Analysis
- max time kernel
122s - max time network
139s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system - submitted
21/02/2024, 03:38
Behavioral task
behavioral1
Sample
7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62.exe
Resource
win7-20231215-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
27 signatures
150 seconds
General
- Target 7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62.exe
- Size 20.6MB
- Sample240221-d7cnfsbc96
- SHA256 7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62
- MD5 29ada151e3522de32e9a00d4fb80c703
- SHA1 dda54ebdacde6dddc16038b1790d49c51b4006cb
- SHA512 684f0bbc8c2c1e7c85822565d0c4a8772648d5c5cbd49a9c6018f5faa2afda27a793cbf05f45a5a256619020e682f6409fc31287fcc984590c1672e13b07d6a6
- SSDEEP 393216:C0s4AglBegE+a1fkHYrX4FbZevN67zmJteZD4XIqNfRyUuL:CclBnra1fkH+AC+iJteBaNfRp
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- UPX dump on OEP (original entry point) 3 IoCs
resource yara_rule behavioral1/memory/1180-0-0x0000000000400000-0x00000000019A1000-memory.dmp UPX behavioral1/memory/1180-99-0x0000000000400000-0x00000000019A1000-memory.dmp UPX behavioral1/memory/1180-503-0x0000000000400000-0x00000000019A1000-memory.dmp UPX - Drops file in Drivers directory 5 IoCs
description ioc Process File created C:\Windows\system32\drivers\pcisys.sys winst64.exe File created C:\Windows\system32\drivers\nskbfltr.sys winst64.exe File opened for modification C:\Windows\system32\DRIVERS\SETF00A.tmp DrvInst.exe File created C:\Windows\system32\DRIVERS\SETF00A.tmp DrvInst.exe File opened for modification C:\Windows\system32\DRIVERS\gdihook5.sys DrvInst.exe - Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\nskbfltr\ImagePath = "\\SystemRoot\\system32\\drivers\\nskbfltr.sys" WINSTALL.EXE - Executes dropped EXE 8 IoCs
pid Process 1312 MSIC891.tmp 904 MSIC90F.tmp 2624 checkdvd.exe 1260 WINSTALL.EXE 2536 winst64.exe 3036 WINSTALL.EXE 2052 client32.exe 2660 client32.exe - Loads dropped DLL 46 IoCs
pid Process 2940 MsiExec.exe 2940 MsiExec.exe 2940 MsiExec.exe 2940 MsiExec.exe 2940 MsiExec.exe 2940 MsiExec.exe 2940 MsiExec.exe 2940 MsiExec.exe 2940 MsiExec.exe 2940 MsiExec.exe 2940 MsiExec.exe 2940 MsiExec.exe 2940 MsiExec.exe 2940 MsiExec.exe 2940 MsiExec.exe 2240 MsiExec.exe 2240 MsiExec.exe 2940 MsiExec.exe 1260 WINSTALL.EXE 1260 WINSTALL.EXE 2536 winst64.exe 1260 WINSTALL.EXE 2940 MsiExec.exe 2940 MsiExec.exe 3036 WINSTALL.EXE 2052 client32.exe 2052 client32.exe 2052 client32.exe 2052 client32.exe 2052 client32.exe 2052 client32.exe 2052 client32.exe 2660 client32.exe 2660 client32.exe 2660 client32.exe 2660 client32.exe 2660 client32.exe 2660 client32.exe 2660 client32.exe 2660 client32.exe 2940 MsiExec.exe 2940 MsiExec.exe 2940 MsiExec.exe 2660 client32.exe 2660 client32.exe 2660 client32.exe - Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71C5A887-11E0-4c5a-9B9B-D4A074555692}\InProcServer32\ = "Client32Provider.dll" winst64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71C5A887-11E0-4c5a-9B9B-D4A074555692}\InProcServer32\ThreadingModel = "Apartment" winst64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71C5A887-11E0-4c5a-9B9B-D4A074555692}\InProcServer32 winst64.exe -
resource yara_rule behavioral1/memory/1180-0-0x0000000000400000-0x00000000019A1000-memory.dmp upx behavioral1/memory/1180-99-0x0000000000400000-0x00000000019A1000-memory.dmp upx behavioral1/memory/1180-503-0x0000000000400000-0x00000000019A1000-memory.dmp upx - Blocklisted process makes network request 4 IoCs
flow pid Process 3 2584 msiexec.exe 5 2584 msiexec.exe 7 2584 msiexec.exe 9 2584 msiexec.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: client32.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: client32.exe File opened (read-only) \??\Q: msiexec.exe - Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "0" WINSTALL.EXE - Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{2446fec2-4cce-72c9-c724-415ac948670d}\x64\gdihook5.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2446fec2-4cce-72c9-c724-415ac948670d}\SETECF0.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2446fec2-4cce-72c9-c724-415ac948670d}\gdihook5.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2446fec2-4cce-72c9-c724-415ac948670d}\x64 DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat DrvInst.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\loca[1].htm client32.exe File created C:\Windows\SysWOW64\pcimsg.dll WINSTALL.EXE File opened for modification C:\Windows\SysWOW64\pcimsg.dll WINSTALL.EXE File created C:\Windows\system32\client32provider.dll winst64.exe File created C:\Windows\System32\DriverStore\Temp\{2446fec2-4cce-72c9-c724-415ac948670d}\x64\SETECDE.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{2446fec2-4cce-72c9-c724-415ac948670d}\x64\SETECEF.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\gdihook5.inf_amd64_neutral_d8853853669e565a\gdihook5.PNF DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt winst64.exe File created C:\Windows\system32\SETF087.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat client32.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2446fec2-4cce-72c9-c724-415ac948670d}\x64\SETECEF.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat winst64.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\NetSupport\NetSupport Manager\QVMRJQQO_SW.bin client32.exe File created C:\Windows\system32\clhook4.dll winst64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2446fec2-4cce-72c9-c724-415ac948670d}\x64\gdihook5.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2446fec2-4cce-72c9-c724-415ac948670d}\gdihook5.cat DrvInst.exe File opened for modification C:\Windows\system32\SETF087.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2446fec2-4cce-72c9-c724-415ac948670d}\x64\SETECDE.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstor.dat DrvInst.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\NetSupport\NetSupport Manager\QVMRJQQO_HF.bin client32.exe File created C:\Windows\System32\DriverStore\Temp\{2446fec2-4cce-72c9-c724-415ac948670d}\SETECF0.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat winst64.exe File opened for modification C:\Windows\system32\gdihook5.dll DrvInst.exe File opened for modification C:\Windows\system32\clhook4.dll winst64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2446fec2-4cce-72c9-c724-415ac948670d}\SETED01.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\INFCACHE.0 DrvInst.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\NetSupport\NetSupport Manager\QVMRJQQO_HW.bin client32.exe File created C:\Windows\System32\DriverStore\Temp\{2446fec2-4cce-72c9-c724-415ac948670d}\SETED01.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\gdihook5.inf_amd64_neutral_d8853853669e565a\gdihook5.PNF DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2446fec2-4cce-72c9-c724-415ac948670d} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat DrvInst.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\product.dat msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\PCIinv.dll msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\PCIVDD.DLL msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\Inv\amberbar.gif msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\Inv\network2.gif msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\logo.png msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32.exe msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\HTCTL32.DLL msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\nspscr.cat msiexec.exe File opened for modification C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32.ini WINSTALL.EXE File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\PCIHOOKS.DLL msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\nsmres.dll msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\x64\gdihook5.dll msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\nsmexec.exe msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\Inv\btn_down.gif msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\Inv\unknown.gif msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\NSToast.exe msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\toastImageAndText.png msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\toastChat.png msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\NSClient32UI.exe msiexec.exe File opened for modification C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32.log client32.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\PCIMSG.DLL msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\remcmdstub.exe msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\Inv\greenbar.gif msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\Inv\header.gif msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\Inv\verified.gif msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\Client32Provider.dll msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\VolumeControlWVI.DLL msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\supporttool.exe msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\NSM.LIC msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\_?????? ?????? ???????????.lnk WINSTALL.EXE File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\Control.kbd msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\Inv\btn_down_grey.gif msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\IsMetro.exe msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\toastMessage.png msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\pscrinst64.dll msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\PCIIMAGE.DLL msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\Inv\btn_up_grey.gif msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\Inv\computer2.gif msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\pcicapi.dll msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\gdihook5.INF msiexec.exe File opened for modification C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32.log client32.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\Inv\bar.gif msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\Inv\baseboard.gif msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\Inv\cpu2.gif msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\PCICL32.DLL msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\gdihook5.cat msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\msvcp100.dll msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\CryptPak.dll msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\Inv\btn_up.gif msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\VolumeControlWXP.DLL msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\WdfCoInstaller01005.dll msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\nsm32.chm msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\TCCTL32.DLL msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\IcoViewer.dll msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\Inv\redbar.gif msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\pcisys.sys msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\clhook4.dll msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\nspscr.sys msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\DBI.EXE msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\NSM.ini msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\msvcr100.dll msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\mfc100u.dll msiexec.exe File created C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\PCIhtmlgen.dll msiexec.exe - Drops file in Windows directory 49 IoCs
description ioc Process File opened for modification C:\Windows\setupact.log DrvInst.exe File opened for modification C:\Windows\setuperr.log DrvInst.exe File opened for modification C:\Windows\setupact.log WINSTALL.EXE File opened for modification C:\Windows\Installer\MSIF860.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76aa05.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC2A5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICA68.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB88F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICFAA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB811.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB91C.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSIC96D.tmp msiexec.exe File opened for modification C:\Windows\setuperr.log WINSTALL.EXE File created C:\Windows\Installer\f76aa0a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIFFE2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC332.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICE51.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76aa08.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIB774.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBFD4.tmp msiexec.exe File created C:\Windows\INF\oem2.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSIBB7E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC90F.tmp msiexec.exe File opened for modification C:\Windows\Installer\{64893459-B4B8-403D-8E2D-8395D2BA3F1F}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\MSIFF83.tmp msiexec.exe File created C:\Windows\Installer\f76aa05.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIC891.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log winst64.exe File created C:\Windows\INF\oem2.PNF DrvInst.exe File opened for modification C:\Windows\Installer\MSIFFA3.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.app.log winst64.exe File opened for modification C:\Windows\setupact.log winst64.exe File opened for modification C:\Windows\INF\oem2.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\MSIC44C.tmp msiexec.exe File created C:\Windows\Installer\{64893459-B4B8-403D-8E2D-8395D2BA3F1F}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIC0FF.tmp msiexec.exe File created C:\Windows\Installer\f76aa08.ipi msiexec.exe File opened for modification C:\Windows\setuperr.log winst64.exe File opened for modification C:\Windows\INF\setupapi.ev2 DrvInst.exe File opened for modification C:\Windows\Installer\MSIBE8B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC052.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB310.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBF37.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICDA5.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI client32.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 client32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz client32.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-84-68-7d-16-6e\WpadDecision = "0" client32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 client32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad client32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B648ECF3-70CC-4358-804C-174DB004CCDB}\WpadNetworkName = "Network 3" client32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" client32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix client32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing winst64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust winst64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B648ECF3-70CC-4358-804C-174DB004CCDB}\WpadDecisionTime = e02fab917764da01 client32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople winst64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust winst64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed winst64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs winst64.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\ = "NetSupport Manager Replay File" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\DefaultIcon\ = "C:\\Program Files (x86)\\pchelper\\Óäàëåííûé ïîìîùíèê\\PCIVideo.exe,1" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\MiscStatus\1 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ProgID MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ProgID\ = "IcoViewer.IconViewer.1" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\InprocServer32 MsiExec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\InprocServer32\InprocServer32 = 4e003000550042004800690052007e005f003800520062005300270058006a004600630026002d0043006c00690065006e0074003e0027007300430050006200280031004a007b00380068007a004400660043004f006d0030006b00240000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71C5A887-11E0-4c5a-9B9B-D4A074555692}\ = "Client32Provider" winst64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\MiscStatus\1\ = "131473" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\954398468B4BD304E8D238592DABF3F1\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\97DC.tmp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer\CurVer\ = "IcoViewer.IconViewer.1" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Version\ = "1.0" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\954398468B4BD304E8D238592DABF3F1 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell WINSTALL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell WINSTALL.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\EditFlags = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Programmable MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\VersionIndependentProgID MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\MiscStatus\ = "0" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\954398468B4BD304E8D238592DABF3F1\SourceList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\NSReplayFile msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Nb32cf674\a = "M" WINSTALL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer\ = "IconViewer Class" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\954398468B4BD304E8D238592DABF3F1\ProductIcon = "C:\\Windows\\Installer\\{64893459-B4B8-403D-8E2D-8395D2BA3F1F}\\ARPPRODUCTICON.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer\CLSID\ = "{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show\ = "&???????? ? NetSupport School" WINSTALL.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\954398468B4BD304E8D238592DABF3F1\AuthorizedLUAApp = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ToolboxBitmap32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ = "IconViewer Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer.1\ = "IconViewer Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show\ = "&???????? ? NetSupport School" WINSTALL.EXE Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer\CurVer msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell\show\ = "&???????? ? NetSupport School" WINSTALL.EXE Key created \REGISTRY\MACHINE\Software\Classes\NSReplayFile\Shell\Play\Command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Control msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ToolboxBitmap32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\NSReplayFile\Shell msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\BrowserFlags = "8" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell\show\command WINSTALL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show WINSTALL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\954398468B4BD304E8D238592DABF3F1\SourceList\Media\1 = "DISK1;1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71C5A887-11E0-4c5a-9B9B-D4A074555692}\InProcServer32 winst64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Nb32cf674 WINSTALL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Insertable MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\954398468B4BD304E8D238592DABF3F1\Client = "NSM" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\954398468B4BD304E8D238592DABF3F1\Language = "1049" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\954398468B4BD304E8D238592DABF3F1\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer.1\CLSID\ = "{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell WINSTALL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\954398468B4BD304E8D238592DABF3F1\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\954398468B4BD304E8D238592DABF3F1\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show\command\ = "\"C:\\Program Files (x86)\\pchelper\\Óäàëåííûé ïîìîùíèê\\pcinssui.exe\" /ShowVideo \"%L\"" WINSTALL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58E5039-E78C-441D-AA62-383AD6F38FC8}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\pchelper\\Óäàëåííûé ïîìîùíèê\\" MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ProgID MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\954398468B4BD304E8D238592DABF3F1\CommonFiles = "NSM" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\954398468B4BD304E8D238592DABF3F1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\954398468B4BD304E8D238592DABF3F1\ProductName = "NetSupport Manager" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\VersionIndependentProgID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell\show WINSTALL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2C61D9FBB5C49E141B2D086B0653E432\954398468B4BD304E8D238592DABF3F1 msiexec.exe - Modifies registry key 1 TTPs 1 IoCs
pid Process 2332 reg.exe - Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1364 attrib.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2584 msiexec.exe 2584 msiexec.exe 1260 WINSTALL.EXE 1260 WINSTALL.EXE 1260 WINSTALL.EXE 1260 WINSTALL.EXE 1260 WINSTALL.EXE 1260 WINSTALL.EXE 2052 client32.exe 2052 client32.exe 2660 client32.exe 2660 client32.exe 2660 client32.exe 2660 client32.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 464 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1480 msiexec.exe Token: SeIncreaseQuotaPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 2584 msiexec.exe Token: SeTakeOwnershipPrivilege 2584 msiexec.exe Token: SeSecurityPrivilege 2584 msiexec.exe Token: SeCreateTokenPrivilege 1480 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1480 msiexec.exe Token: SeLockMemoryPrivilege 1480 msiexec.exe Token: SeIncreaseQuotaPrivilege 1480 msiexec.exe Token: SeMachineAccountPrivilege 1480 msiexec.exe Token: SeTcbPrivilege 1480 msiexec.exe Token: SeSecurityPrivilege 1480 msiexec.exe Token: SeTakeOwnershipPrivilege 1480 msiexec.exe Token: SeLoadDriverPrivilege 1480 msiexec.exe Token: SeSystemProfilePrivilege 1480 msiexec.exe Token: SeSystemtimePrivilege 1480 msiexec.exe Token: SeProfSingleProcessPrivilege 1480 msiexec.exe Token: SeIncBasePriorityPrivilege 1480 msiexec.exe Token: SeCreatePagefilePrivilege 1480 msiexec.exe Token: SeCreatePermanentPrivilege 1480 msiexec.exe Token: SeBackupPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 1480 msiexec.exe Token: SeShutdownPrivilege 1480 msiexec.exe Token: SeDebugPrivilege 1480 msiexec.exe Token: SeAuditPrivilege 1480 msiexec.exe Token: SeSystemEnvironmentPrivilege 1480 msiexec.exe Token: SeChangeNotifyPrivilege 1480 msiexec.exe Token: SeRemoteShutdownPrivilege 1480 msiexec.exe Token: SeUndockPrivilege 1480 msiexec.exe Token: SeSyncAgentPrivilege 1480 msiexec.exe Token: SeEnableDelegationPrivilege 1480 msiexec.exe Token: SeManageVolumePrivilege 1480 msiexec.exe Token: SeImpersonatePrivilege 1480 msiexec.exe Token: SeCreateGlobalPrivilege 1480 msiexec.exe Token: SeRestorePrivilege 2584 msiexec.exe Token: SeTakeOwnershipPrivilege 2584 msiexec.exe Token: SeRestorePrivilege 2584 msiexec.exe Token: SeTakeOwnershipPrivilege 2584 msiexec.exe Token: SeRestorePrivilege 2584 msiexec.exe Token: SeTakeOwnershipPrivilege 2584 msiexec.exe Token: SeRestorePrivilege 2584 msiexec.exe Token: SeTakeOwnershipPrivilege 2584 msiexec.exe Token: SeRestorePrivilege 2584 msiexec.exe Token: SeTakeOwnershipPrivilege 2584 msiexec.exe Token: SeRestorePrivilege 2584 msiexec.exe Token: SeTakeOwnershipPrivilege 2584 msiexec.exe Token: SeRestorePrivilege 2584 msiexec.exe Token: SeTakeOwnershipPrivilege 2584 msiexec.exe Token: SeRestorePrivilege 2584 msiexec.exe Token: SeTakeOwnershipPrivilege 2584 msiexec.exe Token: SeRestorePrivilege 2584 msiexec.exe Token: SeTakeOwnershipPrivilege 2584 msiexec.exe Token: SeRestorePrivilege 2584 msiexec.exe Token: SeTakeOwnershipPrivilege 2584 msiexec.exe Token: SeRestorePrivilege 2584 msiexec.exe Token: SeTakeOwnershipPrivilege 2584 msiexec.exe Token: SeRestorePrivilege 2584 msiexec.exe Token: SeTakeOwnershipPrivilege 2584 msiexec.exe Token: SeRestorePrivilege 2584 msiexec.exe Token: SeTakeOwnershipPrivilege 2584 msiexec.exe Token: SeRestorePrivilege 2584 msiexec.exe Token: SeTakeOwnershipPrivilege 2584 msiexec.exe Token: SeRestorePrivilege 2584 msiexec.exe Token: SeTakeOwnershipPrivilege 2584 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2660 client32.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2660 client32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1180 wrote to memory of 2452 1180 7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62.exe 28 PID 1180 wrote to memory of 2452 1180 7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62.exe 28 PID 1180 wrote to memory of 2452 1180 7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62.exe 28 PID 1180 wrote to memory of 2452 1180 7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62.exe 28 PID 1180 wrote to memory of 2452 1180 7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62.exe 28 PID 1180 wrote to memory of 2452 1180 7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62.exe 28 PID 1180 wrote to memory of 2452 1180 7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62.exe 28 PID 2452 wrote to memory of 1480 2452 cmd.exe 30 PID 2452 wrote to memory of 1480 2452 cmd.exe 30 PID 2452 wrote to memory of 1480 2452 cmd.exe 30 PID 2452 wrote to memory of 1480 2452 cmd.exe 30 PID 2452 wrote to memory of 1480 2452 cmd.exe 30 PID 2452 wrote to memory of 1480 2452 cmd.exe 30 PID 2452 wrote to memory of 1480 2452 cmd.exe 30 PID 2584 wrote to memory of 2940 2584 msiexec.exe 32 PID 2584 wrote to memory of 2940 2584 msiexec.exe 32 PID 2584 wrote to memory of 2940 2584 msiexec.exe 32 PID 2584 wrote to memory of 2940 2584 msiexec.exe 32 PID 2584 wrote to memory of 2940 2584 msiexec.exe 32 PID 2584 wrote to memory of 2940 2584 msiexec.exe 32 PID 2584 wrote to memory of 2940 2584 msiexec.exe 32 PID 2584 wrote to memory of 2368 2584 msiexec.exe 34 PID 2584 wrote to memory of 2368 2584 msiexec.exe 34 PID 2584 wrote to memory of 2368 2584 msiexec.exe 34 PID 2368 wrote to memory of 1364 2368 cmd.exe 36 PID 2368 wrote to memory of 1364 2368 cmd.exe 36 PID 2368 wrote to memory of 1364 2368 cmd.exe 36 PID 2368 wrote to memory of 1364 2368 cmd.exe 36 PID 2584 wrote to memory of 1312 2584 msiexec.exe 37 PID 2584 wrote to memory of 1312 2584 msiexec.exe 37 PID 2584 wrote to memory of 1312 2584 msiexec.exe 37 PID 2584 wrote to memory of 1312 2584 msiexec.exe 37 PID 2584 wrote to memory of 904 2584 msiexec.exe 38 PID 2584 wrote to memory of 904 2584 msiexec.exe 38 PID 2584 wrote to memory of 904 2584 msiexec.exe 38 PID 2584 wrote to memory of 904 2584 msiexec.exe 38 PID 2584 wrote to memory of 2240 2584 msiexec.exe 39 PID 2584 wrote to memory of 2240 2584 msiexec.exe 39 PID 2584 wrote to memory of 2240 2584 msiexec.exe 39 PID 2584 wrote to memory of 2240 2584 msiexec.exe 39 PID 2584 wrote to memory of 2240 2584 msiexec.exe 39 PID 2584 wrote to memory of 2240 2584 msiexec.exe 39 PID 2584 wrote to memory of 2240 2584 msiexec.exe 39 PID 2584 wrote to memory of 2624 2584 msiexec.exe 40 PID 2584 wrote to memory of 2624 2584 msiexec.exe 40 PID 2584 wrote to memory of 2624 2584 msiexec.exe 40 PID 2584 wrote to memory of 2624 2584 msiexec.exe 40 PID 2584 wrote to memory of 1260 2584 msiexec.exe 41 PID 2584 wrote to memory of 1260 2584 msiexec.exe 41 PID 2584 wrote to memory of 1260 2584 msiexec.exe 41 PID 2584 wrote to memory of 1260 2584 msiexec.exe 41 PID 2584 wrote to memory of 1260 2584 msiexec.exe 41 PID 2584 wrote to memory of 1260 2584 msiexec.exe 41 PID 2584 wrote to memory of 1260 2584 msiexec.exe 41 PID 1260 wrote to memory of 2536 1260 WINSTALL.EXE 42 PID 1260 wrote to memory of 2536 1260 WINSTALL.EXE 42 PID 1260 wrote to memory of 2536 1260 WINSTALL.EXE 42 PID 1260 wrote to memory of 2536 1260 WINSTALL.EXE 42 PID 2584 wrote to memory of 3036 2584 msiexec.exe 47 PID 2584 wrote to memory of 3036 2584 msiexec.exe 47 PID 2584 wrote to memory of 3036 2584 msiexec.exe 47 PID 2584 wrote to memory of 3036 2584 msiexec.exe 47 PID 2584 wrote to memory of 3036 2584 msiexec.exe 47 PID 2584 wrote to memory of 3036 2584 msiexec.exe 47 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1364 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62.exe"C:\Users\Admin\AppData\Local\Temp\7831c040565e36128d3f589b734338eb5cf216290dc0c2138d8564689991ae62.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\97DC.tmp\Install.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\97DC.tmp\ns.msi" /qn /quiet /promptrestart3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1480
-
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\SYSTEM\ControlSet001\services\Client32 /f /v DisplayName /t REG_SZ /d "PCHelper ôñá½Ñ¡¡δ⌐ »«¼«Θ¡¿¬"3⤵
- Modifies registry key
PID:2332
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding ADC0A471DC85A3ADDB81510396286A5E2⤵
- Loads dropped DLL
- Modifies registry class
PID:2940
-
-
C:\Windows\system32\cmd.execmd.exe /c ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{64893459-B4B8-403D-8E2D-8395D2BA3F1F}\\nsm.lic"2⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\attrib.exeATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{64893459-B4B8-403D-8E2D-8395D2BA3F1F}\\nsm.lic"3⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Views/modifies file attributes
PID:1364
-
-
-
C:\Windows\Installer\MSIC891.tmp"C:\Windows\Installer\MSIC891.tmp" NSConnSvrUI.exe NSN2⤵
- Executes dropped EXE
PID:1312
-
-
C:\Windows\Installer\MSIC90F.tmp"C:\Windows\Installer\MSIC90F.tmp" NewShortcut1_DC174CC2D1F545EBA5FA9A05CD201FFD.exe NSN2⤵
- Executes dropped EXE
PID:904
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7DFC86175E53200EA849C8DFB6C72914 M Global\MSI00002⤵
- Loads dropped DLL
- Modifies registry class
PID:2240
-
-
C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\checkdvd.exe"C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\checkdvd.exe"2⤵
- Executes dropped EXE
PID:2624
-
-
C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\WINSTALL.EXE"C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\WINSTALL.EXE" /EV"NetSupport School" /EF".\Log Files" /EF".\Bookmarks" /EF".\Tests" /EF".\Store" /EF".\inv" /EA /EX /EC /Q /V /Q /I *2⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\winst64.exewinst64.exe /q /q /i3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2536
-
-
-
C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\WINSTALL.EXE"C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\WINSTALL.EXE" /EI2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2878b1b8-686d-5742-185f-140aba8c756a}\gdihook5.inf" "9" "6d3d268df" "000000000000005C" "WinSta0\Default" "00000000000003E4" "208" "c:\program files (x86)\pchelper\óäàëåííûé ïîìîùíèê"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2528
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\DISPLAY\0000" "C:\Windows\INF\oem2.inf" "gdihook5.inf:gdihook5.Mfg.NTamd64:gdihook5:11.11.0.704:pci_gdihook5_hwid" "6d3d268df" "000000000000005C" "00000000000003B0" "00000000000005C4"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2456
-
C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32.exe"C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32.exe" /* *1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2052 -
C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32.exe"C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32.exe" * /VistaUI2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2660
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\f76aa09.rbs
- Size 38KB
- SHA256 22c2f6a831f939feabaae9744c945e139a24f03ecc2f423af71442f3384aa1f2
- MD5 4657dec9224a9e20134bb3b6110a5c8d
- SHA1 3362237f588a0c76145601a505f3ab1c189d80f3
- SHA512 be3a17526dcd158cf64d9d0cb1751442475924d3cae108d6fa4c5912a55f98e57ea689c120895939bc9d2a8108ae1b72687e60c0f55f317d93b3b4beb26dd0aa
- SSDEEP 384:s2El1kdazckLBC49PrththththttnJIueX6LtnalyNzNvUkSYcr45:s2kiock1ththththt9kMdRYP45
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\WINSTALL.EXE
- Size 192KB
- SHA256 7ed721b9f515dbb10507e9c97e6a3bc65a3a3409fc2821ff389802fbd2f9a76c
- MD5 b98f50a28a7ec0afeaa9f031019ef06b
- SHA1 9a4a6c63850003a0d66cbaa7d82d25e0ce9c3d99
- SHA512 64861279fe6b884a8ec9c8ca2c2f11d04e7328c11ecbbd994ac8a24a7c0f7aa8db78567c7ec52716aee9aed97ee284ed9eaf0db4f1ae3bb345b38732b437c534
- SSDEEP 6144:CctDVYhNVnFhPVLyg0IhEeHxHxHnobbeVgKqkGbnIK1lX:CctDVYhNFFhPVLygvHxRHnobbeVgKtGN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\checkdvd.exe
- Size 396KB
- SHA256 a51fa80689ca5af9ee74995a8e6c6f0b3b63b21b8eea53981836cbda4dcdc736
- MD5 6ea8705ebd8cf36b330b0118ed234c6f
- SHA1 8c980c3fcb2971e9a11a49e925f7039ccf6035a4
- SHA512 4733fa9c643dd2fc1e150c7a6beb6a4756da63c162630e493e00ddbc459bd79ce79e71ccf1664a90b688d79336ca6dfc313826d3ded29419978b7892844921b9
- SSDEEP 12288:YWhuB3qqRt9APhFRIFPAAXkrMHAbyTnvNqqn+hV6XJhb:xi/Uyvhb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\clhook4.dll
- Size 94KB
- SHA256 22089a0e1c8532f0e65b850d722a544ce59b9cd030f87cf8ccf4ce24f60c6ee4
- MD5 60cee80196194638cbaefd7b4f44b507
- SHA1 cfdc413a4da753914c9feb9b24eaba12c3bca6ad
- SHA512 34320109aafbf54772ad036b895d8a36d14a8d36f24278540021c263c867166ee895f8d64e6efde34ec48c70b274f7429d123dfa01b65a4f94f8b7d05d4ed6d7
- SSDEEP 1536:dfit0VW7VKXERxskgGJ0cBAe4a2al8j+65Zx2pYX/COAXdV5772Jc:RisW7VKwx5gGJnj2aajRhWQq/dVN7Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\client32provider.dll
- Size 82KB
- SHA256 ac455c89a8c167cf6552613a7adfc66f62ad15c35f6ebeb5c32fe8565c68d72c
- MD5 79fabff1a23fe07a80c5af6bdee7f33d
- SHA1 d3ff61a416ffd5a38c1eb9d427f8cb09abf56c7d
- SHA512 bde3811b829232e153d19599cd26848d7e8649aee6276819be4aa6e2b07038efdcdf4ff73c9d935087fd974105ec2f679b2fcc2d7d1d47d18c3b8535aae55129
- SSDEEP 1536:tuVpFNdo7GC97n+/DvTlx8FbXjwKzHsTdrCXH3:tuVno7zZn+bvTlxKbXjwAHsTdqH3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\nskbfltr.sys
- Size 33KB
- SHA256 e7e628de2ed025ad146328e86fa7ab83a79962972cc847263f984edc567d6e7c
- MD5 fe21de1984a1db19d520f01badae7087
- SHA1 13dee984774e0e3605b8d9e34e73f79efdaab1e3
- SHA512 1c79a62cb6e695a5178d8c28cacc765977981a9fa0e005126d29cb82042f175569c88d51e3003148116f9cbad68412dc597817b2c1c9688e1ea34acf79e56af5
- SSDEEP 768:QbG73Znjbfudxpl7x1u33FrFteVVJKZg0ymNjB:B3ZWxpl7KFcKZgCH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\pcimsg.dll
- Size 37KB
- SHA256 cc905356821f51db8e4ee2ec96f44b28cbc1f817cb6f147b0abef41233280d42
- MD5 dbde3f0dd10731abe626530e9155e586
- SHA1 266e0b1dd559b86f6446bcc8804bc742edf7ffe7
- SHA512 9e2df168da1df3f1671bc9192f19a9da872b40abb18e8e3aa8775ec3e50cb64b5d29a68a07a7f3c6884ac6ccb39278e7e2d339904f8e42f088dbdebeb6d86c9c
- SSDEEP 768:vyV3gJXky+9ZiGy43gJXSye3gJXSye3gJX19FvAJnJu6IEF:o
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\pcisys.sys
- Size 21KB
- SHA256 3ddec977bd8f93fd22b1e4c98083aa0de94074d5b1f3994ec71bbefc584694d1
- MD5 3b14690ace7c6bcf2fcfcbce0c2d7e39
- SHA1 61b8fed3bbd3eb2a256b4a172ec2e1d0da3e41bf
- SHA512 d265189880e5c3b162dfcce91d38b844986809850ad63e1c3bd80e209e8b4d5729ba0e59c3d3de6544857d26f6ba28e53a9742d7bbc7113b05d3f8be24d274e1
- SSDEEP 384:qFZj8MgCiZetfffX3/9e0mfSW7jWe7UVYJLu1M6jjmbCSN:q8MXlfffX3/9e3XmeowLWMm6bCe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\product.dat
- Size 506B
- SHA256 065d817596d710d5a06060241acc207b82b844530cc56ff842ff53d8ff92a075
- MD5 ff7c0d2dbb9195083bbabaff482d5ed6
- SHA1 5c2efbf855c376ce1b93e681c54a367a407495dc
- SHA512 ea226b3a55fc59175136f104df497ebf5055624fb1c1c8073b249dfc5e1ed5818a6feee995aa82cf9ed050f1adc7a62994c90b1af03569dfe0d4551ee2bc70c9
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\winst64.exe
- Size 127KB
- SHA256 15d7d3c8cd9654fc6e52cd77d674bced7b57c9710f4e615fe8630fd2282d3618
- MD5 043f82d7e26beb51b3b06a3848e34450
- SHA1 0d0582ef797d742ab785181718c63da7e6c58435
- SHA512 f23f48e27860832baf09d80936b3d775441a355ca3ad1130fc3026e3e5e5c0997b226357fa54e8c8b49daf2662ab841d6e98eaf3f1d371f83c47142d7ef8faf3
- SSDEEP 3072:490P38ugYXh92MUPgkOdFUTXJjgD5uXS1np:S43GGh9bUYkUFUTX1glu0np
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\97DC.tmp\Client32.ini
- Size 1KB
- SHA256 153dc072bc02d29f33e826a9116ee13094dc87eb83956aa48bd604a8d9aa3d7c
- MD5 645a553caf7177f628be8d0fa4bfe8d1
- SHA1 437ee4364cde5ca39e05e294531022f9d64ef8bd
- SHA512 2d00c0597d99fd735f8a1c0fa73fcad6c5e36d23ec186a99c19ee5b9e959408d5f85463cc2130fe760e6f2919c51aecef74e384befe48352eefd60f9aa5213a5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\97DC.tmp\Install.bat
- Size 312B
- SHA256 cacd72fe9928925d9e2f08d0e551ce63c2415d31e3987e90a727841f7d8ea791
- MD5 54cdc5e174d75c4a35751ba5e3ba794b
- SHA1 43a9fbd70b5613c156f4a1f476616bef652f2b69
- SHA512 b0ed0b72b7fe964683768f9601d27fe5b7016ddb4e6304c64e9a370a45bd2331909b0fede35382b16b1e5667c84c9b96e07cc46def3bbb9551b76e8586813b7b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\97DC.tmp\NSM.ini
- Size 69B
- SHA256 011c851c57cbec1d827b3d129c6786d60bbf82460254a4a5b2ad292ab83c9b22
- MD5 1f4c78f19faf4fd31dab68a20e54f650
- SHA1 fd3b793be273db414e40520c5dbb7e14bae1797d
- SHA512 448de405eeb67dd2006f9d0201aeaee09d189d48a51aa0bcff7afe100b29883ad0d476f5b15c143e62c982cd08d391f3cbac274dcd641ec28cf7915f6d370864
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\97DC.tmp\NSM.lic
- Size 255B
- SHA256 61cfdefd60d4839a8d38b4e2483f68c26b7e2b8dbbe697e75679b7f03b292b67
- MD5 c491d8f5de0a549ce9548ddee48a3c96
- SHA1 77d9e40f026473a147c629050bcaec543e551468
- SHA512 7cd9862cfae88a2b46cd9df27138e71912c8bbf02ed3643cc3b75bb2f6214a454ff22ca1377e5e5e35bb78251159b0a79801e96032930e5d865c1050032de02b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\97DC.tmp\ns.msi
- Size 1.7MB
- SHA256 143525bef5a91ff30ce3fadc78e376e16fca45739d334da5909aeec57c80f7e9
- MD5 d4473c6111a94a9103895c36e8be3024
- SHA1 fb6bc0f4191ba27bb5922555dfa16672acb4f332
- SHA512 1ef4d9154fea843f02fd2ba92088d961b2a43ff08b9fea26c253263f093959159b923d971cfbff4479d8663d4399aae63851c96e5cc7241513e775d1e2fae4a0
- SSDEEP 24576:+M6QjYyDFF3YLKCOl3fH2yCfqDTlL1OvUSEJx54TAwXM6mkC0TB:+M6QjYyTIK5l3ey00TBiw/iApFhCB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\CabAE5B.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\DLL_{64893459-B4B8-403D-8E2D-8395D2BA3F1F}.ini
- Size 1KB
- SHA256 d8ad82d7687c678788c33fcdcc2ae21c42cc5873377195d39affc1a6f3a24a57
- MD5 796f6fa71965eb8f9512bda2cb35e974
- SHA1 a5f1290804a95591d6a2eab1ee9f157b66504447
- SHA512 10eb36de40aa3460cebef2770e2cd7268c33ca5d559c9bf0ce952224ced915d40186010f7191fcd3cc8f0702ab04442b39d5c53a47d657c1fc328861bd58f734
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\TarB11C.tmp
- Size 171KB
- SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
- MD5 9c0c641c06238516f27941aa1166d427
- SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
- SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
- SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{64893459-B4B8-403D-8E2D-8395D2BA3F1F}\Client32.upd
- Size 25B
- SHA256 00e0c629d5645c15df66adcf99e8a0a3e517d7a7876141ae7a752f0585eec047
- MD5 c05c19b006d57dd4c90785cbe5c7877b
- SHA1 34beebb832e53e4a3b9b3349919689fdf1401151
- SHA512 bede1e24476a12e9b1f29962254b19b357bfdfbe5c6eec9a2fca6c1b2105f4cec1d5872f6be269ef39d6e5cc542dc587ea9555ef87687bac64b3ff0de16c0f8c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\{64893459-B4B8-403D-8E2D-8395D2BA3F1F}\NSM.LIC
- Size 255B
- SHA256 64c45c70743b974f63e8d85ffa30cc96d9788e3bad730fd96d9bf8068777eb5c
- MD5 3933788386cb330c32c38aab96568942
- SHA1 25927501ed27ead562f78ed8f330db16b356da69
- SHA512 107e75af7c33da06dddc02e0fb0d78d8fe3ebb9a33e8258fef0d1c60e17377a168ee2325b20c6d20ed1219d73b266a76d8e47a327f6f826ba81da14906b374b4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\~CA81.tmp
- Size 270B
- SHA256 677d68b44aee25f998bbeea952726295c63052742c97efc9eb9ab0172f72ea3c
- MD5 109c5669e4ddaefb5b3eeaac114622a0
- SHA1 75972352e7bb112bf520c655dca9f5fa7cb234c4
- SHA512 011e422fcbfcd803df74d26d1c27516b11f9d7f0a070992c42a891bd81a0b7a4b4e11249834c2acaf6464ad9893717fe7174f9bdf05620affd745bad67099393
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\~CA81.tmp
- Size 281B
- SHA256 82999a16b37cc6bba663fae8e963c3888a6dee162adf8d074edd5d579cb8bf65
- MD5 3f2c41c455faa5c3408c91739d09c03c
- SHA1 2ff411bb735bf1eace0e88b8c7f66f4a754b7026
- SHA512 77951e8575fc8e7005f033c0d3064a145720f19311c3c4c249380fac603630201bf43240a4df536cf90252c76043638ecc87a964fcb97fe8c493ba8de91b577c
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSIB310.tmp
- Size 48KB
- SHA256 cc188b1cac39d8d8a5d1a2195f8e0b9b4fb8d0608fcade43274540f300730cef
- MD5 e1a0645a0cc826a574099e96dfd8e504
- SHA1 6ac085eaa95abef0dabb2623d689f70667be1afc
- SHA512 4301960256932aa5ceabb36af5719aa8f7a294e2038a1ae218b77697be1e2a399d64f93db1c4f2d532fd100008785de84d3b157897b873cb651da897b7eedff1
- SSDEEP 768:n0J8+QCTqaxxKkUmFVSarTJym3OZESrclFK:zCTqYttXDJT+lc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIB774.tmp
- Size 212KB
- SHA256 cff87c98eec91a11f254db00a59c4df32cfad308d74042a2c01eaea079dbd7a2
- MD5 8db3649a915613aeac2fa7454224a611
- SHA1 a646cea962ae0ba5e22ff1ebcc4e8fed278fc128
- SHA512 1d862dc5f0902f6b2d52aa8c9769516a7944953273926a66e8f2893ec0499c67d2f3c8a59a6647c31e2c183ac35e55b3177c2a5c96341416c4ec8d18ee9b6df0
- SSDEEP 3072:pOTZdNubZd1mfKK86FfqKTpB7ASMDJjcUwYu1OPxXoYbp:pK/ur4j8wF5A5172OPxYyp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIB811.tmp
- Size 224KB
- SHA256 c0b50aab3b865dfbfa28b2ccb05641da06c58fcb8e79cc90ffe8a4dfe5ae2b94
- MD5 01fc057ea0763b01edb0588f5f1acb64
- SHA1 b308d8f9f06eb6b8f120ae27f016a99c3d1f8af1
- SHA512 e09e3d0d48a3c7447441287f5b6b433bf8348e17004affa75818f1b2e9d7def2645460de103bcad001bbb7840595d0ca85e7a7c4c31d4c154e7f7201b4b9658b
- SSDEEP 3072:Gu+Df1xOTCBBE+IslAr/YtcM3aRMz3RE7bpeiPZZ8z9L8H9z3wfzRb1dGjH8wKU1:rCm+BdNXz3RE7bcCH8KH53wfPdJwGrC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIB88F.tmp
- Size 97KB
- SHA256 b42ce4941df68de1529e9d5af4bcfa6fef8f74f009b9b9e2d58ec4716bf92fb0
- MD5 c4355cba2bd3e659269f98938e35f1c7
- SHA1 8054aabb407ff08aaba2a00b87e7d005ab407395
- SHA512 f897686b0e760a47967b3341ab8ed67755cec3d1c8d02b9a20d893fa1fde6903e8ac0914fd430608a0ba379ad9e50ea5d7bb21cff486f424449c2909e9c9cd19
- SSDEEP 3072:Gu+Df1xOTCBBE+IslAr/YtcM3aRMz3RE7bpeiPZf:rCm+BdNXz3RE7bcCt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIB91C.tmp
- Size 80KB
- SHA256 1695cbbfb7add4687249c37f180118d89f5c84739fac6901404f3b80d73fa513
- MD5 ee3c6890f15356b39a30a3a13472b25b
- SHA1 5db8d569d3b535608efa5fab89eb197f7bbee26e
- SHA512 8d30ef80212e0ae4cb884c1653492fcdbe4bd1326ac12b790c19aadbbd8a14b432ac11cedf587c4dfd3849d685ea0113cf1f3d3b13852e3ec8a4e3ad251d85c4
- SSDEEP 1536:IzykrDtT4NxMQRmWdhi79C0X/niKGn+TcFyc/i9wKZ:urXsx1ljiCn+TcFyc/iWK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIC891.tmp
- Size 106KB
- SHA256 731dfe0007ebafbf110632ee6d9e7f2b36b53f17be5117eab92abbd8b32a9c81
- MD5 977671ba4886fb3667dcd70ccdcdf615
- SHA1 db050e33f15d7c20105b90d8cdfbb2516a12592b
- SHA512 681a1034806d56aa5ae509cbfc655329c893f1eef5184b34a52dc145e90cdcc781f44a76f1650eb1c02591e994ac342c3f98a80346b33352adc15eeaa51ebeb3
- SSDEEP 768:vmw4DeWnKV4jiAhUmS3cXoUlDoOP+/k+hhOmT2fn2kEDSzDPNomY0uwpZU9qZU97:vVOKgOMXBi/kKpT2Pfk0uwppob
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSICA68.tmp
- Size 104KB
- SHA256 072e4d185482beccf7967dcf10649ee1ea863da61c8336c0215d458b0254977f
- MD5 ffe48fdd2c532149f0d30f1678235bc8
- SHA1 5cddbc54fbd286793f35b407d4a544e24838f1f0
- SHA512 1f3ed34c50a3c7d72c37ee411a2d7305e9fbd331a5abfa21ce52d5511d92bff8582e9d82fba3a0e62aaf385033a0b88bc3a4cf49aafb0262cc62a7cdd6e06a4d
- SSDEEP 1536:xrxde1oKG616ruhX5bsYG/W6LyhcnsTjJDw5GaypS61IcFzmaieW:xbmG66QG/WIyDdCEF1IcFzmaij
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\f76aa05.msi
- Size 2.1MB
- SHA256 3b843d6979bf8897f4fb65eb53b4f9adf3f981333f01b8d78bdfde8cba1efd04
- MD5 6ab38fa826cf3092da0d6cc043250035
- SHA1 fb8ff7e0c071b6cbaf1d4cad3ae2e82c0abb5c0f
- SHA512 41721e8ab9d70244d7900adb83fbf1d18860dca6e2f43a14c8687688020c53fb8e29089db0296ef279d05ffa08f131ebcc4ee384c9a0ceab6cc490a2ce04e26f
- SSDEEP 49152:+M6QjYyTIK5l3ey00TBiw/iApFhCgE9nHX4MMAB:bYyTIW1z6KRq4MMG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DriverStore\Temp\{2446fec2-4cce-72c9-c724-415ac948670d}\x64\SETECEF.tmp
- Size 68KB
- SHA256 641f2b86f013a95707ffdf0f584e3a83fedc1392cea3b546905b9ccb54ae10cf
- MD5 9a348ed02f8b1efc9bfc5f53827f8a9c
- SHA1 c1f22705392af57b277d1fb4f46258dddffe8f33
- SHA512 9debb460fd74cb586ed66b7fa4bbb51a8e1184c1a061e81f4fd6f5e700fdb1e91b809a3f517fe55dd889f60df6ea29190455073dfa1cb5b85032b91efd12033f
- SSDEEP 768:p8c59WTkwv6MY2d7kz/ET9Hx2aOlP30Bhs1RQuX210ze9MQN7Z2ym+4lcf7xl8uF:qqi8L2dwz/ET9HB1kzQNlkYjaDCCM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\inf\oem2.PNF
- Size 8KB
- SHA256 a9dd38a9b04e68792d55af484fa0adea268eb98ab36b01db05fefbbf4595ada7
- MD5 2b135e5dab517160f237cc39309d52e8
- SHA1 0a39ce8d32e04d78ca68c1451a49d848c7c82a62
- SHA512 24a38e57d1b162572ed823313936c1365ff7323495f19848b898f9c6261be72da652586a0acdd9a203bd2f85075882a14433f987499aefbdf483ca0e5d6d0558
- SSDEEP 96:a1NeSy9mZh3ftdC7oMTU6NX4ZKkenNRRAS+IvcQ6q/1gF0vhrnl4Mma/STd:avF+oM9e6wIUQ6whrnl4Oy
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\PROGRA~2\pchelper\48B7~1\x64\gdihook5.dll
- Size 95KB
- SHA256 2b675e9c27d3fb01cb9df2583b380de8dc8c0d5bbbe18af458f90b47c6d62b03
- MD5 52b88eb20beb3b34a692a4cae0ff2196
- SHA1 26a297b2baeb118f8856c1de41ee855572ba958a
- SHA512 29567fc4db46d85f9ab8f6ecf2a708ec2c8def2e49eccd439daceda327b7411957b2014171a8370c3928d4a03a13bc6124d93678a87684370a5e6042d1c2ad6e
- SSDEEP 1536:hkybYM1RAFHKrvngTwjhVkHtf0Y8L2dwz/ET9HB1kzQNlkm2aDCCR:7kM1RAFHKrvnYwjhVkHtsYU2dwoTZ3bb
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files (x86)\pchelper\óäàëåííûé ïîìîùíèê\gdihook5.cat
- Size 8KB
- SHA256 019290c9b7e5b48fb6de95f9563ed481cd42f8658451c6fbc8ad131d61209ce0
- MD5 2d31ce5fe7cd81c996615ebcc29c058a
- SHA1 4d74fe8e3170d36666df779e43fe8016986b154a
- SHA512 b8188481050630e7317d2f0687790a46e86f30a79f34164e4b02ec28da39334da80bd494a4f32ae8bb60fa2f01273cdcd9d15100f901517b0c01507678330052
- SSDEEP 192:iEd0VE3v3k08ywwlhjeyveCtAW5LfsxhQ8eVC:iDwPjpvjAGLa3x
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files (x86)\pchelper\óäàëåííûé ïîìîùíèê\gdihook5.inf
- Size 2KB
- SHA256 4cfca868959f4e1b85bfd6b8a970ae06c0810d9c341f260df3ab8479089500e9
- MD5 703c7774b981e5d02e058340a27a5b75
- SHA1 37534d7f0b31d2328d70ca578047d597273b73b6
- SHA512 758e84915fa7ebb343bafd096bc40d9d226fe0da7c167b2b8e59f664e1be796143228bc3405df7e3447cdc918004db516344365d3d07a8e6c040df2b90456d78
- MD5 SHA1 SHA512
- Path \Program Files (x86)\pchelper\Óäàëåííûé ïîìîùíèê\shfolder.dll
- Size 28KB
- SHA256 3419e795ff8ae1e2c188a45b9a31c77a7fb15a45684fcbe70c220945c63422c7
- MD5 d6a8c31989ca8813817e22088a8dcab8
- SHA1 67e397c256d46c23a13e10e7424a7186b4b4e5d5
- SHA512 4f3ecdb3fb8b9c431c24cddfab25650eb2dbc22c94ee04a109fd860a7a89a2172b1394f659264b4df3d5aae9f0d7792cf00d879d8805987cd38f8912e397acd6
- SSDEEP 384:+6YxDdSPrTWmmXZ6UJuHW3iWqHosHigH2nKwsHTGHib+GzHWYHjHqLHP0oqQGVP5:dYxDdwTWm8lJuEFzE6U
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Installer\MSIB88F.tmp
- Size 45KB
- SHA256 00514e4ea1164c9ca19309c4e2ecc82b223f9626966cec8d5d2f42179c74fc98
- MD5 fccfa5a23cc69e317a83af8e8576904e
- SHA1 1a31405621bf81aae51b9e5fb8fdbf88b9e7a65c
- SHA512 85206f0797753370f048cffc94223f577154f1c161833141b560d84cb1e559b2ff6f96e6542bc786621ef17a10944fc20b2fb3c80da96617d9d17ce93d279ef4
- SSDEEP 768:hgIPWhOvC9Kf1X540WVoWTl9fFfZW34L4bwVvm8OQJ1FPdcy0geSI8XobnB+Isln:hgI+hrO154doWDf1QkOw4fQJXKxgBI8r
- MD5 SHA1 SHA512 SSDEEP