Edit tour

Windows Analysis Report
1944b321.msi

Overview

General Information

Sample name:	1944b321.msi
Analysis ID:	1546437
MD5:	f2f3a908a18ef6b45b50e1105326b833
SHA1:	d01c20894cff8efa96e3394fcb54a8f4cea0f764
SHA256:	ef896df89c6088517c117552424e932d590ebd483decc3c9f444a18ce88179fd
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Creates an undocumented autostart registry key

Disables DEP (Data Execution Prevention) for certain images

Modifies the windows firewall

PE file has nameless sections

Uses netsh to modify the Windows network and firewall settings

Adds / modifies Windows certificates

Checks for available system drives (often done to infect USB drives)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion NT Autorun Keys Modification

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 7268 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\1944b321.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7312 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

mpk_emni_mpk.exe (PID: 7464 cmdline: "C:\ProgramData\MPK\mpk_emni_mpk.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SDIR "C:\Users\user\Desktop\" /LOG="C:\ProgramData\MPK\mpk_em_log.txt" MD5: E67464707F7D14131BEDE9DB845A6A0A)

mpk_emni_mpk.tmp (PID: 7480 cmdline: "C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp" /SL5="$3049C,4852295,119296,C:\ProgramData\MPK\mpk_emni_mpk.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SDIR "C:\Users\user\Desktop\" /LOG="C:\ProgramData\MPK\mpk_em_log.txt" MD5: 5ABA2917CE54882DFFA1635380313097)

_setup64.tmp (PID: 7496 cmdline: helper 105 0x3DC MD5: 526426126AE5D326D0A24706C77D8C5C)

conhost.exe (PID: 7504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7564 cmdline: "C:\Windows\SysWOW64\cmd.exe" /c netsh advfirewall firewall add rule name="TCP\IP" dir=in action=allow program="C:\ProgramData\MPK\mpk.exe" enable=yes MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7608 cmdline: netsh advfirewall firewall add rule name="TCP\IP" dir=in action=allow program="C:\ProgramData\MPK\mpk.exe" enable=yes MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

MPKInst.exe (PID: 7640 cmdline: "C:\ProgramData\MPK\MPKInst.exe" /i /dr /cp MD5: 20BC08D7652B652811DF5F403C9C6DFA)

conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

lsynchost.exe (PID: 7696 cmdline: c:\programdata\mpk\\lsynchost.exe /install /silent MD5: 1A902E39120A8CCAA56163B91601E63A)

lsynchost.exe (PID: 7716 cmdline: c:\programdata\mpk\lsynchost.exe /startedbyscm:E4233B4F-40E3FE91-MPKService MD5: 1A902E39120A8CCAA56163B91601E63A)

lsynchost.exe (PID: 7748 cmdline: "c:\programdata\mpk\lsynchost.exe" /runsrv MD5: 1A902E39120A8CCAA56163B91601E63A)

lsynchost.exe (PID: 7772 cmdline: "c:\programdata\mpk\lsynchost.exe" /runsrv \MID:D MD5: 1A902E39120A8CCAA56163B91601E63A)

svchost.exe (PID: 8088 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\MPK\is-7IT87.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\MPK\is-URL53.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000000.2093241826.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000C.00000000.2094922926.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
10.0.MPKInst.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
12.0.lsynchost.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: c:\windows\system32\userinit.exe,, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp, ProcessId: 7480, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 8088, ProcessName: svchost.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T22:10:30.806667+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.5	64622	TCP
2024-10-31T22:11:09.825649+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.5	64805	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\ProgramData\MPK\is-EQREG.tmp	Avira: detection malicious, Label: APPL/MonitorTool.Gen
Source: C:\ProgramData\MPK\is-NK5I1.tmp	Avira: detection malicious, Label: APPL/MonitorTool.Gen

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MPK\MPK.dll (copy)	ReversingLabs: Detection: 53%
Source: C:\ProgramData\MPK\MPK.exe (copy)	ReversingLabs: Detection: 62%
Source: C:\ProgramData\MPK\MPK64.dll (copy)	ReversingLabs: Detection: 44%
Source: C:\ProgramData\MPK\MPKInst.exe (copy)	ReversingLabs: Detection: 40%
Source: C:\ProgramData\MPK\MpkHCA.dll (copy)	ReversingLabs: Detection: 64%
Source: C:\ProgramData\MPK\MpkL64.exe (copy)	ReversingLabs: Detection: 45%
Source: C:\ProgramData\MPK\is-5U9RI.tmp	ReversingLabs: Detection: 24%
Source: C:\ProgramData\MPK\is-7IT87.tmp	ReversingLabs: Detection: 44%
Source: C:\ProgramData\MPK\is-EQREG.tmp	ReversingLabs: Detection: 62%
Source: C:\ProgramData\MPK\is-H68I0.tmp	ReversingLabs: Detection: 44%
Source: C:\ProgramData\MPK\is-M13BC.tmp	ReversingLabs: Detection: 45%
Source: C:\ProgramData\MPK\is-NK5I1.tmp	ReversingLabs: Detection: 64%
Source: C:\ProgramData\MPK\is-RJO8C.tmp	ReversingLabs: Detection: 53%
Source: C:\ProgramData\MPK\is-URL53.tmp	ReversingLabs: Detection: 40%
Source: C:\ProgramData\MPK\lsynchost.exe (copy)	ReversingLabs: Detection: 44%
Source: C:\ProgramData\MPK\mpk_emni_mpk.exe	ReversingLabs: Detection: 51%
Source: C:\ProgramData\MPK\unins000.exe (copy)	ReversingLabs: Detection: 24%
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	ReversingLabs: Detection: 24%

Multi AV Scanner detection for submitted file

Source: 1944b321.msi

ReversingLabs: Detection: 33%

Source:	Binary string: D:\CFILES\Projects\WinSSL\openssl-1.0.1l\out32dll\libeay32.pdbl source: is-3LL6A.tmp.4.dr
Source:	Binary string: D:\CFILES\Projects\WinSSL\openssl-1.0.1l\out32dll\libeay32.pdb source: is-3LL6A.tmp.4.dr
Source:	Binary string: Inspect.pdb source: is-ARHTI.tmp.4.dr
Source:	Binary string: D:\CFILES\Projects\WinSSL\openssl-1.0.1l\out32dll\ssleay32.pdb source: is-SUMV4.tmp.4.dr
Source:	Binary string: CHARTOOEMBUFFl\Release\isunzlib.pdb source: mpk_emni_mpk.tmp, 00000004.00000003.2101400325.0000000002CAD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\zlib-dll\Release\isunzlib.pdb source: mpk_emni_mpk.tmp, 00000004.00000003.2062536481.00000000029B4000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101887413.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.4.dr
Source:	Binary string: D:\asf\httpd-2.2\srclib\zlib\zlib1.pdb source: is-GH6IU.tmp.4.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:64622
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:64805

Source: mpk_emni_mpk.exe, 00000003.00000003.2060667547.000000007FE41000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.exe, 00000003.00000003.2060281542.00000000024A5000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000002.2102814872.000000000018F000.00000004.00000010.00020000.00000000.sdmp, 1944b321.msi, 4e7f65.msi.1.dr, is-EQREG.tmp.4.dr, mpk_emni_mpk.exe.1.dr, is-RJO8C.tmp.4.dr, 4e7f67.msi.1.dr, mpk_emni_mpk.tmp.3.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: mpk_emni_mpk.exe, 00000003.00000003.2060667547.000000007FE41000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.exe, 00000003.00000003.2060281542.00000000024A5000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000002.2102814872.000000000018F000.00000004.00000010.00020000.00000000.sdmp, 1944b321.msi, 4e7f65.msi.1.dr, is-EQREG.tmp.4.dr, mpk_emni_mpk.exe.1.dr, is-RJO8C.tmp.4.dr, 4e7f67.msi.1.dr, mpk_emni_mpk.tmp.3.dr	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: mpk_emni_mpk.exe, 00000003.00000003.2060667547.000000007FE41000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.exe, 00000003.00000003.2060281542.00000000024A5000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000002.2102814872.000000000018F000.00000004.00000010.00020000.00000000.sdmp, 1944b321.msi, 4e7f65.msi.1.dr, is-EQREG.tmp.4.dr, mpk_emni_mpk.exe.1.dr, is-RJO8C.tmp.4.dr, 4e7f67.msi.1.dr, mpk_emni_mpk.tmp.3.dr	String found in binary or memory: http://sf.symcd.com0&
Source: mpk_emni_mpk.exe, 00000003.00000003.2059670958.0000000002390000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.exe, 00000003.00000003.2103847115.00000000021DC000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2062536481.00000000029A0000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101887413.000000000228B000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101400325.0000000002C3D000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101887413.0000000002258000.00000004.00001000.00020000.00000000.sdmp, unins000.msg.4.dr	String found in binary or memory: http://www.dk-soft.org/
Source: mpk_emni_mpk.exe, 00000003.00000003.2103847115.00000000021BF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dk-soft.org/0
Source: mpk_emni_mpk.tmp, 00000004.00000003.2101887413.0000000002258000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google-analytics.com/collect
Source: mpk_emni_mpk.exe, 00000003.00000003.2060281542.0000000002390000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.exe, 00000003.00000003.2060667547.000000007FD30000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000000.2061522413.0000000000401000.00000020.00000001.01000000.00000004.sdmp, mpk_emni_mpk.tmp.3.dr	String found in binary or memory: http://www.innosetup.com/
Source: mpk_emni_mpk.exe, 00000003.00000000.2058969608.0000000000401000.00000020.00000001.01000000.00000003.sdmp, mpk_emni_mpk.exe.1.dr	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: mpk_emni_mpk.tmp, 00000004.00000003.2062536481.00000000029A0000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101400325.0000000002C3D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mipko.ru/
Source: mpk_emni_mpk.tmp, 00000004.00000003.2062536481.00000000029A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mipko.ru/$QuickHelpMainLabel
Source: mpk_emni_mpk.exe, 00000003.00000003.2059670958.0000000002390000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2062536481.00000000029A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mipko.ru/(http://www.mipko.ru/(http://www.mipko.ru/(
Source: mpk_emni_mpk.exe, 00000003.00000003.2103847115.0000000002241000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101887413.0000000002311000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mipko.ru/1
Source: mpk_emni_mpk.tmp, 00000004.00000003.2062536481.00000000029A0000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101400325.0000000002C3D000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101887413.0000000002243000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mipko.ru/employee-monitor/tutorial-msi.php?reffrominfo=INSTALL&refverinfo=0
Source: mpk_emni_mpk.tmp, 00000004.00000003.2101400325.0000000002C3D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mipko.ru/helponline.php?reffrominfo=INSTALL&refverinfo=0
Source: mpk_emni_mpk.tmp, 00000004.00000003.2101887413.000000000224A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mipko.ru/helponline.php?reffrominfo=INSTALL&refverinfo=0a
Source: mpk_emni_mpk.tmp, 00000004.00000003.2101887413.000000000224A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mipko.ru/helponline.php?reffrominfo=INSTALL&refverinfo=0q
Source: mpk_emni_mpk.exe, 00000003.00000003.2103847115.0000000002241000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101887413.0000000002311000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mipko.ru/q
Source: mpk_emni_mpk.tmp, 00000004.00000003.2062536481.00000000029A0000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101887413.000000000224A000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101400325.0000000002C3D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mipko.ru/register.php?reffrominfo=INSTALL&refverinfo=0
Source: mpk_emni_mpk.tmp, 00000004.00000003.2062536481.00000000029A0000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101400325.0000000002C3D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mipko.ru/uninstall.htm?reffrominfo=INSTALL&refverinfo=0
Source: mpk_emni_mpk.tmp, 00000004.00000003.2101887413.000000000224A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mipko.ru/uninstall.htm?reffrominfo=INSTALL&refverinfo=09
Source: is-3LL6A.tmp.4.dr, is-SUMV4.tmp.4.dr	String found in binary or memory: http://www.openssl.org/V
Source: is-3LL6A.tmp.4.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: is-3LL6A.tmp.4.dr	String found in binary or memory: http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG
Source: mpk_emni_mpk.exe, 00000003.00000003.2060281542.0000000002390000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.exe, 00000003.00000003.2060667547.000000007FD30000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000000.2061522413.0000000000401000.00000020.00000001.01000000.00000004.sdmp, mpk_emni_mpk.tmp.3.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: mpk_emni_mpk.exe, 00000003.00000003.2060667547.000000007FE41000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.exe, 00000003.00000003.2060281542.00000000024A5000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000002.2102814872.000000000018F000.00000004.00000010.00020000.00000000.sdmp, 1944b321.msi, 4e7f65.msi.1.dr, is-EQREG.tmp.4.dr, mpk_emni_mpk.exe.1.dr, is-RJO8C.tmp.4.dr, 4e7f67.msi.1.dr, mpk_emni_mpk.tmp.3.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: mpk_emni_mpk.exe, 00000003.00000003.2060667547.000000007FE41000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.exe, 00000003.00000003.2060281542.00000000024A5000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000002.2102814872.000000000018F000.00000004.00000010.00020000.00000000.sdmp, 1944b321.msi, 4e7f65.msi.1.dr, is-EQREG.tmp.4.dr, mpk_emni_mpk.exe.1.dr, is-RJO8C.tmp.4.dr, 4e7f67.msi.1.dr, mpk_emni_mpk.tmp.3.dr	String found in binary or memory: https://d.symcb.com/rpa0

System Summary

PE file has nameless sections

Source: is-EQREG.tmp.4.dr	Static PE information: section name:
Source: is-EQREG.tmp.4.dr	Static PE information: section name:
Source: is-EQREG.tmp.4.dr	Static PE information: section name:
Source: is-EQREG.tmp.4.dr	Static PE information: section name:
Source: is-EQREG.tmp.4.dr	Static PE information: section name:
Source: is-EQREG.tmp.4.dr	Static PE information: section name:
Source: is-EQREG.tmp.4.dr	Static PE information: section name:
Source: is-EQREG.tmp.4.dr	Static PE information: section name:
Source: is-EQREG.tmp.4.dr	Static PE information: section name:

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4e7f65.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{9EBEE94E-B80E-4DDF-961B-A35BE6877C22}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI83EA.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4e7f67.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4e7f67.msi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\Windows\SysWOW64\is-ARHTI.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\PeerDistRepub	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\4e7f67.msi

Jump to behavior

Source: mpk_emni_mpk.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: mpk_emni_mpk.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-5U9RI.tmp.4.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-5U9RI.tmp.4.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: is-JS61I.tmp.4.dr	Static PE information: Number of sections : 19 > 10
Source: is-EQREG.tmp.4.dr	Static PE information: Number of sections : 12 > 10

Source: is-EQREG.tmp.4.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: is-EQREG.tmp.4.dr	Static PE information: Section: ZLIB complexity 1.000859375
Source: is-EQREG.tmp.4.dr	Static PE information: Section: ZLIB complexity 1.0005542652027026
Source: is-EQREG.tmp.4.dr	Static PE information: Section: ZLIB complexity 1.0008445945945945
Source: is-EQREG.tmp.4.dr	Static PE information: Section: ZLIB complexity 1.0107421875

Source: classification engine

Classification label: mal84.evad.winMSI@25/66@0/0

Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\ProgramData\MPK\MPKInst.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\MPK_MUTEX_42587B64572B06762F7D7E70674A777103
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
Source: C:\ProgramData\MPK\lsynchost.exe	Mutant created: \BaseNamedObjects\Global\MPK_MUTEX_42587B64572B06762F1A757B76
Source: C:\ProgramData\MPK\lsynchost.exe	Mutant created: \BaseNamedObjects\Global\MPK_MUTEX_23587B645730146A376D7E607B2B617D687C6D2F
Source: C:\ProgramData\MPK\lsynchost.exe	Mutant created: \BaseNamedObjects\Global\MPK_MUTEX_23587B64572B07753D7A736B7C376607036170
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7504:120:WilError_03
Source: C:\ProgramData\MPK\lsynchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\MPK_MUTEX_42587B64572B07753D7A736B7C376607036170
Source: C:\ProgramData\MPK\lsynchost.exe	Mutant created: \BaseNamedObjects\Global\MPK_MUTEX_20587B64572B07753D7A736B7C376607036170

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DFEDA63B10F1214E09.TMP

Jump to behavior

Source: Yara match	File source: 10.0.MPKInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.lsynchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.2093241826.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.2094922926.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\MPK\is-7IT87.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\MPK\is-URL53.tmp, type: DROPPED

Source: C:\ProgramData\MPK\mpk_emni_mpk.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPK\MPKInst.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPK\MPKInst.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: 1944b321.msi

Static file information: TRID: Microsoft Windows Installer (60509/1) 88.31%

Source: 1944b321.msi

ReversingLabs: Detection: 33%

Source: C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_setup64.tmp

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

graph_5-67

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\1944b321.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\ProgramData\MPK\mpk_emni_mpk.exe "C:\ProgramData\MPK\mpk_emni_mpk.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SDIR "C:\Users\user\Desktop\" /LOG="C:\ProgramData\MPK\mpk_em_log.txt"
Source: C:\ProgramData\MPK\mpk_emni_mpk.exe	Process created: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp "C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp" /SL5="$3049C,4852295,119296,C:\ProgramData\MPK\mpk_emni_mpk.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SDIR "C:\Users\user\Desktop\" /LOG="C:\ProgramData\MPK\mpk_em_log.txt"
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_setup64.tmp helper 105 0x3DC
Source: C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_setup64.tmp	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c netsh advfirewall firewall add rule name="TCP\IP" dir=in action=allow program="C:\ProgramData\MPK\mpk.exe" enable=yes
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="TCP\IP" dir=in action=allow program="C:\ProgramData\MPK\mpk.exe" enable=yes
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process created: C:\ProgramData\MPK\MPKInst.exe "C:\ProgramData\MPK\MPKInst.exe" /i /dr /cp
Source: C:\ProgramData\MPK\MPKInst.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MPK\MPKInst.exe	Process created: C:\ProgramData\MPK\lsynchost.exe c:\programdata\mpk\\lsynchost.exe /install /silent
Source: unknown	Process created: C:\ProgramData\MPK\lsynchost.exe c:\programdata\mpk\lsynchost.exe /startedbyscm:E4233B4F-40E3FE91-MPKService
Source: C:\ProgramData\MPK\lsynchost.exe	Process created: C:\ProgramData\MPK\lsynchost.exe "c:\programdata\mpk\lsynchost.exe" /runsrv
Source: C:\ProgramData\MPK\lsynchost.exe	Process created: C:\ProgramData\MPK\lsynchost.exe "c:\programdata\mpk\lsynchost.exe" /runsrv \MID:D
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Windows\System32\msiexec.exe	Process created: C:\ProgramData\MPK\mpk_emni_mpk.exe "C:\ProgramData\MPK\mpk_emni_mpk.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SDIR "C:\Users\user\Desktop\" /LOG="C:\ProgramData\MPK\mpk_em_log.txt"	Jump to behavior
Source: C:\ProgramData\MPK\mpk_emni_mpk.exe	Process created: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp "C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp" /SL5="$3049C,4852295,119296,C:\ProgramData\MPK\mpk_emni_mpk.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SDIR "C:\Users\user\Desktop\" /LOG="C:\ProgramData\MPK\mpk_em_log.txt"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_setup64.tmp helper 105 0x3DC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c netsh advfirewall firewall add rule name="TCP\IP" dir=in action=allow program="C:\ProgramData\MPK\mpk.exe" enable=yes	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process created: C:\ProgramData\MPK\MPKInst.exe "C:\ProgramData\MPK\MPKInst.exe" /i /dr /cp	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="TCP\IP" dir=in action=allow program="C:\ProgramData\MPK\mpk.exe" enable=yes	Jump to behavior
Source: C:\ProgramData\MPK\MPKInst.exe	Process created: C:\ProgramData\MPK\lsynchost.exe c:\programdata\mpk\\lsynchost.exe /install /silent	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Process created: C:\ProgramData\MPK\lsynchost.exe "c:\programdata\mpk\lsynchost.exe" /runsrv	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Process created: C:\ProgramData\MPK\lsynchost.exe "c:\programdata\mpk\lsynchost.exe" /runsrv \MID:D	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\ProgramData\MPK\mpk_emni_mpk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPK\mpk_emni_mpk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_setup64.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_setup64.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\MPK\MPKInst.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPK\MPKInst.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\MPK\MPKInst.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MPK\MPKInst.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\ProgramData\MPK\MPKInst.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\MPK\MPKInst.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPK\MPKInst.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPK\MPKInst.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\ProgramData\MPK\MPKInst.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 1944b321.msi

Static file information: File size 5255168 > 1048576

Source:	Binary string: D:\CFILES\Projects\WinSSL\openssl-1.0.1l\out32dll\libeay32.pdbl source: is-3LL6A.tmp.4.dr
Source:	Binary string: D:\CFILES\Projects\WinSSL\openssl-1.0.1l\out32dll\libeay32.pdb source: is-3LL6A.tmp.4.dr
Source:	Binary string: Inspect.pdb source: is-ARHTI.tmp.4.dr
Source:	Binary string: D:\CFILES\Projects\WinSSL\openssl-1.0.1l\out32dll\ssleay32.pdb source: is-SUMV4.tmp.4.dr
Source:	Binary string: CHARTOOEMBUFFl\Release\isunzlib.pdb source: mpk_emni_mpk.tmp, 00000004.00000003.2101400325.0000000002CAD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\zlib-dll\Release\isunzlib.pdb source: mpk_emni_mpk.tmp, 00000004.00000003.2062536481.00000000029B4000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101887413.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.4.dr
Source:	Binary string: D:\asf\httpd-2.2\srclib\zlib\zlib1.pdb source: is-GH6IU.tmp.4.dr

Source: is-EQREG.tmp.4.dr	Static PE information: section name:
Source: is-EQREG.tmp.4.dr	Static PE information: section name:
Source: is-EQREG.tmp.4.dr	Static PE information: section name:
Source: is-EQREG.tmp.4.dr	Static PE information: section name:
Source: is-EQREG.tmp.4.dr	Static PE information: section name:
Source: is-EQREG.tmp.4.dr	Static PE information: section name:
Source: is-EQREG.tmp.4.dr	Static PE information: section name:
Source: is-EQREG.tmp.4.dr	Static PE information: section name:
Source: is-EQREG.tmp.4.dr	Static PE information: section name:
Source: is-EQREG.tmp.4.dr	Static PE information: section name: .adata
Source: is-JS61I.tmp.4.dr	Static PE information: section name: /4
Source: is-JS61I.tmp.4.dr	Static PE information: section name: /19
Source: is-JS61I.tmp.4.dr	Static PE information: section name: /35
Source: is-JS61I.tmp.4.dr	Static PE information: section name: /51
Source: is-JS61I.tmp.4.dr	Static PE information: section name: /63
Source: is-JS61I.tmp.4.dr	Static PE information: section name: /77
Source: is-JS61I.tmp.4.dr	Static PE information: section name: /89
Source: is-JS61I.tmp.4.dr	Static PE information: section name: /102
Source: is-JS61I.tmp.4.dr	Static PE information: section name: /113
Source: is-JS61I.tmp.4.dr	Static PE information: section name: /124
Source: is-7IT87.tmp.4.dr	Static PE information: section name: .didata
Source: is-URL53.tmp.4.dr	Static PE information: section name: .didata

Source: is-EQREG.tmp.4.dr	Static PE information: section name: entropy: 7.984789371171089
Source: is-EQREG.tmp.4.dr	Static PE information: section name: entropy: 7.994840224102401
Source: is-EQREG.tmp.4.dr	Static PE information: section name: entropy: 7.990943201012819
Source: is-EQREG.tmp.4.dr	Static PE information: section name: entropy: 7.815634775197806
Source: is-EQREG.tmp.4.dr	Static PE information: section name: .rsrc entropy: 7.93730555835485
Source: is-EQREG.tmp.4.dr	Static PE information: section name: .data entropy: 7.925340424958526

Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\Vorbis.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-89R70.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-I4L15.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\ogg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-3LL6A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-BV3PJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-URL53.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\lsynchost.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-H68I0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-NK5I1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\MpkL64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-EQREG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\Windows\SysWOW64\inspect.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\MpkHCA.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-SUMV4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-5U9RI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-9EF5L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-JS61I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\vorbisfile.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-M13BC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-RJO8C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-7IT87.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\MPK.dll (copy)	Jump to dropped file
Source: C:\ProgramData\MPK\mpk_emni_mpk.exe	File created: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\MPK.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\MPKInst.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\MPK\mpk_emni_mpk.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\MPK64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\vorbisenc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-GH6IU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\Windows\SysWOW64\is-ARHTI.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\Vorbis.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-89R70.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-I4L15.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\ogg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-3LL6A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-BV3PJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-URL53.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\lsynchost.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-H68I0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-NK5I1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\MpkL64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-EQREG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\MpkHCA.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-SUMV4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-5U9RI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-9EF5L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-JS61I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\vorbisfile.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-M13BC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-RJO8C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-7IT87.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\MPK.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\MPK.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\MPKInst.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\MPK\mpk_emni_mpk.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\MPK64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\vorbisenc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\ProgramData\MPK\is-GH6IU.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\Windows\SysWOW64\inspect.exe (copy)			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	File created: C:\Windows\SysWOW64\is-ARHTI.tmp			Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 Blob

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\MPK\mpk_emni_mpk.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPK\mpk_emni_mpk.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPK\MPKInst.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\Vorbis.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\is-89R70.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\ogg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\is-I4L15.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\is-3LL6A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\is-BV3PJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\is-NK5I1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\is-H68I0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\MpkL64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\inspect.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\is-EQREG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\MpkHCA.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\is-SUMV4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\is-9EF5L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\is-JS61I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\vorbisfile.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\is-M13BC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\is-RJO8C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\MPK.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\MPK.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\MPK64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\vorbisenc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\ProgramData\MPK\is-GH6IU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-ARHTI.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\ProgramData\MPK\MPKInst.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\ProgramData\MPK\MPKInst.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\ProgramData\MPK\lsynchost.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: mpk_emni_mpk.tmp, 00000004.00000002.2103218386.0000000000745000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process created: C:\ProgramData\MPK\mpk_emni_mpk.exe "C:\ProgramData\MPK\mpk_emni_mpk.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SDIR "C:\Users\user\Desktop\" /LOG="C:\ProgramData\MPK\mpk_em_log.txt"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_setup64.tmp helper 105 0x3DC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c netsh advfirewall firewall add rule name="TCP\IP" dir=in action=allow program="C:\ProgramData\MPK\mpk.exe" enable=yes	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="TCP\IP" dir=in action=allow program="C:\ProgramData\MPK\mpk.exe" enable=yes	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_setup64.tmp

Code function: 5_2_0000000140001000 GetNamedSecurityInfoW,AllocateAndInitializeSid,SetEntriesInAclW,SetNamedSecurityInfoW,LocalFree,FreeSid,LocalFree,GetLastError,

5_2_0000000140001000

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables DEP (Data Execution Prevention) for certain images

Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers DisableNXShowUI

Jump to behavior

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /c netsh advfirewall firewall add rule name="TCP\IP" dir=in action=allow program="C:\ProgramData\MPK\mpk.exe" enable=yes

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="TCP\IP" dir=in action=allow program="C:\ProgramData\MPK\mpk.exe" enable=yes

Source: C:\Windows\System32\msiexec.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 Blob

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	11 Process Injection	21 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Disable or Modify Tools	Security Account Manager	11 Peripheral Device Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	2 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1944b321.msi	33%	ReversingLabs	Win32.PUA.RefogKeylogging

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\MPK\is-EQREG.tmp	100%	Avira	APPL/MonitorTool.Gen
C:\ProgramData\MPK\is-NK5I1.tmp	100%	Avira	APPL/MonitorTool.Gen
C:\ProgramData\MPK\MPK.dll (copy)	53%	ReversingLabs	Win32.PUA.RefogKeylogging
C:\ProgramData\MPK\MPK.exe (copy)	62%	ReversingLabs	Win32.Spyware.Refog
C:\ProgramData\MPK\MPK64.dll (copy)	45%	ReversingLabs	Win64.PUA.RefogKeylogging
C:\ProgramData\MPK\MPKInst.exe (copy)	40%	ReversingLabs	Win32.PUA.RefogKeylogging
C:\ProgramData\MPK\MpkHCA.dll (copy)	65%	ReversingLabs	Win32.PUA.RefogKeylogging
C:\ProgramData\MPK\MpkL64.exe (copy)	45%	ReversingLabs	Win64.Spyware.Refog
C:\ProgramData\MPK\Vorbis.dll (copy)	0%	ReversingLabs
C:\ProgramData\MPK\is-3LL6A.tmp	2%	ReversingLabs
C:\ProgramData\MPK\is-5U9RI.tmp	24%	ReversingLabs	Win32.PUA.RefogKeylogging
C:\ProgramData\MPK\is-7IT87.tmp	45%	ReversingLabs	Win32.Spyware.Refog
C:\ProgramData\MPK\is-89R70.tmp	0%	ReversingLabs
C:\ProgramData\MPK\is-9EF5L.tmp	0%	ReversingLabs
C:\ProgramData\MPK\is-BV3PJ.tmp	0%	ReversingLabs
C:\ProgramData\MPK\is-EQREG.tmp	62%	ReversingLabs	Win32.Spyware.Refog
C:\ProgramData\MPK\is-GH6IU.tmp	0%	ReversingLabs
C:\ProgramData\MPK\is-H68I0.tmp	45%	ReversingLabs	Win64.PUA.RefogKeylogging
C:\ProgramData\MPK\is-I4L15.tmp	0%	ReversingLabs
C:\ProgramData\MPK\is-JS61I.tmp	0%	ReversingLabs
C:\ProgramData\MPK\is-M13BC.tmp	45%	ReversingLabs	Win64.Spyware.Refog
C:\ProgramData\MPK\is-NK5I1.tmp	65%	ReversingLabs	Win32.PUA.RefogKeylogging
C:\ProgramData\MPK\is-RJO8C.tmp	53%	ReversingLabs	Win32.PUA.RefogKeylogging
C:\ProgramData\MPK\is-SUMV4.tmp	0%	ReversingLabs
C:\ProgramData\MPK\is-URL53.tmp	40%	ReversingLabs	Win32.PUA.RefogKeylogging
C:\ProgramData\MPK\libeay32.dll (copy)	2%	ReversingLabs
C:\ProgramData\MPK\lsynchost.exe (copy)	45%	ReversingLabs	Win32.Spyware.Refog
C:\ProgramData\MPK\mpk_emni_mpk.exe	52%	ReversingLabs	Win32.PUA.RefogKeylogging
C:\ProgramData\MPK\ogg.dll (copy)	0%	ReversingLabs
C:\ProgramData\MPK\sqlite3.dll (copy)	0%	ReversingLabs
C:\ProgramData\MPK\ssleay32.dll (copy)	0%	ReversingLabs
C:\ProgramData\MPK\unins000.exe (copy)	24%	ReversingLabs	Win32.PUA.RefogKeylogging
C:\ProgramData\MPK\vorbisenc.dll (copy)	0%	ReversingLabs
C:\ProgramData\MPK\vorbisfile.dll (copy)	0%	ReversingLabs
C:\ProgramData\MPK\zlib1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp	24%	ReversingLabs	Win32.PUA.RefogKeylogging
C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Windows\SysWOW64\inspect.exe (copy)	0%	ReversingLabs
C:\Windows\SysWOW64\is-ARHTI.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.innosetup.com/	0%	URL Reputation	safe
http://www.remobjects.com/ps	0%	URL Reputation	safe
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe
http://www.dk-soft.org/	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.dk-soft.org/0	mpk_emni_mpk.exe, 00000003.00000003.2103847115.00000000021BF000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.innosetup.com/	mpk_emni_mpk.exe, 00000003.00000003.2060281542.0000000002390000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.exe, 00000003.00000003.2060667547.000000007FD30000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000000.2061522413.0000000000401000.00000020.00000001.01000000.00000004.sdmp, mpk_emni_mpk.tmp.3.dr	false	URL Reputation: safe	unknown
http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG	is-3LL6A.tmp.4.dr	false		unknown
http://www.mipko.ru/	mpk_emni_mpk.tmp, 00000004.00000003.2062536481.00000000029A0000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101400325.0000000002C3D000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.mipko.ru/register.php?reffrominfo=INSTALL&refverinfo=0	mpk_emni_mpk.tmp, 00000004.00000003.2062536481.00000000029A0000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101887413.000000000224A000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101400325.0000000002C3D000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.openssl.org/V	is-3LL6A.tmp.4.dr, is-SUMV4.tmp.4.dr	false		unknown
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	mpk_emni_mpk.exe, 00000003.00000000.2058969608.0000000000401000.00000020.00000001.01000000.00000003.sdmp, mpk_emni_mpk.exe.1.dr	false		unknown
http://www.mipko.ru/uninstall.htm?reffrominfo=INSTALL&refverinfo=0	mpk_emni_mpk.tmp, 00000004.00000003.2062536481.00000000029A0000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101400325.0000000002C3D000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.mipko.ru/helponline.php?reffrominfo=INSTALL&refverinfo=0q	mpk_emni_mpk.tmp, 00000004.00000003.2101887413.000000000224A000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.mipko.ru/(http://www.mipko.ru/(http://www.mipko.ru/(	mpk_emni_mpk.exe, 00000003.00000003.2059670958.0000000002390000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2062536481.00000000029A0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.mipko.ru/uninstall.htm?reffrominfo=INSTALL&refverinfo=09	mpk_emni_mpk.tmp, 00000004.00000003.2101887413.000000000224A000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.mipko.ru/1	mpk_emni_mpk.exe, 00000003.00000003.2103847115.0000000002241000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101887413.0000000002311000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.mipko.ru/q	mpk_emni_mpk.exe, 00000003.00000003.2103847115.0000000002241000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101887413.0000000002311000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.mipko.ru/$QuickHelpMainLabel	mpk_emni_mpk.tmp, 00000004.00000003.2062536481.00000000029A0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.remobjects.com/ps	mpk_emni_mpk.exe, 00000003.00000003.2060281542.0000000002390000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.exe, 00000003.00000003.2060667547.000000007FD30000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000000.2061522413.0000000000401000.00000020.00000001.01000000.00000004.sdmp, mpk_emni_mpk.tmp.3.dr	false	URL Reputation: safe	unknown
http://www.mipko.ru/helponline.php?reffrominfo=INSTALL&refverinfo=0	mpk_emni_mpk.tmp, 00000004.00000003.2101400325.0000000002C3D000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.mipko.ru/helponline.php?reffrominfo=INSTALL&refverinfo=0a	mpk_emni_mpk.tmp, 00000004.00000003.2101887413.000000000224A000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.openssl.org/support/faq.html	is-3LL6A.tmp.4.dr	false	URL Reputation: safe	unknown
http://www.dk-soft.org/	mpk_emni_mpk.exe, 00000003.00000003.2059670958.0000000002390000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.exe, 00000003.00000003.2103847115.00000000021DC000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2062536481.00000000029A0000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101887413.000000000228B000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101400325.0000000002C3D000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101887413.0000000002258000.00000004.00001000.00020000.00000000.sdmp, unins000.msg.4.dr	false	URL Reputation: safe	unknown
http://www.mipko.ru/employee-monitor/tutorial-msi.php?reffrominfo=INSTALL&refverinfo=0	mpk_emni_mpk.tmp, 00000004.00000003.2062536481.00000000029A0000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101400325.0000000002C3D000.00000004.00001000.00020000.00000000.sdmp, mpk_emni_mpk.tmp, 00000004.00000003.2101887413.0000000002243000.00000004.00001000.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546437
Start date and time:	2024-10-31 22:09:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1944b321.msi
Detection:	MAL
Classification:	mal84.evad.winMSI@25/66@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 88% Number of executed functions: 3 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 1944b321.msi

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7730
Entropy (8bit):	5.511606428476331
Encrypted:	false
SSDEEP:	96:3VtMfewQGIU2CtCsThq7U2CtC6jcDtlThqtHEg5ODWxARYCipljVrAp+C:3fceWnPwILPwHuohip0
MD5:	C316E035CBB1039600EEA6AE0EA5ED5E
SHA1:	7287825B32A8974CF85C0B23F8E4D351176CDEE7
SHA-256:	37B4687207A84935C1BE3904CC3D8B35791D04529340A225D9708486CBDAFD88
SHA-512:	D7135ACBB4A88F4DFA77DB26D80CF025D8D38B68DBCA431DEC2ACB6F301CBF3095C3D27765A0469B9633B3D484ED2BB7FA830BB1720B2316C432378E4D66A870
Malicious:	false
Preview:	...@IXOS.@.....@H._Y.@.....@.....@.....@.....@.....@......&.{9EBEE94E-B80E-4DDF-961B-A35BE6877C22}..MPK_EM..1944b321.msi.@.....@.....@.....@........&.{13B3FD70-0ECC-42BA-8BCE-4711A2312FB6}.....@.....@.....@.....@.......@.....@.....@.......@......MPK_EM......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{F9FFC604-2CE5-4252-B031-34223392D3E4}&.{9EBEE94E-B80E-4DDF-961B-A35BE6877C22}.@......&.{2BE243B0-33A6-4A41-B727-70254936D3E0}&.{9EBEE94E-B80E-4DDF-961B-A35BE6877C22}.@........CreateFolders..Creating folders..Folder: [1]"...C:\ProgramData\.@.............. .......,.............................x......................................... ... ....................................... ...!................... ...!.......InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]....C:\ProgramData\MPK\....#.C:\ProgramData\MPK\mpk_emni_mpk.exe....RegisterProduct..Registering product..[1]...

C:\ProgramData\MPK\MPK.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	629504
Entropy (8bit):	4.886934785875236
Encrypted:	false
SSDEEP:	6144:elEenOB3t7nPQBgyD7IjOHKEZa7Y1qqZbUn3JxDxqTJNOI:93t7ZyD7iOHKEZF1xZbc3EOI
MD5:	CCCC6EE4E855BB19581AB7CB61A86055
SHA1:	D67E92E3AD3B7AF42FBEAB2A98647B3894B4658A
SHA-256:	B21437682A17616CEE9BDC7034A3FE45679AFC69A810BB9FFAAFB6B4BDFDBAAB
SHA-512:	9709F878CE2D1F2F80BC26D5D03C18C0072821750A1FCF6FE1C1C115073E4277F2B6759FF83E8FC2A967A3C260E7AEBE1BF3E9B3043C75C768A4804DB6054D91
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{$VQ?E8.?E8.?E8.....E8....0E8....QE8...U.:E8...C.;E8.6=...E8.?E9..E8.Y....E8.Y...>E8.Y...>E8.?E..>E8.Y...>E8.Rich?E8.........PE..L......T...........!................l!...............................................a....@..................................p.......... ........................:..................................0...@............u...............................text...o........................... ..`.rdata...O.......P..................@..@.data... 3...0......................@....idata..J....p......................@....rsrc... ............8..............@..@.reloc..:D.......F...@..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\MPK\MPK.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1848064
Entropy (8bit):	7.9914250784592245
Encrypted:	true
SSDEEP:	49152:hSWaDZti/jOiGYkHW2VQ8HXibJ8CVjeHGB:QWa1ti/KR2h8CEW
MD5:	1F88A27A865B8E6C69CCA354B9B68445
SHA1:	313A3547382C192DB10EC314A2030C706B9E734C
SHA-256:	DEA8CA52EBCFFC6962DE7B65F39392BDF806DB56563CE6A7941EE1E04C00B0BD
SHA-512:	F0B44AA925958E6F4413775C86DF4B5304601F8C65878A41FECD1FFEBE7504EA15E9E4AA4BE8F051EEDF76319E765A261B364B20F35B47CF3AC3C79FD2957B0E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 62%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......T.................$C..................@C...@..........................`].....0............@..........................\|.X.D.....S.......................................................X...............................................................B.........................@.................B..2..................@............@...@C.....................@.................D.....................@............`... M..J..................@.................M.....................@.................M.....................@.................M.....................@............P....M.....................@....rsrc.........S.....................@....data....@....X..<..................@....adata.......P].....................@...................

C:\ProgramData\MPK\MPK64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	696064
Entropy (8bit):	4.562266096083011
Encrypted:	false
SSDEEP:	6144:Ueyz3C7heuffqf6CANY/ja9DzNTxZKjJ1Btm0v2CfU+nlm/pBZBRM+6p+m:NheuffsiY/GyiCfU+nE/3yN
MD5:	5C601EEA1F8C0013F207CA53EB2E4166
SHA1:	4AEC386FAB7515FAC4ED523E2A92D0205E213691
SHA-256:	8AFB2EC5A4168F8782D5F54D282CFE1D41E91619C8BDEFEC8613747235CF84BC
SHA-512:	86769ABEA91A7B03E9B1B8982675A8B9804051A5127BD0F0A8C6EEF24510D17EF43D23A1D4A95E939758B5133E70F1268E3FEE88568D666F52CB69F8EEA008D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&..b...b...b...ER..f...ER..f...Rm.O...Rl.....Ro.k...k.%.c...k.1.s...b.......zm.s....zh.c....zk.c...b.5.c....zn.c...Richb...................PE..d...-..T.........." ................d ...............................................^....`............................................................. ....`..l-..................................................P...p...........0...P............................text...'........................... ..`.rdata..............................@..@.data...........~..................@....pdata...3...`...4..................@..@.idata...!......."...F..............@....rsrc... ............h..............@..@.reloc...............p..............@..B........................................................................................................................................................................................

C:\ProgramData\MPK\MPKInst.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1499392
Entropy (8bit):	6.499259379210101
Encrypted:	false
SSDEEP:	24576:+YkHGqHO6pTADZVmH28IcBOSteCjRdNakuxHgb26nhr/xJ/r92OFvprq+:+LHxdQZQocISvRDxJ/r92oprq+
MD5:	20BC08D7652B652811DF5F403C9C6DFA
SHA1:	2DAF670A0909F40738849F1420A28E2ECC499C43
SHA-256:	DCD6A7649342DEA92532F866BA85E545974F05E9D2F5D70DC7CFD66CBB50A3E5
SHA-512:	F4720499EF89331E34EDCD3516376C25CA3E83C457B87C313D7A2826A4C30EB956E4563A9290C62A0A274272F8D65041D3D4FBDB7CCF07228ADF1A994341A643
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 40%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....T.................D..........(W.......`....@..............................................@..............................L;... ...Z..................................................p...............................P..^....................text....#.......$.................. ..`.itext.......@... ...(.............. ..`.data...TM...`...N...H..............@....bss.....T...............................idata..L;.......<..................@....didata.^....P......................@....tls....@....`...........................rdata.......p......................@..@.reloc.............................@..B.rsrc....Z... ...Z...r..............@..@....................................@..@........................................................

C:\ProgramData\MPK\MpkHCA.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	333056
Entropy (8bit):	4.260070328190628
Encrypted:	false
SSDEEP:	3072:FsqQ2Sv1itXCgDrr45t/oPkekfCMvJMdKmJk82y:Fu2Svozv45erkliBJkRy
MD5:	70223C7999C6847DD78239415E6185B3
SHA1:	E3B692BF56661F91436E8711E6E3762A3CD24571
SHA-256:	80001E9B4054E26B7F9DC01DEC4AD28DD15806430F52F095E9833EE7CBBAB4DF
SHA-512:	DE6D235B3F4074729CEFDD4D05F39A2C82563C04A949AF393DCB5E6916793FCA2FD6CC3B336C17206F9038FD4528E0C8CF2601539C1ED0F353F22C956AE637E1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.!.9.O.9.O.9.O..N4.;.O..N....O..N..7.O..N..U.O..N!.8.O.9.N.G.O.....2.O._f..2.O._f..8.O._f..8.O.9...8.O._f..8.O.Rich9.O.........PE..L......T...........!.........h...............................................P......T.....@.........................0Y..i....P..P.......p.......................\|!...................................G..@...............x............................text............................... ..`.rdata..............................@..@.data........`...n...D..............@....rsrc...p...........................@..@.reloc...H.......J..................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPK\MpkL64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79616
Entropy (8bit):	5.538620798160883
Encrypted:	false
SSDEEP:	1536:+6T4xQ1x132X9ba2EDww/VJdVKN8G8sWhmqsd4WlWTLyfYHh:rTwQ1xJ2X9bTEDwwdRgz4WALn
MD5:	4F4CC7256A1D6B7E8782CDEDDA4279EF
SHA1:	2BAB6C2877C0EA259FE42A7429930E5DB90432EF
SHA-256:	F35958CDF631ECEBF6E850C8485F8B18E9BFD2EC060C4AEB7C378ACBA694AE8B
SHA-512:	B7D58030CCBE928B5C8D3698D45C9E3691C04CA284FCC13D6C6F09724467163BE9569471DAFCC932D567FA077ABCAA087ACBCE52E7DFD986690730510E3F179C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... ..NZ.NZ.NZ.h5Z.NZ.h.Z..NZ.h.Z..NZ.h.Z.NZ...Z.NZ.OZ..NZ.@.Z.NZ.@.Z.NZ..Z.NZ.@.Z.NZRich.NZ................PE..d...3..T.........."......\|..........0..........@..........................................`.................................................l...P....`..p....P.......".......p..4.......................................p............................................text....z.......\|.................. ..`.rdata..>e.......f..................@..@.data....E....... ..................@....pdata.......P......................@..@.rsrc...p....`......................@..@.reloc..`....p......................@..B........................................................................................................................................................................................................................................................

C:\ProgramData\MPK\Vorbis.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1168384
Entropy (8bit):	2.5375197488346086
Encrypted:	false
SSDEEP:	3072:w4ABLspLX5fr0Z2zvvSD2tP4gc8Q8g1I9RtuH8OrsT+qldWfF/eMw:we55YI7ti1QR4Wqqi
MD5:	8884A1C5DA2077CCD9D08C5D3DACF192
SHA1:	1813EE9EBB7FDAF7E79DD90F3E0FA36D043731F5
SHA-256:	6698808D9394C8267C019EEC458093CFBD8B3D5FDE517458091B603EE00C4345
SHA-512:	00AE8C5FCD5FB60AB22CBE1646F1903A9950EA0185CBDD3E00931E59B27FE62C6974BD87FDA6E4F8EDA8128B37A197AD435B99E3604004FA5E209DC56D476E9B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}?E...........#...8..........................c.........................P.......N........ .................................L............................ ..x)...................................................................................text...............................`..`.data...............................@....rdata..............................@..@.bss.... (...............................edata..............................@..@.idata..L...........................@....reloc..x)... .....................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPK\cinfo.bin (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1570
Entropy (8bit):	5.88877406553654
Encrypted:	false
SSDEEP:	48:LrQgD1RE7dXrI+TsGyxMGRIDBfaqgxR6TgQg:LrBhRE7Vzy8fLgy1g
MD5:	50BDA2ED4D02DBD625FA425A3FCDEB44
SHA1:	434A39F59FC5207543227A6B2A215570BF2D5809
SHA-256:	1E00A7F619A596AC9C2DE6614297A2477D15D34E255BCF947150991C24EEE0A8
SHA-512:	6974F9D05E42EE4856FCD7617CE1C5459C396E903BAF2B7E5135A9C26446AC0B7284E4D1464AD35DE7546B67C19C852F0EAB546CCECBF0B89E2A3DB89B7DE703
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIESDCCAzCgAwIBAgIJAJNdu/QfCMXrMA0GCSqGSIb3DQEBBQUAMHUxCzAJBgNV..BAYTAlVTMQswCQYDVQQIEwJWQTETMBEGA1UEBxMKQWxleGFuZHJpYTESMBAGA1UE..ChMJUmVmb2cgSW5jMQ4wDAYDVQQDEwVSZWZvZzEgMB4GCSqGSIb3DQEJARYRc3Vw..cG9ydEByZWZvZy5jb20wHhcNMTAxMDI1MDY0NTUzWhcNMjAxMDIyMDY0NTUzWjB1..MQswCQYDVQQGEwJVUzELMAkGA1UECBMCVkExEzARBgNVBAcTCkFsZXhhbmRyaWEx..EjAQBgNVBAoTCVJlZm9nIEluYzEOMAwGA1UEAxMFUmVmb2cxIDAeBgkqhkiG9w0B..CQEWEXN1cHBvcnRAcmVmb2cuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB..CgKCAQEA6lQxNZ07MoOeC8Dkra2Zf9iNWnx2CwDpgfGrGOgbz+x94vEXZFmTMcxy..Y7NFgjHy5DBFcLEzVBc0LnwdRUt7KRNYdxHXIpaLveqe+vFG8eCUhOiUzPNjg5pg..G6lYCBAQPztz4CtiPktQbWGyFnxJMwwtazjG7xgbZOXI7UOCBkVrt4yQXAcg6Bvv..aRfS1EFmG/q51TYgqhmKM7H6tMUwwK1ChZOXgd+a5l0mMj7Ql1YGIlmk3SpZDJyB..1jRdY5ywiA5JL1EN8rpC2Poc08D2ET88eeGel1TolcS+QWCbgWELw8A8Weh2zYKZ..HJEVqq5fK1XGyQA1AhBJCAa2Uy1kAwIDAQABo4HaMIHXMB0GA1UdDgQWBBS4qC8I..EltnmHh2BRy/ylRl3qin/jCBpwYDVR0jBIGfMIGcgBS4qC8IEltnmHh2BRy/ylRl..3qin/qF5pHcwdTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlZ

C:\ProgramData\MPK\is-3LL6A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1179648
Entropy (8bit):	6.81374307872326
Encrypted:	false
SSDEEP:	24576:vMBQN+KpPoWxSkU6kzi9FObe+bDCvNpjvvj0poSZHMfHde:D9ntae+bDCvNxvj0poUMfHde
MD5:	8B043541FBB07831C731566DBC1175A9
SHA1:	3B8DCB6FDC48DBFDEC789BF8A7182487181D3AED
SHA-256:	08409174C3FFF9EB2D06F37802C7AD71C3B1C06A6FAF917AF9AB83A1BB7624D7
SHA-512:	E1F342DD39E2C7098DBADE5DFE8FAC1A2C2D030710A220792699CAA2F4900D34E50DAF9384414F3DE8B5210CB88BBA07CDD44A9D0407D813C14CA395F3781962
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........TE..5+.5+.5+.M..5+.M..5+.5*..5+.M..5+.5+.5+.M...7+.M..5+.M..5+.M..5+.Rich.5+.........PE..L...jk.T...........!.........................................................P.......................................b..f....X..................................`....................................V..@............................................text............................... ..`.rdata..............................@..@.data............^..................@....rsrc................\..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPK\is-5U9RI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1178880
Entropy (8bit):	6.409651886038298
Encrypted:	false
SSDEEP:	24576:J1VqyG3T/+ofiDIZE2kChYYmpY9a2nWEdEC6GnJJ3G7vxyxG:TQdhZgEN6GnJYb
MD5:	5ABA2917CE54882DFFA1635380313097
SHA1:	616D89410D1FF04B7D17E8EA65ADBF716A85D8E7
SHA-256:	6F3A8D6237EA49ECCA6A1CC979090FEF4F0FD96A42F09334D990C40875AC0045
SHA-512:	16F7CDF19802C53EBDDD76C8B1DAA876C58ED8AF9E67082199FC6ED5AA1179DA4AA12EF7207B2C1D0B6D7BC849ED2EA14430C396B20C967699F4D80948A6FB62
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......S..........................................@..............................................@...............................7..................................................................................t................................text............................... ..`.itext.. ........................... ..`.data...80.......2..................@....bss.....a...@...........................idata...7.......8..................@....tls....<............R...................rdata...............R..............@..@.rsrc................T..............@..@....................................@..@........................................................................................................................................

C:\ProgramData\MPK\is-7IT87.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1561344
Entropy (8bit):	6.486982389571691
Encrypted:	false
SSDEEP:	24576:qa3gEom5UYKRL1Rbggj1eVFBAS5lAvSciLyoMfO2EQ2G3FoUxW/Sk8oUEARW0NPV:qo5HKRfjGFCS3w3FzxW/SPoXsWMPwe
MD5:	1A902E39120A8CCAA56163B91601E63A
SHA1:	42E92AE948D8EC97005FC474C815B2C3EA0D5688
SHA-256:	321DB63396B88771EAEEB15B361FB533096ADDF122E709D84FEB089EE46DDBF9
SHA-512:	ABB774E547D506E6CD6D95B7111A4B7A50F9A20429D556DD8644F6B0740AB32BF8AB10C5A0A2CF294C6CB2DBFDB4F2B377A46848F4AFD05F6E2DF5C9902BA71B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\MPK\is-7IT87.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....T............................l(.......0....@..........................`.......H...........@...............................=.......^...................P..t............................@......................t...l.... ..^....................text............................... ..`.itext..x........................... ..`.data....N...0...P... ..............@....bss....4U...........p...................idata...=.......>...p..............@....didata.^.... ......................@....tls....@....0...........................rdata.......@......................@..@.reloc..t....P......................@..B.rsrc....^.......^...`..............@..@.............`......................@..@........................................................

C:\ProgramData\MPK\is-89R70.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1011200
Entropy (8bit):	1.5301191700885959
Encrypted:	false
SSDEEP:	768:uZCopPpPMKfwW+nAEF2xxDvgFwLDbSkRcbceITgkzokrkkkl0gJukgfkkkgrkhyl:i7GfbQP1UL7JxmrNdFFl
MD5:	6DE80C4A49E3688C26ABC6AB788FD4D4
SHA1:	4D1D52CA9CFDEF96B5C4907CEF07A82CF29E1697
SHA-256:	BC93208756401ECC4DE27AA3082C79425EF7491FC771CB2BDC0B7FBE9831E5E9
SHA-512:	06D57808C9784CB08835CBB90ECFDDF4F7B0794E916BEFA5A9DCE77BB0E2557E7C09FCD7C1E02D3F0168154604187C3005AA448968F764F2E1F0003DDB80873C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}?E...........#...8....j..............@....8b.................................}........ ..................................................................$...................................................................................text....(.......*..................`..`.data...P....@......................@....rdata.......`.......B..............@..@.bss.....(...p...........................edata...............D..............@..@.idata...............F..............@....reloc...$.......&...H..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPK\is-9EF5L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1168384
Entropy (8bit):	2.5375197488346086
Encrypted:	false
SSDEEP:	3072:w4ABLspLX5fr0Z2zvvSD2tP4gc8Q8g1I9RtuH8OrsT+qldWfF/eMw:we55YI7ti1QR4Wqqi
MD5:	8884A1C5DA2077CCD9D08C5D3DACF192
SHA1:	1813EE9EBB7FDAF7E79DD90F3E0FA36D043731F5
SHA-256:	6698808D9394C8267C019EEC458093CFBD8B3D5FDE517458091B603EE00C4345
SHA-512:	00AE8C5FCD5FB60AB22CBE1646F1903A9950EA0185CBDD3E00931E59B27FE62C6974BD87FDA6E4F8EDA8128B37A197AD435B99E3604004FA5E209DC56D476E9B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}?E...........#...8..........................c.........................P.......N........ .................................L............................ ..x)...................................................................................text...............................`..`.data...............................@....rdata..............................@..@.bss.... (...............................edata..............................@..@.idata..L...........................@....reloc..x)... .....................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPK\is-BV3PJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	6.043943242879702
Encrypted:	false
SSDEEP:	192:PJCQIHVlG655ksUBfPxW0gtsiZVu9OoQk6qS7lGidz78oVh7xXh2Kn1U0SC:PCz55ksUTW0vyVu9r6TQif5xRz6
MD5:	82BF92B15339F0DB75552B15DD1D1573
SHA1:	E80099B882E17AEE846BD6D28914F13561148E6E
SHA-256:	2B2A426D6691998755C42A108EB1A9AFD3F33DC3F1081FB63C31C15AC8A405E0
SHA-512:	D80A60A1AB6F257257E4ACB4439E73B1D46B8C8B27AB1C2900A389C13425D8C74D222D2706058EE3F06A8F3EA3B13F65A5BA61BA5C7BA88AA24DA64C791238F2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...}}?E...........#...8.&...:...............@.....f.......................................... ......................p...............................................................................................................................text....%.......&..................`..`.data...0....@.......*..............@....rdata.......P.......,..............@..@.bss.........`...........................edata.......p.......2..............@..@.idata...............:..............@....reloc...............<..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPK\is-EQREG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1848064
Entropy (8bit):	7.9914250784592245
Encrypted:	true
SSDEEP:	49152:hSWaDZti/jOiGYkHW2VQ8HXibJ8CVjeHGB:QWa1ti/KR2h8CEW
MD5:	1F88A27A865B8E6C69CCA354B9B68445
SHA1:	313A3547382C192DB10EC314A2030C706B9E734C
SHA-256:	DEA8CA52EBCFFC6962DE7B65F39392BDF806DB56563CE6A7941EE1E04C00B0BD
SHA-512:	F0B44AA925958E6F4413775C86DF4B5304601F8C65878A41FECD1FFEBE7504EA15E9E4AA4BE8F051EEDF76319E765A261B364B20F35B47CF3AC3C79FD2957B0E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 62%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......T.................$C..................@C...@..........................`].....0............@..........................\|.X.D.....S.......................................................X...............................................................B.........................@.................B..2..................@............@...@C.....................@.................D.....................@............`... M..J..................@.................M.....................@.................M.....................@.................M.....................@............P....M.....................@....rsrc.........S.....................@....data....@....X..<..................@....adata.......P].....................@...................

C:\ProgramData\MPK\is-GH6IU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73783
Entropy (8bit):	5.5930170320396355
Encrypted:	false
SSDEEP:	1536:6TNNA1f3D3JfzvQUzFz/ebA/nToIfjIOlIO+MeO:6UD3xzVzFjeuTBfFv+MeO
MD5:	99E402544E67C8B57BE64CAC89760F3F
SHA1:	67A0BF698C3A58F4B1A6E1F4C11165D494017BEF
SHA-256:	91CA3A9D557EA54BB7283C3DF0772F856F53F825C67AF22C59B973C31431C530
SHA-512:	F950D4030D541FD2767544883CDB8D10C01B4C34F85C318A020BD9BBFB5C4E15A2B1DC6EF5E0095F7C397EF798DB9A8F7B3B9CF9FBCC9F80C6766D1CAC989E1B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i..Z...Z...Z......X.......[...5..._...5...Y...Z...L....+..V.......[....(..[...RichZ...........................PE..L......E...........!................:........................................ ..........................................]... ...<...................................`...................................................X............................text............................... ..`.rdata...D.......P..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPK\is-H68I0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	696064
Entropy (8bit):	4.562266096083011
Encrypted:	false
SSDEEP:	6144:Ueyz3C7heuffqf6CANY/ja9DzNTxZKjJ1Btm0v2CfU+nlm/pBZBRM+6p+m:NheuffsiY/GyiCfU+nE/3yN
MD5:	5C601EEA1F8C0013F207CA53EB2E4166
SHA1:	4AEC386FAB7515FAC4ED523E2A92D0205E213691
SHA-256:	8AFB2EC5A4168F8782D5F54D282CFE1D41E91619C8BDEFEC8613747235CF84BC
SHA-512:	86769ABEA91A7B03E9B1B8982675A8B9804051A5127BD0F0A8C6EEF24510D17EF43D23A1D4A95E939758B5133E70F1268E3FEE88568D666F52CB69F8EEA008D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&..b...b...b...ER..f...ER..f...Rm.O...Rl.....Ro.k...k.%.c...k.1.s...b.......zm.s....zh.c....zk.c...b.5.c....zn.c...Richb...................PE..d...-..T.........." ................d ...............................................^....`............................................................. ....`..l-..................................................P...p...........0...P............................text...'........................... ..`.rdata..............................@..@.data...........~..................@....pdata...3...`...4..................@..@.idata...!......."...F..............@....rsrc... ............h..............@..@.reloc...............p..............@..B........................................................................................................................................................................................

C:\ProgramData\MPK\is-HFVOH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1570
Entropy (8bit):	5.88877406553654
Encrypted:	false
SSDEEP:	48:LrQgD1RE7dXrI+TsGyxMGRIDBfaqgxR6TgQg:LrBhRE7Vzy8fLgy1g
MD5:	50BDA2ED4D02DBD625FA425A3FCDEB44
SHA1:	434A39F59FC5207543227A6B2A215570BF2D5809
SHA-256:	1E00A7F619A596AC9C2DE6614297A2477D15D34E255BCF947150991C24EEE0A8
SHA-512:	6974F9D05E42EE4856FCD7617CE1C5459C396E903BAF2B7E5135A9C26446AC0B7284E4D1464AD35DE7546B67C19C852F0EAB546CCECBF0B89E2A3DB89B7DE703
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIESDCCAzCgAwIBAgIJAJNdu/QfCMXrMA0GCSqGSIb3DQEBBQUAMHUxCzAJBgNV..BAYTAlVTMQswCQYDVQQIEwJWQTETMBEGA1UEBxMKQWxleGFuZHJpYTESMBAGA1UE..ChMJUmVmb2cgSW5jMQ4wDAYDVQQDEwVSZWZvZzEgMB4GCSqGSIb3DQEJARYRc3Vw..cG9ydEByZWZvZy5jb20wHhcNMTAxMDI1MDY0NTUzWhcNMjAxMDIyMDY0NTUzWjB1..MQswCQYDVQQGEwJVUzELMAkGA1UECBMCVkExEzARBgNVBAcTCkFsZXhhbmRyaWEx..EjAQBgNVBAoTCVJlZm9nIEluYzEOMAwGA1UEAxMFUmVmb2cxIDAeBgkqhkiG9w0B..CQEWEXN1cHBvcnRAcmVmb2cuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB..CgKCAQEA6lQxNZ07MoOeC8Dkra2Zf9iNWnx2CwDpgfGrGOgbz+x94vEXZFmTMcxy..Y7NFgjHy5DBFcLEzVBc0LnwdRUt7KRNYdxHXIpaLveqe+vFG8eCUhOiUzPNjg5pg..G6lYCBAQPztz4CtiPktQbWGyFnxJMwwtazjG7xgbZOXI7UOCBkVrt4yQXAcg6Bvv..aRfS1EFmG/q51TYgqhmKM7H6tMUwwK1ChZOXgd+a5l0mMj7Ql1YGIlmk3SpZDJyB..1jRdY5ywiA5JL1EN8rpC2Poc08D2ET88eeGel1TolcS+QWCbgWELw8A8Weh2zYKZ..HJEVqq5fK1XGyQA1AhBJCAa2Uy1kAwIDAQABo4HaMIHXMB0GA1UdDgQWBBS4qC8I..EltnmHh2BRy/ylRl3qin/jCBpwYDVR0jBIGfMIGcgBS4qC8IEltnmHh2BRy/ylRl..3qin/qF5pHcwdTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlZ

C:\ProgramData\MPK\is-I4L15.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.097513538868524
Encrypted:	false
SSDEEP:	384:TxUeOg43wV5Cqu7S4doKlc+LjRHeAU8mDagMSHY2bvHlqwbLl:Mg4W5CqG9oKlc+XxmDaJSbvHlqw
MD5:	5275F0437F319FCB0F396D40661D484C
SHA1:	6D98740F53C92D3650DD4CEC17E7ACA2C0E285C5
SHA-256:	01B3443E049B5E642A994F1549A99D3B64A3E41B75FA7062DDDF7E19BC9AA7C1
SHA-512:	968AA18FCFB51CC542714AED111585E2D7F42AB976ED3964F68A983401FD95FFE7592573FFA792E01138D6D8F918E4DE6F8C1BC45E2E01C7E46921B706926ADA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}?E...........#...8.J...\...............`....Ho.................................A........ .........................\............................................................................................................................text...dH.......J..................`..`.data...0....`.......N..............@....rdata.......p.......P..............@..@.bss.....................................edata..\............R..............@..@.idata...............V..............@....reloc...............^..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPK\is-JS61I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	600868
Entropy (8bit):	6.494077241753678
Encrypted:	false
SSDEEP:	12288:Sl3jNMFx7sFGtojgKNLe8GQ9g2CKyw3WUbgvKnjAcHoU:SlZU7sFGtOgKNLedQxAibnfHoU
MD5:	2C7B219CD45E962C49B1834083C75183
SHA1:	053BBBFA1250BAADD702CA3A9823552E1ED13D4D
SHA-256:	D1CBB5835A4B94417501F59F179A235A02F1D64ED780FA51B5D6A39A5F565C59
SHA-512:	132B518289358124329B3523CE561DFC23A2445D8360835F65303E11D774341B6996A29BFF8D649806A1AE579C071761BC6FB19A70C677FF68085BD6BE81DCF1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....mP...........!.....@...B......X........P.....`................................A......... ...................... ..<....@...............................p...$...........................`.......................A..d............................text....>.......@..................`.0`.data...<....P.......F..............@.0..rdata..t....`.......V..............@.@@.bss..................................@..edata..<.... ......................@.0@.idata.......@......................@.0..CRT.........P......................@.0..tls.... ....`....... ..............@.0..reloc...$...p...&..."..............@.0B/4......`............H..............@.@B/19..................J..............@..B/35.....M............N..............@..B/51......C.......D...V..............@..B/63.......... ......................@..B/77..........0......................@..B/89..........@..........

C:\ProgramData\MPK\is-LNEHG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.21126073643228
Encrypted:	false
SSDEEP:	3:Mz2KpWYrAXDyn:fGIDy
MD5:	82B80F9814765D2D613754DBA009715C
SHA1:	A15301821214B8DED9FD43BF124DAE509F2E51D5
SHA-256:	E6E979A873ED54A1DF6A33C09997D57A98BB994776F1DEB68EEE47E78D6EBA07
SHA-512:	24708FA14DF8518CDA8A92BF8D07DC63A69E9897A356696EFF3BCBD8FDAF7962D48AB40F07EDFEE45E3F93F3497294D0F057BFAC9D73DED894D8C3E5D300BA95
Malicious:	false
Preview:	[MyVersion]..Value=NetTrial..

C:\ProgramData\MPK\is-M13BC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79616
Entropy (8bit):	5.538620798160883
Encrypted:	false
SSDEEP:	1536:+6T4xQ1x132X9ba2EDww/VJdVKN8G8sWhmqsd4WlWTLyfYHh:rTwQ1xJ2X9bTEDwwdRgz4WALn
MD5:	4F4CC7256A1D6B7E8782CDEDDA4279EF
SHA1:	2BAB6C2877C0EA259FE42A7429930E5DB90432EF
SHA-256:	F35958CDF631ECEBF6E850C8485F8B18E9BFD2EC060C4AEB7C378ACBA694AE8B
SHA-512:	B7D58030CCBE928B5C8D3698D45C9E3691C04CA284FCC13D6C6F09724467163BE9569471DAFCC932D567FA077ABCAA087ACBCE52E7DFD986690730510E3F179C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... ..NZ.NZ.NZ.h5Z.NZ.h.Z..NZ.h.Z..NZ.h.Z.NZ...Z.NZ.OZ..NZ.@.Z.NZ.@.Z.NZ..Z.NZ.@.Z.NZRich.NZ................PE..d...3..T.........."......\|..........0..........@..........................................`.................................................l...P....`..p....P.......".......p..4.......................................p............................................text....z.......\|.................. ..`.rdata..>e.......f..................@..@.data....E....... ..................@....pdata.......P......................@..@.rsrc...p....`......................@..@.reloc..`....p......................@..B........................................................................................................................................................................................................................................................

C:\ProgramData\MPK\is-NK5I1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	333056
Entropy (8bit):	4.260070328190628
Encrypted:	false
SSDEEP:	3072:FsqQ2Sv1itXCgDrr45t/oPkekfCMvJMdKmJk82y:Fu2Svozv45erkliBJkRy
MD5:	70223C7999C6847DD78239415E6185B3
SHA1:	E3B692BF56661F91436E8711E6E3762A3CD24571
SHA-256:	80001E9B4054E26B7F9DC01DEC4AD28DD15806430F52F095E9833EE7CBBAB4DF
SHA-512:	DE6D235B3F4074729CEFDD4D05F39A2C82563C04A949AF393DCB5E6916793FCA2FD6CC3B336C17206F9038FD4528E0C8CF2601539C1ED0F353F22C956AE637E1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.!.9.O.9.O.9.O..N4.;.O..N....O..N..7.O..N..U.O..N!.8.O.9.N.G.O.....2.O._f..2.O._f..8.O._f..8.O.9...8.O._f..8.O.Rich9.O.........PE..L......T...........!.........h...............................................P......T.....@.........................0Y..i....P..P.......p.......................\|!...................................G..@...............x............................text............................... ..`.rdata..............................@..@.data........`...n...D..............@....rsrc...p...........................@..@.reloc...H.......J..................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPK\is-RJO8C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	629504
Entropy (8bit):	4.886934785875236
Encrypted:	false
SSDEEP:	6144:elEenOB3t7nPQBgyD7IjOHKEZa7Y1qqZbUn3JxDxqTJNOI:93t7ZyD7iOHKEZF1xZbc3EOI
MD5:	CCCC6EE4E855BB19581AB7CB61A86055
SHA1:	D67E92E3AD3B7AF42FBEAB2A98647B3894B4658A
SHA-256:	B21437682A17616CEE9BDC7034A3FE45679AFC69A810BB9FFAAFB6B4BDFDBAAB
SHA-512:	9709F878CE2D1F2F80BC26D5D03C18C0072821750A1FCF6FE1C1C115073E4277F2B6759FF83E8FC2A967A3C260E7AEBE1BF3E9B3043C75C768A4804DB6054D91
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{$VQ?E8.?E8.?E8.....E8....0E8....QE8...U.:E8...C.;E8.6=...E8.?E9..E8.Y....E8.Y...>E8.Y...>E8.?E..>E8.Y...>E8.Rich?E8.........PE..L......T...........!................l!...............................................a....@..................................p.......... ........................:..................................0...@............u...............................text...o........................... ..`.rdata...O.......P..................@..@.data... 3...0......................@....idata..J....p......................@....rsrc... ............8..............@..@.reloc..:D.......F...@..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\MPK\is-SUMV4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	274432
Entropy (8bit):	6.427766656548579
Encrypted:	false
SSDEEP:	6144:JWXcqYW1jPqoSvWn5ytmZlOWegx8Wf22r8c4zQmrGl60ulz/Y+x89hQkBu2lre+z:JcYW17qoSvWnctmZlOZguWf2s8c4zQmK
MD5:	39068A91D3CFA868182AD8C4FE8CE12C
SHA1:	C1BC62EAE8C597C13AD458551414352EA03AF217
SHA-256:	0269ADA04B83DB3F2A5425BE2C1B0CF32BE682EA9AF0EE915F2D46E8059C4B4E
SHA-512:	EB406486A54389F2339C5209E830CA7488657146AF1D9DA3D532D238EFB45C2E4F8B830C2BDDE1D9E6C754086C572F99AD1EC79AF1E70AC85D664935FAC6223E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........OE.z.E.z.E.z.L...F.z.L...G.z.L...B.z.E.{...z.L...{.z.L...D.z.L...D.z.L...D.z.RichE.z.........................PE..L...zk.T...........!.................#.......0...............................p......R..................................p$..l...P....0.......................@...#..@6..............................P...@............0.. ............................text............................... ..`.rdata..`....0......................@..@.data....1.......0..................@....rsrc........0......................@..@.reloc...$...@...&..................@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPK\is-URL53.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1499392
Entropy (8bit):	6.499259379210101
Encrypted:	false
SSDEEP:	24576:+YkHGqHO6pTADZVmH28IcBOSteCjRdNakuxHgb26nhr/xJ/r92OFvprq+:+LHxdQZQocISvRDxJ/r92oprq+
MD5:	20BC08D7652B652811DF5F403C9C6DFA
SHA1:	2DAF670A0909F40738849F1420A28E2ECC499C43
SHA-256:	DCD6A7649342DEA92532F866BA85E545974F05E9D2F5D70DC7CFD66CBB50A3E5
SHA-512:	F4720499EF89331E34EDCD3516376C25CA3E83C457B87C313D7A2826A4C30EB956E4563A9290C62A0A274272F8D65041D3D4FBDB7CCF07228ADF1A994341A643
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\MPK\is-URL53.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 40%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....T.................D..........(W.......`....@..............................................@..............................L;... ...Z..................................................p...............................P..^....................text....#.......$.................. ..`.itext.......@... ...(.............. ..`.data...TM...`...N...H..............@....bss.....T...............................idata..L;.......<..................@....didata.^....P......................@....tls....@....`...........................rdata.......p......................@..@.reloc.............................@..B.rsrc....Z... ...Z...r..............@..@....................................@..@........................................................

C:\ProgramData\MPK\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1179648
Entropy (8bit):	6.81374307872326
Encrypted:	false
SSDEEP:	24576:vMBQN+KpPoWxSkU6kzi9FObe+bDCvNpjvvj0poSZHMfHde:D9ntae+bDCvNxvj0poUMfHde
MD5:	8B043541FBB07831C731566DBC1175A9
SHA1:	3B8DCB6FDC48DBFDEC789BF8A7182487181D3AED
SHA-256:	08409174C3FFF9EB2D06F37802C7AD71C3B1C06A6FAF917AF9AB83A1BB7624D7
SHA-512:	E1F342DD39E2C7098DBADE5DFE8FAC1A2C2D030710A220792699CAA2F4900D34E50DAF9384414F3DE8B5210CB88BBA07CDD44A9D0407D813C14CA395F3781962
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........TE..5+.5+.5+.M..5+.M..5+.5*..5+.M..5+.5+.5+.M...7+.M..5+.M..5+.M..5+.Rich.5+.........PE..L...jk.T...........!.........................................................P.......................................b..f....X..................................`....................................V..@............................................text............................... ..`.rdata..............................@..@.data............^..................@....rsrc................\..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPK\lsynchost.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1561344
Entropy (8bit):	6.486982389571691
Encrypted:	false
SSDEEP:	24576:qa3gEom5UYKRL1Rbggj1eVFBAS5lAvSciLyoMfO2EQ2G3FoUxW/Sk8oUEARW0NPV:qo5HKRfjGFCS3w3FzxW/SPoXsWMPwe
MD5:	1A902E39120A8CCAA56163B91601E63A
SHA1:	42E92AE948D8EC97005FC474C815B2C3EA0D5688
SHA-256:	321DB63396B88771EAEEB15B361FB533096ADDF122E709D84FEB089EE46DDBF9
SHA-512:	ABB774E547D506E6CD6D95B7111A4B7A50F9A20429D556DD8644F6B0740AB32BF8AB10C5A0A2CF294C6CB2DBFDB4F2B377A46848F4AFD05F6E2DF5C9902BA71B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....T............................l(.......0....@..........................`.......H...........@...............................=.......^...................P..t............................@......................t...l.... ..^....................text............................... ..`.itext..x........................... ..`.data....N...0...P... ..............@....bss....4U...........p...................idata...=.......>...p..............@....didata.^.... ......................@....tls....@....0...........................rdata.......@......................@..@.reloc..t....P......................@..B.rsrc....^.......^...`..............@..@.............`......................@..@........................................................

C:\ProgramData\MPK\mpk_em_log.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9359
Entropy (8bit):	5.0596151713658815
Encrypted:	false
SSDEEP:	96:Kd7K+ikYvqp++7it7nXr6N2WxJhr/lZpySLlpnZelwJlcZdldO:crS+7o7uJ6O
MD5:	6870A4C488A0D93BB2C124A88C16DB09
SHA1:	04D3966F25049D2E7765914C26BBA8F0F1804F58
SHA-256:	D76E627E7F11D8C40704BE88BB1A7F8DEA778BF5ABECEBDB1999E29C35EF665E
SHA-512:	80FE38F0C17729495539502306F441609DC0D782D5F721618DFB3BC9E38513A9DCF03307EF680325F8507BCD270DFAFD13E614C0563DC1B687225C7FCB753220
Malicious:	false
Preview:	.2024-10-31 17:10:15.211 Log opened. (Time zone: UTC-04:00)..2024-10-31 17:10:15.211 Setup version: Inno Setup version 5.5.5 (u)..2024-10-31 17:10:15.211 Original Setup EXE: C:\ProgramData\MPK\mpk_emni_mpk.exe..2024-10-31 17:10:15.211 Setup command line: /SL5="$3049C,4852295,119296,C:\ProgramData\MPK\mpk_emni_mpk.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SDIR "C:\Users\user\Desktop\" /LOG="C:\ProgramData\MPK\mpk_em_log.txt"..2024-10-31 17:10:15.211 Windows version: 6.3.9600 (NT platform: Yes)..2024-10-31 17:10:15.211 64-bit Windows: Yes..2024-10-31 17:10:15.211 Processor architecture: x64..2024-10-31 17:10:15.211 User privileges: Administrative..2024-10-31 17:10:15.227 64-bit install mode: Yes..2024-10-31 17:10:15.258 Created temporary directory: C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp..2024-10-31 17:10:15.352 MsiSourceDir: C:\Users\user\Desktop\..2024-10-31 17:10:16.789 Starting the installation process...2024-10-31 17:10:16.805 Setting pe

C:\ProgramData\MPK\mpk_emni_mpk.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5283576
Entropy (8bit):	7.993505483500863
Encrypted:	true
SSDEEP:	98304:AuV6aAZbtixCzn8cF8sl2BahFXXTNp9YTAtJBTNONA:zV6ashiSn8m8s5hFXXTJLJpX
MD5:	E67464707F7D14131BEDE9DB845A6A0A
SHA1:	CBC9A7F4D1F71EEC44C4141FE6A778765C1C4EA8
SHA-256:	4400A5B51971786396302AE21A0A4BA9BB55B787977E5D7BD363AF8D67F5DC1E
SHA-512:	3237678854EB1D00A2E0FFD83A0CDB8F41620C25F842F5C12DCF5DBF7073C143E0FE3A8B283FDD28B41571D5D0215268FC84B946CC3A344300427A63D9AAF213
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 52%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......S..................................... ....@.................................T.Q..........@....................................................P..............................................................................................text...,........................... ..`.itext..D........................... ..`.data........ ......................@....bss.....V...0...........................idata..............................@....tls.....................................rdata..............................@..@.rsrc................ ..............@..@....................................@..@........................................................................................................................................

C:\ProgramData\MPK\ogg.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	6.043943242879702
Encrypted:	false
SSDEEP:	192:PJCQIHVlG655ksUBfPxW0gtsiZVu9OoQk6qS7lGidz78oVh7xXh2Kn1U0SC:PCz55ksUTW0vyVu9r6TQif5xRz6
MD5:	82BF92B15339F0DB75552B15DD1D1573
SHA1:	E80099B882E17AEE846BD6D28914F13561148E6E
SHA-256:	2B2A426D6691998755C42A108EB1A9AFD3F33DC3F1081FB63C31C15AC8A405E0
SHA-512:	D80A60A1AB6F257257E4ACB4439E73B1D46B8C8B27AB1C2900A389C13425D8C74D222D2706058EE3F06A8F3EA3B13F65A5BA61BA5C7BA88AA24DA64C791238F2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...}}?E...........#...8.&...:...............@.....f.......................................... ......................p...............................................................................................................................text....%.......&..................`..`.data...0....@.......*..............@....rdata.......P.......,..............@..@.bss.........`...........................edata.......p.......2..............@..@.idata...............:..............@....reloc...............<..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPK\sqlite3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	600868
Entropy (8bit):	6.494077241753678
Encrypted:	false
SSDEEP:	12288:Sl3jNMFx7sFGtojgKNLe8GQ9g2CKyw3WUbgvKnjAcHoU:SlZU7sFGtOgKNLedQxAibnfHoU
MD5:	2C7B219CD45E962C49B1834083C75183
SHA1:	053BBBFA1250BAADD702CA3A9823552E1ED13D4D
SHA-256:	D1CBB5835A4B94417501F59F179A235A02F1D64ED780FA51B5D6A39A5F565C59
SHA-512:	132B518289358124329B3523CE561DFC23A2445D8360835F65303E11D774341B6996A29BFF8D649806A1AE579C071761BC6FB19A70C677FF68085BD6BE81DCF1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....mP...........!.....@...B......X........P.....`................................A......... ...................... ..<....@...............................p...$...........................`.......................A..d............................text....>.......@..................`.0`.data...<....P.......F..............@.0..rdata..t....`.......V..............@.@@.bss..................................@..edata..<.... ......................@.0@.idata.......@......................@.0..CRT.........P......................@.0..tls.... ....`....... ..............@.0..reloc...$...p...&..."..............@.0B/4......`............H..............@.@B/19..................J..............@..B/35.....M............N..............@..B/51......C.......D...V..............@..B/63.......... ......................@..B/77..........0......................@..B/89..........@..........

C:\ProgramData\MPK\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	274432
Entropy (8bit):	6.427766656548579
Encrypted:	false
SSDEEP:	6144:JWXcqYW1jPqoSvWn5ytmZlOWegx8Wf22r8c4zQmrGl60ulz/Y+x89hQkBu2lre+z:JcYW17qoSvWnctmZlOZguWf2s8c4zQmK
MD5:	39068A91D3CFA868182AD8C4FE8CE12C
SHA1:	C1BC62EAE8C597C13AD458551414352EA03AF217
SHA-256:	0269ADA04B83DB3F2A5425BE2C1B0CF32BE682EA9AF0EE915F2D46E8059C4B4E
SHA-512:	EB406486A54389F2339C5209E830CA7488657146AF1D9DA3D532D238EFB45C2E4F8B830C2BDDE1D9E6C754086C572F99AD1EC79AF1E70AC85D664935FAC6223E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........OE.z.E.z.E.z.L...F.z.L...G.z.L...B.z.E.{...z.L...{.z.L...D.z.L...D.z.L...D.z.RichE.z.........................PE..L...zk.T...........!.................#.......0...............................p......R..................................p$..l...P....0.......................@...#..@6..............................P...@............0.. ............................text............................... ..`.rdata..`....0......................@..@.data....1.......0..................@....rsrc........0......................@..@.reloc...$...@...&..................@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPK\trial_net.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.21126073643228
Encrypted:	false
SSDEEP:	3:Mz2KpWYrAXDyn:fGIDy
MD5:	82B80F9814765D2D613754DBA009715C
SHA1:	A15301821214B8DED9FD43BF124DAE509F2E51D5
SHA-256:	E6E979A873ED54A1DF6A33C09997D57A98BB994776F1DEB68EEE47E78D6EBA07
SHA-512:	24708FA14DF8518CDA8A92BF8D07DC63A69E9897A356696EFF3BCBD8FDAF7962D48AB40F07EDFEE45E3F93F3497294D0F057BFAC9D73DED894D8C3E5D300BA95
Malicious:	false
Preview:	[MyVersion]..Value=NetTrial..

C:\ProgramData\MPK\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	InnoSetup Log 64-bit Employee Monitor, version 0x418, 36285 bytes, 783875\37\SYSTEM\37, C:\ProgramData\MPK\376\377\377\007 \0
Category:	dropped
Size (bytes):	36285
Entropy (8bit):	4.417772789796529
Encrypted:	false
SSDEEP:	384:jQqhpAx46Tcn9MvqglOODbKK2EBiVZAXD5hfLgUlBnLOUC3nQkXSD+Bjcn/6euCj:jQd46TcXKD+BA/6ejK2Xol9jk3
MD5:	83273B2C75D88CB6D8CC3601C4509505
SHA1:	E3ADDBDB729A8A1D044B846CF513FC0BC465310C
SHA-256:	877743215CB09DD59EB493A488F16DBDED770E19E1D3E093B3E16EE205950966
SHA-512:	3D59765EE7B69FDA0E11B76A1188DA976B096231FE1B79DAAF19DEFE3BC683D0AE6C9E1FD033FE7DB31D7AA37446782994B0F456A5D683ABC62D3613EA3CA157
Malicious:	false
Preview:	Inno Setup Uninstall Log (b) 64-bit.............................CC40ED25-0373-4738-ACE2-010FD31A20A4............................................................................................Employee Monitor............................................................................................................................%............................................................................................................................b.5......a........7.8.3.8.7.5......S.Y.S.T.E.M......C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.P.K....................... .............IFPS....+...]...........................................................................................................................................................BOOLEAN..............TEXECWAIT.........TSTRINGLIST....TSTRINGLIST.....................TFILETIME.................................................TFINDREC.............!OPENARRAYOFCONST...............................................#.......TGUID........

C:\ProgramData\MPK\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1178880
Entropy (8bit):	6.409651886038298
Encrypted:	false
SSDEEP:	24576:J1VqyG3T/+ofiDIZE2kChYYmpY9a2nWEdEC6GnJJ3G7vxyxG:TQdhZgEN6GnJYb
MD5:	5ABA2917CE54882DFFA1635380313097
SHA1:	616D89410D1FF04B7D17E8EA65ADBF716A85D8E7
SHA-256:	6F3A8D6237EA49ECCA6A1CC979090FEF4F0FD96A42F09334D990C40875AC0045
SHA-512:	16F7CDF19802C53EBDDD76C8B1DAA876C58ED8AF9E67082199FC6ED5AA1179DA4AA12EF7207B2C1D0B6D7BC849ED2EA14430C396B20C967699F4D80948A6FB62
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......S..........................................@..............................................@...............................7..................................................................................t................................text............................... ..`.itext.. ........................... ..`.data...80.......2..................@....bss.....a...@...........................idata...7.......8..................@....tls....<............R...................rdata...............R..............@..@.rsrc................T..............@..@....................................@..@........................................................................................................................................

C:\ProgramData\MPK\unins000.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	InnoSetup messages, version 5.5.3, 221 messages (UTF-16), &\036 ?@>3@0<<5...
Category:	dropped
Size (bytes):	24019
Entropy (8bit):	4.039586018574892
Encrypted:	false
SSDEEP:	192:QHt1Nsp47I7QchuW15U7f8l0nemL5lm1S4wIqhHh9lQtlyIq+SOqyNqwkrTRoCUi:QN1Nsp8b6KPntwdwzBHQSOq1dhecR5
MD5:	55977FF14B7755F6CB73867223818C3C
SHA1:	9FA757B514943431E5C44EAA4815ED027F9632CB
SHA-256:	1F958F5F1DFA7597719532F1193D872E8C5493C7F7B9D266D4C816391D27D7A3
SHA-512:	B2220D3FC50E52D98917CFDFD9249C2088D623E3CD7F312D2E2A8CBECF8AF4543685F1CEE5C3A8267FD30565EBC2370D7B47C640A594CF51E5EB4EEC6D616232
Malicious:	false
Preview:	Inno Setup Messages (5.5.3) (u)......................................]..y....2.=&... .?.@.>.3.@.0.<.<.5.........%.1.,. .2.5.@.A.8.O. .%.2.....%.3.........!.0.9.B. .%.1.:.....%.4....... .?.@.>.3.@.0.<.<.5...'.B.>.1.K. .C.A.B.0.=.>.2.8.B.L. .4.0.=.=.C.N. .?.@.>.3.@.0.<.<.C.,. ...K. .4.>.;.6.=.K. .2.K.?.>.;.=.8.B.L. .2.E.>.4. .2. .A.8.A.B.5.<.C. .:.0.:. ...4.<.8.=.8.A.B.@.0.B.>.@.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.c.o.m.m.e.n.d.e.d. .t.h.a.t. .y.o.u. .a.l.l.o.w. .S.e.t.u.p. .t.o. .a.u.t.o.m.a.t.i.c.a.l.l.y. .c.l.o.s.e. .t.h.e.s.e. .a.p.p.l.i.c.a.t.i.o.n.s.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.c.o.m.m.e.n.d.e.d. .t.h.a.t. .y.o.u. .a.l.l.o.w. .S.e.t.u.p. .t.o. .a.u.t.o.m.a.t.i.c.a.l.l.y. .c.l.o.s.e. .t.h.e.s.e. .a.p.p.l.

C:\ProgramData\MPK\vorbisenc.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1011200
Entropy (8bit):	1.5301191700885959
Encrypted:	false
SSDEEP:	768:uZCopPpPMKfwW+nAEF2xxDvgFwLDbSkRcbceITgkzokrkkkl0gJukgfkkkgrkhyl:i7GfbQP1UL7JxmrNdFFl
MD5:	6DE80C4A49E3688C26ABC6AB788FD4D4
SHA1:	4D1D52CA9CFDEF96B5C4907CEF07A82CF29E1697
SHA-256:	BC93208756401ECC4DE27AA3082C79425EF7491FC771CB2BDC0B7FBE9831E5E9
SHA-512:	06D57808C9784CB08835CBB90ECFDDF4F7B0794E916BEFA5A9DCE77BB0E2557E7C09FCD7C1E02D3F0168154604187C3005AA448968F764F2E1F0003DDB80873C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}?E...........#...8....j..............@....8b.................................}........ ..................................................................$...................................................................................text....(.......*..................`..`.data...P....@......................@....rdata.......`.......B..............@..@.bss.....(...p...........................edata...............D..............@..@.idata...............F..............@....reloc...$.......&...H..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPK\vorbisfile.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.097513538868524
Encrypted:	false
SSDEEP:	384:TxUeOg43wV5Cqu7S4doKlc+LjRHeAU8mDagMSHY2bvHlqwbLl:Mg4W5CqG9oKlc+XxmDaJSbvHlqw
MD5:	5275F0437F319FCB0F396D40661D484C
SHA1:	6D98740F53C92D3650DD4CEC17E7ACA2C0E285C5
SHA-256:	01B3443E049B5E642A994F1549A99D3B64A3E41B75FA7062DDDF7E19BC9AA7C1
SHA-512:	968AA18FCFB51CC542714AED111585E2D7F42AB976ED3964F68A983401FD95FFE7592573FFA792E01138D6D8F918E4DE6F8C1BC45E2E01C7E46921B706926ADA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}?E...........#...8.J...\...............`....Ho.................................A........ .........................\............................................................................................................................text...dH.......J..................`..`.data...0....`.......N..............@....rdata.......p.......P..............@..@.bss.....................................edata..\............R..............@..@.idata...............V..............@....reloc...............^..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPK\zlib1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73783
Entropy (8bit):	5.5930170320396355
Encrypted:	false
SSDEEP:	1536:6TNNA1f3D3JfzvQUzFz/ebA/nToIfjIOlIO+MeO:6UD3xzVzFjeuTBfFv+MeO
MD5:	99E402544E67C8B57BE64CAC89760F3F
SHA1:	67A0BF698C3A58F4B1A6E1F4C11165D494017BEF
SHA-256:	91CA3A9D557EA54BB7283C3DF0772F856F53F825C67AF22C59B973C31431C530
SHA-512:	F950D4030D541FD2767544883CDB8D10C01B4C34F85C318A020BD9BBFB5C4E15A2B1DC6EF5E0095F7C397EF798DB9A8F7B3B9CF9FBCC9F80C6766D1CAC989E1B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i..Z...Z...Z......X.......[...5..._...5...Y...Z...L....+..V.......[....(..[...RichZ...........................PE..L......E...........!................:........................................ ..........................................]... ...<...................................`...................................................X............................text............................... ..`.rdata...D.......P..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp

Download File

Process:	C:\ProgramData\MPK\mpk_emni_mpk.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1178880
Entropy (8bit):	6.409651886038298
Encrypted:	false
SSDEEP:	24576:J1VqyG3T/+ofiDIZE2kChYYmpY9a2nWEdEC6GnJJ3G7vxyxG:TQdhZgEN6GnJYb
MD5:	5ABA2917CE54882DFFA1635380313097
SHA1:	616D89410D1FF04B7D17E8EA65ADBF716A85D8E7
SHA-256:	6F3A8D6237EA49ECCA6A1CC979090FEF4F0FD96A42F09334D990C40875AC0045
SHA-512:	16F7CDF19802C53EBDDD76C8B1DAA876C58ED8AF9E67082199FC6ED5AA1179DA4AA12EF7207B2C1D0B6D7BC849ED2EA14430C396B20C967699F4D80948A6FB62
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......S..........................................@..............................................@...............................7..................................................................................t................................text............................... ..`.itext.. ........................... ..`.data...80.......2..................@....bss.....a...@...........................idata...7.......8..................@....tls....<............R...................rdata...............R..............@..@.rsrc................T..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.745960477552938
Encrypted:	false
SSDEEP:	384:BXvhMwoSitz/bjx7yxnbdn+EHvbsHoOODCg:BZ7FEAbd+EDsIO
MD5:	A813D18268AFFD4763DDE940246DC7E5
SHA1:	C7366E1FD925C17CC6068001BD38EAEF5B42852F
SHA-256:	E19781AABE466DD8779CB9C8FA41BBB73375447066BB34E876CF388A6ED63C64
SHA-512:	B310ED4CD2E94381C00A6A370FCB7CC867EBE425D705B69CAAAAFFDAFBAB91F72D357966916053E72E68ECF712F2AF7585500C58BB53EC3E1D539179FCB45FB4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I...(...(...(..n ..(...(...(...$..(...$..(...$..(..Rich.(..................PE..L......B...........!..... ..........p........0....P..........................P.......................................;.......;..(............................@.......0...............................................0...............................text............ .................. ..`.rdata.......0.......$..............@..@.reloc.......@.......2..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.363359036723334
Encrypted:	false
SSDEEP:	48:SvrzfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2piSS4k+bkg6j0KHc:+fkcXegaJ/ZAYNzcld1xaX12pTSKvkc
MD5:	526426126AE5D326D0A24706C77D8C5C
SHA1:	68BAEC323767C122F74A269D3AA6D49EB26903DB
SHA-256:	B20A8D88C550981137ED831F2015F5F11517AEB649C29642D9D61DEA5EBC37D1
SHA-512:	A2D824FB08BF0B2B2CC0B5E4AF8B13D5BC752EA0D195C6D40FD72AEC05360A3569EADE1749BDAC81CFB075112D0D3CD030D40F629DAF7ABCC243F9D8DCA8BFBE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\4e7f65.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: MPK_EM, Author: Mipko, Keywords: Installer, Comments: This installer database contains the logic and data required to install MPK_EM., Template: Intel;1033, Revision Number: {13B3FD70-0ECC-42BA-8BCE-4711A2312FB6}, Create Time/Date: Wed Feb 18 13:48:52 2015, Last Saved Time/Date: Wed Feb 18 13:48:52 2015, Number of Pages: 300, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1224.0), Security: 2
Category:	dropped
Size (bytes):	5255168
Entropy (8bit):	7.9965012572516505
Encrypted:	true
SSDEEP:	98304:Bzo9xMVVnii6a2A125eRsbcTP1o1y7klqJ1p9cOSJci3IOI:xo9xUhiBAI5eyob1o1ywwJBaJcA
MD5:	F2F3A908A18EF6B45B50E1105326B833
SHA1:	D01C20894CFF8EFA96E3394FCB54A8F4CEA0F764
SHA-256:	EF896DF89C6088517C117552424E932D590EBD483DECC3C9F444A18CE88179FD
SHA-512:	99749B7C3AA1EE2DA0A63BE57027BE364E513792D1B048D95A22C97ED4FE031D6ECE28B5C417171E49CB9A63880B570B0F34358A19AC28C3B67C1AB1ECCAF9F7
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\4e7f67.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: MPK_EM, Author: Mipko, Keywords: Installer, Comments: This installer database contains the logic and data required to install MPK_EM., Template: Intel;1033, Revision Number: {13B3FD70-0ECC-42BA-8BCE-4711A2312FB6}, Create Time/Date: Wed Feb 18 13:48:52 2015, Last Saved Time/Date: Wed Feb 18 13:48:52 2015, Number of Pages: 300, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1224.0), Security: 2
Category:	dropped
Size (bytes):	5255168
Entropy (8bit):	7.9965012572516505
Encrypted:	true
SSDEEP:	98304:Bzo9xMVVnii6a2A125eRsbcTP1o1y7klqJ1p9cOSJci3IOI:xo9xUhiBAI5eyob1o1ywwJBaJcA
MD5:	F2F3A908A18EF6B45B50E1105326B833
SHA1:	D01C20894CFF8EFA96E3394FCB54A8F4CEA0F764
SHA-256:	EF896DF89C6088517C117552424E932D590EBD483DECC3C9F444A18CE88179FD
SHA-512:	99749B7C3AA1EE2DA0A63BE57027BE364E513792D1B048D95A22C97ED4FE031D6ECE28B5C417171E49CB9A63880B570B0F34358A19AC28C3B67C1AB1ECCAF9F7
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI83EA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	2041
Entropy (8bit):	5.7468830592310445
Encrypted:	false
SSDEEP:	48:TGQ6a3Bb6pP3P1EvZeUjPnidEaEVltmQrlade2vto:TV5Z6pmewidEaEP7r88KO
MD5:	DB78D485FA5C377FFDF2E829187FCF7A
SHA1:	EB15A00CFB4928C7C12062DB92E53C6DB9C6E56F
SHA-256:	E08111814D70262ACD685A073EFCD0CFE0800390386DFBE406BB110E7792637F
SHA-512:	352847CB20E5B3BEDF4701BEF73E19F176C738D67BEF1E9D58371585DDD8AD1E451CA69D090EA5E4AF8EA881877BEE3569357DC37FFFB0A569580ABBE3936DA7
Malicious:	false
Preview:	...@IXOS.@.....@G._Y.@.....@.....@.....@.....@.....@......&.{9EBEE94E-B80E-4DDF-961B-A35BE6877C22}..MPK_EM..1944b321.msi.@.....@.....@.....@........&.{13B3FD70-0ECC-42BA-8BCE-4711A2312FB6}.....@.....@.....@.....@.......@.....@.....@.......@......MPK_EM......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{F9FFC604-2CE5-4252-B031-34223392D3E4}..C:\ProgramData\.@.......@.....@.....@......&.{2BE243B0-33A6-4A41-B727-70254936D3E0}#.C:\ProgramData\MPK\mpk_emni_mpk.exe.@.......@.....@.....@........CreateFolders..Creating folders..Folder: [1]"...C:\ProgramData\.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]...@..P..@.....@........C:\ProgramData\MPK\....1\MPK\......Please insert the disk: ..mipko_em.cab.@.....@......C:\Windows\Installer\4e7f65.msi.........@........ffuny7wq.exe\|mpk_emni_mpk.exe..mpk_emni_mpk.exe..mpk_emni_mpk.exe.

C:\Windows\Installer\SourceHash{9EBEE94E-B80E-4DDF-961B-A35BE6877C22}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1642939435942166
Encrypted:	false
SSDEEP:	12:JSbX72FjhQAGiLIlHVRpfh/7777777777777777777777777vDHFZostpwl0i8Q:JfQQI5bUEF
MD5:	294992128D559E93033E385DE21089FC
SHA1:	5EF417C0E8DBF566772CCC8CE190AFC06BCEA399
SHA-256:	653FCA8AA540F0F5B56740947BD4B31138EA2B055012A66326B9E01048F05D12
SHA-512:	8069B9E9F24A824CD8B37749C6C1D53C7BCFA9735E54165F16BD950D286D25E8FF0E0CCD01B2872259701FD40F7A91EE959CD4AC566DCFECB73410F1BB096BA3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4652481796855752
Encrypted:	false
SSDEEP:	48:9X8PhAuRc06WXJanT5OFqbS5hrlqbSIe0:UhA1RnTASr60
MD5:	DF28138C9CD1D4CDD3CD08B69D68ABD5
SHA1:	BA98FB259CFFAE7FD13CD4336B4612278F94CEF2
SHA-256:	2BC9F6A36309BB7F14BF9532AC6F37E4AB1AE89D50859ADCA18609F6C11437FE
SHA-512:	0C465B5BA4F0703F1BA251D88BDD9CD7D22EFD786EDA0252F370AD6DA5A814A7885EB2ECDEE28FBF0A8202FA1085297CC3AA0F334544822E62A4EDA9D170BBF6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	364484
Entropy (8bit):	5.365488401892333
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauC:zTtbmkExhMJCIpEN
MD5:	4EF82142C1C008261402D9FBD61B8FE7
SHA1:	3561F966BD91D6F3BF8F9B8E1C2DE85CBEE6CFE1
SHA-256:	0F2959F051255BD4020CAF46ED27B3A8E9CEA4B3265D2FDA9BB4FF56C4D82738
SHA-512:	AA14B54A14C2B1D71843C9A3943DC786A2B7CC27F64599039021C77B0A278590CE94A4172BC8387B0748EAA106F2B7BBF7136AE21A9E6777516544118D6FD45E
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\SysWOW64\inspect.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	168784
Entropy (8bit):	5.933402254740505
Encrypted:	false
SSDEEP:	3072:EEuO7R/vB0fMN3N+mWiRM0w8TrwDbIYcFncs75hb9o:0ORSfML+mTRM0w4rwvPsV
MD5:	C2E248B330F247BC8E3EEF9596227CA6
SHA1:	02AA51BF8AE818B8DC41FEADE5499ABD5ADF4213
SHA-256:	8F77023A58FC99383AFCC3417F92512B504FEE1A92A3BCDD7362BE23C965C2FE
SHA-512:	9E8A3C76B15E566C9042125DBC017CA33D3CF7984A2019872FA145120627A75DD9496D00C66AE664B4104CEFC5AC62851383D069739C53E32605FD126494F0A6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........ci..ci..ci.]1...ci.]1...ci..ch..bi.]1..ci.]1..ci......ci.]1.ci.]1.ci.Rich.ci.................PE..L....`.K............................6................................................#....@...... ..........................$...........Xr...........\|..P............................................s..@......................@....................text............................... ..`.data...TA.......>..................@....rsrc...Xr.......t..................@..@.reloc...$.......&...V..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\is-ARHTI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	168784
Entropy (8bit):	5.933402254740505
Encrypted:	false
SSDEEP:	3072:EEuO7R/vB0fMN3N+mWiRM0w8TrwDbIYcFncs75hb9o:0ORSfML+mTRM0w4rwvPsV
MD5:	C2E248B330F247BC8E3EEF9596227CA6
SHA1:	02AA51BF8AE818B8DC41FEADE5499ABD5ADF4213
SHA-256:	8F77023A58FC99383AFCC3417F92512B504FEE1A92A3BCDD7362BE23C965C2FE
SHA-512:	9E8A3C76B15E566C9042125DBC017CA33D3CF7984A2019872FA145120627A75DD9496D00C66AE664B4104CEFC5AC62851383D069739C53E32605FD126494F0A6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........ci..ci..ci.]1...ci.]1...ci..ch..bi.]1..ci.]1..ci......ci.]1.ci.]1.ci.Rich.ci.................PE..L....`.K............................6................................................#....@...... ..........................$...........Xr...........\|..P............................................s..@......................@....................text............................... ..`.data...TA.......>..................@....rsrc...Xr.......t..................@..@.reloc...$.......&...V..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF13A8E2FACE6496FD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1C4FEAA2E3A3C744.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07075141213311552
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOqSnZodet4Vky6lw:2F0i8n0itFzDHFZoCw
MD5:	6D9F80A4360464D5A975B7B4460159B1
SHA1:	A6C9AC41629C46CC5932AD47BBEE0B8630C2E9B7
SHA-256:	5D582396F46AEE052C7735E7C11D28D09BCAADE1FF2E4BB61D152D81C2497BFA
SHA-512:	ABA5F90D751C83E5F462A832D65E9C0D53698F131FD5CD576084D6E35FE8F690FC64B80482FFC583E661000DBA9CA08881D834EACA4527BFE0E6AA2D22EBD801
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF292CF65E628468E7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF351EF6164E266DEF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF39DD0387BB6EF8BA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4652481796855752
Encrypted:	false
SSDEEP:	48:9X8PhAuRc06WXJanT5OFqbS5hrlqbSIe0:UhA1RnTASr60
MD5:	DF28138C9CD1D4CDD3CD08B69D68ABD5
SHA1:	BA98FB259CFFAE7FD13CD4336B4612278F94CEF2
SHA-256:	2BC9F6A36309BB7F14BF9532AC6F37E4AB1AE89D50859ADCA18609F6C11437FE
SHA-512:	0C465B5BA4F0703F1BA251D88BDD9CD7D22EFD786EDA0252F370AD6DA5A814A7885EB2ECDEE28FBF0A8202FA1085297CC3AA0F334544822E62A4EDA9D170BBF6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF41B79A2990E59A2A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6B24AE1C4385ECB6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8CD3A19676C97F67.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1808683807138078
Encrypted:	false
SSDEEP:	24:JIMhC3houx5iAipKP2xza2tzhAPZdagUMClXtd85qKt+skwVgbipV7VQwGklrkgE:OhouXNveFXJpT50FqbS5hrlqbSIe0
MD5:	EA2CA4D3DC515F16D39FA71716C6609A
SHA1:	0D958B162D70C99184238F4FF8490CC7E81045C7
SHA-256:	5826DB790A1594004EC4B07E6B43D568656E962F7A1C2163C548FE5F9A91C239
SHA-512:	8DE6CD9B52EB7C0FBB0631E5259C38F6F052C5C1FFF1662B6DDC13A0F15E22B702E0BD9AF84340DE8DD9BE307BF48087A57F55E6DF7FCF2BEBD84300516860FA
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAFB44D2E754922C2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1808683807138078
Encrypted:	false
SSDEEP:	24:JIMhC3houx5iAipKP2xza2tzhAPZdagUMClXtd85qKt+skwVgbipV7VQwGklrkgE:OhouXNveFXJpT50FqbS5hrlqbSIe0
MD5:	EA2CA4D3DC515F16D39FA71716C6609A
SHA1:	0D958B162D70C99184238F4FF8490CC7E81045C7
SHA-256:	5826DB790A1594004EC4B07E6B43D568656E962F7A1C2163C548FE5F9A91C239
SHA-512:	8DE6CD9B52EB7C0FBB0631E5259C38F6F052C5C1FFF1662B6DDC13A0F15E22B702E0BD9AF84340DE8DD9BE307BF48087A57F55E6DF7FCF2BEBD84300516860FA
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBB43AE07B76BD267.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4652481796855752
Encrypted:	false
SSDEEP:	48:9X8PhAuRc06WXJanT5OFqbS5hrlqbSIe0:UhA1RnTASr60
MD5:	DF28138C9CD1D4CDD3CD08B69D68ABD5
SHA1:	BA98FB259CFFAE7FD13CD4336B4612278F94CEF2
SHA-256:	2BC9F6A36309BB7F14BF9532AC6F37E4AB1AE89D50859ADCA18609F6C11437FE
SHA-512:	0C465B5BA4F0703F1BA251D88BDD9CD7D22EFD786EDA0252F370AD6DA5A814A7885EB2ECDEE28FBF0A8202FA1085297CC3AA0F334544822E62A4EDA9D170BBF6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCF6D3EA99DEBE3A6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1808683807138078
Encrypted:	false
SSDEEP:	24:JIMhC3houx5iAipKP2xza2tzhAPZdagUMClXtd85qKt+skwVgbipV7VQwGklrkgE:OhouXNveFXJpT50FqbS5hrlqbSIe0
MD5:	EA2CA4D3DC515F16D39FA71716C6609A
SHA1:	0D958B162D70C99184238F4FF8490CC7E81045C7
SHA-256:	5826DB790A1594004EC4B07E6B43D568656E962F7A1C2163C548FE5F9A91C239
SHA-512:	8DE6CD9B52EB7C0FBB0631E5259C38F6F052C5C1FFF1662B6DDC13A0F15E22B702E0BD9AF84340DE8DD9BE307BF48087A57F55E6DF7FCF2BEBD84300516860FA
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEDA63B10F1214E09.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.10350804523799162
Encrypted:	false
SSDEEP:	24:ZfxJpwVgbipVEwVgbipV7VQwGklrkgx+s6K:BxJ6qbSLqbS5hrx
MD5:	21FA18D53D3CAD398213FCB312E57D25
SHA1:	2F6E92FFCCE54A983A8AB44832ABA642E556790C
SHA-256:	FDDA532E03073E72C2CD1882116F38571571340160A7CB3BFC616A974CF06DD0
SHA-512:	89D999EDFE8A2D82CE1CC08F148C3282909FCF723006D509846B028804D54521498309A997AC68BD844623CE782DA92CB06395BE425B80282692DE7F5636A15A
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.2359263506290326
Encrypted:	false
SSDEEP:	3:t:t
MD5:	F1CA165C0DA831C9A17D08C4DECBD114
SHA1:	D750F8260312A40968458169B496C40DACC751CA
SHA-256:	ACCF036232D2570796BF0ABF71FFE342DC35E2F07B12041FE739D44A06F36AF8
SHA-512:	052FF09612F382505B049EF15D9FB83E46430B5EE4EEFB0F865CD1A3A50FDFA6FFF573E0EF940F26E955270502D5774187CD88B90CD53792AC1F6DFA37E4B646
Malicious:	false
Preview:	Ok.....

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: MPK_EM, Author: Mipko, Keywords: Installer, Comments: This installer database contains the logic and data required to install MPK_EM., Template: Intel;1033, Revision Number: {13B3FD70-0ECC-42BA-8BCE-4711A2312FB6}, Create Time/Date: Wed Feb 18 13:48:52 2015, Last Saved Time/Date: Wed Feb 18 13:48:52 2015, Number of Pages: 300, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1224.0), Security: 2
Entropy (8bit):	7.9965012572516505
TrID:	Microsoft Windows Installer (60509/1) 88.31% Generic OLE2 / Multistream Compound File (8008/1) 11.69%
File name:	1944b321.msi
File size:	5'255'168 bytes
MD5:	f2f3a908a18ef6b45b50e1105326b833
SHA1:	d01c20894cff8efa96e3394fcb54a8f4cea0f764
SHA256:	ef896df89c6088517c117552424e932d590ebd483decc3c9f444a18ce88179fd
SHA512:	99749b7c3aa1ee2da0a63be57027be364e513792d1b048d95a22c97ed4fe031d6ece28b5c417171e49cb9a63880b570b0f34358a19ac28c3b67c1ab1eccaf9f7
SSDEEP:	98304:Bzo9xMVVnii6a2A125eRsbcTP1o1y7klqJ1p9cOSJci3IOI:xo9xUhiBAI5eyob1o1ywwJBaJcA
TLSH:	C7363399966CDB15CC454AF1AC924777082CBEC88700E64FFDAEFA52087AB8CF9745C1
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 22:10:28.929764986 CET	53	51238	1.1.1.1	192.168.2.5

Target ID:	0
Start time:	17:10:12
Start date:	31/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\1944b321.msi"
Imagebase:	0x7ff6161a0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:10:12
Start date:	31/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6161a0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	17:10:14
Start date:	31/10/2024
Path:	C:\ProgramData\MPK\mpk_emni_mpk.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\MPK\mpk_emni_mpk.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SDIR "C:\Users\user\Desktop\" /LOG="C:\ProgramData\MPK\mpk_em_log.txt"
Imagebase:	0x400000
File size:	5'283'576 bytes
MD5 hash:	E67464707F7D14131BEDE9DB845A6A0A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 52%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:10:15
Start date:	31/10/2024
Path:	C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-EVFO2.tmp\mpk_emni_mpk.tmp" /SL5="$3049C,4852295,119296,C:\ProgramData\MPK\mpk_emni_mpk.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SDIR "C:\Users\user\Desktop\" /LOG="C:\ProgramData\MPK\mpk_em_log.txt"
Imagebase:	0x400000
File size:	1'178'880 bytes
MD5 hash:	5ABA2917CE54882DFFA1635380313097
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 24%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:10:16
Start date:	31/10/2024
Path:	C:\Users\user\AppData\Local\Temp\is-TDMRE.tmp\_isetup\_setup64.tmp
Wow64 process (32bit):	false
Commandline:	helper 105 0x3DC
Imagebase:	0x140000000
File size:	6'144 bytes
MD5 hash:	526426126AE5D326D0A24706C77D8C5C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:10:17
Start date:	31/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:10:17
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cmd.exe" /c netsh advfirewall firewall add rule name="TCP\IP" dir=in action=allow program="C:\ProgramData\MPK\mpk.exe" enable=yes
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:10:17
Start date:	31/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:10:17
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name="TCP\IP" dir=in action=allow program="C:\ProgramData\MPK\mpk.exe" enable=yes
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:10:18
Start date:	31/10/2024
Path:	C:\ProgramData\MPK\MPKInst.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\MPK\MPKInst.exe" /i /dr /cp
Imagebase:	0x400000
File size:	1'499'392 bytes
MD5 hash:	20BC08D7652B652811DF5F403C9C6DFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000A.00000000.2093241826.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:10:18
Start date:	31/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:10:18
Start date:	31/10/2024
Path:	C:\ProgramData\MPK\lsynchost.exe
Wow64 process (32bit):	true
Commandline:	c:\programdata\mpk\\lsynchost.exe /install /silent
Imagebase:	0x400000
File size:	1'561'344 bytes
MD5 hash:	1A902E39120A8CCAA56163B91601E63A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000C.00000000.2094922926.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:10:18
Start date:	31/10/2024
Path:	C:\ProgramData\MPK\lsynchost.exe
Wow64 process (32bit):	true
Commandline:	c:\programdata\mpk\lsynchost.exe /startedbyscm:E4233B4F-40E3FE91-MPKService
Imagebase:	0x400000
File size:	1'561'344 bytes
MD5 hash:	1A902E39120A8CCAA56163B91601E63A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:10:18
Start date:	31/10/2024
Path:	C:\ProgramData\MPK\lsynchost.exe
Wow64 process (32bit):	true
Commandline:	"c:\programdata\mpk\lsynchost.exe" /runsrv
Imagebase:	0x400000
File size:	1'561'344 bytes
MD5 hash:	1A902E39120A8CCAA56163B91601E63A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	17:10:18
Start date:	31/10/2024
Path:	C:\ProgramData\MPK\lsynchost.exe
Wow64 process (32bit):	true
Commandline:	"c:\programdata\mpk\lsynchost.exe" /runsrv \MID:D
Imagebase:	0x400000
File size:	1'561'344 bytes
MD5 hash:	1A902E39120A8CCAA56163B91601E63A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	17:10:57
Start date:	31/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	56.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	33.3%
Total number of Nodes:	33
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001000 Relevance: 12.1, APIs: 8, Instructions: 120
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNamedSecurityInfoW.ADVAPI32 ref: 0000000140001079
AllocateAndInitializeSid.ADVAPI32 ref: 00000001400010DE
SetEntriesInAclW.ADVAPI32 ref: 0000000140001131
SetNamedSecurityInfoW.ADVAPI32 ref: 000000014000115F
LocalFree.KERNEL32 ref: 000000014000116C
FreeSid.ADVAPI32 ref: 0000000140001187
LocalFree.KERNEL32 ref: 000000014000119C
GetLastError.KERNEL32 ref: 00000001400011C5

Memory Dump Source

Source File: 00000005.00000002.2100907608.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2100885026.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2100933131.0000000140002000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2100956168.0000000140013000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2101007888.0000000140025000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000__setup64.jbxd

Similarity

API ID: Free$InfoLocalNamedSecurity$AllocateEntriesErrorInitializeLast
String ID:
API String ID: 1336570144-0
Opcode ID: b35f34b64a9d6aa6b81e16b13b2f1c0d38c8c3b1546899b34faa1a97c6582e21
Instruction ID: 9ad65f9ffd8baecdb197e09b536dbb51b96e9a581e15e5332d3d6b3fb358d4f4
Opcode Fuzzy Hash: b35f34b64a9d6aa6b81e16b13b2f1c0d38c8c3b1546899b34faa1a97c6582e21
Instruction Fuzzy Hash: A35147B2614B8186E765CF12F88078EB7E6F7887D4F504425EB8943B64DF38D9A5CB00

Function 00000001400012A4 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012AF
SetErrorMode.KERNELBASE(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012BA
GetSystemDirectoryW.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012CC
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012D9
SetProcessShutdownParameters.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012E6
SetConsoleCtrlHandler.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012F5
GetCommandLineW.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012FB
CommandLineToArgvW.SHELL32(?,?,?,?,?,?,00000001400014E9), ref: 0000000140001309
GetLastError.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 0000000140001317
CloseHandle.KERNEL32 ref: 00000001400014AD
GetLastError.KERNEL32 ref: 00000001400014C5

Strings

MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 000000014000141C

Memory Dump Source

Source File: 00000005.00000002.2100907608.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2100885026.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2100933131.0000000140002000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2100956168.0000000140013000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2101007888.0000000140025000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000__setup64.jbxd

Similarity

API ID: Error$CommandDirectoryLastLine$ArgvCloseConsoleCtrlCurrentHandleHandlerModeParametersProcessShutdownSystem
String ID: MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 1351133944-1036520142
Opcode ID: 9d6e473d000c958ab654ea6524e99b93636dd2550909cc2fdf2d0baeb0bae34d
Instruction ID: bed22989135500286ff082a5b8534ee6a98307118f748591786f601728a80f93
Opcode Fuzzy Hash: 9d6e473d000c958ab654ea6524e99b93636dd2550909cc2fdf2d0baeb0bae34d
Instruction Fuzzy Hash: 435106B160464686EB13DF27F8843E963A1F78C7C5F904125FB4A476B5CB3C8989CB50

Function 00000001400014E0 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400012A4: #17.COMCTL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012AF
Part of subcall function 00000001400012A4: SetErrorMode.KERNELBASE(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012BA
Part of subcall function 00000001400012A4: GetSystemDirectoryW.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012CC
Part of subcall function 00000001400012A4: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012D9
Part of subcall function 00000001400012A4: SetProcessShutdownParameters.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012E6
Part of subcall function 00000001400012A4: SetConsoleCtrlHandler.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012F5
Part of subcall function 00000001400012A4: GetCommandLineW.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012FB
Part of subcall function 00000001400012A4: CommandLineToArgvW.SHELL32(?,?,?,?,?,?,00000001400014E9), ref: 0000000140001309
Part of subcall function 00000001400012A4: GetLastError.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 0000000140001317

ExitProcess.KERNEL32 ref: 00000001400014EB

Memory Dump Source

Source File: 00000005.00000002.2100907608.0000000140001000.00000020.00000001.01000000.00000007.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2100885026.0000000140000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2100933131.0000000140002000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2100956168.0000000140013000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2101007888.0000000140025000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000__setup64.jbxd

Similarity

API ID: CommandDirectoryErrorLineProcess$ArgvConsoleCtrlCurrentExitHandlerLastModeParametersShutdownSystem
String ID:
API String ID: 596749235-0
Opcode ID: d409c78e300c7577bde50c236e3745e62975251c616abf16af35a2c2feadab5b
Instruction ID: 20a652f16b87ba7830b4ae42eb4563c7e1ed9e0c7b0ce7c62722bbd31286e835
Opcode Fuzzy Hash: d409c78e300c7577bde50c236e3745e62975251c616abf16af35a2c2feadab5b
Instruction Fuzzy Hash: CEA001B0E2168282EA0ABBB6695A3D911626FD8781F540414A242872A2DD7884698612

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1944b321.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\4e7f66.rbs

C:\ProgramData\MPK\MPK.dll (copy)

C:\ProgramData\MPK\MPK.exe (copy)

C:\ProgramData\MPK\MPK64.dll (copy)

C:\ProgramData\MPK\MPKInst.exe (copy)

C:\ProgramData\MPK\MpkHCA.dll (copy)

C:\ProgramData\MPK\MpkL64.exe (copy)

C:\ProgramData\MPK\Vorbis.dll (copy)

C:\ProgramData\MPK\cinfo.bin (copy)

C:\ProgramData\MPK\is-3LL6A.tmp

C:\ProgramData\MPK\is-5U9RI.tmp

C:\ProgramData\MPK\is-7IT87.tmp

C:\ProgramData\MPK\is-89R70.tmp

C:\ProgramData\MPK\is-9EF5L.tmp

C:\ProgramData\MPK\is-BV3PJ.tmp

C:\ProgramData\MPK\is-EQREG.tmp

C:\ProgramData\MPK\is-GH6IU.tmp

C:\ProgramData\MPK\is-H68I0.tmp

C:\ProgramData\MPK\is-HFVOH.tmp

Windows Analysis Report
1944b321.msi