Malware Analysis Report

2024-11-16 10:44

Sample ID 240603-lj8pzsac3z
Target 3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9
SHA256 3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9
Tags
bootkit discovery evasion persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9

Threat Level: Known bad

The file 3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9 was found to be: Known bad.

Malicious Activity Summary

bootkit discovery evasion persistence spyware stealer

Modifies firewall policy service

Drops file in Drivers directory

Modifies Windows Firewall

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Enumerates connected drives

Checks installed software on the system

Adds Run key to start application

Drops desktop.ini file(s)

Writes to the Master Boot Record (MBR)

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

System policy modification

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Modifies data under HKEY_USERS

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 09:34

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 09:34

Reported

2024-06-03 09:37

Platform

win7-20240221-en

Max time kernel

149s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List\8150:TCP = "8150:TCP:*:Enabled:8150" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\8150:TCP = "8150:TCP:*:Enabled:8150" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile C:\Program Files\WW2017CF\wmcSystem7.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\cbregistry20.sys C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Windows\System32\drivers\WM7F.inf C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Windows\System32\drivers\WM7F.inf C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Windows\System32\drivers\WM7F.sys C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Windows\system32\DRIVERS\SET2404.tmp C:\Windows\system32\rundll32.exe N/A
File created C:\Windows\system32\DRIVERS\SET2404.tmp C:\Windows\system32\rundll32.exe N/A
File opened for modification C:\Windows\system32\DRIVERS\WM7F.sys C:\Windows\system32\rundll32.exe N/A
File opened for modification C:\Windows\System32\drivers\WM7F.inf C:\Program Files\WW2017CF\wmcSystem7.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcProc7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcUser7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcProc7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcUser7.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" C:\Windows\system32\rundll32.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\H: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\F: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\G: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\I: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\M: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\X: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\D: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\O: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\Q: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\B: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\K: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\J: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\S: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\Y: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\L: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\P: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\U: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\V: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\N: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\R: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\Z: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\A: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\T: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\W: C:\Program Files\WW2017CF\wmcSystem7.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Program Files\WW2017CF\wmcSystem7.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\pcinfo7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Windows\system32\WinNetDaily.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Windows\SysWOW64\wmcUpdater.exe C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe N/A
File opened for modification C:\Windows\SysWOW64\wmcUpdater.exe C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe N/A
File created C:\Windows\system32\cbregistryevtmsg.dll C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Windows\system32\HuRMS.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Windows\system32\pcinfo7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Windows\SysWOW64\pcinfo7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Windows\SysWOW64\WinNetDaily.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Windows\SysWOW64\WinNetDaily.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Windows\SysWOW64\pcinfo7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Windows\system32\WinNetDaily.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Windows\SysWOW64\HuRMS.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WW2017CF\Updater7.ini C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\WM7F.cab C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcFTSlave7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcProc7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\WM7F.inf.w7_x64_Signed C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Program Files\WW2017CF\Info\BootInfo.opt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\PolicyViewer.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\ServerSchTask.dat C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcEncryption7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcService7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\cbregistry.cab C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcRCSlave7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcUser7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\WM7F.inf.w7_x64_Signed C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\Policy\System\PolicyContainer.opt C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\TGT2.ini C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\Updater7.ini C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcHook7.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcHook764.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcWatermark7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\Policy\System\PolicyContainer.opt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\SmrPolicy.txt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\wmcEncryption7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcHook7.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcProc7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcUser7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcWatermark7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcWatermark764.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\WM7F.inf.w7_x64_Signed C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\wmcRCSlave7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcUpdater.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\cbfsfilter2032.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\Policy\System\PolicyContainer.opt C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\winet.lnk C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\WM7F.cab C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\WM7F.sys.w7_x64_Signed C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\Info\MachineSWInfo.opt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\Offline\System\HKULBIBU2024_06_03_09_36_28_486_1500.off C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Program Files\WW2017CF\Info\RemoteService.opt C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\TGT2.ini C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcMemmgr64.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\Info\PCInfo.opt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Program Files\WW2017CF\Policy\Log\2024_06_03.log C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\FoxSDKU32w.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\WinNetDaily.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcFTSlave7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\XceedCry.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\Info\PCInfo.opt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\Policy\System\PolicyContainer.bak C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Program Files\WW2017CF\Info\ADUserInfo.txt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Program Files\WW2017CF\PCInfo7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\PolicyViewer.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\ScheduleTask.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\Policy\System\PolicyContainer.tmp C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\cbfsfilter20.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\Info C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\Policy C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcDataBurner7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcEnterprise.dat C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcMemmgr.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\cbfsfilter2032.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\Info\RemoteService.opt C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\ServerSchTask.dat C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcEnterprise.dat C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WM7\AutoUpdate\20240603.log C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe N/A
File created C:\Windows\Debug\WM7\SystemDisk.opt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Windows\Debug\SMR7\ScheduleTask\2024_06_03.log C:\Program Files\WW2017CF\ScheduleTask.exe N/A
File created C:\Windows\inf\oem0.PNF C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Windows\Debug\WM7\Client\wmcUser7.exe\20240603.log C:\Program Files\WW2017CF\wmcUser7.exe N/A
File opened for modification C:\Windows\WindowsUpdate.log C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Windows\Debug\WM7\Client\wmcSystem7.exe\LogWriteTest.txt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240603.log C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240603.log C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Windows\INF\setupapi.app.log C:\Windows\system32\rundll32.exe N/A
File opened for modification C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240603.log C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Windows\Debug\WM7\Client\wmcSystem7.exe\LogWriteTest.txt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Windows\Debug\WM7\AutoUpdate\20240603.log C:\Windows\SysWOW64\wmcUpdater.exe N/A
File created C:\Windows\Debug\WM7\Client\wmcProc7.exe\LogWriteTest.txt C:\Program Files\WW2017CF\wmcProc7.exe N/A
File created C:\Windows\Debug\WM7\Client\wmcUser7.exe\LogWriteTest.txt C:\Program Files\WW2017CF\wmcUser7.exe N/A
File created C:\Windows\Debug\WM7\Client\wmcProc7.exe\20240603.log C:\Program Files\WW2017CF\wmcProc7.exe N/A
File created C:\Windows\Debug\WM7\Client\wmcUser7.exe\20240603.log C:\Program Files\WW2017CF\wmcUser7.exe N/A
File created C:\Windows\Debug\WM7\Client\wmcSystem7.exe\LogWriteTest.txt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240603.log C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Windows\Debug\WM7\AutoUpdate\20240603.log C:\Windows\SysWOW64\wmcUpdater.exe N/A
File created C:\Windows\inf\oem1.PNF C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Windows\Debug\WM7\Client\wmcProc7.exe\20240603.log C:\Program Files\WW2017CF\wmcProc7.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\runonce.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\runonce.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\2 C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\474A91C C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP" C:\Windows\system32\netsh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace C:\Windows\system32\netsh.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies." C:\Windows\system32\netsh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace C:\Windows\system32\netsh.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\474A91C\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0" C:\Windows\system32\netsh.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client" C:\Windows\system32\netsh.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection" C:\Windows\system32\netsh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session C:\Windows\system32\netsh.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\netsh.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\netsh.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\netsh.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation" C:\Windows\system32\netsh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session C:\Windows\system32\netsh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session C:\Windows\system32\netsh.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\474A91C\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client" C:\Windows\system32\netsh.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation" C:\Windows\system32\netsh.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client" C:\Windows\system32\netsh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace C:\Windows\system32\netsh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000090d37a99b5da01 C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\474A91C\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\474A91C\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation" C:\Windows\system32\netsh.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP" C:\Windows\system32\netsh.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation" C:\Windows\system32\netsh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace C:\Windows\system32\netsh.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\netsh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace C:\Windows\system32\netsh.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\474A91C\LanguageList = 7a0068002d005400570000007a0068002d00480061006e00740000007a006800000065006e002d0055005300000065006e0000000000 C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\netsh.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party" C:\Windows\system32\netsh.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\netsh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace C:\Windows\system32\netsh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session C:\Windows\system32\netsh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session C:\Windows\system32\netsh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session C:\Windows\system32\netsh.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\474A91C\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" C:\Windows\system32\netsh.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0" C:\Windows\system32\netsh.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0" C:\Windows\system32\netsh.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0521D27-066B-4207-900B-6C3DF64B3CA0}\1.0\0 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{02084676-181B-4E44-9E8A-7D2C38BFF609}\TypeLib\Version = "1.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxBurnerCOM.FoxDeviceCapabilities\CLSID\ = "{8E0FC6DA-5E53-4F8B-A139-BFF7ACE28FC6}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.RijndaelEncryptionMethod.1\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F46F6141-7C9C-4d70-911A-E49CE2ADA922}\Programmable C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA8B5033-ADA7-4B06-B5D0-8BC7C13909D2}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxBurnerCOM.FoxDiskSession\ = "FoxDiskSession Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A0A61B00-96A6-457F-AA5E-AFA5167852E5}\ToolboxBitmap32\ = "C:\\Program Files\\WW2017CF\\XceedCry.dll, 101" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxBurner.FoxBurner\CLSID\ = "{DA68A3FF-C69C-4FE8-947B-BD561EE15EFA}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EC04D5B-19A8-45EE-BCB0-6FE0067F9468}\ProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E0FC6DA-5E53-4F8B-A139-BFF7ACE28FC6}\Programmable C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D865F1E7-BAC6-4ECA-B37B-0A5DDFF2D031}\Version\ = "1.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C6F5554-32C4-4304-A235-B5F2B97F1B20} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C3271080-C57A-4520-8066-337AD212D7E0}\TypeLib\ = "{55A560A7-E3F9-4790-8D22-F3A97009AC8F}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.HavalHashingMethod.1\ = "XceedHavalHashingMethod Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BAF7A82C-443E-4FF5-8A04-286E30C67553}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C8D3206-4A88-43D9-BB91-0ECC8C5F79CF}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E0FC6DA-5E53-4F8B-A139-BFF7ACE28FC6}\VersionIndependentProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A0A61B00-96A6-457F-AA5E-AFA5167852E5}\Control C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D865F1E7-BAC6-4ECA-B37B-0A5DDFF2D031}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C6F5554-32C4-4304-A235-B5F2B97F1B20}\TypeLib\ = "{D0521D27-066B-4207-900B-6C3DF64B3CA0}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxBurner.FoxBurner\ = "FoxBurner Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.Hashing.1\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68051560-DBA7-4939-8E34-4A8F28313E65}\ = "DXceedHashing" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.HavalHashingMethod\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EC04D5B-19A8-45EE-BCB0-6FE0067F9468}\InprocServer32\ = "C:\\Program Files\\WW2017CF\\XceedCry.dll" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxBurnerCOM.FoxDeviceCapabilities\ = "FoxDeviceCapabilities Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EC04D5B-19A8-45EE-BCB0-6FE0067F9468}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxBurnerCOM.FoxDiskSession\CLSID\ = "{F46F6141-7C9C-4d70-911A-E49CE2ADA922}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68051560-DBA7-4939-8E34-4A8F28313E65}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A02A65C1-50E4-4E5D-B9D0-625D5DEBC671} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.RSASigningMethod.1\CLSID\ = "{90FDB7BD-EB76-4AC9-8385-D1EE80BBCDCD}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DF814B45-2ED1-4471-B151-89E6D49AD3E5}\TypeLib\Version = "1.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6F9F8921-D7A9-47E4-A0D5-B5F2CA673408}\TypeLib\Version = "1.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A0A61B00-96A6-457F-AA5E-AFA5167852E5}\MiscStatus\ = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D865F1E7-BAC6-4ECA-B37B-0A5DDFF2D031}\Version C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EA8B5033-ADA7-4B06-B5D0-8BC7C13909D2}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DBAC3AFA-8540-497E-BB31-D6A8667A43AF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F46F6141-7C9C-4d70-911A-E49CE2ADA922}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.Hashing\CLSID\ = "{7EC04D5B-19A8-45EE-BCB0-6FE0067F9468}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EA8B5033-ADA7-4B06-B5D0-8BC7C13909D2}\TypeLib\ = "{D0521D27-066B-4207-900B-6C3DF64B3CA0}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EC04D5B-19A8-45EE-BCB0-6FE0067F9468}\MiscStatus\1 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4C6F5554-32C4-4304-A235-B5F2B97F1B20}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EA8B5033-ADA7-4B06-B5D0-8BC7C13909D2}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55A560A7-E3F9-4790-8D22-F3A97009AC8F}\1.1\HELPDIR C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBA63CAC-9913-4A13-9212-E97BB70C05C9}\VersionIndependentProgID\ = "Xceed.RijndaelEncryptionMethod" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{231D1CF6-C578-411D-9B9B-48264355805D}\TypeLib\ = "{55A560A7-E3F9-4790-8D22-F3A97009AC8F}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.HavalHashingMethod\CLSID\ = "{A02A65C1-50E4-4E5D-B9D0-625D5DEBC671}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90FDB7BD-EB76-4AC9-8385-D1EE80BBCDCD}\TypeLib\ = "{55A560A7-E3F9-4790-8D22-F3A97009AC8F}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EC04D5B-19A8-45EE-BCB0-6FE0067F9468}\VersionIndependentProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C14B6BF4-85A9-4DDF-BD42-59928595634F}\ = "IFoxDeviceCapabilities" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DBAC3AFA-8540-497E-BB31-D6A8667A43AF}\ = "DXceedSigning__0100" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6F9F8921-D7A9-47E4-A0D5-B5F2CA673408}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.Encryption.1\CLSID\ = "{A0A61B00-96A6-457F-AA5E-AFA5167852E5}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.TwofishEncryptionMethod.1\CLSID\ = "{D3E95E1D-D003-42A0-91FD-465DC624BC7A}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsef\shell\open\command\ = "C:\\Program Files\\WW2017CF\\wmcEncryption7.exe %1 decrypt" C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D865F1E7-BAC6-4ECA-B37B-0A5DDFF2D031} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C14B6BF4-85A9-4DDF-BD42-59928595634F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A0A61B00-96A6-457F-AA5E-AFA5167852E5}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxBurnerCOM.FoxDeviceCapabilities\CLSID\ = "{8E0FC6DA-5E53-4F8B-A139-BFF7ACE28FC6}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90FDB7BD-EB76-4AC9-8385-D1EE80BBCDCD}\VersionIndependentProgID\ = "Xceed.RSASigningMethod" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA8B5033-ADA7-4B06-B5D0-8BC7C13909D2}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{626BC99A-6FF2-4CFC-B027-66D618CFD6DE} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{05755065-6ECA-4F26-A3B1-0AE425B0EE07}\ = "DXceedEncryption__0100" C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcProc7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcUser7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcUser7.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\WW2017CF\wmcProc7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcUser7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2940 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\reg.exe
PID 2940 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\reg.exe
PID 2940 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\reg.exe
PID 2940 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\reg.exe
PID 2940 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Program Files\WW2017CF\wmcSystem7.exe
PID 2940 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Program Files\WW2017CF\wmcSystem7.exe
PID 2940 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Program Files\WW2017CF\wmcSystem7.exe
PID 2940 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Program Files\WW2017CF\wmcSystem7.exe
PID 2940 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Program Files\WW2017CF\wmcSystem7.exe
PID 2940 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Program Files\WW2017CF\wmcSystem7.exe
PID 2940 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Program Files\WW2017CF\wmcSystem7.exe
PID 2940 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Program Files\WW2017CF\wmcSystem7.exe
PID 3024 wrote to memory of 2620 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\system32\rundll32.exe
PID 3024 wrote to memory of 2620 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\system32\rundll32.exe
PID 3024 wrote to memory of 2620 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\system32\rundll32.exe
PID 2620 wrote to memory of 2564 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\runonce.exe
PID 2620 wrote to memory of 2564 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\runonce.exe
PID 2620 wrote to memory of 2564 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\runonce.exe
PID 2564 wrote to memory of 2292 N/A C:\Windows\system32\runonce.exe C:\Windows\System32\grpconv.exe
PID 2564 wrote to memory of 2292 N/A C:\Windows\system32\runonce.exe C:\Windows\System32\grpconv.exe
PID 2564 wrote to memory of 2292 N/A C:\Windows\system32\runonce.exe C:\Windows\System32\grpconv.exe
PID 2592 wrote to memory of 2604 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\regsvr32.exe
PID 2592 wrote to memory of 2604 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\regsvr32.exe
PID 2592 wrote to memory of 2604 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\regsvr32.exe
PID 2592 wrote to memory of 2604 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\regsvr32.exe
PID 2592 wrote to memory of 2604 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\regsvr32.exe
PID 2592 wrote to memory of 2500 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\regsvr32.exe
PID 2592 wrote to memory of 2500 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\regsvr32.exe
PID 2592 wrote to memory of 2500 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\regsvr32.exe
PID 2592 wrote to memory of 2500 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\regsvr32.exe
PID 2592 wrote to memory of 2500 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\regsvr32.exe
PID 2604 wrote to memory of 2452 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2604 wrote to memory of 2452 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2604 wrote to memory of 2452 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2604 wrote to memory of 2452 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2604 wrote to memory of 2452 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2604 wrote to memory of 2452 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2604 wrote to memory of 2452 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2500 wrote to memory of 2432 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2500 wrote to memory of 2432 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2500 wrote to memory of 2432 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2500 wrote to memory of 2432 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2500 wrote to memory of 2432 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2500 wrote to memory of 2432 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2500 wrote to memory of 2432 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2940 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe
PID 2940 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe
PID 2940 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe
PID 2940 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe
PID 2940 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe
PID 2940 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe
PID 2940 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe
PID 2476 wrote to memory of 1220 N/A C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe C:\Windows\SysWOW64\wmcUpdater.exe
PID 2476 wrote to memory of 1220 N/A C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe C:\Windows\SysWOW64\wmcUpdater.exe
PID 2476 wrote to memory of 1220 N/A C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe C:\Windows\SysWOW64\wmcUpdater.exe
PID 2476 wrote to memory of 1220 N/A C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe C:\Windows\SysWOW64\wmcUpdater.exe
PID 2476 wrote to memory of 1220 N/A C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe C:\Windows\SysWOW64\wmcUpdater.exe
PID 2476 wrote to memory of 1220 N/A C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe C:\Windows\SysWOW64\wmcUpdater.exe
PID 2476 wrote to memory of 1220 N/A C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe C:\Windows\SysWOW64\wmcUpdater.exe
PID 2940 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\netsh.exe
PID 2940 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\netsh.exe
PID 2940 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\netsh.exe
PID 2940 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\netsh.exe
PID 2940 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\netsh.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer C:\Program Files\WW2017CF\wmcSystem7.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe

"C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe export HKLM\SYSTEM\CurrentControlSet\Services\Win-Win7 "C:\Users\Public\SMR7\Debug\WinWin7.RegDebug.log"

C:\Program Files\WW2017CF\wmcSystem7.exe

"C:\Program Files\WW2017CF\wmcSystem7.exe" -di

C:\Program Files\WW2017CF\wmcSystem7.exe

"C:\Program Files\WW2017CF\wmcSystem7.exe" -ai

C:\Windows\system32\rundll32.exe

C:\Windows\system32\rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Windows\System32\drivers\WM7F.inf

C:\Program Files\WW2017CF\wmcSystem7.exe

"C:\Program Files\WW2017CF\wmcSystem7.exe"

C:\Windows\system32\runonce.exe

"C:\Windows\system32\runonce.exe" -r

C:\Windows\System32\grpconv.exe

"C:\Windows\System32\grpconv.exe" -o

C:\Windows\System32\regsvr32.exe

/i /s "C:\Program Files\WW2017CF\XceedCry.dll"

C:\Windows\System32\regsvr32.exe

/i /s "C:\Program Files\WW2017CF\FoxSDKU32w.dll"

C:\Windows\SysWOW64\regsvr32.exe

/s "C:\Program Files\WW2017CF\FoxSDKU32w.dll"

C:\Windows\SysWOW64\regsvr32.exe

/s "C:\Program Files\WW2017CF\XceedCry.dll"

C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe

"C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe" -smr_inst

C:\Windows\SysWOW64\wmcUpdater.exe

"C:\Windows\SysWOW64\wmcUpdater.exe" -smr_inst

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="ICMPv4 Inbound"

C:\Windows\SysWOW64\wmcUpdater.exe

"C:\Windows\SysWOW64\wmcUpdater.exe"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall firewall delete rule name="ICMPv4 Inbound"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="WinMasterServices V7 Client7"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall firewall delete rule name="WinMasterServices V7 Client7"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="WinMasterRC Slave7"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall firewall delete rule name="WinMasterRC Slave7"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="WinMasterFT Slave7"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall firewall delete rule name="WinMasterFT Slave7"

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall firewall add rule name="ICMPv4 Inbound" dir=in action=allow enable=yes profile=any localip=any remoteip=any protocol=icmpv4:8,any interfacetype=any edge=yes

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall firewall add rule name="WinMasterServices V7 Client7" dir=in program="C:\Program Files\WW2017CF\wmcSystem7.exe" action=allow enable=yes profile=any localip=any remoteip=any protocol=TCP interfacetype=any edge=yes

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall firewall add rule name="WinMasterRC Slave7" dir=in program="C:\Program Files\WW2017CF\wmcRCSlave7.exe" action=allow enable=yes profile=any localip=any remoteip=any protocol=TCP interfacetype=any edge=yes

C:\Windows\SysWOW64\netsh.exe

C:\Windows\system32\netsh.exe advfirewall firewall add rule name="WinMasterFT Slave7" dir=in program="C:\Program Files\WW2017CF\wmcFTSlave7.exe" action=allow enable=yes profile=any localip=any remoteip=any protocol=TCP interfacetype=any edge=yes

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /i /s "C:\Program Files\WW2017CF\FoxSDKU32w.dll"

C:\Program Files\WW2017CF\ScheduleTask.exe

"C:\Program Files\WW2017CF\ScheduleTask.exe" -SetSchedule

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="WinMaster Client7"

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="WinMaster Client7" dir=in program="C:\Program Files\ww2017cf\wmcSystem7.exe" action=allow enable=yes profile=any localip=any remoteip=any protocol=TCP interfacetype=any edge=yes

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="WinMasterRC Slave7"

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="WinMasterRC Slave7" dir=in program="C:\Program Files\ww2017cf\wmcRCSlave7.exe" action=allow enable=yes profile=any localip=any remoteip=any protocol=TCP interfacetype=any edge=yes

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="WinMasterFT Slave7"

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="WinMasterFT Slave7" dir=in program="C:\Program Files\ww2017cf\wmcFTSlave7.exe" action=allow enable=yes profile=any localip=any remoteip=any protocol=TCP interfacetype=any edge=yes

C:\Program Files\WW2017CF\wmcUser7.exe

"C:\Program Files\WW2017CF\wmcUser7.exe"

C:\Program Files\WW2017CF\wmcProc7.exe

"C:\Program Files\WW2017CF\wmcProc7.exe"

Network

Country Destination Domain Proto
N/A 192.168.6.221:8150 tcp
N/A 192.168.6.221:8150 tcp
N/A 192.168.6.221:8150 tcp
N/A 127.0.0.1:8150 tcp
N/A 192.168.6.221:8150 tcp
N/A 192.168.6.221:8150 tcp
N/A 192.168.6.221:8150 tcp
N/A 192.168.6.221:8150 tcp

Files

C:\Users\Public\SMR7\ManualUpdate.ini

MD5 9d3ae7caa49c493e2fbe8239a61cd4fe
SHA1 e76cec0ab133e43b4ceea01c838056b3b3664c51
SHA256 98b84068ac60b2c8a289e8c4171f54610cf21a4c7b01d8d2e876ec0422b81fd5
SHA512 7ab548dbdb954da372782efda1c9783d4d43194ecab9226de212db786d3f4c93651b93e7940b97b51b920b20097e69aed8d48de3dc3f60345d9e14cdd3de1198

C:\Users\Public\SMR7\Debug\ManualUpdate\2024_06_03_HKULBIBU.log

MD5 f513dbce1ead81a73532372449181bf3
SHA1 7267817ec1509c8a2abc2e19ce5e90c259fc09ad
SHA256 f3f2b0065f8698bbb4d95bf50d7ae2126de47696ad8bfb08852add3203ded27a
SHA512 32264e33fc3a5307f9650b4c2861d7e7d01e6521f2e73260539703939313ace257e75b24fda04f3dbfd76765a3c5e13652233392b262a25afb4d0648d27cac59

\Users\Public\SMR7\WM7installTemp\GCBClient.exe

MD5 32f5bcdadb929f8981c1bf428bf8f7ca
SHA1 bed1245f17b8af02b8bb6e5a66a40c7ba46fee14
SHA256 f2ad5a1653c5322810ba5a2a77708d619d7bd661eb9fb0843dbaf9ec1bc771b2
SHA512 da73da117b2ea027ccf62929f3fc5d94f7f247062696a7e533c8043abf7478e288ed399f534b706bab40f2fc3dfd4d2a64a43405265dab459050fe397bf2e225

\Users\Public\SMR7\WM7installTemp\PCInfo7.exe

MD5 b163e896a74ee9becad5770c34bce10c
SHA1 4d166a080385acdeb115fcdb8b8acee428f196db
SHA256 e0ad39c486fa93799f3ce4019687027b9dda7f3b69a5e5d572c9cba775931979
SHA512 d65f7d4f1a33011a7c0a59c864d39d4bb27138bf158818d11e34fc4659f4d0cc9bedf77a44eddce6906f785e0bac9b329a86c9b48e4125bdbbdcb630da1e887b

\Users\Public\SMR7\WM7installTemp\PolicyViewer20.exe

MD5 67be6064557474ae467cbbac5d749be5
SHA1 65dd83ce9ec0952e2a5f63716734b87765196f32
SHA256 6665ad75ebdd3db7d3a3624f8d3cb817ddc8162ac891d15d058efe27a916d473
SHA512 1000c0ac8117715c1c7c88e313a5c9131a8a54e6f7abecf9ab7d4e3c6f9ac5191a45f87a95d6c17d719fdccdaafcfa889c84ccc927d2842dec59b58f940f1521

\Users\Public\SMR7\WM7installTemp\PolicyViewer40.exe

MD5 3a1b35c59faee8f49564a844886c5e2f
SHA1 71eed14b8c1b39c74ff7a8d7f18555ab428e165b
SHA256 e836912ef4f75b7e208539fc0af37092e3a5b36e36324154e3ac5e270de826c8
SHA512 f32c8d0cf7464d6358328f57a5ded664a034931f47f52434343958adc6451ca4f6747faab5c307df0ed1db0f941d9dea31e110d74f01394a96faf51d325a9049

\Users\Public\SMR7\WM7installTemp\ScheduleTask.exe

MD5 97b22d17f9b149e0abf2a9d1406afab0
SHA1 30bd9f4f5270fbe57983d60d7b5549f1e8caecba
SHA256 a599d8ec969c3fb73bb07371455aedfe7fa9037f906afa0235ab8d16e3e28aec
SHA512 f3c8cd68e797f23e16d8f0e2e7477238b236913f9f129548296b24c1f8ab8afa2fb0e8a7eb77baed492fad9cac5e9420b2fd65a755352ed506a81ebda87b3cd4

\Users\Public\SMR7\WM7installTemp\wmcDataBurner7.exe

MD5 3dfbf34103ae1adddcbccf260a363d0f
SHA1 2d4db9822a2c3ab4b154c29f10a2fc597ed4bb9c
SHA256 dec0c8f4be5e8dfa2f830772d7459ab5e100d615c590070b402c203be7272716
SHA512 919b0eccb9ff8f6ccccaa5e5acdd54ff074ad1f2bf282eb5fdcbbccba17f0f717b7a3fdbcfec9f4f51a8682c4a2c3f22ba584f44e292f5ea2401e2917847dd04

\Users\Public\SMR7\WM7installTemp\wmcEncryption7.exe

MD5 6d4aaf8abeeaa8609088d175487c4b27
SHA1 23f1e4f9d5bdda536c343f1fdc02d9acdd17833a
SHA256 b2660493abe6163094b490e0b69b3fc4a05b595d5ef9d35c082f14071a4f41a9
SHA512 9a0cbef644fecbc5bc334354edf2456bc17a5abe11f21f707f835ccd213d3601e939ed0c336c296802acf5c462f90130f66f3396a77743507012c1763129f6d1

\Users\Public\SMR7\WM7installTemp\wmcFTSlave7.exe

MD5 852f3f6810cb17314f484bc104c47ed6
SHA1 71e9c5c70b251ea1139a2c99571a29ef62ba58b3
SHA256 15a8b924ca3e27f84a2f36ce2768502371180ead491ab153083aefaad87fc127
SHA512 3088de5679e6146b68973342d8f1bc19611194f7882470f0ea788e19eb92cf185de13a8d9faa551d67d24893f5a07ba190255d0c206705fc3f3817dff75a2bab

\Users\Public\SMR7\WM7installTemp\wmcRCSlave7.exe

MD5 613c32f03d0c5402d39bee40fe686daa
SHA1 339989dba57200366ca93d612690568fe63179eb
SHA256 381551b2e407606d7f75bc97f8b4d139b79736cf7d45f20b44c17b351b8b2357
SHA512 e4f794681c3faaaef1de0b06ad552f9dc93f26b9ceb59cb0abc5b4cc43a0757d63fa7dfdb8d98d248b107eeb0c563f54474c041dec630269bf885fb2394dcee2

\Users\Public\SMR7\WM7installTemp\wmcProc7.exe

MD5 f43aca48d1c94e444485ccaa16784d51
SHA1 51139bb576470ae852f881b008fba2fca66bce5e
SHA256 adbb2529e20817af1dbb1130e901a80528d76e1eebac32a322ebfcbc98a16032
SHA512 dfa9b3a875f236241da75ca55711ad97389eec73b30d49043be6fc19049201813dccb7a3c99e7a8693a60b99bacbd2b77df58da7d0a4d867a4cc6c51c1a2250e

\Users\Public\SMR7\WM7installTemp\wmcService7.exe

MD5 f0285b3a46e3a95e198f15b1ce04f6f4
SHA1 9cc094df45082628e6a6e441cd2b0d102654c25d
SHA256 f283aa0baf02c43984b6871498c58f716a30cb99197ddaeb6211c3ebc29ab1eb
SHA512 fa07aa1565c2adef781de66491d856971949969ca547985129801b43864bba2ab0a959431353d745aa57487b20052cabe6d20d0c1568e78ecb1eee4337ed092f

\Users\Public\SMR7\WM7installTemp\wmcService764.exe

MD5 48e8605440424daa13fe37f54a0aa353
SHA1 6b88a88d86f2641f4639e539714babb586b3109f
SHA256 394e3a1517e5dea89ce4329ffb4483cc5344f19a2058b43cb828799c75d64e10
SHA512 17c3d5011b51a457eba4079ea096fe5f3b8ea0d75b4aa0dcefda3debe8da44ad30ed643e523fdc0733c7439a36776f2d1f54b6fe6c618d4cd54e0e32c29b8745

\Users\Public\SMR7\WM7installTemp\wmcSystem7.exe

MD5 d84e87645941fb13a10d744c7034fd23
SHA1 5e17db317fe0d443c21b61d90b284e02f988e27f
SHA256 c281ae98d46c9c2d3c3c88ba5233f0d3c720e3ed1a5228d7abd3b90d9fe2d830
SHA512 d4f7271addf995fe79f8be4a7a9ac4b41e4d6ce926d879ef1149f5da35913028076b34291d003c094e77d86a7b362817037f12c01523bfcde073e9b257aca01c

\Users\Public\SMR7\WM7installTemp\wmcSystem764.exe

MD5 df7a46c060be48306fbcc850456ef18a
SHA1 7bf67efd5c4bd3da9dc2f4f49e24533408dbad46
SHA256 9f7744f9566df7bbb604375cac7fb15ef25e7c4d90797129867f8a79ec6c1225
SHA512 d1d0b88af90f4869b47e823d74267054fe629bfd4c4677f1aa423590b399019c84fbfec92d0301a0d82e7b8c94c15df4fe5b96918d8e59c96d8e3ff6593dedf8

\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe

MD5 0bc433c866a12a560761514cf9466057
SHA1 a12fae7f8dff6d1247be6b89814d03123f4ec9b4
SHA256 9f7dfa281d6374646421ffd74bfa0534bcdfaab650e95c68ab5acb2d50957d7a
SHA512 4062177c58860f97faf7732361a7129695aafdc3cb819fe5c848069b41bf8a49272697066e2d44ee524356e6b5f0b33dfeb659ea99d1204581447a6c00ea7466

\Users\Public\SMR7\WM7installTemp\wmcUser7.exe

MD5 973e8a7e616972bbf44bde9e6bc4a15b
SHA1 fe0b70aa4502e5d5e04b2e4cd97de9411561f263
SHA256 2c10a8233485afb3b54131991d7859de151eaf68bd99bd66ab387c228dbf14f5
SHA512 8b05f1af5dea46efac54c90dd53becb0cc3f825084b90a423b7011bc22e6980d9c7ca1f79b7ba7e322eb03417189deadf134261a61ffd91b9b2a513cbaa52b86

\Users\Public\SMR7\WM7installTemp\wmcWatermark7.exe

MD5 adcd46624b13fd8b7fbe1c434fa9b554
SHA1 c25b3d4e64852cd412631ff12713e6fe57b7fa59
SHA256 068cfc241e956d9e0a7b4f43ff5e9a52def92318a907478c8940ca4d446700c1
SHA512 64b79ca858437de607c98d5f6f3fc766002b48061bc22fe0d21aabf88c2ee777952bbfa3a66e3e67a2f976dab0c8598250a772b2489c64f383230359544c39e0

\Users\Public\SMR7\WM7installTemp\wmcWatermark764.exe

MD5 c296210f4d633e27b31fdc69bc7e52df
SHA1 54691eb49db559b31a21b5267c1ea951744ad0f5
SHA256 972cefa76b81fd49a67f4eb1e2832fe677a6e20e984df5ae0755b9215f706d0d
SHA512 30609fe30bf8757e4b1eb0f312999f2de410176411923f011cac5fe665a6f3484e53a057013050f137249113fa09ea5f54c360c9681e0fb03b3cd800549df54f

C:\Users\Public\SMR7\Debug\ManualUpdate\2024_06_03_HKULBIBU.log

MD5 bcd448283599647c62dcde7eed8b673d
SHA1 6dc89cfa1ce0a1a2ed7127c38c9c28aeca174300
SHA256 dc6b552bfc833ce238267a743a3120d293aaa39294c2ce714b3439bec983fafa
SHA512 d34f5a90d825fef655fa859564266a6ca5fb0e105291f9add9273ab67757ac0839481d20be93ebd0613c9024ee799bca177e8d6355213a98bf8ead880c756384

C:\Users\Public\SMR7\WM7installTemp\cbfsfilter20.dll

MD5 be8818d3615195035cd9975c47204a85
SHA1 309e2195d53f486afe3f87ed186dcc39ff79c7d9
SHA256 2340772c80a5f90801d307f1e8f3ff4e77d6fd0f7d643a837e429129988c1e8a
SHA512 7b1ab6fe500edba69a792daf6a06c2d17a43ccf89f4ee8c65fb1ca162beca027a02a9b89e95fde9bab8789f2de3eb677ab7fb4d1d8f3ca000b8d4a2e4035b344

C:\Users\Public\SMR7\WM7installTemp\cbfsfilter2032.dll

MD5 4efb2a895ecd3792eed52e850af847c9
SHA1 74e43921d052fecf4190c813c9ee56b37d79dea8
SHA256 8a21206fe6d151d5c18fa48d8bb6cb600190bdf62999c6cc7e53a31b8fcdc72c
SHA512 40a90f67830d7f1415f9781ccb09f2ec68b075004db238aadd09afb7a1b11b61c266d25f60c96966b0eb0aa3ed1531e2f9b04e4d1b2fe753cda68a59af26e6f6

C:\Users\Public\SMR7\WM7installTemp\WinNetDaily.dll

MD5 6dc31af9f2b09740922065ea28b5eb3c
SHA1 4a1c267b30535aef8c3109f2104da9dd01c17f0c
SHA256 869941e24817fce286963877bad58b0de73486de1bcbfcc7f7d2f9056d514745
SHA512 4303263999c61414c6f29949c70c6cdc6a96cdf210708a39c84b0037a08a108c807a7f03620b7d3303449610c0cfe0ba4fb518e9f37917f983bc70a1e21a6321

C:\Program Files\WW2017CF\Policy\System\PolicyContainer.opt

MD5 a987fbde86cd2a32de5c451298252916
SHA1 a91cdf99964851c8f6d560fb92fbe53d96c8dc28
SHA256 c0da2237679c6e27506478cba709030b1ebce4a4aed6a375f4bc6d3cb4c630d0
SHA512 f238d844d2fd075aa89efe7c00fb09957f1e1cc6199a85108f48f63135acfe030f7bbc8e809e32e852c386ce966201863b604cd3abfbc8b8f72c5b5364e1c3cb

C:\Program Files\WW2017CF\Info\RemoteService.opt

MD5 21f084d77a7851f7bdc063d42edc02a9
SHA1 a018660ab7e63050facd2a9234bb739ae37dafe0
SHA256 594045032987458e03e396b7a40673138cb71ed175e9b71c2d29f8e31096c463
SHA512 82791e2b6ee4a14e8d408df0dcc4ba4102fd943e2bda5913e320f19d2b10ac0cd53b88a5e6bbc028b72f06a4958a21527d863bc568ec40709b56093a660737ce

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fc1e3851f429ea606d6ff1e01a5229f1_63be8c66-23f0-4400-84bb-c1a439222555

MD5 7cc5da8cb7f64d90933aefd17554bcff
SHA1 9beb9d1013e9e122e4869b9a4f43e2086cfe0d82
SHA256 c9fcf21a310fc132dad5ce295e06ed7d7da801d5b6b4d89ae54628e82e5afa4d
SHA512 a206368b840a4cd36b21fe1b62594ff406dd4411a1ecf5578c83da5c5cbbe0345500267c68053ea21577c22bd4fcda64a31b6f7bfff70ff8485dca0fe4a9a51f

C:\Program Files\WW2017CF\WM7F.cab

MD5 cc1f53076963cb3c349d15cb9f11648c
SHA1 b10204c29ff8d1bda781a79de44c50386162fa49
SHA256 2490e29b7a6e98d01c1b38a4c083061e63b312a87dd81ee2977f95ba0f7322dc
SHA512 4d9680bb52761c959d972bfbe9887835846c0ae786601883168cbff2a9d6820c74f3c29d8035653db9ffe25666ff88ade65083b568bb564def9960e65e5d33be

C:\Program Files\WW2017CF\WM7F.inf.w7_x64_Signed

MD5 9c59ff05b3ce916e4ef82af702122bad
SHA1 1fe8a164e00cb9ad52c1fe9c1fe1872d85f8908e
SHA256 11262e861ccf526b2eb696a308f9adc3408b56e5f815bf53e166fbb84e1411e1
SHA512 9face36cdf68c7ccf7444c0da83b52afc72354f26fa6bf9ef711662834776a8a06bf3f7fee42c9db00c7c51dc71083299676ed8637f1307c28856116074437b4

C:\Program Files\WW2017CF\WM7F.sys.w7_x64_Signed

MD5 832c4ea632f1be7582da75f8ad7559f5
SHA1 40d7904023d01edb3d52f25694dc89d6b53aea2c
SHA256 d7d994688ab1f68966cbca7573d4fa23e79645f82fba8df06dc488728164839e
SHA512 4cdd0b34f95861dbac0e7ee0d0ef103054944814cf2e19f2a7e9b1508505756579c11989dfa906199d68135073d0cf440a6843c1df790527601b4d6216a3007e

C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240603.log

MD5 1ef890ac1cebae58c886db7df6e436c4
SHA1 c8a40051ca26ed9d35ea8a27abcb201914297384
SHA256 6d097acc5e60da7b878c1719e3be3173b0cc4d926b0f26e3cd021d1ac9a00f86
SHA512 8236f2f235634fadd63269e5efec89129d17f5d46202399f0c1529e24f94278086aebe96ba5ee031d9cdc24e755843675feb59445345a1e48b8855510d93243b

memory/2620-407-0x000000013F190000-0x000000013F32D000-memory.dmp

memory/2620-410-0x000000013F120000-0x000000013F2BD000-memory.dmp

C:\Program Files\WW2017CF\FoxSDKU32w.dll

MD5 25e0bf4889612fc23561d79c942ada1c
SHA1 f9428cc4f4a9640a244875687178b43a74f4211e
SHA256 3a69e8fa1426b7cc4b837875c0bb5ca19f6b93fe49172f3e2dfa14256fd32d30
SHA512 8c4f6608b2e9930d38b8064a881b7a849b2f8f2222dfcd8915bf137a8ab4a616db56fc784c80600036dbcaa0351946171f17cd7160a8295a2310eed0efa9677d

C:\Program Files\WW2017CF\XceedCry.dll

MD5 2c0c746eecffdcedd18450659f3a8ee6
SHA1 68dcbd003837545a07608ed3f2efa77612c30456
SHA256 ff9722c64be81caad50e14bb3f50f345b4a30ca76c87113292ff852e934590b3
SHA512 ccc2a0f7d3f18eb1ff3506cc8545e7fa72b05758bfeb8b5e8348de4f7648ff57deba69839f8b7d7a350d6cb383030267e81bb3d274aa62f1e9a6002d5b2a7751

C:\Program Files\WW2017CF\wmcMemmgr64.dll

MD5 87ce6a87f5d828e5667d3aa262469d70
SHA1 5be0e09630639fb34c7f6b9f461816caeaf3c920
SHA256 f452e0cc62b65fd187b5434cc289556609afdac096d9da2b3c21203121a6d364
SHA512 ef3191d8a2d3d5fe672a8f50edf9185283e3923c73416984e9eacccc68e417594ad9f6fc8444bfc84d2559f286beeb6ae3ebbc5f0ecc0caf8f9a9ea23c23ede7

C:\Program Files\WW2017CF\wmcEnterprise.dat

MD5 efb7296340c8c83e18d94f7925803b38
SHA1 257c7db3f2f2f8865b7c4ade0c5ed6e4adf4f2bc
SHA256 b71adfe936280c99af02e11decf438eb1d4af57cae2e2208c3c6b2c8bba82d44
SHA512 d9f14cdaaac469c4de627843c17247cff78245cdfeae38aae87ec57e8ac3aa1927052214dd52afe84293b58a836cb491abd8df43756b25bd00c04335031f8959

C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240603.log

MD5 daf91c7c2dc14264f254d649e770ae69
SHA1 989d35f716f5b36e1e11d6abba3ff2b48173f00f
SHA256 b8d67d3fe1653558a63407e97ed5a1da1929b7225daca0111ca827cb145a0829
SHA512 32f145a0f4069290c18bd2e51842a3f630140df525d54248d704deddc95e811e14a58f2abcaca8a871b0932aad14933d8c5a9b4fe44075e491d70eda392dc41b

C:\Windows\Debug\WM7\AutoUpdate\20240603.log

MD5 267a454071b6fdfb13e1cdb03ef76c26
SHA1 603c61546925c75e2608df6b21dc24f68dbca68e
SHA256 700d725175034ba680d61face71ce39bdf5084c048971ac380a0f31e0fc70ad7
SHA512 340ba3e3a0099f8da6406191c2eccae448e601537274a555f73306ae89ca1474ce99eb8677247781c43ccf16580cf96f31689c90379a00c6ea6a79073c455497

C:\Windows\Debug\WM7\AutoUpdate\20240603.log

MD5 99f1c1b9b212e41d01c25c1d506fd189
SHA1 2e6e9750782579b694984e3fbbcb6ecc331ef009
SHA256 0afb35e15bd263f732abf0766fb298da4bd92ef8d0d279d6aec1db0c9b138a63
SHA512 e702309d8b0cf5adf7afeec383b28fededb88aac3c1e9e5d23151f9bb8fc3417ea58d7ddefa78e095558606f7551d80b9582722e5b0d8077567569cbb0e0f92a

C:\Windows\Debug\WM7\AutoUpdate\20240603.log

MD5 b4511fbd30726a02ea0a6891f248bfa4
SHA1 e75d3e5e1efb20062f963f0fc588123b2891a655
SHA256 8ca63e7e7b92f16a64013fe696468f9846d68bf197bb56d98cea4c2b3cc094e5
SHA512 5c9a0fbff14b93a96184e06b7bc873643d940a9145b139ab332d66c12311607653c0b17f24a5a9d1400a26455fa7701f16816e79f6f3dbf317d56f2d79561589

C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240603.log

MD5 e7b2b10543f2598a55d6c6f9e0b6555f
SHA1 1a52c5e02c439212dae9f74d238132aa3904bcdf
SHA256 57a86e676c1ed44ffff220be9796e064f907b88e0f3908c92c265096b6b14ca8
SHA512 5c1f1c00db837ecbf1b127a2a2a896dc912115766e0b9e929dbdf954b594a263150602197f7a8040aebeffd9f19c3d4d95f20678c72ee17d028735753495697a

C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240603.log

MD5 d7fd8d20a635ee1b0a82948bd5bdeae6
SHA1 8e654e1cdabb6fbf1463c56a15541156c69d2e8d
SHA256 52b76fcb1ad864af5697f6d16cb0dff3b6b8ceb4951b2dc11999511a1fd6d94a
SHA512 e0bf8747632493742f2d79823b6cafec4d3a704b7ae2106a9df564a3a0514a90dc5bc6088956af3580c8e7bb89a6cfa775f5077823816edd7f6dbafa7d9fd4d8

C:\Windows\debug\SMR7\ScheduleTask\2024_06_03.log

MD5 53b83fc369c21987e6ea365266df1170
SHA1 63ecebbf2433edd7c54b9f1bc08ed3719f8322b0
SHA256 c979840f175786279afee4f45ab7836b47f5485a84a8fd0108cbb7ab12c58555
SHA512 10155cd738319aef125e949a5105ebcd7d312c4834d1730559bcecd6ff6e322eaa8801c40c2f5e285d50adbb612481b433df4cf402a9f45d7061d798f2173185

C:\Users\Public\SMR7\WM7installTemp\wmcWatermark_DLL64.dll

MD5 22971c80f1b259a441618fffb6ba272d
SHA1 882954bc62524872d91934d426aa16c1bfeed5aa
SHA256 e508f49196fcd06618b61926894c7218479ae8d8316dfd85a7fbb5196e379367
SHA512 3ba0734079414a942a1537b26512e412dc0395047af9f3d601a5e2815260ff0d8b78d723d72be31bc60724dc6d841e3423b66f3be66d9bbcc6edf51e12185480

C:\Users\Public\SMR7\WM7installTemp\wmcWatermark_DLL.dll

MD5 1382987179f8036c02a6984045a1706f
SHA1 7b62e05127b1b48c6c499d12472d988c4a908790
SHA256 5e17105bfa60a0bcdc59408444167bb6a31eaa45e2dc3db619b9b40ad13a113c
SHA512 305c79969c9de07a6043fc5d9ef958433cd18f9967f4e06ad806c0a0d951d796b36b86d1ed5a1eebe640855d61e08430d1763b0c5b55293638fb8878af159023

C:\Users\Public\SMR7\WM7installTemp\wmcMemmgr.dll

MD5 78ae8351860894528c5a591633c118e4
SHA1 a24af6086d96e7bfac6a1186a3d693fbc880af18
SHA256 3c14c2f092a2dd8f8763e7e158d331d7835d870fad7a78c6dff117268c82f7d7
SHA512 7c9f02f03281f66d5aef2365f82fb10638e10c1c8f82f75e64086a922b8e92a34516ffbbec34b0a55121af2781dfa239c98041167aea8ad8d334ca50267d9e3e

C:\Users\Public\SMR7\WM7installTemp\wmcHook764.dll

MD5 a3946d64c9d54ba9a98b7109005bd474
SHA1 5d19e3c4af23960dc06d78ba0a0d76a9e9a6a04b
SHA256 eeb99548e38ed4be4cb1cd453adc3abe7ee9eb07ecdc7644935526a261e21f6b
SHA512 cf48929def50a6d3747d416563a7457d1e10cf2bf26d634dd7018dbfaa80f90b22c999cdf5487da78766fe717c33f740dad29dc510d21524d1543cd7c61cc796

C:\Users\Public\SMR7\WM7installTemp\wmcHook7.dll

MD5 6396c106cc4ea058f1c6a9fe3ed60213
SHA1 7728f2dcc0f6c6c93ddc10cd7c0dfaa1d13ca6b4
SHA256 2923dc753d10d06d389a3cb2201aa4b10f404e82015450ddb288eaad4f4eb87e
SHA512 0985e01649b01df3ac62927898e3d27b94a035bb99eae0680651a6b9f557146316d953375f79f783836b95bf052431e5cbfb58da6845d43f3627d3dbfb735da5

C:\Users\Public\SMR7\WM7installTemp\winet.lnk

MD5 d34cbdf1a37e06133cf75c17eebbf58d
SHA1 db861919287928e8a5efeb930056c96bd9c815c3
SHA256 a55978e4257023fb61896e82bf006ca4d1a9a5b9c7994042355339ae688b0147
SHA512 dac577250345d2d5a40c8c96eeb489f19de1b3c7a3aee87e31146870216176bc9fcf94decbe1fee4dba60bc7a6b88fa2ff5d0b926097ac86ea9c47c1d62e372c

C:\Users\Public\SMR7\WM7installTemp\Version.dat

MD5 3f394766f01d5080492340d5b1412007
SHA1 bcf66946d91e20543fc333405739f2a81629f2c0
SHA256 9ae6c87c532846b61d6ba046d07ec078399aee5e6674f8eaa6dbb33ed5bdb4a5
SHA512 4148bf530d2b49b528ca9e9a38c5532bf08122cee38a0a185feb23c6c427131f72ffc67af84e88c64904643ccd008e0e1f8bc65508d97b2751383849515a5773

C:\Users\Public\SMR7\WM7installTemp\Updater7.ini

MD5 6562576eb0f3f5ef8427d522562bcf38
SHA1 8da5720e40dc3c0808ec67a406a14b1aeee71363
SHA256 46402a1d135e284c8e756b3d715a6359661cccc8adba1af4ef80fcef407129ac
SHA512 a1e18f450deb35af2b5bddb4b8e5c48c60bcd25000ed56c1078cd9893564ef5378e7bcfcd7f7d5c00bed4d2bd1e8409be28f9bdb1218e6e8ea1690a2fa614229

C:\Users\Public\SMR7\WM7installTemp\TGT2.ini

MD5 14b6600ea20ecf376cc0916adca4664c
SHA1 1a2e60830b18d3938b92e9fdecaca4fc64adb9c3
SHA256 50f17744a841e27360e8d109fe2e4b81cb488a5ea420ef85f53ef307fc5c3aaa
SHA512 f96b706f17745013add0214383598341e6d726a1ff24c9ff782ec45356fa517fd038d1f52de0e3d1c29c3adcdace3df42055d324499a20ff600e14c8e82e10d4

C:\Users\Public\SMR7\WM7installTemp\ServerSchTask.dat

MD5 aca73f319209e2556b36c21030592252
SHA1 2e5fe3b619642158dd224e189b9492eb0ceba7ee
SHA256 d7a6e2f0cc0f34b8c4a616516ccdbedb563acfc91de72ee9a3c2cf26da70efbb
SHA512 85de70bcc089fa308b8b3a68cbb924ab4473fb34c2fe2627856bbce9a4114dba7b254e9ea3992038bde65d5717e6242b7fe592b9676eea542a10d4be9ee8f366

C:\Users\Public\SMR7\WM7installTemp\cbregistry.cab

MD5 cbf0c82d8867a425a0a04527e89425f1
SHA1 7c946358da28fb35b62755e3854edfd349f8bf84
SHA256 ce731190ee0d63e9051b1ea58f305d49256a799e170de45baa3a5bc1b0bb5e9c
SHA512 e793e4ec38e8d031c568a94b559053504b44b0f5938d71ddedea2b09996e9cdb472f976f181f24e3a53c6c621d3936a7ed955e716e8d10b8867c39b45570dbf0

C:\Program Files\WW2017CF\SmrPolicy.txt

MD5 752d829ef7daac9bedec1915e406ddad
SHA1 ddc9b7eebe2653812b81eb06cb401a34f0352602
SHA256 14b2311d24a84a0390abc8c17710decca8ab5dbc093fcf4cda7cc1bfbaf8b4f9
SHA512 9ffa51a3f62410148c84f2b3a657a9b8599e6c1f2269bbfd01b65db12ea2c11baf6f5ff4a447f8074c83090099584dc4d764932dd628b2f24b16da8a1d785edd

C:\Program Files\WW2017CF\Info\PCInfo.opt

MD5 7f44adb9f434e9a0ce231c497c6bb5c9
SHA1 224a92d69c4b932d30230f7f8b0a12c361de9609
SHA256 5425b3929913f78c9ed9bcaa5f5fe38166aafbd577d560afcafb36706513034f
SHA512 0bbde6a5202458dfcba71a0f45c8247d589645e86e16b4a6fd2201cab8aad3ecf6652141fd5f5d6778439e6eaf4f03c010cc02e90bd898830c01bd563a7a1a88

C:\Program Files\WW2017CF\Info\PCInfo.opt

MD5 d9816a198023beb55553b04cba4d8a94
SHA1 0533bad34fbaf5c19ae9bd8d33571aaa3025370e
SHA256 38377b74002b45c35376c4df6e4c1645092e01312f63e159046bcfc7149745d0
SHA512 946af6b7d1742f0d560e2d0d61cacb19b7c8b4b6bea5e75b2f7774cf9d0bb4ec4d5f8d21198d14fd840df316c1c2a406ac7a3d6852f9626f52efc5124505d52a

C:\Program Files\WW2017CF\Info\PCInfo.opt

MD5 33306f13b376452fb2c6d8d7d00129a9
SHA1 c1d3a8fd7f70be9f51de5c6d4bc2c19850495993
SHA256 503f3c5975d928457750b7f925bae965a8ccb51588ef98a52130e7ccbbb7bd5b
SHA512 d10d33dbea22080b8209ac80878b2a3f629468eb4836781aa98a33f92c0910a6dadba5d4ccc0a5498b62de7d49aa3f379184e7d59ba02e066c402e9c92c93263

C:\Program Files\WW2017CF\Info\BootInfo.opt

MD5 8d120406a06be09609578c06682e2a26
SHA1 97d4124f57801f0d3a5fe21ffb2f28e8777686ab
SHA256 374ee590fc88d443673bf49f396513144bdff2e4a67804a8f8c88756a1734fdf
SHA512 f0f1d9426be17440e92289b57dc1d2ea0036ee661dbc949f93cba19114270ec8cf221af6507c3c7e521a4b8f0a179bac87e259e50aa80a573f8cbd8637020dc3

C:\Program Files\WW2017CF\Info\PCInfo.opt

MD5 ab6bcd38f20f0037f6cb591c305f3ced
SHA1 152149ff85ec3ccba06b9adbd3e267f3eaeae550
SHA256 db4ce38b3ae2009271cebc46a800c14db2f3007e6800f05dbdfeb34418c3d91b
SHA512 a5d62c95225d60be4469d1079208540baef44c8ee6c3b2587c6458d80b5d69e4a8d09c5d2676514b39f6dac7cb0f78d61a65baee07358c3ca47fb157b8954ddd

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 09:34

Reported

2024-06-03 09:37

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List\8150:TCP = "8150:TCP:*:Enabled:8150" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\8150:TCP = "8150:TCP:*:Enabled:8150" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts C:\Program Files\WW2017CF\wmcSystem7.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\WM7F.inf C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Windows\System32\drivers\WM7F.inf C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Windows\System32\drivers\WM7F.sys C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Windows\System32\drivers\WM7F.inf C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Windows\system32\drivers\cbregistry20.sys C:\Program Files\WW2017CF\wmcSystem7.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" C:\Windows\system32\rundll32.exe N/A

Checks installed software on the system

discovery

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini C:\Program Files\WW2017CF\wmcSystem7.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\M: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\O: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\T: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\D: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\F: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\I: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\Q: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\X: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\G: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\L: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\P: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\A: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\Z: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\E: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\J: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\K: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\B: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\N: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\R: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\H: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\W: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\S: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\U: C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened (read-only) \??\Y: C:\Program Files\WW2017CF\wmcSystem7.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Program Files\WW2017CF\wmcSystem7.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\pcinfo7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Windows\system32\WinNetDaily.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Windows\SysWOW64\pcinfo7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Windows\SysWOW64\HuRMS.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Windows\SysWOW64\WinNetDaily.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Windows\SysWOW64\pcinfo7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Windows\system32\pcinfo7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Windows\SysWOW64\WinNetDaily.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Windows\SysWOW64\wmcUpdater.exe C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe N/A
File opened for modification C:\Windows\system32\HuRMS.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Windows\system32\WinNetDaily.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Windows\SysWOW64\wmcUpdater.exe C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe N/A
File created C:\Windows\system32\cbregistryevtmsg.dll C:\Program Files\WW2017CF\wmcSystem7.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WW2017CF\Info\HWInfo.opt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\cbfsfilter2032.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\PCInfo7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcDataBurner7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\Policy\System\PolicyContainer.bak C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\Info\Admin.opt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\wmcService7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcUpdater.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcUser7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\GCBClient.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\winet.lnk C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\WM7F.cab C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcFTSlave7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcService7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcWatermark_DLL64.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\Info\ADUserInfo.txt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\cbregistry.cab C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\ServerSchTask.dat C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\Updater7.ini C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcWatermark_DLL.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\SmrPolicy.txt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\Policy\System\PolicyContainer.opt C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcUpdater.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\Info\BootInfo.opt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Program Files\WW2017CF\cbfsfilter20.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcWatermark7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcWatermark7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\XceedCry.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\Info\PCInfo.opt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Program Files\WW2017CF\cbregistry.cab C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcHook7.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcMemmgr.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\Info\LogonInfo.opt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Program Files\WW2017CF\GCBClient.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\Version.dat C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\Info\PCInfo.opt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Program Files\WW2017CF\Policy\System\PolicyContainer.opt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\Offline\System\BVRKIPTS2024_06_03_09_36_31_131_3172.off C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\wmcEncryption7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcHook764.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcSystem7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\cbfsfilter20.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\cbfsfilter2032.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\PCInfo7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\PolicyViewer.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\Updater7.ini C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\ScheduleTask.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcEncryption7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcSystem7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\Info C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\Info\RemoteService.opt C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\Policy C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\Policy\System\PolicyContainer.opt C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\PolicyViewer.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\Info\RemoteService.opt C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\TGT2.ini C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\wmcEnterprise.dat C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcProc7.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcWatermark764.exe C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\ServerSchTask.dat C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File opened for modification C:\Program Files\WW2017CF\Version.dat C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\wmcWatermark_DLL64.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
File created C:\Program Files\WW2017CF\WM7F.sys.w8_x64_Signed C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Program Files\WW2017CF\wmcMemmgr64.dll C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WM7\AutoUpdate\20240603.log C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe N/A
File opened for modification C:\Windows\Debug\WM7\AutoUpdate\20240603.log C:\Windows\SysWOW64\wmcUpdater.exe N/A
File created C:\Windows\inf\oem2.PNF C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Windows\Debug\WM7\Client\wmcProc7.exe\20240603.log C:\Program Files\WW2017CF\wmcProc7.exe N/A
File created C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240603.log C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240603.log C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Windows\Debug\WM7\Client\wmcSystem7.exe\LogWriteTest.txt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Windows\Debug\WM7\Client\wmcSystem7.exe\LogWriteTest.txt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Windows\Debug\WM7\Client\wmcProc7.exe\LogWriteTest.txt C:\Program Files\WW2017CF\wmcProc7.exe N/A
File created C:\Windows\inf\oem0.PNF C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Windows\inf\oem1.PNF C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Windows\Debug\WM7\Client\wmcUser7.exe\20240603.log C:\Program Files\WW2017CF\wmcUser7.exe N/A
File created C:\Windows\Debug\WM7\Client\wmcProc7.exe\20240603.log C:\Program Files\WW2017CF\wmcProc7.exe N/A
File opened for modification C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240603.log C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Windows\Debug\WM7\SystemDisk.opt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Windows\Debug\WM7\Client\wmcUser7.exe\LogWriteTest.txt C:\Program Files\WW2017CF\wmcUser7.exe N/A
File opened for modification C:\Windows\Debug\SMR7\ScheduleTask\2024_06_03.log C:\Program Files\WW2017CF\ScheduleTask.exe N/A
File created C:\Windows\Debug\WM7\Client\wmcUser7.exe\20240603.log C:\Program Files\WW2017CF\wmcUser7.exe N/A
File opened for modification C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240603.log C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File created C:\Windows\Debug\WM7\Client\wmcSystem7.exe\LogWriteTest.txt C:\Program Files\WW2017CF\wmcSystem7.exe N/A
File opened for modification C:\Windows\Debug\WM7\AutoUpdate\20240603.log C:\Windows\SysWOW64\wmcUpdater.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ContainerID C:\Program Files\WW2017CF\wmcSystem7.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\2 C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\runonce.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\runonce.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\cscript.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\474A91C\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\System32\cscript.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\System32\cscript.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\474A91C\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\System32\cscript.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings C:\Windows\System32\cscript.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs C:\Windows\System32\cscript.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\474A91C\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\System32\cscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\cscript.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\cscript.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BAF7A82C-443E-4FF5-8A04-286E30C67553}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.RSASigningMethod\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.Hashing\CurVer C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68051560-DBA7-4939-8E34-4A8F28313E65}\TypeLib\Version = "1.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF814B45-2ED1-4471-B151-89E6D49AD3E5}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CA6D55E7-F279-42BA-AEC5-5338C5CE5B30} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.TwofishEncryptionMethod\ = "XceedTwofishEncryptionMethod Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{065BFAE3-3448-4E31-BAAC-CB599C7AAA24}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065BFAE3-3448-4E31-BAAC-CB599C7AAA24}\ = "IFoxDiskSession" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BAF7A82C-443E-4FF5-8A04-286E30C67553}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBAC3AFA-8540-497E-BB31-D6A8667A43AF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DA68A3FF-C69C-4FE8-947B-BD561EE15EFA}\ = "FoxBurner Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxBurnerCOM.FoxDeviceCapabilities.1\CLSID\ = "{8E0FC6DA-5E53-4F8B-A139-BFF7ACE28FC6}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EA8B5033-ADA7-4B06-B5D0-8BC7C13909D2}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.RSASigningMethod.1\ = "XceedRSASigningMethod Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6081A14B-77EC-4451-ABA0-20957C818BFE} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.Encryption\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{231D1CF6-C578-411D-9B9B-48264355805D}\ = "XceedSHAHashingMethod Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7EC04D5B-19A8-45EE-BCB0-6FE0067F9468}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jsef\shell\open\command\ = "C:\\Program Files\\WW2017CF\\wmcEncryption7.exe %1 decrypt" C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E0FC6DA-5E53-4F8B-A139-BFF7ACE28FC6}\ProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E0FC6DA-5E53-4F8B-A139-BFF7ACE28FC6}\VersionIndependentProgID\ = "FoxBurnerCOM.FoxDeviceCapabilities" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3E95E1D-D003-42A0-91FD-465DC624BC7A}\VersionIndependentProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F46F6141-7C9C-4d70-911A-E49CE2ADA922}\VersionIndependentProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F46F6141-7C9C-4d70-911A-E49CE2ADA922}\Programmable C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C14B6BF4-85A9-4DDF-BD42-59928595634F}\ = "IFoxDeviceCapabilities" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.RSAEncryptionMethod.1 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF814B45-2ED1-4471-B151-89E6D49AD3E5}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.Encryption\CLSID\ = "{A0A61B00-96A6-457F-AA5E-AFA5167852E5}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxBurnerCOM.FoxDiskSession\CurVer\ = "FoxBurnerCOM.FoxDiskSession.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02084676-181B-4E44-9E8A-7D2C38BFF609} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0A61B00-96A6-457F-AA5E-AFA5167852E5}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3E95E1D-D003-42A0-91FD-465DC624BC7A}\ProgID\ = "Xceed.TwofishEncryptionMethod.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6F9F8921-D7A9-47E4-A0D5-B5F2CA673408} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CA6D55E7-F279-42BA-AEC5-5338C5CE5B30}\TypeLib\ = "{55A560A7-E3F9-4790-8D22-F3A97009AC8F}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsef\DefaultIcon\ = "C:\\Program Files\\WW2017CF\\wmcEncryption7.exe" C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F46F6141-7C9C-4d70-911A-E49CE2ADA922}\ProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C6F5554-32C4-4304-A235-B5F2B97F1B20}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DBAC3AFA-8540-497E-BB31-D6A8667A43AF}\TypeLib\ = "{55A560A7-E3F9-4790-8D22-F3A97009AC8F}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C3271080-C57A-4520-8066-337AD212D7E0}\ProgID\ = "Xceed.RSAEncryptionMethod.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D865F1E7-BAC6-4ECA-B37B-0A5DDFF2D031}\ToolboxBitmap32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F066CCAD-163A-4617-BA3C-BA4A4F80320C}\TypeLib C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0A61B00-96A6-457F-AA5E-AFA5167852E5}\MiscStatus C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.TwofishEncryptionMethod.1\CLSID\ = "{D3E95E1D-D003-42A0-91FD-465DC624BC7A}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.SHAHashingMethod\CLSID\ = "{231D1CF6-C578-411D-9B9B-48264355805D}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.RSASigningMethod.1\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C3271080-C57A-4520-8066-337AD212D7E0}\VersionIndependentProgID\ = "Xceed.RSAEncryptionMethod" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CA6D55E7-F279-42BA-AEC5-5338C5CE5B30}\TypeLib\ = "{55A560A7-E3F9-4790-8D22-F3A97009AC8F}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CA6D55E7-F279-42BA-AEC5-5338C5CE5B30}\TypeLib\Version = "1.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E0FC6DA-5E53-4F8B-A139-BFF7ACE28FC6}\Programmable C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBA63CAC-9913-4A13-9212-E97BB70C05C9}\VersionIndependentProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBA63CAC-9913-4A13-9212-E97BB70C05C9}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68051560-DBA7-4939-8E34-4A8F28313E65} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxBurnerCOM.FoxDiskSession\CurVer C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{231D1CF6-C578-411D-9B9B-48264355805D}\VersionIndependentProgID C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7EC04D5B-19A8-45EE-BCB0-6FE0067F9468}\InprocServer32\ = "C:\\Program Files\\WW2017CF\\XceedCry.dll" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D865F1E7-BAC6-4ECA-B37B-0A5DDFF2D031}\InprocServer32 C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68051560-DBA7-4939-8E34-4A8F28313E65}\TypeLib\ = "{55A560A7-E3F9-4790-8D22-F3A97009AC8F}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxBurnerCOM.FoxDiskSession.1\ = "FoxDiskSession Class" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F46F6141-7C9C-4d70-911A-E49CE2ADA922}\Programmable C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.RijndaelEncryptionMethod\CurVer\ = "Xceed.RijndaelEncryptionMethod.1" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C6F5554-32C4-4304-A235-B5F2B97F1B20}\ = "_IFoxBurnerEvents" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EA8B5033-ADA7-4B06-B5D0-8BC7C13909D2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xceed.RSAEncryptionMethod\CLSID C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcUser7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcUser7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcProc7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcProc7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcUser7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcUser7.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\WW2017CF\wmcSystem7.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\WW2017CF\wmcProc7.exe N/A
N/A N/A C:\Program Files\WW2017CF\wmcUser7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4548 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\reg.exe
PID 4548 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\reg.exe
PID 4548 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\reg.exe
PID 4548 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Program Files\WW2017CF\wmcSystem7.exe
PID 4548 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Program Files\WW2017CF\wmcSystem7.exe
PID 4548 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Program Files\WW2017CF\wmcSystem7.exe
PID 4548 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Program Files\WW2017CF\wmcSystem7.exe
PID 1648 wrote to memory of 3148 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\system32\rundll32.exe
PID 1648 wrote to memory of 3148 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\system32\rundll32.exe
PID 3876 wrote to memory of 2556 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\regsvr32.exe
PID 3876 wrote to memory of 2556 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\regsvr32.exe
PID 3876 wrote to memory of 3016 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\regsvr32.exe
PID 3876 wrote to memory of 3016 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\regsvr32.exe
PID 2556 wrote to memory of 4972 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2556 wrote to memory of 4972 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2556 wrote to memory of 4972 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3016 wrote to memory of 2600 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3016 wrote to memory of 2600 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3016 wrote to memory of 2600 N/A C:\Windows\System32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 3876 wrote to memory of 4864 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\system32\rundll32.exe
PID 3876 wrote to memory of 4864 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\system32\rundll32.exe
PID 3148 wrote to memory of 3100 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\runonce.exe
PID 3148 wrote to memory of 3100 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\runonce.exe
PID 3100 wrote to memory of 4848 N/A C:\Windows\system32\runonce.exe C:\Windows\System32\grpconv.exe
PID 3100 wrote to memory of 4848 N/A C:\Windows\system32\runonce.exe C:\Windows\System32\grpconv.exe
PID 4548 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe
PID 4548 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe
PID 4548 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe
PID 4536 wrote to memory of 872 N/A C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe C:\Windows\SysWOW64\wmcUpdater.exe
PID 4536 wrote to memory of 872 N/A C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe C:\Windows\SysWOW64\wmcUpdater.exe
PID 4536 wrote to memory of 872 N/A C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe C:\Windows\SysWOW64\wmcUpdater.exe
PID 4548 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\netsh.exe
PID 4548 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\netsh.exe
PID 4548 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\netsh.exe
PID 4548 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\netsh.exe
PID 4548 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\netsh.exe
PID 4548 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\netsh.exe
PID 4548 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\netsh.exe
PID 4548 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\netsh.exe
PID 4548 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\netsh.exe
PID 4548 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\netsh.exe
PID 4548 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\netsh.exe
PID 4548 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\netsh.exe
PID 4548 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4548 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4548 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4548 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Program Files\WW2017CF\ScheduleTask.exe
PID 4548 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Program Files\WW2017CF\ScheduleTask.exe
PID 4548 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe C:\Program Files\WW2017CF\ScheduleTask.exe
PID 3876 wrote to memory of 4372 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\cscript.exe
PID 3876 wrote to memory of 4372 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\cscript.exe
PID 3876 wrote to memory of 3812 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\cscript.exe
PID 3876 wrote to memory of 3812 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\cscript.exe
PID 3876 wrote to memory of 3856 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\cscript.exe
PID 3876 wrote to memory of 3856 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\System32\cscript.exe
PID 3876 wrote to memory of 4912 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\system32\netsh.exe
PID 3876 wrote to memory of 4912 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\system32\netsh.exe
PID 3876 wrote to memory of 4608 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\system32\netsh.exe
PID 3876 wrote to memory of 4608 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Windows\system32\netsh.exe
PID 3876 wrote to memory of 5108 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Program Files\WW2017CF\wmcUser7.exe
PID 3876 wrote to memory of 5108 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Program Files\WW2017CF\wmcUser7.exe
PID 3876 wrote to memory of 5108 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Program Files\WW2017CF\wmcUser7.exe
PID 3876 wrote to memory of 916 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Program Files\WW2017CF\wmcProc7.exe
PID 3876 wrote to memory of 916 N/A C:\Program Files\WW2017CF\wmcSystem7.exe C:\Program Files\WW2017CF\wmcProc7.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer C:\Program Files\WW2017CF\wmcSystem7.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe

"C:\Users\Admin\AppData\Local\Temp\3cddad79cf5682367b2c29f95203e49c5ff8861bcd8fb191ee01fa94afbfb8d9.exe"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe export HKLM\SYSTEM\CurrentControlSet\Services\Win-Win7 "C:\Users\Public\SMR7\Debug\WinWin7.RegDebug.log"

C:\Program Files\WW2017CF\wmcSystem7.exe

"C:\Program Files\WW2017CF\wmcSystem7.exe" -di

C:\Program Files\WW2017CF\wmcSystem7.exe

"C:\Program Files\WW2017CF\wmcSystem7.exe" -ai

C:\Windows\system32\rundll32.exe

C:\Windows\system32\rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Windows\System32\drivers\WM7F.inf

C:\Program Files\WW2017CF\wmcSystem7.exe

"C:\Program Files\WW2017CF\wmcSystem7.exe"

C:\Windows\System32\regsvr32.exe

/i /s "C:\Program Files\WW2017CF\XceedCry.dll"

C:\Windows\System32\regsvr32.exe

/i /s "C:\Program Files\WW2017CF\FoxSDKU32w.dll"

C:\Windows\SysWOW64\regsvr32.exe

/s "C:\Program Files\WW2017CF\XceedCry.dll"

C:\Windows\SysWOW64\regsvr32.exe

/s "C:\Program Files\WW2017CF\FoxSDKU32w.dll"

C:\Windows\system32\rundll32.exe

C:\Windows\system32\rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Windows\System32\drivers\WM7F.inf

C:\Windows\system32\runonce.exe

"C:\Windows\system32\runonce.exe" -r

C:\Windows\System32\grpconv.exe

"C:\Windows\System32\grpconv.exe" -o

C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe

"C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe" -smr_inst

C:\Windows\SysWOW64\wmcUpdater.exe

"C:\Windows\SysWOW64\wmcUpdater.exe" -smr_inst

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="ICMPv4 Inbound"

C:\Windows\SysWOW64\wmcUpdater.exe

"C:\Windows\SysWOW64\wmcUpdater.exe"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="WinMasterServices V7 Client7"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="WinMasterRC Slave7"

C:\Windows\SysWOW64\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="WinMasterFT Slave7"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /i /s "C:\Program Files\WW2017CF\FoxSDKU32w.dll"

C:\Program Files\WW2017CF\ScheduleTask.exe

"C:\Program Files\WW2017CF\ScheduleTask.exe" -SetSchedule

C:\Windows\System32\cscript.exe

C:\Windows\System32\cscript.exe "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus

C:\Windows\System32\cscript.exe

C:\Windows\System32\cscript.exe "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus

C:\Windows\System32\cscript.exe

C:\Windows\System32\cscript.exe "C:\Program Files\Microsoft Office\Office15\ospp.vbs" /dstatus

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="WinMaster Client7"

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="WinMaster Client7" dir=in program="C:\Program Files\ww2017cf\wmcSystem7.exe" action=allow enable=yes profile=any localip=any remoteip=any protocol=TCP interfacetype=any edge=yes

C:\Program Files\WW2017CF\wmcUser7.exe

"C:\Program Files\WW2017CF\wmcUser7.exe"

C:\Program Files\WW2017CF\wmcProc7.exe

"C:\Program Files\WW2017CF\wmcProc7.exe"

C:\Windows\System32\cscript.exe

C:\Windows\System32\cscript.exe "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus

C:\Windows\System32\cscript.exe

C:\Windows\System32\cscript.exe "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs" /dstatus

C:\Windows\System32\cscript.exe

C:\Windows\System32\cscript.exe "C:\Program Files\Microsoft Office\Office15\ospp.vbs" /dstatus

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
N/A 192.168.6.221:8150 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
N/A 192.168.6.221:8150 tcp
US 8.8.8.8:53 97.90.14.23.in-addr.arpa udp
N/A 192.168.6.221:8150 tcp
N/A 127.0.0.1:8150 tcp
N/A 192.168.6.221:8150 tcp
N/A 192.168.6.221:8150 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
N/A 192.168.6.221:8150 tcp
N/A 192.168.6.221:8150 tcp

Files

C:\Users\Public\SMR7\ManualUpdate.ini

MD5 9d3ae7caa49c493e2fbe8239a61cd4fe
SHA1 e76cec0ab133e43b4ceea01c838056b3b3664c51
SHA256 98b84068ac60b2c8a289e8c4171f54610cf21a4c7b01d8d2e876ec0422b81fd5
SHA512 7ab548dbdb954da372782efda1c9783d4d43194ecab9226de212db786d3f4c93651b93e7940b97b51b920b20097e69aed8d48de3dc3f60345d9e14cdd3de1198

C:\Users\Public\SMR7\Debug\ManualUpdate\2024_06_03_BVRKIPTS.log

MD5 1cb9d04f7535eb76c837ca9f5793d45f
SHA1 b92aa34e548d8d4d927834127fa215919ec54980
SHA256 46e4a509e89d7aae1c3d17232b44d611b76707c743d62ccfef652023233899ca
SHA512 2b71842c246ad15bd5d9dabce7206d7a772383ddee2471ecc73c0d688156cdc52537188e60413e3ba654b6cc2d416727b3ba81002955fc07fbbd00d3d182b6ae

C:\Users\Public\SMR7\Debug\ManualUpdate\2024_06_03_BVRKIPTS.log

MD5 1d2cee294431f7c818a57ada0b67b969
SHA1 1d957ee0248ebd02ee7f9f4f7f4872c8e4614e68
SHA256 8c94491a673bbfbcbec1a5cab9d8be05278cf6383efaa87b85bcf8e967d7bc6e
SHA512 98eaa237ce010fc99206d76bb2829f6904cb89bc2c8bb52c489dc4e37169af293025dca66499d74de75b20e4e26a8c1f3a1a84c6a28576e4829beaab180dc421

C:\Users\Public\SMR7\Debug\ManualUpdate\2024_06_03_BVRKIPTS.log

MD5 9448a5573029cae76f2a161d0a605f3b
SHA1 c00df045ced880699f9657e9c279344e3651530b
SHA256 7711f0ba3f0cd6378ba58ce7d57deaf1b2c951b60e154684ac9a3d0bac09517a
SHA512 aa3a0c2b47b8448e196748f85a07417b8496add3c621ffc3108952c58504ecc421e59283a2dcfc537cb66528db7100bc928579af2b7cf78797b798ce6eb154fd

C:\Users\Public\SMR7\WM7installTemp\cbfsfilter20.dll

MD5 be8818d3615195035cd9975c47204a85
SHA1 309e2195d53f486afe3f87ed186dcc39ff79c7d9
SHA256 2340772c80a5f90801d307f1e8f3ff4e77d6fd0f7d643a837e429129988c1e8a
SHA512 7b1ab6fe500edba69a792daf6a06c2d17a43ccf89f4ee8c65fb1ca162beca027a02a9b89e95fde9bab8789f2de3eb677ab7fb4d1d8f3ca000b8d4a2e4035b344

C:\Users\Public\SMR7\WM7installTemp\wmcService7.exe

MD5 48e8605440424daa13fe37f54a0aa353
SHA1 6b88a88d86f2641f4639e539714babb586b3109f
SHA256 394e3a1517e5dea89ce4329ffb4483cc5344f19a2058b43cb828799c75d64e10
SHA512 17c3d5011b51a457eba4079ea096fe5f3b8ea0d75b4aa0dcefda3debe8da44ad30ed643e523fdc0733c7439a36776f2d1f54b6fe6c618d4cd54e0e32c29b8745

C:\Users\Public\SMR7\WM7installTemp\wmcSystem7.exe

MD5 df7a46c060be48306fbcc850456ef18a
SHA1 7bf67efd5c4bd3da9dc2f4f49e24533408dbad46
SHA256 9f7744f9566df7bbb604375cac7fb15ef25e7c4d90797129867f8a79ec6c1225
SHA512 d1d0b88af90f4869b47e823d74267054fe629bfd4c4677f1aa423590b399019c84fbfec92d0301a0d82e7b8c94c15df4fe5b96918d8e59c96d8e3ff6593dedf8

C:\Program Files\WW2017CF\cbfsfilter2032.dll

MD5 4efb2a895ecd3792eed52e850af847c9
SHA1 74e43921d052fecf4190c813c9ee56b37d79dea8
SHA256 8a21206fe6d151d5c18fa48d8bb6cb600190bdf62999c6cc7e53a31b8fcdc72c
SHA512 40a90f67830d7f1415f9781ccb09f2ec68b075004db238aadd09afb7a1b11b61c266d25f60c96966b0eb0aa3ed1531e2f9b04e4d1b2fe753cda68a59af26e6f6

C:\Program Files\WW2017CF\cbregistry.cab

MD5 cbf0c82d8867a425a0a04527e89425f1
SHA1 7c946358da28fb35b62755e3854edfd349f8bf84
SHA256 ce731190ee0d63e9051b1ea58f305d49256a799e170de45baa3a5bc1b0bb5e9c
SHA512 e793e4ec38e8d031c568a94b559053504b44b0f5938d71ddedea2b09996e9cdb472f976f181f24e3a53c6c621d3936a7ed955e716e8d10b8867c39b45570dbf0

C:\Users\Public\SMR7\WM7installTemp\PolicyViewer40.exe

MD5 3a1b35c59faee8f49564a844886c5e2f
SHA1 71eed14b8c1b39c74ff7a8d7f18555ab428e165b
SHA256 e836912ef4f75b7e208539fc0af37092e3a5b36e36324154e3ac5e270de826c8
SHA512 f32c8d0cf7464d6358328f57a5ded664a034931f47f52434343958adc6451ca4f6747faab5c307df0ed1db0f941d9dea31e110d74f01394a96faf51d325a9049

C:\Program Files\WW2017CF\wmcEnterprise.dat

MD5 efb7296340c8c83e18d94f7925803b38
SHA1 257c7db3f2f2f8865b7c4ade0c5ed6e4adf4f2bc
SHA256 b71adfe936280c99af02e11decf438eb1d4af57cae2e2208c3c6b2c8bba82d44
SHA512 d9f14cdaaac469c4de627843c17247cff78245cdfeae38aae87ec57e8ac3aa1927052214dd52afe84293b58a836cb491abd8df43756b25bd00c04335031f8959

C:\Program Files\WW2017CF\XceedCry.dll

MD5 2c0c746eecffdcedd18450659f3a8ee6
SHA1 68dcbd003837545a07608ed3f2efa77612c30456
SHA256 ff9722c64be81caad50e14bb3f50f345b4a30ca76c87113292ff852e934590b3
SHA512 ccc2a0f7d3f18eb1ff3506cc8545e7fa72b05758bfeb8b5e8348de4f7648ff57deba69839f8b7d7a350d6cb383030267e81bb3d274aa62f1e9a6002d5b2a7751

C:\Program Files\WW2017CF\wmcWatermark_DLL64.dll

MD5 22971c80f1b259a441618fffb6ba272d
SHA1 882954bc62524872d91934d426aa16c1bfeed5aa
SHA256 e508f49196fcd06618b61926894c7218479ae8d8316dfd85a7fbb5196e379367
SHA512 3ba0734079414a942a1537b26512e412dc0395047af9f3d601a5e2815260ff0d8b78d723d72be31bc60724dc6d841e3423b66f3be66d9bbcc6edf51e12185480

C:\Program Files\WW2017CF\wmcWatermark_DLL.dll

MD5 1382987179f8036c02a6984045a1706f
SHA1 7b62e05127b1b48c6c499d12472d988c4a908790
SHA256 5e17105bfa60a0bcdc59408444167bb6a31eaa45e2dc3db619b9b40ad13a113c
SHA512 305c79969c9de07a6043fc5d9ef958433cd18f9967f4e06ad806c0a0d951d796b36b86d1ed5a1eebe640855d61e08430d1763b0c5b55293638fb8878af159023

C:\Users\Public\SMR7\WM7installTemp\wmcWatermark764.exe

MD5 c296210f4d633e27b31fdc69bc7e52df
SHA1 54691eb49db559b31a21b5267c1ea951744ad0f5
SHA256 972cefa76b81fd49a67f4eb1e2832fe677a6e20e984df5ae0755b9215f706d0d
SHA512 30609fe30bf8757e4b1eb0f312999f2de410176411923f011cac5fe665a6f3484e53a057013050f137249113fa09ea5f54c360c9681e0fb03b3cd800549df54f

C:\Users\Public\SMR7\WM7installTemp\wmcWatermark7.exe

MD5 adcd46624b13fd8b7fbe1c434fa9b554
SHA1 c25b3d4e64852cd412631ff12713e6fe57b7fa59
SHA256 068cfc241e956d9e0a7b4f43ff5e9a52def92318a907478c8940ca4d446700c1
SHA512 64b79ca858437de607c98d5f6f3fc766002b48061bc22fe0d21aabf88c2ee777952bbfa3a66e3e67a2f976dab0c8598250a772b2489c64f383230359544c39e0

C:\Users\Public\SMR7\WM7installTemp\wmcUser7.exe

MD5 973e8a7e616972bbf44bde9e6bc4a15b
SHA1 fe0b70aa4502e5d5e04b2e4cd97de9411561f263
SHA256 2c10a8233485afb3b54131991d7859de151eaf68bd99bd66ab387c228dbf14f5
SHA512 8b05f1af5dea46efac54c90dd53becb0cc3f825084b90a423b7011bc22e6980d9c7ca1f79b7ba7e322eb03417189deadf134261a61ffd91b9b2a513cbaa52b86

C:\Users\Public\SMR7\WM7installTemp\wmcUpdater.exe

MD5 0bc433c866a12a560761514cf9466057
SHA1 a12fae7f8dff6d1247be6b89814d03123f4ec9b4
SHA256 9f7dfa281d6374646421ffd74bfa0534bcdfaab650e95c68ab5acb2d50957d7a
SHA512 4062177c58860f97faf7732361a7129695aafdc3cb819fe5c848069b41bf8a49272697066e2d44ee524356e6b5f0b33dfeb659ea99d1204581447a6c00ea7466

C:\Users\Public\SMR7\WM7installTemp\wmcRCSlave7.exe

MD5 613c32f03d0c5402d39bee40fe686daa
SHA1 339989dba57200366ca93d612690568fe63179eb
SHA256 381551b2e407606d7f75bc97f8b4d139b79736cf7d45f20b44c17b351b8b2357
SHA512 e4f794681c3faaaef1de0b06ad552f9dc93f26b9ceb59cb0abc5b4cc43a0757d63fa7dfdb8d98d248b107eeb0c563f54474c041dec630269bf885fb2394dcee2

C:\Users\Public\SMR7\WM7installTemp\wmcProc7.exe

MD5 f43aca48d1c94e444485ccaa16784d51
SHA1 51139bb576470ae852f881b008fba2fca66bce5e
SHA256 adbb2529e20817af1dbb1130e901a80528d76e1eebac32a322ebfcbc98a16032
SHA512 dfa9b3a875f236241da75ca55711ad97389eec73b30d49043be6fc19049201813dccb7a3c99e7a8693a60b99bacbd2b77df58da7d0a4d867a4cc6c51c1a2250e

C:\Program Files\WW2017CF\wmcMemmgr64.dll

MD5 87ce6a87f5d828e5667d3aa262469d70
SHA1 5be0e09630639fb34c7f6b9f461816caeaf3c920
SHA256 f452e0cc62b65fd187b5434cc289556609afdac096d9da2b3c21203121a6d364
SHA512 ef3191d8a2d3d5fe672a8f50edf9185283e3923c73416984e9eacccc68e417594ad9f6fc8444bfc84d2559f286beeb6ae3ebbc5f0ecc0caf8f9a9ea23c23ede7

C:\Program Files\WW2017CF\wmcMemmgr.dll

MD5 78ae8351860894528c5a591633c118e4
SHA1 a24af6086d96e7bfac6a1186a3d693fbc880af18
SHA256 3c14c2f092a2dd8f8763e7e158d331d7835d870fad7a78c6dff117268c82f7d7
SHA512 7c9f02f03281f66d5aef2365f82fb10638e10c1c8f82f75e64086a922b8e92a34516ffbbec34b0a55121af2781dfa239c98041167aea8ad8d334ca50267d9e3e

C:\Program Files\WW2017CF\wmcHook764.dll

MD5 a3946d64c9d54ba9a98b7109005bd474
SHA1 5d19e3c4af23960dc06d78ba0a0d76a9e9a6a04b
SHA256 eeb99548e38ed4be4cb1cd453adc3abe7ee9eb07ecdc7644935526a261e21f6b
SHA512 cf48929def50a6d3747d416563a7457d1e10cf2bf26d634dd7018dbfaa80f90b22c999cdf5487da78766fe717c33f740dad29dc510d21524d1543cd7c61cc796

C:\Program Files\WW2017CF\wmcHook7.dll

MD5 6396c106cc4ea058f1c6a9fe3ed60213
SHA1 7728f2dcc0f6c6c93ddc10cd7c0dfaa1d13ca6b4
SHA256 2923dc753d10d06d389a3cb2201aa4b10f404e82015450ddb288eaad4f4eb87e
SHA512 0985e01649b01df3ac62927898e3d27b94a035bb99eae0680651a6b9f557146316d953375f79f783836b95bf052431e5cbfb58da6845d43f3627d3dbfb735da5

C:\Users\Public\SMR7\WM7installTemp\wmcFTSlave7.exe

MD5 852f3f6810cb17314f484bc104c47ed6
SHA1 71e9c5c70b251ea1139a2c99571a29ef62ba58b3
SHA256 15a8b924ca3e27f84a2f36ce2768502371180ead491ab153083aefaad87fc127
SHA512 3088de5679e6146b68973342d8f1bc19611194f7882470f0ea788e19eb92cf185de13a8d9faa551d67d24893f5a07ba190255d0c206705fc3f3817dff75a2bab

C:\Users\Public\SMR7\WM7installTemp\wmcEncryption7.exe

MD5 6d4aaf8abeeaa8609088d175487c4b27
SHA1 23f1e4f9d5bdda536c343f1fdc02d9acdd17833a
SHA256 b2660493abe6163094b490e0b69b3fc4a05b595d5ef9d35c082f14071a4f41a9
SHA512 9a0cbef644fecbc5bc334354edf2456bc17a5abe11f21f707f835ccd213d3601e939ed0c336c296802acf5c462f90130f66f3396a77743507012c1763129f6d1

C:\Users\Public\SMR7\WM7installTemp\wmcDataBurner7.exe

MD5 3dfbf34103ae1adddcbccf260a363d0f
SHA1 2d4db9822a2c3ab4b154c29f10a2fc597ed4bb9c
SHA256 dec0c8f4be5e8dfa2f830772d7459ab5e100d615c590070b402c203be7272716
SHA512 919b0eccb9ff8f6ccccaa5e5acdd54ff074ad1f2bf282eb5fdcbbccba17f0f717b7a3fdbcfec9f4f51a8682c4a2c3f22ba584f44e292f5ea2401e2917847dd04

C:\Program Files\WW2017CF\WM7F.cab

MD5 cc1f53076963cb3c349d15cb9f11648c
SHA1 b10204c29ff8d1bda781a79de44c50386162fa49
SHA256 2490e29b7a6e98d01c1b38a4c083061e63b312a87dd81ee2977f95ba0f7322dc
SHA512 4d9680bb52761c959d972bfbe9887835846c0ae786601883168cbff2a9d6820c74f3c29d8035653db9ffe25666ff88ade65083b568bb564def9960e65e5d33be

C:\Program Files\WW2017CF\WinNetDaily.dll

MD5 6dc31af9f2b09740922065ea28b5eb3c
SHA1 4a1c267b30535aef8c3109f2104da9dd01c17f0c
SHA256 869941e24817fce286963877bad58b0de73486de1bcbfcc7f7d2f9056d514745
SHA512 4303263999c61414c6f29949c70c6cdc6a96cdf210708a39c84b0037a08a108c807a7f03620b7d3303449610c0cfe0ba4fb518e9f37917f983bc70a1e21a6321

C:\Program Files\WW2017CF\winet.lnk

MD5 d34cbdf1a37e06133cf75c17eebbf58d
SHA1 db861919287928e8a5efeb930056c96bd9c815c3
SHA256 a55978e4257023fb61896e82bf006ca4d1a9a5b9c7994042355339ae688b0147
SHA512 dac577250345d2d5a40c8c96eeb489f19de1b3c7a3aee87e31146870216176bc9fcf94decbe1fee4dba60bc7a6b88fa2ff5d0b926097ac86ea9c47c1d62e372c

C:\Program Files\WW2017CF\Version.dat

MD5 3f394766f01d5080492340d5b1412007
SHA1 bcf66946d91e20543fc333405739f2a81629f2c0
SHA256 9ae6c87c532846b61d6ba046d07ec078399aee5e6674f8eaa6dbb33ed5bdb4a5
SHA512 4148bf530d2b49b528ca9e9a38c5532bf08122cee38a0a185feb23c6c427131f72ffc67af84e88c64904643ccd008e0e1f8bc65508d97b2751383849515a5773

C:\Program Files\WW2017CF\Updater7.ini

MD5 6562576eb0f3f5ef8427d522562bcf38
SHA1 8da5720e40dc3c0808ec67a406a14b1aeee71363
SHA256 46402a1d135e284c8e756b3d715a6359661cccc8adba1af4ef80fcef407129ac
SHA512 a1e18f450deb35af2b5bddb4b8e5c48c60bcd25000ed56c1078cd9893564ef5378e7bcfcd7f7d5c00bed4d2bd1e8409be28f9bdb1218e6e8ea1690a2fa614229

C:\Program Files\WW2017CF\TGT2.ini

MD5 14b6600ea20ecf376cc0916adca4664c
SHA1 1a2e60830b18d3938b92e9fdecaca4fc64adb9c3
SHA256 50f17744a841e27360e8d109fe2e4b81cb488a5ea420ef85f53ef307fc5c3aaa
SHA512 f96b706f17745013add0214383598341e6d726a1ff24c9ff782ec45356fa517fd038d1f52de0e3d1c29c3adcdace3df42055d324499a20ff600e14c8e82e10d4

C:\Program Files\WW2017CF\ServerSchTask.dat

MD5 aca73f319209e2556b36c21030592252
SHA1 2e5fe3b619642158dd224e189b9492eb0ceba7ee
SHA256 d7a6e2f0cc0f34b8c4a616516ccdbedb563acfc91de72ee9a3c2cf26da70efbb
SHA512 85de70bcc089fa308b8b3a68cbb924ab4473fb34c2fe2627856bbce9a4114dba7b254e9ea3992038bde65d5717e6242b7fe592b9676eea542a10d4be9ee8f366

C:\Users\Public\SMR7\WM7installTemp\ScheduleTask.exe

MD5 97b22d17f9b149e0abf2a9d1406afab0
SHA1 30bd9f4f5270fbe57983d60d7b5549f1e8caecba
SHA256 a599d8ec969c3fb73bb07371455aedfe7fa9037f906afa0235ab8d16e3e28aec
SHA512 f3c8cd68e797f23e16d8f0e2e7477238b236913f9f129548296b24c1f8ab8afa2fb0e8a7eb77baed492fad9cac5e9420b2fd65a755352ed506a81ebda87b3cd4

C:\Program Files\WW2017CF\Policy\System\PolicyContainer.opt

MD5 a987fbde86cd2a32de5c451298252916
SHA1 a91cdf99964851c8f6d560fb92fbe53d96c8dc28
SHA256 c0da2237679c6e27506478cba709030b1ebce4a4aed6a375f4bc6d3cb4c630d0
SHA512 f238d844d2fd075aa89efe7c00fb09957f1e1cc6199a85108f48f63135acfe030f7bbc8e809e32e852c386ce966201863b604cd3abfbc8b8f72c5b5364e1c3cb

C:\Users\Public\SMR7\WM7installTemp\PCInfo7.exe

MD5 b163e896a74ee9becad5770c34bce10c
SHA1 4d166a080385acdeb115fcdb8b8acee428f196db
SHA256 e0ad39c486fa93799f3ce4019687027b9dda7f3b69a5e5d572c9cba775931979
SHA512 d65f7d4f1a33011a7c0a59c864d39d4bb27138bf158818d11e34fc4659f4d0cc9bedf77a44eddce6906f785e0bac9b329a86c9b48e4125bdbbdcb630da1e887b

C:\Users\Public\SMR7\WM7installTemp\Info\RemoteService.opt

MD5 21f084d77a7851f7bdc063d42edc02a9
SHA1 a018660ab7e63050facd2a9234bb739ae37dafe0
SHA256 594045032987458e03e396b7a40673138cb71ed175e9b71c2d29f8e31096c463
SHA512 82791e2b6ee4a14e8d408df0dcc4ba4102fd943e2bda5913e320f19d2b10ac0cd53b88a5e6bbc028b72f06a4958a21527d863bc568ec40709b56093a660737ce

C:\Users\Public\SMR7\WM7installTemp\GCBClient.exe

MD5 32f5bcdadb929f8981c1bf428bf8f7ca
SHA1 bed1245f17b8af02b8bb6e5a66a40c7ba46fee14
SHA256 f2ad5a1653c5322810ba5a2a77708d619d7bd661eb9fb0843dbaf9ec1bc771b2
SHA512 da73da117b2ea027ccf62929f3fc5d94f7f247062696a7e533c8043abf7478e288ed399f534b706bab40f2fc3dfd4d2a64a43405265dab459050fe397bf2e225

C:\Program Files\WW2017CF\FoxSDKU32w.dll

MD5 25e0bf4889612fc23561d79c942ada1c
SHA1 f9428cc4f4a9640a244875687178b43a74f4211e
SHA256 3a69e8fa1426b7cc4b837875c0bb5ca19f6b93fe49172f3e2dfa14256fd32d30
SHA512 8c4f6608b2e9930d38b8064a881b7a849b2f8f2222dfcd8915bf137a8ab4a616db56fc784c80600036dbcaa0351946171f17cd7160a8295a2310eed0efa9677d

C:\Program Files\WW2017CF\WM7F.sys.w8_x64_Signed

MD5 247ce2fc87ddabbe2b8dd8c815716c91
SHA1 bb4aae651b110b18df2f118d4a97fa58125a930b
SHA256 5e56c2e4771933f37df918ac0da97e042c193b0600fe26be607eb38201d25a11
SHA512 96101c3896d5f84963e29fb5097facae9d001a2747566326015a8388b24308a8b2a6416395c85815f5b9850822eb9397ae8bd729a5a8cb7d11e3e2cadacdece3

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fc1e3851f429ea606d6ff1e01a5229f1_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f

MD5 beaaa47c5aad6be039fef62e02a4da7d
SHA1 dc0e0ef906e3d482026b1bc95bc7f9dd44e28807
SHA256 db82ab75b09d95aa122c5f6a82d13c7d21bda5a86923fa31fefe56c3876b9df7
SHA512 1630fcf7b207c0c5652f4c04f8709a9f6806ead4182bd21c676032677e72145327036395fed5c9b4a5f54dcac00f45e5fc1c14e4dbb933f5a88106766a5ae95d

C:\Users\Admin\AppData\Local\Temp\REG6486.tmp

MD5 7ab4a9714396f82e25715e8ad38ea5b3
SHA1 04fb94974a10697bd51ea74e3c9982cd02e67d30
SHA256 5dcbced8ff7030da230a862de0b870f81f525f28f9ed888d3799c16c9c8b8586
SHA512 83f31fc6938bf01f710e0c24a08774872c173b8b07ecce9ad757897b8874444babab4bf6325b5b91f001d3ad5bfd13d6889e64037987f1e2c7b21f04baf411a7

C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240603.log

MD5 46a5b628880d4097fd03d0c5fcb67443
SHA1 400fd15bf1c203d2733f5cd4a63238f3e1a9b3db
SHA256 0bf06e5695d5a3d453c9600c993f79399be456863cfa62638e2d26c05cb4528c
SHA512 36bdb53d1b8f2c2101325f1ea623dccb966b6e135b007d89686e5bfc831428d4ca861fecc2f0bb4b238ba7479dbfecbb91c6c496565eb82983f538714b02633b

C:\Windows\System32\drivers\WM7F.inf

MD5 33ec9153c34863caffc90a83ef255e85
SHA1 02a85126e1312b72f9617be01a13ab3ea85aa325
SHA256 6c9a4b307ec6a7f467d54a4560ba4c9c89abcef5722cc1761e33eaef4cfb88fd
SHA512 d94d7b18bcf8eec7dc0e965c3cf0f327d37fd88622c2c573d1ffbaa5481d3e1f543ea87847fcd5ef6973e221653aab784baf1d78fcc16ecb1606d3f57eeaab0c

C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240603.log

MD5 c8336209a46eface6bdccb46ba6baf8d
SHA1 161b337669873703729ea6c6ae72b14aaa9b11b0
SHA256 94098810de26a0425933ce02645ea5970d4c37708c5c308efc446f86a99bd721
SHA512 f698273878c6b3fa790919b86e2be8d27b0f51d382fac298165cd257be46389fe9062ca59a067e60abcf46ffc001f6d6216c1cec7937cbcdfd64723ce2b1bccc

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fc1e3851f429ea606d6ff1e01a5229f1_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f

MD5 542a3f251e69c2b91b4848557a5de618
SHA1 b2cbc06057d577225480cb16dcbb8b03fa2b961d
SHA256 a97c586d9ecea61d77d75c5e9a7f32e971364bdd007bef5fd1a3146fe16960ad
SHA512 8292b0f8ddc8942e26018ca3480d3eb427d0dcb08f3131fdb5bfe8812f71eb1a56e3fd35917003f1b0a3f6d3d33f58af0b6d877f8ed8cc64e81eda5a3077c8e9

C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240603.log

MD5 764f6635ebc3ed3c049c43f32b4ec414
SHA1 56d1a7beab5cc8a00f36a5c3d74839fdfaecc944
SHA256 2d7bd589a9fc05be2d42501aef36c2a273f7f159f6b9c047f7f83f30dd38a4ba
SHA512 9dc87a16f6456ce33c3f97ac9073f1f2bf27a23e745c3146b4324c433469c5e5502cee26d3ec3a077156ea6c3ca3a0bcb33e94073419ae292fcad17c5f1a7551

C:\Windows\debug\WM7\AutoUpdate\20240603.log

MD5 36487a6719d7c3552e7951073ce65e77
SHA1 ce6946344a1426bb4e4059dee15d6db8d1bbbc3d
SHA256 8e0278b002897b994dfe53b6c63c0bde936f8f018ac4d38e80be1e4d0613ab37
SHA512 6a78aa6a250b94d1d3dbcc54f8781c035c299235a0326acdc92ed9412cc219c3d3c73793307571f9c94ebf0fd34592bc9003239b4c52839a295af71ea1fbe755

C:\Windows\Debug\WM7\AutoUpdate\20240603.log

MD5 9ef0d5082bf2ae92b91334da55315061
SHA1 7ec99a2dac2018cb8a790ce48d42497b9c6503f5
SHA256 c86c3ea327e81e406795076ccc3e5b65f64df3c9fcf1f58f39acdbe7b9da0376
SHA512 50f19aa6b4b794fd225d8cc6895cf61a80194597d7eb1d636452ba4e19c2adbb30f861be5e54b660a50564d9ea8f71c6df0bc19230c8cd5bf834476d5b925d47

C:\Windows\debug\WM7\AutoUpdate\20240603.log

MD5 a8fcc091f389d75f8fd2ef9752e52b53
SHA1 f4948be02064aa09025753cb06c851cf3040c42d
SHA256 d04052f49e64d3cbfecfbef6098495d9753387d13feaf2025d1f4a4d1b3b0a6f
SHA512 270b5051316127ad86c2d1ce4cc7358f0efb01f1759c65dfbd7bc4a82eb9b5d3687dbac87befaaf5fb31d7893ac5e13bb8a3ac97c947b64985464952496b9021

C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240603.log

MD5 6734be73d62b6fb17844b1accaa1ee0a
SHA1 27d8792a5c0f347024abc51eece686f70d6891e0
SHA256 40e9fb8a2ba4cd3468747788cc4b984130dd1d23d2d8a81cb09618adcfe65d91
SHA512 26d8493ef6c15d86d984bc6ef09eb55111d4dd3b1a867c59496348fa25f6e60b416ee740b3fa34e00952108b355cb6bf0dad9a882e6de199e7f40eb94f270e92

C:\Windows\Debug\WM7\Client\wmcSystem7.exe\20240603.log

MD5 5297bd8d18e8519ef038ca36d6ccf843
SHA1 74529c777103a6155f69b3ab75cc8039504db800
SHA256 e2a03c2e1f17b8188dc5022bb4220479bb1652b865423b5c8bd553eed2689ac7
SHA512 4d7cfabee8182377cb94b07eb64bd53f3ba9860259d2c36267fdb48c11f3961318550627176e9c58d99ee48ae451292d892b6fa5622ee4c8a55b6052f1e55497

C:\Windows\debug\WM7\Client\wmcSystem7.exe\20240603.log

MD5 7b870b49bc361fc20b78c1fbf2b5de37
SHA1 516e7b4838e86549ed4a51c6963e279cf92163b3
SHA256 f98647a0659e95015428f0766ef31447049d7f1027b562cbbf59c20483f390df
SHA512 5ee11621b452a5737d387f17ee59a73b958d99837962133960f15b558f80f29bea419feefdc20132e1a650f20956fb532db84389a31aa0e9feb7ed6a0a9dd6df

C:\Program Files\WW2017CF\Policy\System\PolicyContainer.opt

MD5 a000d8d6e8ee94bb66e0bf350fe24585
SHA1 b783142dc3f56d6cddb85e93577ed2c1da180278
SHA256 dd6cd1127893ca10e31ff4d860810e6821ef77be0f274dfddbd510e872cd0a3b
SHA512 c4b65a00cb0b8f1ad75043e9704f2f20cebdb3ec6b67e430f47b2fa75bb169613d2355983e206f1058d5e6ab473566b9477a7d70ac8e4830f46003f7da85e6c6

C:\Windows\debug\SMR7\ScheduleTask\2024_06_03.log

MD5 bf7e1a3f7d7f9cef3a62c45d109d1f5e
SHA1 739e905e6727938ad2c754588ccb7a154373ae5c
SHA256 15ee81d7dbc336aa41b6309848cc1fd28a8f8f1a344786893cb1ba86e453a8b5
SHA512 0116402bbabcad165c3b49136a393c6323e81f4003db90063f97f166de91438ab58d8501671383deac3ad34b6ab7f47edaaee1d70707002e745726de0da5ca7e

C:\Program Files\WW2017CF\Info\ADUserInfo.txt

MD5 164f43ab5a1827c52f7fb45e2423979b
SHA1 6e62f181e80ee9f7abde476d7e9f7062442beb7c
SHA256 e4f88ddcaed3bb4ff9b9d7154089d29e14bb510f61d13c835da28a39317cbc13
SHA512 ce9729f5cec31710fcde2cdcb68949c70be952e51305ae38c375ef60128f51d0e5f98974a257eeb45884acc0d9e54ce95f985fd5bcc9a85a14371c4691aa6c22

C:\Program Files\WW2017CF\SmrPolicy.txt

MD5 752d829ef7daac9bedec1915e406ddad
SHA1 ddc9b7eebe2653812b81eb06cb401a34f0352602
SHA256 14b2311d24a84a0390abc8c17710decca8ab5dbc093fcf4cda7cc1bfbaf8b4f9
SHA512 9ffa51a3f62410148c84f2b3a657a9b8599e6c1f2269bbfd01b65db12ea2c11baf6f5ff4a447f8074c83090099584dc4d764932dd628b2f24b16da8a1d785edd

C:\Windows\Temp\{713CC6CE-B3E2-4fd9-838D-E28F558F6866}\cbregistryevtmsg.dll

MD5 7241dcbab33ff2c6a3ea211e3f095be3
SHA1 3fd21f3b8bf054fe34324eba66f0e98ebe6d4bda
SHA256 4be5a326f9f4c07ea1e1df22f27a84aa197a54fab1928d05835f11505005d430
SHA512 66db36e8c4d37391115c6fb1300c1dbffddc84ef4d0db996c05c03687c2d0aa180a57e01be7d72ebffe80fca6fadba0f5e1bb01381065205ae5d476c5a9569b7

C:\Windows\Temp\{713CC6CE-B3E2-4fd9-838D-E28F558F6866}\x64\cbregistry20.sys

MD5 1f6379ecb10624498a6955969cc1d77f
SHA1 8811d30255aceb2d622737a3e12229cc67f6d60e
SHA256 3817532a39d2bfac5445ef205e2c8700dc098c3d27d2fe812ba8608745e5605e
SHA512 2f2bd3be0bd01886c3f76d2a695e171f624139ea38a96b6789e0b400b6b5f7270fcae6e2ee07e82e5c45ddd47699f4e3fe3827a311ee731b79aeb7548c4698a3

C:\Program Files\WW2017CF\Info\PCInfo.opt

MD5 0492d5c2dc1889a20b1f10ad0e2d1839
SHA1 40fba27befc170e7a580dd1d5e40acc240e43027
SHA256 f5495f54a9694c6d3a033285bff2954092b4732a0b6480e4137d6649839bad3f
SHA512 b50e812d5ecd79673f97ba4038f8c6bbb108998ce9db97a80c88a4960c20df47f86d57bcd094caac4d47bb4eddafa8e76623dc4f2d5bf41f3e105051939bb8e8

C:\Program Files\WW2017CF\Info\PCInfo.opt

MD5 601923a74d08d3a4a2ede60aa249106e
SHA1 257ea6e8e24c0ef2181ca6df87f445744b92265f
SHA256 194f67116b8172caed466a2b66870694b2cac09742d3878544e9876d7513f411
SHA512 2cf7d9423ed1b2b6b83984de60b1a2495519fbe64eaf6a1399ec5a0d9a381b35b2927a9f68a2294cae21e9239c0597360f08866aee477373a7519edaf27c48f8

C:\Program Files\WW2017CF\Info\PCInfo.opt

MD5 c26ab841a6d60ae1f165adc9bbaa2666
SHA1 932ec9aedbb4496bbed945d258010197381967d1
SHA256 ea5e7411962a58f74721cf01339c84528801565229473cb8140d17de02e53dc0
SHA512 405ca1df2c8c78d5168ccfc2e6626c21b17ddad2232a31b37025e2af4f8d274bdb0af018d03039f40452d09fe603cf0fa31cf1ed6a62dcb7b0122d7433608f70