Windows Analysis Report
#U8f6f#U4ef6#U5305#U5b89#U88c5.msi

Overview

General Information

Sample name:	#U8f6f#U4ef6#U5305#U5b89#U88c5.msi renamed because original name is a hash value
Original sample name:	.msi
Analysis ID:	1525396
MD5:	ba615bbffbb5a4604ee2ddf9a2972333
SHA1:	229540b47f5248997257946a0fab693c070ed436
SHA256:	854f026f4e3071e41c828edcb350c049b74211ce7b653d8161a32d345257afcf
Tags:	Backdoormsiuser-GDHJDSYDH1
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Checks for available system drives (often done to infect USB drives)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Classification

Signatures

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Windows NT\Update.png	ReversingLabs: Detection: 54%
Source: C:\Program Files (x86)\Windows NT\Update.png	Virustotal: Detection: 52%	Perma Link
Source: C:\Windows\Installer\MSI8940.tmp	ReversingLabs: Detection: 54%
Source: C:\Windows\Installer\MSI8940.tmp	Virustotal: Detection: 52%	Perma Link

Multi AV Scanner detection for submitted file

Source: #U8f6f#U4ef6#U5305#U5b89#U88c5.msi	ReversingLabs: Detection: 47%
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5.msi	Virustotal: Detection: 45%			Perma Link

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Creates files inside the system directory

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5086af.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{3AD6D567-3D1F-4CA4-AB2A-D72B3C32145A}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI87D8.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5086b1.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5086b1.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8940.tmp	Jump to behavior

Deletes files inside the Windows folder

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\5086b1.msi

Jump to behavior

Source: classification engine

Classification label: mal60.evad.winMSI@4/27@0/0

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Windows NT\7za.bin

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DFF81FC4BDDE620274.TMP

Jump to behavior

Source: #U8f6f#U4ef6#U5305#U5b89#U88c5.msi

Static file information: TRID: Microsoft Windows Installer (60509/1) 88.31%

Source: #U8f6f#U4ef6#U5305#U5b89#U88c5.msi	ReversingLabs: Detection: 47%
Source: #U8f6f#U4ef6#U5305#U5b89#U88c5.msi	Virustotal: Detection: 45%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\#U8f6f#U4ef6#U5305#U5b89#U88c5.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 7BDA3736EA8AC5FE14FD6ABBE0BEDB9F E Global\MSI0000
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 7BDA3736EA8AC5FE14FD6ABBE0BEDB9F E Global\MSI0000	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior

Source: #U8f6f#U4ef6#U5305#U5b89#U88c5.msi

Static file information: File size 1904640 > 1048576

PE file contains sections with non-standard names

Source: MSI8940.tmp.1.dr	Static PE information: section name: .00cfg
Source: MSI8940.tmp.1.dr	Static PE information: section name: .voltbl
Source: MSI8940.tmp.1.dr	Static PE information: section name: _RDATA
Source: Update.png.2.dr	Static PE information: section name: .00cfg
Source: Update.png.2.dr	Static PE information: section name: .voltbl
Source: Update.png.2.dr	Static PE information: section name: _RDATA

Drops PE files

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8940.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Windows NT\Update.png			Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\MSI8940.tmp

Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Windows NT\Update.png

Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\msiexec.exe

System information queried: FirmwareTableInformation

Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8940.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows NT\Update.png			Jump to dropped file

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\msiexec.exe

Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	1525396
Product:	CloudBasic
Start time:	06:36:08
Start date:	04.10.2024
Sample:	#U8f6f#U4ef6#U5305#U5b89#U88c5.msi
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	ba615bbffbb5a4604ee2ddf9a2972333
SHA1:	229540b47f5248997257946a0fab693c070ed436
SHA256:	854f026f4e3071e41c828edcb350c049b74211ce7b653d8161a32d345257afcf
Filetype:	Microsoft Windows Installer (60509/1) 88.31%

Name	Type	MD5	SHA1	SHA256
C:\Config.Msi\5086b0.rbs	data	E2A1B9D566BBCE7EB27C7D0B628B2781	EA6786F8726C39722547F4F7D0353114F7DC45F0	E81FC9D4B77E097624E407C099AC4548075CE8A0552B5EBD213D56C99BA349FC
C:\Program Files (x86)\Windows NT\7za.bin	data	F77C0B61806B6865C888592E178294C3	E9E0B393CC977FBDBC44FE19D92879A38A4DAD0C	B85490DE04744A2E30A815BFAD752B520E87F71A1CE92DD23A0ED975B4836C82
C:\Program Files (x86)\Windows NT\Update.png	PE32+ executable (DLL) (console) x86-64, for MS Windows	2D7CB93530254216475BECB691121DFB	309F5FE7E5114307590CB870ED2BE65999092E2D	A00AEFA8248081A627D0B8DB0960B9E8A624CA348A3F4A1768727D070D2AF4E6
C:\Program Files (x86)\Windows NT\bin.dat	data	A287C6D8A324FA25F2F0AD735BBA125D	BBF18C61C598A907CEA27C6146D097E6F7389A9D	3BF81C4A837738FCB7D591AF85D1CC87C53FD4126C102E43EEC294ADCB9C6F97
C:\Program Files (x86)\Windows NT\locale.dat	7-zip archive data, version 0.4	47956B5A75679481E013A70CC97B1541	E0F434DA37B233913B8B49D0A8041E6A94CC9209	7FC8DAE671E72E8931EE6BE5DFC6088EBD2DFA07BEE808BD2C2FC21EC690CB21
C:\Program Files (x86)\Windows NT\locale2.dat	7-zip archive data, version 0.4	5E938B56D424974500E1D54A4F145890	95B6479B7A3B4FEA8A9ADCF8656D4D1377EECC38	7CB58B2C224E8172D1558FA90EC649F20278B87126086910EDD3B69F19CA3A78
C:\Program Files (x86)\Windows NT\locale3.dat	7-zip archive data, version 0.4	0FAD52CA924581631C281F1785EAFAB5	BC6C041EA595C1A6C33705AF2BF063F5500062E1	ACA08C437182B06B3158FB68E51B24C04E50479D10C116B1BC03C25D20CE3204
C:\Program Files (x86)\Windows NT\locale4.dat	7-zip archive data, version 0.3	A1D4588C1AE33AF2CA21B2851AF7335E	598D9C932015AE4B57D5510B4CA1A8B4858445FD	87A792C38C69E25E10C3A3CD3B38D1C77DFDC3E206D6917E2F095B61017712A6
C:\Windows\Installer\5086af.msi	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Setup Program, Author: M, Keywords: Installer, Comments: Comment, Template: Intel;1033, Revision Number: {BC9A93FF-6759-45EC-9BF9-01291458AF41}, Create Time/Date: Mon Sep 30 03:07:00 2024, Last Saved Time/Date: Mon Sep 30 03:07:00 2024, Number of Pages: 300, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2	BA615BBFFBB5A4604EE2DDF9A2972333	229540B47F5248997257946A0FAB693C070ED436	854F026F4E3071E41C828EDCB350C049B74211CE7B653D8161A32D345257AFCF
C:\Windows\Installer\5086b1.msi	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Setup Program, Author: M, Keywords: Installer, Comments: Comment, Template: Intel;1033, Revision Number: {BC9A93FF-6759-45EC-9BF9-01291458AF41}, Create Time/Date: Mon Sep 30 03:07:00 2024, Last Saved Time/Date: Mon Sep 30 03:07:00 2024, Number of Pages: 300, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2	BA615BBFFBB5A4604EE2DDF9A2972333	229540B47F5248997257946A0FAB693C070ED436	854F026F4E3071E41C828EDCB350C049B74211CE7B653D8161A32D345257AFCF
C:\Windows\Installer\MSI87D8.tmp	data	B85AC886F344016EC781943815B5B1D4	84269508FE5FF7EC6DE53D56641F5EFE78E73A04	4E0D9A7FF886D6BC580D419BA76E06C93F7AB181EE9CAADD5BEDF448B7528CB1
C:\Windows\Installer\MSI8940.tmp	PE32+ executable (DLL) (console) x86-64, for MS Windows	2D7CB93530254216475BECB691121DFB	309F5FE7E5114307590CB870ED2BE65999092E2D	A00AEFA8248081A627D0B8DB0960B9E8A624CA348A3F4A1768727D070D2AF4E6
C:\Windows\Installer\SourceHash{3AD6D567-3D1F-4CA4-AB2A-D72B3C32145A}	Composite Document File V2 Document, Cannot read section info	A3878A3F3DC9E1D7AF7D15F006573896	4123B63A118C6A05B5EA6112678C733B7B6C8186	007C20C201687ED381FA330F0757E72665B00926D31AE6A5B10C0EF17EEC4BBF
C:\Windows\Installer\inprogressinstallinfo.ipi	Composite Document File V2 Document, Cannot read section info	889FB8E25BD875C1D205BB866405CA49	D917B134CF2CB035DF87DA29F8CA50D139CC4376	C6F92036C81D69A75ACBCBE8D0780518223ED32D7CD31C5122CDD878AA44E6B9
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	D4656769C03387B7A1667CB59DB5427F	9D665DCFB7951A197D69B389A07BEDAF16113C7A	5FD74FC1354A9BA47CEC50EB5D0775A27D64F7B981B364E97665A120EBFDD44D
C:\Windows\Temp\~DF110252C8EACB032B.TMP	Composite Document File V2 Document, Cannot read section info	889FB8E25BD875C1D205BB866405CA49	D917B134CF2CB035DF87DA29F8CA50D139CC4376	C6F92036C81D69A75ACBCBE8D0780518223ED32D7CD31C5122CDD878AA44E6B9
C:\Windows\Temp\~DF187D175EE7F0CC02.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Windows\Temp\~DF271BABB457CDB72B.TMP	Composite Document File V2 Document, Cannot read section info	E0E30C13C0D3EA8E4C1413A877B355A5	D64F877FAD23BD1D2821FA8DEB512F998DE8F900	5DFB3F8C555D3FDA769246D5C905086D34BC4FBDC4C83FDDE55EF88DEF48F6F4
C:\Windows\Temp\~DF8B8F87368AFA308D.TMP	Composite Document File V2 Document, Cannot read section info	889FB8E25BD875C1D205BB866405CA49	D917B134CF2CB035DF87DA29F8CA50D139CC4376	C6F92036C81D69A75ACBCBE8D0780518223ED32D7CD31C5122CDD878AA44E6B9
C:\Windows\Temp\~DF9FB0A2442B555886.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Windows\Temp\~DFA16E0D081F45B769.TMP	Composite Document File V2 Document, Cannot read section info	E0E30C13C0D3EA8E4C1413A877B355A5	D64F877FAD23BD1D2821FA8DEB512F998DE8F900	5DFB3F8C555D3FDA769246D5C905086D34BC4FBDC4C83FDDE55EF88DEF48F6F4
C:\Windows\Temp\~DFC2694982D725A76C.TMP	data	7B1B063A9806D307AC3519E9FE426C3B	0E4E00D00D604F669ED0AFCBA24B463B4CACA9D4	082A6DFD504A0DF73C229626C6181FFF5792601CB1A0DF7FB214FA86DB701ABB
C:\Windows\Temp\~DFE0B391DE665C8F14.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Windows\Temp\~DFE1653ECFCDE358F2.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Windows\Temp\~DFE50BB96FA2A42E7C.TMP	data	BF619EAC0CDF3F68D496EA9344137E8B	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
C:\Windows\Temp\~DFE52718B162A367C3.TMP	Composite Document File V2 Document, Cannot read section info	E0E30C13C0D3EA8E4C1413A877B355A5	D64F877FAD23BD1D2821FA8DEB512F998DE8F900	5DFB3F8C555D3FDA769246D5C905086D34BC4FBDC4C83FDDE55EF88DEF48F6F4
C:\Windows\Temp\~DFF81FC4BDDE620274.TMP	data	0EB610A40C5F2F31FE73BD7826D7B522	439F7F7409486CE6E30094AA04A82B2B6E668555	531450ACF93957AC36BFD3D6E554AA05B7AD75AF3F582E048E508754DC3C8EBF

Windows Analysis Report
#U8f6f#U4ef6#U5305#U5b89#U88c5.msi

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Spreading

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report #U8f6f#U4ef6#U5305#U5b89#U88c5.msi

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Spreading

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
#U8f6f#U4ef6#U5305#U5b89#U88c5.msi