dcrat | af09248cb756488850f9e6f9a7a00149005bf47a9b2087b792ff6bd937297ffb

Processes:

blockcom.exeblockcom.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Local Settings\\System.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Local Settings\\System.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\dllhost.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Local Settings\\System.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Local Settings\\System.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\audiodg.exe\", \"C:\\Serverhost\\System.exe\", \"C:\\Serverhost\\csrss.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Local Settings\\System.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\audiodg.exe\", \"C:\\Serverhost\\System.exe\", \"C:\\Serverhost\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\chrome.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\chrome.exe\", \"C:\\Serverhost\\WmiPrvSE.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Local Settings\\System.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\audiodg.exe\", \"C:\\Serverhost\\System.exe\", \"C:\\Serverhost\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\chrome.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\chrome.exe\", \"C:\\Serverhost\\WmiPrvSE.exe\", \"C:\\Windows\\uk-UA\\csrss.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\microsoft.system.package.metadata\\ApplicationFrameHost.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Local Settings\\System.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\audiodg.exe\", \"C:\\Serverhost\\System.exe\", \"C:\\Serverhost\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\chrome.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\chrome.exe\", \"C:\\Serverhost\\WmiPrvSE.exe\", \"C:\\Windows\\uk-UA\\csrss.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\microsoft.system.package.metadata\\ApplicationFrameHost.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Local Settings\\System.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\audiodg.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Local Settings\\System.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\audiodg.exe\", \"C:\\Serverhost\\System.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Local Settings\\System.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\audiodg.exe\", \"C:\\Serverhost\\System.exe\", \"C:\\Serverhost\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\chrome.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Local Settings\\System.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\audiodg.exe\", \"C:\\Serverhost\\System.exe\", \"C:\\Serverhost\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\chrome.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\chrome.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\Local Settings\\System.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\audiodg.exe\", \"C:\\Serverhost\\System.exe\", \"C:\\Serverhost\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\chrome.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\chrome.exe\", \"C:\\Serverhost\\WmiPrvSE.exe\", \"C:\\Windows\\uk-UA\\csrss.exe\""	blockcom.exe

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6744	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5404	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6784	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5412	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5768	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6464	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5468	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5780	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5596	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5824	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6456	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5432	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5168	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5716	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6532	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6304	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6448	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4032	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	424	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6684	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6416	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5308	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6424	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5616	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6324	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6744	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3296	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6608	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6784	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6796	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5768	4140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6464	4140	schtasks.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Dupper (2).cmd	dcrat
behavioral1/memory/836-49389-0x0000000000140000-0x0000000000266000-memory.dmp	dcrat
C:\Program Files (x86)\MSBuild\Microsoft\dllhost.exe	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

3992 powershell.exe
2568 powershell.exe
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

pid	process
3992	powershell.exe
2568	powershell.exe

Drops file in Drivers directory 4 IoCs

Processes:

NPFInstall.exeisestart.exe

description	ioc	process
File opened for modification	C:\Windows\system32\DRIVERS\SET30BC.tmp	NPFInstall.exe
File created	C:\Windows\system32\DRIVERS\SET30BC.tmp	NPFInstall.exe
File opened for modification	C:\Windows\system32\DRIVERS\npcap.sys	NPFInstall.exe
File created	C:\Windows\system32\drivers\isedrv.sys	isestart.exe

Manipulates Digital Signatures 1 TTPs 13 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

Processes:

certutil.execertutil.execmdinstall.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION"	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3BA63A6E4841355772DEBEF9CDCF4D5AF353A297\Blob = 0300000001000000140000003ba63a6e4841355772debef9cdcf4d5af353a2972000000001000000350500003082053130820419a00302010202100aa125d6d6321b7e41e405da3697c215300d06092a864886f70d01010b05003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3136303130373132303030305a170d3331303130373132303030305a3072310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3131302f060355040313284469676943657274205348413220417373757265642049442054696d657374616d70696e6720434130820122300d06092a864886f70d01010105000382010f003082010a0282010100bdd032ee4bcd8f7fdda9ba8299c539542857b6234ac40e07453351107dd0f97d4d687ee7b6a0f48db388e497bf63219098bf13bc57d3c3e17e08d66a140038f72e1e3beecca6f63259fe5f653fe09bebe34647061a557e0b277ec0a2f5a0e0de223f0eff7e95fbf3a3ba223e18ac11e4f099036d3b857c09d3ee5dc89a0b54e3a809716be0cf22100f75cf71724e0aaddf403a5cb751e1a17914c64d2423305dbcec3c606aac2f07ccfdf0ea47d988505efd666e56612729898451e682e74650fd942a2ca7e4753eba980f847f9f3114d6add5f264cb7b1e05d084197217f11706ef3dcdd64def0642fda2532a4f851dc41d3cafcfdaac10f5ddacace956ff930203010001a38201ce308201ca301d0603551d0e04160414f4b6e1201dfe29aed2e461a5b2a225b2c817356e301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f30120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070308307906082b06010505070101046d306b302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304306082b060105050730028637687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e6372743081810603551d1f047a3078303aa038a0368634687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e63726c303aa038a0368634687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e63726c30500603551d20044930473038060a6086480186fd6c000204302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f435053300b06096086480186fd6c0701300d06092a864886f70d01010b05000382010100719512e951875669cdefddda7caa637ab378cf06374084ef4b84bfcacf0302fdc5a7c30e20422caf77f32b1f0c215a2ab705341d6aae99f827a266bf09aa60df76a43a930ff8b2d1d87c1962e85e82251ec4ba1c7b2c21e2d65b2c1435430468b2db7502e072c798d63c64e51f4810185f8938614d62462487638c91522caf2989e5781fd60b14a580d7124770b375d59385937eb69267fb536189a8f56b96c0f458690d7cc801b1b92875b7996385228c61ca79947e59fc8c0fe36fb50126b66ca5ee875121e458609bba0c2d2b6da2c47ebbc4252b4702087c49ae13b6e17c424228c61856cf4134b6665db6747bf55633222f2236b24ba24a95d8f5a68e52	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\60EE3FC53D4BDFD1697AE5BEAE1CAB1C0F3AD4E3\Blob = 0f0000000100000020000000eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf03000000010000001400000060ee3fc53d4bdfd1697ae5beae1cab1c0f3ad4e32000000001000000c0060000308206bc308205a4a003020102021003f1b4e15f3a82f1149678b3d7d8475c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3132303431383132303030305a170d3237303431383132303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e672043412028534841322930820122300d06092a864886f70d01010105000382010f003082010a0282010100a753fa0fb2b513f164cf8480fcae8035d1b6d7c7a32cac1a2cacf184ac3a35123a9291ba57e4c4c9f32fa8483cb7d66edc9722ba517961af432f0db79bb44931ae44583ea4a196a7874f237ec36c652490553ea1ca237cc542e9c47a62459b7dde6374cb9e6325f8849a9aad454fae7d1fc813cb759bc9e1e18af80b0c98f4ca3ed045aa7a1ea558933634be2b2e2b315866b432109f9df052a1efe83ed376f2405adcfa6a3d1b4bad76b08c5cee36ba83ea30a84cdef10b2a584188ae0089ab03d11682202276eb5e54381262e1d27024dbed1f70d26409802de2b69dce1ff2bb21f36cdbd8b3197b8a509fefec360a5c9ab74ad308a03979fdddbf3d3a09250203010001a38203583082035430120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307f06082b0601050507010104733071302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304906082b06010505073002863d687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63727430818f0603551d1f0481873081843040a03ea03c863a687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63726c3040a03ea03c863a687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0302308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e301d0603551d0e041604148fe87ef06d326a000523c770976a3a90ff6bead4301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d01010b0500038201010019334a0c813337dbad36c9e4c93abbb51b2e7aa2e2f44342179ebf4ea14de1b1dbe981dd9f01f2e488d5e9fe09fd21c1ec5d80d2f0d6c143c2fe772bdbf9d79133ce6cd5b2193be62ed6c9934f88408ecde1f57ef10fc6595672e8eb6a41bd1cd546d57c49ca663815c1bfe091707787dcc98d31c90c29a233ed8de287cd898d3f1bffd5e01a978b7cda6dfba8c6b23a666b7b01b3cdd8a634ec1201ab9558a5c45357a860e6e70212a0b92364a24dbb7c81256421becfee42184397bba53706af4dff26a54d614bec4641b865ceb8799e08960b818c8a3b8fc7998ca32a6e986d5e61c696b78ab9612d93b8eb0e0443d7f5fea6f062d4996aa5c1c1f0649480	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4CE89794FE2D2F7E30121F10BCF76AC3CCF77CA9\Blob = 0300000001000000140000004ce89794fe2d2f7e30121f10bcf76ac3ccf77ca92000000001000000c7050000308205c3308204aba003020102021009256314069e7e6a88cb823075c0d9c9300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3230303530313030303030305a170d3231303530373132303030305a3081d231133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a43616c69666f726e6961311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e311530130603550405130c323030303130333130303133310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130753656174746c6531193017060355040a1310496e7365637572652e436f6d204c4c433119301706035504031310496e7365637572652e436f6d204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100a88cd713346c50a5cd2a62900419f091330f9820b73b38785a8b5a25ceda8e11b71b2d11ff4b0c18cad405a2a195a6462619fa3ddf6d14466a350d1cf1c6ad48cce166fe6011a62ee62751046dd264b1cc145c4a4354537cec1ae615b6b8566a28ddf3b510fee92023dbe4190b44bb4174f94c4ec62256bd4aa5ba541ee833388db8cc411365e094ee6314eaff59ca6659bb6388300e7ffbd0f8b299889b8e3ea526f8ca926ded79eac89a6b068757ae428022e2602ec98babf5998216b0c28a709129a1300872878d9971e3130826a7d1ce894fe649a017003f07ee3c53ca0cba998fab097e573723fbd3e0ea1b742dd6d076b4c2284b93500021a7d27109630203010001a38201f8308201f4301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604140a9c208099309acdddf9c9909a03890dcd30c8ea30350603551d11042e302ca02a06082b06010505070803a01e301c0c1a55532d43414c49464f524e49412d323030303130333130303133300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b0500038201010042368fc33025a2a1338cf35a08d00e263958f825e79b6d3af23e0e4e4cf59bc8502022d452cbba14a53274e3a12a5b01f4aee16abfcb1b28d63484a0ae1995c9759c6f0970254da8902fb479f5f7869a566aa285f2c28e50096dfd2e14a9ecf0000963c570d2338def108dfe66b1e44d22182826749871a7f3977eba4976910f1f0de866fc75b918c1a9f466fcf96ae90df932071b9c770f0f3193f8ca500abe52cc316549403a5ca5b5422d1ebffffc3cbe3b926de552f493b53c6570fdd0736550f080c2db204b03bc00ff724241581b5dfb0dff7b8f2cc28f136c19cca8bd4b3c3d81404e69f4598e7b5458e41c6f2e6622a212d28c2615565782a1f66987	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E1D782A8E191BEEF6BCA1691B5AAB494A6249BF3\Blob = 0f0000000100000020000000a43de6baf968a942da017b70769fdb65b3cfb1bbca1f9174da26a7d8aae78ec5030000000100000014000000e1d782a8e191beef6bca1691b5aab494a6249bf3200000000100000002050000308204fe308203e6a00302010202100d424ae0be3a88ff604021ce1400f0dd300d06092a864886f70d01010b05003072310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3131302f060355040313284469676943657274205348413220417373757265642049442054696d657374616d70696e67204341301e170d3231303130313030303030305a170d3331303130363030303030305a3048310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3120301e0603550403131744696769436572742054696d657374616d70203230323130820122300d06092a864886f70d01010105000382010f003082010a0282010100c2e6618467c58af50d08a445ca636b51d73a1142bd0a75754d94b40c50b52610fe1dc86f916b0c96e71a5c48ef44e5bf9b61cd1591625ab8ff670b9c63fd366a81fa29f8dd2b7085de0218f3786dbc7df9c76d093dbe6a7687e98abdf8845d1e76c9e4c676763a53d1d1d35a368fc6a3e12f1b3ab761d673ec4e6d338a7c5d452d4bb150e6413a375686dc93238df75025e864e6ddd38f2f57b58720eb0e8e2cd523daf44d7846e3038331294a5c0c318a4a8c88c5f7305af914af155f6c434909fd262353f68d63e81aab5bb11d30c29b6982b4dbfc5654bc1fa187abbe7a5b0a202f4b09c995a78db2fad6638b4ea5721cee9f7a0173f819d6fe0d4984bd010203010001a38201b8308201b4300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030160603551d250101ff040c300a06082b0601050507030830410603551d20043a3038303606096086480186fd6c07013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f435053301f0603551d23041830168014f4b6e1201dfe29aed2e461a5b2a225b2c817356e301d0603551d0e041604143644868ea4bab066bebc282d1d4436dde36a7abc30710603551d1f046a30683032a030a02e862c687474703a2f2f63726c332e64696769636572742e636f6d2f736861322d617373757265642d74732e63726c3032a030a02e862c687474703a2f2f63726c342e64696769636572742e636f6d2f736861322d617373757265642d74732e63726c30818506082b0601050507010104793077302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304f06082b060105050730028643687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572745348413241737375726564494454696d657374616d70696e6743412e637274300d06092a864886f70d01010b05000382010100481cdcb5e99a23bce71ae7200e8e6746fd427251740a2347a3ab92d225c47059be14a0e52781a54d1415190779f0d104c386d93bbdfe4402664ded69a40ff6b870cf62e8f5514a7879367a27b7f3e7529f93a7ed439e7be7b4dd412289fb87a246034efcf4feb76477635f2352698382fa1a53ed90cc8da117730df4f36539704bf39cd67a7bda0cbc3d32d01bcbf561fc75080076bc810ef8c0e15ccfc41172e71b6449d8229a751542f52d323881daf460a2bab452fb5ce06124254fb2dfc929a8734351dabd63d61f5b9bf72e1b4f131df74a0d717e97b7f43f84ebc1e3a349a1facea7bf56cfba597661895f7ea7b48e6778f93698e1cb28da5b87a68a2f	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4CE89794FE2D2F7E30121F10BCF76AC3CCF77CA9\Blob = 0f000000010000002000000051296450c9049de88a6df397cfe6ee4eeb29020c6789c8db737b6c96bf2ad6a70300000001000000140000004ce89794fe2d2f7e30121f10bcf76ac3ccf77ca92000000001000000c7050000308205c3308204aba003020102021009256314069e7e6a88cb823075c0d9c9300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3230303530313030303030305a170d3231303530373132303030305a3081d231133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a43616c69666f726e6961311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e311530130603550405130c323030303130333130303133310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130753656174746c6531193017060355040a1310496e7365637572652e436f6d204c4c433119301706035504031310496e7365637572652e436f6d204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100a88cd713346c50a5cd2a62900419f091330f9820b73b38785a8b5a25ceda8e11b71b2d11ff4b0c18cad405a2a195a6462619fa3ddf6d14466a350d1cf1c6ad48cce166fe6011a62ee62751046dd264b1cc145c4a4354537cec1ae615b6b8566a28ddf3b510fee92023dbe4190b44bb4174f94c4ec62256bd4aa5ba541ee833388db8cc411365e094ee6314eaff59ca6659bb6388300e7ffbd0f8b299889b8e3ea526f8ca926ded79eac89a6b068757ae428022e2602ec98babf5998216b0c28a709129a1300872878d9971e3130826a7d1ce894fe649a017003f07ee3c53ca0cba998fab097e573723fbd3e0ea1b742dd6d076b4c2284b93500021a7d27109630203010001a38201f8308201f4301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604140a9c208099309acdddf9c9909a03890dcd30c8ea30350603551d11042e302ca02a06082b06010505070803a01e301c0c1a55532d43414c49464f524e49412d323030303130333130303133300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b0500038201010042368fc33025a2a1338cf35a08d00e263958f825e79b6d3af23e0e4e4cf59bc8502022d452cbba14a53274e3a12a5b01f4aee16abfcb1b28d63484a0ae1995c9759c6f0970254da8902fb479f5f7869a566aa285f2c28e50096dfd2e14a9ecf0000963c570d2338def108dfe66b1e44d22182826749871a7f3977eba4976910f1f0de866fc75b918c1a9f466fcf96ae90df932071b9c770f0f3193f8ca500abe52cc316549403a5ca5b5422d1ebffffc3cbe3b926de552f493b53c6570fdd0736550f080c2db204b03bc00ff724241581b5dfb0dff7b8f2cc28f136c19cca8bd4b3c3d81404e69f4598e7b5458e41c6f2e6622a212d28c2615565782a1f66987	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3BA63A6E4841355772DEBEF9CDCF4D5AF353A297\Blob = 0f000000010000002000000056b5f0d9db578e3f142921daa387902722a76700375c7e1c4ae0ba004bacaa0c0300000001000000140000003ba63a6e4841355772debef9cdcf4d5af353a2972000000001000000350500003082053130820419a00302010202100aa125d6d6321b7e41e405da3697c215300d06092a864886f70d01010b05003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3136303130373132303030305a170d3331303130373132303030305a3072310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3131302f060355040313284469676943657274205348413220417373757265642049442054696d657374616d70696e6720434130820122300d06092a864886f70d01010105000382010f003082010a0282010100bdd032ee4bcd8f7fdda9ba8299c539542857b6234ac40e07453351107dd0f97d4d687ee7b6a0f48db388e497bf63219098bf13bc57d3c3e17e08d66a140038f72e1e3beecca6f63259fe5f653fe09bebe34647061a557e0b277ec0a2f5a0e0de223f0eff7e95fbf3a3ba223e18ac11e4f099036d3b857c09d3ee5dc89a0b54e3a809716be0cf22100f75cf71724e0aaddf403a5cb751e1a17914c64d2423305dbcec3c606aac2f07ccfdf0ea47d988505efd666e56612729898451e682e74650fd942a2ca7e4753eba980f847f9f3114d6add5f264cb7b1e05d084197217f11706ef3dcdd64def0642fda2532a4f851dc41d3cafcfdaac10f5ddacace956ff930203010001a38201ce308201ca301d0603551d0e04160414f4b6e1201dfe29aed2e461a5b2a225b2c817356e301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f30120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070308307906082b06010505070101046d306b302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304306082b060105050730028637687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e6372743081810603551d1f047a3078303aa038a0368634687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e63726c303aa038a0368634687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e63726c30500603551d20044930473038060a6086480186fd6c000204302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f435053300b06096086480186fd6c0701300d06092a864886f70d01010b05000382010100719512e951875669cdefddda7caa637ab378cf06374084ef4b84bfcacf0302fdc5a7c30e20422caf77f32b1f0c215a2ab705341d6aae99f827a266bf09aa60df76a43a930ff8b2d1d87c1962e85e82251ec4ba1c7b2c21e2d65b2c1435430468b2db7502e072c798d63c64e51f4810185f8938614d62462487638c91522caf2989e5781fd60b14a580d7124770b375d59385937eb69267fb536189a8f56b96c0f458690d7cc801b1b92875b7996385228c61ca79947e59fc8c0fe36fb50126b66ca5ee875121e458609bba0c2d2b6da2c47ebbc4252b4702087c49ae13b6e17c424228c61856cf4134b6665db6747bf55633222f2236b24ba24a95d8f5a68e52	cmdinstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7\Name = "szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL"	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E1D782A8E191BEEF6BCA1691B5AAB494A6249BF3\Blob = 030000000100000014000000e1d782a8e191beef6bca1691b5aab494a6249bf3200000000100000002050000308204fe308203e6a00302010202100d424ae0be3a88ff604021ce1400f0dd300d06092a864886f70d01010b05003072310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3131302f060355040313284469676943657274205348413220417373757265642049442054696d657374616d70696e67204341301e170d3231303130313030303030305a170d3331303130363030303030305a3048310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3120301e0603550403131744696769436572742054696d657374616d70203230323130820122300d06092a864886f70d01010105000382010f003082010a0282010100c2e6618467c58af50d08a445ca636b51d73a1142bd0a75754d94b40c50b52610fe1dc86f916b0c96e71a5c48ef44e5bf9b61cd1591625ab8ff670b9c63fd366a81fa29f8dd2b7085de0218f3786dbc7df9c76d093dbe6a7687e98abdf8845d1e76c9e4c676763a53d1d1d35a368fc6a3e12f1b3ab761d673ec4e6d338a7c5d452d4bb150e6413a375686dc93238df75025e864e6ddd38f2f57b58720eb0e8e2cd523daf44d7846e3038331294a5c0c318a4a8c88c5f7305af914af155f6c434909fd262353f68d63e81aab5bb11d30c29b6982b4dbfc5654bc1fa187abbe7a5b0a202f4b09c995a78db2fad6638b4ea5721cee9f7a0173f819d6fe0d4984bd010203010001a38201b8308201b4300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030160603551d250101ff040c300a06082b0601050507030830410603551d20043a3038303606096086480186fd6c07013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f435053301f0603551d23041830168014f4b6e1201dfe29aed2e461a5b2a225b2c817356e301d0603551d0e041604143644868ea4bab066bebc282d1d4436dde36a7abc30710603551d1f046a30683032a030a02e862c687474703a2f2f63726c332e64696769636572742e636f6d2f736861322d617373757265642d74732e63726c3032a030a02e862c687474703a2f2f63726c342e64696769636572742e636f6d2f736861322d617373757265642d74732e63726c30818506082b0601050507010104793077302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304f06082b060105050730028643687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572745348413241737375726564494454696d657374616d70696e6743412e637274300d06092a864886f70d01010b05000382010100481cdcb5e99a23bce71ae7200e8e6746fd427251740a2347a3ab92d225c47059be14a0e52781a54d1415190779f0d104c386d93bbdfe4402664ded69a40ff6b870cf62e8f5514a7879367a27b7f3e7529f93a7ed439e7be7b4dd412289fb87a246034efcf4feb76477635f2352698382fa1a53ed90cc8da117730df4f36539704bf39cd67a7bda0cbc3d32d01bcbf561fc75080076bc810ef8c0e15ccfc41172e71b6449d8229a751542f52d323881daf460a2bab452fb5ce06124254fb2dfc929a8734351dabd63d61f5b9bf72e1b4f131df74a0d717e97b7f43f84ebc1e3a349a1facea7bf56cfba597661895f7ea7b48e6778f93698e1cb28da5b87a68a2f	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3C0D087ECDCC76D1084ABE00F1FEE5040400AE37\Blob = 0300000001000000140000003c0d087ecdcc76d1084abe00f1fee5040400ae372000000001000000c6050000308205c2308204aaa00302010202100aa60783ebb5076ebc2d12da9b04c290300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3231303530353030303030305a170d3234303631303233353935395a3081d2311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a43616c69666f726e6961311530130603550405130c323030303130333130303133310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130753656174746c6531193017060355040a1310496e7365637572652e436f6d204c4c433119301706035504031310496e7365637572652e436f6d204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6ec814ee2c7075e2e29ac7ebd10b6188055929370a213b83fb6e337d82ed0756d15e267f6bc645e6db5bb1d586ef1098ead1595147d03897af04b666aa5a50def2b3af23974896c6fb4f5246baf3ec374dbfd90eeec7575ffb11a6efea7a0d7da0adb04eaf000b1ad520d9e9529b2a8cf420998d4c7a46c1f95e405e35f69ad8c05d62df0f9745017a6284134afba26f905d900da1c412200e6ca5c6b148f3f785aa0ebe35ea9160644bd6924b54625eb404ab39db981f6b216b6dd960930a1443b26aab08cdbcf1c5fd74dbb56c3e9df791f8429401dee5869e90c39f95000fc616b5ac8396b588e24407235ea074328c608112f6cb4f07347cd4d28d28ab90203010001a38201f7308201f3301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e04160414c5b210483c7598f90d32838cd0763d3cd85fef5130350603551d11042e302ca02a06082b06010505070803a01e301c0c1a55532d43414c49464f524e49412d323030303130333130303133300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304a0603551d2004433041303606096086480186fd6c03023029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101008b2182887ada0e08e4afe89019ded16e88ff6ff1b12fd9b2994b945b8c76c63862ae35a1751672c474c8575a039250105e346bb7ce7ae1f2494e760de418b9453f1bbac9255b0dccafd296adb3cdb49d46d54c3413bfc34a3e640e244da7b1e1dbd1b04cea414ff64fe57f0ef28944a42e41065548e4834f2b05d4aae8516a1f154c5b09af25fe059a69a7dc75a7deb4cf3068c402614ece0509edf02b0968b5c8d1081cdafcfba3b7c1599256e6685ef7391f46746eaf829bc8fd40f55be70a3fc51142648b78a903e750158328cb80d54aaddce82df8fe983b0e36af4dafbdbdffe8896bee9a93c370e77f735fe9c42fc2259a3e5672e9f75f37ecf7104e53	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION"	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\60EE3FC53D4BDFD1697AE5BEAE1CAB1C0F3AD4E3\Blob = 03000000010000001400000060ee3fc53d4bdfd1697ae5beae1cab1c0f3ad4e32000000001000000c0060000308206bc308205a4a003020102021003f1b4e15f3a82f1149678b3d7d8475c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3132303431383132303030305a170d3237303431383132303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e672043412028534841322930820122300d06092a864886f70d01010105000382010f003082010a0282010100a753fa0fb2b513f164cf8480fcae8035d1b6d7c7a32cac1a2cacf184ac3a35123a9291ba57e4c4c9f32fa8483cb7d66edc9722ba517961af432f0db79bb44931ae44583ea4a196a7874f237ec36c652490553ea1ca237cc542e9c47a62459b7dde6374cb9e6325f8849a9aad454fae7d1fc813cb759bc9e1e18af80b0c98f4ca3ed045aa7a1ea558933634be2b2e2b315866b432109f9df052a1efe83ed376f2405adcfa6a3d1b4bad76b08c5cee36ba83ea30a84cdef10b2a584188ae0089ab03d11682202276eb5e54381262e1d27024dbed1f70d26409802de2b69dce1ff2bb21f36cdbd8b3197b8a509fefec360a5c9ab74ad308a03979fdddbf3d3a09250203010001a38203583082035430120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307f06082b0601050507010104733071302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304906082b06010505073002863d687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63727430818f0603551d1f0481873081843040a03ea03c863a687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63726c3040a03ea03c863a687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0302308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e301d0603551d0e041604148fe87ef06d326a000523c770976a3a90ff6bead4301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d01010b0500038201010019334a0c813337dbad36c9e4c93abbb51b2e7aa2e2f44342179ebf4ea14de1b1dbe981dd9f01f2e488d5e9fe09fd21c1ec5d80d2f0d6c143c2fe772bdbf9d79133ce6cd5b2193be62ed6c9934f88408ecde1f57ef10fc6595672e8eb6a41bd1cd546d57c49ca663815c1bfe091707787dcc98d31c90c29a233ed8de287cd898d3f1bffd5e01a978b7cda6dfba8c6b23a666b7b01b3cdd8a634ec1201ab9558a5c45357a860e6e70212a0b92364a24dbb7c81256421becfee42184397bba53706af4dff26a54d614bec4641b865ceb8799e08960b818c8a3b8fc7998ca32a6e986d5e61c696b78ab9612d93b8eb0e0443d7f5fea6f062d4996aa5c1c1f0649480	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3C0D087ECDCC76D1084ABE00F1FEE5040400AE37\Blob = 0f0000000100000020000000e5657d41869c485f7a75539139120605e5dc5a373a8f8a96e3c2b30140cc76220300000001000000140000003c0d087ecdcc76d1084abe00f1fee5040400ae372000000001000000c6050000308205c2308204aaa00302010202100aa60783ebb5076ebc2d12da9b04c290300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3231303530353030303030305a170d3234303631303233353935395a3081d2311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a43616c69666f726e6961311530130603550405130c323030303130333130303133310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130753656174746c6531193017060355040a1310496e7365637572652e436f6d204c4c433119301706035504031310496e7365637572652e436f6d204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6ec814ee2c7075e2e29ac7ebd10b6188055929370a213b83fb6e337d82ed0756d15e267f6bc645e6db5bb1d586ef1098ead1595147d03897af04b666aa5a50def2b3af23974896c6fb4f5246baf3ec374dbfd90eeec7575ffb11a6efea7a0d7da0adb04eaf000b1ad520d9e9529b2a8cf420998d4c7a46c1f95e405e35f69ad8c05d62df0f9745017a6284134afba26f905d900da1c412200e6ca5c6b148f3f785aa0ebe35ea9160644bd6924b54625eb404ab39db981f6b216b6dd960930a1443b26aab08cdbcf1c5fd74dbb56c3e9df791f8429401dee5869e90c39f95000fc616b5ac8396b588e24407235ea074328c608112f6cb4f07347cd4d28d28ab90203010001a38201f7308201f3301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e04160414c5b210483c7598f90d32838cd0763d3cd85fef5130350603551d11042e302ca02a06082b06010505070803a01e301c0c1a55532d43414c49464f524e49412d323030303130333130303133300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304a0603551d2004433041303606096086480186fd6c03023029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101008b2182887ada0e08e4afe89019ded16e88ff6ff1b12fd9b2994b945b8c76c63862ae35a1751672c474c8575a039250105e346bb7ce7ae1f2494e760de418b9453f1bbac9255b0dccafd296adb3cdb49d46d54c3413bfc34a3e640e244da7b1e1dbd1b04cea414ff64fe57f0ef28944a42e41065548e4834f2b05d4aae8516a1f154c5b09af25fe059a69a7dc75a7deb4cf3068c402614ece0509edf02b0968b5c8d1081cdafcfba3b7c1599256e6685ef7391f46746eaf829bc8fd40f55be70a3fc51142648b78a903e750158328cb80d54aaddce82df8fe983b0e36af4dafbdbdffe8896bee9a93c370e77f735fe9c42fc2259a3e5672e9f75f37ecf7104e53	cmdinstall.exe

Modifies Windows Firewall 2 TTPs 11 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

pid	process
2860	netsh.exe
1588	netsh.exe
2108	netsh.exe
4172	netsh.exe
4316	netsh.exe
2796	netsh.exe
540	netsh.exe
1184	netsh.exe
1392	netsh.exe
2492	netsh.exe
1344	netsh.exe

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\probe\{app}\dbexpmda40.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\probe\{app}\dbexpoda40.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\probe\{app}\dbexpsda40.dll	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

PRTGLicenseCheck64.exeprtgmovekey.exePRTGLicenseCheck64.exePRTG Server.exePRTGLicenseCheck64.exePRTGLicenseCheck64.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	PRTGLicenseCheck64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	prtgmovekey.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	prtgmovekey.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	PRTGLicenseCheck64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	PRTGLicenseCheck64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	PRTG Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	PRTG Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	PRTGLicenseCheck64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	PRTGLicenseCheck64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	PRTGLicenseCheck64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	PRTGLicenseCheck64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	PRTGLicenseCheck64.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

cmdinstall.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\International\Geo\Nation	cmdinstall.exe

Executes dropped EXE 51 IoCs

Processes:

prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.exeprtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmpPRTGLicenseCheck64.exeprtgmovekey.exePRTGLicenseCheck64.exePRTGLicenseCheck64.exePRTGLicenseCheck64.exeinnounp.exenpcapoem.exeNPFInstall.exeNPFInstall.exeNPFInstall.exeNPFInstall.exeopenssl.exePRTG Probe.exePRTG Server.exePRTG GUI Starter.exeXenServerRRDSensor.exeVMwareSensor.exePRTG_IPMI_Sensor.exeipmiutil.exeXenServerRRDSensor.exeVMwareSensor.exePRTG_IPMI_Sensor.exeipmiutil.exeManageEngine_OpManager_64bit.exeManageEngine_OpManager_64bit.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exeManageEngine_NetFlowAnalyzer_64bit.exeManageEngine_NetFlowAnalyzer_64bit.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exeISBEW64.exeDupper (2).cmdblockcom.exeblockcom.exechrome.execispro_installer.execmdinstall.exeise_installer.exeisestart.exeMSI3D68.tmpMSI3D68.tmp

pid	process
820	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.exe
2596	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
1376	PRTGLicenseCheck64.exe
3468	prtgmovekey.exe
2128	PRTGLicenseCheck64.exe
740	PRTGLicenseCheck64.exe
1352	PRTGLicenseCheck64.exe
4148	innounp.exe
4548	npcapoem.exe
4312	NPFInstall.exe
788	NPFInstall.exe
2156	NPFInstall.exe
2216	NPFInstall.exe
2296	openssl.exe
3056	PRTG Probe.exe
2860	PRTG Server.exe
5784	PRTG GUI Starter.exe
5616	XenServerRRDSensor.exe
6808	VMwareSensor.exe
5472	PRTG_IPMI_Sensor.exe
5680	ipmiutil.exe
6024	XenServerRRDSensor.exe
5468	VMwareSensor.exe
1588	PRTG_IPMI_Sensor.exe
1824	ipmiutil.exe
6008	ManageEngine_OpManager_64bit.exe
6080	ManageEngine_OpManager_64bit.exe
6564	ISBEW64.exe
6444	ISBEW64.exe
396	ISBEW64.exe
2300	ISBEW64.exe
6404	ISBEW64.exe
6752	ISBEW64.exe
3672	ManageEngine_NetFlowAnalyzer_64bit.exe
5972	ManageEngine_NetFlowAnalyzer_64bit.exe
6620	ISBEW64.exe
5540	ISBEW64.exe
5628	ISBEW64.exe
5376	ISBEW64.exe
3596	ISBEW64.exe
5256	ISBEW64.exe
6232	Dupper (2).cmd
836	blockcom.exe
3920	blockcom.exe
6728	chrome.exe
5616	cispro_installer.exe
7408	cmdinstall.exe
7832	ise_installer.exe
7336	isestart.exe
5412	MSI3D68.tmp
6524	MSI3D68.tmp

Loads dropped DLL 64 IoCs

Processes:

advbattoexeconverter.exeprtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmpPRTGLicenseCheck64.exePRTGLicenseCheck64.exePRTGLicenseCheck64.exePRTGLicenseCheck64.exenpcapoem.exeopenssl.exePRTG Probe.exe

pid	process
4212	advbattoexeconverter.exe
4212	advbattoexeconverter.exe
4212	advbattoexeconverter.exe
2596	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
2596	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
1376	PRTGLicenseCheck64.exe
1376	PRTGLicenseCheck64.exe
2128	PRTGLicenseCheck64.exe
2128	PRTGLicenseCheck64.exe
740	PRTGLicenseCheck64.exe
740	PRTGLicenseCheck64.exe
1352	PRTGLicenseCheck64.exe
1352	PRTGLicenseCheck64.exe
4548	npcapoem.exe
4548	npcapoem.exe
4548	npcapoem.exe
4548	npcapoem.exe
4548	npcapoem.exe
4548	npcapoem.exe
4548	npcapoem.exe
4548	npcapoem.exe
4548	npcapoem.exe
4548	npcapoem.exe
4548	npcapoem.exe
2296	openssl.exe
2296	openssl.exe
2296	openssl.exe
2296	openssl.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\probe\{app}\Sensor System\phantomjs.exe	upx

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

blockcom.exeblockcom.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Serverhost\\WmiPrvSE.exe\""	blockcom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\uk-UA\\csrss.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Serverhost\\csrss.exe\""	blockcom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Windows\\Performance\\WinSAT\\DataStore\\chrome.exe\""	blockcom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Serverhost\\WmiPrvSE.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\uk-UA\\csrss.exe\""	blockcom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Recovery\\WindowsRE\\cmd.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Recovery\\WindowsRE\\audiodg.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Serverhost\\System.exe\""	blockcom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Recovery\\WindowsRE\\chrome.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Recovery\\WindowsRE\\chrome.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Windows\\Performance\\WinSAT\\DataStore\\chrome.exe\""	blockcom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicationFrameHost = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\microsoft.system.package.metadata\\ApplicationFrameHost.exe\""	blockcom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\""	blockcom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Recovery\\WindowsRE\\audiodg.exe\""	blockcom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Serverhost\\System.exe\""	blockcom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Serverhost\\csrss.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\dllhost.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Recovery\\WindowsRE\\cmd.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ApplicationFrameHost = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\microsoft.system.package.metadata\\ApplicationFrameHost.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\""	blockcom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Admin\\Local Settings\\System.exe\""	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Admin\\Local Settings\\System.exe\""	blockcom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\dllhost.exe\""	blockcom.exe

Checks for any installed AV software in registry 1 TTPs 44 IoCs

Security Software Discovery

T1518.001

Processes:

cmdinstall.exeMsiExec.exeMsiExec.exemsiexec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UsageStatHost	cmdinstall.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Data\EnforceUseOtlsHttp	cmdinstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\InstallerName = "cisproinstallerx64"	cmdinstall.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\MsiExec	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\DbgTrace\MsiExec	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Testing purposes	cmdinstall.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer	cmdinstall.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\Proxy	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Options	cmdinstall.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam\ModeEx	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Cam\ModeEx = "2"	cmdinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS	cmdinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Cam	cmdinstall.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\Instance\{48222F79-874D-414E-9563-03C664764923} = "7408"	cmdinstall.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam\SubscriptionIdFree	cmdinstall.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam	cmdinstall.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\Proxy	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer	cmdinstall.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	cmdinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	cmdinstall.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options	cmdinstall.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Data	cmdinstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Data\CmcWindowsVersion = "{\"release_id\":1703,\"build\":15063,\"ubr\":0,\"major\":0}"	cmdinstall.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam\TKey required = "0"	cmdinstall.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\DbgTrace\cmdinstall	cmdinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer\Instance	cmdinstall.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\VolatileData	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam	cmdinstall.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam\LicenseKeyFree	cmdinstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam\PricingTerm	cmdinstall.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer	cmdinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Data	cmdinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options	cmdinstall.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Data	cmdinstall.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Options\Proxy	cmdinstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam\ProductID = "cis.paid_trial_free"	cmdinstall.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Cam	cmdinstall.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\VolatileData	cmdinstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options\UsageStatHost = "cmc.comodo.com"	cmdinstall.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Data	cmdinstall.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Options	cmdinstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exeMsiExec.exeMsiExec.execmdinstall.exe

description	ioc	process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	MsiExec.exe
File opened (read-only)	\??\T:	MsiExec.exe
File opened (read-only)	\??\H:	cmdinstall.exe
File opened (read-only)	\??\P:	cmdinstall.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	cmdinstall.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	MsiExec.exe
File opened (read-only)	\??\X:	MsiExec.exe
File opened (read-only)	\??\E:	MsiExec.exe
File opened (read-only)	\??\T:	cmdinstall.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	MsiExec.exe
File opened (read-only)	\??\N:	MsiExec.exe
File opened (read-only)	\??\O:	MsiExec.exe
File opened (read-only)	\??\B:	cmdinstall.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	MsiExec.exe
File opened (read-only)	\??\Z:	cmdinstall.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	cmdinstall.exe
File opened (read-only)	\??\E:	cmdinstall.exe
File opened (read-only)	\??\K:	cmdinstall.exe
File opened (read-only)	\??\N:	cmdinstall.exe
File opened (read-only)	\??\X:	cmdinstall.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	MsiExec.exe
File opened (read-only)	\??\J:	MsiExec.exe
File opened (read-only)	\??\S:	MsiExec.exe
File opened (read-only)	\??\Z:	MsiExec.exe
File opened (read-only)	\??\R:	MsiExec.exe
File opened (read-only)	\??\W:	MsiExec.exe
File opened (read-only)	\??\Y:	MsiExec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	MsiExec.exe
File opened (read-only)	\??\G:	MsiExec.exe
File opened (read-only)	\??\Q:	MsiExec.exe
File opened (read-only)	\??\U:	MsiExec.exe
File opened (read-only)	\??\Z:	MsiExec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	MsiExec.exe
File opened (read-only)	\??\B:	MsiExec.exe
File opened (read-only)	\??\H:	MsiExec.exe
File opened (read-only)	\??\K:	MsiExec.exe
File opened (read-only)	\??\V:	MsiExec.exe
File opened (read-only)	\??\R:	cmdinstall.exe
File opened (read-only)	\??\S:	cmdinstall.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	MsiExec.exe
File opened (read-only)	\??\V:	MsiExec.exe
File opened (read-only)	\??\V:	cmdinstall.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	MsiExec.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
phishing motw

Processes:

flow ioc

2861 https://www.manageengine.com/cookiepolicybanner.html

flow	ioc
2861	https://www.manageengine.com/cookiepolicybanner.html

Drops file in System32 directory 60 IoCs

Processes:

DrvInst.exePRTG Probe.exenpcapoem.exeNPFInstall.exePRTG_IPMI_Sensor.exePRTG Server.exeXenServerRRDSensor.exeVMwareSensor.exeisestart.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e7717c6d-a333-8e49-a781-2dfef300723a}\SET2F57.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_7abd107f8e2977e7\npcap.sys	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	PRTG Probe.exe
File created	C:\Windows\SysWOW64\wpcap.dll	npcapoem.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netserv.inf_amd64_ecd984f601508a74\netserv.PNF	NPFInstall.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\27999D99C94133F97B49300A7A341170	PRTG Probe.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_A2D1E6F7C5D8A16EB86000D2072F8E10	PRTG Probe.exe
File created	C:\Windows\SysWOW64\WlanHelper.exe	npcapoem.exe
File created	C:\Windows\system32\Npcap\WlanHelper.exe	npcapoem.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_e610f6f65afdc230\netnb.PNF	NPFInstall.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e7717c6d-a333-8e49-a781-2dfef300723a}\npcap.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_ded82fc1c2b41e6b\netvwififlt.PNF	NPFInstall.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	PRTG Probe.exe
File created	C:\Windows\SysWOW64\Npcap\NpcapHelper.exe	npcapoem.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e7717c6d-a333-8e49-a781-2dfef300723a}\SET2F55.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{e7717c6d-a333-8e49-a781-2dfef300723a}\SET2F57.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{e7717c6d-a333-8e49-a781-2dfef300723a}\SET2F55.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\AdvMetaLog_probe.log	PRTG Probe.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PRTG_IPMI_Sensor.exe.log	PRTG_IPMI_Sensor.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9D62370080CB5FB23719D6AF2D727C1C	PRTG Probe.exe
File created	C:\Windows\system32\wpcap.dll	npcapoem.exe
File created	C:\Windows\system32\Npcap\wpcap.dll	npcapoem.exe
File created	C:\Windows\System32\DriverStore\Temp\{e7717c6d-a333-8e49-a781-2dfef300723a}\SET2F56.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e7717c6d-a333-8e49-a781-2dfef300723a}\NPCAP.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_739e9ec110147b31\netbrdg.PNF	NPFInstall.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	PRTG Server.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e7717c6d-a333-8e49-a781-2dfef300723a}\npcap.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_23069e5b67ce90a4\c_netservice.PNF	NPFInstall.exe
File created	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_7abd107f8e2977e7\npcap.PNF	NPFInstall.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\XenServerRRDSensor.exe.log	XenServerRRDSensor.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VMwareSensor.exe.log	VMwareSensor.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\27999D99C94133F97B49300A7A341170	PRTG Probe.exe
File created	C:\Windows\SysWOW64\Packet.dll	npcapoem.exe
File created	C:\Windows\SysWOW64\Npcap\wpcap.dll	npcapoem.exe
File created	C:\Windows\SysWOW64\Npcap\WlanHelper.exe	npcapoem.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_56290c9e296b5be9\netpacer.PNF	NPFInstall.exe
File created	C:\Windows\SysWOW64\NpcapHelper.exe	npcapoem.exe
File created	C:\Windows\system32\NpcapHelper.exe	npcapoem.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_960a76222168b3fa\ndiscap.PNF	NPFInstall.exe
File created	C:\Windows\system32\WlanHelper.exe	npcapoem.exe
File created	C:\Windows\system32\Npcap\NpcapHelper.exe	npcapoem.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_286311b3ad406c73\netrass.PNF	NPFInstall.exe
File created	C:\Windows\system32\Npcap\Packet.dll	npcapoem.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e7717c6d-a333-8e49-a781-2dfef300723a}\SET2F56.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	PRTG Probe.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9D62370080CB5FB23719D6AF2D727C1C	PRTG Probe.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_54cf91ab0e4c9ac2\wfpcapture.PNF	NPFInstall.exe
File created	C:\Windows\syswow64\iseguard32.dll	isestart.exe
File created	C:\Windows\SysWOW64\Npcap\Packet.dll	npcapoem.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_7abd107f8e2977e7\NPCAP.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\system32\Packet.dll	npcapoem.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{e7717c6d-a333-8e49-a781-2dfef300723a}	DrvInst.exe
File created	C:\Windows\system32\iseguard64.dll	isestart.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	PRTG Probe.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_A2D1E6F7C5D8A16EB86000D2072F8E10	PRTG Probe.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_7abd107f8e2977e7\npcap.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_9b48be32f09b1fb6\netnwifi.PNF	NPFInstall.exe
File opened for modification	C:\Windows\System32\AdvMetaLog_core.log	PRTG Server.exe

Drops file in Program Files directory 64 IoCs

Processes:

prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmpNPFInstall.exePRTG Server.exe

description	ioc	process
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-LPA57.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-OSMNA.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-LKOB8.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\multiprocessing\__pycache__\is-OB323.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\multiprocessing\__pycache__\is-L58OQ.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\site-packages\pip\_vendor\urllib3\util\is-KCSL6.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\javascript\is-U61R4.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\mapicons\iconset5\is-A9TQB.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-MBBHU.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\DLLs\is-OUFRM.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\site-packages\pip\_vendor\rich\is-451OA.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\site-packages\Crypto\Hash\is-KEHC9.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\site-packages\Crypto\SelfTest\Random\is-04LJ4.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\mapicons\iconset5\is-NG0PI.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-GLMTS.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\asyncio\__pycache__\is-Q2JAL.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\frontend\bundle\is-16F73.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\javascript\is-JG5TR.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\mailtemplates\is-2DPUS.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-6UD6N.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\site-packages\Crypto\Hash\is-HAD59.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-FIOHE.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\encodings\__pycache__\is-RSOPG.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\lookups\is-ACOS8.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File opened for modification	C:\Program Files\Npcap\NPFInstall.log	NPFInstall.exe
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\mapobjects\is-COKLT.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-1F3F3.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\importlib\__pycache__\is-EQV2G.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\__pycache__\is-RDK2A.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\lookups\prtg.standardlookups.paessler.veeam.yesno_no_is_error.ovl	PRTG Server.exe
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-DSOQM.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-VVI2J.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-D9693.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\mapicons\defaulticons2\is-RL4JG.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-MP8UC.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\site-packages\Crypto\Protocol\is-U6AAV.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-6R435.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\ctypes\test\is-P5GOP.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\distutils\tests\__pycache__\is-RU9NH.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\site-packages\Crypto\Hash\__pycache__\is-DBJJI.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\icons\devices\is-P0T84.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\includes\tct\theater\is-7HA2B.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\public\is-GAP40.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\frontend\bundle\is-8VU16.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-NO4UT.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-8I1RD.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\javascript\lib\slickgrid\plugins\is-D8V31.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\MIB\is-3M9QK.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\asyncio\is-6QL98.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\distutils\__pycache__\is-3BDCF.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\site-packages\pip\_vendor\requests\__pycache__\is-2C6NS.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-NA0N1.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\python\Lib\distutils\command\is-TE63Q.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\lookups\is-HLCER.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-4Q9JD.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-VQK22.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\icons\is-9A704.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-HS6A8.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-4Q517.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-GLMOS.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\mailtemplates\reminder\global\br\is-H7OJT.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\mailtemplates\reminder\global\DE\is-K7S57.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-790LN.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
File created	C:\Program Files (x86)\PRTG Network Monitor\webroot\help\is-HQDPE.tmp	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp

Drops file in Windows directory 28 IoCs

Processes:

DrvInst.exemsiexec.exeNPFInstall.exeblockcom.exeblockcom.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI391C.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	NPFInstall.exe
File created	C:\Windows\Performance\WinSAT\DataStore\chrome.exe	blockcom.exe
File opened for modification	C:\Windows\Installer\MSI3CE7.tmp	msiexec.exe
File created	C:\Windows\Performance\WinSAT\DataStore\7a73b78f679a6f	blockcom.exe
File created	C:\Windows\uk-UA\csrss.exe	blockcom.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\microsoft.system.package.metadata\ApplicationFrameHost.exe	blockcom.exe
File opened for modification	C:\Windows\Installer\MSI392C.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3BDD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D67.tmp	msiexec.exe
File created	C:\Windows\Installer\e80362c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI391B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D68.tmp	msiexec.exe
File created	C:\Windows\INF\oem3.PNF	NPFInstall.exe
File created	C:\Windows\uk-UA\886983d96e3d3e	blockcom.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI38DB.tmp	msiexec.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\microsoft.system.package.metadata\6dd19aba3e2428	blockcom.exe
File opened for modification	C:\Windows\Installer\e80362c.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6D506E2A-AB2C-4D1E-A226-AB27BC469B62}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D47.tmp	msiexec.exe
File created	C:\Windows\schemas\VpnProfile\dllhost.exe	blockcom.exe
File created	C:\Windows\MiracastView\en-US\dllhost.exe	blockcom.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 34 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

DrvInst.exeNPFInstall.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	NPFInstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	NPFInstall.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Creates scheduled task(s) 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

Processes:

pid	process
2844	schtasks.exe
6448	schtasks.exe
6416	schtasks.exe
5308	schtasks.exe
5412	schtasks.exe
5768	schtasks.exe
5468	schtasks.exe
6684	schtasks.exe
6424	schtasks.exe
3296	schtasks.exe
5768	schtasks.exe
5168	schtasks.exe
5716	schtasks.exe
5616	schtasks.exe
6464	schtasks.exe
5432	schtasks.exe
6324	schtasks.exe
5404	schtasks.exe
2412	schtasks.exe
4032	schtasks.exe
424	schtasks.exe
5824	schtasks.exe
6456	schtasks.exe
1136	schtasks.exe
6784	schtasks.exe
4604	schtasks.exe
6744	schtasks.exe
6608	schtasks.exe
6796	schtasks.exe
6744	schtasks.exe
6784	schtasks.exe
6464	schtasks.exe
5780	schtasks.exe
5596	schtasks.exe
6532	schtasks.exe
6304	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2108 taskkill.exe

pid	process
2108	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exePRTG Probe.exePRTG Server.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	PRTG Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	PRTG Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	PRTG Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	PRTG Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	PRTG Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	PRTG Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	PRTG Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	PRTG Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	PRTG Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	PRTG Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	PRTG Probe.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\1E7EF647CBA150281C60897257102878C4BD8CDC\Blob = 0300000001000000140000001e7ef647cba150281c60897257102878c4bd8cdc1400000001000000140000008a747faf85cdee95cd3d9cd0e24614f371351d27040000000100000010000000178ef18343ccc9e0ecb0e38d9dea03d80f00000001000000200000000625ac65b521da9255c15c0b806e2a3c90d010b0cdc7045df65d05f5cb693db9190000000100000010000000440771e9fd9b149cfa0e96a7eaa47f515c000000010000000400000000080000180000000100000010000000e6fee6521c735bc60c74ebb251da386620000000010000009a050000308205963082037ea003020102020d0203bc53596b34c718f5015066300d06092a864886f70d01010b05003047310b300906035504061302555331223020060355040a1319476f6f676c65205472757374205365727669636573204c4c43311430120603550403130b47545320526f6f74205231301e170d3230303831333030303034325a170d3237303933303030303034325a3046310b300906035504061302555331223020060355040a1319476f6f676c65205472757374205365727669636573204c4c43311330110603550403130a4754532043412031433330820122300d06092a864886f70d01010105000382010f003082010a0282010100f588dfe7628c1e37f83742907f6c87d0fb658225fde8cb6ba4ff6de95a23e299f61ce9920399137c090a8afa42d65e5624aa7a33841fd1e969bbb974ec574c66689377375553fe39104db734bb5f2577373b1794ea3ce59dd5bcc3b443eb2ea747efb0441163d8b44185dd413048931bbfb7f6e0450221e0964217cfd92b6556340726040da8fd7dca2eefea487c374d3f009f83dfef75842e79575cfc576e1a96fffc8c9aa699be25d97f962c06f7112a028080eb63183c504987e58aca5f192b59968100a0fb51dbca770b0bc9964fef7049c75c6d20fd99b4b4e2ca2e77fd2ddc0bb66b130c8c192b179698b9f08bf6a027bbb6e38d518fbdaec79bb1899d0203010001a38201803082017c300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b0601050507030230120603551d130101ff040830060101ff020100301d0603551d0e041604148a747faf85cdee95cd3d9cd0e24614f371351d27301f0603551d23041830168014e4af2b26711a2b4827852f52662ceff08913713e306806082b06010505070101045c305a302606082b06010505073001861a687474703a2f2f6f6373702e706b692e676f6f672f6774737231303006082b060105050730028624687474703a2f2f706b692e676f6f672f7265706f2f63657274732f67747372312e64657230340603551d1f042d302b3029a027a0258623687474703a2f2f63726c2e706b692e676f6f672f67747372312f67747372312e63726c30570603551d200450304e3038060a2b06010401d679020503302a302806082b06010505070201161c68747470733a2f2f706b692e676f6f672f7265706f7369746f72792f3008060667810c0102013008060667810c010202300d06092a864886f70d01010b05000382020100897dac205c0c3cbe9aa857951bb4aefaaba57271b43695fddf4011034cc24614bb1424abf0507122dbadc46e7fcff16a6fc8831bd8ce895f876c87b8a90ca39ba162949395df5bae66190b02969efcb5e710693e7acb46495f46e141b1d7984d653400801a3f4f9f6c7f4900815341a4922182821af1a3445b2a5012134dc15336f34208af54fa8e77531b6438271709bd58c91b7c392d5bf3ced4ed97db1403bf0953241fc20c04799826f261f15352fd428c1b662b3f15a1bbfff69be3819a01067189352824dde1bdeb192de148cb3d598351b474c69d7cc6b1865bafcc34c4d3ccd481119500a1f4122201fab48371af8cb78c7324ac3753c200903f11fe5ced3694103bbd29aee2c73a623b6c63d980bf5971ac6327b94c17a0daf67315bf2ade8ff3a56c32813303d08651719934ba938d5db55158f7b293e801f659be719bfd4d28cecf6dc716dcf7d1d6469ba7ca6be9770ffda0b61b23831d101ad9090084e044d3a27523b33486f620b0a45e101de05246009db10f1f217051f59add06fc55f42b0e3377c34b42c2f17713fc738094eb1fbb373fce022a66b0731d32a5326c32b08ee0c423ff5b7d4d6570ac2b9b3dcedbe06d8e3280be969f9263bc97bb5db9f4e1715e2ae4ef0322b18a653a8fc09365d485cd0f0f5b83591647162d9c243ac880a62614859bf6379bac6ff9c5c30651f3e27fc5b110ba51f4dd	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\1E7EF647CBA150281C60897257102878C4BD8CDC	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	PRTG Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	PRTG Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	PRTG Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	PRTG Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	PRTG Probe.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	PRTG Server.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	PRTG Probe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

Modifies registry class 15 IoCs

Processes:

blockcom.exeprtgmovekey.execmdinstall.exefirefox.exeblockcom.exeDupper (2).cmd

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	blockcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{915DDB6E-B3A8-1AE8-C8BE-F05496AD0221}\LocalizedString = "@%SystemRoot%\\System32\\urlmon.dll,-4200"	prtgmovekey.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCFF154D-A97B-4138-A1AC-A2B0C3C05696}	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCFF154D-A97B-4138-A1AC-A2B0C3C05696}\TDate = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3e2d356149d8043b21a68045ec049aa040000000200000000001066000000010000200000007f57d6342127cbcff564d2b46eaf2059a655ed2005aff6cf09f2e6361e22fe06000000000e8000000002000020000000cd6a64c2def600023cbe2e628163fd663fec615e630a15d03bbf147ea27ec94410000000dd7fba5832c91f992a25e4e15f8080794000000043b932f4feff739b4531d02a6f19954ff60fb28810a850844226297d9a39b8a839c2964705d2c34aa3379ea37817152bf9205a35e50d3fee88dd5d80a1645719	cmdinstall.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{915DDB6E-B3A8-1AE8-C8BE-F05496AD0221}	prtgmovekey.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{915DDB6E-B3A8-1AE8-C8BE-F05496AD0221}\InprocServer32	prtgmovekey.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{915DDB6E-B3A8-1AE8-C8BE-F05496AD0221}\InprocServer32\ThreadingModel = "Apartment"	prtgmovekey.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	blockcom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{915DDB6E-B3A8-1AE8-C8BE-F05496AD0221}\Elevation	prtgmovekey.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{915DDB6E-B3A8-1AE8-C8BE-F05496AD0221}\Elevation\Enabled = "1"	prtgmovekey.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{915DDB6E-B3A8-1AE8-C8BE-F05496AD0221}\InprocServer32\ = "C:\\Windows\\SysWOW64\\urlmon.dll"	prtgmovekey.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	Dupper (2).cmd
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{915DDB6E-B3A8-1AE8-C8BE-F05496AD0221}\ = "PersistentZoneIdentifier"	prtgmovekey.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{915DDB6E-B3A8-1AE8-C8BE-F05496AD0221}\AppId = "{0968e258-16c7-4dba-aa86-462dd61e31a3}"	prtgmovekey.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1080 reg.exe

pid	process
1080	reg.exe

Modifies system certificate store 2 TTPs 31 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

cmdinstall.exePRTG Probe.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\60EE3FC53D4BDFD1697AE5BEAE1CAB1C0F3AD4E3	cmdinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4CE89794FE2D2F7E30121F10BCF76AC3CCF77CA9	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4668000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	cmdinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E1D782A8E191BEEF6BCA1691B5AAB494A6249BF3	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4CE89794FE2D2F7E30121F10BCF76AC3CCF77CA9\Blob = 0f000000010000002000000051296450c9049de88a6df397cfe6ee4eeb29020c6789c8db737b6c96bf2ad6a70300000001000000140000004ce89794fe2d2f7e30121f10bcf76ac3ccf77ca92000000001000000c7050000308205c3308204aba003020102021009256314069e7e6a88cb823075c0d9c9300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3230303530313030303030305a170d3231303530373132303030305a3081d231133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a43616c69666f726e6961311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e311530130603550405130c323030303130333130303133310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130753656174746c6531193017060355040a1310496e7365637572652e436f6d204c4c433119301706035504031310496e7365637572652e436f6d204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100a88cd713346c50a5cd2a62900419f091330f9820b73b38785a8b5a25ceda8e11b71b2d11ff4b0c18cad405a2a195a6462619fa3ddf6d14466a350d1cf1c6ad48cce166fe6011a62ee62751046dd264b1cc145c4a4354537cec1ae615b6b8566a28ddf3b510fee92023dbe4190b44bb4174f94c4ec62256bd4aa5ba541ee833388db8cc411365e094ee6314eaff59ca6659bb6388300e7ffbd0f8b299889b8e3ea526f8ca926ded79eac89a6b068757ae428022e2602ec98babf5998216b0c28a709129a1300872878d9971e3130826a7d1ce894fe649a017003f07ee3c53ca0cba998fab097e573723fbd3e0ea1b742dd6d076b4c2284b93500021a7d27109630203010001a38201f8308201f4301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604140a9c208099309acdddf9c9909a03890dcd30c8ea30350603551d11042e302ca02a06082b06010505070803a01e301c0c1a55532d43414c49464f524e49412d323030303130333130303133300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b0500038201010042368fc33025a2a1338cf35a08d00e263958f825e79b6d3af23e0e4e4cf59bc8502022d452cbba14a53274e3a12a5b01f4aee16abfcb1b28d63484a0ae1995c9759c6f0970254da8902fb479f5f7869a566aa285f2c28e50096dfd2e14a9ecf0000963c570d2338def108dfe66b1e44d22182826749871a7f3977eba4976910f1f0de866fc75b918c1a9f466fcf96ae90df932071b9c770f0f3193f8ca500abe52cc316549403a5ca5b5422d1ebffffc3cbe3b926de552f493b53c6570fdd0736550f080c2db204b03bc00ff724241581b5dfb0dff7b8f2cc28f136c19cca8bd4b3c3d81404e69f4598e7b5458e41c6f2e6622a212d28c2615565782a1f66987	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d901030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3BA63A6E4841355772DEBEF9CDCF4D5AF353A297\Blob = 0f000000010000002000000056b5f0d9db578e3f142921daa387902722a76700375c7e1c4ae0ba004bacaa0c0300000001000000140000003ba63a6e4841355772debef9cdcf4d5af353a2972000000001000000350500003082053130820419a00302010202100aa125d6d6321b7e41e405da3697c215300d06092a864886f70d01010b05003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3136303130373132303030305a170d3331303130373132303030305a3072310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3131302f060355040313284469676943657274205348413220417373757265642049442054696d657374616d70696e6720434130820122300d06092a864886f70d01010105000382010f003082010a0282010100bdd032ee4bcd8f7fdda9ba8299c539542857b6234ac40e07453351107dd0f97d4d687ee7b6a0f48db388e497bf63219098bf13bc57d3c3e17e08d66a140038f72e1e3beecca6f63259fe5f653fe09bebe34647061a557e0b277ec0a2f5a0e0de223f0eff7e95fbf3a3ba223e18ac11e4f099036d3b857c09d3ee5dc89a0b54e3a809716be0cf22100f75cf71724e0aaddf403a5cb751e1a17914c64d2423305dbcec3c606aac2f07ccfdf0ea47d988505efd666e56612729898451e682e74650fd942a2ca7e4753eba980f847f9f3114d6add5f264cb7b1e05d084197217f11706ef3dcdd64def0642fda2532a4f851dc41d3cafcfdaac10f5ddacace956ff930203010001a38201ce308201ca301d0603551d0e04160414f4b6e1201dfe29aed2e461a5b2a225b2c817356e301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f30120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070308307906082b06010505070101046d306b302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304306082b060105050730028637687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e6372743081810603551d1f047a3078303aa038a0368634687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e63726c303aa038a0368634687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e63726c30500603551d20044930473038060a6086480186fd6c000204302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f435053300b06096086480186fd6c0701300d06092a864886f70d01010b05000382010100719512e951875669cdefddda7caa637ab378cf06374084ef4b84bfcacf0302fdc5a7c30e20422caf77f32b1f0c215a2ab705341d6aae99f827a266bf09aa60df76a43a930ff8b2d1d87c1962e85e82251ec4ba1c7b2c21e2d65b2c1435430468b2db7502e072c798d63c64e51f4810185f8938614d62462487638c91522caf2989e5781fd60b14a580d7124770b375d59385937eb69267fb536189a8f56b96c0f458690d7cc801b1b92875b7996385228c61ca79947e59fc8c0fe36fb50126b66ca5ee875121e458609bba0c2d2b6da2c47ebbc4252b4702087c49ae13b6e17c424228c61856cf4134b6665db6747bf55633222f2236b24ba24a95d8f5a68e52	cmdinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	PRTG Probe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa60300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4314000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f04000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	PRTG Probe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 0f0000000100000030000000761613f4cd8607508c3d520fbefe68773735fc73746f42a9fd6254ba3b72f0047994e5af57677cf6d2c1965984965df1090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003a0000005300650063007400690067006f002000280066006f0072006d00650072006c007900200043006f006d006f0064006f002000430041002900000062000000010000002000000052f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b40234140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d41d0000000100000010000000cb39c3d4272cdf63774e1db810c5a89e030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb42000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\60EE3FC53D4BDFD1697AE5BEAE1CAB1C0F3AD4E3\Blob = 0f0000000100000020000000eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf03000000010000001400000060ee3fc53d4bdfd1697ae5beae1cab1c0f3ad4e32000000001000000c0060000308206bc308205a4a003020102021003f1b4e15f3a82f1149678b3d7d8475c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3132303431383132303030305a170d3237303431383132303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e672043412028534841322930820122300d06092a864886f70d01010105000382010f003082010a0282010100a753fa0fb2b513f164cf8480fcae8035d1b6d7c7a32cac1a2cacf184ac3a35123a9291ba57e4c4c9f32fa8483cb7d66edc9722ba517961af432f0db79bb44931ae44583ea4a196a7874f237ec36c652490553ea1ca237cc542e9c47a62459b7dde6374cb9e6325f8849a9aad454fae7d1fc813cb759bc9e1e18af80b0c98f4ca3ed045aa7a1ea558933634be2b2e2b315866b432109f9df052a1efe83ed376f2405adcfa6a3d1b4bad76b08c5cee36ba83ea30a84cdef10b2a584188ae0089ab03d11682202276eb5e54381262e1d27024dbed1f70d26409802de2b69dce1ff2bb21f36cdbd8b3197b8a509fefec360a5c9ab74ad308a03979fdddbf3d3a09250203010001a38203583082035430120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307f06082b0601050507010104733071302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304906082b06010505073002863d687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63727430818f0603551d1f0481873081843040a03ea03c863a687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63726c3040a03ea03c863a687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274486967684173737572616e63654556526f6f7443412e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0302308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e301d0603551d0e041604148fe87ef06d326a000523c770976a3a90ff6bead4301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d01010b0500038201010019334a0c813337dbad36c9e4c93abbb51b2e7aa2e2f44342179ebf4ea14de1b1dbe981dd9f01f2e488d5e9fe09fd21c1ec5d80d2f0d6c143c2fe772bdbf9d79133ce6cd5b2193be62ed6c9934f88408ecde1f57ef10fc6595672e8eb6a41bd1cd546d57c49ca663815c1bfe091707787dcc98d31c90c29a233ed8de287cd898d3f1bffd5e01a978b7cda6dfba8c6b23a666b7b01b3cdd8a634ec1201ab9558a5c45357a860e6e70212a0b92364a24dbb7c81256421becfee42184397bba53706af4dff26a54d614bec4641b865ceb8799e08960b818c8a3b8fc7998ca32a6e986d5e61c696b78ab9612d93b8eb0e0443d7f5fea6f062d4996aa5c1c1f0649480	cmdinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3C0D087ECDCC76D1084ABE00F1FEE5040400AE37	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3C0D087ECDCC76D1084ABE00F1FEE5040400AE37\Blob = 0f0000000100000020000000e5657d41869c485f7a75539139120605e5dc5a373a8f8a96e3c2b30140cc76220300000001000000140000003c0d087ecdcc76d1084abe00f1fee5040400ae372000000001000000c6050000308205c2308204aaa00302010202100aa60783ebb5076ebc2d12da9b04c290300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3231303530353030303030305a170d3234303631303233353935395a3081d2311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a43616c69666f726e6961311530130603550405130c323030303130333130303133310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130753656174746c6531193017060355040a1310496e7365637572652e436f6d204c4c433119301706035504031310496e7365637572652e436f6d204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6ec814ee2c7075e2e29ac7ebd10b6188055929370a213b83fb6e337d82ed0756d15e267f6bc645e6db5bb1d586ef1098ead1595147d03897af04b666aa5a50def2b3af23974896c6fb4f5246baf3ec374dbfd90eeec7575ffb11a6efea7a0d7da0adb04eaf000b1ad520d9e9529b2a8cf420998d4c7a46c1f95e405e35f69ad8c05d62df0f9745017a6284134afba26f905d900da1c412200e6ca5c6b148f3f785aa0ebe35ea9160644bd6924b54625eb404ab39db981f6b216b6dd960930a1443b26aab08cdbcf1c5fd74dbb56c3e9df791f8429401dee5869e90c39f95000fc616b5ac8396b588e24407235ea074328c608112f6cb4f07347cd4d28d28ab90203010001a38201f7308201f3301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e04160414c5b210483c7598f90d32838cd0763d3cd85fef5130350603551d11042e302ca02a06082b06010505070803a01e301c0c1a55532d43414c49464f524e49412d323030303130333130303133300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304a0603551d2004433041303606096086480186fd6c03023029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101008b2182887ada0e08e4afe89019ded16e88ff6ff1b12fd9b2994b945b8c76c63862ae35a1751672c474c8575a039250105e346bb7ce7ae1f2494e760de418b9453f1bbac9255b0dccafd296adb3cdb49d46d54c3413bfc34a3e640e244da7b1e1dbd1b04cea414ff64fe57f0ef28944a42e41065548e4834f2b05d4aae8516a1f154c5b09af25fe059a69a7dc75a7deb4cf3068c402614ece0509edf02b0968b5c8d1081cdafcfba3b7c1599256e6685ef7391f46746eaf829bc8fd40f55be70a3fc51142648b78a903e750158328cb80d54aaddce82df8fe983b0e36af4dafbdbdffe8896bee9a93c370e77f735fe9c42fc2259a3e5672e9f75f37ecf7104e53	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186819000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	cmdinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46	cmdinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E1C950E6EF22F84C5645728B922060D7D5A7A3E8	PRTG Probe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E1C950E6EF22F84C5645728B922060D7D5A7A3E8\Blob = 0f0000000100000030000000e4c58a0a499480862db093ada2b299298d57d1c586bee12c4b74d5e13dd4bcbda6d57be981eee012e984e6b83d0b4c7b09000000010000002a000000302806082b0601050507030206082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000002a575471e31340bc21581cbd2cf13e158463203ece94bcf9d3cc196bf09a54720b0000000100000018000000470054005300200052006f006f0074002000520031000000140000000100000014000000e4af2b26711a2b4827852f52662ceff08913713e1d0000000100000010000000afec13f04d331040c81e81d2b3ec2e24030000000100000014000000e1c950e6ef22f84c5645728b922060d7d5a7a3e820000000010000005e0500003082055a30820342a00302010202106e47a9c54b470c0dec33d089b91cf4e1300d06092a864886f70d01010c05003047310b300906035504061302555331223020060355040a1319476f6f676c65205472757374205365727669636573204c4c43311430120603550403130b47545320526f6f74205231301e170d3136303632323030303030305a170d3336303632323030303030305a3047310b300906035504061302555331223020060355040a1319476f6f676c65205472757374205365727669636573204c4c43311430120603550403130b47545320526f6f7420523130820222300d06092a864886f70d01010105000382020f003082020a0282020100b611028b1ee3a1779b3bdcbf943eb795a7403ca1fd82f97d32068271f6f68c7ffbe8dbbc6a2e9797a38c4bf92bf6b1f9ce841db1f9c597deefb9f2a3e9bc12895ea7aa52abf82327cba4b19c63dbd7997ef00a5eeb68a6f4c65a470d4d1033e34eb113a3c8186c4becfc0990df9d6429252307a1b4d23d2e60e0cfd20987bbcd48f04dc2c27a888abbbacf5919d6af8fb007b09e31f182c1c0df2ea66d6c190eb5d87e261a45033db079a49428ad0f7f26e5a808fe96e83c689453ee833a882b159609b2e07a8c2e75d69ceba756648f964f68ae3d97c2848fc0bc40c00b5cbdf687b3356cac18507f84e04ccd92d320e933bc5299af32b529b3252ab448f972e1ca64f7e682108de89dc28a88fa38668afc63f901f978fd7b5c77fa7687faecdfb10e799557b4bd26efd601d1eb160abb8e0bb5c5c58a55abd3acea914b29cc19a432254e2af16544d002ceaace49b4ea9f7c83b0407be743aba76ca38f7d8981fa4ca5ffd58ec3ce4be0b5d8b38e45cf76c0ed402bfd530fb0a7d53b0db18aa203de31adcc77ea6f7b3ed6df912212e6befad832fc1063145172de5dd61693bd296833ef3a66ec078a26df13d757657827de5e491400a2007f9aa821b6a9b195b0a5b90d1611dac76c483c40e07e0d5acd563cd19705b9cb4bed394b9cc43fd255136e24b0d671faf4c1bacced1bf5fe8141d800983d3ac8ae7a98371805950203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414e4af2b26711a2b4827852f52662ceff08913713e300d06092a864886f70d01010c0500038202010038960aee3db4961e5fef9d9c0b339f2be0cafdd28e0a1f4174a57caa84d4e5f21ee63752329c0bd1611dbf28c1b6442935757798b27cd9bd74ac8a68e3a9310929016073e3477c53a8904a27ef4bd79f93e78236ce9a680c82e7cfd410166f5f0e995cf61f717defef7b2f7eea36d697700b15eed75c566a33a5e349380cb87dfb8d85a4b1595ef46ae1dda1f66444aee651832166c6113ef3ce47ee9c281f25daffac6695dd350f5cef202c62fd91baa9ccfc5a9c93818329974a7c5a72b439d0b777cb79fd693a9237ed6e3865467ee960bd7988975f3812f4eeaf5b82c886d5e1996d8c04f276ba49f66ee96d1e5fa0ef27827640f8a6d3585c0f2c42da42c67b8834c7c1d8459bc13ec5611dd9635049f634856ae018c56e47ab4142299bf6600dd231d3639823935a008148b4efcd8acdc9cf99eed99eaa36e1684b71491436283a3d1dce9a8f25e68071612bb57bccf9251681e1315fa1a37e16a49c166a9718bd7672a50b9e1d36e62fa12fbe70910fa8e6daf8c492406c257e7bb309dcb217ad8044f068a58f9475ff745ae8a8027c0c09e2a94b0ba0850b62b9efa13192fbeff65104896ce8a974a1bb17b3b5fd490f7c3cec831820434ed593bab434b11f16361f0ce66439164cdce0fe1dc8a9623d40eacac53402b4ae89883335dc2c1373d827f1d072ee753b22de9868665bf1c66347551cbaa5085175a64825	PRTG Probe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 5c00000001000000040000000010000019000000010000001000000082218ffb91733e64136be5719f57c3a1030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb41d0000000100000010000000cb39c3d4272cdf63774e1db810c5a89e140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d462000000010000002000000052f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b402340b000000010000003a0000005300650063007400690067006f002000280066006f0072006d00650072006c007900200043006f006d006f0064006f002000430041002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000030000000761613f4cd8607508c3d520fbefe68773735fc73746f42a9fd6254ba3b72f0047994e5af57677cf6d2c1965984965df10400000001000000100000001b31b0714036cc143691adc43efdec182000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74	cmdinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a8937214000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d430f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	PRTG Probe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 19000000010000001000000082218ffb91733e64136be5719f57c3a1030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb41d0000000100000010000000cb39c3d4272cdf63774e1db810c5a89e140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d462000000010000002000000052f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b402340b000000010000003a0000005300650063007400690067006f002000280066006f0072006d00650072006c007900200043006f006d006f0064006f002000430041002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000030000000761613f4cd8607508c3d520fbefe68773735fc73746f42a9fd6254ba3b72f0047994e5af57677cf6d2c1965984965df12000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E1D782A8E191BEEF6BCA1691B5AAB494A6249BF3\Blob = 0f0000000100000020000000a43de6baf968a942da017b70769fdb65b3cfb1bbca1f9174da26a7d8aae78ec5030000000100000014000000e1d782a8e191beef6bca1691b5aab494a6249bf3200000000100000002050000308204fe308203e6a00302010202100d424ae0be3a88ff604021ce1400f0dd300d06092a864886f70d01010b05003072310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3131302f060355040313284469676943657274205348413220417373757265642049442054696d657374616d70696e67204341301e170d3231303130313030303030305a170d3331303130363030303030305a3048310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3120301e0603550403131744696769436572742054696d657374616d70203230323130820122300d06092a864886f70d01010105000382010f003082010a0282010100c2e6618467c58af50d08a445ca636b51d73a1142bd0a75754d94b40c50b52610fe1dc86f916b0c96e71a5c48ef44e5bf9b61cd1591625ab8ff670b9c63fd366a81fa29f8dd2b7085de0218f3786dbc7df9c76d093dbe6a7687e98abdf8845d1e76c9e4c676763a53d1d1d35a368fc6a3e12f1b3ab761d673ec4e6d338a7c5d452d4bb150e6413a375686dc93238df75025e864e6ddd38f2f57b58720eb0e8e2cd523daf44d7846e3038331294a5c0c318a4a8c88c5f7305af914af155f6c434909fd262353f68d63e81aab5bb11d30c29b6982b4dbfc5654bc1fa187abbe7a5b0a202f4b09c995a78db2fad6638b4ea5721cee9f7a0173f819d6fe0d4984bd010203010001a38201b8308201b4300e0603551d0f0101ff040403020780300c0603551d130101ff0402300030160603551d250101ff040c300a06082b0601050507030830410603551d20043a3038303606096086480186fd6c07013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f435053301f0603551d23041830168014f4b6e1201dfe29aed2e461a5b2a225b2c817356e301d0603551d0e041604143644868ea4bab066bebc282d1d4436dde36a7abc30710603551d1f046a30683032a030a02e862c687474703a2f2f63726c332e64696769636572742e636f6d2f736861322d617373757265642d74732e63726c3032a030a02e862c687474703a2f2f63726c342e64696769636572742e636f6d2f736861322d617373757265642d74732e63726c30818506082b0601050507010104793077302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304f06082b060105050730028643687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572745348413241737375726564494454696d657374616d70696e6743412e637274300d06092a864886f70d01010b05000382010100481cdcb5e99a23bce71ae7200e8e6746fd427251740a2347a3ab92d225c47059be14a0e52781a54d1415190779f0d104c386d93bbdfe4402664ded69a40ff6b870cf62e8f5514a7879367a27b7f3e7529f93a7ed439e7be7b4dd412289fb87a246034efcf4feb76477635f2352698382fa1a53ed90cc8da117730df4f36539704bf39cd67a7bda0cbc3d32d01bcbf561fc75080076bc810ef8c0e15ccfc41172e71b6449d8229a751542f52d323881daf460a2bab452fb5ce06124254fb2dfc929a8734351dabd63d61f5b9bf72e1b4f131df74a0d717e97b7f43f84ebc1e3a349a1facea7bf56cfba597661895f7ea7b48e6778f93698e1cb28da5b87a68a2f	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4\Blob = 0400000001000000100000001b31b0714036cc143691adc43efdec180f0000000100000030000000761613f4cd8607508c3d520fbefe68773735fc73746f42a9fd6254ba3b72f0047994e5af57677cf6d2c1965984965df1090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003a0000005300650063007400690067006f002000280066006f0072006d00650072006c007900200043006f006d006f0064006f002000430041002900000062000000010000002000000052f0e1c4e58ec629291b60317f074671b85d7ea80d5b07273463534b32b40234140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d41d0000000100000010000000cb39c3d4272cdf63774e1db810c5a89e030000000100000014000000afe5d244a8d1194230ff479fe2f897bbcd7a8cb419000000010000001000000082218ffb91733e64136be5719f57c3a12000000001000000dc050000308205d8308203c0a00302010202104caaf9cadb636fe01ff74ed85b03869d300d06092a864886f70d01010c0500308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f72697479301e170d3130303131393030303030305a170d3338303131383233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a3423040301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201000af1d54684b7ae51bb6cb24d411400934c9ccbe5c054cfa0258e02f9fdb0a20df520983c132dac56a2b0d67e1192e92eba9e2e9a72b1bd19446c6135a29ab41612695a8ce1d73ea41ae82f03f4ae611d101b2aa48b7ac5fe05a6e1c0d6c8fe9eae8f2bba3d99f8d8730958466ea69cf4d727d395da3783721cd373e0a2479903385dd5497900291cc7ec9b201c0724695778b239fc3a84a0b59c7c8dbf2e936227b739da1718aebd3c0968ff849b3cd5d60b03e3579e14f7d1eb4fc8bd8723b7b6494379855cbaeb920ba1c6e868a84c16b11a990ae8532c92bba10918750c65a87bcb23b71ac22885c31bffd02b62efa47b099198678c1401cd68066a6321750380888a6e81c685f2a9a42de7f4a524104783cacdf48d7958b1069be71a2ad99d01d7947ded034acaf0dbe8a9013ef55699c91e8e493dbbe509b9e04f49923d168240cccc59c6e63aed122e693c6c95b1fdaa1d7b7f86be1e0e3246fbfb138f757f4c8b4b4663fe00344070c1c3b9a1dda670e204b341bce98091ea649c7ae12203a99c6e6f0e654f6c87875ef36ea0f975a59b40e853b2279d4ab9c077218dff87f2debc8cef17dfb7490bd1f26e300b1a0e4e76ed11fcf5e956b27dbfc76d0a938ca5d0c0b61dbe3a4e94a2d76e6c0bc28a7cfa20f3c4e4e5cd0da8cb9192b17c85ecb51469660e82e7cdcec82da6517f21c1355385064a5d9fadbb1b5f74	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 5c000000010000000400000000080000190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4668000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb040000000100000010000000a7f2e41606411150306b9ce3b49cb0c920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E1C950E6EF22F84C5645728B922060D7D5A7A3E8\Blob = 040000000100000010000000821aefd4d24af29fe23d9706147072850f0000000100000030000000e4c58a0a499480862db093ada2b299298d57d1c586bee12c4b74d5e13dd4bcbda6d57be981eee012e984e6b83d0b4c7b09000000010000002a000000302806082b0601050507030206082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000002a575471e31340bc21581cbd2cf13e158463203ece94bcf9d3cc196bf09a54720b0000000100000018000000470054005300200052006f006f0074002000520031000000140000000100000014000000e4af2b26711a2b4827852f52662ceff08913713e1d0000000100000010000000afec13f04d331040c81e81d2b3ec2e24030000000100000014000000e1c950e6ef22f84c5645728b922060d7d5a7a3e8190000000100000010000000e6fee6521c735bc60c74ebb251da386620000000010000005e0500003082055a30820342a00302010202106e47a9c54b470c0dec33d089b91cf4e1300d06092a864886f70d01010c05003047310b300906035504061302555331223020060355040a1319476f6f676c65205472757374205365727669636573204c4c43311430120603550403130b47545320526f6f74205231301e170d3136303632323030303030305a170d3336303632323030303030305a3047310b300906035504061302555331223020060355040a1319476f6f676c65205472757374205365727669636573204c4c43311430120603550403130b47545320526f6f7420523130820222300d06092a864886f70d01010105000382020f003082020a0282020100b611028b1ee3a1779b3bdcbf943eb795a7403ca1fd82f97d32068271f6f68c7ffbe8dbbc6a2e9797a38c4bf92bf6b1f9ce841db1f9c597deefb9f2a3e9bc12895ea7aa52abf82327cba4b19c63dbd7997ef00a5eeb68a6f4c65a470d4d1033e34eb113a3c8186c4becfc0990df9d6429252307a1b4d23d2e60e0cfd20987bbcd48f04dc2c27a888abbbacf5919d6af8fb007b09e31f182c1c0df2ea66d6c190eb5d87e261a45033db079a49428ad0f7f26e5a808fe96e83c689453ee833a882b159609b2e07a8c2e75d69ceba756648f964f68ae3d97c2848fc0bc40c00b5cbdf687b3356cac18507f84e04ccd92d320e933bc5299af32b529b3252ab448f972e1ca64f7e682108de89dc28a88fa38668afc63f901f978fd7b5c77fa7687faecdfb10e799557b4bd26efd601d1eb160abb8e0bb5c5c58a55abd3acea914b29cc19a432254e2af16544d002ceaace49b4ea9f7c83b0407be743aba76ca38f7d8981fa4ca5ffd58ec3ce4be0b5d8b38e45cf76c0ed402bfd530fb0a7d53b0db18aa203de31adcc77ea6f7b3ed6df912212e6befad832fc1063145172de5dd61693bd296833ef3a66ec078a26df13d757657827de5e491400a2007f9aa821b6a9b195b0a5b90d1611dac76c483c40e07e0d5acd563cd19705b9cb4bed394b9cc43fd255136e24b0d671faf4c1bacced1bf5fe8141d800983d3ac8ae7a98371805950203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414e4af2b26711a2b4827852f52662ceff08913713e300d06092a864886f70d01010c0500038202010038960aee3db4961e5fef9d9c0b339f2be0cafdd28e0a1f4174a57caa84d4e5f21ee63752329c0bd1611dbf28c1b6442935757798b27cd9bd74ac8a68e3a9310929016073e3477c53a8904a27ef4bd79f93e78236ce9a680c82e7cfd410166f5f0e995cf61f717defef7b2f7eea36d697700b15eed75c566a33a5e349380cb87dfb8d85a4b1595ef46ae1dda1f66444aee651832166c6113ef3ce47ee9c281f25daffac6695dd350f5cef202c62fd91baa9ccfc5a9c93818329974a7c5a72b439d0b777cb79fd693a9237ed6e3865467ee960bd7988975f3812f4eeaf5b82c886d5e1996d8c04f276ba49f66ee96d1e5fa0ef27827640f8a6d3585c0f2c42da42c67b8834c7c1d8459bc13ec5611dd9635049f634856ae018c56e47ab4142299bf6600dd231d3639823935a008148b4efcd8acdc9cf99eed99eaa36e1684b71491436283a3d1dce9a8f25e68071612bb57bccf9251681e1315fa1a37e16a49c166a9718bd7672a50b9e1d36e62fa12fbe70910fa8e6daf8c492406c257e7bb309dcb217ad8044f068a58f9475ff745ae8a8027c0c09e2a94b0ba0850b62b9efa13192fbeff65104896ce8a974a1bb17b3b5fd490f7c3cec831820434ed593bab434b11f16361f0ce66439164cdce0fe1dc8a9623d40eacac53402b4ae89883335dc2c1373d827f1d072ee753b22de9868665bf1c66347551cbaa5085175a64825	PRTG Probe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E1C950E6EF22F84C5645728B922060D7D5A7A3E8\Blob = 5c000000010000000400000000100000190000000100000010000000e6fee6521c735bc60c74ebb251da3866030000000100000014000000e1c950e6ef22f84c5645728b922060d7d5a7a3e81d0000000100000010000000afec13f04d331040c81e81d2b3ec2e24140000000100000014000000e4af2b26711a2b4827852f52662ceff08913713e0b0000000100000018000000470054005300200052006f006f00740020005200310000006200000001000000200000002a575471e31340bc21581cbd2cf13e158463203ece94bcf9d3cc196bf09a547209000000010000002a000000302806082b0601050507030206082b0601050507030406082b0601050507030106082b060105050703080f0000000100000030000000e4c58a0a499480862db093ada2b299298d57d1c586bee12c4b74d5e13dd4bcbda6d57be981eee012e984e6b83d0b4c7b040000000100000010000000821aefd4d24af29fe23d97061470728520000000010000005e0500003082055a30820342a00302010202106e47a9c54b470c0dec33d089b91cf4e1300d06092a864886f70d01010c05003047310b300906035504061302555331223020060355040a1319476f6f676c65205472757374205365727669636573204c4c43311430120603550403130b47545320526f6f74205231301e170d3136303632323030303030305a170d3336303632323030303030305a3047310b300906035504061302555331223020060355040a1319476f6f676c65205472757374205365727669636573204c4c43311430120603550403130b47545320526f6f7420523130820222300d06092a864886f70d01010105000382020f003082020a0282020100b611028b1ee3a1779b3bdcbf943eb795a7403ca1fd82f97d32068271f6f68c7ffbe8dbbc6a2e9797a38c4bf92bf6b1f9ce841db1f9c597deefb9f2a3e9bc12895ea7aa52abf82327cba4b19c63dbd7997ef00a5eeb68a6f4c65a470d4d1033e34eb113a3c8186c4becfc0990df9d6429252307a1b4d23d2e60e0cfd20987bbcd48f04dc2c27a888abbbacf5919d6af8fb007b09e31f182c1c0df2ea66d6c190eb5d87e261a45033db079a49428ad0f7f26e5a808fe96e83c689453ee833a882b159609b2e07a8c2e75d69ceba756648f964f68ae3d97c2848fc0bc40c00b5cbdf687b3356cac18507f84e04ccd92d320e933bc5299af32b529b3252ab448f972e1ca64f7e682108de89dc28a88fa38668afc63f901f978fd7b5c77fa7687faecdfb10e799557b4bd26efd601d1eb160abb8e0bb5c5c58a55abd3acea914b29cc19a432254e2af16544d002ceaace49b4ea9f7c83b0407be743aba76ca38f7d8981fa4ca5ffd58ec3ce4be0b5d8b38e45cf76c0ed402bfd530fb0a7d53b0db18aa203de31adcc77ea6f7b3ed6df912212e6befad832fc1063145172de5dd61693bd296833ef3a66ec078a26df13d757657827de5e491400a2007f9aa821b6a9b195b0a5b90d1611dac76c483c40e07e0d5acd563cd19705b9cb4bed394b9cc43fd255136e24b0d671faf4c1bacced1bf5fe8141d800983d3ac8ae7a98371805950203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414e4af2b26711a2b4827852f52662ceff08913713e300d06092a864886f70d01010c0500038202010038960aee3db4961e5fef9d9c0b339f2be0cafdd28e0a1f4174a57caa84d4e5f21ee63752329c0bd1611dbf28c1b6442935757798b27cd9bd74ac8a68e3a9310929016073e3477c53a8904a27ef4bd79f93e78236ce9a680c82e7cfd410166f5f0e995cf61f717defef7b2f7eea36d697700b15eed75c566a33a5e349380cb87dfb8d85a4b1595ef46ae1dda1f66444aee651832166c6113ef3ce47ee9c281f25daffac6695dd350f5cef202c62fd91baa9ccfc5a9c93818329974a7c5a72b439d0b777cb79fd693a9237ed6e3865467ee960bd7988975f3812f4eeaf5b82c886d5e1996d8c04f276ba49f66ee96d1e5fa0ef27827640f8a6d3585c0f2c42da42c67b8834c7c1d8459bc13ec5611dd9635049f634856ae018c56e47ab4142299bf6600dd231d3639823935a008148b4efcd8acdc9cf99eed99eaa36e1684b71491436283a3d1dce9a8f25e68071612bb57bccf9251681e1315fa1a37e16a49c166a9718bd7672a50b9e1d36e62fa12fbe70910fa8e6daf8c492406c257e7bb309dcb217ad8044f068a58f9475ff745ae8a8027c0c09e2a94b0ba0850b62b9efa13192fbeff65104896ce8a974a1bb17b3b5fd490f7c3cec831820434ed593bab434b11f16361f0ce66439164cdce0fe1dc8a9623d40eacac53402b4ae89883335dc2c1373d827f1d072ee753b22de9868665bf1c66347551cbaa5085175a64825	PRTG Probe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c00000001000000040000000008000019000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b0400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E1C950E6EF22F84C5645728B922060D7D5A7A3E8\Blob = 190000000100000010000000e6fee6521c735bc60c74ebb251da3866030000000100000014000000e1c950e6ef22f84c5645728b922060d7d5a7a3e81d0000000100000010000000afec13f04d331040c81e81d2b3ec2e24140000000100000014000000e4af2b26711a2b4827852f52662ceff08913713e0b0000000100000018000000470054005300200052006f006f00740020005200310000006200000001000000200000002a575471e31340bc21581cbd2cf13e158463203ece94bcf9d3cc196bf09a547209000000010000002a000000302806082b0601050507030206082b0601050507030406082b0601050507030106082b060105050703080f0000000100000030000000e4c58a0a499480862db093ada2b299298d57d1c586bee12c4b74d5e13dd4bcbda6d57be981eee012e984e6b83d0b4c7b20000000010000005e0500003082055a30820342a00302010202106e47a9c54b470c0dec33d089b91cf4e1300d06092a864886f70d01010c05003047310b300906035504061302555331223020060355040a1319476f6f676c65205472757374205365727669636573204c4c43311430120603550403130b47545320526f6f74205231301e170d3136303632323030303030305a170d3336303632323030303030305a3047310b300906035504061302555331223020060355040a1319476f6f676c65205472757374205365727669636573204c4c43311430120603550403130b47545320526f6f7420523130820222300d06092a864886f70d01010105000382020f003082020a0282020100b611028b1ee3a1779b3bdcbf943eb795a7403ca1fd82f97d32068271f6f68c7ffbe8dbbc6a2e9797a38c4bf92bf6b1f9ce841db1f9c597deefb9f2a3e9bc12895ea7aa52abf82327cba4b19c63dbd7997ef00a5eeb68a6f4c65a470d4d1033e34eb113a3c8186c4becfc0990df9d6429252307a1b4d23d2e60e0cfd20987bbcd48f04dc2c27a888abbbacf5919d6af8fb007b09e31f182c1c0df2ea66d6c190eb5d87e261a45033db079a49428ad0f7f26e5a808fe96e83c689453ee833a882b159609b2e07a8c2e75d69ceba756648f964f68ae3d97c2848fc0bc40c00b5cbdf687b3356cac18507f84e04ccd92d320e933bc5299af32b529b3252ab448f972e1ca64f7e682108de89dc28a88fa38668afc63f901f978fd7b5c77fa7687faecdfb10e799557b4bd26efd601d1eb160abb8e0bb5c5c58a55abd3acea914b29cc19a432254e2af16544d002ceaace49b4ea9f7c83b0407be743aba76ca38f7d8981fa4ca5ffd58ec3ce4be0b5d8b38e45cf76c0ed402bfd530fb0a7d53b0db18aa203de31adcc77ea6f7b3ed6df912212e6befad832fc1063145172de5dd61693bd296833ef3a66ec078a26df13d757657827de5e491400a2007f9aa821b6a9b195b0a5b90d1611dac76c483c40e07e0d5acd563cd19705b9cb4bed394b9cc43fd255136e24b0d671faf4c1bacced1bf5fe8141d800983d3ac8ae7a98371805950203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414e4af2b26711a2b4827852f52662ceff08913713e300d06092a864886f70d01010c0500038202010038960aee3db4961e5fef9d9c0b339f2be0cafdd28e0a1f4174a57caa84d4e5f21ee63752329c0bd1611dbf28c1b6442935757798b27cd9bd74ac8a68e3a9310929016073e3477c53a8904a27ef4bd79f93e78236ce9a680c82e7cfd410166f5f0e995cf61f717defef7b2f7eea36d697700b15eed75c566a33a5e349380cb87dfb8d85a4b1595ef46ae1dda1f66444aee651832166c6113ef3ce47ee9c281f25daffac6695dd350f5cef202c62fd91baa9ccfc5a9c93818329974a7c5a72b439d0b777cb79fd693a9237ed6e3865467ee960bd7988975f3812f4eeaf5b82c886d5e1996d8c04f276ba49f66ee96d1e5fa0ef27827640f8a6d3585c0f2c42da42c67b8834c7c1d8459bc13ec5611dd9635049f634856ae018c56e47ab4142299bf6600dd231d3639823935a008148b4efcd8acdc9cf99eed99eaa36e1684b71491436283a3d1dce9a8f25e68071612bb57bccf9251681e1315fa1a37e16a49c166a9718bd7672a50b9e1d36e62fa12fbe70910fa8e6daf8c492406c257e7bb309dcb217ad8044f068a58f9475ff745ae8a8027c0c09e2a94b0ba0850b62b9efa13192fbeff65104896ce8a974a1bb17b3b5fd490f7c3cec831820434ed593bab434b11f16361f0ce66439164cdce0fe1dc8a9623d40eacac53402b4ae89883335dc2c1373d827f1d072ee753b22de9868665bf1c66347551cbaa5085175a64825	PRTG Probe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\3BA63A6E4841355772DEBEF9CDCF4D5AF353A297	cmdinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 040000000100000010000000a7f2e41606411150306b9ce3b49cb0c90f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d901030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	cmdinstall.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.exe:Zone.Identifier	firefox.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 368 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	flow	ioc
HTTP User-Agent header	368	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

NPFInstall.exepowershell.exepowershell.exechrome.exePRTG Server.exePRTG Probe.exechrome.exe

pid	process
4312	NPFInstall.exe
4312	NPFInstall.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
2568	powershell.exe
2568	powershell.exe
2568	powershell.exe
2568	powershell.exe
5868	chrome.exe
5868	chrome.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
6600	chrome.exe
6600	chrome.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
2860	PRTG Server.exe
3056	PRTG Probe.exe
3056	PRTG Probe.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

chrome.exe

pid process

6728 chrome.exe
Suspicious behavior: LoadsDriver 4 IoCs

Processes:

pid process

632
632
632
632

pid	process
6728	chrome.exe

pid	process
632
632
632
632

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

Processes:

chrome.exe

pid	process
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exetaskkill.exeprtgmovekey.exeNPFInstall.exesvchost.exesvchost.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1704	firefox.exe
Token: SeDebugPrivilege	1704	firefox.exe
Token: SeDebugPrivilege	1704	firefox.exe
Token: SeDebugPrivilege	1704	firefox.exe
Token: SeDebugPrivilege	1704	firefox.exe
Token: SeDebugPrivilege	2108	taskkill.exe
Token: 33	3468	prtgmovekey.exe
Token: SeIncBasePriorityPrivilege	3468	prtgmovekey.exe
Token: SeDebugPrivilege	1704	firefox.exe
Token: SeDebugPrivilege	4312	NPFInstall.exe
Token: SeShutdownPrivilege	1352	svchost.exe
Token: SeCreatePagefilePrivilege	1352	svchost.exe
Token: SeAuditPrivilege	884	svchost.exe
Token: SeSecurityPrivilege	884	svchost.exe
Token: SeDebugPrivilege	3992	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeIncreaseQuotaPrivilege	2568	powershell.exe
Token: SeSecurityPrivilege	2568	powershell.exe
Token: SeTakeOwnershipPrivilege	2568	powershell.exe
Token: SeLoadDriverPrivilege	2568	powershell.exe
Token: SeSystemProfilePrivilege	2568	powershell.exe
Token: SeSystemtimePrivilege	2568	powershell.exe
Token: SeProfSingleProcessPrivilege	2568	powershell.exe
Token: SeIncBasePriorityPrivilege	2568	powershell.exe
Token: SeCreatePagefilePrivilege	2568	powershell.exe
Token: SeBackupPrivilege	2568	powershell.exe
Token: SeRestorePrivilege	2568	powershell.exe
Token: SeShutdownPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeSystemEnvironmentPrivilege	2568	powershell.exe
Token: SeRemoteShutdownPrivilege	2568	powershell.exe
Token: SeUndockPrivilege	2568	powershell.exe
Token: SeManageVolumePrivilege	2568	powershell.exe
Token: 33	2568	powershell.exe
Token: 34	2568	powershell.exe
Token: 35	2568	powershell.exe
Token: 36	2568	powershell.exe
Token: SeIncreaseQuotaPrivilege	2568	powershell.exe
Token: SeSecurityPrivilege	2568	powershell.exe
Token: SeTakeOwnershipPrivilege	2568	powershell.exe
Token: SeLoadDriverPrivilege	2568	powershell.exe
Token: SeSystemProfilePrivilege	2568	powershell.exe
Token: SeSystemtimePrivilege	2568	powershell.exe
Token: SeProfSingleProcessPrivilege	2568	powershell.exe
Token: SeIncBasePriorityPrivilege	2568	powershell.exe
Token: SeCreatePagefilePrivilege	2568	powershell.exe
Token: SeBackupPrivilege	2568	powershell.exe
Token: SeRestorePrivilege	2568	powershell.exe
Token: SeShutdownPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeSystemEnvironmentPrivilege	2568	powershell.exe
Token: SeRemoteShutdownPrivilege	2568	powershell.exe
Token: SeUndockPrivilege	2568	powershell.exe
Token: SeManageVolumePrivilege	2568	powershell.exe
Token: 33	2568	powershell.exe
Token: 34	2568	powershell.exe
Token: 35	2568	powershell.exe
Token: 36	2568	powershell.exe
Token: SeIncreaseQuotaPrivilege	2568	powershell.exe
Token: SeSecurityPrivilege	2568	powershell.exe
Token: SeTakeOwnershipPrivilege	2568	powershell.exe
Token: SeLoadDriverPrivilege	2568	powershell.exe
Token: SeSystemProfilePrivilege	2568	powershell.exe
Token: SeSystemtimePrivilege	2568	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

firefox.exeprtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmpchrome.exe

pid	process
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
2596	prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe

Suspicious use of SendNotifyMessage 33 IoCs

Processes:

firefox.exechrome.exe

pid	process
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe
5868	chrome.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

firefox.exeManageEngine_OpManager_64bit.exeManageEngine_NetFlowAnalyzer_64bit.execmdinstall.exeisestart.exe

pid	process
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
1704	firefox.exe
6080	ManageEngine_OpManager_64bit.exe
6080	ManageEngine_OpManager_64bit.exe
5972	ManageEngine_NetFlowAnalyzer_64bit.exe
5972	ManageEngine_NetFlowAnalyzer_64bit.exe
7408	cmdinstall.exe
7408	cmdinstall.exe
7408	cmdinstall.exe
7408	cmdinstall.exe
7336	isestart.exe
7336	isestart.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 780 wrote to memory of 1704	780	firefox.exe	firefox.exe
PID 780 wrote to memory of 1704	780	firefox.exe	firefox.exe
PID 780 wrote to memory of 1704	780	firefox.exe	firefox.exe
PID 780 wrote to memory of 1704	780	firefox.exe	firefox.exe
PID 780 wrote to memory of 1704	780	firefox.exe	firefox.exe
PID 780 wrote to memory of 1704	780	firefox.exe	firefox.exe
PID 780 wrote to memory of 1704	780	firefox.exe	firefox.exe
PID 780 wrote to memory of 1704	780	firefox.exe	firefox.exe
PID 780 wrote to memory of 1704	780	firefox.exe	firefox.exe
PID 780 wrote to memory of 1704	780	firefox.exe	firefox.exe
PID 780 wrote to memory of 1704	780	firefox.exe	firefox.exe
PID 1704 wrote to memory of 4552	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 4552	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 908	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 4796	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 4796	1704	firefox.exe	firefox.exe
PID 1704 wrote to memory of 4796	1704	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\advbattoexeconverter.exe
"C:\Users\Admin\AppData\Local\Temp\advbattoexeconverter.exe"
1⤵
- DcRat
- Loads dropped DLL
PID:4212

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:780

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.0.358379620\1301784848" -parentBuildID 20221007134813 -prefsHandle 1696 -prefMapHandle 1692 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bb9cbed-9ef2-4058-8853-74deb1d58736} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 1776 1e65adcdb58 gpu
3⤵
PID:4552

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.1.775799913\188101372" -parentBuildID 20221007134813 -prefsHandle 2104 -prefMapHandle 2100 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3364c139-9c58-425f-84d6-acb3bfb54b3e} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 2132 1e648a6fb58 socket
3⤵
PID:908

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.2.243456131\1005162754" -childID 1 -isForBrowser -prefsHandle 2748 -prefMapHandle 2680 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {06114877-9b25-4859-9d77-71d742252edb} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 2984 1e65f092b58 tab
3⤵
PID:4796

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.3.1093904647\1203165137" -childID 2 -isForBrowser -prefsHandle 3388 -prefMapHandle 3372 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04e526ba-033f-4c1d-894a-d560c0a6acfc} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 3420 1e648a61358 tab
3⤵
PID:2308

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.4.1262991348\1779214848" -childID 3 -isForBrowser -prefsHandle 4304 -prefMapHandle 3740 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe5b673c-5484-43e1-ac04-991bd1981d1e} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 4328 1e660c66858 tab
3⤵
PID:2936

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.5.1114214148\616489056" -childID 4 -isForBrowser -prefsHandle 4860 -prefMapHandle 4716 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8762fe75-e779-4510-b149-443179d5f04a} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 4872 1e66112d958 tab
3⤵
PID:4316

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.6.2116163306\1562849964" -childID 5 -isForBrowser -prefsHandle 5008 -prefMapHandle 5012 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {36044da0-3d75-4e63-865e-8d0e6dd4c4e9} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 5000 1e66112e258 tab
3⤵
PID:4764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.7.546939232\616798475" -childID 6 -isForBrowser -prefsHandle 5208 -prefMapHandle 5212 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {59f0695f-d8c8-4e4d-899e-19268a110d52} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 5200 1e66112e858 tab
3⤵
PID:664

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.8.1580704881\85539838" -childID 7 -isForBrowser -prefsHandle 4632 -prefMapHandle 4308 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bee7c11-049a-4dfc-bc14-835977266455} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 4608 1e65ddb7858 tab
3⤵
PID:776

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.9.1487766295\1640325833" -childID 8 -isForBrowser -prefsHandle 5768 -prefMapHandle 3108 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {62d711fd-965c-4dd4-b258-4181eb71e4e3} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 4468 1e65e235c58 tab
3⤵
PID:3580

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.10.308103551\2044841980" -parentBuildID 20221007134813 -prefsHandle 4932 -prefMapHandle 5164 -prefsLen 26768 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {858526e4-8a73-4105-9d95-a9ff51ed4d27} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 5152 1e662ba6c58 rdd
3⤵
PID:648

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.11.2087902520\1682538232" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5168 -prefMapHandle 4932 -prefsLen 26768 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {59dd5330-97e5-447c-82da-3a69358adfc4} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 5132 1e663159858 utility
3⤵
PID:1692

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1704.12.1678105236\773615625" -childID 9 -isForBrowser -prefsHandle 5104 -prefMapHandle 5028 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {550f3e12-fec0-4bfb-bc5f-964384f727af} 1704 "\\.\pipe\gecko-crash-server-pipe.1704" 3112 1e65d6c4558 tab
3⤵
PID:1716

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1140

C:\Users\Admin\Downloads\prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.exe
"C:\Users\Admin\Downloads\prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.exe"
1⤵
- Executes dropped EXE
PID:820

C:\Users\Admin\AppData\Local\Temp\is-3F3KE.tmp\prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp
"C:\Users\Admin\AppData\Local\Temp\is-3F3KE.tmp\prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.tmp" /SL5="$2029A,363146424,816128,C:\Users\Admin\Downloads\prtg_installer_with_trial_key_000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:2596

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /t /im "PRTG Enterprise Console.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\PRTGLicenseCheck64.exe /c /path "C:\Program Files (x86)\PRTG Network Monitor" /temp "C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\is-HML3E.tmp" /version "0.0.0" /language english > C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\is-0THFD.tmp
3⤵
PID:68

C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\PRTGLicenseCheck64.exe
C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\PRTGLicenseCheck64.exe /c /path "C:\Program Files (x86)\PRTG Network Monitor" /temp "C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\is-HML3E.tmp" /version "0.0.0" /language english
4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
PID:1376

C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\prtgmovekey.exe
"C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\prtgmovekey.exe"
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\PRTGLicenseCheck64.exe /c /path "C:\Program Files (x86)\PRTG Network Monitor" /temp "C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\is-PNBCF.tmp" /version "0.0.0" /language english > C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\is-MMH41.tmp
3⤵
PID:2188

C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\PRTGLicenseCheck64.exe
C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\PRTGLicenseCheck64.exe /c /path "C:\Program Files (x86)\PRTG Network Monitor" /temp "C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\is-PNBCF.tmp" /version "0.0.0" /language english
4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
PID:2128

C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\PRTGLicenseCheck64.exe
"C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\PRTGLicenseCheck64.exe" /s /name "prtgtrial" /key "000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ" /path "C:\Program Files (x86)\PRTG Network Monitor"
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
PID:740

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\PRTGLicenseCheck64.exe /a /name "prtgtrial" /key "000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ" /path "C:\Program Files (x86)\PRTG Network Monitor" /temp "C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\is-QNAP1.tmp" /version "0.0.0" /language english > C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\is-UR3UC.tmp
3⤵
PID:68

C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\PRTGLicenseCheck64.exe
C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\PRTGLicenseCheck64.exe /a /name "prtgtrial" /key "000014-X2PKFM-8FFMZM-8U0NQH-MW6VFR-VVCV8D-79Q8KD-FB91JQ-97MPB1-MU9JHQ" /path "C:\Program Files (x86)\PRTG Network Monitor" /temp "C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\is-QNAP1.tmp" /version "0.0.0" /language english
4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
PID:1352

C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\innounp.exe
"C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\innounp.exe" -x -dprobe PRTG_Remote_Probe_Installer.exe
3⤵
- Executes dropped EXE
PID:4148

C:\Windows\SysWOW64\netsh.exe
"netsh" advfirewall firewall delete rule name="PRTG_Network_Monitor_Server"
3⤵
- Modifies Windows Firewall
PID:1392

C:\Windows\SysWOW64\netsh.exe
"netsh" advfirewall firewall delete rule name="PRTG_Network_Monitor_Application_Server"
3⤵
- Modifies Windows Firewall
PID:1588

C:\Windows\SysWOW64\netsh.exe
"netsh" advfirewall firewall delete rule name="PRTG_Network_Monitor_Probe"
3⤵
- Modifies Windows Firewall
PID:2492

C:\Windows\SysWOW64\netsh.exe
"netsh" advfirewall firewall delete rule name="PRTG_Network_Monitor_Admin_Tool"
3⤵
- Modifies Windows Firewall
PID:2108

C:\Windows\SysWOW64\netsh.exe
"netsh" advfirewall firewall add rule name="PRTG_Network_Monitor_Server" action=allow dir=in profile=domain,private,public enable=yes program="C:\Program Files (x86)\PRTG Network Monitor\64 bit\PRTG Server.exe" description="Allow PRTG Network Monitor Core Server to be accessed externally"
3⤵
- Modifies Windows Firewall
PID:1344

C:\Windows\SysWOW64\netsh.exe
"netsh" advfirewall firewall add rule name="PRTG_Network_Monitor_Server" action=allow dir=in profile=domain,private,public enable=yes program="C:\Program Files (x86)\PRTG Network Monitor\PRTG Server.exe" description="Allow PRTG Network Monitor Core Server to be accessed externally"
3⤵
- Modifies Windows Firewall
PID:4172

C:\Windows\SysWOW64\netsh.exe
"netsh" advfirewall firewall add rule name="PRTG_Network_Monitor_Application_Server" action=allow dir=in profile=domain,private,public enable=yes program="C:\Program Files (x86)\PRTG Network Monitor\64 bit\prtgappserver.exe" description="Allow PRTG Network Monitor Application Server to be accessed externally"
3⤵
- Modifies Windows Firewall
PID:4316

C:\Windows\SysWOW64\netsh.exe
"netsh" advfirewall firewall add rule name="PRTG_Network_Monitor_Application_Server" action=allow dir=in profile=domain,private,public enable=yes program="C:\Program Files (x86)\PRTG Network Monitor\prtgappserver.exe" description="Allow PRTG Network Monitor Application Server to be accessed externally"
3⤵
- Modifies Windows Firewall
PID:2796

C:\Windows\SysWOW64\netsh.exe
"netsh" advfirewall firewall add rule name="PRTG_Network_Monitor_Probe" action=allow dir=in profile=domain,private,public enable=yes program="C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe" description="Allow PRTG Network Monitor Probe to be accessed externally"
3⤵
- Modifies Windows Firewall
PID:2860

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:1392

C:\Windows\SysWOW64\netsh.exe
"netsh" advfirewall firewall add rule name="PRTG_Network_Monitor_Admin_Tool" action=allow dir=in profile=domain,private,public enable=yes program="C:\Program Files (x86)\PRTG Network Monitor\PRTG Administrator.exe"
3⤵
- Modifies Windows Firewall
PID:540

C:\Windows\SysWOW64\netsh.exe
"netsh" advfirewall firewall add rule name="PRTG_Network_Monitor_Admin_Tool" action=allow dir=in profile=domain,private,public enable=yes program="C:\Program Files (x86)\PRTG Network Monitor\64 bit\PRTG Administrator.exe"
3⤵
- Modifies Windows Firewall
PID:1184

C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\probe\{app}\npcapoem.exe
"C:\Users\Admin\AppData\Local\Temp\is-57PQM.tmp\probe\{app}\npcapoem.exe" /S /winpcap_mode=yes /loopback_support=no /npf_startup=yes
3⤵
- DcRat
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:4548

C:\Users\Admin\AppData\Local\Temp\nsx2833.tmp\NPFInstall.exe
"C:\Users\Admin\AppData\Local\Temp\nsx2833.tmp\NPFInstall.exe" -n -check_dll
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\Windows\SysWOW64\certutil.exe
certutil -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nsx2833.tmp\roots.p7b"
4⤵
- Manipulates Digital Signatures
PID:836

C:\Windows\SysWOW64\certutil.exe
certutil -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nsx2833.tmp\signing.p7b"
4⤵
- Manipulates Digital Signatures
PID:1108

C:\Program Files\Npcap\NPFInstall.exe
"C:\Program Files\Npcap\NPFInstall.exe" -n -c
4⤵
- Executes dropped EXE
PID:788

C:\Windows\SYSTEM32\pnputil.exe
pnputil.exe -e
5⤵
PID:3608

C:\Program Files\Npcap\NPFInstall.exe
"C:\Program Files\Npcap\NPFInstall.exe" -n -iw
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2156

C:\Program Files\Npcap\NPFInstall.exe
"C:\Program Files\Npcap\NPFInstall.exe" -n -i
4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2216

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Start-Service -Name npcap -PassThru | Stop-Service -PassThru | Start-Service"
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3992

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Register-ScheduledTask -Force -TaskName 'npcapwatchdog' -Description 'Ensure Npcap service is configured to start at boot' -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Npcap\CheckStatus.bat') -Principal (New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount) -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Compatibility Win8)"
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\PRTG Network Monitor\cert\generatedh.bat""
3⤵
PID:2560

C:\Program Files (x86)\PRTG Network Monitor\openssl.exe
..\openssl.exe dhparam -out dh.pem -2 1024
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296

C:\Program Files (x86)\PRTG Network Monitor\PRTG GUI Starter.exe
"C:\Program Files (x86)\PRTG Network Monitor\PRTG GUI Starter.exe" firstinstall
3⤵
- Executes dropped EXE
PID:5784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" http://127.0.0.1/group.htm?id=0&tabid=1
4⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe41f79758,0x7ffe41f79768,0x7ffe41f79778
5⤵
PID:5880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:2
5⤵
PID:6096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:6112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:1360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3088 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:5132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:5376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4664 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:5744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5336 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5448 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4784 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:5772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2584 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:5420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5628 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3212 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5776 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5784 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:6452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5752 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:5704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6124 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:2
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:6600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4804 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:5252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6080 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:5240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5252 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5952 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=2640 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:5764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5200 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5776 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=4672 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5204 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:3192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=5644 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=5544 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:2204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=4900 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:2440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6348 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:5584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6496 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:2688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6508 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:6064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=6656 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=6912 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:1172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=6352 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:4312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=5568 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6964 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:5388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7112 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:5976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3220 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:6564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:6532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7060 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:6508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7036 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:6584

C:\Users\Admin\Downloads\ManageEngine_OpManager_64bit.exe
"C:\Users\Admin\Downloads\ManageEngine_OpManager_64bit.exe"
5⤵
- Executes dropped EXE
PID:6008

C:\Users\Admin\AppData\Local\Temp\{F4F50BD1-DCA9-4644-A442-C6503A332708}\ManageEngine_OpManager_64bit.exe
C:\Users\Admin\AppData\Local\Temp\{F4F50BD1-DCA9-4644-A442-C6503A332708}\ManageEngine_OpManager_64bit.exe -package:"C:\Users\Admin\Downloads\ManageEngine_OpManager_64bit.exe" -no_selfdeleter -IS_temp -media_path:"C:\Users\Admin\AppData\Local\Temp\{F4F50BD1-DCA9-4644-A442-C6503A332708}\Disk1\" -tempdisk1folder:"C:\Users\Admin\AppData\Local\Temp\{F4F50BD1-DCA9-4644-A442-C6503A332708}\" -IS_OriginalLauncher:"C:\Users\Admin\AppData\Local\Temp\{F4F50BD1-DCA9-4644-A442-C6503A332708}\Disk1\ManageEngine_OpManager_64bit.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6080

C:\Users\Admin\AppData\Local\Temp\{B8C4ACA2-9D57-43C4-9710-352937BE3516}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{B8C4ACA2-9D57-43C4-9710-352937BE3516}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A1C8A776-83A5-476D-BBB6-070FEB6AB4A9}
7⤵
- Executes dropped EXE
PID:6564

C:\Users\Admin\AppData\Local\Temp\{B8C4ACA2-9D57-43C4-9710-352937BE3516}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{B8C4ACA2-9D57-43C4-9710-352937BE3516}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7A1881FB-CB2C-425A-B143-BE2947CD5E13}
7⤵
- Executes dropped EXE
PID:6444

C:\Users\Admin\AppData\Local\Temp\{B8C4ACA2-9D57-43C4-9710-352937BE3516}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{B8C4ACA2-9D57-43C4-9710-352937BE3516}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F3B6E97D-6150-4C3A-A8C1-BED5F3E2AA42}
7⤵
- Executes dropped EXE
PID:396

C:\Users\Admin\AppData\Local\Temp\{B8C4ACA2-9D57-43C4-9710-352937BE3516}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{B8C4ACA2-9D57-43C4-9710-352937BE3516}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A75B0C7D-F19E-4063-A4C9-CA8BAE41DD91}
7⤵
- Executes dropped EXE
PID:2300

C:\Users\Admin\AppData\Local\Temp\{B8C4ACA2-9D57-43C4-9710-352937BE3516}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{B8C4ACA2-9D57-43C4-9710-352937BE3516}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FC50EE3D-13F0-496C-A8CF-A71FE1FBFB2D}
7⤵
- Executes dropped EXE
PID:6404

C:\Users\Admin\AppData\Local\Temp\{B8C4ACA2-9D57-43C4-9710-352937BE3516}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{B8C4ACA2-9D57-43C4-9710-352937BE3516}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2FDBAEC0-708B-4A5E-B32A-1F68B1758432}
7⤵
- Executes dropped EXE
PID:6752

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe /C C:\Users\Admin\AppData\Local\Temp\{B8C4ACA2-9D57-43C4-9710-352937BE3516}\{D6AFA160-5CF3-4C84-A2E6-18615BE014D9}\ExistDir.bat "C:\Program Files\ManageEngine\OpManager" > C:\Users\Admin\AppData\Local\Temp\{B8C4ACA2-9D57-43C4-9710-352937BE3516}\{D6AFA160-5CF3-4C84-A2E6-18615BE014D9}\Preinstall.log 2>&1
7⤵
PID:6324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:5676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=6664 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=5328 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:1824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5204 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:6484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4820 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:2668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=6580 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=6208 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:2980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=2544 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=4996 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=6292 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=4712 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --mojo-platform-channel-handle=1712 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --mojo-platform-channel-handle=6000 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --mojo-platform-channel-handle=6028 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --mojo-platform-channel-handle=6824 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --mojo-platform-channel-handle=3212 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:4040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --mojo-platform-channel-handle=5768 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:2508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2544 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:6408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5880 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:6452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --mojo-platform-channel-handle=7156 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1732 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:1588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5340 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:4560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5828 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:1824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --mojo-platform-channel-handle=6780 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6836

C:\Users\Admin\Downloads\ManageEngine_NetFlowAnalyzer_64bit.exe
"C:\Users\Admin\Downloads\ManageEngine_NetFlowAnalyzer_64bit.exe"
5⤵
- Executes dropped EXE
PID:3672

C:\Users\Admin\AppData\Local\Temp\{F91884C8-6EA7-4E28-9485-300EAB630A02}\ManageEngine_NetFlowAnalyzer_64bit.exe
C:\Users\Admin\AppData\Local\Temp\{F91884C8-6EA7-4E28-9485-300EAB630A02}\ManageEngine_NetFlowAnalyzer_64bit.exe -package:"C:\Users\Admin\Downloads\ManageEngine_NetFlowAnalyzer_64bit.exe" -no_selfdeleter -IS_temp -media_path:"C:\Users\Admin\AppData\Local\Temp\{F91884C8-6EA7-4E28-9485-300EAB630A02}\Disk1\" -tempdisk1folder:"C:\Users\Admin\AppData\Local\Temp\{F91884C8-6EA7-4E28-9485-300EAB630A02}\" -IS_OriginalLauncher:"C:\Users\Admin\AppData\Local\Temp\{F91884C8-6EA7-4E28-9485-300EAB630A02}\Disk1\ManageEngine_NetFlowAnalyzer_64bit.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5972

C:\Users\Admin\AppData\Local\Temp\{1B110BDA-D3C8-4262-BA52-A1A4FD0E4BE2}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{1B110BDA-D3C8-4262-BA52-A1A4FD0E4BE2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BFC07A06-4D0E-4282-B39F-5370DE51A4E1}
7⤵
- Executes dropped EXE
PID:6620

C:\Users\Admin\AppData\Local\Temp\{1B110BDA-D3C8-4262-BA52-A1A4FD0E4BE2}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{1B110BDA-D3C8-4262-BA52-A1A4FD0E4BE2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{91026ED5-E1F5-4B51-AC6F-7B80574532F3}
7⤵
- Executes dropped EXE
PID:5540

C:\Users\Admin\AppData\Local\Temp\{1B110BDA-D3C8-4262-BA52-A1A4FD0E4BE2}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{1B110BDA-D3C8-4262-BA52-A1A4FD0E4BE2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{22E6C842-FBC4-4659-8550-0959296B6DCD}
7⤵
- Executes dropped EXE
PID:5628

C:\Users\Admin\AppData\Local\Temp\{1B110BDA-D3C8-4262-BA52-A1A4FD0E4BE2}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{1B110BDA-D3C8-4262-BA52-A1A4FD0E4BE2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{54CC1BFB-3EA4-43D0-B10F-C85197505A27}
7⤵
- Executes dropped EXE
PID:5376

C:\Users\Admin\AppData\Local\Temp\{1B110BDA-D3C8-4262-BA52-A1A4FD0E4BE2}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{1B110BDA-D3C8-4262-BA52-A1A4FD0E4BE2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{355BF08C-116F-42D2-9A01-3FE603ED896D}
7⤵
- Executes dropped EXE
PID:3596

C:\Users\Admin\AppData\Local\Temp\{1B110BDA-D3C8-4262-BA52-A1A4FD0E4BE2}\ISBEW64.exe
C:\Users\Admin\AppData\Local\Temp\{1B110BDA-D3C8-4262-BA52-A1A4FD0E4BE2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1B8ECC80-F8D4-4923-9317-B70557950187}
7⤵
- Executes dropped EXE
PID:5256

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe /C C:\Users\Admin\AppData\Local\Temp\{1B110BDA-D3C8-4262-BA52-A1A4FD0E4BE2}\{D6AFA160-5CF3-4C84-A2E6-18615BE014D9}\ExistDir.bat "C:\Program Files\ManageEngine\OpManager" > C:\Users\Admin\AppData\Local\Temp\{1B110BDA-D3C8-4262-BA52-A1A4FD0E4BE2}\{D6AFA160-5CF3-4C84-A2E6-18615BE014D9}\Preinstall.log 2>&1
7⤵
PID:6008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --mojo-platform-channel-handle=4720 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --mojo-platform-channel-handle=6156 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --mojo-platform-channel-handle=5756 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:3748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --mojo-platform-channel-handle=6664 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:2300

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --mojo-platform-channel-handle=3192 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:1848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --mojo-platform-channel-handle=6856 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:4736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --mojo-platform-channel-handle=5620 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6704 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:6708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7212 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:4972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --mojo-platform-channel-handle=6704 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:1544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --mojo-platform-channel-handle=6700 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --mojo-platform-channel-handle=6672 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:3320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --mojo-platform-channel-handle=6544 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:2688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6600 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:1652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7592 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:4020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --mojo-platform-channel-handle=7644 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --mojo-platform-channel-handle=7380 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:4812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7356 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:4624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --mojo-platform-channel-handle=6700 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --mojo-platform-channel-handle=5292 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:3192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --mojo-platform-channel-handle=7696 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2468 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:4024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4800 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:1940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --mojo-platform-channel-handle=4864 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --mojo-platform-channel-handle=6544 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:3044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --mojo-platform-channel-handle=7304 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:4332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7244 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:3320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4968 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:4456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --mojo-platform-channel-handle=4684 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:1728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --mojo-platform-channel-handle=5156 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:2368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --mojo-platform-channel-handle=5676 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:2060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1652 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:2176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4984 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:4060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --mojo-platform-channel-handle=1576 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --mojo-platform-channel-handle=4496 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --mojo-platform-channel-handle=6172 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --mojo-platform-channel-handle=7272 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --mojo-platform-channel-handle=5972 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --mojo-platform-channel-handle=4400 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --mojo-platform-channel-handle=7140 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:2484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --mojo-platform-channel-handle=5716 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --mojo-platform-channel-handle=7312 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:1400

C:\Users\Admin\Downloads\Dupper (2).cmd
"C:\Users\Admin\Downloads\Dupper (2).cmd"
5⤵
- Executes dropped EXE
- Modifies registry class
PID:6232

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Serverhost\dPTDnD85kThG8j3rW.vbe"
6⤵
PID:4388

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Serverhost\54few99r3KxETtS7l.bat" "
7⤵
PID:5640

C:\Serverhost\blockcom.exe
"C:\Serverhost\blockcom.exe"
8⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
PID:836

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VoqEmDemzX.bat"
9⤵
PID:6500

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
10⤵
PID:1400

C:\Serverhost\blockcom.exe
"C:\Serverhost\blockcom.exe"
10⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
PID:3920

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z7OHWwwihG.bat"
11⤵
PID:1892

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
12⤵
PID:3712

C:\Recovery\WindowsRE\chrome.exe
"C:\Recovery\WindowsRE\chrome.exe"
12⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:6728

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
8⤵
- Modifies registry key
PID:1080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --mojo-platform-channel-handle=1568 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:2480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --mojo-platform-channel-handle=5784 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:4060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7216 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:6232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7672 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:6720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --mojo-platform-channel-handle=7704 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --mojo-platform-channel-handle=7324 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:4604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --mojo-platform-channel-handle=7576 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:3628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3224 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:1360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6176 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:2172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --mojo-platform-channel-handle=5188 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --mojo-platform-channel-handle=6812 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:6036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --mojo-platform-channel-handle=4556 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --mojo-platform-channel-handle=4800 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:1
5⤵
PID:5896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7612 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:7164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5208 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:2552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3172 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:2676

C:\Users\Admin\Downloads\cispro_installer.exe
"C:\Users\Admin\Downloads\cispro_installer.exe"
5⤵
- Executes dropped EXE
PID:5616

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe
"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe" -log -setupname "cispro_installer.exe" -sfx "C:\Users\Admin\Downloads" -theme lycia -type alone -mode cispro -partner 18137
6⤵
- Manipulates Digital Signatures
- Checks computer location settings
- Executes dropped EXE
- Checks for any installed AV software in registry
- Enumerates connected drives
- Modifies registry class
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:7408

C:\ProgramData\Comodo\Installer\ise_installer.exe
"C:\ProgramData\\Comodo\Installer\ise_installer.exe" /quiet /chid=18137 /aff=18137
7⤵
- Executes dropped EXE
PID:7832

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\bin\ise_installer\isestart.exe
"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\bin\ise_installer\isestart.exe" /quiet /chid=18137 /aff=18137
8⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:7336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6868 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:2880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7748 --field-trial-handle=1752,i,15377539447506024157,10195758138633415516,131072 /prefetch:8
5⤵
PID:1172

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1352

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:884

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{a43f4dc0-efb9-e94b-bb1b-4d0738dc351c}\NPCAP.inf" "9" "405306be3" "0000000000000178" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files\Npcap"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2204

C:\Windows\sysWOW64\wbem\wmiprvse.exe
C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:2156

C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe
"C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:3056

C:\Program Files (x86)\PRTG Network Monitor\Sensor System\XenServerRRDSensor.exe
"C:\Program Files (x86)\PRTG Network Monitor\Sensor System\XenServerRRDSensor.exe" -pipe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5616

C:\Program Files (x86)\PRTG Network Monitor\Sensor System\VMwareSensor.exe
"C:\Program Files (x86)\PRTG Network Monitor\Sensor System\VMwareSensor.exe" -pipe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6808

C:\Program Files (x86)\PRTG Network Monitor\Sensor System\PRTG_IPMI_Sensor.exe
"C:\Program Files (x86)\PRTG Network Monitor\Sensor System\PRTG_IPMI_Sensor.exe" "-user=ADMIN" "-pw=ADMIN" "-ip=Uoklywyh"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5472

C:\Program Files (x86)\PRTG Network Monitor\Sensor System\ipmiutil.exe
"C:\Program Files (x86)\PRTG Network Monitor\Sensor System\ipmiutil.exe" sensor -N Uoklywyh -U ADMIN -P ADMIN -s
3⤵
- Executes dropped EXE
PID:5680

C:\Program Files (x86)\PRTG Network Monitor\Sensor System\XenServerRRDSensor.exe
"C:\Program Files (x86)\PRTG Network Monitor\Sensor System\XenServerRRDSensor.exe" -pipe
2⤵
- Executes dropped EXE
PID:6024

C:\Program Files (x86)\PRTG Network Monitor\Sensor System\VMwareSensor.exe
"C:\Program Files (x86)\PRTG Network Monitor\Sensor System\VMwareSensor.exe" -pipe
2⤵
- Executes dropped EXE
PID:5468

C:\Program Files (x86)\PRTG Network Monitor\Sensor System\PRTG_IPMI_Sensor.exe
"C:\Program Files (x86)\PRTG Network Monitor\Sensor System\PRTG_IPMI_Sensor.exe" "-user=ADMIN" "-pw=ADMIN" "-ip=dns.google"
2⤵
- Executes dropped EXE
PID:1588

C:\Program Files (x86)\PRTG Network Monitor\Sensor System\ipmiutil.exe
"C:\Program Files (x86)\PRTG Network Monitor\Sensor System\ipmiutil.exe" sensor -N dns.google -U ADMIN -P ADMIN -s
3⤵
- Executes dropped EXE
PID:1824

C:\Program Files (x86)\PRTG Network Monitor\64 bit\PRTG Server.exe
"C:\Program Files (x86)\PRTG Network Monitor\64 bit\PRTG Server.exe"
1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2860

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5624

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5320

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x390
1⤵
PID:6400

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\5f39cd3e020845159414dec114e512cf /t 3712 /p 6080
1⤵
PID:6716

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\f9258c731b474980821869bc67e6dfad /t 5196 /p 5972
1⤵
PID:3420

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5376

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:6420

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5024

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Local Settings\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Local Settings\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Serverhost\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Serverhost\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Serverhost\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Serverhost\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Serverhost\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Serverhost\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\chrome.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\chrome.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\chrome.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 14 /tr "'C:\Windows\Performance\WinSAT\DataStore\chrome.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\chrome.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 10 /tr "'C:\Windows\Performance\WinSAT\DataStore\chrome.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Serverhost\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Serverhost\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Serverhost\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\uk-UA\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\uk-UA\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\uk-UA\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 14 /tr "'C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\microsoft.system.package.metadata\ApplicationFrameHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ApplicationFrameHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\microsoft.system.package.metadata\ApplicationFrameHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 8 /tr "'C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\microsoft.system.package.metadata\ApplicationFrameHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6464

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2508

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:312

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in Windows directory
PID:8972

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 8E9C5A8CF773959BC6E8A3080BD00860
2⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
PID:1400

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 64713A21CD53151FC48D8ACA5EFBB7CF E Global\MSI0000
2⤵
- Checks for any installed AV software in registry
- Enumerates connected drives
PID:4536

C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --langID 1033 --createConfig "active=avfw;dplus=opt;esm=0;av=1;fw=1;cesfw=1;cesav=1;cessandbox=1;free=0;noalerts=1;cloud=1;sendstats=1;configfile=;fwstate=0;dfstate=0;avstate=0;bbstate=0;avservers=0;standalone=1;useblob=1;trustnewnets=0;"
3⤵
PID:3320

C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --upgradeBackuped=""
3⤵
PID:7324

C:\Windows\system32\runonce.exe
"C:\Windows\system32\runonce.exe" -r
3⤵
PID:8940

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
4⤵
PID:9036

C:\Windows\system32\runonce.exe
"C:\Windows\system32\runonce.exe" -r
3⤵
PID:9144

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
4⤵
PID:996

C:\Windows\Installer\MSI3D68.tmp
"C:\Windows\Installer\MSI3D68.tmp" -rptype 0 -descr "Installing COMODO Internet Security Pro" -logfile "C:\Users\Admin\AppData\Local\Temp\COMODO Internet Security dbgout.log"
2⤵
- Executes dropped EXE
PID:5412

C:\Windows\Installer\MSI3D68.tmp
"C:\Windows\Installer\MSI3D68.tmp" -rptype 0 -descr "Installing COMODO Internet Security Pro" -logfile "C:\Users\Admin\AppData\Local\Temp\COMODO Internet Security dbgout.log" -working
3⤵
- Executes dropped EXE
PID:6524

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
4⤵
PID:5952

C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --installCertificates
2⤵
PID:8564

C:\Windows\system32\regsvr32.exe
"regsvr32.exe" /s "C:\Program Files\COMODO\COMODO Internet Security\cisresc.dll"
2⤵
PID:8580

C:\Windows\system32\regsvr32.exe
"regsvr32.exe" /s "C:\Program Files\COMODO\COMODO Internet Security\cisbfps.dll"
2⤵
PID:8596

C:\Program Files\COMODO\COMODO Internet Security\cisbf.exe
"C:\Program Files\COMODO\COMODO Internet Security\cisbf.exe" /RegServer
2⤵
PID:6288

C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
"C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe" --updateHtml
2⤵
PID:8636

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
PID:7480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
PID:6664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -s DeviceInstall
1⤵
PID:5628

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\COMODO\COMODO Internet Security\drivers\win10\inspect.inf" "9" "471514ecf" "0000000000000178" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files\COMODO\COMODO Internet Security\drivers\win10"
2⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery