File name: | E05FDCDC.msi |
Full analysis: | https://app.any.run/tasks/fffb1a60-9e05-49e3-a566-96f9f5caf61d |
Verdict: | Malicious activity |
Analysis date: | August 09, 2020, 02:06:13 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-msi |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 936, Revision Number: {1B985C9C-C836-4C08-B35E-8589CD16FB1B}, Number of Words: 2, Subject: AVKYBZWVUCEWXPTGJRQMEOMIGWHUSLDEXBNI, Author: AVKYBZWVUCEWXPTGJRQMEOMIGWHUSLDEXBNI, Name of Creating Application: Advanced Installer 16.3 build ee189028, Template: ;2052, Comments: AVKYBZWVUCEWXPTGJRQMEOMIGWHUSLDEXBNI , Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200 |
MD5: | D09A58319806DAE311FC87498FE62B88 |
SHA1: | 906C705334FB5C42276EB5CA27E5F1E021D0A37D |
SHA256: | 4A53ABF041D7B9555D81F8E68AD7B91690D1385CBBB1B3EFFC688461F90C2A87 |
SSDEEP: | 49152:DaHZBWVq9qVOox6FBdXZA/RILuYkN1GKkvj4Pb+44WP2E9QmcIDTL4m8eBRpa:C9O6BFZsRsQ8jKbLhFBXEm8ezpa |
.msi | | | Microsoft Windows Installer (81.9) |
---|---|---|
.mst | | | Windows SDK Setup Transform Script (9.2) |
.msp | | | Windows Installer Patch (7.6) |
.msi | | | Microsoft Installer (100) |
Pages: | 200 |
---|---|
Keywords: | Installer, MSI, Database |
Title: | Installation Database |
Comments: | ?˰?װ???ݿ??????˰?װ AVKYBZWVUCEWXPTGJRQMEOMIGWHUSLDEXBNI ?????????????ݡ? |
Template: | ;2052 |
Software: | Advanced Installer 16.3 build ee189028 |
LastModifiedBy: | - |
Author: | AVKYBZWVUCEWXPTGJRQMEOMIGWHUSLDEXBNI |
Subject: | AVKYBZWVUCEWXPTGJRQMEOMIGWHUSLDEXBNI |
Words: | 2 |
RevisionNumber: | {1B985C9C-C836-4C08-B35E-8589CD16FB1B} |
CodePage: | Windows Simplified Chinese (PRC, Singapore) |
Security: | None |
ModifyDate: | 2009:12:11 11:47:44 |
CreateDate: | 2009:12:11 11:47:44 |
LastPrinted: | 2009:12:11 11:47:44 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2760 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\E05FDCDC.msi" | C:\Windows\System32\msiexec.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 3010 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
3740 | C:\Windows\system32\MsiExec.exe -Embedding F571D781ACDBD0D45EDC38E11B270E00 | C:\Windows\system32\MsiExec.exe | — | msiexec.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
900 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
956 | C:\Windows\system32\DllHost.exe /Processid:{4D111E08-CBF7-4F12-A926-2C7920AF52FC} | C:\Windows\system32\DllHost.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2620 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\E05FDCDC.msi" | C:\Windows\System32\msiexec.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 1641 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2456 | C:\Windows\system32\MsiExec.exe -Embedding 81DC220E05BBB203B6A199557686854D | C:\Windows\system32\MsiExec.exe | — | msiexec.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
3124 | C:\Windows\system32\msiexec.exe /V | C:\Windows\System32\msiexec.exe | services.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3124 | msiexec.exe | C:\Windows\Installer\MSIC34E.tmp | — | |
MD5:— | SHA256:— | |||
3124 | msiexec.exe | C:\Windows\Installer\MSIC37E.tmp | — | |
MD5:— | SHA256:— | |||
3124 | msiexec.exe | C:\Windows\Installer\MSIC3AD.tmp | — | |
MD5:— | SHA256:— | |||
3124 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DF1B8684E65E6A8F61.TMP | — | |
MD5:— | SHA256:— | |||
3124 | msiexec.exe | C:\Config.Msi\d5992.rbs | — | |
MD5:— | SHA256:— | |||
3124 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DF0690994A04713F34.TMP | — | |
MD5:— | SHA256:— | |||
3124 | msiexec.exe | C:\Windows\Installer\MSI9600.tmp | — | |
MD5:— | SHA256:— | |||
3124 | msiexec.exe | C:\Windows\Installer\MSI968E.tmp | — | |
MD5:— | SHA256:— | |||
3124 | msiexec.exe | C:\Windows\Installer\MSI96DD.tmp | — | |
MD5:— | SHA256:— | |||
3124 | msiexec.exe | C:\Windows\Installer\MSI970D.tmp | — | |
MD5:— | SHA256:— |