Windows Analysis Report
SR_AD40BM0.1-A01N_A24-ENG.pdf

Overview

General Information

Sample name: SR_AD40BM0.1-A01N_A24-ENG.pdf
Analysis ID: 1419164
MD5: aa8ff96636214fb017ed4d31f3e81540
SHA1: 945ba0fc78217bd64a2c5f97f74a20708592c0d0
SHA256: 3198b142e34be6ef581d4b9a8681960c41f57c27812132de08e06de750316e20
Infos:

Detection

Score: 5
Range: 0 - 100
Whitelisted: false
Confidence: 0%

Signatures

Checks for available system drives (often done to infect USB drives)
Creates files inside the system directory
Deletes files inside the Windows folder
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Found dropped PE file which has not been started or loaded
PDF is encrypted
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Tries to load missing DLLs

Classification

Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z:
Source: C:\Windows\System32\msiexec.exe File opened: x:
Source: C:\Windows\System32\msiexec.exe File opened: v:
Source: C:\Windows\System32\msiexec.exe File opened: t:
Source: C:\Windows\System32\msiexec.exe File opened: r:
Source: C:\Windows\System32\msiexec.exe File opened: p:
Source: C:\Windows\System32\msiexec.exe File opened: n:
Source: C:\Windows\System32\msiexec.exe File opened: l:
Source: C:\Windows\System32\msiexec.exe File opened: j:
Source: C:\Windows\System32\msiexec.exe File opened: h:
Source: C:\Windows\System32\msiexec.exe File opened: f:
Source: C:\Windows\System32\msiexec.exe File opened: b:
Source: C:\Windows\System32\msiexec.exe File opened: y:
Source: C:\Windows\System32\msiexec.exe File opened: w:
Source: C:\Windows\System32\msiexec.exe File opened: u:
Source: C:\Windows\System32\msiexec.exe File opened: s:
Source: C:\Windows\System32\msiexec.exe File opened: q:
Source: C:\Windows\System32\msiexec.exe File opened: o:
Source: C:\Windows\System32\msiexec.exe File opened: m:
Source: C:\Windows\System32\msiexec.exe File opened: k:
Source: C:\Windows\System32\msiexec.exe File opened: i:
Source: C:\Windows\System32\msiexec.exe File opened: g:
Source: C:\Windows\System32\msiexec.exe File opened: e:
Source: C:\Windows\System32\msiexec.exe File opened: a:
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 23.196.176.131:443 -> 192.168.2.16:49714
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 23.196.176.131:443 -> 192.168.2.16:49714
Source: global traffic TCP traffic: 23.196.176.131:443 -> 192.168.2.16:49714
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 23.196.176.131:443 -> 192.168.2.16:49714
Source: global traffic TCP traffic: 23.196.176.131:443 -> 192.168.2.16:49714
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 23.196.176.131:443 -> 192.168.2.16:49714
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 23.196.176.131:443 -> 192.168.2.16:49714
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 23.196.176.131:443 -> 192.168.2.16:49714
Source: global traffic TCP traffic: 23.196.176.131:443 -> 192.168.2.16:49714
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 192.168.2.16:49714 -> 23.196.176.131:443
Source: global traffic TCP traffic: 23.196.176.131:443 -> 192.168.2.16:49714
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.176.131
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Creates files inside the system directory
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE59D.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE5FB.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE62B.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE64C.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE67B.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE69C.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE6BC.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE6EC.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE71C.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE73C.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE76C.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE78C.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE79D.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE7CD.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\SysWOW64\Elevation.tmp
Deletes files inside the Windows folder
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\MSIE59D.tmp
Tries to load missing DLLs
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: winhttp.dll
Source: classification engine Classification label: clean5.winPDF@19/42@0/33
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-03 08-35-37-986.log
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\SR_AD40BM0.1-A01N_A24-ENG.pdf"
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\SR_AD40BM0.1-A01N_A24-ENG.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1552 --field-trial-handle=1588,i,3979237204365230565,69821222064031274,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 06011184B17684BE71E822C1A4E57BDE
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1552 --field-trial-handle=1588,i,3979237204365230565,69821222064031274,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 06011184B17684BE71E822C1A4E57BDE
Source: Window Recorder Window detected: More than 3 window changes detected
Source: SR_AD40BM0.1-A01N_A24-ENG.pdf Initial sample: PDF keyword /JS count = 0
Source: SR_AD40BM0.1-A01N_A24-ENG.pdf Initial sample: PDF keyword /JavaScript count = 0
Source: SR_AD40BM0.1-A01N_A24-ENG.pdf Initial sample: PDF keyword /Encrypt count = 2
Source: SR_AD40BM0.1-A01N_A24-ENG.pdf Initial sample: PDF keyword stream count = 81
Source: SR_AD40BM0.1-A01N_A24-ENG.pdf Initial sample: PDF keyword /EmbeddedFile count = 0
Source: SR_AD40BM0.1-A01N_A24-ENG.pdf Initial sample: PDF keyword /ObjStm count = 14
Source: SR_AD40BM0.1-A01N_A24-ENG.pdf Initial sample: PDF keyword obj count = 86
PDF is encrypted
Source: SR_AD40BM0.1-A01N_A24-ENG.pdf Initial sample: PDF keyword /Encrypt
Drops PE files
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE59D.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE67B.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE73C.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE78C.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE71C.tmp Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE59D.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE67B.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE73C.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE78C.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE71C.tmp Jump to dropped file
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIE59D.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIE67B.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIE73C.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIE78C.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIE71C.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe Process information queried: ProcessInformation
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation