Source: |
Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: vCD97MuZPI.msi |
Source: |
Binary string: .PdbhXjbft source: vCD97MuZPI.msi |
Source: C:\Windows\System32\msiexec.exe |
File opened: z: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: x: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: v: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: t: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: r: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: p: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: n: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: l: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: j: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: h: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: f: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: b: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: y: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: w: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: u: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: s: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: q: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: o: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: m: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: k: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: i: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: g: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: e: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: c: |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File opened: a: |
Jump to behavior |
Source: global traffic |
DNS traffic detected: DNS query: ocsps.ssl.com |
Source: vCD97MuZPI.msi |
String found in binary or memory: http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor |
Source: vCD97MuZPI.msi |
String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q |
Source: vCD97MuZPI.msi |
String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0 |
Source: vCD97MuZPI.msi |
String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0 |
Source: vCD97MuZPI.msi |
String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.crl0 |
Source: vCD97MuZPI.msi |
String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0 |
Source: vCD97MuZPI.msi |
String found in binary or memory: http://ocsps.ssl.com0 |
Source: vCD97MuZPI.msi |
String found in binary or memory: http://ocsps.ssl.com0? |
Source: vCD97MuZPI.msi |
String found in binary or memory: http://ocsps.ssl.com0Q |
Source: vCD97MuZPI.msi |
String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0 |
Source: vCD97MuZPI.msi |
String found in binary or memory: https://www.ssl.com/repository0 |
Source: vCD97MuZPI.msi |
Binary or memory string: tLegalCopyrightCopyright (c) Microsoft Corporation. All rights reserved.L$OriginalFilenameVC_redist.x86.exe vs vCD97MuZPI.msi |
Source: classification engine |
Classification label: clean1.winMSI@2/0@2/0 |
Source: C:\Windows\System32\msiexec.exe |
Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA |
Jump to behavior |
Source: unknown |
Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\vCD97MuZPI.msi" |
Source: unknown |
Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: msi.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: sfc.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: sfc_os.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: dwmapi.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: wkscli.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: msisip.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: bcrypt.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: rpcrtremote.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: msihnd.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: msi.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: sfc.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: sfc_os.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: dwmapi.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Section loaded: rpcrtremote.dll |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: C:\Windows\System32\msiexec.exe |
Automated click: OK |
Source: Window Recorder |
Window detected: More than 3 window changes detected |
Source: vCD97MuZPI.msi |
Static file information: File size 21594112 > 1048576 |
Source: |
Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: vCD97MuZPI.msi |
Source: |
Binary string: .PdbhXjbft source: vCD97MuZPI.msi |
Source: C:\Windows\System32\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe TID: 3364 |
Thread sleep time: -120000s >= -30000s |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe TID: 3400 |
Thread sleep time: -60000s >= -30000s |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File Volume queried: C:\ FullSizeInformation |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File Volume queried: C:\ FullSizeInformation |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File Volume queried: C:\ FullSizeInformation |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
File Volume queried: C:\ FullSizeInformation |
Jump to behavior |
Source: C:\Windows\System32\msiexec.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |