File name:

easypdfbox.msi

Full analysis: https://app.any.run/tasks/c7bf88b0-5143-4f71-8a70-5957bab44825
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 30, 2025, 08:38:17
OS: Windows 11 Professional (build: 22000, 64 bit)
Tags:
generated-doc
loader
stealer
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {E0AF7559-7A5A-4FA5-943D-0D2B80B39C9B}, Number of Words: 10, Subject: OneStart PDF, Author: OneStart.ai, Name of Creating Application: OneStart PDF, Template: ;1033, Comments: OneStart PDF 4.5.268.2, Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Fri Jan 17 07:38:55 2025, Last Saved Time/Date: Fri Jan 17 07:38:55 2025, Last Printed: Fri Jan 17 07:38:55 2025, Number of Pages: 450
MD5:

904366068865FA2D5CE89B23AFC4F065

SHA1:

8542DFD1A378928A507E56C7BA07ADF8C45F1373

SHA256:

F7D5E33B15325633B1BD6F1628B0C28F8A94517AD8F77614390F7538FAE9EEE6

SSDEEP:

98304:O9Ipo/PuJfbQnmutlJXi1yvSVTuocjXBfZQvv/IVTu5XKivee3uol5igSE1:f

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • notification_helper.exe (PID: 4812)

    • Changes the autorun value in the registry

      • onestart.exe (PID: 6108)

  • SUSPICIOUS

    • Reads the Internet Settings

      • msiexec.exe (PID: 3004)
      • msiexec.exe (PID: 4400)
      • MSIF768.tmp (PID: 2096)
      • msiexec.exe (PID: 3168)
      • onestart.exe (PID: 6108)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3616)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 3324)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 3324)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 4400)
      • MSIF768.tmp (PID: 2096)
      • msiexec.exe (PID: 3168)

    • Potential Corporate Privacy Violation

      • msiexec.exe (PID: 4400)

    • Process requests binary or script from the Internet

      • msiexec.exe (PID: 4400)

    • Executable content was dropped or overwritten

      • onestart_installer.exe (PID: 3660)
      • setup.exe (PID: 3172)
      • onestart.exe (PID: 4952)

    • Creates a software uninstall entry

      • setup.exe (PID: 3172)

    • Searches for installed software

      • setup.exe (PID: 3172)

    • Application launched itself

      • setup.exe (PID: 5368)
      • setup.exe (PID: 3172)
      • onestart.exe (PID: 6108)
      • onestart.exe (PID: 1648)

    • Starts CMD.EXE for commands execution

      • MSIF768.tmp (PID: 2096)
      • msiexec.exe (PID: 3168)
      • onestart.exe (PID: 6108)

    • The process deletes folder without confirmation

      • MSIF768.tmp (PID: 2096)

    • The executable file from the user directory is run by the CMD process

      • onestart.exe (PID: 6276)

    • Reads settings of System Certificates

      • onestart.exe (PID: 6108)

    • The process checks if it is being run in the virtual environment

      • onestart.exe (PID: 6108)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 3004)

    • An automatically generated document

      • msiexec.exe (PID: 3004)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 3004)
      • msiexec.exe (PID: 4400)
      • onestart_installer.exe (PID: 3660)
      • notification_helper.exe (PID: 4812)
      • setup.exe (PID: 5368)
      • setup.exe (PID: 3172)
      • onestart.exe (PID: 6108)
      • onestart.exe (PID: 1376)

    • Reads the software policy settings

      • msiexec.exe (PID: 3004)
      • msiexec.exe (PID: 3324)

    • Checks proxy server information

      • msiexec.exe (PID: 3004)
      • msiexec.exe (PID: 4400)
      • onestart.exe (PID: 6108)

    • Checks supported languages

      • msiexec.exe (PID: 3324)
      • msiexec.exe (PID: 3168)
      • msiexec.exe (PID: 4400)
      • onestart_installer.exe (PID: 3660)
      • notification_helper.exe (PID: 4812)
      • setup.exe (PID: 5368)
      • setup.exe (PID: 2440)
      • onestart.exe (PID: 6108)
      • setup.exe (PID: 3172)
      • setup.exe (PID: 2052)
      • onestart.exe (PID: 1648)
      • onestart.exe (PID: 2648)
      • MSIF768.tmp (PID: 2096)
      • onestart.exe (PID: 5024)
      • onestart.exe (PID: 5912)
      • onestart.exe (PID: 1748)
      • onestart.exe (PID: 6276)
      • onestart.exe (PID: 5028)
      • onestart.exe (PID: 6776)
      • onestart.exe (PID: 4560)
      • onestart.exe (PID: 1376)
      • onestart.exe (PID: 6992)
      • onestart.exe (PID: 7012)
      • onestart.exe (PID: 4784)
      • onestart.exe (PID: 4952)
      • onestart.exe (PID: 1220)
      • onestart.exe (PID: 4756)
      • onestart.exe (PID: 6528)
      • onestart.exe (PID: 1840)
      • onestart.exe (PID: 3828)
      • onestart.exe (PID: 1400)
      • onestart.exe (PID: 3456)
      • onestart.exe (PID: 4168)
      • onestart.exe (PID: 6556)
      • onestart.exe (PID: 148)
      • onestart.exe (PID: 6612)
      • onestart.exe (PID: 4924)
      • onestart.exe (PID: 7136)
      • onestart.exe (PID: 2588)
      • onestart.exe (PID: 2420)
      • onestart.exe (PID: 4880)
      • onestart.exe (PID: 224)
      • onestart.exe (PID: 7012)
      • onestart.exe (PID: 6136)
      • onestart.exe (PID: 4756)
      • onestart.exe (PID: 5860)
      • onestart.exe (PID: 1176)
      • onestart.exe (PID: 2524)
      • onestart.exe (PID: 6556)
      • onestart.exe (PID: 5404)
      • onestart.exe (PID: 6252)
      • onestart.exe (PID: 4812)
      • onestart.exe (PID: 5056)
      • onestart.exe (PID: 2416)
      • onestart.exe (PID: 5772)
      • onestart.exe (PID: 6580)

    • Reads the computer name

      • msiexec.exe (PID: 3324)
      • msiexec.exe (PID: 3168)
      • msiexec.exe (PID: 4400)
      • onestart_installer.exe (PID: 3660)
      • notification_helper.exe (PID: 4812)
      • setup.exe (PID: 5368)
      • onestart.exe (PID: 6108)
      • setup.exe (PID: 3172)
      • onestart.exe (PID: 1648)
      • MSIF768.tmp (PID: 2096)
      • onestart.exe (PID: 5912)
      • onestart.exe (PID: 6276)
      • onestart.exe (PID: 1376)
      • onestart.exe (PID: 4756)
      • onestart.exe (PID: 1176)
      • onestart.exe (PID: 5860)
      • onestart.exe (PID: 2524)

    • The sample compiled with english language support

      • msiexec.exe (PID: 3004)
      • msiexec.exe (PID: 3324)
      • msiexec.exe (PID: 4400)
      • onestart_installer.exe (PID: 3660)
      • setup.exe (PID: 3172)
      • onestart.exe (PID: 4952)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3004)
      • msiexec.exe (PID: 3324)

    • Reads Environment values

      • msiexec.exe (PID: 3168)
      • msiexec.exe (PID: 4400)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 3324)
      • onestart.exe (PID: 6108)
      • onestart.exe (PID: 2524)

    • Manages system restore points

      • SrTasks.exe (PID: 1616)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 3324)

    • Create files in a temporary directory

      • onestart.exe (PID: 6108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (88.6)
.mst | Windows SDK Setup Transform Script (10)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {E0AF7559-7A5A-4FA5-943D-0D2B80B39C9B}
Words: 10
Subject: OneStart PDF
Author: OneStart.ai
LastModifiedBy: -
Software: OneStart PDF
Template: ;1033
Comments: OneStart PDF 4.5.268.2
Title: Installation Database
Keywords: Installer, MSI, Database
CreateDate: 2025:01:17 07:38:55
ModifyDate: 2025:01:17 07:38:55
LastPrinted: 2025:01:17 07:38:55
Pages: 450
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
185
Monitored processes
66
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe onestart_installer.exe setup.exe setup.exe no specs notification_helper.exe chrome.exe no specs setup.exe no specs setup.exe no specs onestart.exe onestart.exe no specs onestart.exe no specs msif768.tmp no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs onestart.exe no specs onestart.exe onestart.exe no specs cmd.exe no specs onestart.exe onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
148"C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=5152,i,5503500162499777947,15613262027103265696,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe—onestart.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
LOW
Description:
OneStart
Exit code:
0
Version:
130.0.6723.139
Modules
Images
c:\users\admin\appdata\local\onestart.ai\onestart\application\onestart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\local\onestart.ai\onestart\application\130.0.6723.139\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
224"C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=4304,i,5503500162499777947,15613262027103265696,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe—onestart.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
LOW
Description:
OneStart
Exit code:
0
Version:
130.0.6723.139
1176"C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations=is-enterprise-managed=no --field-trial-handle=792,i,5503500162499777947,15613262027103265696,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:12C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe—onestart.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
LOW
Description:
OneStart
Version:
130.0.6723.139
1220"C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=5168,i,5503500162499777947,15613262027103265696,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe—onestart.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
LOW
Description:
OneStart
Exit code:
0
Version:
130.0.6723.139
Modules
Images
c:\users\admin\appdata\local\onestart.ai\onestart\application\onestart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\local\onestart.ai\onestart\application\130.0.6723.139\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
1376"C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --start-stack-profiler --field-trial-handle=2196,i,5503500162499777947,15613262027103265696,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
onestart.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
MEDIUM
Description:
OneStart
Version:
130.0.6723.139
Modules
Images
c:\users\admin\appdata\local\onestart.ai\onestart\application\onestart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\local\onestart.ai\onestart\application\130.0.6723.139\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
1400"C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=5520,i,5503500162499777947,15613262027103265696,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe—onestart.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
LOW
Description:
OneStart
Exit code:
0
Version:
130.0.6723.139
Modules
Images
c:\users\admin\appdata\local\onestart.ai\onestart\application\onestart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\local\onestart.ai\onestart\application\130.0.6723.139\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
1616C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:14C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1648C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\OneStart.ai\OneStart\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\admin\AppData\Local\OneStart.ai\OneStart\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\OneStart.ai\OneStart\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=OneStart --annotation=ver=130.0.6723.139 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7ff92b477c38,0x7ff92b477c44,0x7ff92b477c50C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe—onestart.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
MEDIUM
Description:
OneStart
Version:
130.0.6723.139
Modules
Images
c:\users\admin\appdata\local\onestart.ai\onestart\application\onestart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\local\onestart.ai\onestart\application\130.0.6723.139\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
1748"C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2316,i,5503500162499777947,15613262027103265696,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe—onestart.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
LOW
Description:
OneStart
Version:
130.0.6723.139
Modules
Images
c:\users\admin\appdata\local\onestart.ai\onestart\application\onestart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\local\onestart.ai\onestart\application\130.0.6723.139\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
1840"C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=5576,i,5503500162499777947,15613262027103265696,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe—onestart.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
LOW
Description:
OneStart
Exit code:
0
Version:
130.0.6723.139
Modules
Images
c:\users\admin\appdata\local\onestart.ai\onestart\application\onestart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\local\onestart.ai\onestart\application\130.0.6723.139\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
Total events
20 726
Read events
20 342
Write events
365
Delete events
19

Modification events

(PID) Process:(3324) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
480000000000000082FA5360F272DB01FC0C0000380E0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3324) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
480000000000000082FA5360F272DB01FC0C0000380E0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3324) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000078D49D60F272DB01FC0C0000380E0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3324) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000078D49D60F272DB01FC0C0000380E0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3324) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
48000000000000001D08A560F272DB01FC0C0000380E0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3324) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000F93AA060F272DB01FC0C0000380E0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3324) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000004CCE5761F272DB01FC0C0000AC100000E80300000100000000000000000000006068B2C89F34DC4BBEA2F2F18B31637A00000000000000000000000000000000
(PID) Process:(3616) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Leave)
Value:
480000000000000005FD5E61F272DB01200E00008C160000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3324) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
14
(PID) Process:(3324) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000EF7D5561F272DB01FC0C0000380E0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
42
Suspicious files
637
Text files
135
Unknown types
1

Dropped files

PID
Process
Filename
Type
3324msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3004msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_92EDC502ED2DCA77FBA738595B424D4Abinary
MD5:16024348C28E3A1BDD169FBDFC99F2F2
SHA256:1507EA46E0D8C5F7320148BFD64C0189E2E3CE648239A1E69A78D5EB598A2B0C
3004msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI1FC8.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
3004msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI22DE.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
3004msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Ebinary
MD5:7F9BDA078252E1104D28264443C0D561
SHA256:939621F7028B080A4319F30BB246F104617E7612E184E24AF13447AA14BF259F
3004msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI2151.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
3004msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI2181.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
3004msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI220F.tmpexecutable
MD5:E83D774F643972B8ECCDB3A34DA135C5
SHA256:D0A6F6373CFB902FCD95BC12360A9E949F5597B72C01E0BD328F9B1E2080B5B7
3004msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI21C0.tmpexecutable
MD5:EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA256:7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
4400msiexec.exeC:\Users\admin\AppData\Local\OneStart.ai\OneStart Installer\onestart_installer.exe.part —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
41
TCP/UDP connections
84
DNS requests
87
Threats
97

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
88.221.110.234:80
http://www.msftconnecttest.com/connecttest.txt
unknown
—
—
whitelisted
3004
msiexec.exe
GET
200
199.232.210.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?417ff4e0ca3b7cd8
unknown
—
—
whitelisted
3004
msiexec.exe
GET
200
151.101.66.133:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDHIJtrz9Ya%2BlpHbb8A%3D%3D
unknown
—
—
whitelisted
2860
svchost.exe
GET
304
84.201.210.23:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?da926bed344bea6e
unknown
—
—
whitelisted
2860
svchost.exe
GET
200
84.201.210.23:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?f89d0d26c4a5f00b
unknown
—
—
whitelisted
3660
onestart_installer.exe
POST
200
108.138.26.36:80
http://log.onestart.ai/
unknown
—
—
unknown
2860
svchost.exe
GET
200
84.201.210.23:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?8e99cab6193946e3
unknown
—
—
whitelisted
2860
svchost.exe
GET
200
84.201.210.23:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?34d033045770a123
unknown
—
—
whitelisted
1376
onestart.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompecagnajdejgnnjijobebaeigek_4.10.2830.0_win64_dldxogwi36sxwpr57ta4lg57z4.crx3
unknown
—
—
whitelisted
3660
onestart_installer.exe
POST
200
108.138.26.36:80
http://log.onestart.ai/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
88.221.110.234:80
—
Akamai International B.V.
DE
unknown
3376
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1592
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3004
msiexec.exe
199.232.210.172:80
ctldl.windowsupdate.com
FASTLY
US
whitelisted
3004
msiexec.exe
151.101.66.133:80
ocsp.globalsign.com
FASTLY
US
whitelisted
1592
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2884
svchost.exe
20.42.73.30:443
v10.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3376
MoUsoCoreWorker.exe
20.44.239.154:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
4400
msiexec.exe
52.222.236.46:80
resources.onestart.ai
AMAZON-02
US
suspicious
2860
svchost.exe
84.201.210.23:80
ctldl.windowsupdate.com
IP4NET Sp. z o.o.
PL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted
login.live.com
  • 20.190.159.23
  • 40.126.31.0
  • 40.126.31.129
  • 20.190.159.64
  • 20.190.159.0
  • 20.190.159.129
  • 20.190.159.128
  • 20.190.159.4
  • 20.190.160.132
  • 40.126.32.133
  • 40.126.32.136
  • 40.126.32.74
  • 40.126.32.138
  • 20.190.160.128
  • 20.190.160.5
  • 20.190.160.17
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.44.239.154
  • 20.73.194.208
whitelisted
ctldl.windowsupdate.com
  • 199.232.210.172
  • 199.232.214.172
  • 84.201.210.23
  • 217.20.57.19
  • 84.201.210.39
  • 217.20.57.36
  • 217.20.57.18
  • 217.20.57.35
  • 217.20.57.20
  • 217.20.57.34
whitelisted
ocsp.globalsign.com
  • 151.101.66.133
  • 151.101.2.133
  • 151.101.130.133
  • 151.101.194.133
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
v10.events.data.microsoft.com
  • 20.42.73.30
whitelisted
resources.onestart.ai
  • 52.222.236.46
  • 52.222.236.124
  • 52.222.236.99
  • 52.222.236.71
unknown
fs.microsoft.com
  • 184.28.90.27
whitelisted
onestart.ai
  • 13.33.187.77
  • 13.33.187.25
  • 13.33.187.4
  • 13.33.187.71
unknown

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Microsoft Connection Test
4400
msiexec.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
4400
msiexec.exe
Potentially Bad Traffic
ET INFO Executable served from Amazon S3
1376
onestart.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
1376
onestart.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
1376
onestart.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
1376
onestart.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
1376
onestart.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
1376
onestart.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
1376
onestart.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
easypdfbox.msi