ZWUVluQWIvalN5TGg0eElzYy5odG1sIiwiciI6IjFjMDQ2OWExLTM4MjgtNGUwNy1iY2RiLWVjZDA0ZTM0NGUyMCIsIm0iOiJtYWlsIiwiYyI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9#em=katieidlewine0383@plopmail.com	Get hash	malicious	Phisher	Browse	104.21.61.175
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.96.3

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	x64_x32_installer__v4.0.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	WebAdvisorInstall.exe	Get hash	malicious	LockBit ransomware	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.96.3
	46262-pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	188.114.96.3
	PO_GM_list_28082024202003180817418280824_purchase_doc_00000(991KB).bat	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	188.114.96.3
	IMS64.dll.dll	Get hash	malicious	BruteRatel	Browse	188.114.96.3
	IMS64.dll.dll	Get hash	malicious	BruteRatel	Browse	188.114.96.3
	Payment_Advice.exe	Get hash	malicious	FormBook, GuLoader	Browse	188.114.96.3

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	26141
Entropy (8bit):	5.869440053426368
Encrypted:	false
SSDEEP:	768:s6vdGiAZr8dGTYeMnc3j3l+iK/kilSmpN9Mal3uG2+FdTE0qoWPoTVGP9Lt+V2vv:xvdGiAZr8dGTYeMnc3j3l+iK/kilSmp8
MD5:	DD2E2019D2B79C937A879E5764B5A5F9
SHA1:	9C06E6149615482EFCEAA004A78739852B6DA6FE
SHA-256:	87A4527079B57BBBD29795B7570FB52679210CBDB994C61F7ACEF51BE3E539A9
SHA-512:	A6F57B8089DC5A63E5CECE20D1557B160F6C60B7C2DC7BBDEB0B225B05DB28E6398C630E3A165EDE87DBC24265179BE88887CBC7C0F891A5E7ACA70506955309
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.e.Y.@.....@.....@.....@.....@.....@......&.{B1B66780-D60D-433F-9DFF-34A6F436A96E}..IcuApp..r3Zor4OEe5.msi.@.....@.....@.....@......icon_25.exe..&.{847FACC8-465F-4938-AF1A-A70D5A9EDA57}.....@.....@.....@.....@.......@.....@.....@.......@......IcuApp......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{A1891289-FBA3-4394-97C6-59BEB51FC0CD}&.{B1B66780-D60D-433F-9DFF-34A6F436A96E}.@......&.{BA9848B9-FD9A-4F66-A260-353B1A39344A}&.{B1B66780-D60D-433F-9DFF-34A6F436A96E}.@......&.{B38797AC-AC2E-421D-B180-F8E18558EE2F}&.{B1B66780-D60D-433F-9DFF-34A6F436A96E}.@......&.{F1C6C119-92FE-4258-B0E3-6BABD549DF7B}&.{B1B66780-D60D-433F-9DFF-34A6F436A96E}.@......&.{40B539D7-F501-49C5-A9AE-7A21A44D396B}&.{B1B66780-D60D-433F-9DFF-34A6F436A96E}.@......&.{7C39C0D1-2D87-4D59-9C5F-D3B533AC5BEE}&.{B1B66780-D60D-433F-9DFF-34A6F436A96E}.@......&.{5B40C5C7-0FF3-41C7-BA3F-6C6A434D5C6A}&.{B1B66780-D60D-433F-

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:u:u
MD5:	E99BB33727D338314912E86FBDEC87AF
SHA1:	6779AFBC3E993C547CA0800A9754F37A6E80E0ED
SHA-256:	6856C5A3A26B5A3F2EAD70CA56870769D1FEE88F9C457F4360812F2203565824
SHA-512:	00FC5A88AB965B5A16D7CA33CFEF247ECE3185560F2C778CFBDD0353FE73505638E300B35F447713D26A5001AB29F6F969622BCEAEF1C100E80913F7430CC085
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0a

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {847FACC8-465F-4938-AF1A-A70D5A9EDA57}, Number of Words: 10, Subject: IcuApp, Author: Icuuq Cmpq, Name of Creating Application: IcuApp, Template: x64;2057, Comments: This installer database contains the logic and data required to install IcuApp., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Mon Aug 26 09:54:16 2024, Last Saved Time/Date: Mon Aug 26 09:54:16 2024, Last Printed: Mon Aug 26 09:54:16 2024, Number of Pages: 450
Entropy (8bit):	7.941902122746861
TrID:	Windows SDK Setup Transform Script (63028/2) 88.73% Generic OLE2 / Multistream Compound File (8008/1) 11.27%
File name:	r3Zor4OEe5.msi
File size:	35'910'144 bytes
MD5:	7b9e449d03cc0e3e5fd65dd019505bcb
SHA1:	26eb5c00591fa4307cbf71c95d9a0b63ca6cd5d3
SHA256:	bb193b20d415134b38b673f30b232325f9cabff21732957266d2d207e2b7e170
SHA512:	4a70427a618a1b30119337b5475acdf74bc4e49c8dddd58d633127593af5d7d6162b035d462b54b42f9dc7ebbc366f197bc122a3c1140bfcf40e839969ba21da
SSDEEP:	786432:ot9wUyTDXySTjxA4Ztx2+G+N0WYQYBXPByttH+dktHEDv0ylvnA:ot9Q7xVLYjsp+ikJlPA
TLSH:	7277230091B3B515F7ABB2BF2AB95FE48549BC6A02E59DF7637173B906F10920433893
File Content Preview:	........................>...................$...................................^.......................5.......k.......c.......y...z...{...\|...}...~...........................O...P...Q...R...S...T...[.......................;...<...=...>...?...@...A...B..

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 18:47:04.802357912 CEST	49704	443	192.168.2.5	188.114.96.3
Aug 28, 2024 18:47:04.802460909 CEST	443	49704	188.114.96.3	192.168.2.5
Aug 28, 2024 18:47:04.802555084 CEST	49704	443	192.168.2.5	188.114.96.3
Aug 28, 2024 18:47:04.804663897 CEST	49704	443	192.168.2.5	188.114.96.3
Aug 28, 2024 18:47:04.804699898 CEST	443	49704	188.114.96.3	192.168.2.5
Aug 28, 2024 18:47:05.300775051 CEST	443	49704	188.114.96.3	192.168.2.5
Aug 28, 2024 18:47:05.300884008 CEST	49704	443	192.168.2.5	188.114.96.3
Aug 28, 2024 18:47:05.376471043 CEST	49704	443	192.168.2.5	188.114.96.3
Aug 28, 2024 18:47:05.376494884 CEST	443	49704	188.114.96.3	192.168.2.5
Aug 28, 2024 18:47:05.376718044 CEST	443	49704	188.114.96.3	192.168.2.5
Aug 28, 2024 18:47:05.376780987 CEST	49704	443	192.168.2.5	188.114.96.3
Aug 28, 2024 18:47:05.378932953 CEST	49704	443	192.168.2.5	188.114.96.3
Aug 28, 2024 18:47:05.379025936 CEST	49704	443	192.168.2.5	188.114.96.3
Aug 28, 2024 18:47:05.379040956 CEST	443	49704	188.114.96.3	192.168.2.5
Aug 28, 2024 18:47:05.892755985 CEST	443	49704	188.114.96.3	192.168.2.5
Aug 28, 2024 18:47:05.892823935 CEST	49704	443	192.168.2.5	188.114.96.3
Aug 28, 2024 18:47:05.892842054 CEST	443	49704	188.114.96.3	192.168.2.5
Aug 28, 2024 18:47:05.892853975 CEST	443	49704	188.114.96.3	192.168.2.5
Aug 28, 2024 18:47:05.892913103 CEST	49704	443	192.168.2.5	188.114.96.3
Aug 28, 2024 18:47:05.903544903 CEST	49704	443	192.168.2.5	188.114.96.3
Aug 28, 2024 18:47:05.903559923 CEST	443	49704	188.114.96.3	192.168.2.5

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 18:47:04.746022940 CEST	62016	53	192.168.2.5	1.1.1.1
Aug 28, 2024 18:47:04.795193911 CEST	53	62016	1.1.1.1	192.168.2.5

Timestamp	Bytes transferred	Direction	Data
2024-08-28 16:47:05 UTC	198	OUT	POST /licenseUser.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvancedInstaller Host: get-license4.com Content-Length: 44 Cache-Control: no-cache
2024-08-28 16:47:05 UTC	44	OUT	Data Raw: 49 73 49 43 53 3d 30 26 4c 61 6e 67 43 6f 64 65 3d 35 38 37 35 26 41 77 61 69 74 54 6d 70 3d 31 37 26 4b 69 69 64 3d 38 31 32 35 37 Data Ascii: IsICS=0&LangCode=5875&AwaitTmp=17&Kiid=81257
2024-08-28 16:47:05 UTC	632	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 16:47:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tu%2F%2BV2DZnvCfHXnpPWwSHhTDGompWQFQh22%2B%2FLHNFLGhWyxNe3IXol0r3EONR%2FBb0gKRMH0PX0B%2FT95T8jkTiMlM269BD6m672Ryf9FetR73J8ivqqtNc2f%2B%2Bhn%2FhtoTNn4a"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ba5c7faec1a440e-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 16:47:05 UTC	7	IN	Data Raw: 32 0d 0a 30 61 0d 0a Data Ascii: 20a
2024-08-28 16:47:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:46:59
Start date:	28/08/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\r3Zor4OEe5.msi"
Imagebase:	0x7ff6c30b0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	12:47:00
Start date:	28/08/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding ACEE42F6E57521698C9A0D746A0AD34D
Imagebase:	0x40000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true