Analysis
- max time kernel
142s - max time network
142s - platform
windows10_x64 - resource
win10 - submitted
08/10/2020, 07:38
Static task
static1
Behavioral task
behavioral1
Sample
e8002fbc4bd5e57fd317fb99e3bb2bc8965e94761e37757aed51f3f21486c0ad.msi
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e8002fbc4bd5e57fd317fb99e3bb2bc8965e94761e37757aed51f3f21486c0ad.msi
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target e8002fbc4bd5e57fd317fb99e3bb2bc8965e94761e37757aed51f3f21486c0ad.msi
- Size 6.7MB
- Sample201008-34xyn95xde
- SHA256 e8002fbc4bd5e57fd317fb99e3bb2bc8965e94761e37757aed51f3f21486c0ad
- MD5 e1973f7c9578df9bbb776a4e5d771fac
- SHA1 c848fd470ec77b8cfa4beccbe368780589e637be
- SHA512 6f679b48ef7b7dedf61e064fc887fd7bf64b09d7e10721b7d1d9133124fb4daac54c2fd6400e0f757feacafd65495601d28a305017d177209a46cb81c3b3fd28
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- ServiceHost packer 10 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/2980-53-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2980-54-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2980-55-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2980-56-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2980-57-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2980-75-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2980-76-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2980-77-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2980-78-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2980-80-0x0000000000000000-mapping.dmp servicehost - Blacklisted process makes network request 4 IoCs
flow pid Process 8 3608 msiexec.exe 10 3608 msiexec.exe 12 3608 msiexec.exe 14 3608 msiexec.exe - Executes dropped EXE 15 IoCs
pid Process 496 Setup.exe 4028 Setup.tmp 2980 build.exe 4356 7z.exe 4424 7z.exe 4484 7z.exe 4520 7z.exe 4552 7z.exe 4584 7z.exe 4632 7z.exe 4792 7z.exe 4840 7z.exe 4904 7z.exe 4964 7z.exe 5012 Setup.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setup.exe - Loads dropped DLL 16 IoCs
pid Process 752 MsiExec.exe 4028 Setup.tmp 4152 MsiExec.exe 752 MsiExec.exe 4356 7z.exe 4424 7z.exe 4484 7z.exe 4520 7z.exe 4552 7z.exe 4584 7z.exe 4632 7z.exe 4792 7z.exe 4840 7z.exe 4904 7z.exe 4964 7z.exe 5012 Setup.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Modifies service 2 TTPs 163 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer\IDENTIFY (Leave) = 480000000000000079b6f97d459dd601ac0500009c080000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState) = 48000000000000008000e186459dd601ac050000080900000400000001000000030000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\THAW (Enter) = 48000000000000009c62e386459dd601ac0500008c080000f203000001000000030000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppGetSnapshots (Leave) = 4800000000000000aa700a8e459dd601dc08000060010000d20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 srtasks.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_BEGINPREPARE (Leave) = 4800000000000000e41b7584459dd601ac0500009c0800000104000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_ENDPREPARE (Leave) = 48000000000000002078f384459dd601ac050000bc0f00000204000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\VSS_WS_WAITING_FOR_FREEZE (SetCurrentState) = 4800000000000000fe9c3885459dd601ac050000040600000200000001000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\FREEZE_SYSTEM (Leave) = 4800000000000000dbf9b685459dd601ac050000bc0f0000ee03000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\BKGND_FREEZE_THREAD (Enter) = 4800000000000000b035b285459dd601ac0500007c0e0000fc03000001000000030000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\FREEZE (Enter) = 48000000000000003abfbb85459dd601ac05000004060000eb03000001000000020000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_PRECOMMIT (Leave) = 4800000000000000a2ca6986459dd601ac050000bc0f00000304000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\BKGND_FREEZE_THREAD (Leave) = 48000000000000008000e186459dd601ac050000cc0a0000fc03000000000000030000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\GETSTATE (Enter) = 48000000000000002db7b084459dd601ac0500009c080000f903000001000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\PREPARESNAPSHOT (Leave) = 4800000000000000fe9c3885459dd601ac05000004060000ea03000000000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\VSS_WS_WAITING_FOR_THAW (SetCurrentState) = 4800000000000000dcbf9c85459dd601ac050000040600000300000001000000020000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\GETSTATE (Enter) = 48000000000000002db7b084459dd601ac05000068060000f903000001000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\FREEZE (Enter) = 4800000000000000dcbf9c85459dd601ac050000bc0f0000eb03000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\BKGND_FREEZE_THREAD (Leave) = 48000000000000009c62e386459dd601ac0500007c0e0000fc03000000000000030000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppGetSnapshots (Leave) = 480000000000000063862887459dd601dc08000060010000d20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 srtasks.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\THAW (Leave) = 48000000000000009c62e386459dd601ac050000bc0f0000f203000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\POSTSNAPSHOT (Enter) = 480000000000000014e6f686459dd601ac0500008c080000f503000001000000040000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher\IDENTIFY (Leave) = 4800000000000000f5141e80459dd60144070000000a0000e803000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher\DOSNAPSHOT (Enter) = 48000000000000006406bf84459dd60144070000000500000a04000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\THAW (Enter) = 4800000000000000b73cbd86459dd601ac050000bc0f0000f203000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\BKGND_FREEZE_THREAD (Leave) = 48000000000000009c62e386459dd601ac0500008c0e0000fc03000000000000030000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\POSTSNAPSHOT (Leave) = 480000000000000013d7f886459dd601ac05000008090000f503000000000000040000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\POSTSNAPSHOT (Leave) = 4800000000000000939afd86459dd601ac0500008c080000f503000000000000040000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppEnumGroups (Leave) = 480000000000000011d40c8e459dd601dc08000060010000d10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000 srtasks.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_COMMIT (Leave) = 4800000000000000f177b886459dd601ac050000b40e00000404000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher\DOSNAPSHOT (Leave) = 4800000000000000b73cbd86459dd601440700009c0d00000a04000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\POSTSNAPSHOT (Leave) = 480000000000000014e6f686459dd601ac05000008090000f503000000000000040000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace\OPEN_VOLUME_HANDLE (Enter) = 4800000000000000a2ca6986459dd601ac050000bc0f0000fd03000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppCreate (Leave) = 4800000000000000d2b3d286459dd6014407000000050000d00700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\THAW (Leave) = 48000000000000009c62e386459dd601ac05000008090000f203000000000000030000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher\GETSTATE (Enter) = 4800000000000000e0f1ab84459dd601440700005c090000f903000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\PREPARESNAPSHOT (Leave) = 4800000000000000dcbf9c85459dd601ac050000bc0f0000ea03000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace\IOCTL_FLUSH_AND_HOLD (Leave) = 4800000000000000f177b886459dd601ac050000bc0f0000fe03000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace\IOCTL_RELEASE (Enter) = 4800000000000000f177b886459dd601ac050000bc0f0000ff0300000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState) = 48000000000000009c62e386459dd601ac050000080900000400000001000000030000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_ENDPREPARE (Enter) = 48000000000000006406bf84459dd601ac050000bc0f00000204000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\THAW_KTM (Leave) = 4800000000000000b73cbd86459dd601ac050000bc0f0000f403000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\POSTSNAPSHOT (Enter) = 480000000000000014e6f686459dd601ac05000008090000f503000001000000040000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\IDENTIFY (Leave) = 480000000000000096f1f47d459dd601ac0500006c060000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace(__?_Volume{9563bb1f-0000-0000-0000-500600000000}_) vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\BKGND_FREEZE_THREAD (Enter) = 4800000000000000dcbf9c85459dd601ac050000cc0a0000fc03000001000000030000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace(__?_Volume{9563bb1f-0000-0000-0000-500600000000}_)\OPEN_VOLUME_HANDLE (Enter) = 4800000000000000a2ca6986459dd601ac050000840e0000fd03000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\THAW (Enter) = 48000000000000009c62e386459dd601ac05000008090000f203000001000000030000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\POSTSNAPSHOT (Enter) = 48000000000000009f12f486459dd601ac050000bc0f0000f503000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\VSS_WS_STABLE (SetCurrentState) = 4800000000000000e8437c84459dd601ac050000680600000100000001000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\GETSTATE (Leave) = 48000000000000002db7b084459dd601ac0500009c080000f903000000000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\FREEZE_SYSTEM (Enter) = 4800000000000000b035b285459dd601ac050000bc0f0000ee03000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore\SrCreateRp (Leave) = 48000000000000000a14d586459dd6014407000000050000d50700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\PREPARESNAPSHOT (Leave) = 480000000000000028773185459dd601ac05000078090000ea03000000000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\FREEZE_BACK (Enter) = 4800000000000000e1aba885459dd601ac050000bc0f0000ed03000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppEnumGroups (Leave) = 4800000000000000aa700a8e459dd601dc08000060010000d10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000 srtasks.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppGetSnapshots (Enter) = 4800000000000000aa700a8e459dd601dc08000060010000d20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 srtasks.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppEnumGroups (Leave) = 4800000000000000c01add7d459dd6014407000000050000d10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppGatherWriterMetadata (Enter) = 48000000000000005868eb7d459dd6014407000000050000d30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppGatherWriterMetadata (Leave) = 4800000000000000205df483459dd6014407000000050000d30700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\GETSTATE (Leave) = 48000000000000002db7b084459dd601ac05000068060000f903000000000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace\IOCTL_RELEASE (Leave) = 4800000000000000f177b886459dd601ac050000bc0f0000ff0300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppEnumGroups (Leave) = 48000000000000000f4a2d87459dd601dc08000060010000d10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000 srtasks.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_POSTFINALCOMMIT (Leave) = 48000000000000001f373987459dd601ac050000bc0f00000704000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher\PREPAREBACKUP (Enter) = 4800000000000000e41b7584459dd60144070000f0010000e903000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\PREPAREBACKUP (Enter) = 4800000000000000e8e07984459dd601ac05000074060000e903000001000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\PREPAREBACKUP (Leave) = 4800000000000000e8437c84459dd601ac05000068060000e903000000000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace(__?_Volume{9563bb1f-0000-0000-0000-500600000000}_)\OPEN_VOLUME_HANDLE (Leave) = 4800000000000000ba3d9e86459dd601ac050000840e0000fd03000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP srtasks.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\IDENTIFY (Enter) = 48000000000000008690f27d459dd601ac05000074060000e80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\PREPARESNAPSHOT (Enter) = 4800000000000000dbff1b85459dd601ac050000a8080000ea03000001000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\THAW (Leave) = 48000000000000008000e186459dd601ac05000008090000f203000000000000030000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag srtasks.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\PREPAREBACKUP (Leave) = 48000000000000002da67e84459dd601ac0500009c080000e903000000000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\VSS_WS_WAITING_FOR_FREEZE (SetCurrentState) = 4800000000000000c53a3685459dd601ac050000a80800000200000001000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\FREEZE_RM (Leave) = 4800000000000000a2ca6986459dd601ac050000bc0f0000ef03000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace(__?_Volume{9563bb1f-0000-0000-0000-500600000000}_)\IOCTL_RELEASE (Enter) = 4800000000000000f177b886459dd601ac050000840e0000ff03000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\VSS_WS_WAITING_FOR_FREEZE (SetCurrentState) = 480000000000000028773185459dd601ac050000780900000200000001000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\BACKUPSHUTDOWN (Leave) = 48000000000000001f373987459dd601ac050000a8080000fb03000000000000050000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\BACKUPSHUTDOWN (Leave) = 480000000000000094983b87459dd601ac050000bc0f0000fb03000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\GETSTATE (Leave) = 48000000000000002db7b084459dd601ac0500009c080000f903000000000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher\GETSTATE (Leave) = 48000000000000002db7b084459dd601440700005c090000f903000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace(__?_Volume{9563bb1f-0000-0000-0000-500600000000}_)\IOCTL_RELEASE (Leave) = 4800000000000000f177b886459dd601ac050000840e0000ff03000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppGetSnapshots (Enter) = 480000000000000045991c87459dd601dc08000060010000d20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 srtasks.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\FREEZE_KTM (Leave) = 4800000000000000dbf9b685459dd601ac050000bc0f0000f003000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\FREEZE_RM (Enter) = 4800000000000000dbf9b685459dd601ac050000bc0f0000ef03000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\FREEZE (Leave) = 4800000000000000a2ca6986459dd601ac05000004060000eb03000000000000020000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\BKGND_FREEZE_THREAD (Enter) = 4800000000000000a2ca6986459dd601ac0500008c0e0000fc03000001000000030000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore\SrCreateRp (Enter) = 4800000000000000eb31b27d459dd6014407000000050000d50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer\IDENTIFY (Enter) = 48000000000000008690f27d459dd601ac0500009c080000e80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\GETSTATE (Enter) = 48000000000000002db7b084459dd601ac0500009c080000f903000001000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\PREPARESNAPSHOT (Leave) = 4800000000000000c53a3685459dd601ac050000a8080000ea03000000000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\POSTSNAPSHOT (Enter) = 480000000000000014e6f686459dd601ac05000008090000f503000001000000040000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppGetSnapshots (Enter) = 4800000000000000c90c088e459dd601dc08000060010000d20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 srtasks.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\VSS_WS_STABLE (SetCurrentState) = 48000000000000002da67e84459dd601ac0500009c0800000100000001000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\VSS_WS_WAITING_FOR_THAW (SetCurrentState) = 4800000000000000b035b285459dd601ac050000040600000300000001000000020000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace(__?_Volume{9563bb1f-0000-0000-0000-500600000000}_)\IOCTL_FLUSH_AND_HOLD (Enter) = 4800000000000000ba3d9e86459dd601ac050000840e0000fe03000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\BACKUPSHUTDOWN (Leave) = 48000000000000001f373987459dd601ac050000a8080000fb03000000000000050000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_POSTCOMMIT (Leave) = 480000000000000005daba86459dd601ac050000bc0f00000504000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\IDENTIFY (Leave) = 48000000000000007055f77d459dd601ac05000074060000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\VSS_WS_WAITING_FOR_THAW (SetCurrentState) = 4800000000000000a2ca6986459dd601ac050000040600000300000001000000020000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_POSTCOMMIT (Enter) = 4800000000000000f177b886459dd601ac050000bc0f00000504000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_POSTFINALCOMMIT (Enter) = 4800000000000000635e2187459dd601ac050000bc0f00000704000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppEnumGroups (Enter) = 480000000000000031e82a87459dd601dc08000060010000d10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 srtasks.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_BEGINPREPARE (Enter) = 4800000000000000e41b7584459dd601ac0500009c0800000104000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\VSS_WS_STABLE (SetCurrentState) = 4800000000000000e8e07984459dd601ac050000740600000100000001000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\THAW_KTM (Enter) = 4800000000000000b73cbd86459dd601ac050000bc0f0000f403000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\PREPARESNAPSHOT (Enter) = 4800000000000000dbff1b85459dd601ac05000078090000ea03000001000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace(__?_Volume{9563bb1f-0000-0000-0000-500600000000}_)\IOCTL_FLUSH_AND_HOLD (Leave) = 4800000000000000f177b886459dd601ac050000840e0000fe03000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppEnumGroups (Enter) = 4800000000000000aa700a8e459dd601dc08000060010000d10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 srtasks.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher\IDENTIFY (Enter) = 48000000000000006acaed7d459dd60144070000000a0000e803000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\IDENTIFY (Enter) = 48000000000000008690f27d459dd601ac0500006c060000e80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\FREEZE_KTM (Enter) = 4800000000000000dbf9b685459dd601ac050000bc0f0000f003000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\BACKUPSHUTDOWN (Enter) = 48000000000000001f373987459dd601ac050000a8080000fb03000001000000050000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\PREPARESNAPSHOT (Enter) = 48000000000000000b3df884459dd601ac050000bc0f0000ea03000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\FREEZE (Leave) = 4800000000000000b035b285459dd601ac05000004060000eb03000000000000020000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) = 480000000000000014e6f686459dd601ac050000080900000500000001000000040000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\FREEZE_FRONT (Enter) = 4800000000000000dcbf9c85459dd601ac050000bc0f0000ec03000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\FREEZE_FRONT (Leave) = 4800000000000000e1aba885459dd601ac050000bc0f0000ec03000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace\IOCTL_FLUSH_AND_HOLD (Enter) = 4800000000000000ba3d9e86459dd601ac050000bc0f0000fe03000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState) = 48000000000000009c62e386459dd601ac0500008c0800000400000001000000030000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppGetSnapshots (Enter) = 4800000000000000eb31b27d459dd6014407000000050000d20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\IDENTIFY (Leave) = 480000000000000096f1f47d459dd601ac05000068060000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppAddInterestingComponents (Leave) = 480000000000000001f72f84459dd6014407000000050000d40700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) = 480000000000000013d7f886459dd601ac050000080900000500000001000000040000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\FREEZE (Leave) = 4800000000000000a2ca6986459dd601ac050000bc0f0000eb03000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace\OPEN_VOLUME_HANDLE (Leave) = 4800000000000000ba3d9e86459dd601ac050000bc0f0000fd03000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppEnumGroups (Enter) = 4800000000000000c01add7d459dd6014407000000050000d10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\IDENTIFY (Enter) = 48000000000000008690f27d459dd601ac05000068060000e80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppAddInterestingComponents (Enter) = 4800000000000000205df483459dd6014407000000050000d40700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\PREPAREBACKUP (Enter) = 4800000000000000e8e07984459dd601ac05000068060000e903000001000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\PREPAREBACKUP (Leave) = 4800000000000000e8e07984459dd601ac05000074060000e903000000000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_PREFINALCOMMIT (Enter) = 48000000000000009c62e386459dd601ac050000bc0f00000604000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\THAW (Leave) = 48000000000000009c62e386459dd601ac0500008c080000f203000000000000030000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_PREFINALCOMMIT (Leave) = 48000000000000009f12f486459dd601ac050000bc0f00000604000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\BACKUPSHUTDOWN (Enter) = 48000000000000001f373987459dd601ac050000bc0f0000fb03000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\PREPAREBACKUP (Enter) = 4800000000000000e8e07984459dd601ac0500009c080000e903000001000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\FREEZE (Enter) = 4800000000000000b035b285459dd601ac05000004060000eb03000001000000020000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_PRECOMMIT (Enter) = 4800000000000000a2ca6986459dd601ac050000bc0f00000304000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppGetSnapshots (Leave) = 4800000000000000c01add7d459dd6014407000000050000d20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) = 4800000000000000939afd86459dd601ac0500008c0800000500000001000000040000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\POSTSNAPSHOT (Leave) = 4800000000000000635e2187459dd601ac050000bc0f0000f503000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\BACKUPSHUTDOWN (Leave) = 48000000000000001f373987459dd601ac050000a8080000fb03000000000000050000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\BACKUPSHUTDOWN (Enter) = 48000000000000001f373987459dd601ac050000a8080000fb03000001000000050000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP\SppCreate (Enter) = 4800000000000000c01add7d459dd6014407000000050000d00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\FREEZE (Enter) = 4800000000000000dcbf9c85459dd601ac05000004060000eb03000001000000020000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher\FREEZE_BACK (Leave) = 4800000000000000b035b285459dd601ac050000bc0f0000ed03000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\THAW (Enter) = 48000000000000008000e186459dd601ac05000008090000f203000001000000030000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer\BACKUPSHUTDOWN (Enter) = 48000000000000001f373987459dd601ac050000a8080000fb03000001000000050000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher\PREPAREBACKUP (Leave) = 4800000000000000bdb4a984459dd60144070000f0010000e903000000000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer\PREPARESNAPSHOT (Enter) = 48000000000000008f631e85459dd601ac05000004060000ea03000001000000010000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer\FREEZE (Leave) = 4800000000000000dcbf9c85459dd601ac05000004060000eb03000000000000020000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_COMMIT (Enter) = 4800000000000000f177b886459dd601ac050000b40e00000404000001000000000000000000000047b5533002969748a04e2c142890c2b500000000000000000000000000000000 vssvc.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\build.exe Setup.tmp File created C:\Program Files (x86)\is-OCDUP.tmp Setup.tmp - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{947DF10B-1F64-4184-BBF4-9186FC3E77B9} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI51DF.tmp msiexec.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe File opened for modification C:\Windows\Installer\MSI6884.tmp msiexec.exe File opened for modification C:\Windows\Installer\f74500a.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe File opened for modification C:\Windows\Installer\MSI68B5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6A0F.tmp msiexec.exe File created C:\Windows\Installer\f74500a.msi msiexec.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4332 2980 WerFault.exe 88 - Checks SCSI registry key(s) 3 TTPs 96 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Capabilities svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID svchost.exe - Delays execution with timeout.exe 1 IoCs
pid Process 4232 timeout.exe - Modifies Control Panel 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\ForegroundLockTimeout = "0" MsiExec.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\ForegroundLockTimeout = "200000" MsiExec.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17 msiexec.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings Setup.tmp - Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 1860 msiexec.exe 1860 msiexec.exe 4028 Setup.tmp 4028 Setup.tmp 4332 WerFault.exe 4332 WerFault.exe 4332 WerFault.exe 4332 WerFault.exe 4332 WerFault.exe 4332 WerFault.exe 4332 WerFault.exe 4332 WerFault.exe 4332 WerFault.exe 4332 WerFault.exe 4332 WerFault.exe 4332 WerFault.exe 4332 WerFault.exe 4332 WerFault.exe 4332 WerFault.exe 4332 WerFault.exe 4332 WerFault.exe 4332 WerFault.exe 5012 Setup.exe - Suspicious use of AdjustPrivilegeToken 109 IoCs
description pid Process Token: SeShutdownPrivilege 3608 msiexec.exe Token: SeIncreaseQuotaPrivilege 3608 msiexec.exe Token: SeSecurityPrivilege 1860 msiexec.exe Token: SeCreateTokenPrivilege 3608 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3608 msiexec.exe Token: SeLockMemoryPrivilege 3608 msiexec.exe Token: SeIncreaseQuotaPrivilege 3608 msiexec.exe Token: SeMachineAccountPrivilege 3608 msiexec.exe Token: SeTcbPrivilege 3608 msiexec.exe Token: SeSecurityPrivilege 3608 msiexec.exe Token: SeTakeOwnershipPrivilege 3608 msiexec.exe Token: SeLoadDriverPrivilege 3608 msiexec.exe Token: SeSystemProfilePrivilege 3608 msiexec.exe Token: SeSystemtimePrivilege 3608 msiexec.exe Token: SeProfSingleProcessPrivilege 3608 msiexec.exe Token: SeIncBasePriorityPrivilege 3608 msiexec.exe Token: SeCreatePagefilePrivilege 3608 msiexec.exe Token: SeCreatePermanentPrivilege 3608 msiexec.exe Token: SeBackupPrivilege 3608 msiexec.exe Token: SeRestorePrivilege 3608 msiexec.exe Token: SeShutdownPrivilege 3608 msiexec.exe Token: SeDebugPrivilege 3608 msiexec.exe Token: SeAuditPrivilege 3608 msiexec.exe Token: SeSystemEnvironmentPrivilege 3608 msiexec.exe Token: SeChangeNotifyPrivilege 3608 msiexec.exe Token: SeRemoteShutdownPrivilege 3608 msiexec.exe Token: SeUndockPrivilege 3608 msiexec.exe Token: SeSyncAgentPrivilege 3608 msiexec.exe Token: SeEnableDelegationPrivilege 3608 msiexec.exe Token: SeManageVolumePrivilege 3608 msiexec.exe Token: SeImpersonatePrivilege 3608 msiexec.exe Token: SeCreateGlobalPrivilege 3608 msiexec.exe Token: SeBackupPrivilege 1452 vssvc.exe Token: SeRestorePrivilege 1452 vssvc.exe Token: SeAuditPrivilege 1452 vssvc.exe Token: SeBackupPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 4356 7z.exe Token: 35 4356 7z.exe Token: SeRestorePrivilege 4332 WerFault.exe Token: SeBackupPrivilege 4332 WerFault.exe Token: SeSecurityPrivilege 4356 7z.exe Token: SeSecurityPrivilege 4356 7z.exe Token: SeRestorePrivilege 4424 7z.exe Token: 35 4424 7z.exe Token: SeSecurityPrivilege 4424 7z.exe Token: SeSecurityPrivilege 4424 7z.exe Token: SeDebugPrivilege 4332 WerFault.exe Token: SeRestorePrivilege 4484 7z.exe Token: 35 4484 7z.exe Token: SeSecurityPrivilege 4484 7z.exe Token: SeSecurityPrivilege 4484 7z.exe Token: SeRestorePrivilege 4520 7z.exe Token: 35 4520 7z.exe Token: SeSecurityPrivilege 4520 7z.exe Token: SeSecurityPrivilege 4520 7z.exe Token: SeRestorePrivilege 4552 7z.exe Token: 35 4552 7z.exe Token: SeSecurityPrivilege 4552 7z.exe Token: SeSecurityPrivilege 4552 7z.exe Token: SeRestorePrivilege 4584 7z.exe Token: 35 4584 7z.exe Token: SeSecurityPrivilege 4584 7z.exe Token: SeSecurityPrivilege 4584 7z.exe Token: SeRestorePrivilege 4632 7z.exe Token: 35 4632 7z.exe Token: SeSecurityPrivilege 4632 7z.exe Token: SeSecurityPrivilege 4632 7z.exe Token: SeBackupPrivilege 2268 srtasks.exe Token: SeRestorePrivilege 2268 srtasks.exe Token: SeSecurityPrivilege 2268 srtasks.exe Token: SeTakeOwnershipPrivilege 2268 srtasks.exe Token: SeBackupPrivilege 2268 srtasks.exe Token: SeRestorePrivilege 2268 srtasks.exe Token: SeSecurityPrivilege 2268 srtasks.exe Token: SeTakeOwnershipPrivilege 2268 srtasks.exe Token: SeRestorePrivilege 4792 7z.exe Token: 35 4792 7z.exe Token: SeSecurityPrivilege 4792 7z.exe Token: SeSecurityPrivilege 4792 7z.exe Token: SeRestorePrivilege 4840 7z.exe Token: 35 4840 7z.exe Token: SeSecurityPrivilege 4840 7z.exe Token: SeSecurityPrivilege 4840 7z.exe Token: SeRestorePrivilege 4904 7z.exe Token: 35 4904 7z.exe Token: SeSecurityPrivilege 4904 7z.exe Token: SeSecurityPrivilege 4904 7z.exe Token: SeRestorePrivilege 4964 7z.exe Token: 35 4964 7z.exe Token: SeSecurityPrivilege 4964 7z.exe Token: SeSecurityPrivilege 4964 7z.exe Token: SeDebugPrivilege 5012 Setup.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3608 msiexec.exe 4028 Setup.tmp 3608 msiexec.exe - Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 1860 wrote to memory of 2268 1860 msiexec.exe 81 PID 1860 wrote to memory of 2268 1860 msiexec.exe 81 PID 1860 wrote to memory of 752 1860 msiexec.exe 83 PID 1860 wrote to memory of 752 1860 msiexec.exe 83 PID 1860 wrote to memory of 752 1860 msiexec.exe 83 PID 752 wrote to memory of 2172 752 MsiExec.exe 84 PID 752 wrote to memory of 2172 752 MsiExec.exe 84 PID 752 wrote to memory of 2172 752 MsiExec.exe 84 PID 752 wrote to memory of 496 752 MsiExec.exe 86 PID 752 wrote to memory of 496 752 MsiExec.exe 86 PID 752 wrote to memory of 496 752 MsiExec.exe 86 PID 496 wrote to memory of 4028 496 Setup.exe 87 PID 496 wrote to memory of 4028 496 Setup.exe 87 PID 496 wrote to memory of 4028 496 Setup.exe 87 PID 4028 wrote to memory of 2980 4028 Setup.tmp 88 PID 4028 wrote to memory of 2980 4028 Setup.tmp 88 PID 4028 wrote to memory of 2980 4028 Setup.tmp 88 PID 4028 wrote to memory of 2396 4028 Setup.tmp 89 PID 4028 wrote to memory of 2396 4028 Setup.tmp 89 PID 4028 wrote to memory of 2396 4028 Setup.tmp 89 PID 2396 wrote to memory of 2920 2396 WScript.exe 90 PID 2396 wrote to memory of 2920 2396 WScript.exe 90 PID 2396 wrote to memory of 2920 2396 WScript.exe 90 PID 2396 wrote to memory of 4116 2396 WScript.exe 92 PID 2396 wrote to memory of 4116 2396 WScript.exe 92 PID 2396 wrote to memory of 4116 2396 WScript.exe 92 PID 1860 wrote to memory of 4152 1860 msiexec.exe 94 PID 1860 wrote to memory of 4152 1860 msiexec.exe 94 PID 1860 wrote to memory of 4152 1860 msiexec.exe 94 PID 2920 wrote to memory of 4220 2920 cmd.exe 95 PID 2920 wrote to memory of 4220 2920 cmd.exe 95 PID 2920 wrote to memory of 4220 2920 cmd.exe 95 PID 4116 wrote to memory of 4232 4116 cmd.exe 96 PID 4116 wrote to memory of 4232 4116 cmd.exe 96 PID 4116 wrote to memory of 4232 4116 cmd.exe 96 PID 752 wrote to memory of 4320 752 MsiExec.exe 98 PID 752 wrote to memory of 4320 752 MsiExec.exe 98 PID 752 wrote to memory of 4320 752 MsiExec.exe 98 PID 2920 wrote to memory of 4356 2920 cmd.exe 101 PID 2920 wrote to memory of 4356 2920 cmd.exe 101 PID 2920 wrote to memory of 4424 2920 cmd.exe 102 PID 2920 wrote to memory of 4424 2920 cmd.exe 102 PID 2920 wrote to memory of 4484 2920 cmd.exe 103 PID 2920 wrote to memory of 4484 2920 cmd.exe 103 PID 2920 wrote to memory of 4520 2920 cmd.exe 104 PID 2920 wrote to memory of 4520 2920 cmd.exe 104 PID 2920 wrote to memory of 4552 2920 cmd.exe 105 PID 2920 wrote to memory of 4552 2920 cmd.exe 105 PID 2920 wrote to memory of 4584 2920 cmd.exe 106 PID 2920 wrote to memory of 4584 2920 cmd.exe 106 PID 2920 wrote to memory of 4632 2920 cmd.exe 107 PID 2920 wrote to memory of 4632 2920 cmd.exe 107 PID 2920 wrote to memory of 4792 2920 cmd.exe 108 PID 2920 wrote to memory of 4792 2920 cmd.exe 108 PID 2920 wrote to memory of 4840 2920 cmd.exe 109 PID 2920 wrote to memory of 4840 2920 cmd.exe 109 PID 2920 wrote to memory of 4904 2920 cmd.exe 110 PID 2920 wrote to memory of 4904 2920 cmd.exe 110 PID 2920 wrote to memory of 4964 2920 cmd.exe 111 PID 2920 wrote to memory of 4964 2920 cmd.exe 111 PID 2920 wrote to memory of 5012 2920 cmd.exe 112 PID 2920 wrote to memory of 5012 2920 cmd.exe 112 PID 2920 wrote to memory of 5012 2920 cmd.exe 112
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e8002fbc4bd5e57fd317fb99e3bb2bc8965e94761e37757aed51f3f21486c0ad.msi1⤵
- Blacklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3608
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Modifies service
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Modifies service
PID:2268
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0CB679E4C1905B294B76A55A4CC777B92⤵
- Loads dropped DLL
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\expand.exe"C:\Windows\System32\expand.exe" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:2172
-
-
C:\Users\Admin\AppData\Local\Temp\MW-fb82572e-8f4f-4b79-8f4f-c9125ff100cb\files\Setup.exe"C:\Users\Admin\AppData\Local\Temp\MW-fb82572e-8f4f-4b79-8f4f-c9125ff100cb\files\Setup.exe" /SP- /VERYSILENT3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Users\Admin\AppData\Local\Temp\is-SS4N0.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-SS4N0.tmp\Setup.tmp" /SL5="$70032,6651823,721408,C:\Users\Admin\AppData\Local\Temp\MW-fb82572e-8f4f-4b79-8f4f-c9125ff100cb\files\Setup.exe" /SP- /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Program Files (x86)\build.exe"C:\Program Files (x86)\build.exe"5⤵
- Executes dropped EXE
PID:2980 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 8086⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4332
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\AuEyy\MMF2.vbs"5⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\AuEyy\main.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\mode.commode 65,107⤵PID:4220
-
-
C:\ProgramData\AuEyy\7z.exe7z.exe e file.zip -p___________15024pwd10466pwd8827___________ -oextracted7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
-
C:\ProgramData\AuEyy\7z.exe7z.exe e extracted/file_10.zip -oextracted7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4424
-
-
C:\ProgramData\AuEyy\7z.exe7z.exe e extracted/file_9.zip -oextracted7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4484
-
-
C:\ProgramData\AuEyy\7z.exe7z.exe e extracted/file_8.zip -oextracted7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4520
-
-
C:\ProgramData\AuEyy\7z.exe7z.exe e extracted/file_7.zip -oextracted7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4552
-
-
C:\ProgramData\AuEyy\7z.exe7z.exe e extracted/file_6.zip -oextracted7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4584
-
-
C:\ProgramData\AuEyy\7z.exe7z.exe e extracted/file_5.zip -oextracted7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4632
-
-
C:\ProgramData\AuEyy\7z.exe7z.exe e extracted/file_4.zip -oextracted7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4792
-
-
C:\ProgramData\AuEyy\7z.exe7z.exe e extracted/file_3.zip -oextracted7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4840
-
-
C:\ProgramData\AuEyy\7z.exe7z.exe e extracted/file_2.zip -oextracted7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4904
-
-
C:\ProgramData\AuEyy\7z.exe7z.exe e extracted/file_1.zip -oextracted7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4964
-
-
C:\ProgramData\AuEyy\Setup.exe"Setup.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:5012
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\AuEyy\DiskRemoval.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\timeout.exetimeout /T 60 /NOBREAK7⤵
- Delays execution with timeout.exe
PID:4232
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-fb82572e-8f4f-4b79-8f4f-c9125ff100cb\files"3⤵PID:4320
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E7760D235C3CC7A3030C8E6D3BF9B59B E Global\MSI00002⤵
- Loads dropped DLL
PID:4152
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1452
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3968