Style Straps Black Looking Comportable Womens Flip With Footbed Flop Glitter and Cool wnHOgZpq

Not all malicious and suspicious indicators are displayed. Get your own Reebok Zprint Women's 7 5 Black Shoe M US Running White WVN Her MTM qZqfra or the full version to view all details.

• Malicious Indicators 3

• Installation/Persistance
  • Writes data to a remote process

    details

    "" wrote 1500 bytes to a remote process "%TEMP%\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\{A2811D90-175B-43CD-8468-7209A034D5BA}\vc_redist.x86.exe" (Handle: 444)
    "" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\{A2811D90-175B-43CD-8468-7209A034D5BA}\vc_redist.x86.exe" (Handle: 444)
    "" wrote 32 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\{A2811D90-175B-43CD-8468-7209A034D5BA}\vc_redist.x86.exe" (Handle: 444)
    "" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\{A2811D90-175B-43CD-8468-7209A034D5BA}\vc_redist.x86.exe" (Handle: 444)
    "" wrote 1500 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 8)
    "" wrote 4 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 8)
    "" wrote 32 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 8)
    "" wrote 52 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 8)
    "vc_redist.x86.ex" wrote 1500 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\{A2811D90-175B-43CD-8468-7209A034D5BA}\vc_redist.x86.exe" (Handle: 180)
    "vc_redist.x86.ex" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\{A2811D90-175B-43CD-8468-7209A034D5BA}\vc_redist.x86.exe" (Handle: 180)
    "vc_redist.x86.ex" wrote 32 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\{A2811D90-175B-43CD-8468-7209A034D5BA}\vc_redist.x86.exe" (Handle: 180)
    "vc_redist.x86.ex" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\{A2811D90-175B-43CD-8468-7209A034D5BA}\vc_redist.x86.exe" (Handle: 180)

    source

    API Call

    relevance

    6/10

• System Security
  • References security related windows services

    details

    "wuauserv" (Indicator: "wuauserv")

    source

    String

    relevance

    7/10

• Unusual Characteristics
  • Checks for a resource fork (ADS) file

    details

    "vc_redist.x86.ex" checked file "C:"

    source

    API Call

    relevance

    5/10

• Suspicious Indicators 24

• Anti-Detection/Stealthyness
  • Contains ability to open/control a service

    details

    OpenServiceW@ADVAPI32.dll at 18838-1175-0041EE8C
    ControlService@ADVAPI32.dll at 18838-1178-0041EE11

    source

    Hybrid Analysis Technology

    relevance

    8/10

• Environment Awareness
  • Reads the active computer name

    details

    "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
    "vc_redist.x86.ex" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
    "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")

    source

    Registry Access

    relevance

    5/10

  • 37 PU Pumps Round Toe Shoes Soft Solid Women's WeiPoot White Closed Material TnHqq4

    details

    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")

    source

    Registry Access

    relevance

    10/10

• General
  • Contains ability to find and load resources of a specific module

    details

    FindResourceExA@KERNEL32.dll at 9734-491-1000A888

    source

    Hybrid Analysis Technology

    relevance

    1/10

  • Opened the service control manager

    details

    "vc_redist.x86.ex" called "OpenSCManager" requesting access rights "SC_MANAGER_CONNECT" (0x1)
    "msiexec.exe" called "OpenSCManager" requesting access rights "SC_MANAGER_CONNECT" (0x1)

    source

    API Call

    relevance

    10/10

  • Requested access to a system service

    details

    "vc_redist.x86.ex" called "OpenService" to access the "VSS" service
    "msiexec.exe" called "OpenService" to access the "ServicesActive" service requesting "SERVICE_QUERY_STATUS" (0X4) access rights
    "msiexec.exe" called "OpenService" to access the "gpsvc" service
    "msiexec.exe" called "OpenService" to access the "CryptSvc" service

    source

    API Call

    relevance

    10/10

  • Sent a control code to a service

    details

    "msiexec.exe" called "ControlService" and sent control code "0X24" to the service "gpsvc"
    "msiexec.exe" called "ControlService" and sent control code "0XFC" to the service "gpsvc"
    "msiexec.exe" called "ControlService" and sent control code "0X400" to the service "CryptSvc"

    source

    API Call

    relevance

    10/10

• Installation/Persistance
  • Drops executable files

    details

    "VC_redist.x86.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
    "wixstdba.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "vc_redist.x86.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"

    source

    Extracted File

    relevance

    10/10

  • Modifies auto-execute functionality by setting/creating a value in the registry

    details

    "" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: " ISSETUPPREREQUISISTES"; Value: ""C:\406c89577b889e9aa618a96e211d0940fabd2a29b668e9f05790c70add0a5630.exe"")

    source

    Registry Access

    relevance

    8/10

• Network Related
  • Contacts Random Domain Names

    details

    "crl.godaddy.com" seems to be random

    source

    Network Traffic

    relevance

    5/10

  • Found potential IP address in binary/memory

    details

    Heuristic match: "ScriptVer=1.0.0.1"

    source

    String

    relevance

    3/10

• Pattern Matching
  • Contains ability to download files from the internet

    details

    InternetReadFile@WININET.dll at 18838-1110-00426FC7

    source

    Hybrid Analysis Technology

    relevance

    10/10

• Remote Access Related
  • TAOFFEN Comfort Low Shoes Women Pumps Heel Green rBxHrqwC

    details

    "r3hK`h$ubl:dk*H4kvncflMj!lvLeLr"=_LfLGiM=:05h" (Indicator for product: Generic VNC)

    source

    String

    relevance

    10/10

• System Security
  • Modifies Software Policy Settings

    details

    "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS")
    "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")

    source

    Registry Access

    relevance

    10/10

• Unusual Characteristics
  • CRC value set in PE header does not match actual value

    details

    "wixstdba.dll" claimed CRC 184936 while the actual is CRC 579268
    "vc_redist.x86.exe" claimed CRC 13774667 while the actual is CRC 184936

    source

    Static Parser

    relevance

    10/10

  • Imports suspicious APIs

    details

    RegCreateKeyExW
    RegCloseKey
    RegDeleteKeyW
    SetSecurityDescriptorDacl
    OpenProcessToken
    RegOpenKeyExW
    LookupAccountNameW
    GetUserNameW
    RegEnumKeyExW
    RegDeleteValueW
    GetFileAttributesW
    GetTempPathW
    ConnectNamedPipe
    CopyFileW
    GetModuleFileNameW
    IsDebuggerPresent
    UnhandledExceptionFilter
    CreateThread
    TerminateProcess
    LoadLibraryW
    GetVersionExW
    GetTickCount
    OpenProcess
    GetStartupInfoW
    CreateDirectoryW
    DeleteFileW
    GetProcAddress
    GetTempFileNameW
    GetComputerNameW
    GetFileSizeEx
    FindNextFileW
    FindFirstFileW
    CreateFileW
    CreateFileA
    CreateFileMappingW
    GetCommandLineW
    CopyFileExW
    MapViewOfFile
    GetModuleHandleA
    GetModuleHandleW
    WriteFile
    CreateProcessW
    Sleep
    VirtualAlloc
    ShellExecuteExW
    HttpQueryInfoW
    InternetConnectW
    InternetCrackUrlW
    InternetCloseHandle
    HttpSendRequestW
    InternetReadFile
    InternetOpenW
    FindResourceExA
    GetModuleFileNameA
    LockResource
    GetCommandLineA
    GetUpdateRect

    source

    Static Parser

    relevance

    1/10

  • Reads information about supported languages

    details

    "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
    "vc_redist.x86.ex" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
    "msiexec.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME")
    "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")

    source

    Registry Access

    relevance

    3/10

• Hiding 7 Suspicious Indicators
  • All indicators are available only in the private webservice or standalone version

• Informative 21

• Anti-Reverse Engineering
  • Contains ability to register a top-level exception handler (often used as anti-debugging trick)

    details

    SetUnhandledExceptionFilter@KERNEL32.dll at 18838-1819-004290B2

    source

    Hybrid Analysis Technology

    relevance

    1/10

• Environment Awareness
  • Contains ability to query machine time

    details

    GetSystemTime@KERNEL32.dll at 18838-1087-004098DB
    GetSystemTimeAsFileTime@KERNEL32.dll at 18838-1125-00427516

    source

    Hybrid Analysis Technology

    relevance

    1/10

  • White Teva Women's Original Sandal Solid qw0Pz4Iw

    details

    GetVersionExW@KERNEL32.dll at 18838-1069-00409028

    source

    Hybrid Analysis Technology

    relevance

    1/10

  • Contains ability to query the system locale

    details

    GetUserDefaultUILanguage@KERNEL32.dll at 9734-459-10005A48

    source

    Hybrid Analysis Technology

    relevance

    1/10

  • Reads the registry for installed applications

    details

    "" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\VC_REDIST.X86.EXE")
    "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\VC_REDIST.X86.EXE")
    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL")
    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK")
    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI")
    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3")
    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER")
    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX")
    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME")
    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE")
    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40")
    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA")
    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX")
    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA")
    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA0")
    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA1")
    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA10")
    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA100")
    "vc_redist.x86.ex" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA101")

    source

    Registry Access

    relevance

    10/10

• External Systems
  • Sample was identified as clean by Antivirus engines

    details

    0/63 Antivirus vendors marked sample as malicious (0% detection rate)

    source

    External System

    relevance

    10/10

• General
  • Accesses Software Policy Settings

    details

    "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
    "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
    "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
    "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
    "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")
    "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "")
    "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "")
    "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")

    source

    Registry Access

    relevance

    10/10

  • Accesses System Certificates Settings

    details

    "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "")
    "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
    "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
    "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB")
    "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB")
    "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB")
    "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
    "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB")
    "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
    "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")

    source

    Registry Access

    relevance

    10/10

  • Contacts domains

    details

    "ocsp.godaddy.com"
    "crl.godaddy.com"

    source

    Network Traffic

    relevance

    1/10

  • Contains PDB pathways

    details

    "C:\CodeBases\isdev\src\Runtime\MSI\Shared\Setup\Setup___Win32_Release_Prerequisites_Unicode\setupPreReq.pdb"
    "E:\delivery\Dev\wix37\build\ship\x86\burn.pdb"
    "E:\delivery\Dev\wix37\build\ship\x86\WixStdBA.pdb"

    source

    String

    relevance

    1/10

  • Creates a writable file in a temporary directory

    details

    "" created file "%TEMP%\_MSI5166._IS"
    "" created file "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\Setup.INI"
    "" created file "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\_ISMSIDEL.INI"
    "" created file "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\0x0407.ini"
    "" created file "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\0x0409.ini"
    "" created file "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\0x040a.ini"
    "" created file "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\0x040c.ini"
    "" created file "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\0x0410.ini"
    "" created file "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\0x0413.ini"
    "" created file "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\0x041d.ini"
    "" created file "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\0x0809.ini"
    "" created file "C:\Users\%USERNAME%\AppData\Local\Temp\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\0x0816.ini"

    source

    API Call

    relevance

    1/10

  • Creates mutants

    details

    "\Sessions\1\BaseNamedObjects\Global\WindowsUpdateTracingMutex"
    "Global\WindowsUpdateTracingMutex"

    source

    Created Mutant

    relevance

    3/10

  • Drops files marked as clean

    details

    Antivirus vendors marked dropped file "VC_redist.x86.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "wixstdba.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "license.rtf" as clean (type is "Rich Text Format data version 1 ANSI")

    source

    Extracted File

    relevance

    10/10

  • Loads rich edit control libraries

    details

    "vc_redist.x86.ex" loaded module "%WINDIR%\System32\riched20.dll" at 6A690000

    source

    Loaded Module

  • Reads Windows Trust Settings

    details

    "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING"; Key: "STATE")

    source

    Registry Access

    relevance

    5/10

  • Spawns new processes

    details

    Spawned process "vc_redist.x86.ex" with commandline "e" /q /norestart" ( Show Process), Spawned process "vc_redist.x86.ex" with commandline "e" /q /norestart -burn.unelevated BurnPipe.{BED50601-1243-4A79-90C7-8E7BE076649E} {8484A276-3C9F-4D9B-970B-81B4FFAE2EC4} 2720" ( Show Process)
    Spawned process "msiexec.exe" with commandline "/i "%TEMP%\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\LibreViewDeviceDrivers.msi" TRANSFORMS="%TEMP%\{6FEC4497-D54B-47EF-991A-6C92BC26CAA6}\1033.MST" SETUPEXEDIR="C:" SETUPEXENAME="406c89577b889e9aa618a96e211d0940fabd2a29b668e9f05790c70add0a5630.exe"" ( Show Process)

    source

    Monitored Target

    relevance

    3/10

• Installation/Persistance
  • Contains ability to lookup the windows account name

    details

    GetUserNameW@ADVAPI32.dll at 18838-1091-00409AB0

    source

    Hybrid Analysis Technology

    relevance

    5/10

  • Women's Raven ROSE Keen Gargoyle Sandals Aq7Cxn

    details

    "VC_redist.x86.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
    "wixstdba.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
    "1033.MST" has type "Composite Document File V2 Document Little Endian O%WINDIR%\Version 6.2 Code page: 1252 Title: Installation Database Subject: LibreView Device Drivers Author: Newyu Keywords: InstallerMSIDatabase Comments: This installer database contains the data required to install the LibreView Device Drivers. Create Time/Date: Tue Aug 15 17:24:18 2017 Name of Creating Application: InstallShield 2013 - Premier Edition with Virtualization Pack 20 Security: 1 Template: Intel;01033104320573084103610311040207010341053 Last Saved By: Intel;1033 Revision Number: {A8859735-44FA-4706-B906-BE969AE2F25A}2.1.3;{A8859735-44FA-4706-B906-BE969AE2F25A}2.1.3;{1CE48AD9-9F14-46C3-ACB7-4884D8DEA010} Number of Pages: 200 Number of Characters: 1"
    "LibreViewDeviceDrivers.msi" has type "Composite Document File V2 Document Can't read SAT"
    "vc_redist.x86.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
    "CabB7E0.tmp" has type "Microsoft Cabinet archive data 50939 bytes 1 file"
    "thm.wxl" has type "XML 1.0 document UTF-8 Unicode text with CRLF line terminators"
    "~DD47.tmp" has type "Little-endian UTF-16 Unicode text with CRLF CR line terminators"
    "license.rtf" has type "Rich Text Format data version 1 ANSI"
    "~DE25.tmp" has type "Little-endian UTF-16 Unicode text with CRLF CR line terminators"
    "0x0413.ini" has type "Little-endian UTF-16 Unicode text with very long lines with CRLF CR line terminators"
    "56ADBB1837AFF6D7FD308FFF42A6DE9E_E99D756EDE8B4828A303032D402999E9" has type "data"
    "0x040c.ini" has type "Little-endian UTF-16 Unicode text with very long lines with CRLF CR line terminators"
    "BootstrapperApplicationData.xml" has type "XML 1.0 document Little-endian UTF-16 Unicode text with very long lines with CRLF line terminators"
    "0x0409.ini" has type "Little-endian UTF-16 Unicode text with very long lines with CRLF CR line terminators"
    "0x0c0c.ini" has type "Little-endian UTF-16 Unicode text with very long lines with CRLF CR line terminators"

    source

    Extracted File

    relevance

    3/10

  • Touches files in the Windows directory

    details

    "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
    "" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui"
    "" touched file "C:\Windows\Fonts\StaticCache.dat"
    "" touched file "C:\Windows\System32\en-US\msctf.dll.mui"
    "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"
    "" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db"
    "" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db"
    "" touched file "C:\Windows\System32\en-US\propsys.dll.mui"
    "" touched file "C:\Windows\System32\en-US\setupapi.dll.mui"
    "" touched file "C:\Windows\AppPatch\sysmain.sdb"
    "" touched file "C:\Windows\System32\imageres.dll"
    "" touched file "C:\Windows\System32\en-US\imageres.dll.mui"
    "" touched file "C:\Windows\System32\en-US\user32.dll.mui"
    "" touched file "C:\Windows\System32\msiexec.exe"
    "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"

    source

    API Call

    relevance

    7/10

• Network Related
  • Found potential URL in binary/memory

    details

    Heuristic match: "cmE/gZ.yT"
    Heuristic match: "%RGi-p.Mm"
    Heuristic match: "te% Pattern match: "oy.wQ/{}j"
    Pattern match: "http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d"
    Pattern match: "http://schemas.microsoft.com/wix/2010/BootstrapperApplicationData"
    Heuristic match: "HEAD /edgedl/release2/Hcq1Yqsih2A/57.0.2987.133_56.0.2924.87_chrome_updater.exe HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    User-Agent: Microsoft BITS/7.5
    X-Old-UID: cnt=0
    X-Last-HR: 0x80042194
    X-Last-HTTP-Status-Code: 404
    "
    Pattern match: "http://crl.godaddy.com/repository/gdroot-g2.crl0J"
    Pattern match: "http://crl.godaddy.com/repository/0"
    Pattern match: "http://certs.godaddy.com/repository/1301"
    Pattern match: "http://crl.godaddy.com/repository/mastergodaddy2issuing.crl0J"
    Pattern match: "http://crl.godaddy.com/gdig2s5-1.crl0"
    Heuristic match: "ocsp.godaddy.com"
    Heuristic match: "crl.godaddy.com"
    Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings"
    Pattern match: "go.microsoft.com/fwlink/?LinkID=523763&clcid=0x409"
    Pattern match: "go.microsoft.com/fwlink/?LinkID=528096&clcid=0x409"
    Pattern match: "www.microsoft.com/exporting}}{\fldrslt{\ul\cf3"
    Pattern match: "http://certs.godaddy.com/repository/1301U*Go"
    Pattern match: "http://crl.godaddy.com/gdig2s5-1.crl0]U"
    Pattern match: "http://crl.thawte.com/ThawteTimestampingCA.crl0U%0"
    Pattern match: "www.NewYu.com0"
    Pattern match: "https://www.verisign.com/rpa"
    Pattern match: "http://csc3-2010-crl.verisign.com/CSC3-2010.crl0DU"
    Pattern match: "http://csc3-2010-aia.verisign.com/CSC3-2010.cer0U#0{&K&0`HB0"
    Pattern match: "http://www.flexerasoftware.com0"
    Pattern match: "https://%V44&VlW&V8%toys::file"
    Pattern match: "http://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl720\margr720\margt720\margb720\gutter0\ltrsect"
    Pattern match: "http://www.libreview.com"
    Pattern match: "www.libreview.com}}}\sectd"
    Pattern match: "www.numera.com/privacy"
    Heuristic match: "telephone at (888) 253-5001,\line \bullet \tab }{\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid6961079 or by email at privacy@numera.com"
    Pattern match: "http://www.export.gov/safeharbor/"
    Heuristic match: "\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid5654732 700}{\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid6961079 \line Seattle, WA 98101\line support@Numera.com"
    Heuristic match: "\par You can reach us:\line \bullet \tab by mail at 1201 3rd Avenue, Suite 700, Seattle, WA 98101,\line \bullet \tab by telephone at (888) 253-5001,\line \bullet \tab or by email at privacy@numera.com"
    Heuristic match: "\par Webmaster\line Numera, Inc.\line 1201 3rd Avenue, Suite 700\line Seattle, WA 98101\line support@Numera.com"
    Pattern match: "e2c.Bi/L`E.=BGy2j0]5R_%r#"
    Pattern match: "f.nwAc/?1"
    Pattern match: "l3sm.PgO/iWpZH',|"
    Heuristic match: "@R:iAVAYWCz_fPf}C5q?hB#BM@bfH#NX~;dgcgZ=2&,im=+`1*Du>A>Wj4>Zcv:Hdk5du~0fHZ,00|X7.j&%6)9X_I<-jhL![-\ubl+-L(PSbfzi6Sz!!.bb"
    Pattern match: "dDm59WlJ.UC/w}auO7J.Bq5gDAfbP0eH1tV\p3z.`h"
    Pattern match: "g.fV/^~zR@H;WK}';4XB"
    Heuristic match: "i#X]c2XC1b/|c.mE"
    Pattern match: "6JaZ.qaC/dBi,Fggz"
    Pattern match: "e.iL/9DDPau}o~Q2ef&Joh"
    Heuristic match: "lT65}1_h#IJi\UQb:S.aO"
    Heuristic match: "}H{h1eE*bj`se,*ZZ8_@4:onAKI=gAB.S1B{pq[sm}o0D.Ph"
    Heuristic match: "Eeql/n9&O+N'@&w&/kQ?)_>s|P&MTw*1F Pattern match: "Q.aL/Yc$oPQZ"
    Pattern match: "ZCXHX.pT/3L9|o"
    Pattern match: "Aw.Ad/fhW(/)=m.eE1"
    Heuristic match: "jUS:}j5lN!+umm&Rctm.2I*cZHfW_5:]zjRzZC Pattern match: "WwW.tW.vW.u2W.w"
    Pattern match: "ZH7A.Yo/+8/?#c3jGA:yrf/UV$gVDj5E+V`I32Rvg0$"
    Pattern match: "cP.zip/^D"
    Heuristic match: "NADv0 d(OgQ~r7)obQ/[QjT_O\.Q}[HkiXc}XTWV5-Z\r~ C`JPnSXK|)RJ--^$L8E?U}mYfL)5H|cEb@R==.5'r^du])K.Fm"
    Heuristic match: "/{d+.Bs"
    Heuristic match: "66&ymJ=_]P@X6}7@p P Pattern match: "r.Is/^{r|Oc[pu~N$,x5#9$W3~c@=z#L|959B"
    Heuristic match: "P_Y}}5zc;}[S-0AGE-o3dy\F{.TZ"
    Pattern match: "Zn.xu.Cw/BATfu5jHH}NH5R"
    Heuristic match: "de:On$2e#CbY*Bk,O4.KN"
    Pattern match: "Eo.AV/iuYP"
    Pattern match: "Vt.hVTN/Y9"
    Pattern match: "yFw4.trC/9_JCZ~{'BX@s^XH"
    Pattern match: "3R8Mc7.vA/:f"
    Heuristic match: "ffAZQ.RW"
    Pattern match: "wC.ta/vT"
    Pattern match: "y4pu.ar/W1h"
    Heuristic match: "Z9MJ>(SCUy}5%Q2i!-*OxTELO2kOwM%pEIvrI.pW"
    Heuristic match: ";`3zY}.Cl"
    Heuristic match: "]*%IBU:DiKIbDNcl.gD"
    Heuristic match: "S-WAEFxgi4!o'06$>cV9-`?E4E]G^WJ/N Heuristic match: "D$^QMF,o5ll hq04TZ+{WVN.bV"
    Heuristic match: "1E)/~r*Zp|[1]XVW0_EYc1w%`xV=>>,X.o`=>:WJHb q&R8;sG4=^I,2IVA.Cu"
    Pattern match: "BQoMb.rOC/e*:*kM&0USX%pWKnV$so,NyB!sHvB0gr"
    Pattern match: "e9.eS/.kka#,a[Ck8wb8rr;dcE*&UE\Z"
    Pattern match: "HjN.CNx/u-9MB{]7YZ3I"
    Heuristic match: "WjF\.UlV-Wh(fH\O7fksH42WG+F6Z)7`ksJ1.Ng"
    Heuristic match: ">EUFUd.bv~4Ueu^KY&I&61R]B.ZW"
    Heuristic match: "v#`.Uz"
    Pattern match: "Qu.Yw/{v"
    Pattern match: "Z.hd/}wGIgcD+iR,uZ9UHch+uJ'-QMKKkU'FCYs#bHS"
    Pattern match: "Gg.so/Y+11BK+c;P$m"
    Pattern match: "Y.SHC/ea%`a]6l[L8eAWUgQk#S~a"
    Heuristic match: "G>=\v+\48f8_`xPUSUK2oPHpS)Z7<$n`-./{@6iAj?1morVgrcz53owwDg6QfYx0G{SWYrc4`vj8j\r(c4k.md"
    Pattern match: "U2Qnl1w.BV/1iM6.LrATF7"
    Heuristic match: "}+fd_96]]aA2V!C.rW"
    Pattern match: "KNlO.Yg/#n"
    Pattern match: "Cw4.SwnR/@7(7y5{.RM)_FR"
    Pattern match: "9.iUTj/dHE+Y*,QtY!M-G:1l&'U*m1EVEAMRr"
    Heuristic match: "iMDH._SmuoMQ6[U74!9?@8Gzt]qGxhgYxIjUTh6R M2EIRZ0H(or|s><{9WbW2.Jc[iueVceS1YJg,d8c'j,fF}>CZGcc1fre*v%?wey7xcuxv@I0V~'sPc_Eg-UoRS0c4X>5%D#[8I&%G(f,L]Gg|dcDolK2]:kl9e]Gq5qv9L5Bd=TKNx*B2.j@kxnL!*e.5{j]e.(uI>i>)e.U tm]LlA?t9.Lu"
    Pattern match: "w.joRr/|BRjZb_,=`Zjis2`Za-_-[J,[N-Zc?Zg?yqA7s46Bin^{(6hn^)~k!Sn^"
    Heuristic match: "/'h3mlwhzYv)8}vVz(VWgpH*+V6k@{6~6t Pattern match: "Mv..vw/qn=_Mz5f=p^Yz/A_"
    Pattern match: "B.eNz/nHp7#}*Mo9'F"
    Pattern match: "2qz.cl/F%f_CS"
    Heuristic match: "3..BF"
    Pattern match: "rpBvA5hfvu07awsY.dhn/%9{OxI|al"
    Heuristic match: "t{ID8 Heuristic match: "Ua'7vU)EX\\V8z[~`g;50uyn.ps"
    Pattern match: "ZQ.OS/@O/"
    Heuristic match: "$m~6vB6 Pattern match: "i.NyE/&N^"
    Pattern match: "p5.S.pcLl/{^FNWAZx"
    Pattern match: "E0rh.Fo/F,is=~q_G3"
    Pattern match: "K0lL.HHV/{i|G"
    Pattern match: "7.BH/,0ZE6-8RQw;?dD;9{y!OyfRb4mOhzJK+,B7"
    Heuristic match: "H!Ie[T2JjgT r!8'KaM;xH0kG0+y=.GVy4W,;|wG[Hcv%,5.tH"
    Pattern match: "http://schemas.microsoft.com/wix/2006/localization"
    Pattern match: "http://go.microsoft.com/fwlink/?LinkID=523763&clcid=0x409}}{\fldrslt{\ul\cf1"
    Pattern match: "http://go.microsoft.com/fwlink/?LinkID=528096&clcid=0x409}}{\fldrslt{\ul\cf1"
    Pattern match: "http://www.microsoft.com/exporting"

    source

    String

    relevance

    10/10

• Unusual Characteristics
  • Matched Compiler/Packer signature

    details

    "VC_redist.x86.exe" was detected as "VC8 -> Microsoft Corporation"
    "wixstdba.dll" was detected as "Visual C++ 2005 DLL -> Microsoft"
    "vc_redist.x86.exe" was detected as "VC8 -> Microsoft Corporation"

    source

    Static Parser

    relevance

    10/10

DNS Requests

Contacted Hosts

No relevant hosts were contacted.

HTTP Traffic

No relevant HTTP requests were made.