Edit tour

Windows Analysis Report
app__v7.3.5_.msi

Overview

General Information

Sample name:	app__v7.3.5_.msi
Analysis ID:	1523421
MD5:	2d6151dbbbb50c077564ef7ffc971a4e
SHA1:	b67ec6dd683f5f8b12d52aa79aeee9a498380589
SHA256:	2eae05e829f353c9a8d01683187eb759dbf73f90ccd435f03d46761b03247fbd
Tags:	msiRobotDropperuser-aachum
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Msiexec Initiated Connection

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 7548 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\app__v7.3.5_.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7580 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7660 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 01297D2E2EDE3162BB91A5AD2CF048CC MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Sigma Signatures

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 104.21.1.209, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 7660, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 63583

Suricata Signatures

ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T15:52:32.919981+0200	2829202	1	A Network Trojan was detected	192.168.2.4	63583	104.21.1.209	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: unknown

HTTPS traffic detected: 104.21.1.209:443 -> 192.168.2.4:63583 version: TLS 1.2

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.1.dr
Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: app__v7.3.5_.msi, 480495.msi.1.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdb source: app__v7.3.5_.msi, 480495.msi.1.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.1.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: app__v7.3.5_.msi, MSID34.tmp.1.dr, 480495.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdbj source: app__v7.3.5_.msi, 480495.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbm source: app__v7.3.5_.msi, 480495.msi.1.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: api-ms-win-core-synch-l1-1-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\tempFiles.pdb- source: app__v7.3.5_.msi, 480495.msi.1.dr, MSIDF.tmp.1.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: api-ms-win-crt-multibyte-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: api-ms-win-crt-environment-l1-1-0.dll.1.dr
Source:	Binary string: D:\git-sdk-64-build-installers\usr\src\MINGW-packages\mingw-w64-git\src\git\git-bash.pdb source: git-bash.exe.1.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: api-ms-win-core-timezone-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.1.dr
Source:	Binary string: D:\git-sdk-64-build-installers\usr\src\MINGW-packages\mingw-w64-git\src\git\cmd\git-gui.pdb source: git-gui.exe.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: app__v7.3.5_.msi, 480495.msi.1.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: app__v7.3.5_.msi, MSIC95.tmp.1.dr, 480495.msi.1.dr, MSIAF.tmp.1.dr, MSICD5.tmp.1.dr, MSIDD3.tmp.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\tempFiles.pdb source: app__v7.3.5_.msi, 480495.msi.1.dr, MSIDF.tmp.1.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: api-ms-win-crt-heap-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: api-ms-win-crt-string-l1-1-0.dll.1.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2829202 - Severity 1 - ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA : 192.168.2.4:63583 -> 104.21.1.209:443

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: check-key.com

Source: unknown

HTTP traffic detected: POST /licenseUser.php HTTP/1.1Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: AdvancedInstallerHost: check-key.comContent-Length: 110Cache-Control: no-cache

Source: app__v7.3.5_.msi, 480495.msi.1.dr	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor
Source: git-gui.exe.1.dr, git-bash.exe.1.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: git-gui.exe.1.dr, git-bash.exe.1.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0V
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: git-gui.exe.1.dr, git-bash.exe.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: git-gui.exe.1.dr, git-bash.exe.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: git-gui.exe.1.dr, git-bash.exe.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: git-gui.exe.1.dr, git-bash.exe.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: git-gui.exe.1.dr, git-bash.exe.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: git-gui.exe.1.dr, git-bash.exe.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: app__v7.3.5_.msi, 480495.msi.1.dr	String found in binary or memory: http://docs.jquery.com/License
Source: app__v7.3.5_.msi, 480495.msi.1.dr	String found in binary or memory: http://erik.eae.net/archives/2007/07/27/18.54.15/#comment-102291
Source: app__v7.3.5_.msi, 480495.msi.1.dr	String found in binary or memory: http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript
Source: chrome_elf.dll.1.dr	String found in binary or memory: http://https:///true1...
Source: app__v7.3.5_.msi, 480495.msi.1.dr	String found in binary or memory: http://javascript.nwbox.com/IEContentLoaded/
Source: app__v7.3.5_.msi, 480495.msi.1.dr	String found in binary or memory: http://jquery.com/
Source: git-gui.exe.1.dr, git-bash.exe.1.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: git-gui.exe.1.dr, git-bash.exe.1.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: http://s.symcd.com06
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: app__v7.3.5_.msi, 480495.msi.1.dr	String found in binary or memory: http://sizzlejs.com/
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: app__v7.3.5_.msi, 480495.msi.1.dr	String found in binary or memory: http://webreflection.blogspot.com/2007/08/global-scope-evaluation-and-dom.html
Source: app__v7.3.5_.msi, 480495.msi.1.dr	String found in binary or memory: https://check-key.com/licenseUser.phpDoAppSearchExAI_SET_RESUMEAI_SET_INSTALLSendCollectedDataAI_Ext
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: git-gui.exe.1.dr, git-bash.exe.1.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63583
Source: unknown	Network traffic detected: HTTP traffic on port 63583 -> 443

Source: unknown

HTTPS traffic detected: 104.21.1.209:443 -> 192.168.2.4:63583 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\480495.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAA0.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC95.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICD5.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICF5.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID34.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID93.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDD3.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAF.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDF.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2F4.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI333.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{3E28EEFE-5291-43E1-AA61-E4D35B611491}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9AC.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIAA0.tmp

Jump to behavior

Source: git.exe0.1.dr	Static PE information: Number of sections : 13 > 10
Source: git-cmd.exe.1.dr	Static PE information: Number of sections : 13 > 10
Source: bash.exe.1.dr	Static PE information: Number of sections : 13 > 10
Source: git-bash.exe.1.dr	Static PE information: Number of sections : 13 > 10
Source: gitk.exe.1.dr	Static PE information: Number of sections : 13 > 10
Source: sh.exe.1.dr	Static PE information: Number of sections : 13 > 10
Source: scalar.exe.1.dr	Static PE information: Number of sections : 13 > 10
Source: git-gui.exe.1.dr	Static PE information: Number of sections : 13 > 10
Source: chrome_elf.dll.1.dr	Static PE information: Number of sections : 12 > 10
Source: git.exe.1.dr	Static PE information: Number of sections : 13 > 10

Source: api-ms-win-core-string-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found

Source: app__v7.3.5_.msi	Binary or memory string: tLegalCopyrightCopyright (c) Microsoft Corporation. All rights reserved.L$OriginalFilenameVC_redist.x64.exe vs app__v7.3.5_.msi
Source: app__v7.3.5_.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs app__v7.3.5_.msi
Source: app__v7.3.5_.msi	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs app__v7.3.5_.msi
Source: app__v7.3.5_.msi	Binary or memory string: OriginalFilenamePrereq.dllF vs app__v7.3.5_.msi
Source: app__v7.3.5_.msi	Binary or memory string: OriginalFilenameMsiTempFiles.dllF vs app__v7.3.5_.msi
Source: app__v7.3.5_.msi	Binary or memory string: OriginalFilenameDataUploader.dllF vs app__v7.3.5_.msi

Source: classification engine

Classification label: mal48.winMSI@4/118@1/1

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CMLA8C.tmp

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSI92e8e.LOG

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\app__v7.3.5_.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 01297D2E2EDE3162BB91A5AD2CF048CC
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 01297D2E2EDE3162BB91A5AD2CF048CC	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: app__v7.3.5_.msi

Static file information: File size 57166336 > 1048576

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.1.dr
Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: app__v7.3.5_.msi, 480495.msi.1.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdb source: app__v7.3.5_.msi, 480495.msi.1.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.1.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: app__v7.3.5_.msi, MSID34.tmp.1.dr, 480495.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdbj source: app__v7.3.5_.msi, 480495.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbm source: app__v7.3.5_.msi, 480495.msi.1.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: api-ms-win-core-synch-l1-1-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\tempFiles.pdb- source: app__v7.3.5_.msi, 480495.msi.1.dr, MSIDF.tmp.1.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: api-ms-win-crt-multibyte-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: api-ms-win-crt-environment-l1-1-0.dll.1.dr
Source:	Binary string: D:\git-sdk-64-build-installers\usr\src\MINGW-packages\mingw-w64-git\src\git\git-bash.pdb source: git-bash.exe.1.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: api-ms-win-core-timezone-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.1.dr
Source:	Binary string: D:\git-sdk-64-build-installers\usr\src\MINGW-packages\mingw-w64-git\src\git\cmd\git-gui.pdb source: git-gui.exe.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: app__v7.3.5_.msi, 480495.msi.1.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: app__v7.3.5_.msi, MSIC95.tmp.1.dr, 480495.msi.1.dr, MSIAF.tmp.1.dr, MSICD5.tmp.1.dr, MSIDD3.tmp.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\tempFiles.pdb source: app__v7.3.5_.msi, 480495.msi.1.dr, MSIDF.tmp.1.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: api-ms-win-crt-heap-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: api-ms-win-crt-string-l1-1-0.dll.1.dr

Source: api-ms-win-crt-stdio-l1-1-0.dll.1.dr

Static PE information: 0xF676C81F [Wed Jan 12 13:26:55 2101 UTC]

Source: NVIDIA GeForce Experience.exe.1.dr	Static PE information: section name: .oldntma
Source: NVIDIA GeForce Experience.exe.1.dr	Static PE information: section name: .crthunk
Source: NVIDIA GeForce Experience.exe.1.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.1.dr	Static PE information: section name: .00cfg
Source: libEGL.dll.1.dr	Static PE information: section name: .gehcont
Source: libGLESv2.dll.1.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.1.dr	Static PE information: section name: .gehcont
Source: node.dll.1.dr	Static PE information: section name: .00cfg
Source: chrome_elf.dll.1.dr	Static PE information: section name: .00cfg
Source: chrome_elf.dll.1.dr	Static PE information: section name: .crthunk
Source: chrome_elf.dll.1.dr	Static PE information: section name: .oldntma
Source: chrome_elf.dll.1.dr	Static PE information: section name: CPADinfo
Source: smartgit-updater.exe.1.dr	Static PE information: section name: .xdata
Source: bash.exe.1.dr	Static PE information: section name: .xdata
Source: bash.exe.1.dr	Static PE information: section name: .debug
Source: git.exe.1.dr	Static PE information: section name: .xdata
Source: git.exe.1.dr	Static PE information: section name: .debug
Source: sh.exe.1.dr	Static PE information: section name: .xdata
Source: sh.exe.1.dr	Static PE information: section name: .debug
Source: git-gui.exe.1.dr	Static PE information: section name: .xdata
Source: git-gui.exe.1.dr	Static PE information: section name: .debug
Source: git.exe0.1.dr	Static PE information: section name: .xdata
Source: git.exe0.1.dr	Static PE information: section name: .debug
Source: gitk.exe.1.dr	Static PE information: section name: .xdata
Source: gitk.exe.1.dr	Static PE information: section name: .debug
Source: scalar.exe.1.dr	Static PE information: section name: .xdata
Source: scalar.exe.1.dr	Static PE information: section name: .debug
Source: git-bash.exe.1.dr	Static PE information: section name: .xdata
Source: git-bash.exe.1.dr	Static PE information: section name: .debug
Source: git-cmd.exe.1.dr	Static PE information: section name: .xdata
Source: git-cmd.exe.1.dr	Static PE information: section name: .debug
Source: UnRAR.exe.1.dr	Static PE information: section name: _RDATA
Source: MSID34.tmp.1.dr	Static PE information: section name: .didat
Source: MSI2F4.tmp.1.dr	Static PE information: section name: .didat

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\NVIDIA GeForce Experience.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\chrome_elf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\smartgitc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICD5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\bin\sh.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDD3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\libEGL.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\bin\git.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAA0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\cmd\git.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\cmd\git-gui.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID34.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICF5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\bin\bash.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\smartgit.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2F4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID93.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\node.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC95.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\smartgit-updater.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\jvm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\libGLESv2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\git-cmd.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\UnRAR.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI333.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\git-bash.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\cmd\scalar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\cmd\gitk.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC95.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAA0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID34.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDD3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICF5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI333.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2F4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID93.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICD5.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\NVIDIA GeForce Experience.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\chrome_elf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\smartgitc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICD5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\bin\sh.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIDD3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\libEGL.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\bin\git.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIAA0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\cmd\git.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\cmd\git-gui.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID34.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\bin\bash.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICF5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\smartgit.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI2F4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID93.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\node.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC95.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\smartgit-updater.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\jvm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIAF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\libGLESv2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIDF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\git-cmd.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\UnRAR.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI333.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\git-bash.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\cmd\scalar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\cmd\gitk.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: 480495.msi.1.dr

Binary or memory string: HKEY_USERSRegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1VMware20,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	21 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Timestomp	Security Account Manager	11 Peripheral Device Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\NVIDIA GeForce Experience.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\jvm.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\UnRAR.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-multibyte-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-private-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\chrome_elf.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\bin\bash.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\bin\git.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\bin\sh.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\cmd\git-gui.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\cmd\git.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\cmd\gitk.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\cmd\scalar.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\git-bash.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\git-cmd.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\node.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\smartgit-updater.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\smartgit.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\smartgitc.exe	0%	ReversingLabs
C:\Windows\Installer\MSI2F4.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI333.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIAA0.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIAF.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIC95.tmp	0%	ReversingLabs
C:\Windows\Installer\MSICD5.tmp	0%	ReversingLabs
C:\Windows\Installer\MSICF5.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID34.tmp	0%	ReversingLabs
C:\Windows\Installer\MSID93.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIDD3.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIDF.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://sizzlejs.com/	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://jquery.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
check-key.com	104.21.1.209	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://check-key.com/licenseUser.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	git-gui.exe.1.dr, git-bash.exe.1.dr	false	URL Reputation: safe	unknown
https://check-key.com/licenseUser.phpDoAppSearchExAI_SET_RESUMEAI_SET_INSTALLSendCollectedDataAI_Ext	app__v7.3.5_.msi, 480495.msi.1.dr	false		unknown
https://sectigo.com/CPS0	git-gui.exe.1.dr, git-bash.exe.1.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	git-gui.exe.1.dr, git-bash.exe.1.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	git-gui.exe.1.dr, git-bash.exe.1.dr	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	git-gui.exe.1.dr, git-bash.exe.1.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	git-gui.exe.1.dr, git-bash.exe.1.dr	false	URL Reputation: safe	unknown
http://docs.jquery.com/License	app__v7.3.5_.msi, 480495.msi.1.dr	false		unknown
http://sizzlejs.com/	app__v7.3.5_.msi, 480495.msi.1.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	git-gui.exe.1.dr, git-bash.exe.1.dr	false	URL Reputation: safe	unknown
http://https:///true1...	chrome_elf.dll.1.dr	false		unknown
http://webreflection.blogspot.com/2007/08/global-scope-evaluation-and-dom.html	app__v7.3.5_.msi, 480495.msi.1.dr	false		unknown
http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor	app__v7.3.5_.msi, 480495.msi.1.dr	false		unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	git-gui.exe.1.dr, git-bash.exe.1.dr	false	URL Reputation: safe	unknown
http://erik.eae.net/archives/2007/07/27/18.54.15/#comment-102291	app__v7.3.5_.msi, 480495.msi.1.dr	false		unknown
http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript	app__v7.3.5_.msi, 480495.msi.1.dr	false		unknown
http://javascript.nwbox.com/IEContentLoaded/	app__v7.3.5_.msi, 480495.msi.1.dr	false		unknown
http://jquery.com/	app__v7.3.5_.msi, 480495.msi.1.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.1.209	check-key.com	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523421
Start date and time:	2024-10-01 15:50:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	app__v7.3.5_.msi
Detection:	MAL
Classification:	mal48.winMSI@4/118@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msi Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: app__v7.3.5_.msi

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
check-key.com	app__v7.1.7_.msi	Get hash	malicious	Unknown	Browse	172.67.129.237

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://www.dropbox.com/l/scl/AADL_v5DzsoHwkyegIhk6J0bQm3A7UWklCA	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://k7qo.sarnerholz.cam/APRjVfmk	Get hash	malicious	Unknown	Browse	172.67.179.163
	asegurar.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	dcsegura.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	188.114.97.3
	asegura.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	grace.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	e.dll	Get hash	malicious	Dridex Dropper	Browse	104.21.69.9
	Sales_Contract_Main_417053608_09.2024.pdf	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://pt9w4x.nauleacepr.com/9QLzRhIr/#Ygovernment.relations@rolls-royce.com	Get hash	malicious	HTMLPhisher	Browse	104.18.86.42
	https://vwkugoia0yciq0buttompanj2.ntvultra.com/viciorhthvgh/forhwural/coupletri/QdhahVchT/yEjbKM/anNhbGFzQGhvbGxhbmRjby5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	e.dll	Get hash	malicious	Dridex Dropper	Browse	104.21.1.209
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.21.1.209
	Passport.vbs	Get hash	malicious	Unknown	Browse	104.21.1.209
	Aj#U00e1nlatk#U00e9r#U00e9s 09-30-2024#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	104.21.1.209
	18000012550_20240930_0078864246#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.1.209
	PRORA#U010cUNSKA ZAHTEVA 09-30-2024#U00b7pdf.vbe	Get hash	malicious	GuLoader, Lokibot	Browse	104.21.1.209
	A 413736796#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.1.209
	Solicitud de presupuesto 09-30-2024#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	104.21.1.209
	SOLICITUD DE PEDIDO (Universidade de S#U00e3o Paulo (USP))09-30-2024#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	104.21.1.209
	Recibo de transferencia#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.1.209

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\NVIDIA GeForce Experience.exe	app__v7.1.7_.msi	Get hash	malicious	Unknown	Browse
	app__v5.20.03.msi	Get hash	malicious	Unknown	Browse
	app__v6.25.3_.msi	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\jvm.dll	app__v7.1.7_.msi	Get hash	malicious	Unknown	Browse
	app__v5.20.03.msi	Get hash	malicious	Unknown	Browse
	app__v6.25.3_.msi	Get hash	malicious	Unknown	Browse
	app__v6.20.9_.msi	Get hash	malicious	Unknown	Browse
	app__v6.20.5_.msi	Get hash	malicious	Unknown	Browse
	app__v6.20.0_.msi	Get hash	malicious	Unknown	Browse
	app__v6.15.9_.msi	Get hash	malicious	Unknown	Browse
	launch-v3.17.msi	Get hash	malicious	Unknown	Browse
	x64__installer___v4.8.6.msi	Get hash	malicious	Unknown	Browse
	x64__installer___v4.7.5.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\480497.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	337166
Entropy (8bit):	6.899647537964628
Encrypted:	false
SSDEEP:	6144:nX5b5U2MBVOUMgdkhVYPph0lhSMXlBXBW/yX8H:X5b5tMjOUMgcsph0lhSMXle48H
MD5:	A82F9FE5258B71FCF8326CBDE4AF70AB
SHA1:	F796FC8B21558ABC7F497755DBAB5C6AE70A5253
SHA-256:	79EB81ADF4F85A8429B41975A5315C34B20157176E7C9133C6CC4C8840868FDA
SHA-512:	AEC8D045C335D89CF627333FAC39018DF3E0C3DC84350645372D7B04882BB85187D54B5F21ED2F672E700D252E7D0E75499AB69E6ACC62DCABDD25BF8EF28553
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.NAY.@.....@.....@.....@.....@.....@......&.{3E28EEFE-5291-43E1-AA61-E4D35B611491}..NoqotApp..app__v7.3.5_.msi.@.....@.....@.....@......icon_35.exe..&.{EE3A39B9-5A50-459E-950A-80F951511BDC}.....@.....@.....@.....@.......@.....@.....@.......@......NoqotApp......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....AI_RemoveAllTempFilesL...AI_RemoveAllTempFiles.@......h...MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4..pp.#p.#p.#..."{.#..."..#..."f.#vR."b.#vR."g.#vR."?.#..."..#p.#..#.R."`.#.R."q.#.RX#q.#p.0#q.#.R."q.#Richp.#................PE..L...m.e.........."!...&..................... ............................................@A....................................<.......................h:..........@c..p....................c.......b..@............ ...............................text............................... ..`.rdata...v... ...x

C:\Users\user\AppData\Local\Temp\MSI92e8e.LOG

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\box-add-remove.svg

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	26747
Entropy (8bit):	5.3354839574811335
Encrypted:	false
SSDEEP:	384:rIZA1hRLR3Cf1dvsv6Qsmhifm5wGEvLvE7uVd5bATX:sZArRLR3Cf1dv23iwwbvLaO5b0X
MD5:	E4233A59C354B105D6A2C0E1C2BEA05A
SHA1:	85DE6D31D2428535344753A4A13EFE1162BE3FCF
SHA-256:	A933EACC4A326A88BE0EB49C6D1A1775ADD2ECC3CA777409DF5124355B5B674E
SHA-512:	C0765E062678CA96FCD2B034889B056BDB077089048E056D730D222D81E47BEC953FD71451A650F1F592CC6E14ECDBA85B4ECCE5404F629323652C0174FE440C
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 26.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 55 55" style="enable-background:new 0 0 55 55;" xml:space="preserve">..<g>...<g>....<linearGradient id="SVGID_1_" gradientUnits="userSpaceOnUse" x1="2.7994" y1="32.6842" x2="40.5625" y2="33.9325">.....<stop offset="0" style="stop-color:#E66966"/>.....<stop offset="0.1096" style="stop-color:#D9575C"/>.....<stop offset="0.374" style="stop-color:#BF3246"/>.....<stop offset="0.6191" style="stop-color:#AC1636"/>.....<stop offset="0.8354" style="stop-color:#A0062C"/>.....<stop offset="1" style="stop-color:#9C0029"/>....</linearGradient>....<path style="fill:url(#SVGID_1_);" d="M2.662,11.042v38.362l6.77,5.136V14.855L2.662,11.042L2.662,11.042z"/>.........<linearGradient id="SVGID_00000020358057779141704330000004975

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\box-custom.svg

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	28807
Entropy (8bit):	5.315787365057691
Encrypted:	false
SSDEEP:	384:rIGhalxkwE48I3Tdv/ygyy/mhifV4wGEvLSAdB5cRCW7:s0alxa48I3TdvqBiOwbvLSsB5cRCW7
MD5:	A0A6276BAB21E14FE618DB774B52D3BD
SHA1:	488923D19D0DBAABC3A4732E9318003C2AA353F4
SHA-256:	83B8B86445C41B8B832BEA1A4F80A51E42A7B810E7F30E6E41F22F279CDB88B0
SHA-512:	4D53F275DFC480234C3325BAC52B70859063C38A4D9C60D71FADCABF5E1104001B8AF90385DBF1E8EF3186FD70C780FB6423D90AD8C70A4EEE2F57C8B5174E48
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 26.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 55 55" style="enable-background:new 0 0 55 55;" xml:space="preserve">..<g>...<g>....<linearGradient id="SVGID_1_" gradientUnits="userSpaceOnUse" x1="2.7994" y1="32.6842" x2="40.5625" y2="33.9325">.....<stop offset="0" style="stop-color:#E66966"/>.....<stop offset="0.1096" style="stop-color:#D9575C"/>.....<stop offset="0.374" style="stop-color:#BF3246"/>.....<stop offset="0.6191" style="stop-color:#AC1636"/>.....<stop offset="0.8354" style="stop-color:#A0062C"/>.....<stop offset="1" style="stop-color:#9C0029"/>....</linearGradient>....<path style="fill:url(#SVGID_1_);" d="M2.662,11.042v38.362l6.77,5.136V14.855L2.662,11.042L2.662,11.042z"/>.........<linearGradient id="SVGID_00000113319978603717769910000001732

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\box-remove.svg

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	5.183881650609288
Encrypted:	false
SSDEEP:	48:cdA+fEthxLBHzeNZRYJZRjFZRvneCK8+yaEnd7mzMtVqaXb:n+fY16zRARXRvn5+ya+mzMnqaXb
MD5:	B51E84774C92901C3E1A49F8F5B18A96
SHA1:	56D4D2F94659D78710DE25698689CEDB7770503A
SHA-256:	BC63A6B83A8D1E01A893928993C9F5B78E858ED296EB54A1D6F2307B1661AC2D
SHA-512:	0DD491DD30A7975F60202E0BC2135EFF99ED17F609825FD27516AAC69DE525177A0C186EB613C59BE6B080A2AB117EDB34B1B318B2F428306511F782608ADA93
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 26.3.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 64 64" style="enable-background:new 0 0 64 64;" xml:space="preserve">..<style type="text/css">....st0{fill:url(#SVGID_1_);}..</style>..<g>...<linearGradient id="SVGID_1_" gradientUnits="userSpaceOnUse" x1="32.0331" y1="2.5219" x2="32.0331" y2="60.8651">....<stop offset="0" style="stop-color:#F46362"/>....<stop offset="0.3527" style="stop-color:#F44352"/>....<stop offset="1" style="stop-color:#F4002F"/>...</linearGradient>...<path class="st0" d="M51.636,60.401c0.363,0.435,1.013,0.473,1.429,0.088l2.911-2.695c0.333-0.308,0.419-0.799,0.205-1.199....c-2.849-5.319-6.015-10.82-9.535-16.447c-1.765-2.821-3.539-5.522-5.311-8.148c1.772-2.627,3.546-5.327,5.311-8.148....c3.519-5.625,6.685-11.125,9.534-16.443c0.215-0.402,0.

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\box-repair.svg

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	37689
Entropy (8bit):	5.176993624414914
Encrypted:	false
SSDEEP:	768:67k5QBiAOW4Wv9joq6mpfffdKPVvuSj3Lr+msDraLFYhbFbYDDt:67Vv9j9lpFCvuSz3+m2raRYhpYDDt
MD5:	AD66115932D13485A903559A84480CC9
SHA1:	375A953AC6EA44DF55201BDD35492A3B41C031A9
SHA-256:	D27AC020D37E20DF41F2E9CC8B6BE836FA2F9D9B7223EF516981674AFCBE3138
SHA-512:	EC7C22FB201C275D8F14120169363F2DEE8C800AF0A9850704BFBA078064DEE3B4D26C7C1D3F6DA119A8A7F3228BDE5AA63307FDDDD7DFE810229C5DCFF993DB
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 26.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 55 55" style="enable-background:new 0 0 55 55;" xml:space="preserve">..<g>...<linearGradient id="SVGID_1_" gradientUnits="userSpaceOnUse" x1="3.1613" y1="32.687" x2="40.6639" y2="33.9268">....<stop offset="0" style="stop-color:#E66966"/>....<stop offset="0.1096" style="stop-color:#D9575C"/>....<stop offset="0.374" style="stop-color:#BF3246"/>....<stop offset="0.6191" style="stop-color:#AC1636"/>....<stop offset="0.8354" style="stop-color:#A0062C"/>....<stop offset="1" style="stop-color:#9C0029"/>...</linearGradient>...<path style="fill:url(#SVGID_1_);" d="M3.025,11.195v38.098l6.723,5.1V14.981L3.025,11.195L3.025,11.195z"/>.......<linearGradient id="SVGID_00000057132565685308545930000003367873453350078114_" g

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\box.svg

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	19901
Entropy (8bit):	5.359272233659334
Encrypted:	false
SSDEEP:	192:rISMtDmDRC3Mi0s0AfVsC3uXfBC3phfx70AcSiHQsfhuyCniBqSiSVOLC6tMne7w:rI5QAluap0T5BnY7Eqw
MD5:	F7F3379FF3A90C3BA70CA47E579C17EE
SHA1:	267FBE1FBE06B5927A2662F546764E7A3426206F
SHA-256:	B169D8F11915957D649537E2940640ACD970F09154E37047A7A90C84380CA3D0
SHA-512:	CC8D701618371B02DD30DF2E38CB530231FF6CC29BA201FE88988CA5A2AC9C093B4505796ED6471972D11AD7FC5A7F84DCD2D543424686911CDCE105471D886B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 26.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 55 55" style="enable-background:new 0 0 55 55;" xml:space="preserve">..<g>...<g>....<linearGradient id="SVGID_1_" gradientUnits="userSpaceOnUse" x1="2.4959" y1="32.6243" x2="40.6352" y2="33.8851">.....<stop offset="0" style="stop-color:#E66966"/>.....<stop offset="0.1096" style="stop-color:#D9575C"/>.....<stop offset="0.374" style="stop-color:#BF3246"/>.....<stop offset="0.6191" style="stop-color:#AC1636"/>.....<stop offset="0.8354" style="stop-color:#A0062C"/>.....<stop offset="1" style="stop-color:#9C0029"/>....</linearGradient>....<path style="fill:url(#SVGID_1_);" d="M2.357,10.767v38.745l6.837,5.187V14.618L2.357,10.767L2.357,10.767z"/>.........<linearGradient id="SVGID_0000012918401183422795151000001667

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\client.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.814970259904566
Encrypted:	false
SSDEEP:	24:KICMXqAnYhh7dkJemL/xJX4yQgG7gut32F32P7r/:7CMaAnWZkJLLJ50gUP7r/
MD5:	0B032D476A15E3AD6B7C2AF32DF30AC3
SHA1:	516548A73154E5D7CE00D1675F6189DCB387349C
SHA-256:	70D37345D5BD33B4CA94967AC61C076483EB08B5B04F5E47DD5D5D27DA723DF7
SHA-512:	1F9076CAA6AE7F94D5B3E7254897B9A5F975EC7B035CE54C838D8C609146FB44F942D3E46BE669EB439CB08FD9985B1A5AAABAB7AC40ED8C907101F80EDF5FBA
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z.n.D.>..j..HM...H.7o...z.....nA....pG.....I%..JU.MP..J.M..w7...yms.k.......TK....w.\|....q.8....".\|{....X.+.&.y9&.....g.....w........`e...../..Y..m.{....Q`..........+m...~.jo..,.7q....7...g9..A...>9...2..C..=.k:....N.vq.s..Z ..P.....glx..tPFci..u....z..G.t. "..A......o..8....%..X0.6...9<...t.d6N5.:V. ..%B...,h'.:...G-.....K..%...B.....$>E\..D.cZ..oj.C)3....(.`I.t...s.{.p\|..1.>h.q.........(.....t........'.....oP......K..w.v7..h..6.^.x..N..) U.K.o....y.(<.m.~J..A`..........Kd..U.b....m......N...z>...P.GI.1,u.o.....S...%.u..u;.0....p"....o...>.H....O..i.U..b./@.~..x...E.]/ I.f..H....t....}f.}t..=.F..."R.29E.PH.....y..t.@o.'P..,b..x...w.3Q....l.Q.f.@..p..D..s...Q...=.}..8n/.oY.GO..QYC^7^..f../B..."f5.D.J.'..h.8O..`.4*@.z....H,.K.7B.Cx.......(.....8.D.s...A{...O.......Y....3.....Z.$.t....12.>x..N.M.M.K..E..7s.....:....._-.&....BA.....s.......\|O..".}...=.A...D..s

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\client_server.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2584
Entropy (8bit):	7.905292564018653
Encrypted:	false
SSDEEP:	48:9Nsd2bBUbReocfMr1yj++j2qqsZ3HQlav4bkbwXcyj0jSog9T1Z7TDGxaq509:9KkbBUsLA1A++j2qJgQvykbwXh9TfWaF
MD5:	60599D91309C3B10CD32466B4ADB6ED5
SHA1:	8AE7FCFEC7A98A8EA8539AAB7D7F998089D1812A
SHA-256:	73AB28B0A5645771DE997A98ADE3035C8A89F71C6A423151CF340C1107EB30C5
SHA-512:	15CCA1EFAD369819F1F23D06DA1A6D9A6170E3B476FADD033F1122138FDD5393A8D456FF154B442C08952D6CC54B13369CCD42ED71AE2272D793035C312A21F3
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Zkl...>3.k{..a...LCS.5Mb...VI.#.#.$m...QA..._....UU.$U%......".B.IZ... .......o{...^.......;{gvfm.v.t.3.3..;.;..s..Dkkk3.....!.....m%%%TVVF.MMFdrr...^....4.<..B...g/..b.......R."...H..k...y...4.....tK.xzz....h&..L.(\q..d..>......../..Hn..:.../Zq.j.c....Q....5.y.df....i.W.S....O..6...,....)$R_[K.[..s\.H&.N. q....IJ.k0.?.\]..fH......z..N$..7.o.V.......<..H......p........k.E....u..4..'........`..RY`..N..D...RF.............LP+.!3...p&..s2.e......M.g.F).e.{_._..+..9....&.t........u+...r.._A......#.Hha.O(....k.Y........"...yo3.?.L.............6...E..]]]....9..7....q.Pq..((...=.=&R..=.].[.E.......JG.8b.)...B.lR.g.'.LZ... `:^.`k!M...e/..;.D,R.....u.!EZ.s.X...Z`K.hz.ut...O...sg.Z.YN.abc$2`.....%.....}.3B}.Q"....-..K.^8..&.R.m.PF!......c.........=......Ff.....g.R..H...eN..\|....~.t.......?I....d.an#.\.....y....i.....{... .[...Ht.I.y}!.<...m......\M...x.4.g..}..K....S.qs..

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\common.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5838
Entropy (8bit):	5.02136799597797
Encrypted:	false
SSDEEP:	96:oeKghsj0bGR+xONq25eEx3q2D49yF8ZkRCFVpyF8ZkRCFPd+OfSt782IRDFCW4bi:oL+0Nq25eEtq2D49yF8ZkRCXpyF8ZkRa
MD5:	6FD78642C7ACC8F3B9FF84A4EB025D0D
SHA1:	AE3E6ED196ED04791EAB9376123B815F44CE6EC3
SHA-256:	4AA199C837F68EFA9C87C335ECCE80021D70428EB9BEA1C5AB0AC56679C53A27
SHA-512:	0F33ABDD98ADB77F9D028581B06486C9CE3EFBDE2E45AAA6A57829E7BCBD7F8C58291E5B4DB5B335ADA49E9BCE242D7CC292D7B834F8B4624020DB7DDEC4574F
Malicious:	false
Preview:	function InitPage() {. //alert('init');. //document.getElementById('main').style.zoom = external.GetFontHeight() / 16;.}..function AddCss() {. var css =. ['.buttonwrapper a [\\{]',. ' background-image: linear-gradient([AiWinUIBtnNormalBkgColorStart], [AiWinUIBtnNormalBkgColorEnd]);',. ' border-color: [AiWinUIBtnNormalBorder];',. '[\\}]',. '.buttonwrapper a:hover [\\{]',. ' background-image: linear-gradient([AiWinUIBtnHoverBkgColorStart], [AiWinUIBtnHoverBkgColorEnd]);',. ' border-color: [AiWinUIBtnHoverBorder];',. '[\\}]',. '.buttonwrapper a:active [\\{]',. ' background-image: linear-gradient([AiWinUIBtnPressedBkgColorStart], [AiWinUIBtnPressedBkgColorEnd]);',. ' border-color: [AiWinUIBtnPressedBorder];',. '[\\}]',. '.buttonwrapper-disabled a, .buttonwrapper-disabled a:hover, .buttonwrapper-disabled a:active [\\{]',. ' background-image: linear-gradient(#F5F5F5, #CACACA);',. ' border-color: #F4F4

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\customize.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	3619
Entropy (8bit):	4.982952047079098
Encrypted:	false
SSDEEP:	48:zLPp5ag9yPlhVq9uO2XJpYzO65UjV52MiQt/dlxhytbU83nNnkz5:zTd4P3YUvXJparUzpFnQVBBg
MD5:	39CF7DF8CDEDEEC28C1D7B655E71BD25
SHA1:	DE3E869800795270FBFCB566A3378B729171C8D6
SHA-256:	0128132AA9E0883FD743245CEFF4709B87EC41976ACDA73221B76D20F8D16796
SHA-512:	A6D72CF0E5D1C23EB7615A0BA75F4C74FBD629F5DFDAB896B34E8AC14D3C493E642F54F12FEB13FC7F5DBB155C1461CAEDF0717CEC5D55E802F12B164C1C1E92
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">. //hook the window load event ("event" argument will be automatically populated by standard browsers). //background: url(background.jpg) no-repeat;. $(document).ready(function () {.. //AddCss();.. /* START XXX */.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');. UpdateBackGroundInd("OptionsLogoIcon", 'logo');.. ResolveTag("p");. ResolveTag("h1"); ResolveTag("span");..

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\diskcost.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	2340
Entropy (8bit):	4.980828192947993
Encrypted:	false
SSDEEP:	48:zLPp5ag9g7VlJpYzO65ULwrgt/dlxhyWTUZL5:zTdK7vJparUXFnQJF
MD5:	EB958A7CA48566DC3E07741FD2FBBF65
SHA1:	A28FFAEAE1565121C87692EA7D0FB87B25709574
SHA-256:	28D467446EDF18B240F8A027B1EFC1AD0B37088B0484F1C2F583E4849B06B2BF
SHA-512:	AD45E4AD9FE16BB786562BF57B3621115311CAF711AAAAE69037F829FEC4A9B9F79F52B493C3A6222E859A1C0CCEE446FC7F4D43A29144CFE657A4A137EB9FF7
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">. //hook the window load event ("event" argument will be automatically populated by standard browsers). //background: url(background.jpg) no-repeat;. $(document).ready(function() {.. /* START XXX /.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');.. ResolveTag("p");. ResolveTag("h1"); ResolveTag("span");.... . ShowFooter();.. / END XXX */.. }); . </script>.. .<

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\exit.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	3484
Entropy (8bit):	5.043990447060793
Encrypted:	false
SSDEEP:	48:zLPp5ag9mAcmswVRDSwyK9YTn/JODTVG9txwxBD9/wx1JpYzO65UreqsbVmuVc/P:zTdB/bTy+YTnBO0texBmx1JparUM84un
MD5:	730AB3B96EF0973F474B48A4C19323E0
SHA1:	DE4768E07749B2D399E2941CD644E30C105D2D11
SHA-256:	5D78C6FD1B68EDD9B64F839DF40299ADF34F94E8D00A1617A8483304C8C8FA6D
SHA-512:	04AC0BBFF22A4346DC06A983E8DF154EADE8880DE076B979AC03097B15FAD1C5D4D4B49C9EF64577354640D4A8B241C47A99352C7D6AAA3A1A92B881FFF917E9
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">. //hook the window load event ("event" argument will be automatically populated by standard browsers). //background: url(background.jpg) no-repeat;. $(document).ready(function() {.. /* START XXX */.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');. UpdateBackGroundInd("AppLogoIcon", 'logoBig');.. ResolveTag("p");. . . var a = ['ViewReadme', 'RunApp', 'leftBtnA', 'le

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\fatalerror.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	3539
Entropy (8bit):	4.950614686768222
Encrypted:	false
SSDEEP:	48:zLPp5agMYVgg8p2VC/N8B2AKTVJpYzO65UC6i3HzGikXSAZ1SVuZ6+VXr5:zTdf3VCH5JparUnDZ1SMV
MD5:	57126AA48593F77C24561C16AA16E7D7
SHA1:	BED90CD32D122FBC579749B3B679C7A61E013359
SHA-256:	239BE5ABD30921EFA432667A06D71031337EBC89E4B6861BFC5FD05A6950F6BF
SHA-512:	1DEC62BAD1B76BB84AA2027CA8EC9CE454824E0196529BDD5BF88101B634E65DB0010A1DB321E0E910B7051566B4664BA15356C86FD4BBF1935F6EBBF8B88FF4
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">. //hook the window load event ("event" argument will be automatically populated by standard browsers). $(document).ready(function() {.. /* START XXX */.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');.. ResolveTag("p");. ResolveTag("h1"); ResolveTag("span");. ResolveTag("label");.. . ShowFooter();.. if (external.MsiGetProperty('MsiLogFileLocation') != ''). {.

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\fileinuse.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	2858
Entropy (8bit):	4.90429928319433
Encrypted:	false
SSDEEP:	48:zLPp5ag9EVlJpYzO65U9ot/dlxhyW3n/nBsHCnf5:zTdevJparUyFnQwvVR
MD5:	6511105E765CE94971884F48417C529E
SHA1:	44FF77BF86E089D925458E0133221D69DA59598B
SHA-256:	89CB1F857DA87A327EBD76D90F597236EBA53874020D429F4863425456703EC6
SHA-512:	5B3D26EC9DF414E50B539F1CA435BD52DD99AE6930D091835823C5484BA0E865CCB014D766B65ED793E2759F37C0EF2EADFE44915C5E6D7E8DB864CD3F019C55
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">. //hook the window load event ("event" argument will be automatically populated by standard browsers). //background: url(background.jpg) no-repeat;. $(document).ready(function() {.. /* START XXX /.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');.. ResolveTag("p");. ResolveTag("h1"); ResolveTag("span");.. . ShowFooter();.. / END XXX */.. }); . </script>.. .</h

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\folder.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	3731
Entropy (8bit):	4.9162927521080615
Encrypted:	false
SSDEEP:	96:zTdqiPvTYUvRXJparUziEnFnNVrNyE2Og:zTzvMUvZJQxEFn3rNyEA
MD5:	F98734B05585021B999FD7C08CDF862B
SHA1:	188C454789F394632A04CF8685AEA3EBAEF0006C
SHA-256:	10DB02ACE8789FBDA8AE69D3C2BBE8A1ED183F9BFB2E48F33A98675F86632BD2
SHA-512:	C2A685865A9D3FE319B238A54574C793DC6F1BC0EC17E718271052CF883061A6D4937A6E3053D4A35BEA0FC48573D140708B395D6529E597CF4BC9BE87A468D5
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">. //hook the window load event ("event" argument will be automatically populated by standard browsers). $(document).ready(function () {.. /* START XXX */. //AddCss();.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');. UpdateBackGroundInd("FolderLogoIcon", 'logo');.. ResolveTag("p");. ResolveTag("h1"); ResolveTag("span");.. UpdateSizeText("PrimaryVolumeSpaceRequired");.

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\jquery-1.3.2.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	120620
Entropy (8bit):	5.109145394377532
Encrypted:	false
SSDEEP:	3072:EO7GGNN7ukzX4EWkM99n5KLthpRtPYw/J1vYhUhTikv5n:3GGNN7ukzXDWkan5KLthpRtPTvYhUheO
MD5:	1CD76A83827E0D47B80EBCBBC8CD9262
SHA1:	AA1BABB2D7C3E9DFFC0FB2A1DB939CB948E784DB
SHA-256:	1191EB52C0B19D7A8738B128AB3EC531BDE862D94F07E6F7F6267F7D6E7C94D5
SHA-512:	0FC067649D28A13E3DA9B692DF30DCB9B903C9EBD9CB0184D54A0AAD35A2C56F1D74D84C29D9A441750D3955F1AAB04914E7B365BAAE4BD7AF2EE913131873E3
Malicious:	false
Preview:	/!. jQuery JavaScript Library v1.3.2. * http://jquery.com/. . Copyright (c) 2009 John Resig. * Dual licensed under the MIT and GPL licenses.. * http://docs.jquery.com/License. . Date: 2009-02-19 17:34:21 -0500 (Thu, 19 Feb 2009). * Revision: 6246. /.(function(){..var ..// Will speed up references to window, and allows munging its name...window = this,..// Will speed up references to undefined, and allows munging its name...undefined,..// Map over jQuery in case of overwrite.._jQuery = window.jQuery,..// Map over the $ in case of overwrite.._$ = window.$,...jQuery = window.jQuery = window.$ = function( selector, context ) {...// The jQuery object is actually just the init constructor 'enhanced'...return new jQuery.fn.init( selector, context );..},...// A simple way to check for HTML strings or ID strings..// (both of which we optimize for)..quickExpr = /^[^<](<(.\|\s)+>)[^>]$\|^#([\w-]+)$/,..// Is it a simple selector..isSimple = /^.[^:#\[\.,]$/;..jQuery.fn = jQuery.prototype

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\maintwelcome.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	2691
Entropy (8bit):	4.939355224213893
Encrypted:	false
SSDEEP:	48:zLPp5ag9mASVXJpYzO65UjT5Mkvir5H4SAZ1SVFNUZkd5:zTdBSRJparUBMJQZ1SnOQ
MD5:	E0ECBFC1FB725F4A2A3A616DF1FD2B2F
SHA1:	24D6B16ECF1F69A28A767349C778F4AC8B3CA748
SHA-256:	D372D272372832274295CA3ECE0D1D40F2799461C34B533AA5CE8A336AF5485D
SHA-512:	A5E2049A3D7AD0C4DF13A399C333DBEBBBBDF7445DC554E3FCAC71832BFBC26BD75FCD065A63EB65BAEBB595ED29F6E061F6AF7D3EF06E681183F2AF83A9687E
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">. //hook the window load event ("event" argument will be automatically populated by standard browsers). //background: url(background.jpg) no-repeat;. $(document).ready(function() {.. /* START XXX */.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');. UpdateBackGroundInd("AppLogoIcon", 'logoBig');.. ResolveTag("p");. ResolveTag("h1"); ResolveTag("span");.. . ShowFooter()

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\maintype.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	4.932674509479676
Encrypted:	false
SSDEEP:	48:ztEPp5agLHgVYqFzNzrsbqFzNzrAegqFzNzrA65UCbdaqYX9qzfvqP3nAZxRVCYI:zAdUyWJEWJMegWJhUzqYX9qjqfMxuYzc
MD5:	A618BBFA9B14D73B93DA0A4166A5C6C6
SHA1:	BDB58533EBF5B431259D779E9BB6350CEF254C47
SHA-256:	25787D8A23C653E73ADCBF31A2B09D378A6E8A7DEC9547DE35482D2BEA335B90
SHA-512:	CB9B7013E303F0876D83F9AE837D0DF67758C89F81419D92CF4DA52562A9BC2BEA1186520A84D52F4E857F1265994007EDDA2BECEB077A0384DC231DA23F5A35
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Choose Installation Type</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">. $(document).ready(function() {.. /* START XXX /.. ResolveTag("p");. ResolveTag("h1");. ResolveTag("span");. ResolveTag("b");.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');.. . ShowFooter();.. / END XXX */.. $(".install-now a").hover(function() {. $(".install-now img")... .animate({ top: "-8px" }, 200).animate({ top: "0" }, 200

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\outofdisk.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	2331
Entropy (8bit):	5.016398875636578
Encrypted:	false
SSDEEP:	48:zLPp5ag7EVlJpYzO65UZi5Rt/dlxhyWTUZL5:zTd4vJparUyFnQJF
MD5:	E1A03DB0EA99EB0CF13E7B371F7047BB
SHA1:	253860F507AB65AC253C3485C95A9F821079C7CB
SHA-256:	BF443CD03FBC66E6D9CC3F466449E764B19F62257BFFB0DDAF5587FFA1B3EB67
SHA-512:	E03D96A0F00B5260733954BC4BFAE1D3D479385C695414AE92AAB9A9C6C6B055D2CB87576E67E1156A5F5A0C336514358188E1D73498F8FAB5F5F31901EFCEF2
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">..//hook the window load event ("event" argument will be automatically populated by standard browsers)..//background: url(background.jpg) no-repeat;. $(document).ready(function() {.. /* START XXX /.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');.. ResolveTag("p");. ResolveTag("h1"); ResolveTag("span");.. . ShowFooter();.. / END XXX */.. }); . </script>.. .</head>.<

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\outofrbdisk.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	2706
Entropy (8bit):	4.951911542547178
Encrypted:	false
SSDEEP:	48:zLPp5ag9WV1JpYzO65UJJpxyt/dlxhyW3nUUZCv5:zTdkfJparUaFnQwzG
MD5:	656360A7744929E298FCDD7E2A08EE5A
SHA1:	91A4088D5C6DAC24E18C54534FED7A512F39B7C7
SHA-256:	6AA4B72CE9DBE46C11972BAB7E424D7AC178F565D1BEC3B07B545EECF32FA793
SHA-512:	2A1B6097D0FB1DEF074D196D9827111F140C57E5EBB8A85C8495A4ECE937A6E56B55AC7783A241C3C91CEA8BE8B2C6E56B2164727B47FB297C2422877E49DACE
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">. //hook the window load event ("event" argument will be automatically populated by standard browsers). //background: url(background.jpg) no-repeat;. $(document).ready(function () {.. /* START XXX /.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');.. ResolveTag("p");. ResolveTag("h1"); ResolveTag("span");.. ShowFooter();.. / END XXX */.. });. </script>...</head>.<body

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\prepare.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	2177
Entropy (8bit):	4.998687193308299
Encrypted:	false
SSDEEP:	24:WC7IsHE8e85mfNVvqL6NVvgKVgd7af42vyVuwDRRDcRRQHUWJpYCiD665UCQW+4S:zLPp5agMbyV5fcM9JpYzO65UCQigQA5
MD5:	7AAD09B92691FEABC1D45BF368C15099
SHA1:	FF8633BA6ECFD532717F8ACC3427096072235C61
SHA-256:	2D04B2ABEC491A6ECA4D16CBFB88D1D0C67D39A5FB242F90C6FB6A68200DC7F2
SHA-512:	4AC8A7A84494CB588940205AB17C141F9BDAB2D57D34F25586878F7A9F31533C83F2D2FF8C649FF270559B05E68F2B746F19D8EC4C2CB5ED475C066CC4CA6667
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">. //hook the window load event ("event" argument will be automatically populated by standard browsers). $(document).ready(function() {.. /* START XXX /.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');. UpdateBackGroundInd("WaitLogoItem", 'logo');.. ResolveTag("p");. ResolveTag("h1"); ResolveTag("span");.. . ShowFooter();.. / END XXX */.. });.. function Actio

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\progress.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	3410
Entropy (8bit):	4.990740003407333
Encrypted:	false
SSDEEP:	48:kLPp5hwb1iDJdJkHtzb2yVd0c1g0AoJpYzO65UFV5nUsqIHnrjrBDB29gndUZkc5:kTKNOyBioJparUt3eP
MD5:	AC02EE32364FF47DAD57C1EC35BE36C5
SHA1:	94ABEFBD12AA7C8315389186698CFFA547BB2F6F
SHA-256:	5CFE0F66AC72A5E7213458D0D287CB20B58AABF955762156E487CA4B95D43D70
SHA-512:	CAD55C6C1FFEB6CA5F819205B0325518EC11696BFAC67E7D612DD1FDE51A25CA3C67551339827B7F060A6C276A8DCEA849C75726840688C3FE4B0D3FAA0DDDDE
Malicious:	false
Preview:	.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />. common links-->. <script type="text/javascript" src="jquery-1.3.2.js"></script>. <script type="text/javascript" src="common.js"></script>. progress bar links-->. <link type="text/css" href="progress/progressbar.css" rel="stylesheet" />. <script type="text/javascript" src="progress/progressbar.js"></script>. <script type="text/javascript">. //hook the window load event ("event" argument will be automatically populated by standard browsers). $(document).ready(function () {.. /* START XXX */.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\progress\progressbar.css

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	388
Entropy (8bit):	4.602481116077253
Encrypted:	false
SSDEEP:	12:URBBzZ9WgzD1I2EFQGa/88mTzzUMtfy9ZEZm9W88r50opI2EY:eBzZ9pzqFM/ezRtfAZUAU5QY
MD5:	0A524F0B0D68025A96F12BBE88DC510C
SHA1:	887E797D68554757929006F268908586CC030905
SHA-256:	B479BDB9A553199D3F9FCCB056F8561C0D1FB5FEAAE99B7C737D092B9BEEA480
SHA-512:	5BF8CFB31E6BE5BC7627415E62018CEB560A90ADCDB5501DA1335530178A5B2FE1AF33600F5B9F5CC9C3882C961CD1666F7AE25C9804CA67FC137FAED8252849
Malicious:	false
Preview:	/* Progressbar.----------------------------------/..ui-progressbar.{. height: 20px;. text-align: left;. margin-top: 70px;. border: 1px solid #aaaaaa/{borderColorContent}*/;. background: url(progressbar-bg.png) repeat-x;.}..ui-progressbar .ui-progressbar-value.{. margin: -1px;. height: 20px;. background-image: url(bar-bg.gif);. border: 1px solid #aaaaaa.}...

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\progress\progressbar.js

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.074349303430035
Encrypted:	false
SSDEEP:	6:UPiULwx+4wwIXLXFrMRLGfKWas3N6QPCQpQbDRd7AafoEmQ1K:UbA5wPLKxIxasCQpWDRRAaxmQ8
MD5:	90A92BA5F9E40BB04EAA1471CADBBF3F
SHA1:	959203C9521355CCF825D86967F4C89E5C14013D
SHA-256:	E59211E9B9E308ED6EEA793CCCD10D435314E3E74300F80854551099F3E07017
SHA-512:	40751537117B2A10BB6D63ECF8C62B1AB8789C1CA833A16E652B503BEE67818D1B196A036FB5E8A93D2F04182BE01038E0DC2F0BD4ABCCF62DA440CE2D04F584
Malicious:	false
Preview:	/* $(document).ready(function() {..$('.slideshow').cycle({...fx: 'fade' // choose your transition type, ex: fade, scrollUp, shuffle, etc.....});.});.*/...//Progress.function SetProgress(aCompleted).{. document.getElementById('progressbar-value').style.width = aCompleted+'%';..}.//Progress

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\resume.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	2243
Entropy (8bit):	5.006106039687317
Encrypted:	false
SSDEEP:	48:zLPp5ag7mASVXJpYzO65UCvNsvt5H4zncb5:zTdfSRJparU+ivii
MD5:	3D4BF82C2CB40B28475092CD6EA62BDD
SHA1:	7A776117A38CCA9F560838CB6DC5862DDFB3D171
SHA-256:	A62426392F0211FB150DD847777DC1B80D5B1CF9B1D18E7EFA8B6F2476D5B637
SHA-512:	6910BE328FBB741EFEB17AA8E3A3CFE9DC9690E4E28E3FF280D4B0EAC3B7B1441B39C486A8F8B770A8E2FF3D53062F2DF61D4EAEBB9CF3967DF2605EDB6A5AD1
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">..//hook the window load event ("event" argument will be automatically populated by standard browsers)..//background: url(background.jpg) no-repeat;. $(document).ready(function() {.. /* START XXX */.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');. UpdateBackGroundInd("AppLogoIcon", 'logoBig');.. ResolveTag("p");. ResolveTag("h1"); ResolveTag("span");.. . ShowFooter();..

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\rmfiles.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	2323
Entropy (8bit):	5.015036574580231
Encrypted:	false
SSDEEP:	48:zLPp5ag7EVdJpYzO65UAz8gz3t/dlxhyWTUZL5:zTd4XJparUAXJFnQJF
MD5:	3D02AD5C47CDF4A8EF90DEE9A2FB1DA8
SHA1:	03EE5D0D5D513F3293D33913794F595FC743723A
SHA-256:	08C2848B100D517260C302EC72FE45035555A41319FC6E70EC6DDE6B7DE2E8DB
SHA-512:	88230E6AA29C78E5005E667119CF1BC39F772C5FA606656345DBB26C9ABBCD056C5C9D0A233D97817964A468899B6A18DE9BF022CCF547D3EC7E4FA59DD92124
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">..//hook the window load event ("event" argument will be automatically populated by standard browsers)..//background: url(background.jpg) no-repeat;. $(document).ready(function() {.. /* START XXX /.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');.. ResolveTag("p");. ResolveTag("h1"); ResolveTag("span");.. . ShowFooter();.. / END XXX */.. });. </script>.. .</head>.<bo

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\server.png

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1632
Entropy (8bit):	7.821188279860668
Encrypted:	false
SSDEEP:	24:G0WCv9dPTfXeGnSYVMLk+VRQdAx9dp/TkfJvCni+PiXoRwbgWXMBBtf:G0WcJ7OG9Ak+VaAb/g87PiXoecrtf
MD5:	6AC10775BA1AFAA92725F3D4FB03B3C1
SHA1:	C1C1643564E9F6BE0CBEE0F4CED82DE78A7DAE7E
SHA-256:	9195B25266CD23D482B62A733DFEE43ABA9FB7ADB5070F4F8000E2417F89F6C3
SHA-512:	A9898CCE6BD9D2739EEDFC0C2E0DE35892E8F10CB843021F5630C5E5160F09721DCD17A0C978F8721211DD59DF22F80FC0EC24DA1CE33B0EBB625CDBF2B6D734
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z.O.G....7.7.9..Y.H..i(.AEM..bzJ$D....NA..+&E.Y4.l..Md.9...w...k7....{.....i4.{w....{o.=.,qS3.C.SSSfsS...FE,.....F...$.......z.8v.<z....-....jggg......P..{x"pqq!. .577.......o.....wgG..q.2..;'..d.....d...,..!../....d...............L.<4l....r...g.Y...D?.b....K......GD.<....$.I. q.....k.R~....3 -.VW...[=C....-...J...(.I0..&..TJv...N..@....].}q~n_..v...`..%d...P..<.rN.s..]..+!m.......Duu.....;.....vww.L.c./..J.>G!.I..A...3...g.2..U.f.X[[.........>.....B9........v......LB..C...P.Ywtt..o.ha.2..eY..`.*]C..R@....brr.x.B.]~..^...N.".l.^.t..b!......s9.....]..X.TB...._.....x+0.)....p..h.m..JB.N.q...h/\...%K[7l..5!T...T..hee..C......'!.&....'O..C?.......$di.4..:`..~.v;+..9.i"p....e..P........X]].....=....z.9.PMl.2.e.,S.`.K.C>.HDD(Is..h.w/jjj....0......b..G.V....8.r.q!.54...8..SY;.B..G6....}+A`.%.y..,NY.b.{......H.s..8...)}p..e.}..upp.B..;%`....%..........Q.c....V....b

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\setuptype.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	3412
Entropy (8bit):	5.044099449690642
Encrypted:	false
SSDEEP:	48:ztEPp5agLPvVGqt1rsrqt1re/h65UCKi+qMwqYY33n0:zAdjQ41Q4166UjqMwqYYH0
MD5:	B55A3465AD478AAC218B877FC28DA88D
SHA1:	A8CD53A9C03276D0BA46BE78466CCA819B41A7D2
SHA-256:	8DD32C7875548D3D24C52E86DD1B58C35DA4DC5607669FA4A0FDC028444135E9
SHA-512:	4AEFBE5687705BCBB9F640F2D7ECA32FBA6BD8AA180AE8506D317CA0B571B83935D51726DA6594EAD6A918E59B0405F31861A5ACB4D19714136C01FE0812162C
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Choose Installation Type</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">. $(document).ready(function () {.. /* START XXX /.. //AddCss();.. ResolveTag("p");. ResolveTag("h1");. ResolveTag("span");.. //UpdateLinearBackGroundInd("MyColor1", "MyColor2", 'gradient-btn');... InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');.. . ShowFooter();.. / END XXX */.. $(".install-now a").hover(function () {. $(".inst

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\style.css

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4623
Entropy (8bit):	4.93131301793992
Encrypted:	false
SSDEEP:	96:U75lONThJazIzzgzz/Z9U0zCeR3dLd2xWYUPokgLQutJazEazPxazekaQP:c4NlJazIzzgzzFuHMXgcUJazEazPxazz
MD5:	B5E0FE5490EF396EB32C0E49C0A42391
SHA1:	F5586452B2341D2E0F3F822F4E8DBCDB1A268465
SHA-256:	6E28C48732CA73D291476C23EA526D7D8704623D3EC60F2C084BF70D7B3BEF75
SHA-512:	DA75343FFFFEA68D5BEE5BEE31D285D83D98B8180845BCC52D6659B1B991C664BF35FC68C10F1CE53AB8F44F0C7903DBBE388915CF9A24893E56D602EDD3EB54
Malicious:	false
Preview:	body {. margin: 0;. padding: 0;. cursor: default;.}..a img {. border: none;.}...clear {. clear: both;. height: 0;. line-height: 0;. font-size: 0;.}...center-inline {. text-align: center !important;.}./******/..#main {. width: 450pt;. height: 360pt;. position: relative;. background-repeat: no-repeat;. background-size: cover;.}./****/..div#footer {. height: 52pt;. position: absolute;. bottom: 0;. width: 450pt;.}./****/.div#header {. height: 49pt;. width: 450pt;. position: relative;.}..div#logo {. height: 52.5pt;. width: 45pt;. float: left;. background-position: center center;. background-repeat: no-repeat;.}..h1 {. font: normal 13pt/49pt 'Segoe UI', 'Trebuchet MS', Arial;. float: left;. margin: 0;. color: #323232;.}../******/..div#content {. height: 259pt;. width: 360pt;. margin: 0 auto;. position: relative;.}..div.central {. position: absolute;. left: 0%;. width: 100%;.}..div.aditional-info {. position: absolute;. bottom: 8pt;.}.. div.

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\userexit.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	2215
Entropy (8bit):	4.931036954565628
Encrypted:	false
SSDEEP:	24:WC7IsHE8e85mfNVvqL6NVvgKVgd7afGPVuwdUWJpYCiD665UCtpt4G2MGNZXDG1h:zLPp5agMGVVJpYzO65UCliMCTnOJJ15
MD5:	5E9B75D44EF5266A95BE1F4DE94DFA25
SHA1:	80591ACAE81559096AEF0800CA4565699A9DBEDF
SHA-256:	19BC049533D7A8F24538BF0AE24A1959FE67488337B9464F66980884DAE4C848
SHA-512:	E60DA68115C016706296ECEE09D9C0FF37CB93CE55544F4ABFFC640CFBF51812FC69E4876CD79B07F43069908F564F6D7FC62EF830926818D389F8F7A9C16AF6
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">. //hook the window load event ("event" argument will be automatically populated by standard browsers). $(document).ready(function () {.. AddCss();.. /* START XXX /.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');.. ResolveTag("p");. ResolveTag("h1"); ResolveTag("span");.. . ShowFooter();.. / END XXX */.. });.. </script>.. .</head>.<body>. Background wi

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\varstyle.css

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	716
Entropy (8bit):	5.111242836806214
Encrypted:	false
SSDEEP:	12:ltGtfLqSpz1Jw82bHa+u8r5WUF+TB+NFm8r5WUfSXSpzw/Xa+W8r5WU0CF8Ea8XT:lQtfLHzDw82mU5Ros5RfkIcqW5R5FxaS
MD5:	A60EBB9E7D8494B04C97F1902C782ED4
SHA1:	7ECFA3EE6D564C0409561F1F396F9E3451059F3E
SHA-256:	42F7ABF8D2F192465E7B732B40B882B0092105547AFD104049408F64423CF8AE
SHA-512:	6BEBD87E3F7FA3F89FAB97B692C2BFD5D826A28C2BE4BCDF57AB20059491758A2F24B235CF8727D04717E962C71990CC01A6F1E0E74EDD059009F0E4DD61D900
Malicious:	false
Preview:	.#advinst-text, #advinst-text-shadow.{. position: absolute;. right: 8pt;. top: 8pt;. font: bold 9pt 'Segoe UI', 'Trebuchet MS', Arial;. color: #d3a7a8;.}..#advinst-text-shadow.{. top: 9pt;. color: white;.}...buttonwrapper a {. background-image: linear-gradient(#E34747, #980404);. border-color: #A21313;.}..buttonwrapper a:hover {. background-image: linear-gradient(#F77272, #BD1B1B);. border-color: #CC1C1C;.}...buttonwrapper a:active {. background-image: linear-gradient(#B41D1D, #990404);. border-color: #A81616;.}...buttonwrapper-disabled a, .buttonwrapper-disabled a:hover, .buttonwrapper-disabled a:active {. background-image: linear-gradient(#F5F5F5, #CACACA);. border-color: #F4F4F4;.}

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\verifyready.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	2627
Entropy (8bit):	4.980424633335467
Encrypted:	false
SSDEEP:	48:zLPp5agMtyV5fTMeJpYzO65UjV5nsii3nNncb5:zTdGyTLJparUzkBi
MD5:	4155A0C45CC141BECBCC7E333B57AB54
SHA1:	DFF62F9BC259E1CE1AB1D6EE99E31F9924F636D4
SHA-256:	44275C6087F0961DCAAD8CC6D164F0AF647B40017725C6264C3D41E928132A11
SHA-512:	4325EC330D583A04E1D1B6FD9B1687A9AA5D734482B4099C533ACE24E168F18C06E669176C3D16C5741771229E0C4842CB4DAE8328EA6DF87606147B51F23308
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">. //hook the window load event ("event" argument will be automatically populated by standard browsers). $(document).ready(function () {.. /* START XXX /.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');. UpdateBackGroundInd("InstallLogoIcon", 'logo');.. ResolveTag("p");. ResolveTag("h1"); ResolveTag("span");.. . ShowFooter();.. / END XXX */.. });.. function A

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\verifyremove.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	2634
Entropy (8bit):	4.965742910541496
Encrypted:	false
SSDEEP:	48:zLPp5agMlyV5fTMeJpYzO65UjV5nqiJ3nNndG5:zTdkyTLJparUzrBi
MD5:	DD9A03C9636F97165842A00B858C4A31
SHA1:	66D8EB6BD56FBA05948C6ED9032787CC91BBFE7E
SHA-256:	9D9FD5C27987194EA7CD9B4E91C05DE65225458B51E554B194BB822B0DDF269E
SHA-512:	4C10B82CA9223D5D8A29C75091F968A2FBE7E7D8DE59EA15D809004846BCFA93B3D688F145BE1AA8EF37B419ED1A446B37FE242510B64972E3C9711DA062DEE0
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">. //hook the window load event ("event" argument will be automatically populated by standard browsers). $(document).ready(function() {.. /* START XXX /.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');. UpdateBackGroundInd("InstallLogoIcon", 'logo');.. ResolveTag("p");. ResolveTag("h1"); ResolveTag("span");.. . ShowFooter();.. / END XXX */.. });.. function Ac

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\verifyrepair.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	2629
Entropy (8bit):	4.978204848388694
Encrypted:	false
SSDEEP:	48:zLPp5agMlyV5fTMeJpYzO65UjV5neiO3nNnMr5:zTdkyTLJparUz+BY
MD5:	9A34E23D1D3EF88960349988A51B5F4D
SHA1:	6E8EB7EB0BE77DD2BBD30A6D1A3E14F036ADA985
SHA-256:	6F2FAF557212E9839002CA7D73AF981E63530F84B73CEC6DB5A9110E692A9988
SHA-512:	7CAB6D103320EE7819AEF81F265249B3E85711C40D0AAB7CCB96012724DCB4D55739D4EC5D3637444B51889BC0309E10870A8A311F4D18F5F765DAF3714FBC17
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">. //hook the window load event ("event" argument will be automatically populated by standard browsers). $(document).ready(function() {.. /* START XXX /.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');. UpdateBackGroundInd("InstallLogoIcon", 'logo');.. ResolveTag("p");. ResolveTag("h1"); ResolveTag("span");.. . ShowFooter();.. / END XXX */.. });.. function Ac

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\welcome.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	2368
Entropy (8bit):	5.0006037281140845
Encrypted:	false
SSDEEP:	48:zLNp5ag9+ASVXJpYzO65UC/im5H4TUZkz5:zhdhSRJparUMbg
MD5:	406175F55851187D71E50DD78B429EF8
SHA1:	7EB3709BBEFE192C074FFE97F537ECA6BEF13CFE
SHA-256:	90AF6D1907FCBD0197683CB2B98FB793AE46E30B62B4D1D8078C8B1A7E518072
SHA-512:	8FE83E0A415658DBB290D8BD787697879D73779A392CC6CB91F38EA592AC52E82EC9EC42D54D570E235A03AA2123D4EA69609387AA1F2BA67AA0AF516D89A99F
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <title>Dialog</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. IE=8 for SVG, IE9 for cover, IE=10 for rounded corners over gradient-->. <meta http-equiv="X-UA-Compatible" content="IE=10">. <link rel="stylesheet" type="text/css" href="style.css" media="screen" />. <link rel="stylesheet" type="text/css" href="varstyle.css" media="screen" />.. <script type="text/javascript" src="jquery-1.3.2.js"></script>.. <script type="text/javascript" src="common.js"></script>.. <script type="text/javascript">. //hook the window load event ("event" argument will be automatically populated by standard browsers). //background: url(background.jpg) no-repeat;. $(document).ready(function () {.. //AddCss();.. /* START XXX */.. InitPage();. UpdateBackGroundInd("DialogBitmap", 'main');. UpdateBackGroundInd("AppLogoIcon", 'logoBi

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\NVIDIA GeForce Experience.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3345448
Entropy (8bit):	6.340326941586757
Encrypted:	false
SSDEEP:	49152:dFr9mYaZA/KGEI1Zkl78VaIAeiIdFVwIGZRACjKpo+vor:dtY8VFTKIGqAr
MD5:	BBE60E23DD94FBB56E878EACB5F1A44C
SHA1:	B08F8B87EFC450368816C769C8C1C54FF6DA53B9
SHA-256:	65DA40AB4EF47A5B513C268F15AC9B2DFEF203F87394A1DED33B1EBE1C474669
SHA-512:	2FAACA8A4676143AE628AE64C75B8B99DBF82380EB2A82EFC560AA5A58C999ACE46FA82F144E214322AAA7E57E8AE3BAE5ACAB903E91C1071279C6CA7370B75E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: app__v7.1.7_.msi, Detection: malicious, Browse Filename: app__v5.20.03.msi, Detection: malicious, Browse Filename: app__v6.25.3_.msi, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......6.d.ro..ro..ro......co.......o......{o.......o......Wo......eo......qo..ro..po......so......_o..ro..im.......o......so......so..Richro..........................PE..d...=.Ce.........."......h ..z......0..........@.............................p3.......3...`.................................................L;'......p.x.....(..6....2.(&...03.4=....#.T...................(.#.(... .#............... ..............................text....g ......h ................. ..`.rdata........ ......l .............@..@.data...lz....'..J...h'.............@....pdata...6....(..8....'.............@..@.oldntma.....@.......).............@....crthunk@....P.......).............@..`_RDATA.......`.......).............@..@.rsrc...x....p*.......).............@..@.reloc..4=...03..>....2.............@..B........................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\avsfaq.rar

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	200278016
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:ttt1:jr
MD5:	0841B4C981468BAEF4B612AAF1B52D88
SHA1:	C170D6907E68EAA1A6D0BE449F0F07EAE276C547
SHA-256:	6ECD386B1487009D380538B344D875B2EC3F6CE3D40B7E7725F5A139219AA0C4
SHA-512:	BE4B32337C3CFEAE6FFC5B288904C0848ACFB8B8CD6B61ADCB97097E6C6BB21A26E169B88A2B02346E98DB81BE0DE89999FC46A2D37D27F50251AEFE5E0B8F4B
Malicious:	false
Preview:	!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\classes.jsa

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	12124160
Entropy (8bit):	4.1175508751036585
Encrypted:	false
SSDEEP:
MD5:	8A13CBE402E0BBF3DA56315F0EBA7F8E
SHA1:	EE8B33FA87D7FA04B9B7766BCF2E2C39C4F641EA
SHA-256:	7B5E6A18A805D030779757B5B9C62721200AD899710FF930FC1C72259383278C
SHA-512:	46B804321AB1642427572DD141761E559924AF5D015F3F1DD97795FB74B6795408DEAD5EA822D2EB8FBD88E747ECCAD9C3EE8F9884DFDB73E87FAD7B541391DA
Malicious:	false
Preview:	.................*.\.....................................+................................Ol.....................................">.............................d..3......................A.......@...... t.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................(#......(............... ................Java HotSpot(TM) 64-Bit Server VM (15.0.1+9-18) for windows-amd64 JRE (15.0.1+9-18), built on Sep 15 2020 14:43:54 by "mach5one" with unknown MS VC++:1925....................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\classes_nocoops.jsa

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	12124160
Entropy (8bit):	4.117842215789484
Encrypted:	false
SSDEEP:
MD5:	8DD2CDF8B1702DEE25F4BC2DCE10DA8F
SHA1:	7AE8D142C41159D65C7AB9598C90EC1DF33138D1
SHA-256:	B19E92D742D8989D275BB34FB7828211969997D38FF9250D9561F432D5C5F62C
SHA-512:	6CEBD788559543623A3F54154F6C84E31A9716CFFA19D199087F0704CC9016F54CF0B3CFF6D8DB65428138EEB12553B23EBA7EDAF5B64A050A077DD2951286B0
Malicious:	false
Preview:	....j..L.........*.\.....................................+..............................j..-.....................................!>.............................\|<:.......................A.......@...... t...............................".....................................................................................................................................................................................................................................................................................................................................................................................................................................(#......(............... ................Java HotSpot(TM) 64-Bit Server VM (15.0.1+9-18) for windows-amd64 JRE (15.0.1+9-18), built on Sep 15 2020 14:43:54 by "mach5one" with unknown MS VC++:1925....................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\java.naming.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	460349
Entropy (8bit):	7.928980735357845
Encrypted:	false
SSDEEP:
MD5:	B396D42998F877CBDE5B93A1B238B5C5
SHA1:	ED864130A63A807EFC16CE9F97F8C24750A14C35
SHA-256:	734130C3E9D7A12A75BBB194C9FD29DFC85FD802B42B3CCD2C617C86FC905473
SHA-512:	8E44D12F37DE7A1F7453299FA0A3ACC566C2959A1C482DA936108BFB6514650AA3E2400AC090B65F2FE3FA53BCFF4F676D129695B10334B4160B45EF3B440043
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class.Sio.1.}..KO.f{p.Hi8J.-..DU.T...3..5.9...........G!f...$..J...g...........3L............ ..CA{2.h.R.V.(...V..l0...M[..oF"..1...\v..q..a...s9#.q..K}..#.eyh;>.^.F.Q..m...8(..<..AA=..XdX.q.p..L........ur....u......[.s}.<..ju...wU.%.C07..B.......42l....$..U$S...&...#.g.w....,.a.+....^...0S...u."m...ciK...J.B..H.A.\|.&........U.OZY%..c*j...W+.O.V.M...dG.j......y.r.....$.s....P...ab?n...UMI...{#.uwR.aC...w....e.>R:..LE.......z.(..l=....2.1Z?:...n...t~..;..-;{..Y...\|./.:..<.&...N.%....8.)..9..%\..,S...e<.[...?PK..._./....$...PK.........n/Q............=...classes/com/sun/jndi/ldap/AbstractLdapNamingEnumeration.class.Y.x..u........S.,a....JF..."#.h.$.X...v....5.1....PB...Ml -N...%...i.;.>..WhC.I...G..A....h..d.M.o.....s.....]..W^..........A.)..a.[bv\|{...N.U(j..n.BaC......B.F..BK81.J.[v.#.X..j..O.I;.v.e.=..o.....F.q.+.s..QP[E.,...f..w.Q'.0...v..... .l..s5.a.B0...R-.Nz+5.Jo`(..KG..".pX...K..

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\java.net.http.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	718964
Entropy (8bit):	7.932673218886782
Encrypted:	false
SSDEEP:
MD5:	5A11C4A6D94E1C67F84D2D22B7012B11
SHA1:	273C3A253F6845441C6B4D0AA000BD0860574EA8
SHA-256:	AF1946B6683575D724430220DB7C948AF2598E69091F74459CCA1F97A15C2A54
SHA-512:	841460A10900517CEB80F734F1492AEEE83287ECB521BB5107BECA3684189521D56F9CD2B17A136C521884124CD1F307CE51F63DABCAC60247960BBBFAC046BA
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classu.MN.0...@..K!...8A.*......n2m.$v....b..8..IAt.F..x.gKo>..?.<..It..y...n........I...Ul.1+.5B}r.....Y..L.A.......T.x....J..:I........T&,..W.XI?.8&.T.r.f.....Z.....Ch..u..S....\n...5/.g9.....d:gc...t..e.<.m...F.C..C..:.=. .mA.M....M......(__~.PK............PK.........n/Q................classes/java/net/http/HttpClient$Builder.class.T[O.A...(..r..Q...^X....E....%D..vw..e...b.Y....?..e<;.(......w.7...?....(c....Z.+ .~..]..s#..........b...sN.._..!.=...@.8..T/......\|..P`(...h}..P.....D.........F.....n....F..z.7...%.a.rO.U/..Tk.#.J'.p.L..C.."....\&.....i.]N.....i..8..H...,..L..n.Qm....)..)o.k.b..K...l.6oq?1'^i.h....~..9........e....<..v....t.;u.m.R]...+Whn.8e..@...>b.v.2......g.;5.iz..).{f.;.:.lr.fj2L8...z..PDB/0.:3[.}..p:....z...j.k.4.o.D.\|E.?.."..zzcy.We.-..K.mI...]'U..8...V;e...&.....i..Uo..ioXm.^7....1....B......:n...[.oc.....,b..]L.......dp...>..)..cZ...%..../...~......s.^....)..\|.Y.q...v.....

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\java.prefs.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	54624
Entropy (8bit):	7.943156238505704
Encrypted:	false
SSDEEP:
MD5:	224D8C26B9454FFE244D354BC030CAB9
SHA1:	E531A7BAF213D72964CE4DD83A11AEEAE5713F00
SHA-256:	43622935A7EF06E30D1BDA7E77CB76488DA9E721728AE0B8ACDB1F9C7B91C943
SHA-512:	E0754FFF5801CEB2B1512AD0DDDF0D74C4C2AE97EE70A467E7D83E3AE5870A6ECC6F250B849108923AA8CA94EA3505C4CC7C9BEEBFC192B2DFF1E99A943DCBB4
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class]N.N.@.=W..K....--$.=;.......J.!3....r...Q.;.&.Y.;.qs....'.9..N..:.qV.u."....zS.......h...h.M.}g.u..w...-.~Q.C.....<D.p.o#^...2a.PI..{..T>..$..r...?.ps..T.U....YxVf......T..X.....\..5......J.).}tn.g...T...=......PK..t?u.....9...PK.........n/Q............3...classes/java/util/prefs/AbstractPreferences$1.class.S]O.A.=.nYZ.(....Rd[.._/%D$..R.h.x..C.\w..,..H_1A%>...Q..M.iL7...;.;g...?~...q..dmX.r.c.;...k.W."....-.#...4...<.J+.}.@..2..=0j..#o..`..C.p\|....C.i.\...k.Y...c..6..F.M.......P.p.c6..L.*......X.....f..%#..\.u.S.n.&....a...0.....>...... ..f...mr..D.w..l.2L...^.I..."../.bo..2$...t..&..F.'...2...CKDoy..h=....L.i.J..a....J.apGs...?J.....\0..;..p.G.y~.P.......F...0.<.)..].........C%.......x@t..Q.4..Q..RU4../BEU....m.\)...2T..w.......R.@..s4Z#D..Be.+X.;./4.......k..4.....Q...8R.W.a..r.v..3.~.m}..=...}..dt..#.P.!3...Ix!...D.T.......R.......L_.2.....<4.!<2...E..PK..]5\.H...`...PK.........n/Q.........

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\java.rmi.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	385108
Entropy (8bit):	7.9135425794114935
Encrypted:	false
SSDEEP:
MD5:	C4BF3C85D5A2B5A2482D29682F937339
SHA1:	2ACCDEEAD4904C6EC919771CE49943C9D6E8A9E9
SHA-256:	25FDC4D19B9F9BFF599212307C35ADE3C5B14D8FA326352837E2AC1919A27679
SHA-512:	51908DB9F980EAABB144C3BBD38563DF0DE3AD9AD286FD4D4F5C41B4F2D70CF278395E123D8C26A64742858A4B629902532C0AF097D020EDA92A7031AF586B66
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classeR.N.1........E....ogX.n.411.../Pg..L.i....\^..>..Lwg.b'=?...z.........8eX.M6dO.K..cX.......J.T.....'.Q...).7..E..q...+.c.!..D.^..WFs,3.4.,O9V.....\9o.pt.....K..Z..'.+8"j...09.&.....g.......q<...H{UJ......Kx../6K.......z.].....C.g.Ka........\.<.!..dWq)..e)..Ik...t...T.+.J..F;S.m.a..4..g.>...Fd..U..C.<..Q....,..4...E.Wt.#..p!l.=....v=Qf..7...k.}T..........n..p.M_.V......F.<.E.............b...U..;.;.R^..;.AL.(...({....8Tw..PK..{;\l........PK.........n/Q............R...classes/com/sun/rmi/rmid/ExecOptionPermission$ExecOptionPermissionCollection.class.V.S.W..]..aY.....hQI".UAJ.V......k.\..f7f7......K_./}.C....L.38..8...C..7.........#.:.>d.....;...9y......\|!....n...2.^R...g3.=.>.3).4..6u..mZ1.vh.fw1...#.....kY[....5i..:.!A.j.....H.P)a..*ld....5.dB....i..J...v...W.)O/.-..X.$.ay......K?.2O0.1.[.v........U#........$.)n..q...Qh..lG=..:.M#..g4{.V...6Amn....H .le..hF2"c+v.p............e40.

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\java.scripting.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	44965
Entropy (8bit):	7.9310029341229376
Encrypted:	false
SSDEEP:
MD5:	A64194B2F7AD00E12C9E5AE260B57B3E
SHA1:	2617AE8B733B5E7B31180A3EED1DDFFD1B5CF631
SHA-256:	BC08974AF0D13B1B362A651329036C24CC54028F1D0B3EB327350B51E2270FA5
SHA-512:	68FE47540C844FE28B92C0AE4E8FF5C77F60A4AD0C5F1F3857412DF36E11A6053697B823E7C3D653E012F1923502DBBAAA9B03803A24344DC5C384853A3D44F8
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classMNAN.@....PJK!9q@\|.YQ......\|`.,a!.E......x.....>x.....o.7H...eM.g.>..D....\|..I..W.y...c....".L.3.J..+j../:...(.D..v.c.'......:.p.+....67V/..]..aL8\..Rzi...w.G..+.z.........uM.......d.]_m.....c........<._.S6....I..p..i...PK..=..+....F...PK.........n/Q...............classes/com/sun/tools/script/shell/init.js.<.s....@47.]+.......K.......];i&CK.."u$e[.......AYI{.6.....]...<....^=.V.:.Z...G...>....0Q.u6-....AU..mT6..E...I..P..Z7.....}....z.............W'/^.~w..4U.4Z.j....Um..\|.Kx..z. .?....{....>.....U?g.....\.E. /.\|]N..\..h64....X.`.U..Z5.... .R..j...QU.p9-.]h5......^UI...k]vx....e....^.f.U....'.Z?./.j...s...V.c.O.<...ROTV_5{.\|p..i.~....-........v..v..+.).a......<T2....H.,t....6..l..9>X/u.64..n.O...s......Q.R.Z...j.g.r..G.....^O.&V.%.e."X.=\F..u].e>.e+........n?~T..,...,]..].-.:.0..................L.K..^...$..B..:........p...~.H.l:.M....5.u1k./-.7B.^.%.f.. ...w?....8...\g.

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\java.se.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	2207
Entropy (8bit):	7.650310282866788
Encrypted:	false
SSDEEP:
MD5:	3B4DCB7D28ED3DA5F09ADE9FDE137D3B
SHA1:	0EEDA129FA837E4D5E54F678249C7265C96BE4FA
SHA-256:	4BD4726EB7772FD1A202DF3EEF6367ED66688E0603C4B970D22AC8EB560F2A04
SHA-512:	BBC8165555B54BCE7E2342CEE798F93245B0F5A4B6E9CD9CCBB28F7EF42E8B4E3DD729DB95E7B027CE955DB27FA3B8555D8015B568CF8672A4BEC9DC6028EC1E
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classe..V.1....2.!.xC.&...A7.....=.68.4IF`..gr...P..k.9...K.OU.........p"0_..hh...\|.B..@P....h5..FbJ`..A....,..t....9,\|U........:.....F..X..&.H..X.Xf...2.I,./K.J.NN.....I....Be%...o8]q...Bg....].D`..:.A.x&0.1..B`i...N\|.K...^..`.:/#U..O.:.%v...."..e4..uv.-.E..+-q.k..}.k)RE...../~...zN_s._G../..P.D./...}]].?.....c.Gh.I.......X..M.;.-..s..f.0W.....S.s.&s....e.3..o...G._...PK..U.FO........PK.........n/Q................legal/COPYRIGHT.VMs.6...W..L.I{ir.$n....N...J.A..@).I..}...e.i{.@......C?F..f.....KC?.}.kCwQgHz.S.ds"..Y.MZ.K.X%.&..3z%..M.B..2.S\|t0...:..6x.}.;..i..D..Ye\|..&..wI..Xo....h.['..!..B.\HC.W.g.8.z$.q.....Kob...=.p.].>.Ld.....H.........H/a.(.sa?E...oR'G.!3......j...A..'.....V2..m..5H.....ex.z...m..........a.l.6..7{........v.3]..(..g.\|E.fg"^d..zc".-.dJ.[..M.6*t.uS.BKy...Ys`./.k.......yaZ..........U'.....&.n.&...P....F9..J.1bo.6..I.]%....x..../.1...[.u....ey...-.Ag$H@.BD....xHL.>..V...>

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\java.security.jgss.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	698330
Entropy (8bit):	7.957481640793777
Encrypted:	false
SSDEEP:
MD5:	372B6F9949895C86164FDF3A1E99CAC6
SHA1:	B9D3ECAFAE368E7ACDADCC347DE6FFC08D031CE8
SHA-256:	934114BA650D81262CFE3CFBA0D5A190520C05CDDDCD9A7A875E3E1D951AD71D
SHA-512:	2DB6F0FEAAD1DD724447CE6E1E1CE92C5293AAB8A661031BB4B343564703BA033410EB0BE56B223F2F8901CDF158530503C0F5B6459D7918253C3AC7CF99F029
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class.R[O.A..."."..........P..w.LH..d.;l...lfgYy.w....G.g/.i.L2sn.d.......>.#aq..t$.At.j ..?.g(..a%.N".T.....I...a....;....._".H..R..V.C......iNy..@.I.G..,.x..Q...11O.H..a...Q....K..)7.u..p..:.K.IX._..."lLG3-.Xj...Q.v...)7."#u$F.......u.;...o..........a......3...}...]u5.jW...R#....;.&...P../...K...8...^._.z.$...`-p.<...Vg.'u...[..<I.+.[B.D......t.R0..(.c....^.../.%s.D....{G...-\.9...qd.7........S..B..a/..r!..^.v..\.v.B.+.7....;h.zu.m..+`X.5...#.........S}..PK..CU\.........PK.........n/Q............?...classes/javax/security/auth/kerberos/DelegationPermission.class.V[s.......,.....".f-a!..+.Ip.M.q....0...x..h...,s..Il..vl.v..0.I..B.L.-....C^...<'...T.....8..;.}.w...............`...$L$...}.Z...Y.\|;\.>f.v.9.W. .=W .....a...qm.X...T.........l c.].=.L..pV....?+}/.>..9g..m..P.TV..-..ZDj..@.@.^.B...{...K?......[.r....B.Qeub....W`.+.C.*.up.~..vb...&.......$Q^.,'XG...+......xD...0.(....\T.nxb.(...,;.ob/..

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\java.security.sasl.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	81698
Entropy (8bit):	7.940663737798511
Encrypted:	false
SSDEEP:
MD5:	BDD7FCA80A0E7436DC46FADE0C8CD511
SHA1:	C491F4A649B8DB593F26D25133DD104D8985AE60
SHA-256:	F783A14F1FD9E804553F54E8B97E38A5BEB8C25ADF096FD380FC1BEE391153AA
SHA-512:	6DD0A97BC791E78C28E1D1D949911B94DB3E2B08E5055283AD0195E0897E7984FACB517FF8E6C7B6E78E310819AFCBEAC9876B0FF35370AD96539C3E8B28C134
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classuP.N.@.=..r.h...-$........,..t[.7...?..2N....Mf.\....O...&4...C9V.kR..:...\,..W.....{w...2.2.u&......y.n9n..Q%...\_.Rg6j..~F......<S<.E..uo.G..jF....B..4a........;............{o.&K...S.h....P.J.....G..;..3..B..g.x.i 3Bk.b?Y....5P...q.">..q.C.+...E.6..:..l....gl.\...#.........PK..... .......PK.........n/Q............5...classes/com/sun/security/sasl/ClientFactoryImpl.class.W.w.......,lc.hB.b._.@.C...&26.6.nH..X.UV+.$i..6....> }.m }..b....9.9.I=).7...-.9m.W3........[.n.h.....G.7......HJ5."..Gu....0L..).ij....U..AT#(.f.#....Z.6..HV."....N..9.=.....d...g.....$..0....A... V..6/...B.9.....).......5A..:.`...Y)C3tT.u.....l..O`Ky.s....z...R.Z......o..o......`.@cy{.'..6.T....GX......4...?vpW..=..... ..a.1.;.Y..6G-..2.wX91.s.#..J...D$V..U..n.7.-EUA..Cw`.V.t2...V......U..M`}.'.v. .....wu.W.C.....R.a........W...GR.d.O.i.7j.HE!..n..CK.-#..../..u7.G..M.8.e...."...<.a....p.+.".G2j6{.G.

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\java.smartcardio.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	58645
Entropy (8bit):	7.913344050895434
Encrypted:	false
SSDEEP:
MD5:	4C54BF6DD5C142E6C8C1A360C985167C
SHA1:	7449C89D087ADC871E26218F6AD82FD1FF5BC01D
SHA-256:	0AF33A68F7B71F12FA3B7F27BC69B80A86633F25EB82830076ACFC3170538EC0
SHA-512:	2C5050F04B4F7AD373CDD33B3874A38AA317C996DF27630D4AFCD6F2ACCEC6A5ACEE3ABADFCF8D0182104651BA68239FA13E4658398F9F92D0E1C6D4B4F4568A
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classu..N.1.E.Cd.D.A..gF.t...$...i%Ef..S...........6i_.=..........B;W..H.....GB.b..$_".3]fLs.B....}t...=._.#.G@..[.FdV.../m..U....M....h..\......Aqj.d...\.Z..:..r-...O.....e/l)... .^..........?Lv@....\|..+Woq...\..S...].f.a.9.B.:{..PK..F......k...PK.........n/Q............#...classes/javax/smartcardio/ATR.class.Vko.e.~.t......R,....V.j..m.ta.e......v;....%..5.D.D..1A0.....\B..o..'..A.wf...J.0...y.s.s......2.."...P.a4...jOY5&z.....#.G7tg.@.+..".F............e....t%sK.3.X.f...V!....{...r..U.....V.+J..1..<...5.6.uX/.l;...m...Z..Yy..C.<o2..\.Ql.s.:c.......h3...e..E.2+..Z.=[g+..P..1l....f.im.4..sZw&9#M..iWv..#.....(..T..!..5RUG/..I..k...eN.......t....D&U.AJT;..d6...`g..d=Z]<..........lc.J..{R....WY....f.jY....D...2.Y.n....(.a.....j......[..b.>..@.#....hu..Y..`K.dQ.Q..7C..,...vD...0aa...M.............YG#J.+);..;.]....M..+....."....16.Y...,;d.3.Y...D...;..G.W....3..g.....VqX.[....5......

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\java.sql.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	76011
Entropy (8bit):	7.806124696487568
Encrypted:	false
SSDEEP:
MD5:	E910C6B0413AB8D4CD0A5EBCCDA387EF
SHA1:	6782B1D03ED398C4AA558C219294C6367F7C8479
SHA-256:	2A24C132034F0894A0AA38A2DFA546F6D20113783B791EDCC9831DFC144256FA
SHA-512:	A729C0449FD21D633E5F70B8FE98876E96FE7559DE0E4E137A55B329403B624D6F298B2D4BBA061AD4049DE224CC2A2C3B6FA2BDCB13430BE78E84992D537B2B
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classM.MN.0...../....@]A7l.;$$..I.eHb..m.=........Hx..........p.K.05.&......D....]l.._.n?........\|...s..A......_...C....(.3.0&0O.\dVD.6./..M+S.vD..!..\oe....g..#.....y...&..ID.BI.Bk."r%..x.....B...f.t..NP.........}.........~/l..s.g~..8.S..PK...p......k...PK.........n/Q................classes/java/sql/Array.class...N.0.."2............FH.h..Dg...,#s.3.j^..>..[1@....dY{.''_...O.0.P.....Q#\|u.. .....Bs.g.....p.e..........#P..9g...l.@..}.\|.P....,...<...@.+z.C ..h!.O[`..>U#.F.....Y..Q...\|+.h%K/(.....i.l....MGi...j...\."....-..~.T<......\o.q.y...d....d....a.......5....v\......2....)._....k.K.7.J...R...R..\.2.RP..z..P...T.&.U.+.-.4...Ag...Y\|..w..PK...?mb...&...PK.........n/Q............+...classes/java/sql/BatchUpdateException.class.W.s.W...+.k..8vl)..$N#._q.I.7qS.i.(vR...).F..JdI.V.(.\|5..\|.xf.....q2..2.e.7...x.7.x...sw..m..0c.....w..s..OO....$~.C.....-.=...X.......K..f...s.-.er..@,.R&Y#.26o.3....3..

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\jvm.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11394704
Entropy (8bit):	6.390661514563496
Encrypted:	false
SSDEEP:
MD5:	B97B7AAB1F877A7B3A426A434ED5562D
SHA1:	12D88F7C2FE3D3908BFEDD415CF3C6590CEB42CB
SHA-256:	B30ACCB880B398FC9743A51831A741CE22364FE091AFF9846CF457A772BBE2A2
SHA-512:	23489E913523444FE24462E36A70EC5B8E6C1CFC4C7AC1DD8290DAA778362789B484E43B4A35930EAFC6B29C2322597B38F7AEA19E029A09FAAC9A5ED42D1D77
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: app__v7.1.7_.msi, Detection: malicious, Browse Filename: app__v5.20.03.msi, Detection: malicious, Browse Filename: app__v6.25.3_.msi, Detection: malicious, Browse Filename: app__v6.20.9_.msi, Detection: malicious, Browse Filename: app__v6.20.5_.msi, Detection: malicious, Browse Filename: app__v6.20.0_.msi, Detection: malicious, Browse Filename: app__v6.15.9_.msi, Detection: malicious, Browse Filename: launch-v3.17.msi, Detection: malicious, Browse Filename: x64__installer___v4.8.6.msi, Detection: malicious, Browse Filename: x64__installer___v4.7.5.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............~...~...~.....~......~.i....~...z...~...}...~...{..~......~......~.3.{.I.~.3.~...~.3....~......~.3.\|...~.Rich..~.................PE..d...6.`_.........." ......}...8.....$.}............................................KU....`............................................................8.......P....................T......................(...P..0.............}..............................text.....}.......}................. ..`.rdata..D.!...}...!...}.............@..@.data........@......................@....pdata..P...........................@..@.rsrc...8.........................@..@.reloc............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\Required\trup_si.rar

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	22270
Entropy (8bit):	7.991749234895957
Encrypted:	true
SSDEEP:
MD5:	538C3ED5EC5D7C9E743930EB5FC746DC
SHA1:	16012A0E9D1DF61158691A8CB3F9128E4D4DD0B1
SHA-256:	68508105CD9D141EFAA1A73BE198317AAB836CF14D461B482F22210FEACA0B29
SHA-512:	2EA304564BE20BB5D013B211834EE25933BB27C7604A1F4A6CF49553390763253932F0637D718A2C1148314DCA9194C1D1C56C4D8C213FA96697D7CD6C74AB3E
Malicious:	false
Preview:	Rar!....9\.d!........nR...-.}.....3.5..._H..Mrw...B<......a..egD...n.....`"....L.r.@.......S....M..y..F^5...Q...]H....^.0..uE.6v.\I.L.@M.._.......m$....u.!.."....a.....=..r...`H..<.H....>`.m.`w.$......z..p...Spo.T`..(x.>...0G....K...r4.W.h...hI..&...A..Ox"l.V....e...Bg...l.+...r.+R...B.:.9..\..G......Cu.}\.......G......^..Mv8.k.E. X.P q.I.VZ.......J.....4.#..........->.......Mr..H`......7...q.$.e\Dq?.a.{..<.......e......W.g.z..S}...wM...n..A..#..!...N..JM..y..9{..i....7k..O..@........ y.Il_..bq".M.N5q...V......db}..l.>1u."....*IP...8.....C.LZ......DR..AS/S.."?..rQ..cX).k0j..H.`h/......H.o.^....J.v.)...1W7.)........=..v.rU.f...e.t.6....0.~qY\".....\.=?...G.....p...s#...z..a....:.c.wq.H.Ig1S.-.....f..n....4..d@.F...... ...]!.'u..........=.......2K.zfXO.....D....Wd..X....=v.z9...<b.G5...........LL...O......M.R.}wu.....M..'...\|.....6.O0].........Hl?9.L.....{./..[5....2....f...T....&qm=.@..._%....m.D.b.K......`t..Q.......d/.

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\UnRAR.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	506008
Entropy (8bit):	6.4284173495366845
Encrypted:	false
SSDEEP:
MD5:	98CCD44353F7BC5BAD1BC6BA9AE0CD68
SHA1:	76A4E5BF8D298800C886D29F85EE629E7726052D
SHA-256:	E51021F6CB20EFBD2169F2A2DA10CE1ABCA58B4F5F30FBF4BAE931E4ECAAC99B
SHA-512:	D6E8146A1055A59CBA5E2AAF47F6CB184ACDBE28E42EC3DAEBF1961A91CEC5904554D9D433EBF943DD3639C239EF11560FA49F00E1CFF02E11CD8D3506C4125F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g.}............\|.&.....\|.$.J...\|.%.....H}*.....H}./....H}./.....~P.....H}./.....~D.........z...F}./....F}(.....F}./....Rich............PE..d.....@f.........."....!.b.....................@.....................................'....`.................................................\|...........H........4.......(......8...0I..T....................J..(....G..@............................................text....a.......b.................. ..`.rdata...3.......4...f..............@..@.data...............................@....pdata...4.......6..................@..@_RDATA..\...........................@..@.rsrc...H...........................@..@.reloc..8...........................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11200
Entropy (8bit):	6.7627840671368835
Encrypted:	false
SSDEEP:
MD5:	0233F97324AAAA048F705D999244BC71
SHA1:	5427D57D0354A103D4BB8B655C31E3189192FC6A
SHA-256:	42F4E84073CF876BBAB9DD42FD87124A4BA10BB0B59D2C3031CB2B2DA7140594
SHA-512:	8339F3C0D824204B541AECBD5AD0D72B35EAF6717C3F547E0FD945656BCB2D52E9BD645E14893B3F599ED8F2DE6D3BCBEBF3B23ED43203599AF7AFA5A4000311
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....f............" .........................................................0.......>....`.........................................`................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12224
Entropy (8bit):	6.590253878523919
Encrypted:	false
SSDEEP:
MD5:	E1BA66696901CF9B456559861F92786E
SHA1:	D28266C7EDE971DC875360EB1F5EA8571693603E
SHA-256:	02D987EBA4A65509A2DF8ED5DD0B1A0578966E624FCF5806614ECE88A817499F
SHA-512:	08638A0DD0FB6125F4AB56E35D707655F48AE1AA609004329A0E25C13D2E71CB3EDB319726F10B8F6D70A99F1E0848B229A37A9AB5427BFEE69CD890EDFB89D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...._............" .........................................................0.......S....`.........................................`................ ...................!..............T............................................................................rdata..<...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11720
Entropy (8bit):	6.672720452347989
Encrypted:	false
SSDEEP:
MD5:	7A15B909B6B11A3BE6458604B2FF6F5E
SHA1:	0FEB824D22B6BEEB97BCE58225688CB84AC809C7
SHA-256:	9447218CC4AB1A2C012629AAAE8D1C8A428A99184B011BCC766792AF5891E234
SHA-512:	D01DD566FF906AAD2379A46516E6D060855558C3027CE3B991056244A8EDD09CE29EACEC5EE70CEEA326DED7FC2683AE04C87F0E189EBA0E1D38C06685B743C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....<.........." .........................................................0.......g....`.........................................`................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13760
Entropy (8bit):	6.575688560984027
Encrypted:	false
SSDEEP:
MD5:	6C3FCD71A6A1A39EAB3E5C2FD72172CD
SHA1:	15B55097E54028D1466E46FEBCA1DBB8DBEFEA4F
SHA-256:	A31A15BED26232A178BA7ECB8C8AA9487C3287BB7909952FC06ED0D2C795DB26
SHA-512:	EF1C14965E5974754CC6A9B94A4FA5107E89966CB2E584CE71BBBDD2D9DC0C0536CCC9D488C06FA828D3627206E7D9CC8065C45C6FB0C9121962CCBECB063D4F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......c.........." .........................................................0............`.........................................`...X............ ...................!..............T............................................................................rdata..\|...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.70261983917014
Encrypted:	false
SSDEEP:
MD5:	D175430EFF058838CEE2E334951F6C9C
SHA1:	7F17FBDCEF12042D215828C1D6675E483A4C62B1
SHA-256:	1C72AC404781A9986D8EDEB0EE5DD39D2C27CE505683CA3324C0ECCD6193610A
SHA-512:	6076086082E3E824309BA2C178E95570A34ECE6F2339BE500B8B0A51F0F316B39A4C8D70898C4D50F89F3F43D65C5EBBEC3094A47D91677399802F327287D43B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0......G.....`.........................................`...x............ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12744
Entropy (8bit):	6.599515320379107
Encrypted:	false
SSDEEP:
MD5:	9D43B5E3C7C529425EDF1183511C29E4
SHA1:	07CE4B878C25B2D9D1C48C462F1623AE3821FCEF
SHA-256:	19C78EF5BA470C5B295DDDEE9244CBD07D0368C5743B02A16D375BFB494D3328
SHA-512:	C8A1C581C3E465EFBC3FF06F4636A749B99358CA899E362EA04B3706EAD021C69AE9EA0EFC1115EAE6BBD9CF6723E22518E9BEC21F27DDAAFA3CF18B3A0034A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...r............" .........................................................0............`.........................................`...H............ ...................!..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.690164913578267
Encrypted:	false
SSDEEP:
MD5:	43E1AE2E432EB99AA4427BB68F8826BB
SHA1:	EEE1747B3ADE5A9B985467512215CAF7E0D4CB9B
SHA-256:	3D798B9C345A507E142E8DACD7FB6C17528CC1453ABFEF2FFA9710D2FA9E032C
SHA-512:	40EC0482F668BDE71AEB4520A0709D3E84F093062BFBD05285E2CC09B19B7492CB96CDD6056281C213AB0560F87BD485EE4D2AEEFA0B285D2D005634C1F3AF0B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....Y$..........." .........................................................0.......d....`.........................................`...H............ ...................!..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11720
Entropy (8bit):	6.615761482304143
Encrypted:	false
SSDEEP:
MD5:	735636096B86B761DA49EF26A1C7F779
SHA1:	E51FFBDDBF63DDE1B216DCCC753AD810E91ABC58
SHA-256:	5EB724C51EECBA9AC7B8A53861A1D029BF2E6C62251D00F61AC7E2A5F813AAA3
SHA-512:	3D5110F0E5244A58F426FBB72E17444D571141515611E65330ECFEABDCC57AD3A89A1A8B2DC573DA6192212FB65C478D335A86678A883A1A1B68FF88ED624659
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0......Xc....`.........................................`...<............ ...................!..............T............................................................................rdata..\...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12744
Entropy (8bit):	6.627282858694643
Encrypted:	false
SSDEEP:
MD5:	031DC390780AC08F498E82A5604EF1EB
SHA1:	CF23D59674286D3DC7A3B10CD8689490F583F15F
SHA-256:	B119ADAD588EBCA7F9C88628010D47D68BF6E7DC6050B7E4B787559F131F5EDE
SHA-512:	1468AD9E313E184B5C88FFD79A17C7D458D5603722620B500DBA06E5B831037CD1DD198C8CE2721C3260AB376582F5791958763910E77AA718449B6622D023C7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d..../}..........." .........................................................0......a.....`.........................................0................ ...................!..............T............................................................................rdata.. ...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15816
Entropy (8bit):	6.435326465651674
Encrypted:	false
SSDEEP:
MD5:	285DCD72D73559678CFD3ED39F81DDAD
SHA1:	DF22928E43EA6A9A41C1B2B5BFCAB5BA58D2A83A
SHA-256:	6C008BE766C44BF968C9E91CDDC5B472110BEFFEE3106A99532E68C605C78D44
SHA-512:	84EF0A843798FD6BD6246E1D40924BE42550D3EF239DAB6DB4D423B142FA8F691C6F0603687901F1C52898554BF4F48D18D3AEBD47DE935560CDE4906798C39A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...x............." .........................................................@.......5....`.........................................0................0...................!..............T............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.5874576656353145
Encrypted:	false
SSDEEP:
MD5:	5CCE7A5ED4C2EBAF9243B324F6618C0E
SHA1:	FDB5954EE91583A5A4CBB0054FB8B3BF6235EED3
SHA-256:	AA3E3E99964D7F9B89F288DBE30FF18CBC960EE5ADD533EC1B8326FE63787AA3
SHA-512:	FC85A3BE23621145B8DC067290BD66416B6B1566001A799975BF99F0F526935E41A2C8861625E7CFB8539CA0621ED9F46343C04B6C41DB812F58412BE9C8A0DE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...g P..........." .........................................................0............`.........................................0..."............ ...................!..............T............................................................................rdata..R...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13768
Entropy (8bit):	6.645869978118917
Encrypted:	false
SSDEEP:
MD5:	41FBBB054AF69F0141E8FC7480D7F122
SHA1:	3613A572B462845D6478A92A94769885DA0843AF
SHA-256:	974AF1F1A38C02869073B4E7EC4B2A47A6CE8339FA62C549DA6B20668DE6798C
SHA-512:	97FB0A19227887D55905C2D622FBF5451921567F145BE7855F72909EB3027F48A57D8C4D76E98305121B1B0CC1F5F2667EF6109C59A83EA1B3E266934B2EB33C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...r..x.........." .........................................................0.......(....`.........................................0................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12744
Entropy (8bit):	6.564006501134889
Encrypted:	false
SSDEEP:
MD5:	212D58CEFB2347BD694B214A27828C83
SHA1:	F0E98E2D594054E8A836BD9C6F68C3FE5048F870
SHA-256:	8166321F14D5804CE76F172F290A6F39CE81373257887D9897A6CF3925D47989
SHA-512:	637C215ED3E781F824AE93A0E04A7B6C0A6B1694D489E9058203630DCFC0B8152F2EB452177EA9FD2872A8A1F29C539F85A2F2824CF50B1D7496FA3FEBE27DFE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...h{............" .........................................................0......J(....`.........................................0................ ...................!..............T............................................................................rdata..F...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.678162783983714
Encrypted:	false
SSDEEP:
MD5:	242829C7BE4190564BECEE51C7A43A7E
SHA1:	663154C1437ACF66480518068FBC756F5CABB72F
SHA-256:	EDC1699E9995F98826DF06D2C45BEB9E02AA7817BAE3E61373096AE7F6FA06E0
SHA-512:	3529FDE428AFFC3663C5C69BAEE60367A083841B49583080F0C4C7E72EAA63CABBF8B9DA8CCFC473B3C552A0453405A4A68FCD7888D143529D53E5EEC9A91A34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...+P............" .........................................................0......@.....`.........................................0...e............ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20928
Entropy (8bit):	6.2047011292890195
Encrypted:	false
SSDEEP:
MD5:	FB79420EC05AA715FE76D9B89111F3E2
SHA1:	15C6D65837C9979AF7EC143E034923884C3B0DBD
SHA-256:	F6A93FE6B57A54AAC46229F2ED14A0A979BF60416ADB2B2CFC672386CCB2B42E
SHA-512:	C40884C80F7921ADDCED37B1BF282BB5CB47608E53D4F4127EF1C6CE7E6BB9A4ADC7401389BC8504BF24751C402342693B11CEF8D06862677A63159A04DA544E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...IV............" .........,...............................................P.......e....`.........................................0....%...........@...............0...!..............T............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19904
Entropy (8bit):	6.189411151090302
Encrypted:	false
SSDEEP:
MD5:	A5B920F24AEA5C2528FE539CD7D20105
SHA1:	3FAE25B81DC65923C1911649ED19F193ADC7BDDE
SHA-256:	5B3E29116383BA48A2F46594402246264B4CB001023237EBBF28E7E9292CDB92
SHA-512:	F77F83C7FAD442A9A915ABCBC2AF36198A56A1BC93D1423FC22E6016D5CC53E47DE712E07C118DD85E72D4750CA450D90FDB6F9544D097AFC170AEECC5863158
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.../..N.........." .........(...............................................P......C.....`.........................................0.... ...........@...............,...!..............T............................................................................rdata..$".......$..................@..@.rsrc........@.......(..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64456
Entropy (8bit):	5.53593950821058
Encrypted:	false
SSDEEP:
MD5:	5C2004DAF398620211F0AD9781FF4EC2
SHA1:	E43DD814E90330880EE75259809EEE7B91B4FFA6
SHA-256:	55BC91A549D22B160AE4704485E19DEE955C7C2534E7447AFB84801EE629639B
SHA-512:	11EDBBC662584BB1DEA37D1B23C56426B970D127F290F3BE21CD1BA0A80D1F202047ABB80D8460D17A7CACF095DE90B78A54F7C7EC395043D54B49FFE688DF51
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......F.........." ......................................................................`.........................................0...T................................!..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12736
Entropy (8bit):	6.592404054572702
Encrypted:	false
SSDEEP:
MD5:	DD899C6FFECCE1DCA3E1C3B9BA2C8DA2
SHA1:	2914B84226F5996161EB3646E62973B1E6C9E596
SHA-256:	191F53988C7F02DD888C4FBF7C1D3351570F3B641146FAE6D60ACDAE544771AE
SHA-512:	2DB47FAA025C797D8B9B82DE4254EE80E499203DE8C6738BD17DDF6A77149020857F95D0B145128681A3084B95C7D14EB678C0A607C58B76137403C80FE8F856
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...P..D.........." .........................................................0......N.....`.........................................0...x............ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16328
Entropy (8bit):	6.449442433945565
Encrypted:	false
SSDEEP:
MD5:	883120F9C25633B6C688577D024EFD12
SHA1:	E4FA6254623A2B4CDEA61712CDFA9C91AA905F18
SHA-256:	4390C389BBBF9EC7215D12D22723EFD77BEB4CD83311C75FFE215725ECFD55DC
SHA-512:	F17D3B667CC8002F4B6E6B96B630913FA1CB4083D855DB5B7269518F6FF6EEBF835544FA3B737F4FC0EB46CCB368778C4AE8B11EBCF9274CE1E5A0BA331A0E2F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...9..b.........." .........................................................@......^%....`.........................................0...4............0...................!..............T............................................................................rdata..d...........................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17864
Entropy (8bit):	6.393000322519701
Encrypted:	false
SSDEEP:
MD5:	29680D7B1105171116A137450C8BB452
SHA1:	492BB8C231AAE9D5F5AF565ABB208A706FB2B130
SHA-256:	6F6F6E857B347F70ECC669B4DF73C32E42199B834FE009641D7B41A0B1C210AF
SHA-512:	87DCF131E21041B06ED84C3A510FE360048DE46F1975155B4B12E4BBF120F2DD0CB74CCD2E8691A39EEE0DA7F82AD39BC65C81F530FC0572A726F0A6661524F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....v..........." ......... ...............................................@............`.........................................0...a............0...............$...!..............T............................................................................rdata..............................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18368
Entropy (8bit):	6.28071959876622
Encrypted:	false
SSDEEP:
MD5:	F816666E3FC087CD24828943CB15F260
SHA1:	EAE814C9C41E3D333F43890ED7DAFA3575E4C50E
SHA-256:	45E0835B1D3B446FE2C347BD87922C53CFB6DD826499E19A1D977BF4C11B0E4A
SHA-512:	6860ABE8AB5220EFB88F68B80E6C6E95FE35B4029F46B59BC467E3850FE671BDA1C7C1C7B035B287BDFED5DAEAC879EE481D35330B153EA7EF2532970F62C581
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......e.........." ........."...............................................@......:y....`.........................................0................0...............&...!..............T............................................................................rdata..............................@..@.rsrc........0......."..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14280
Entropy (8bit):	6.540126514657828
Encrypted:	false
SSDEEP:
MD5:	143A735134CD8C889EC7D7B85298705B
SHA1:	906AC1F3A933DD57798AE826BBEFA3096C20D424
SHA-256:	B48310B0837027F756D62C37EA91AF988BAA403CBCBD01CB26B6FDAE21EA96A2
SHA-512:	C9ABE209508AFAE2D1776391F73B658C9A25628876724344023E0FC8A790ECB7DBCE75FDDAE267158D08A8237F83336B1D2BD5B5CE0A8EED7DD41CBE0C031D48
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0.......>....`.........................................0................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\chrome_elf.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	817192
Entropy (8bit):	5.936911881800607
Encrypted:	false
SSDEEP:
MD5:	BFDA1775E273802C4B9AB7A66B1346B5
SHA1:	C5DB8EAA7D16C3E934A498D56D59F369B0CE791B
SHA-256:	EEE38FCC566322B1791213C083DF5FAC1C4E666B9449F255F33872B3593931A5
SHA-512:	B250D0C842E597B60B05BD92865B200C4F68795DB67019FEAC6F0C58CDA0AC45D707D7BB104BC5AB17AFFAEB436FB11ABC8D6EA0F303B70CED6F3E0C3D28BE98
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....\.........." .........>...............................................0.......8....`.....................................................(............@..$T...R..(&..........$...........................(...........................h........................text............................... ..`.rdata....... ......................@..@.data........@.......&..............@....pdata..$T...@...V..................@..@.00cfg...............&..............@..@.crthunk@............(..............@..@.gfids...............*..............@..@.oldntma.............,..............@....tls................................@...CPADinfo8............0..............@....rsrc................2..............@..@.reloc...............:..............@..B........................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\d3dcompiler_47.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4485672
Entropy (8bit):	6.3776489660820515
Encrypted:	false
SSDEEP:
MD5:	D060ECB1FC660EE3151F342184AA4352
SHA1:	EAEC5CCFCFCF6A65C4F115F921BEB9E053DF5590
SHA-256:	689672965C5792A9B85F7EE18A85A147D45B92370837C3A5BCFDEFCEF3F3828E
SHA-512:	13673ED85EC141F4AC210838BD6A3B3E084976F1005A9158F71DA3ADF8E10D0B3D61E50BFED08B3431D1F4A025AD54E9DACA10922E5940D998A5AD45504B22CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p&..4G..4G..4G.......G......5G..Q!..6G..=?..;G..4G...C..Q!..0G..Q!../G..Q!..:G..Q!..5G..Q!...G..Q!a.6G..Q!c.5G..Q!..5G..Rich4G..........................PE..d....(HL.........." .....`3..t......`m&.......................................E......uD...`A........................................@.A.x.....A......pD.@....`B......LD.(&....D......>.T...................8.6.(...0.6.............`.6..............................text....^3......`3................. ..`.rdata......p3......d3.............@..@.data....#...0A......"A.............@....pdata.......`B.......A.............@..@.rsrc...@....pD.......C.............@..@.reloc.......D.......C.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\bin\bash.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45576
Entropy (8bit):	6.165537778917208
Encrypted:	false
SSDEEP:
MD5:	7D6ADFFD5CC9B08558FD0FB58AE70C27
SHA1:	2925A2752BF33481EB0FBB9DED1F4C612F7160FB
SHA-256:	5C983E1130FCDA060B343E6AFE0BD5DAF2976AD394819994740874CC05F8B0DC
SHA-512:	2B5C839225CDBCE30C32844588E5C995DEF6F79D71DBDDF808D4B1B684FF4FE58D11A7B35CE4C44A6931DEA854134ED0E3DCCB1F15B04F0D5E8D80862A44BCC9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...oR.d..........&....(.:...~.................@............................. ......+.....`... .........................................8...............................h-......x............................j..(...................P................................text....9.......:..................`..`.data........P.......@..............@....rdata..0....`.......B..............@..@.pdata...............X..............@..@.xdata..@............\..............@..@.bss.....................................edata..8............`..............@..@.idata...............b..............@....CRT....`............p..............@....tls.................r..............@....rsrc................t..............@....reloc..x...........................@..B.debug..............................@.../19.....D.... ......................@..B/31...... ......."...N..............@..B/45.....

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\bin\git.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45048
Entropy (8bit):	6.203982330119595
Encrypted:	false
SSDEEP:
MD5:	B943F5BAF5DD586DEC08D4AED0113E1A
SHA1:	7572017CC664CF320315047C689B39C72DBE9C66
SHA-256:	287359E8A1E8A016A600915E62119BB3EF927CAFFCD548B29C791329DCC1FC53
SHA-512:	2C7C66CA175AEC714D1CB5EAF0572C3A8EFD77E760562F7280CD4343D8470C12B875F88948742A0049833941DD53E3B11CFED39CEB14FA76EB92FD33613730EE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...oR.d..........&....(.:...\|.................@............................. ............`... .........................................0...............................h-......x...p........................j..(...................P................................text....9.......:..................`..`.data........P.......@..............@....rdata..0....`.......B..............@..@.pdata...............X..............@..@.xdata..@............\..............@..@.bss.....................................edata..0............`..............@..@.idata...............b..............@....CRT....`............p..............@....tls.................r..............@....rsrc................t..............@....reloc..x...........................@..B.debug..............................@.../19.....D.... ......................@..B/31...... ......."...L..............@..B/45.....

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\bin\sh.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45576
Entropy (8bit):	6.165537778917208
Encrypted:	false
SSDEEP:
MD5:	7D6ADFFD5CC9B08558FD0FB58AE70C27
SHA1:	2925A2752BF33481EB0FBB9DED1F4C612F7160FB
SHA-256:	5C983E1130FCDA060B343E6AFE0BD5DAF2976AD394819994740874CC05F8B0DC
SHA-512:	2B5C839225CDBCE30C32844588E5C995DEF6F79D71DBDDF808D4B1B684FF4FE58D11A7B35CE4C44A6931DEA854134ED0E3DCCB1F15B04F0D5E8D80862A44BCC9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...oR.d..........&....(.:...~.................@............................. ......+.....`... .........................................8...............................h-......x............................j..(...................P................................text....9.......:..................`..`.data........P.......@..............@....rdata..0....`.......B..............@..@.pdata...............X..............@..@.xdata..@............\..............@..@.bss.....................................edata..8............`..............@..@.idata...............b..............@....CRT....`............p..............@....tls.................r..............@....rsrc................t..............@....reloc..x...........................@..B.debug..............................@.../19.....D.... ......................@..B/31...... ......."...N..............@..B/45.....

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\cmd\git-gui.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	136200
Entropy (8bit):	7.559366551762514
Encrypted:	false
SSDEEP:
MD5:	BCABCB8AB2BE055F7C3DA8E8737765A0
SHA1:	B6C1BD83B8EC94EF431CC2A066319B27C4BBE321
SHA-256:	CB1839DD8608CACDDACA1C72798D3423D50AFF38ECDA3C9F76EC7A4314ED6535
SHA-512:	1A43A30B28E4A1DB29EED28274C98602A52D201517B65ACC0C28932AAB07E5A695F9FB0D3EC688561C6E596E6DA310E20497C49D01325066C1129E5B1CE25573
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...oR.d..........&....(.:.....................@....................................P.....`... .........................................4................o..............h-...`..x....p.......................j..(...................P................................text....9.......:..................`..`.data........P.......@..............@....rdata..0....`.......B..............@..@.pdata...............X..............@..@.xdata..@............\..............@..@.bss.....................................edata..4............`..............@..@.idata...............b..............@....CRT....`............p..............@....tls.................r..............@....rsrc....o.......o...t..............@....reloc..x....`......................@..B.debug.......p......................@.../19.....D...........................@..B/31...... ...P..."..................@..B/45.....

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\cmd\git.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45048
Entropy (8bit):	6.203982330119595
Encrypted:	false
SSDEEP:
MD5:	B943F5BAF5DD586DEC08D4AED0113E1A
SHA1:	7572017CC664CF320315047C689B39C72DBE9C66
SHA-256:	287359E8A1E8A016A600915E62119BB3EF927CAFFCD548B29C791329DCC1FC53
SHA-512:	2C7C66CA175AEC714D1CB5EAF0572C3A8EFD77E760562F7280CD4343D8470C12B875F88948742A0049833941DD53E3B11CFED39CEB14FA76EB92FD33613730EE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...oR.d..........&....(.:...\|.................@............................. ............`... .........................................0...............................h-......x...p........................j..(...................P................................text....9.......:..................`..`.data........P.......@..............@....rdata..0....`.......B..............@..@.pdata...............X..............@..@.xdata..@............\..............@..@.bss.....................................edata..0............`..............@..@.idata...............b..............@....CRT....`............p..............@....tls.................r..............@....rsrc................t..............@....reloc..x...........................@..B.debug..............................@.../19.....D.... ......................@..B/31...... ......."...L..............@..B/45.....

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\cmd\gitk.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	136200
Entropy (8bit):	7.55883584378142
Encrypted:	false
SSDEEP:
MD5:	DE724541A0485CF73DF1C7D1DEDAEC3F
SHA1:	3CA666EBD65EB77400F4D89C6484165C0B5FFD52
SHA-256:	1106F9B25E48B108361E2FDBB0F5D7703F89A3221B61EDABD03A2B461098E016
SHA-512:	43DF7F9DB03FC687F42C608A1D8AF6EE4D4196370C999B76F428DD90A2409C857F56C30CF4858CDCBB1D6A6E6C242C8750FF6FC416BF8B7DC6C5E7B7D57A2D9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...oR.d..........&....(.:.....................@....................................K$....`... .........................................1................o..............h-...`..x....p.......................j..(...................P................................text....9.......:..................`..`.data........P.......@..............@....rdata..0....`.......B..............@..@.pdata...............X..............@..@.xdata..@............\..............@..@.bss.....................................edata..1............`..............@..@.idata...............b..............@....CRT....`............p..............@....tls.................r..............@....rsrc....o.......o...t..............@....reloc..x....`......................@..B.debug.......p......................@.../19.....D...........................@..B/31...... ...P..."..................@..B/45.....

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\cmd\scalar.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45048
Entropy (8bit):	6.203982330119595
Encrypted:	false
SSDEEP:
MD5:	B943F5BAF5DD586DEC08D4AED0113E1A
SHA1:	7572017CC664CF320315047C689B39C72DBE9C66
SHA-256:	287359E8A1E8A016A600915E62119BB3EF927CAFFCD548B29C791329DCC1FC53
SHA-512:	2C7C66CA175AEC714D1CB5EAF0572C3A8EFD77E760562F7280CD4343D8470C12B875F88948742A0049833941DD53E3B11CFED39CEB14FA76EB92FD33613730EE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...oR.d..........&....(.:...\|.................@............................. ............`... .........................................0...............................h-......x...p........................j..(...................P................................text....9.......:..................`..`.data........P.......@..............@....rdata..0....`.......B..............@..@.pdata...............X..............@..@.xdata..@............\..............@..@.bss.....................................edata..0............`..............@..@.idata...............b..............@....CRT....`............p..............@....tls.................r..............@....rsrc................t..............@....reloc..x...........................@..B.debug..............................@.../19.....D.... ......................@..B/31...... ......."...L..............@..B/45.....

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\git-bash.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	137224
Entropy (8bit):	7.538421711983135
Encrypted:	false
SSDEEP:
MD5:	16C9E7021C2A0B4C7F2C9DF843E6F5EB
SHA1:	348B4D4A45C24D91C081F73471D677B55518761E
SHA-256:	624155444368D5159736E9CCA825850E278D4C0FFA3BBFCB8099ACC318A05B3D
SHA-512:	0B5A35F0C7C587B41C3C522F28BB0025B8380EE43459DF019DAC58B651FDB6AB92454A70E84F191158903045D223BD4FC64D615D19E95914066244AC16B28714
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...oR.d..........&....(.:.....................@....................................P.....`... .........................................5................r..............h-...p..x............................j..(...................P................................text....9.......:..................`..`.data........P.......@..............@....rdata..0....`.......B..............@..@.pdata...............X..............@..@.xdata..@............\..............@..@.bss.....................................edata..5............`..............@..@.idata...............b..............@....CRT....`............p..............@....tls.................r..............@....rsrc....r.......r...t..............@....reloc..x....p......................@..B.debug..............................@.../19.....D...........................@..B/31...... ...`..."..................@..B/45.....

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\git\git-cmd.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	136696
Entropy (8bit):	7.5475559987825935
Encrypted:	false
SSDEEP:
MD5:	8E48E14F5F139D256047726E1A85BD1B
SHA1:	C59D3646A335CD961C6385C65C75D7A03FE1143E
SHA-256:	ABC826E4BA8F6ECDD5C0D41DD82265850C8869ACBA14D5D7812E2DB04873A51E
SHA-512:	7354B421C21662A388C9B78C5FA6ACF82A703EAE6FB4A3BCA99A0CEB16437555D4E8ED1D7F9AF8C2BCD5AD62ABAE13E2DD39E883D15D1091556A4E0AD724F4C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...oR.d..........&....(.:.....................@..........................................`... .........................................4................p..............h-...p..x...p........................j..(...................P................................text....9.......:..................`..`.data........P.......@..............@....rdata..0....`.......B..............@..@.pdata...............X..............@..@.xdata..@............\..............@..@.bss.....................................edata..4............`..............@..@.idata...............b..............@....CRT....`............p..............@....tls.................r..............@....rsrc....p.......p...t..............@....reloc..x....p......................@..B.debug..............................@.../19.....D...........................@..B/31...... ...`..."..................@..B/45.....

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\guirq.rar

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	317470
Entropy (8bit):	7.9994857247432005
Encrypted:	true
SSDEEP:
MD5:	87DAF01078A7A7ACA146DB8DE935B97E
SHA1:	6AA0E88EF8D274F08409C63D5E2FE885E1C45D62
SHA-256:	D8387AF9263F8427B2EAAEF4A20D2C2951316CAF69DBDDD59DF0EABE9E8901D2
SHA-512:	361F9533007097279FB2E37138D2CEA7DAF5AC013D6D1C8A52BF6CBB96874441DF0CEE14BA989526AEEC385FB1435D551F65704FBD7D56F9159BE17507899418
Malicious:	false
Preview:	Rar!......U!...........O.2v..^.9...v[.........Z.#...G1.K.$.,5...;..k.XA.$4.c)R...........a.@v.e.<......E..SC$....O;3..s...........T+......o\|R.)._a..L.q..Q....>.C.62......MmP.}bSs:.....$..h.$!./..v.\...h..Lovd..+.n........u.%.Y..rH....7.}R..7...I..8.~.09].....2},....%..'?.....p8..;#U.#..;........Q.J.........}...5 G....^.!........J=->.0)...'Q_..A.RS.7..,.}.....%i....#!..r..s....Dg(X.a.....N>A...]LyC...3..m.4.j..`Ec..x......9.}..../.......l.0.&.%{]&.........?.....0....v._.]v...U..eS.y..Sn.....m..`..[gh{;....P.....i...S...v.......f...)=-.jP.\|..2.2m..@...3y........ s.c..5k.....8.....s..+(\|gu.d.G[.d.Wv..:....W......)...L.........h.t..D.,"\G8q....p.o3F..`....0.....6..f......U....iB..EP<Yd3%..e..\.:.%{..S^..Z.!..k.. ..}..:....=.7w...B..5."\|..\|q..3mH.....x.?\|..7....j#...zK...2c...I..y..........r.-..v.tu=6..,v.r...qp"....=...w..Bw..6.I..5.u..)...KC.-....g.h/L^30.ma.....Y~....}..Pl...]..&.....b.._..O..Q....sc....[......N!.ifo..CR.w.h.J.$...!...F..1N...5.

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\libEGL.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	400120
Entropy (8bit):	6.311126602723927
Encrypted:	false
SSDEEP:
MD5:	916402208DD64CAD670EF6836765CF79
SHA1:	BFC7389109ACDFD046C0413AD5D3093FC89F519E
SHA-256:	A152B9CD1AB52D196C9E24940643499008A097ABB070A0A977E8AC4182AB5A71
SHA-512:	828085BF57E9B076F975F31B6B9F517E5C14178EDE579D545553888F7731C7A55274BC5F29991716F6B14A40E0FCCEE6120AEFCEE718518BB19A3F5D65112CE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Q.'`.........." ................@.....................................................`A........................................h"......p-..(....`..x.......l9...........p......T...........................(....\|...............0...............................text............................... ..`.rdata...j...0...l..................@..@.data...,N....... ..................@....pdata..l9.......:..................@..@.00cfg.......0......................@..@.gehcont.....@......................@..@.tls....!....P......................@....rsrc...x....`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\libGLESv2.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6674168
Entropy (8bit):	6.439045972076035
Encrypted:	false
SSDEEP:
MD5:	B2A109C0EEC49B8E7535EC9AC05DF3EC
SHA1:	902681A468DEBA475D2B30EC98962D39680F41F5
SHA-256:	B03B0AED99EB789BB75FFEC82ED96DAE3A4BA84B56338CB53CF266400F4F79AB
SHA-512:	791FB41B5FB1171B3282D17131048F89120367BDC6CE8C67F6B9AB488B303FF8D8D3B90C44FC7AEB4EEE6D26D74FFD9E35D3F85019F26D90502F49540D8423B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Q.'`.........." ......G...........D.............................................6Df...`A..........................................[.......].d....`..........<X....e......p..,....=[.....................8<[.(...@#Z..............]......[.@....................text.....G.......G................. ..`.rdata..t.....G.......G.............@..@.data...t@e...^......n^.............@....pdata..<X.......Z...Db.............@..@.00cfg.......0........d.............@..@.gehcont.....@........d.............@..@.tls....1....P........d.............@....rsrc........`........d.............@..@.reloc..,....p........d.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\node.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12742392
Entropy (8bit):	6.584121039677505
Encrypted:	false
SSDEEP:
MD5:	CF9CEC49B348BC0DDA63992CE68ACA20
SHA1:	E67ADEA111190BB7284A013B5644AD9CC9D49670
SHA-256:	BD10B2457FDC98CB4B4E1A6D6DAC03CA84B442631FCEB85C0BB319905122F745
SHA-512:	A7C6D7DC39279CAC9658288E072FBF53E3B4E0E613DB380F01D449519D4828A469847AC7A3498C20C74D76EE05D07D4B6EE3EB419893BF34F16CCB325AA5EB69
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......`.........." ......g...Z.....twg.............................................Ss....`.........................................0...C...s........................R.......... ...............................(......................8 ...........................text.....g.......g................. ..`.rdata..d.V...g...V...g.............@..@.data.....)........................@....pdata...............H..............@..@.00cfg...............<..............@..@.tls.................>..............@....rsrc................@..............@..@.reloc.. ............F..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\smartgit-updater.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	148856
Entropy (8bit):	4.180002572542603
Encrypted:	false
SSDEEP:
MD5:	7F557BAFF029D4B724BA74DBA9564647
SHA1:	1D441CF1D331D49DAA4805C178EEF67C72BE7753
SHA-256:	6708FA90D5C1543D3C42E2EFB274BECD2E97C450FA9669FD3780EF293A9F1E1A
SHA-512:	FD1932228864281CE60343508F798887183D599D31CEA6C1247A2BB1645A62B864BB08513161F9EEB7D678433BB01840593477B4D5DA3BE28E26E24A642B61EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......c...............#............. ........@.....................................A......... ..............................................................P......."..x#..........................................................l................................text............................... .P`.data...0....0......................@.P..rdata.......@......................@.P@.pdata.......P......."..............@.0@.xdata.......`.......$..............@.0@.bss....@....p........................`..idata...............&..............@.0..rsrc................,..............@.0..reloc............... ..............@.0B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\smartgit.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	460144
Entropy (8bit):	5.918754254337758
Encrypted:	false
SSDEEP:
MD5:	846CCE051E8E1EECBF7AF5FBB6D254A7
SHA1:	CDF4675FD842FFDDC2564A9139B7A9A6E0BC75E5
SHA-256:	DEF3EBA3D76A81DA41DFFE07B2359D420D83D535B39B71755CF622DFAE82FE3F
SHA-512:	E5F150696E75C5C41EE874D38F9EF1DEE3417AC70844731E61442A0601C8F6BB0BB212A342FEA81DAFA9AD64DEB4352AFE72240D6DC7C4840B83246A5A5245B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,v..B%..B%..B%C..%..B%...%.B%...%T.B%.y,%..B%.y9%..B%..C%;.B%...%..B%...%..B%...%..B%...%..B%Rich..B%................PE..d......a.........."......z...H.................@.....................................J....@.........................................p........o..d................)......p%...........................................................................................text....y.......z.................. ..`.rdata...............~..............@..@.data............(...t..............@....pdata...).......*..................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\smartgit.launcher

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	833
Entropy (8bit):	5.297919744413499
Encrypted:	false
SSDEEP:
MD5:	239B9A6251AFE30CF6857FCC6188CFAB
SHA1:	E01778A9A32BD3A71C48BFB73CDAC551659E996E
SHA-256:	40D578EF9E577365581206179D24A03FD51B3F4FF74DE45FEB11129231660F3A
SHA-512:	B8F5DE77436AC5DE72DF00EAAB59C53319673D0EAB2F8F8BE948FD818C465834F2984C1680418D70CA401C1639AB854D5E2CEC8F5FA7E0F78E6442EF6E5AB9FA
Malicious:	false
Preview:	# DO NOT EDIT THIS FILE!..# To change Java VM options ("-X"-options) for the installation,..# edit smartgit.vmoptions...# To change Java VM options ("-X"-options) for the current user only,..# create and edit ${APPDATA}\syntevo\SmartGit\smartgit.vmoptions...# To change SmartGit system properties, modify smartgit.properties..# (located in SmartGit's settings directory)....# set initial Java heap size..-Xms48m....# set maximum Java heap size..-Xmx1024m....# Use G1 garbage collector which reliably frees unused memory..-XX:+UseG1GC..-XX:MaxGCPauseMillis=100..-XX:InitiatingHeapOccupancyPercent=25..-XX:MaxJavaStackTraceDepth=1000000....# don't create %TEMP%\hsperfdata_user dir..-XX:-UsePerfData....-include-options ${APPDATA}\syntevo\SmartGit\smartgit.vmoptions....-XX:ErrorFile=${APPDATA}\syntevo\SmartGit\23.1\hs_err_pid%p.log..

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\smartgit.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Mon Apr 22 14:09:26 2024, mtime=Tue Oct 1 12:52:40 2024, atime=Mon Apr 22 14:09:26 2024, length=460144, window=hide
Category:	dropped
Size (bytes):	2040
Entropy (8bit):	3.825615963477796
Encrypted:	false
SSDEEP:
MD5:	4C5F50BAC0F0ABB11674A4C1D60201E9
SHA1:	DA19556503F4A464E077D736E14647251F2739D4
SHA-256:	51CE15EF37DD062FDA9DE342AD4172E8D7C41271CCB06C5C3CF9EAC55C9FEB7C
SHA-512:	60BF88E53D612B13957E5E6EA81F1FAFF2435456718A36F3E77F2A72A4490A5828C4E4D7C0A4FBABE0E262287F2D4000E14315E078F72415C46DEEC06D660535
Malicious:	false
Preview:	L..................F.@.. ...........z`............p.......................0.:..DG..Yr?.D..U..k0.&...&......vk.v.....nO......../........t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^AYln...........................%..A.p.p.D.a.t.a...B.V.1.....AY.n..Roaming.@......CW.^AY.n............................W.R.o.a.m.i.n.g.....\.1.....AY.n..HAYECO~1..D......AY.nAY.n............................W.H.a.y.e. .C.o.s.q.....Z.1.....AY.n..NoqotApp..B......AY.nAY.n..........................j...N.o.q.o.t.A.p.p.....f.2.p....X-y .smartgit.exe..J......X-yAY.n..............................s.m.a.r.t.g.i.t...e.x.e.......m...............-.......l............s.......C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\smartgit.exe......\.s.m.a.r.t.g.i.t...e.x.e.2.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.H.a.y.e. .C.o.s.q.\.N.o.q.o.t.A.p.p.\.e.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.M.i.c.r.o.s.o.f.t.\.I.n.s.t.a.l.l.e.r.\.{.3.E.2.8.E.E.F.E

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\smartgit.vmoptions

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.894158296017299
Encrypted:	false
SSDEEP:
MD5:	CB8C35B8866AEDD658051CC877AAD3E0
SHA1:	AD3539A61621B497878DC3B584FB3333D6057D39
SHA-256:	1EE29CB6AF2E933E1828DD2C2752343963648E72D77CC8A66E9CA76B5D2593AD
SHA-512:	57ADC768001DBFF2146AEAC582E092B7D1F034D454E09A788BF3D21DF16F3DD9A4273FF7977BBC0EBB8A830E573B8D1D15A1C6B60990E535958433318643ACCE
Malicious:	false
Preview:	-Dsmartboot.sourceDirectory=.updates..-Dsmartgit.settings=${smartgit.installation}\.settings..-XX:ErrorFile=%EXE4J_EXEDIR%..\.settings\hs_err_pid%p.log..#-XX:StartFlightRecording=filename=recording.jfr,dumponexit=true..

C:\Users\user\AppData\Roaming\Haye Cosq\NoqotApp\smartgitc.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	460144
Entropy (8bit):	5.918880572622775
Encrypted:	false
SSDEEP:
MD5:	B15D67987E131B813C35BE5719AA4C20
SHA1:	07F51B1A56AD583972B3E700D50DA2247564455A
SHA-256:	477480D485177A62AEDDC5FC15DDA4F77C32C4FA8D281AC3A6E8348D38761603
SHA-512:	453486235A5C38BBB0301BBDBDDB2C101AB4346BFCE94523BBB8C5482D67C09AA0B10E5E9E2CC7502557F73651537C0AAC9DB68214E37F716704C5438479BC2D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,v..B%..B%..B%C..%..B%...%.B%...%T.B%.y,%..B%.y9%..B%..C%;.B%...%..B%...%..B%...%..B%...%..B%Rich..B%................PE..d......a.........."......z...H.................@....................................F.....@.........................................p........o..d................)......p%...........................................................................................text....y.......z.................. ..`.rdata...............~..............@..@.data............(...t..............@....pdata...).......*..................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Installer\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\icon_33.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 9 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	176772
Entropy (8bit):	4.212096109500017
Encrypted:	false
SSDEEP:
MD5:	A83A13934150EE37B486B842B5335D9D
SHA1:	EAB88F5C76A754455CDD5ACC023A703533CB2232
SHA-256:	31D3403B05A9D5F947D21521C043C2809B7B506424043D7985430640CC5911A4
SHA-512:	5A52308269864E00B61062D34E97167B5ABB974418EDE66C24543C2566284BCA810D437F7C79C6412BFCBBE462E10E2A3F618810E81D118B9E1451572DAD070B
Malicious:	false
Preview:	............ ..:............ .(....:..``.... ......B..HH.... ..T......@@.... .(B...,..00.... ..%..Dn.. .... .............. ............... .h........PNG........IHDR.............\r.f....pHYs..........o.d.. .IDATx..wx\.....F..H.-.l.13.15t.......lB.....^.&.}.M.lI!.y...B.&....HbZl...q/....>...dK..43:g.....K..h.<73..~.x.4.4...(...........T.".@9J."R...~\|..I.q .R....=@'.....ID...(u....!.......a%.........8.8o......6...c;J.........R.d...ryd...\.2........Bd...(vV....;Pj3".Qj#.YB.~...8....F..4...J........b.E..6././..%.jsX.)............Q.Z.B.y\|..6.....$...y.S.y`.[.=(u3"o.....(u...P.QD..`..i.&;....e.3......f.~..J..^.V#...'..h2.)..Q.Y.R..>..ux...(.'.A`..B^.."<.`.....;....N.3..A...=..$.RN.T.x. G.i..w.....{.=(...R..V..)D<..%.4..w....)wZ....P.AD~(..V..)$<..!.4o......}s+.....+...N.S.x7..(.4.../.+...#;.....I(.tZ...).4.p.@.(.eD.N..1....P."....RP..>..@.iY<,e;.U.Z.E...)...i^.\|...iY<l.U....B.rZ.70........A....c...'P....tZ.'..7....Q.+..]L..;....?B.oH(..0N0%....oC.n..iY<\.....

C:\Users\user\AppData\Roaming\Microsoft\Installer\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\icon_35.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 9 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	172242
Entropy (8bit):	3.920583934112822
Encrypted:	false
SSDEEP:
MD5:	38EADA415479858E73B3791D1A2F2A8A
SHA1:	53972C0D6830BB51F5E324D16675FFCE7AC67A69
SHA-256:	9E5A10145DD2A9AFB76B584FFCAEB50C1A7D5C87EA9F6ECB2A70CBF6B79F58B0
SHA-512:	F244025DF4CFCC7316E70E45CE0AEEE448253A92A1EF2BCAA4B2F45FD383BE88C38D24AB2629631EEA6BDDDE98207135EE0C7DF82AC7911B6A15B7C2279FE83B
Malicious:	false
Preview:	............ .\|(............ .(....)..``.... .....:1..HH.... ..T......@@.... .(B..j...00.... ..%...\.. .... .....:......... .............. .h...j....PNG........IHDR.............\r.f....pHYs..........o.d.. .IDATx...y....7..^f..a.qaQ.M@e...f0....,.'.<.sN.3.&...F..&.%F.g@.MBD......j4n.A`......G3..=.t.R...9s...U_g....w.W...~....(....`..)G#..@OVli....0vL.l.\...(..D*..PT..3\|...K:.mn..6BQ....H..j..)'A8...A8..K....sr....g ...@..u.f1.b"..L.p..4....X.....m.0..\ .O.;W..j.4..os&....Y....k.3....W....c0}..a0>..........-b@.@....Y L.0..K.tI+.`..m.....@.@.@..._....re........^.p.\.-..)...`.......i..4"..ee83)....l ..0... ...W.........\.NX.gJ...c..{4S!c....f.0]...s3.>.#.`.0.D.... .+K.........\.r..CR.b`.c.. ..,.2..j.y{.RA4....7..........r.mq\|IO.@.l\|..!D......2.Lt.Q)...`..K...t/@[.TRI.Q..KFR."h.c....w........aQ...`...\U.W.O...\n.z..).a....J..A.zYYl0..)....._..+..........~.$.....i.}....L.....xR.!.......C.,..x=.V..:.D$. DO.{.r...{Y)1@...]......U.O..Kr..Z.U"...]..G......Y.du<"@.@

C:\Windows\Installer\480495.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {EE3A39B9-5A50-459E-950A-80F951511BDC}, Number of Words: 10, Subject: NoqotApp, Author: Haye Cosq, Name of Creating Application: NoqotApp, Template: x64;2057, Comments: This installer database contains the logic and data required to install NoqotApp., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Mon Sep 30 16:03:45 2024, Last Saved Time/Date: Mon Sep 30 16:03:45 2024, Last Printed: Mon Sep 30 16:03:45 2024, Number of Pages: 450
Category:	dropped
Size (bytes):	57166336
Entropy (8bit):	7.946264592203114
Encrypted:	false
SSDEEP:
MD5:	2D6151DBBBB50C077564EF7FFC971A4E
SHA1:	B67EC6DD683F5F8B12D52AA79AEEE9A498380589
SHA-256:	2EAE05E829F353C9A8D01683187EB759DBF73F90CCD435F03D46761B03247FBD
SHA-512:	22A30787CF820DA489ED59B8F6401B1282B923A66F796211C2300F1864F4F10BEE01D24133BFCB35975695F32273796CACDEF03D726345C7A12CFB8CE6509979
Malicious:	false
Preview:	......................>...................i.......................y........................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI2F4.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	891744
Entropy (8bit):	6.589375265168366
Encrypted:	false
SSDEEP:
MD5:	6119E62D8047032A715BA0670FC476C5
SHA1:	52E639024460BF111C469E95FB011C07D6FC89E8
SHA-256:	BC31F85266DF2CDFDBE22149937105388FA3ADC17E3646FA4A167736E819AF77
SHA-512:	E7301FA21F01F7F7562B853E9BB246ED051951E3CEF152BB0B3558D4863F141EDBBC0C4D439C30F51F9997805490F131A5E4CD00872B61CCB08BA9D200F811D8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........*?..Dl..Dl..Dla.Gm..Dla.Am..Dl.d@m..Dl.dGm..Dla.@m..Dl.dAm..Dla.Bm..Dla.Em..Dl..El..Dl.dMm..Dl.dDm..Dl.d.l..Dl...l..Dl.dFm..DlRich..Dl........................PE..L.....e.........."!...&.............5...............................................H....@A................................8........ ..h............^..`=...0..........p........................... ...@...................l...@....................text...Z........................... ..`.rdata..............................@..@.data...('..........................@....didat..H...........................@....rsrc...h.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSI333.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	373600
Entropy (8bit):	6.517672795827092
Encrypted:	false
SSDEEP:
MD5:	54D74546C6AFE67B3D118C3C477C159A
SHA1:	957F08BEB7E27E657CD83D8EE50388B887935FAE
SHA-256:	F9956417AF079E428631A6C921B79716D960C3B4917C6B7D17FF3CB945F18611
SHA-512:	D27750B913CC2B7388E9948F42385D0B4124E48335AE7FC0BC6971F4F807DBC9AF63FE88675BC440EB42B9A92551BF2D77130B1633DDDA90866616B583AE924F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........."..q..q..q3..p..q3..pP.q.s.p..q.s.p..q.s.p..q3..p..q3..p..q..q..q.s.p..q.s.p..q.sJq..q.."q..q.s.p..qRich..q........................PE..L.....e.........."!...&............................................................R4....@A............................X............`...............v..`=.......5..`...p...............................@............................................text...Z........................... ..`.rdata...!......."..................@..@.data....!...0......................@....rsrc........`.......(..............@..@.reloc...5.......6...@..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI9AC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	694329
Entropy (8bit):	6.022414312563561
Encrypted:	false
SSDEEP:
MD5:	4059ACA51C0A1D2B66FDD348631E55CE
SHA1:	89C9AF75DAC980698FCD5E133AB9541E7EDBD7AC
SHA-256:	C728C6EF38E361B2AB370329E9C1D698B3CFCDF985BCBADEE374C7AD69C858E4
SHA-512:	CBD544ED48823BAFC6843B7FA705E969B6503FF114AFBB38C5380F6ECB95BCCC694E26E5C978D9566B66FBBAA79C463C8706D29CFBDC0890307893742CEBB0B2
Malicious:	false
Preview:	...@IXOS.@.....@.NAY.@.....@.....@.....@.....@.....@......&.{3E28EEFE-5291-43E1-AA61-E4D35B611491}..NoqotApp..app__v7.3.5_.msi.@.....@.....@.....@......icon_35.exe..&.{EE3A39B9-5A50-459E-950A-80F951511BDC}.....@.....@.....@.....@.......@.....@.....@.......@......NoqotApp......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........AI_RemoveAllTempFiles....J...AI_RemoveAllTempFiles.@......h...MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4..pp.#p.#p.#..."{.#..."..#..."f.#vR."b.#vR."g.#vR."?.#..."..#p.#..#.R."`.#.R."q.#.RX#q.#p.0#q.#.R."q.#Richp.#................PE..L...m.e.........."!...&..................... ............................................@A....................................<.......................h:..........@c..p....................c.......b..@............ ...............................text............................... .

C:\Windows\Installer\MSIAA0.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	756576
Entropy (8bit):	6.616629532136608
Encrypted:	false
SSDEEP:
MD5:	B158D8D605571EA47A238DF5AB43DFAA
SHA1:	BB91AE1F2F7142B9099E3CC285F4F5B84DE568E4
SHA-256:	CA763693CC25D316F14A9EBAD80EBF00590329550C45ADB7E5205486533C2504
SHA-512:	56AEF59C198ACF2FCD0D95EA6E32CE1C706E5098A0800FEFF13DDB427BFB4D538DE1C415A5CB5496B09A5825155E3ABB1C13C8C37DC31549604BD4D63CB70591
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......+.ZRo.4.o.4.o.4...7.d.4...1...4.iV0.}.4.iV7.x.4.iV1.!.4...0.v.4...2.n.4...5.F.4.o.5...4..V=...4..V4.n.4..V..n.4.o..n.4..V6.n.4.Richo.4.........................PE..L.....e.........."!...&............................................................bL....@A........................ ..........,....................N..`=.......x..p...p...............................@...............x............................text...j........................... ..`.rdata..H...........................@..@.data....%..........................@....rsrc...............................@..@.reloc...x.......z..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIAF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	756576
Entropy (8bit):	6.616629532136608
Encrypted:	false
SSDEEP:
MD5:	B158D8D605571EA47A238DF5AB43DFAA
SHA1:	BB91AE1F2F7142B9099E3CC285F4F5B84DE568E4
SHA-256:	CA763693CC25D316F14A9EBAD80EBF00590329550C45ADB7E5205486533C2504
SHA-512:	56AEF59C198ACF2FCD0D95EA6E32CE1C706E5098A0800FEFF13DDB427BFB4D538DE1C415A5CB5496B09A5825155E3ABB1C13C8C37DC31549604BD4D63CB70591
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......+.ZRo.4.o.4.o.4...7.d.4...1...4.iV0.}.4.iV7.x.4.iV1.!.4...0.v.4...2.n.4...5.F.4.o.5...4..V=...4..V4.n.4..V..n.4.o..n.4..V6.n.4.Richo.4.........................PE..L.....e.........."!...&............................................................bL....@A........................ ..........,....................N..`=.......x..p...p...............................@...............x............................text...j........................... ..`.rdata..H...........................@..@.data....%..........................@....rsrc...............................@..@.reloc...x.......z..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC95.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	756576
Entropy (8bit):	6.616629532136608
Encrypted:	false
SSDEEP:
MD5:	B158D8D605571EA47A238DF5AB43DFAA
SHA1:	BB91AE1F2F7142B9099E3CC285F4F5B84DE568E4
SHA-256:	CA763693CC25D316F14A9EBAD80EBF00590329550C45ADB7E5205486533C2504
SHA-512:	56AEF59C198ACF2FCD0D95EA6E32CE1C706E5098A0800FEFF13DDB427BFB4D538DE1C415A5CB5496B09A5825155E3ABB1C13C8C37DC31549604BD4D63CB70591
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......+.ZRo.4.o.4.o.4...7.d.4...1...4.iV0.}.4.iV7.x.4.iV1.!.4...0.v.4...2.n.4...5.F.4.o.5...4..V=...4..V4.n.4..V..n.4.o..n.4..V6.n.4.Richo.4.........................PE..L.....e.........."!...&............................................................bL....@A........................ ..........,....................N..`=.......x..p...p...............................@...............x............................text...j........................... ..`.rdata..H...........................@..@.data....%..........................@....rsrc...............................@..@.reloc...x.......z..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICD5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	756576
Entropy (8bit):	6.616629532136608
Encrypted:	false
SSDEEP:
MD5:	B158D8D605571EA47A238DF5AB43DFAA
SHA1:	BB91AE1F2F7142B9099E3CC285F4F5B84DE568E4
SHA-256:	CA763693CC25D316F14A9EBAD80EBF00590329550C45ADB7E5205486533C2504
SHA-512:	56AEF59C198ACF2FCD0D95EA6E32CE1C706E5098A0800FEFF13DDB427BFB4D538DE1C415A5CB5496B09A5825155E3ABB1C13C8C37DC31549604BD4D63CB70591
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......+.ZRo.4.o.4.o.4...7.d.4...1...4.iV0.}.4.iV7.x.4.iV1.!.4...0.v.4...2.n.4...5.F.4.o.5...4..V=...4..V4.n.4..V..n.4.o..n.4..V6.n.4.Richo.4.........................PE..L.....e.........."!...&............................................................bL....@A........................ ..........,....................N..`=.......x..p...p...............................@...............x............................text...j........................... ..`.rdata..H...........................@..@.data....%..........................@....rsrc...............................@..@.reloc...x.......z..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICF5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	756576
Entropy (8bit):	6.616629532136608
Encrypted:	false
SSDEEP:
MD5:	B158D8D605571EA47A238DF5AB43DFAA
SHA1:	BB91AE1F2F7142B9099E3CC285F4F5B84DE568E4
SHA-256:	CA763693CC25D316F14A9EBAD80EBF00590329550C45ADB7E5205486533C2504
SHA-512:	56AEF59C198ACF2FCD0D95EA6E32CE1C706E5098A0800FEFF13DDB427BFB4D538DE1C415A5CB5496B09A5825155E3ABB1C13C8C37DC31549604BD4D63CB70591
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......+.ZRo.4.o.4.o.4...7.d.4...1...4.iV0.}.4.iV7.x.4.iV1.!.4...0.v.4...2.n.4...5.F.4.o.5...4..V=...4..V4.n.4..V..n.4.o..n.4..V6.n.4.Richo.4.........................PE..L.....e.........."!...&............................................................bL....@A........................ ..........,....................N..`=.......x..p...p...............................@...............x............................text...j........................... ..`.rdata..H...........................@..@.data....%..........................@....rsrc...............................@..@.reloc...x.......z..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID34.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	891744
Entropy (8bit):	6.589375265168366
Encrypted:	false
SSDEEP:
MD5:	6119E62D8047032A715BA0670FC476C5
SHA1:	52E639024460BF111C469E95FB011C07D6FC89E8
SHA-256:	BC31F85266DF2CDFDBE22149937105388FA3ADC17E3646FA4A167736E819AF77
SHA-512:	E7301FA21F01F7F7562B853E9BB246ED051951E3CEF152BB0B3558D4863F141EDBBC0C4D439C30F51F9997805490F131A5E4CD00872B61CCB08BA9D200F811D8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........*?..Dl..Dl..Dla.Gm..Dla.Am..Dl.d@m..Dl.dGm..Dla.@m..Dl.dAm..Dla.Bm..Dla.Em..Dl..El..Dl.dMm..Dl.dDm..Dl.d.l..Dl...l..Dl.dFm..DlRich..Dl........................PE..L.....e.........."!...&.............5...............................................H....@A................................8........ ..h............^..`=...0..........p........................... ...@...................l...@....................text...Z........................... ..`.rdata..............................@..@.data...('..........................@....didat..H...........................@....rsrc...h.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSID93.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1177704
Entropy (8bit):	6.455549891638301
Encrypted:	false
SSDEEP:
MD5:	1A2B237796742C26B11A008D0B175E29
SHA1:	CFD5AFFCFB3B6FD407E58DFC7187FAD4F186EA18
SHA-256:	81E0DF47BCB2B3380FB0FB58B0D673BE4EF1B0367FD2B0D80AB8EE292FC8F730
SHA-512:	3135D866BF91F9E09B980DD649582072DF1F53EABE4C5AC5D34FFF1AEB5B6FA01D38D87FC31DE19A0887A910E95309BCF0E7AE54E6E8ED2469FEB64DA4A4F9E5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..woow$oow$oow$..t%dow$..r%.ow$i.s%}ow$i.t%xow$i.r%;ow$..s%wow$..v%pow$oov$@nw$..~%Uow$..w%now$..$now$oo.$now$..u%now$Richoow$................PE..L.....e.........."!...&.@...........K.......P.......................................{....@A.........................m..t...dn..........................h:......Tc......p........................... ...@............P..8............................text....>.......@.................. ..`.rdata..X0...P...2...D..............@..@.data................v..............@....rsrc................T..............@..@.reloc..Tc.......d...Z..............@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIDD3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	756576
Entropy (8bit):	6.616629532136608
Encrypted:	false
SSDEEP:
MD5:	B158D8D605571EA47A238DF5AB43DFAA
SHA1:	BB91AE1F2F7142B9099E3CC285F4F5B84DE568E4
SHA-256:	CA763693CC25D316F14A9EBAD80EBF00590329550C45ADB7E5205486533C2504
SHA-512:	56AEF59C198ACF2FCD0D95EA6E32CE1C706E5098A0800FEFF13DDB427BFB4D538DE1C415A5CB5496B09A5825155E3ABB1C13C8C37DC31549604BD4D63CB70591
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......+.ZRo.4.o.4.o.4...7.d.4...1...4.iV0.}.4.iV7.x.4.iV1.!.4...0.v.4...2.n.4...5.F.4.o.5...4..V=...4..V4.n.4..V..n.4.o..n.4..V6.n.4.Richo.4.........................PE..L.....e.........."!...&............................................................bL....@A........................ ..........,....................N..`=.......x..p...p...............................@...............x............................text...j........................... ..`.rdata..H...........................@..@.data....%..........................@....rsrc...............................@..@.reloc...x.......z..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIDF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	322152
Entropy (8bit):	6.857959784169984
Encrypted:	false
SSDEEP:
MD5:	61123CBC153CB7F178DDBB318A7EA000
SHA1:	0CFB1FAA4C166D2A335EE62B05DD62B730DED9D6
SHA-256:	E5E0183DFD9F65406042762C0427BBCFF010402B9934DADD2BDDBB6C382D625C
SHA-512:	3249F814C9E4C472B5962AB159729BB44E28314E2E402ABF4B5EC6789CB729192B662C948D362FA71F4284038544E4FDBB8F6D55B6EC0FB92C4DE04840A15926
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4..pp.#p.#p.#..."{.#..."..#..."f.#vR."b.#vR."g.#vR."?.#..."..#p.#..#.R."`.#.R."q.#.RX#q.#p.0#q.#.R."q.#Richp.#................PE..L...m.e.........."!...&..................... ............................................@A....................................<.......................h:..........@c..p....................c.......b..@............ ...............................text............................... ..`.rdata...v... ...x..................@..@.data...d...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{3E28EEFE-5291-43E1-AA61-E4D35B611491}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7698353496685527
Encrypted:	false
SSDEEP:
MD5:	D8D6ADE38FF4F8E4C1C83E302AE20E59
SHA1:	BB51DE51845DA74016A9C426D7F09097A181BA56
SHA-256:	C7DEA4EF65A1F27C03DFFC0E620F85A2A1566189CE0A70A73951C71284B1352C
SHA-512:	89CBC087598D184BA7B25A71AC18DB32EB514975BA1A1D5507DFE1C5339F6BD0D4E52BBD87AB5590EB4367D25BAFF3A9EE987EC2AA39BFC68C96EC9ECBC062BD
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.6480904164648542
Encrypted:	false
SSDEEP:
MD5:	2F4DECA2E42432C5C6F0C8A55B7DE0C5
SHA1:	43A44A6F248873FB9A80E972DE5CBAE6F6153987
SHA-256:	855E7EE17568B7F1222D41F1EFC55D65057585F1AE55BF20DDF8A41B416EA42E
SHA-512:	32CE0DD5B8871E1B2B4D55EFDCBBFEEB5A928FE3AF9CFBEE0E7A9D8204547EAB6D5CA61ECEA8F6BAE8381F9797313A7B0269B5BD4A299CAEE424D258FC5A45C1
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375172849707094
Encrypted:	false
SSDEEP:
MD5:	DA5287FDF4F87C4B975D73B672174536
SHA1:	5C236B8C3679B954CB295C93E6A6B71F8798BB51
SHA-256:	91202858F2AEF08717ADF4B34A2421D0D49CAF96936B6D1DE1E3385B057496EE
SHA-512:	BF02868242FDCDAB5AD7E7B47B69A5BC3C3CD172490F6A224566704589C8E8A8075F725EEABD3303D2771EDCDEFC5EF85A0B55BBF6A7A614757E1F6154A73F5E
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF9C0307B954F74735.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB7CA0E11B73C0D9E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	0.5806406323551833
Encrypted:	false
SSDEEP:
MD5:	F9BB26FF30F662D732BDDA3DA91BA389
SHA1:	81CACBE9045CA22AF0F050363375FE988F4894D0
SHA-256:	141FC7666D73FAE6F900FA7C2BAC2762B38F6F947679A84FA31E1A4D00212F04
SHA-512:	422F7773CD0BCE629F0B6387AA389BF15F946F22AE6D0ED8C3F678A8A6A5C21D91423E7F02DA31805F7DB1ADBCB9E3EC1C25E25C28F2448EE430D98E2F34F988
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCEC44332DD70227F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.6480904164648542
Encrypted:	false
SSDEEP:
MD5:	2F4DECA2E42432C5C6F0C8A55B7DE0C5
SHA1:	43A44A6F248873FB9A80E972DE5CBAE6F6153987
SHA-256:	855E7EE17568B7F1222D41F1EFC55D65057585F1AE55BF20DDF8A41B416EA42E
SHA-512:	32CE0DD5B8871E1B2B4D55EFDCBBFEEB5A928FE3AF9CFBEE0E7A9D8204547EAB6D5CA61ECEA8F6BAE8381F9797313A7B0269B5BD4A299CAEE424D258FC5A45C1
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD90567AE1E5EAFEF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07300115648400513
Encrypted:	false
SSDEEP:
MD5:	D18B2B147DB10B221AD41026DA62B188
SHA1:	26E99AAADA3983665CBEB1F97D4269D36D13B3DA
SHA-256:	553905B2D7F59494DDE1A0C320DDEEBB8B11D9CE5809F633C3A36675C51A3F8E
SHA-512:	23EED6FBDF2BB12B608A4CF96FB969AABF1F8D447BFD89FA7BA77F73E9627B02B5D3F80A2D0B197BB9DD87A7D0E17D6E847D1BFB36FBF7FA6486D15FF17A6EBD
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {EE3A39B9-5A50-459E-950A-80F951511BDC}, Number of Words: 10, Subject: NoqotApp, Author: Haye Cosq, Name of Creating Application: NoqotApp, Template: x64;2057, Comments: This installer database contains the logic and data required to install NoqotApp., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Mon Sep 30 16:03:45 2024, Last Saved Time/Date: Mon Sep 30 16:03:45 2024, Last Printed: Mon Sep 30 16:03:45 2024, Number of Pages: 450
Entropy (8bit):	7.946264592203114
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	app__v7.3.5_.msi
File size:	57'166'336 bytes
MD5:	2d6151dbbbb50c077564ef7ffc971a4e
SHA1:	b67ec6dd683f5f8b12d52aa79aeee9a498380589
SHA256:	2eae05e829f353c9a8d01683187eb759dbf73f90ccd435f03d46761b03247fbd
SHA512:	22a30787cf820da489ed59b8f6401b1282b923a66f796211c2300f1864f4f10bee01d24133bfcb35975695f32273796cacdef03d726345c7a12cfb8ce6509979
SSDEEP:	1572864:0p+Ty2SfWnHDk8FjVbfzPTq4h+RZYoFczfDiQPU8azMCAJ:h/0WnHDkkjBPTq4kYoFefTPU8awCm
TLSH:	53C72311B87C8027D76B1B393959BB9BA55B3CA2475125FBB3A47B2A13348C31237B07
File Content Preview:	........................>...................i.......................y........................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7..

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-01T15:52:32.919981+0200	2829202	ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA	1	192.168.2.4	63583	104.21.1.209	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 15:52:32.161407948 CEST	63583	443	192.168.2.4	104.21.1.209
Oct 1, 2024 15:52:32.161511898 CEST	443	63583	104.21.1.209	192.168.2.4
Oct 1, 2024 15:52:32.161648989 CEST	63583	443	192.168.2.4	104.21.1.209
Oct 1, 2024 15:52:32.169430971 CEST	63583	443	192.168.2.4	104.21.1.209
Oct 1, 2024 15:52:32.169450045 CEST	443	63583	104.21.1.209	192.168.2.4
Oct 1, 2024 15:52:32.863373995 CEST	443	63583	104.21.1.209	192.168.2.4
Oct 1, 2024 15:52:32.863466978 CEST	63583	443	192.168.2.4	104.21.1.209
Oct 1, 2024 15:52:32.914913893 CEST	63583	443	192.168.2.4	104.21.1.209
Oct 1, 2024 15:52:32.914973974 CEST	443	63583	104.21.1.209	192.168.2.4
Oct 1, 2024 15:52:32.915198088 CEST	443	63583	104.21.1.209	192.168.2.4
Oct 1, 2024 15:52:32.915262938 CEST	63583	443	192.168.2.4	104.21.1.209
Oct 1, 2024 15:52:32.919842958 CEST	63583	443	192.168.2.4	104.21.1.209
Oct 1, 2024 15:52:32.919928074 CEST	63583	443	192.168.2.4	104.21.1.209
Oct 1, 2024 15:52:32.919958115 CEST	443	63583	104.21.1.209	192.168.2.4
Oct 1, 2024 15:52:33.378515959 CEST	443	63583	104.21.1.209	192.168.2.4
Oct 1, 2024 15:52:33.378578901 CEST	443	63583	104.21.1.209	192.168.2.4
Oct 1, 2024 15:52:33.378581047 CEST	63583	443	192.168.2.4	104.21.1.209
Oct 1, 2024 15:52:33.378760099 CEST	63583	443	192.168.2.4	104.21.1.209
Oct 1, 2024 15:52:33.381782055 CEST	63583	443	192.168.2.4	104.21.1.209
Oct 1, 2024 15:52:33.381833076 CEST	443	63583	104.21.1.209	192.168.2.4
Oct 1, 2024 15:52:33.381880045 CEST	63583	443	192.168.2.4	104.21.1.209
Oct 1, 2024 15:52:33.381956100 CEST	63583	443	192.168.2.4	104.21.1.209

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 15:51:45.033210993 CEST	53	54556	1.1.1.1	192.168.2.4
Oct 1, 2024 15:52:32.135344982 CEST	58224	53	192.168.2.4	1.1.1.1
Oct 1, 2024 15:52:32.151513100 CEST	53	58224	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 1, 2024 15:52:32.135344982 CEST	192.168.2.4	1.1.1.1	0x4337	Standard query (0)	check-key.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 1, 2024 15:52:32.151513100 CEST	1.1.1.1	192.168.2.4	0x4337	No error (0)	check-key.com		104.21.1.209	A (IP address)	IN (0x0001)	false
Oct 1, 2024 15:52:32.151513100 CEST	1.1.1.1	192.168.2.4	0x4337	No error (0)	check-key.com		172.67.129.237	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

check-key.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	63583	104.21.1.209	443	7660	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 13:52:32 UTC	196	OUT	POST /licenseUser.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvancedInstaller Host: check-key.com Content-Length: 110 Cache-Control: no-cache
2024-10-01 13:52:32 UTC	110	OUT	Data Raw: 44 61 74 65 3d 30 31 25 32 46 31 30 25 32 46 32 30 32 34 26 54 69 6d 65 3d 30 39 25 33 41 35 32 25 33 41 33 31 26 50 72 6f 64 75 63 74 4c 61 6e 67 75 61 67 65 3d 32 30 35 37 26 42 75 69 6c 64 56 65 72 73 69 6f 6e 3d 39 35 37 31 26 4c 61 6e 67 75 61 67 65 49 64 65 6e 74 3d 31 37 37 38 26 55 76 6f 53 74 61 74 65 3d 31 30 30 30 39 Data Ascii: Date=01%2F10%2F2024&Time=09%3A52%3A31&ProductLanguage=2057&BuildVersion=9571&LanguageIdent=1778&UvoState=10009
2024-10-01 13:52:33 UTC	588	IN	HTTP/1.1 500 Internal Server Error Date: Tue, 01 Oct 2024 13:52:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-store CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fAMhY6zDx5hM9dneSOMs0h%2Bt2RNvX0e7RuyrMJbVpR9I5AsrPDJLQC2N1ubxqPudCS%2FjuObZwPf8aGQ25P7ugaOTnEC7063wsRU%2BF%2BMX4QJ24hZ24%2BnjQrnpTw9X7i%2Bk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cbcef0e1b9b0f6b-EWR
2024-10-01 13:52:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:51:25
Start date:	01/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\app__v7.3.5_.msi"
Imagebase:	0x7ff74ac20000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	09:51:26
Start date:	01/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff74ac20000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	09:51:28
Start date:	01/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 01297D2E2EDE3162BB91A5AD2CF048CC
Imagebase:	0xb10000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report app__v7.3.5_.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\480497.rbs

C:\Users\user\AppData\Local\Temp\MSI92e8e.LOG

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\box-add-remove.svg

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\box-custom.svg

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\box-remove.svg

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\box-repair.svg

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\box.svg

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\client.png

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\client_server.png

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\common.js

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\customize.html

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\diskcost.html

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\exit.html

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\fatalerror.html

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\fileinuse.html

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\folder.html

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\jquery-1.3.2.js

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\maintwelcome.html

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\maintype.html

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\outofdisk.html

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\outofrbdisk.html

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\prepare.html

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\progress.html

C:\Users\user\AppData\Local\Temp\{3E28EEFE-5291-43E1-AA61-E4D35B611491}\Spring.742DA8B7\progress\progressbar.css

Windows Analysis Report
app__v7.3.5_.msi