File name:

TraceViewSetup.msi

Full analysis: https://app.any.run/tasks/dc9ecba8-8ed3-426c-9776-05216920329e
Verdict: Malicious activity
Analysis date: April 19, 2021, 06:54:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {C85A58A4-C7B1-4BD8-B92D-1727F03C720D}, Title: Anritsu TraceView Setup, Author: Anritsu, Number of Words: 2, Last Saved Time/Date: Thu Jan 2 16:48:34 2014, Last Printed: Thu Jan 2 16:48:34 2014
MD5:

A247D8F71BB17DAE631A243F82C2BCF6

SHA1:

6427990E6EA86B0C349BE255CD2A0F381F1D64B6

SHA256:

2EF5500880D720840A17380795446A10C3CCA1D809850B59DD02A0BB4B6C0DFF

SSDEEP:

98304:mdn7BxwupPxK0A0xugLPL5PT2iIlMreCI79EzrN6e:2lSupPx004gLD57MCc9Cv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • NetworksOTDR.exe (PID: 3444)

    • Application was dropped or rewritten from another process

      • NetworksOTDR.exe (PID: 3444)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Manual execution by user

      • NetworksOTDR.exe (PID: 3444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

LastPrinted: 2014:01:02 16:48:34
ModifyDate: 2014:01:02 16:48:34
Words: 2
Comments: -
Keywords: -
Author: Anritsu
Subject: -
Title: Anritsu TraceView Setup
RevisionNumber: {C85A58A4-C7B1-4BD8-B92D-1727F03C720D}
Pages: 200
Template: Intel;1033
CodePage: Windows Latin 1 (Western European)
Security: Password protected
Software: Windows Installer
CreateDate: 1999:06:21 07:00:00
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe networksotdr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2136"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\TraceViewSetup.msi"C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3444"C:\Program Files\Anritsu\Anritsu TraceView 5.0.00\NetworksOTDR.exe" C:\Program Files\Anritsu\Anritsu TraceView 5.0.00\NetworksOTDR.exe—explorer.exe
User:
admin
Company:
Anritsu
Integrity Level:
MEDIUM
Description:
NetWorks/OTDR Application 01/02/2014
Exit code:
0
Version:
5.0.0.0
Modules
Images
c:\program files\anritsu\anritsu traceview 5.0.00\networksotdr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mfc100u.dll
c:\windows\system32\msvcr100.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
Total events
172
Read events
157
Write events
15
Delete events
0

Modification events

(PID) Process:(2136) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2136) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@%SystemRoot%\system32\p2pcollab.dll,-8042
Value:
Peer to Peer Trust
(PID) Process:(2136) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@%SystemRoot%\system32\qagentrt.dll,-10
Value:
System Health Authentication
(PID) Process:(2136) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dnsapi.dll,-103
Value:
Domain Name System (DNS) Server Trust
(PID) Process:(2136) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@%SystemRoot%\System32\fveui.dll,-843
Value:
BitLocker Drive Encryption
(PID) Process:(2136) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@%SystemRoot%\System32\fveui.dll,-844
Value:
BitLocker Data Recovery Agent
Executable files
0
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2136msiexec.exeC:\Users\admin\AppData\Local\Temp\CabD71E.tmp —
MD5:—
SHA256:—
2136msiexec.exeC:\Users\admin\AppData\Local\Temp\TarD72F.tmp —
MD5:—
SHA256:—
2136msiexec.exeC:\Users\admin\AppData\Local\Temp\CabD740.tmp —
MD5:—
SHA256:—
2136msiexec.exeC:\Users\admin\AppData\Local\Temp\TarD741.tmp —
MD5:—
SHA256:—
2136msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI1257.tmp —
MD5:—
SHA256:—
2136msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI12E4.tmp —
MD5:—
SHA256:—
2136msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015binary
MD5:—
SHA256:—
2136msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015compressed
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3312
msiexec.exe
GET
304
205.185.216.42:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
—
—
whitelisted
3312
msiexec.exe
GET
304
205.185.216.42:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
—
—
whitelisted
2136
msiexec.exe
GET
200
205.185.216.10:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.2 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2136
msiexec.exe
205.185.216.42:80
www.download.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
2136
msiexec.exe
205.185.216.10:80
www.download.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
3312
msiexec.exe
205.185.216.42:80
www.download.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.download.windowsupdate.com
  • 205.185.216.42
  • 205.185.216.10
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TraceViewSetup.msi