Windows Analysis Report
v.1.6.3__x64__.msi

Overview

General Information

Sample name: v.1.6.3__x64__.msi
Analysis ID: 1532356
MD5: 0ba05fd48cf928447ecf3ce8fbed1544
SHA1: e3e57c4adf4719a85ec2b15f1605d47f501a348a
SHA256: da6cd7e37214c30e69a8b2817e1f361cff10bec40645785af3f01593debeac64
Tags: LegionLoadermsiRobotDropperuser-aachum
Infos:

Detection

LegionLoader
Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Suricata IDS alerts for network traffic
Yara detected LegionLoader
Binary contains a suspicious time stamp
Checks for available system drives (often done to infect USB drives)
Creates files inside the system directory
Deletes files inside the Windows folder
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Found dropped PE file which has not been started or loaded
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Msiexec Initiated Connection

Classification

Source: unknown HTTPS traffic detected: 172.67.221.87:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.1.dr
Source: Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: v.1.6.3__x64__.msi
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.1.dr
Source: Binary string: D:\code88\chromium_git\chromium\src\out\Release_x64\node.dll.pdb source: node.dll.1.dr
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdb source: v.1.6.3__x64__.msi, MSI9864.tmp.1.dr
Source: Binary string: D:\code88\chromium_git\chromium\src\out\Release_x64\node.dll.pdb source: node.dll.1.dr
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.1.dr
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: v.1.6.3__x64__.msi, MSI9825.tmp.1.dr
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdbj source: v.1.6.3__x64__.msi, MSI9864.tmp.1.dr
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbm source: v.1.6.3__x64__.msi
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: api-ms-win-core-synch-l1-1-0.dll.1.dr
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\tempFiles.pdb- source: v.1.6.3__x64__.msi, 54996a.rbs.1.dr, MSIA035.tmp.1.dr
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: api-ms-win-crt-multibyte-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: api-ms-win-crt-environment-l1-1-0.dll.1.dr
Source: Binary string: D:\git-sdk-64-build-installers\usr\src\MINGW-packages\mingw-w64-git\src\git\git-bash.pdb source: git-bash.exe.1.dr
Source: Binary string: obs.pdb~~ source: obs.dll.1.dr
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: api-ms-win-core-timezone-l1-1-0.dll.1.dr
Source: Binary string: libEGL.dll.pdb source: libEGL.dll.1.dr
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.1.dr
Source: Binary string: D:\git-sdk-64-build-installers\usr\src\MINGW-packages\mingw-w64-git\src\git\cmd\git-gui.pdb source: git-gui.exe.1.dr
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: v.1.6.3__x64__.msi
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.1.dr
Source: Binary string: obs.pdb source: obs.dll.1.dr
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: v.1.6.3__x64__.msi, MSIA1C6.tmp.1.dr
Source: Binary string: D:\git-sdk-64-build-installers\usr\src\MINGW-packages\mingw-w64-git\src\git\cmd\git.pdb source: git.exe.1.dr
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\tempFiles.pdb source: v.1.6.3__x64__.msi, 54996a.rbs.1.dr, MSIA035.tmp.1.dr
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: api-ms-win-crt-heap-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: api-ms-win-crt-string-l1-1-0.dll.1.dr
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: x: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: v: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: t: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: r: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: p: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: n: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: l: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: j: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: h: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: f: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: b: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: y: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: w: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: u: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: s: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: q: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: o: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: m: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: k: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: i: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: g: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: e: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: c: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: a: Jump to behavior

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2829202 - Severity 1 - ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA : 192.168.2.4:49807 -> 172.67.221.87:443
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: key-crack.com
Source: unknown HTTP traffic detected: POST /licenseUser.php HTTP/1.1Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: AdvancedInstallerHost: key-crack.comContent-Length: 110Cache-Control: no-cache
Source: node.dll.1.dr String found in binary or memory: http://.css
Source: node.dll.1.dr String found in binary or memory: http://.jpg
Source: v.1.6.3__x64__.msi String found in binary or memory: http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor
Source: libEGL.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr, obs.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: libEGL.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: libEGL.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: libEGL.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr, obs.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr, obs.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr, obs.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: node.dll.1.dr String found in binary or memory: http://code.google.com/p/closure-compiler/wiki/SourceMaps
Source: git-gui.exe.1.dr, git-bash.exe.1.dr, git.exe.1.dr String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: git-gui.exe.1.dr, git-bash.exe.1.dr, git.exe.1.dr String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0V
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: git-gui.exe.1.dr, git-bash.exe.1.dr, git.exe.1.dr String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: git-gui.exe.1.dr, git-bash.exe.1.dr, git.exe.1.dr String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: git-gui.exe.1.dr, git-bash.exe.1.dr, git.exe.1.dr String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr, obs.dll.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: libEGL.dll.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: libEGL.dll.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr, obs.dll.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr, obs.dll.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: obs.dll.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: libEGL.dll.1.dr String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: libEGL.dll.1.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: libEGL.dll.1.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: libEGL.dll.1.dr String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr, obs.dll.1.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: libEGL.dll.1.dr String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: libEGL.dll.1.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: git-gui.exe.1.dr, git-bash.exe.1.dr, git.exe.1.dr String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: git-gui.exe.1.dr, git-bash.exe.1.dr, git.exe.1.dr String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: git-gui.exe.1.dr, git-bash.exe.1.dr, git.exe.1.dr String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: avformat-60.dll.1.dr String found in binary or memory: http://dashif.org/guidelines/trickmode
Source: node.dll.1.dr String found in binary or memory: http://html4/loose.dtd
Source: node.dll.1.dr String found in binary or memory: http://narwhaljs.org)
Source: git-gui.exe.1.dr, git-bash.exe.1.dr, git.exe.1.dr String found in binary or memory: http://ocsp.comodoca.com0
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr, obs.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr, obs.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr, obs.dll.1.dr, libEGL.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: libEGL.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0H
Source: libEGL.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0I
Source: libEGL.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr, obs.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: git-gui.exe.1.dr, git-bash.exe.1.dr, git.exe.1.dr String found in binary or memory: http://ocsp.sectigo.com0
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: http://s.symcd.com06
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: node.dll.1.dr String found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: avformat-60.dll.1.dr String found in binary or memory: http://standards.iso.org/ittf/PubliclyAvailableStandards/MPEG-DASH_schema_files/DASH-MPD.xsd
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: node.dll.1.dr String found in binary or memory: http://userguide.icu-project.org/strings/properties
Source: node.dll.1.dr String found in binary or memory: http://www.3waylabs.com/nw/WWW/products/wizcon/vt220.html
Source: node.dll.1.dr String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr, obs.dll.1.dr, libEGL.dll.1.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: libEGL.dll.1.dr String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: node.dll.1.dr String found in binary or memory: http://www.midnight-commander.org/browser/lib/tty/key.c
Source: node.dll.1.dr String found in binary or memory: http://www.squid-cache.org/Doc/config/half_closed_clients/
Source: zlib.dll.1.dr String found in binary or memory: http://www.zlib.net/D
Source: node.dll.1.dr String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=10201
Source: node.dll.1.dr String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=10704
Source: node.dll.1.dr String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=6593
Source: node.dll.1.dr String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=745678
Source: node.dll.1.dr String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: node.dll.1.dr String found in binary or memory: https://console.spec.whatwg.org/#clear
Source: node.dll.1.dr String found in binary or memory: https://console.spec.whatwg.org/#console-namespace
Source: node.dll.1.dr String found in binary or memory: https://console.spec.whatwg.org/#count
Source: node.dll.1.dr String found in binary or memory: https://console.spec.whatwg.org/#count-map
Source: node.dll.1.dr String found in binary or memory: https://console.spec.whatwg.org/#countreset
Source: node.dll.1.dr String found in binary or memory: https://console.spec.whatwg.org/#table
Source: node.dll.1.dr String found in binary or memory: https://crbug.com/v8/7848
Source: node.dll.1.dr String found in binary or memory: https://cs.chromium.org/chromium/src/v8/tools/SourceMap.js?rcl=dd10454c1d
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: https://d.symcb.com/cps0%
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: https://d.symcb.com/rpa0
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: https://d.symcb.com/rpa0.
Source: node.dll.1.dr String found in binary or memory: https://developer.mozilla.org/en-US/docs/SpiderMonkey/Parser_API
Source: node.dll.1.dr String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Equality_comparisons_and_sameness#Loose_equa
Source: node.dll.1.dr String found in binary or memory: https://encoding.spec.whatwg.org
Source: node.dll.1.dr String found in binary or memory: https://encoding.spec.whatwg.org/#textdecoder
Source: node.dll.1.dr String found in binary or memory: https://encoding.spec.whatwg.org/#textencoder
Source: node.dll.1.dr String found in binary or memory: https://esdiscuss.org/topic/isconstructor#content-11
Source: node.dll.1.dr String found in binary or memory: https://gist.github.com/XVilka/8346728#gistcomment-2823421
Source: node.dll.1.dr String found in binary or memory: https://github.com/acornjs/acorn/blob/master/acorn/src/identifier.js#L23
Source: node.dll.1.dr String found in binary or memory: https://github.com/acornjs/acorn/issues/575
Source: node.dll.1.dr String found in binary or memory: https://github.com/antirez/linenoise
Source: node.dll.1.dr String found in binary or memory: https://github.com/chalk/ansi-regex/blob/master/index.js
Source: node.dll.1.dr String found in binary or memory: https://github.com/chalk/supports-color
Source: node.dll.1.dr String found in binary or memory: https://github.com/chromium/chromium/blob/master/third_party/blink/public/platform/web_crypto_algori
Source: node.dll.1.dr String found in binary or memory: https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color
Source: node.dll.1.dr String found in binary or memory: https://github.com/estree/estree/blob/a27003adf4fd7bfad44de9cef372a2eacd527b1c/es5.md#regexpliteral
Source: node.dll.1.dr String found in binary or memory: https://github.com/google/caja/blob/master/src/com/google/caja/ses/repairES5.js
Source: node.dll.1.dr String found in binary or memory: https://github.com/google/caja/blob/master/src/com/google/caja/ses/startSES.js
Source: node.dll.1.dr String found in binary or memory: https://github.com/google/closure-compiler/wiki/Source-Maps
Source: node.dll.1.dr String found in binary or memory: https://github.com/isaacs/color-support.
Source: node.dll.1.dr String found in binary or memory: https://github.com/joyent/node/issues/3295.
Source: node.dll.1.dr String found in binary or memory: https://github.com/libuv/libuv/pull/1501.
Source: node.dll.1.dr String found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: node.dll.1.dr String found in binary or memory: https://github.com/mafintosh/pump
Source: node.dll.1.dr String found in binary or memory: https://github.com/mysticatea/abort-controller
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node-v0.x-archive/issues/2876.
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/commit/ec2822adaad76b126b5cccdeaa1addf2376c9aa6
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/issues
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/issues/10673
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/issues/13435
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/issues/19009
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/issues/2006
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/issues/31074
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/issues/32020
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/issues/3392
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/issues/35475
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/issues/35862
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/issues/35981
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/pull/12342
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/pull/12607
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/pull/13870#discussion_r124515293
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/pull/21313
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/pull/26334.
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/pull/30380#issuecomment-552948364
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/pull/30958
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/pull/33661
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/pull/3394
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/pull/34010
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/pull/34103#issuecomment-652002364
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/pull/34375
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/pull/35949#issuecomment-722496598
Source: node.dll.1.dr String found in binary or memory: https://github.com/nodejs/node/pull/36061#discussion_r533718029
Source: node.dll.1.dr String found in binary or memory: https://github.com/standard-things/esm/issues/821.
Source: node.dll.1.dr String found in binary or memory: https://github.com/tc39/ecma262/blob/master/LICENSE.md
Source: node.dll.1.dr String found in binary or memory: https://github.com/tc39/ecma262/issues/1209
Source: node.dll.1.dr String found in binary or memory: https://github.com/tc39/proposal-ses/blob/e5271cc42a257a05dcae2fd94713ed2f46c08620/shim/src/freeze.j
Source: node.dll.1.dr String found in binary or memory: https://github.com/tc39/proposal-weakrefs
Source: node.dll.1.dr String found in binary or memory: https://goo.gl/t5IS6M).
Source: node.dll.1.dr String found in binary or memory: https://heycam.github.io/webidl/#define-the-operations
Source: node.dll.1.dr String found in binary or memory: https://heycam.github.io/webidl/#dfn-class-string
Source: node.dll.1.dr String found in binary or memory: https://heycam.github.io/webidl/#dfn-default-iterator-object
Source: node.dll.1.dr String found in binary or memory: https://heycam.github.io/webidl/#dfn-iterator-prototype-object
Source: node.dll.1.dr String found in binary or memory: https://heycam.github.io/webidl/#es-interfaces
Source: node.dll.1.dr String found in binary or memory: https://heycam.github.io/webidl/#es-iterable
Source: node.dll.1.dr String found in binary or memory: https://heycam.github.io/webidl/#es-iterable-entries
Source: node.dll.1.dr String found in binary or memory: https://heycam.github.io/webidl/#es-iterators
Source: node.dll.1.dr String found in binary or memory: https://heycam.github.io/webidl/#es-namespaces
Source: node.dll.1.dr String found in binary or memory: https://heycam.github.io/webidl/#es-operations
Source: node.dll.1.dr String found in binary or memory: https://heycam.github.io/webidl/#es-stringifier
Source: node.dll.1.dr String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin
Source: node.dll.1.dr String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque
Source: node.dll.1.dr String found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: node.dll.1.dr String found in binary or memory: https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope
Source: node.dll.1.dr String found in binary or memory: https://invisible-island.net/ncurses/terminfo.ti.html#toc-_Specials
Source: node.dll.1.dr String found in binary or memory: https://invisible-island.net/xterm/ctlseqs/ctlseqs.html
Source: v.1.6.3__x64__.msi String found in binary or memory: https://key-crack.com/licenseUser.phpDoAppSearchExAI_SET_RESUMEAI_SET_INSTALLSendCollectedDataAI_Ext
Source: node.dll.1.dr String found in binary or memory: https://linux.die.net/man/1/dircolors).
Source: node.dll.1.dr String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: node.dll.1.dr String found in binary or memory: https://no-color.org/
Source: node.dll.1.dr String found in binary or memory: https://nodejs.org/
Source: node.dll.1.dr String found in binary or memory: https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode).
Source: node.dll.1.dr String found in binary or memory: https://nodejs.org/api/fs.html
Source: node.dll.1.dr String found in binary or memory: https://nodejs.org/download/release/v15.9.0/node-v15.9.0-headers.tar.gz
Source: node.dll.1.dr String found in binary or memory: https://nodejs.org/download/release/v15.9.0/node-v15.9.0.tar.gz
Source: node.dll.1.dr String found in binary or memory: https://nodejs.org/download/release/v15.9.0/node-v15.9.0.tar.gzhttps://nodejs.org/download/release/v
Source: node.dll.1.dr String found in binary or memory: https://nodejs.org/download/release/v15.9.0/win-x64/node.lib
Source: git-gui.exe.1.dr, git-bash.exe.1.dr, git.exe.1.dr String found in binary or memory: https://sectigo.com/CPS0
Source: node.dll.1.dr String found in binary or memory: https://sourcemaps.info/spec.html
Source: node.dll.1.dr String found in binary or memory: https://stackoverflow.com/a/5501711/3561
Source: node.dll.1.dr String found in binary or memory: https://tc39.es/ecma262/#sec-%typedarray%-intrinsic-object
Source: node.dll.1.dr String found in binary or memory: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
Source: node.dll.1.dr String found in binary or memory: https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object
Source: node.dll.1.dr String found in binary or memory: https://tc39.github.io/ecma262/#sec-%typedarray%.of
Source: node.dll.1.dr String found in binary or memory: https://tc39.github.io/ecma262/#sec-object.prototype.tostring
Source: node.dll.1.dr String found in binary or memory: https://tools.ietf.org/html/rfc2397#section-2
Source: node.dll.1.dr String found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: node.dll.1.dr String found in binary or memory: https://tools.ietf.org/html/rfc3986#section-3.2.2
Source: node.dll.1.dr String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.2
Source: node.dll.1.dr String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.6
Source: node.dll.1.dr String found in binary or memory: https://tools.ietf.org/html/rfc7540#section-8.1.2.5
Source: node.dll.1.dr String found in binary or memory: https://url.spec.whatwg.org/#cannot-have-a-username-password-port
Source: node.dll.1.dr String found in binary or memory: https://url.spec.whatwg.org/#concept-url
Source: node.dll.1.dr String found in binary or memory: https://url.spec.whatwg.org/#concept-url-origin
Source: node.dll.1.dr String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
Source: node.dll.1.dr String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-parser
Source: node.dll.1.dr String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-serializer
Source: node.dll.1.dr String found in binary or memory: https://url.spec.whatwg.org/#special-scheme
Source: node.dll.1.dr String found in binary or memory: https://url.spec.whatwg.org/#url
Source: node.dll.1.dr String found in binary or memory: https://url.spec.whatwg.org/#url-serializing
Source: node.dll.1.dr String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams
Source: node.dll.1.dr String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams-stringification-behavior
Source: node.dll.1.dr String found in binary or memory: https://v8.dev/blog/v8-release-89
Source: node.dll.1.dr String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#the-integrity-attribute
Source: node.dll.1.dr String found in binary or memory: https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F
Source: libEGL.dll.1.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-line-terminators
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-promise.all
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-timeclip
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Alternative
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Atom
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClass
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClassEscape
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtom
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtomNoDash
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassRanges
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlEscape
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlLetter
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalDigits
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalEscape
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Disjunction
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Hex4Digits
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigit
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigits
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexEscapeSequence
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRanges
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRangesNoDash
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-OctalDigit
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Pattern
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-PatternCharacter
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Quantifier
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-QuantifierPrefix
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-RegExpUnicodeEscapeSequence
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-SyntaxCharacter
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Assertion
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-AtomEscape
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-CharacterEscape
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassControlLetter
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassEscape
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedAtom
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedPatternCharacter
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-IdentityEscape
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-InvalidBracedQuantifier
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-LegacyOctalEscapeSequence
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Term
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape
Source: node.dll.1.dr String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-term
Source: smartgitc.exe.1.dr, smartgit-updater.exe.1.dr String found in binary or memory: https://www.globalsign.com/repository/0
Source: node.dll.1.dr String found in binary or memory: https://www.iana.org/assignments/tls-extensiontype-values
Source: node.dll.1.dr String found in binary or memory: https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown HTTPS traffic detected: 172.67.221.87:443 -> 192.168.2.4:49807 version: TLS 1.2
Creates files inside the system directory
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\549968.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA148.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA1C6.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA206.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA264.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA2B3.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA303.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA342.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI96EA.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI972A.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI9825.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI9864.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{135C4CDB-FF51-44E4-9478-7C0FB9B5D071} Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA035.tmp Jump to behavior
Deletes files inside the Windows folder
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\MSIA148.tmp Jump to behavior
PE file contains more sections than normal
Source: git.exe0.1.dr Static PE information: Number of sections : 13 > 10
Source: git-cmd.exe.1.dr Static PE information: Number of sections : 13 > 10
Source: bash.exe.1.dr Static PE information: Number of sections : 13 > 10
Source: git-bash.exe.1.dr Static PE information: Number of sections : 13 > 10
Source: avutil-58.dll.1.dr Static PE information: Number of sections : 12 > 10
Source: gitk.exe.1.dr Static PE information: Number of sections : 13 > 10
Source: swresample-4.dll.1.dr Static PE information: Number of sections : 12 > 10
Source: sh.exe.1.dr Static PE information: Number of sections : 13 > 10
Source: scalar.exe.1.dr Static PE information: Number of sections : 13 > 10
Source: swscale-7.dll.1.dr Static PE information: Number of sections : 12 > 10
Source: zlib.dll.1.dr Static PE information: Number of sections : 12 > 10
Source: git-gui.exe.1.dr Static PE information: Number of sections : 13 > 10
Source: git.exe.1.dr Static PE information: Number of sections : 13 > 10
Source: avformat-60.dll.1.dr Static PE information: Number of sections : 12 > 10
PE file does not import any functions
Source: api-ms-win-core-string-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.1.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: v.1.6.3__x64__.msi Binary or memory string: tLegalCopyrightCopyright (c) Microsoft Corporation. All rights reserved.L$OriginalFilenameVC_redist.x64.exe vs v.1.6.3__x64__.msi
Source: v.1.6.3__x64__.msi Binary or memory string: OriginalFilenameAICustAct.dllF vs v.1.6.3__x64__.msi
Source: v.1.6.3__x64__.msi Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs v.1.6.3__x64__.msi
Source: v.1.6.3__x64__.msi Binary or memory string: OriginalFilenamePrereq.dllF vs v.1.6.3__x64__.msi
Source: v.1.6.3__x64__.msi Binary or memory string: OriginalFilenameMsiTempFiles.dllF vs v.1.6.3__x64__.msi
Source: v.1.6.3__x64__.msi Binary or memory string: OriginalFilenameDataUploader.dllF vs v.1.6.3__x64__.msi
Source: classification engine Classification label: mal56.troj.winMSI@4/125@1/1
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Microsoft\CMLA0C6.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Temp\MSI5c630.LOG Jump to behavior
Source: C:\Windows\System32\msiexec.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload Jump to behavior
Source: unknown Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\v.1.6.3__x64__.msi"
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 12E499341769C229580CC44839D4DDCA
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 12E499341769C229580CC44839D4DDCA Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.ui.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windowmanagementapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: inputhost.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.ui.immersive.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netprofm.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: v.1.6.3__x64__.msi Static file information: File size 53926912 > 1048576
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.1.dr
Source: Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: v.1.6.3__x64__.msi
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.1.dr
Source: Binary string: D:\code88\chromium_git\chromium\src\out\Release_x64\node.dll.pdb source: node.dll.1.dr
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdb source: v.1.6.3__x64__.msi, MSI9864.tmp.1.dr
Source: Binary string: D:\code88\chromium_git\chromium\src\out\Release_x64\node.dll.pdb source: node.dll.1.dr
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.1.dr
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: v.1.6.3__x64__.msi, MSI9825.tmp.1.dr
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdbj source: v.1.6.3__x64__.msi, MSI9864.tmp.1.dr
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbm source: v.1.6.3__x64__.msi
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: api-ms-win-core-synch-l1-1-0.dll.1.dr
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\tempFiles.pdb- source: v.1.6.3__x64__.msi, 54996a.rbs.1.dr, MSIA035.tmp.1.dr
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: api-ms-win-crt-multibyte-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: api-ms-win-crt-environment-l1-1-0.dll.1.dr
Source: Binary string: D:\git-sdk-64-build-installers\usr\src\MINGW-packages\mingw-w64-git\src\git\git-bash.pdb source: git-bash.exe.1.dr
Source: Binary string: obs.pdb~~ source: obs.dll.1.dr
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: api-ms-win-core-timezone-l1-1-0.dll.1.dr
Source: Binary string: libEGL.dll.pdb source: libEGL.dll.1.dr
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.1.dr
Source: Binary string: D:\git-sdk-64-build-installers\usr\src\MINGW-packages\mingw-w64-git\src\git\cmd\git-gui.pdb source: git-gui.exe.1.dr
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: v.1.6.3__x64__.msi
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.1.dr
Source: Binary string: obs.pdb source: obs.dll.1.dr
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: v.1.6.3__x64__.msi, MSIA1C6.tmp.1.dr
Source: Binary string: D:\git-sdk-64-build-installers\usr\src\MINGW-packages\mingw-w64-git\src\git\cmd\git.pdb source: git.exe.1.dr
Source: Binary string: C:\ReleaseAI\win\Release\custact\x86\tempFiles.pdb source: v.1.6.3__x64__.msi, 54996a.rbs.1.dr, MSIA035.tmp.1.dr
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: api-ms-win-crt-heap-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: api-ms-win-crt-string-l1-1-0.dll.1.dr
Binary contains a suspicious time stamp
Source: w32-pthreads.dll.1.dr Static PE information: 0xB1915111 [Tue May 27 05:11:45 2064 UTC]
PE file contains sections with non-standard names
Source: avutil-58.dll.1.dr Static PE information: section name: .xdata
Source: swresample-4.dll.1.dr Static PE information: section name: .xdata
Source: swscale-7.dll.1.dr Static PE information: section name: .xdata
Source: zlib.dll.1.dr Static PE information: section name: .xdata
Source: avformat-60.dll.1.dr Static PE information: section name: .xdata
Source: vcruntime140.dll.1.dr Static PE information: section name: _RDATA
Source: libEGL.dll.1.dr Static PE information: section name: .00cfg
Source: libEGL.dll.1.dr Static PE information: section name: .gehcont
Source: libGLESv2.dll.1.dr Static PE information: section name: .00cfg
Source: libGLESv2.dll.1.dr Static PE information: section name: .gehcont
Source: node.dll.1.dr Static PE information: section name: .00cfg
Source: smartgit-updater.exe.1.dr Static PE information: section name: .xdata
Source: bash.exe.1.dr Static PE information: section name: .xdata
Source: bash.exe.1.dr Static PE information: section name: .debug
Source: git.exe.1.dr Static PE information: section name: .xdata
Source: git.exe.1.dr Static PE information: section name: .debug
Source: sh.exe.1.dr Static PE information: section name: .xdata
Source: sh.exe.1.dr Static PE information: section name: .debug
Source: git-gui.exe.1.dr Static PE information: section name: .xdata
Source: git-gui.exe.1.dr Static PE information: section name: .debug
Source: git.exe0.1.dr Static PE information: section name: .xdata
Source: git.exe0.1.dr Static PE information: section name: .debug
Source: gitk.exe.1.dr Static PE information: section name: .xdata
Source: gitk.exe.1.dr Static PE information: section name: .debug
Source: scalar.exe.1.dr Static PE information: section name: .xdata
Source: scalar.exe.1.dr Static PE information: section name: .debug
Source: git-bash.exe.1.dr Static PE information: section name: .xdata
Source: git-bash.exe.1.dr Static PE information: section name: .debug
Source: git-cmd.exe.1.dr Static PE information: section name: .xdata
Source: git-cmd.exe.1.dr Static PE information: section name: .debug
Source: UnRAR.exe.1.dr Static PE information: section name: _RDATA
Source: MSIA2B3.tmp.1.dr Static PE information: section name: .didat
Source: MSI9825.tmp.1.dr Static PE information: section name: .didat
Drops PE files
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI9864.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\git-bash.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA342.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\cmd\gitk.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\smartgit-updater.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\bin\git.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\swscale-7.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\vcruntime140_1.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\git-cmd.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\vcruntime140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\node.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\cmd\scalar.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI96EA.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\obs-ffmpeg-mux.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\obs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\avutil-58.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI972A.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\zlib.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\msvcp140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA1C6.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\avformat-60.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\bin\bash.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\cmd\git.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA206.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\Required\jvm.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\cmd\git-gui.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI9825.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA2B3.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA303.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\libGLESv2.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\smartgit.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\UnRAR.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\w32-pthreads.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\bin\sh.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA148.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA264.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\swresample-4.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\smartgitc.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\libEGL.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA1C6.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI9864.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA206.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI96EA.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA148.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA264.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA342.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI9825.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI972A.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA2B3.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIA303.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\git-bash.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSI9864.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIA342.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\cmd\gitk.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\smartgit-updater.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\bin\git.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\swscale-7.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\git-cmd.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\vcruntime140_1.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\vcruntime140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\cmd\scalar.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\node.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSI96EA.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\obs-ffmpeg-mux.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\obs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\avutil-58.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSI972A.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\zlib.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\msvcp140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIA1C6.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\bin\bash.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\avformat-60.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\cmd\git.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIA206.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\Required\jvm.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\cmd\git-gui.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSI9825.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIA2B3.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIA303.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\libGLESv2.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\smartgit.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\UnRAR.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\w32-pthreads.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\git\bin\sh.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIA148.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIA264.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\swresample-4.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\smartgitc.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\libEGL.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tiqs Via Q\KcozApp\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: v.1.6.3__x64__.msi Binary or memory string: HKEY_USERSRegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1VMware20,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+
Source: node.dll.1.dr Binary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: C:\Windows\System32\msiexec.exe Process information queried: ProcessInformation Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected LegionLoader
Source: Yara match File source: v.1.6.3__x64__.msi, type: SAMPLE
Source: Yara match File source: C:\Windows\Installer\549968.msi, type: DROPPED

Remote Access Functionality
barindex
Yara detected LegionLoader
Source: Yara match File source: v.1.6.3__x64__.msi, type: SAMPLE
Source: Yara match File source: C:\Windows\Installer\549968.msi, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1532356 Sample: v.1.6.3__x64__.msi Startdate: 13/10/2024 Architecture: WINDOWS Score: 56 23 key-crack.com 2->23 27 Suricata IDS alerts for network traffic 2->27 29 Yara detected LegionLoader 2->29 7 msiexec.exe 77 114 2->7         started        10 msiexec.exe 3 2->10         started        signatures3 process4 file5 15 C:\Windows\Installer\549968.msi, Composite 7->15 dropped 17 C:\Windows\Installer\MSIA342.tmp, PE32 7->17 dropped 19 C:\Windows\Installer\MSIA303.tmp, PE32 7->19 dropped 21 59 other files (none is malicious) 7->21 dropped 12 msiexec.exe 1 51 7->12         started        process6 dnsIp7 25 key-crack.com 172.67.221.87, 443, 49807 CLOUDFLARENETUS United States 12->25
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.67.221.87
 key-crack.com United States
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
key-crack.com 172.67.221.87 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://key-crack.com/licenseUser.php true
    		unknown