Analysis
- max time kernel
82s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 04:16
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
client.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
43 signatures
150 seconds
Behavioral task
behavioral2
Sample
client.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
40 signatures
150 seconds
General
- Target client.msi
- Size 44.9MB
- Sample260930-ev2x9ass6l
- SHA256 c2526d19589bfce14cbe71d9a7ff01e28cd54cb9706de39935fd814fb316d128
- MD5 2366138f0cf640a92a2af5271d5bb7a2
- SHA1 6f050552b0a49960d4d253be38e7c16bf9fd71cd
- SHA512 d2601fa0924313559114a4c7a73327b6b08b21c6d4b5eae6369a9c143488a8f95d60a9f13bf7461b4c973912bbde8b7da155a373f3d561867230ab34d1972684
- SSDEEP 786432:KaQPnaJv8Q1BRLWKj/x+jlgWgX8EwQOLYDo6vLQZ17nKGWgeXwLO/8IXqc:KXK1BZWe/Q27ZOLYDo6vLKMAS/lqc
- TLSH T174A73312BAC18032E5AF05751D7ADB398AB9BC314B31C5A773E82B6D1F726C0A931717
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Active Setup\Installed Components Explorer.EXE - Drops file in Drivers directory 4 IoCs
description ioc Process File created C:\Windows\system32\drivers\GWDogFile.sys install_driver.exe File created C:\Windows\system32\drivers\GWScanner.sys install_driver.exe File created C:\Windows\system32\drivers\GWPG.sys install_driver.exe File created C:\Windows\system32\Drivers\gwwfp64.sys GWProxy.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5188 netsh.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 23 IoCs
pid Process 4808 MSIA867.tmp 2200 GWProxy.exe 2556 GWProxyEncrypt.exe 256 GWFPInstaller.exe 2240 GWClient.exe 2788 GWClient.exe 6048 GWProxy.exe 2456 GWClient.exe 4924 GWClient.exe 5376 GWClient.exe 6132 GWClient.exe 5784 GWClient.exe 2456 GWProxy.exe 6056 GWProxy.exe 2684 install_driver.exe 1816 install_driver.exe 1708 install_driver.exe 4788 GWScanner.sys 4952 GWPG.sys 3260 GWDogFile.sys 5500 GWHardware.exe 348 GWFPInstaller.exe 3300 gwwfp64.sys - Loads dropped DLL 64 IoCs
pid Process 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 5608 MsiExec.exe 5608 MsiExec.exe 5608 MsiExec.exe 5608 MsiExec.exe 5608 MsiExec.exe 5608 MsiExec.exe 5608 MsiExec.exe 6088 rundll32.exe 6088 rundll32.exe 6088 rundll32.exe 6088 rundll32.exe 6088 rundll32.exe 5608 MsiExec.exe 5608 MsiExec.exe 6108 MsiExec.exe 4776 rundll32.exe 4776 rundll32.exe 4776 rundll32.exe 4776 rundll32.exe 4776 rundll32.exe 6108 MsiExec.exe 1740 MsiExec.exe 1824 MsiExec.exe 5504 MsiExec.exe 6108 MsiExec.exe 6108 MsiExec.exe 200 rundll32.exe 200 rundll32.exe 200 rundll32.exe 200 rundll32.exe 200 rundll32.exe 6108 MsiExec.exe 6108 MsiExec.exe 6108 MsiExec.exe 6108 MsiExec.exe 6108 MsiExec.exe 2240 GWClient.exe 2788 GWClient.exe 6108 MsiExec.exe 2788 GWClient.exe 2240 GWClient.exe 5608 MsiExec.exe 6048 GWProxy.exe 6048 GWProxy.exe 6048 GWProxy.exe 6048 GWProxy.exe 6048 GWProxy.exe 6048 GWProxy.exe 6048 GWProxy.exe 5608 MsiExec.exe 6048 GWProxy.exe 6048 GWProxy.exe 6048 GWProxy.exe 420 rundll32.exe 6048 GWProxy.exe 6048 GWProxy.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: GWClient.exe File opened (read-only) \??\W: GWHardware.exe File opened (read-only) \??\E: Explorer.EXE \??\E:\ GWProxy.exe File opened (read-only) \??\A: GWHardware.exe File opened (read-only) \??\R: GWHardware.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Y: GWHardware.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: GWClient.exe File opened (read-only) \??\N: GWHardware.exe File opened (read-only) \??\D: GWClient.exe File opened (read-only) \??\V: GWHardware.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: GWClient.exe File opened (read-only) \??\G: GWClient.exe File opened (read-only) \??\W: msiexec.exe \??\F:\ GWHardware.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: GWClient.exe File opened (read-only) \??\R: GWClient.exe File opened (read-only) \??\H: GWHardware.exe File opened (read-only) \??\Z: GWHardware.exe File opened (read-only) \??\X: GWClient.exe File opened (read-only) \??\P: GWHardware.exe File opened (read-only) \??\R: GWClient.exe File opened (read-only) \??\B: GWClient.exe File opened (read-only) \??\Q: GWHardware.exe \??\E:\ GWProxy.exe File opened (read-only) \??\Q: GWClient.exe File opened (read-only) \??\V: GWClient.exe File opened (read-only) \??\O: GWHardware.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\D: GWClient.exe File opened (read-only) \??\L: GWClient.exe File opened (read-only) \??\Q: msiexec.exe \??\F:\ msiexec.exe File opened (read-only) \??\J: GWClient.exe File opened (read-only) \??\X: GWClient.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: GWClient.exe File opened (read-only) \??\H: GWClient.exe File opened (read-only) \??\N: GWClient.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: GWClient.exe File opened (read-only) \??\Z: GWClient.exe File opened (read-only) \??\F: GWClient.exe File opened (read-only) \??\U: GWClient.exe \??\F:\ GWProxy.exe File opened (read-only) \??\G: GWClient.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\SysWOW64\GuardWareProxyOff.ini GWProxy.exe File created C:\Windows\system32\GuardWareProxyOff.ini GWProxy.exe File opened for modification C:\Windows\SysWOW64\GuardWareProxyOff.ini GWProxy.exe File opened for modification C:\Windows\system32\GuardWareProxyOff.ini GWProxy.exe File opened for modification C:\Windows\SysWOW64\IDGen_Log.txt GWClient.exe File opened for modification C:\Windows\SysWOW64\dll\wntdll.pdb MsiExec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\GuardWareProxy\GuardWareProxy.ini GWProxy.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\GuardWareProxy\GuardWareProxy.ini GWProxy.exe File opened for modification C:\Windows\SysWOW64\wntdll.pdb MsiExec.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\wntdll.pdb MsiExec.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\GuardWareProxy\GuardWareProxy.ini GWProxy.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Guardware\Integrity Management\usbsu_wdk10.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\libbz2-1.0.2.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\GuardWareProxy64.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\ssblock.htm GWClient.exe File created C:\Program Files (x86)\Guardware\Integrity Management\cxcore210.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\check for update.lnk msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\exception.bin GWClient.exe File created C:\Program Files (x86)\Guardware\Integrity Management\luv.dat msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\RegisterLSP32.exe msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\cv210.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\libplc4.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\nssdbm3.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\SVMDetection\SVM_trained_General.xml msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\crashrpt_lang.ini msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\7z.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\unrar.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\PortPid_2k.exe msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\ml210.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\GWChatDocMon.sys msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\MSMInstallerNet40.exe msiexec.exe File opened for modification C:\Program Files (x86)\Guardware\Integrity Management\updater.ini msiexec.exe File created C:\Program Files\Mozilla Thunderbird\MoSetting.cfg GWProxy.exe File created C:\Program Files\Mozilla Thunderbird\MoSetting.cfg GWProxy.exe File created C:\Program Files (x86)\Guardware\Integrity Management\GWPG.sys msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\7zcl.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\libssl32.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\opencv_core231.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\GWCertDLL.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\license_libcurl.txt msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\msvbvm60.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\SSHelperProcess64.exe msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\libplds4.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\nssutil3.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\GWW.exe msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\MAPIDLL.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\GWWFP64.sys msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\GWWPD.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\tarlib.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\postproc-51.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\SSClientHelper.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\secman.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\GWDogFile.sys msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\PRODUCT_VERSION.txt rundll32.exe File created C:\Program Files (x86)\Guardware\Integrity Management\haarcascade_frontalface_alt2.xml msiexec.exe File opened for modification C:\Program Files\Mozilla Firefox\MoSetting.cfg GWProxy.exe File created C:\Program Files (x86)\Guardware\Integrity Management\RedirectorControlDLL.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\GWDocumentTextExtraction.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\sqlite3.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\MSMInstallerNet35.exe msiexec.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\pref\gwSetting.js GWProxy.exe File created C:\Program Files (x86)\Guardware\Integrity Management\NonPorn_safe_2012.xml msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\filew.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\esafeguy.png GWClient.exe File created C:\Program Files (x86)\Guardware\res msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\scrrun.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\haarcascade_profileface.xml msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\secman64.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\unbz2.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\GWReports.dll msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\fface.xml msiexec.exe File created C:\Program Files (x86)\Guardware\Integrity Management\GWInstallSecurity.exe msiexec.exe File opened for modification C:\Program Files (x86)\Guardware\Integrity Management\secman.dll.log regsvr32.exe File opened for modification C:\Program Files (x86)\Guardware\Integrity Management\secman.dll.log regsvr32.exe File opened for modification C:\Program Files (x86)\Guardware\Integrity Management\acc GWClient.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Installer\e5a6804.msi msiexec.exe File opened for modification C:\Windows\Installer\MSICB1C.tmp-\ClientCustact.dll rundll32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\msvcp140_1.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\MSICB1C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFE06.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfc140cht.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\MSI7478.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7583.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{C14716AB-8D16-4989-A982-48CD7523382A} msiexec.exe File opened for modification C:\Windows\Installer\MSI8112.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\msvcp60.dll msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfc140deu.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\MSI9D39.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfc140cht.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\MSI75C3.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfcm140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfcm140u.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfc140enu.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\MSIA3B2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIABD6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAE59.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI776A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI776A.tmp-\ClientCustact.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI776A.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\vccorlib140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfcm140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfc140enu.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfc140esn.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfc140chs.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File created C:\Windows\SystemTemp\~DFBD81952964224847.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI8027.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8112.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI8598.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\msvcp140_2.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\vcamp140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfc140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\e5a6802.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7544.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\msvcp140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfc140deu.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfc140esn.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfc140rus.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\vcomp140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\MSI7BC0.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\vcamp140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfc140u.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfc140kor.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfc140rus.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\MSI9B24.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9D39.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9D39.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI705F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7438.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI776A.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfc140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfcm140u.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfc140jpn.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\vcomp140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\MSI9D39.tmp-\ClientCustact.dll rundll32.exe File created C:\Windows\Installer\$PatchCache$\Managed\BA61741C61D898949A2884DC573283A2\4.5.14\mfc140fra.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe - Launches sc.exe 13 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1240 sc.exe 240 sc.exe 6116 sc.exe 2564 sc.exe 1824 sc.exe 6008 sc.exe 1740 sc.exe 5888 sc.exe 4392 sc.exe 1628 sc.exe 5224 sc.exe 4788 sc.exe 1168 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4136 msiexec.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 14 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4728 cmd.exe 6576 cmd.exe 4548 cmd.exe 1292 cmd.exe 2412 cmd.exe 4268 cmd.exe 3468 cmd.exe 6532 cmd.exe 7124 cmd.exe 1280 cmd.exe 2604 cmd.exe 4724 cmd.exe 6064 cmd.exe 6288 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 1 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E816986BE4B39109A26D4CBF7A75D69BA4A34C54\Blob = 030000000100000014000000e816986be4b39109a26d4cbf7a75d69ba4a34c5420000000010000001d0300003082031930820201a003020102020441c84cfb300d06092a864886f70d01010d0500302e310b3009060355040613025553311f301d06035504030c16477561726477617265204c74642e2028343539343729301e170d3236303932393034313735345a170d3239303632363034313735345a302e310b3009060355040613025553311f301d06035504030c16477561726477617265204c74642e202834353934372930820122300d06092a864886f70d01010105000382010f003082010a0282010100c620092727fd5b1f21fb351b27cda194f1f3f57409c21ec329e4f52d7fbdcfb3a0de6a6d7797acfe6123e77a7ee27fdec39d173a0affb89596f5ca52b4f4d203a88993b69f863163641d9c99a41eeadc8c4b454bd324a42f8be5207cb4a0931264762ed21f50af946ee83183ab032d68dcc67a2e99802c98939f031e1f209ba90259783f646f4d4c1fee342f63bd35d54c49807a9312cb20a976148d253f12b7ffa931005791bb26d95b7f3eab18b0e0cf78a8b181757dfa803e6e5bd7fb35d462d4005340cc9644cf73c5b6a60a70f7b707a421e81124749352c891ceb6d1cb0ade2d153b28cb59dda49cc035b6e060e2bfef15f09bc9fb3a380cff6349f8890203010001a33f303d300f0603551d130101ff040530030101ff300b0603551d0f040403020204301d0603551d0e041604141441cfd1ebaf6256563111299d1fafc39d5c4806300d06092a864886f70d01010d05000382010100499b360115696910a13ffd330edab1c0a004186c4cedaae2a89168f1b8abdacefba6336442061ebabc5e6c365854403e6b894b106986e24bb2d4004f6808dfc1427a2caa4a92a679d16caffc19ac0304ddae6e5cb68482a7bd494ab16dfd1a323cbf396650d21d789d9932c1235e11eeec6af73e6bc35b92d435e2f0eedb87a1de0c067f6e90e788c326ea10b87a1c5e1aa1c281684fbff5ad81718904e31a803135c5f3b14d397aa6deaba370a58f2064ce5cdcea7c30b8c70e09ac29dcf2227d6db91e9c0df95f29c46760a5e4e0703e00fde7e01faf06546e05fa83e09d11b553504aadfa68006e6a02c6d57a6d38cbb62cad4414a2d60200c745c732cbe5 GWProxy.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain GWProxy.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain GWClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname GWProxy.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain GWProxy.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname GWProxy.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname GWClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIA867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWProxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NETSTAT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWHardware.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NETSTAT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWFPInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWProxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xcopy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - System Network Connections Discovery 1 TTPs 18 IoCs
Attempt to get a listing of network connections.
pid Process 4992 NETSTAT.EXE 6532 cmd.exe 7164 NETSTAT.EXE 7124 cmd.exe 6864 NETSTAT.EXE 2036 NETSTAT.EXE 2604 cmd.exe 4268 cmd.exe 5240 NETSTAT.EXE 6064 cmd.exe 6576 cmd.exe 1292 cmd.exe 6196 NETSTAT.EXE 4728 cmd.exe 2292 NETSTAT.EXE 6636 NETSTAT.EXE 3756 NETSTAT.EXE 4548 cmd.exe - Checks SCSI registry key(s) 3 TTPs 11 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc GWHardware.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000463f4e358e8ea170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010463f4e30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010463f4e3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30463f4e300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60463f4e300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GWHardware.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName GWHardware.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc GWHardware.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GWHardware.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName GWHardware.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe - Gathers network information 2 TTPs 10 IoCs
Uses commandline utility to view network configuration.
pid Process 3756 NETSTAT.EXE 6864 NETSTAT.EXE 4992 NETSTAT.EXE 5240 NETSTAT.EXE 6196 NETSTAT.EXE 1940 ipconfig.exe 2292 NETSTAT.EXE 2036 NETSTAT.EXE 6636 NETSTAT.EXE 7164 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1744 systeminfo.exe - Kills process with taskkill 2 IoCs
pid Process 1152 taskkill.exe 2916 taskkill.exe - Modifies data under HKEY_USERS 30 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GWProxy.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\wmic.exe\VBScriptSetScriptStateStarted = "240838140" WMIC.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE WMIC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script WMIC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E systeminfo.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft WMIC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\wmic.exe WMIC.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GWProxy.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GWProxy.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MSIA867.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GWProxy.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MSIA867.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MSIA867.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT GWProxy.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wmic.exe WMIC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry WMIC.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MSIA867.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MSIA867.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GWProxy.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GWProxy.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings WMIC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT GWProxy.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\mlang.dll,-4386 = "English (United States)" systeminfo.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\TypeLib\Version = "6.0" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\secman.OutlookSecurityManager.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PCProxy.ReadOnlyManager\ = "ReadOnlyManager Class" GWProxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PCProxy.DataStatistics\CurVer\ = "PCProxy.DataStatistics.1" GWProxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AddInExpress.OutlookSecurityManager\CurVer\ = "AddInExpress.OutlookSecurityManager.1" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7131C082-F3C6-404D-B8CC-8AF9CFB6209D}\ProxyStubClsid32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA61741C61D898949A2884DC573283A2\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\secman.OutlookSecurityManager\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}\NumMethods\ = "11" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}\ = "secman" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F62A4AF9-58B4-4FEC-89CC-D717A547D8E8}\ = "ReadOnlyManager Class" GWProxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\ = "_Collection" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{92E5039E-FF1E-4AFB-8F24-87592D20C383}\1.0\FLAGS\ = "0" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PCProxy.DataTableHolder.1\CLSID\ = "{DD67706E-819E-4EBD-BF8D-6D6147CC7A49}" GWProxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PCProxy.DataTable\ = "DataTable Class" GWProxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CE321DA-DC11-45C6-A0FC-4E8A7D978ABC}\ = "DataContainer Class" GWProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CE321DA-DC11-45C6-A0FC-4E8A7D978ABC}\LocalServer32 GWProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C97AF157-6A27-4F57-9D47-E2D3E4761B77}\TypeLib GWProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2} GWProxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA61741C61D898949A2884DC573283A2\ProductName = "e-Safe Compliance Enterprise Client" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}\InprocServer32\ = "C:\\Program Files (x86)\\Guardware\\Integrity Management\\secman.dll" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20E1481B-E285-4ABC-ADC7-AE24842B81CD}\INSERTABLE regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PCProxy.ReadOnlyManager GWProxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PCProxy.LSPLogic\CLSID\ = "{B1A429DB-FB06-4645-B7C0-0CC405EAD3CD}" GWProxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{46803190-228D-470E-90FE-F5E0CEA9C4F2}\TypeLib\ = "{ED721A76-8160-4DA0-A18E-7FD7C4574774}" GWProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\secman.OutlookSecurityManager\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20E1481B-E285-4ABC-ADC7-AE24842B81CD}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CE321DA-DC11-45C6-A0FC-4E8A7D978ABC}\LocalServer32\ = "\"C:\\Program Files (x86)\\Guardware\\Integrity Management\\GWProxy.exe\"" GWProxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}\TypeLib\Version = "1.0" GWProxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}\ = "OutlookSecurityManager Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}\NumMethods\ = "12" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20E1481B-E285-4ABC-ADC7-AE24842B81CD}\MiscStatus\ = "0" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}\6.0\9\win32\ = "C:\\Program Files (x86)\\Guardware\\Integrity Management\\msvbvm60.dll\\3" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}\TypeLib\Version = "6.0" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\ = "Licenses" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C4B6DB8-6413-403B-A038-16A352CFE8B9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" GWProxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\secman.OutlookSecurityManager\ = "OutlookSecurityManager Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PCProxy.WFPController.1\ = "WFPController Class" GWProxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}\ = "PSFactoryBuffer" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2F35794D-4574-4BCF-B0A5-3B16AF985788}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}\TypeLib\Version = "6.0" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9DC8FA51-B596-4f77-802C-5B295919C205} GWProxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}\TypeLib\ = "{ED721A76-8160-4DA0-A18E-7FD7C4574774}" GWProxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}\ = "IWFPController" GWProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C8CCB3A-CE4F-40A2-AA1C-E891338BF189}\1.0\0\win64 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD67706E-819E-4EBD-BF8D-6D6147CC7A49}\Programmable GWProxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{832599B2-55BF-4437-8F3E-030CF5AEB262}\AppID = "{9DC8FA51-B596-4f77-802C-5B295919C205}" GWProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\ProxyStubClsid32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}\TypeLib GWProxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}\TypeLib\Version = "1.0" GWProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C97AF157-6A27-4F57-9D47-E2D3E4761B77}\ProxyStubClsid32 GWProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}\ProxyStubClsid32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20E1481B-E285-4ABC-ADC7-AE24842B81CD}\MiscStatus\1 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode\CLSID MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20E1481B-E285-4ABC-ADC7-AE24842B81CD}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20E1481B-E285-4ABC-ADC7-AE24842B81CD}\VersionIndependentProgID\ = "AddInExpress.OutlookSecurityManager" MsiExec.exe - Modifies system certificate store 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E816986BE4B39109A26D4CBF7A75D69BA4A34C54 GWProxy.exe - Runs .reg file with regedit 1 IoCs
pid Process 5952 regedit.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2296 msiexec.exe 2296 msiexec.exe 6108 MsiExec.exe 6108 MsiExec.exe 2200 GWProxy.exe 2200 GWProxy.exe 2200 GWProxy.exe 2200 GWProxy.exe 256 GWFPInstaller.exe 256 GWFPInstaller.exe 6108 MsiExec.exe 6108 MsiExec.exe 6048 GWProxy.exe 6048 GWProxy.exe 6048 GWProxy.exe 6048 GWProxy.exe 6048 GWProxy.exe 6048 GWProxy.exe 6048 GWProxy.exe 6048 GWProxy.exe 6048 GWProxy.exe 6048 GWProxy.exe 6048 GWProxy.exe 6048 GWProxy.exe 2456 GWProxy.exe 2456 GWProxy.exe 6056 GWProxy.exe 6056 GWProxy.exe 6056 GWProxy.exe 6056 GWProxy.exe 6056 GWProxy.exe 6056 GWProxy.exe 6056 GWProxy.exe 6056 GWProxy.exe 6056 GWProxy.exe 6056 GWProxy.exe 5784 GWClient.exe 5784 GWClient.exe 5784 GWClient.exe 5784 GWClient.exe 2456 GWProxy.exe 2456 GWProxy.exe 6056 GWProxy.exe 6056 GWProxy.exe 3164 WMIC.exe 3164 WMIC.exe 3164 WMIC.exe 3164 WMIC.exe 4968 WMIC.exe 4968 WMIC.exe 4968 WMIC.exe 4968 WMIC.exe 5784 GWClient.exe 5784 GWClient.exe 5784 GWClient.exe 5784 GWClient.exe 5784 GWClient.exe 5784 GWClient.exe 5784 GWClient.exe 5784 GWClient.exe 5784 GWClient.exe 5784 GWClient.exe 5784 GWClient.exe 5784 GWClient.exe - Suspicious behavior: LoadsDriver 7 IoCs
pid Process 824 Process not Found 824 Process not Found 824 Process not Found 824 Process not Found 824 Process not Found 824 Process not Found 824 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4136 msiexec.exe Token: SeIncreaseQuotaPrivilege 4136 msiexec.exe Token: SeSecurityPrivilege 2296 msiexec.exe Token: SeCreateTokenPrivilege 4136 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4136 msiexec.exe Token: SeLockMemoryPrivilege 4136 msiexec.exe Token: SeIncreaseQuotaPrivilege 4136 msiexec.exe Token: SeMachineAccountPrivilege 4136 msiexec.exe Token: SeTcbPrivilege 4136 msiexec.exe Token: SeSecurityPrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeLoadDriverPrivilege 4136 msiexec.exe Token: SeSystemProfilePrivilege 4136 msiexec.exe Token: SeSystemtimePrivilege 4136 msiexec.exe Token: SeProfSingleProcessPrivilege 4136 msiexec.exe Token: SeIncBasePriorityPrivilege 4136 msiexec.exe Token: SeCreatePagefilePrivilege 4136 msiexec.exe Token: SeCreatePermanentPrivilege 4136 msiexec.exe Token: SeBackupPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeShutdownPrivilege 4136 msiexec.exe Token: SeDebugPrivilege 4136 msiexec.exe Token: SeAuditPrivilege 4136 msiexec.exe Token: SeSystemEnvironmentPrivilege 4136 msiexec.exe Token: SeChangeNotifyPrivilege 4136 msiexec.exe Token: SeRemoteShutdownPrivilege 4136 msiexec.exe Token: SeUndockPrivilege 4136 msiexec.exe Token: SeSyncAgentPrivilege 4136 msiexec.exe Token: SeEnableDelegationPrivilege 4136 msiexec.exe Token: SeManageVolumePrivilege 4136 msiexec.exe Token: SeImpersonatePrivilege 4136 msiexec.exe Token: SeCreateGlobalPrivilege 4136 msiexec.exe Token: SeCreateTokenPrivilege 4136 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4136 msiexec.exe Token: SeLockMemoryPrivilege 4136 msiexec.exe Token: SeIncreaseQuotaPrivilege 4136 msiexec.exe Token: SeMachineAccountPrivilege 4136 msiexec.exe Token: SeTcbPrivilege 4136 msiexec.exe Token: SeSecurityPrivilege 4136 msiexec.exe Token: SeTakeOwnershipPrivilege 4136 msiexec.exe Token: SeLoadDriverPrivilege 4136 msiexec.exe Token: SeSystemProfilePrivilege 4136 msiexec.exe Token: SeSystemtimePrivilege 4136 msiexec.exe Token: SeProfSingleProcessPrivilege 4136 msiexec.exe Token: SeIncBasePriorityPrivilege 4136 msiexec.exe Token: SeCreatePagefilePrivilege 4136 msiexec.exe Token: SeCreatePermanentPrivilege 4136 msiexec.exe Token: SeBackupPrivilege 4136 msiexec.exe Token: SeRestorePrivilege 4136 msiexec.exe Token: SeShutdownPrivilege 4136 msiexec.exe Token: SeDebugPrivilege 4136 msiexec.exe Token: SeAuditPrivilege 4136 msiexec.exe Token: SeSystemEnvironmentPrivilege 4136 msiexec.exe Token: SeChangeNotifyPrivilege 4136 msiexec.exe Token: SeRemoteShutdownPrivilege 4136 msiexec.exe Token: SeUndockPrivilege 4136 msiexec.exe Token: SeSyncAgentPrivilege 4136 msiexec.exe Token: SeEnableDelegationPrivilege 4136 msiexec.exe Token: SeManageVolumePrivilege 4136 msiexec.exe Token: SeImpersonatePrivilege 4136 msiexec.exe Token: SeCreateGlobalPrivilege 4136 msiexec.exe Token: SeCreateTokenPrivilege 4136 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4136 msiexec.exe Token: SeLockMemoryPrivilege 4136 msiexec.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4136 msiexec.exe 5784 GWClient.exe 5784 GWClient.exe 4672 Explorer.EXE - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4136 msiexec.exe 2296 msiexec.exe 4332 MsiExec.exe 5608 MsiExec.exe 6108 MsiExec.exe 1740 MsiExec.exe 1824 MsiExec.exe 5504 MsiExec.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2296 wrote to memory of 4332 2296 msiexec.exe 90 PID 2296 wrote to memory of 892 2296 msiexec.exe 96 PID 2296 wrote to memory of 5608 2296 msiexec.exe 98 PID 5608 wrote to memory of 6088 5608 MsiExec.exe 99 PID 6088 wrote to memory of 5860 6088 rundll32.exe 100 PID 5860 wrote to memory of 4788 5860 cmd.exe 102 PID 6088 wrote to memory of 3288 6088 rundll32.exe 103 PID 3288 wrote to memory of 1740 3288 cmd.exe 120 PID 2296 wrote to memory of 6108 2296 msiexec.exe 106 PID 6108 wrote to memory of 4776 6108 MsiExec.exe 107 PID 4776 wrote to memory of 4032 4776 rundll32.exe 108 PID 4032 wrote to memory of 1168 4032 cmd.exe 110 PID 4776 wrote to memory of 2320 4776 rundll32.exe 111 PID 2320 wrote to memory of 1240 2320 cmd.exe 113 PID 6108 wrote to memory of 5444 6108 MsiExec.exe 114 PID 6108 wrote to memory of 5088 6108 MsiExec.exe 116 PID 6108 wrote to memory of 4544 6108 MsiExec.exe 118 PID 2296 wrote to memory of 1740 2296 msiexec.exe 120 PID 2296 wrote to memory of 1824 2296 msiexec.exe 213 PID 2296 wrote to memory of 5504 2296 msiexec.exe 122 PID 6108 wrote to memory of 200 6108 MsiExec.exe 125 PID 200 wrote to memory of 5952 200 rundll32.exe 126 PID 6108 wrote to memory of 3264 6108 MsiExec.exe 127 PID 2296 wrote to memory of 4808 2296 msiexec.exe 129 PID 6108 wrote to memory of 2200 6108 MsiExec.exe 130 PID 4808 wrote to memory of 2556 4808 MSIA867.tmp 131 PID 6108 wrote to memory of 256 6108 MsiExec.exe 133 PID 6108 wrote to memory of 2240 6108 MsiExec.exe 134 PID 6108 wrote to memory of 2788 6108 MsiExec.exe 135 PID 5608 wrote to memory of 420 5608 MsiExec.exe 140 PID 420 wrote to memory of 4596 420 rundll32.exe 141 PID 4596 wrote to memory of 240 4596 cmd.exe 144 PID 4924 wrote to memory of 3672 4924 GWClient.exe 146 PID 4924 wrote to memory of 4120 4924 GWClient.exe 147 PID 6108 wrote to memory of 5228 6108 MsiExec.exe 148 PID 6108 wrote to memory of 472 6108 MsiExec.exe 149 PID 472 wrote to memory of 1608 472 rundll32.exe 150 PID 4924 wrote to memory of 5436 4924 GWClient.exe 152 PID 1608 wrote to memory of 6116 1608 cmd.exe 233 PID 5436 wrote to memory of 4764 5436 regsvr32.exe 154 PID 472 wrote to memory of 4460 472 rundll32.exe 155 PID 4460 wrote to memory of 1152 4460 cmd.exe 157 PID 472 wrote to memory of 3440 472 rundll32.exe 159 PID 3440 wrote to memory of 5376 3440 cmd.exe 161 PID 472 wrote to memory of 2344 472 rundll32.exe 162 PID 2344 wrote to memory of 6132 2344 cmd.exe 164 PID 5784 wrote to memory of 5848 5784 GWClient.exe 166 PID 5784 wrote to memory of 5912 5784 GWClient.exe 167 PID 6108 wrote to memory of 4752 6108 MsiExec.exe 168 PID 5784 wrote to memory of 6060 5784 GWClient.exe 169 PID 6060 wrote to memory of 4852 6060 regsvr32.exe 170 PID 4752 wrote to memory of 3404 4752 rundll32.exe 171 PID 3404 wrote to memory of 5888 3404 cmd.exe 173 PID 4752 wrote to memory of 3048 4752 rundll32.exe 174 PID 3048 wrote to memory of 2916 3048 cmd.exe 176 PID 4752 wrote to memory of 1244 4752 rundll32.exe 177 PID 1244 wrote to memory of 2456 1244 cmd.exe 179 PID 5784 wrote to memory of 1280 5784 GWClient.exe 181 PID 5784 wrote to memory of 1292 5784 GWClient.exe 182 PID 1280 wrote to memory of 1744 1280 cmd.exe 185 PID 1280 wrote to memory of 5688 1280 cmd.exe 186 PID 1292 wrote to memory of 2036 1292 cmd.exe 234 PID 1292 wrote to memory of 2844 1292 cmd.exe 188 PID 1292 wrote to memory of 1392 1292 cmd.exe 189 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System GWClient.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" GWClient.exe - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\client.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4136
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EE12B88ADED36D3945971A2E63678202 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4332
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:892
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 06DC6F61C11EDB6E60427FCDA5B86CBB2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI776A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240809843 46 ClientCustact!ClientCustact.CustomActions.TerminateGuardware3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\sc.exesc stop gwpg5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4788
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\sc.exesc stop gwdogfile5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1740
-
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIAE69.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240823968 123 ClientCustact!ClientCustact.CustomActions.ProductDocumentation3⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\sc.exesc stop gwdogfile5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:240
-
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI135.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240845109 145 ClientCustact!ClientCustact.CustomActions.RunBackupManageExplorer3⤵PID:4176
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵PID:6124
-
C:\ProgramData\ManageExplorers.exe"C:\ProgramData\ManageExplorers.exe"5⤵PID:1532
-
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 07748476F933FCE4AB846E61C9C25E12 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI8112.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240812421 88 ClientCustact!ClientCustact.CustomActions.TerminateGuardware3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\sc.exesc stop gwpg5⤵
- Launches sc.exe
PID:1168
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\sc.exesc stop gwdogfile5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1240
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/C "C:\Users\Admin\AppData\Local\Temp\{63674956-F020-4567-9DB9-7D6F9C457193}.bat"3⤵
- System Location Discovery: System Language Discovery
PID:5444
-
-
C:\Windows\SysWOW64\cmd.exe/C "C:\Users\Admin\AppData\Local\Temp\{63674956-F020-4567-9DB9-7D6F9C457193}.bat"3⤵
- System Location Discovery: System Language Discovery
PID:5088
-
-
C:\Windows\SysWOW64\cmd.exe/C "C:\Users\Admin\AppData\Local\Temp\{63674956-F020-4567-9DB9-7D6F9C457193}.bat"3⤵PID:4544
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI9D39.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240819515 95 ClientCustact!ClientCustact.CustomActions.BackupLSP3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Windows\SysWOW64\regedit.exe"regedit.exe" /e "C:\ProgramData\LSPBackup.reg" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries4⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:5952
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh winsock reset3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3264
-
-
C:\Program Files (x86)\Guardware\Integrity Management\GWProxy.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWProxy.exe" /Auto /NoStop /Service3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2200
-
-
C:\Program Files (x86)\Guardware\Integrity Management\GWFPInstaller.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWFPInstaller.exe" install3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:256
-
-
C:\Program Files (x86)\Guardware\Integrity Management\GWClient.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWClient.exe" -s -i3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2240
-
-
C:\Program Files (x86)\Guardware\Integrity Management\GWClient.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWClient.exe" -s -r3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System policy modification
PID:2788
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIB149.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240824750 127 ClientCustact!ClientCustact.CustomActions.BackupManageExplorer3⤵
- System Location Discovery: System Language Discovery
PID:5228
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIB2D0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240825046 131 ClientCustact!ClientCustact.CustomActions.InstallGWClientService3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\sc.exesc stop gwpg5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:6116
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im gwclient.exe /t5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:1152
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Program Files (x86)\Guardware\Integrity Management\GWClient.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWClient.exe" -s -i5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5376
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Program Files (x86)\Guardware\Integrity Management\GWClient.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWClient.exe" -s -r5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6132
-
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSICB1C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240831250 135 ClientCustact!ClientCustact.CustomActions.InstallGWProxyService3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\sc.exesc stop gwpg5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5888
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im gwproxy.exe /t5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:2916
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Program Files (x86)\Guardware\Integrity Management\GWProxy.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWProxy.exe" /Auto /NoStop /Service5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2456
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:5008 -
C:\Windows\SysWOW64\sc.exesc start GuardWareProxy5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5224
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/C "C:\Users\Admin\AppData\Local\Temp\{9CC202AF-AE02-4DBE-8713-732364ECE61C}.bat"3⤵
- System Location Discovery: System Language Discovery
PID:6116 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:2036
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir /b /a "0"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3468
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /E /Y /K /H /I "0\*" ""4⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:4604
-
-
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Guardware\Integrity Management\msvbvm60.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1740
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Guardware\Integrity Management\osmax.ocx"2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1824
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Guardware\Integrity Management\scrrun.dll"2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5504
-
-
C:\Windows\Installer\MSIA867.tmp"C:\Windows\Installer\MSIA867.tmp" "C:\Program Files (x86)\Guardware\Integrity Management\GWProxyEncrypt.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Program Files (x86)\Guardware\Integrity Management\GWProxyEncrypt.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWProxyEncrypt.exe"3⤵
- Executes dropped EXE
PID:2556
-
-
-
C:\Program Files (x86)\Guardware\Integrity Management\MSMInstallerNet40.exe"C:\Program Files (x86)\Guardware\Integrity Management\MSMInstallerNet40.exe"2⤵PID:7076
-
C:\Program Files (x86)\Guardware\Integrity Management\RMS\MSMInstaller.exe"C:\Program Files (x86)\Guardware\Integrity Management\RMS\MSMInstaller.exe" /qn3⤵PID:5336
-
C:\Windows\system32\msiexec.exe/i "C:\Users\Admin\AppData\Roaming\Guardware Ltd\e-Safe Compliance MSM 1.0.0.0\install\MSMInstaller.msi" /qn AI_SETUPEXEPATH="C:\Program Files (x86)\Guardware\Integrity Management\RMS\MSMInstaller.exe" SETUPEXEDIR="C:\Program Files (x86)\Guardware\Integrity Management\RMS\" EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs /qn "4⤵PID:5600
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FE8CEC993B82797331A0D3D26A6F1E612⤵PID:4080
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:8
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}1⤵
- System Location Discovery: System Language Discovery
PID:1348
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4232
-
C:\Program Files (x86)\Guardware\Integrity Management\GWProxy.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWProxy.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:6048
-
C:\Program Files (x86)\Guardware\Integrity Management\GWClient.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWClient.exe"1⤵
- Executes dropped EXE
PID:2456
-
C:\Program Files (x86)\Guardware\Integrity Management\GWClient.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWClient.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s /i "C:\Program Files (x86)\Guardware\Integrity Management\osmax.ocx"2⤵
- System Location Discovery: System Language Discovery
PID:3672
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s /i "C:\Program Files (x86)\Guardware\Integrity Management\secman.dll"2⤵
- Drops file in Program Files directory
- Modifies registry class
PID:4120
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s /i "C:\Program Files (x86)\Guardware\Integrity Management\secman64.dll"2⤵
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\system32\regsvr32.exe/s /i "C:\Program Files (x86)\Guardware\Integrity Management\secman64.dll"3⤵
- Modifies registry class
PID:4764
-
-
-
C:\Program Files (x86)\Guardware\Integrity Management\GWClient.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWClient.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s /i "C:\Program Files (x86)\Guardware\Integrity Management\osmax.ocx"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5848
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s /i "C:\Program Files (x86)\Guardware\Integrity Management\secman.dll"2⤵
- Drops file in Program Files directory
- Modifies registry class
PID:5912
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s /i "C:\Program Files (x86)\Guardware\Integrity Management\secman64.dll"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Windows\system32\regsvr32.exe/s /i "C:\Program Files (x86)\Guardware\Integrity Management\secman64.dll"3⤵
- Modifies registry class
PID:4852
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c systeminfo /s %computername% | findstr /c:"Model:" /c2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo /s JGATYMDT3⤵
- Gathers system information
- Modifies data under HKEY_USERS
PID:1744
-
-
C:\Windows\SysWOW64\findstr.exefindstr /c:"Model:" /c3⤵PID:5688
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netstat -ano | findstr 2456 | find /i "close_w" /c2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Connections Discovery
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -ano3⤵
- System Network Connections Discovery
- Gathers network information
PID:2036
-
-
C:\Windows\SysWOW64\findstr.exefindstr 24563⤵PID:2844
-
-
C:\Windows\SysWOW64\find.exefind /i "close_w" /c3⤵PID:1392
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netstat -ano | findstr 6056 | find /i "close_w" /c2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Connections Discovery
PID:2604 -
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -ano3⤵
- System Location Discovery: System Language Discovery
- System Network Connections Discovery
- Gathers network information
PID:4992
-
-
C:\Windows\SysWOW64\findstr.exefindstr 60563⤵
- System Location Discovery: System Language Discovery
PID:5884
-
-
C:\Windows\SysWOW64\find.exefind /i "close_w" /c3⤵PID:4980
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program = GWClient.exe name = "e-Safe Systems Client" mode = ENABLE scope = ALL profile = ALL2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5188
-
-
C:\Program Files (x86)\Guardware\Integrity Management\install_driver.exe"C:\Program Files (x86)\Guardware\Integrity Management\install_driver.exe" -fp "C:\Program Files (x86)\Guardware\Integrity Management\GWDogFile.sys" -alt 370036 -s2⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:2684
-
-
C:\Program Files (x86)\Guardware\Integrity Management\install_driver.exe"C:\Program Files (x86)\Guardware\Integrity Management\install_driver.exe" -fp "C:\Program Files (x86)\Guardware\Integrity Management\GWScanner.sys" -alt 370037 -s2⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1816
-
-
C:\Program Files (x86)\Guardware\Integrity Management\install_driver.exe"C:\Program Files (x86)\Guardware\Integrity Management\install_driver.exe" -fp "C:\Program Files (x86)\Guardware\Integrity Management\GWPG.sys" -alt 370039 -s2⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1708
-
-
C:\Windows\SysWOW64\sc.exesc start gwdogfile2⤵
- Launches sc.exe
PID:4392
-
-
C:\Windows\SysWOW64\sc.exesc stop gwchatdocmon2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2564
-
-
C:\Windows\SysWOW64\sc.exesc start gwscanner2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1628
-
-
C:\Windows\SysWOW64\sc.exesc stop gwusbmon2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1824
-
-
C:\Windows\SysWOW64\sc.exesc start gwpg2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:6008
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic bios get serialnumber2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4724 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic bios get serialnumber3⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3164
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic bios get serialnumber2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2412 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic bios get serialnumber3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4968
-
-
-
C:\Program Files (x86)\Guardware\Integrity Management\GWHardware.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWHardware.exe" 94cf774dcc3d914688b97e2406b09d322⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:5500
-
-
C:\Program Files (x86)\Guardware\Integrity Management\GWFPInstaller.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWFPInstaller.exe" install2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:348
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netstat -ano | findstr 6056 | find /i "close_w" /c2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Connections Discovery
PID:4268 -
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -ano3⤵
- System Location Discovery: System Language Discovery
- System Network Connections Discovery
- Gathers network information
PID:5240
-
-
C:\Windows\SysWOW64\findstr.exefindstr 60563⤵
- System Location Discovery: System Language Discovery
PID:4732
-
-
C:\Windows\SysWOW64\find.exefind /i "close_w" /c3⤵
- System Location Discovery: System Language Discovery
PID:4548
-
-
-
C:\Program Files (x86)\Guardware\Integrity Management\GWFPInstaller.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWFPInstaller.exe" install2⤵PID:6680
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netstat -ano | findstr 6056 | find /i "close_w" /c2⤵
- Executes a command shell one-liner
- System Network Connections Discovery
PID:6532 -
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -ano3⤵
- System Network Connections Discovery
- Gathers network information
PID:6636
-
-
C:\Windows\SysWOW64\findstr.exefindstr 60563⤵PID:6624
-
-
C:\Windows\SysWOW64\find.exefind /i "close_w" /c3⤵PID:6664
-
-
-
C:\Program Files (x86)\Guardware\Integrity Management\GWFPInstaller.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWFPInstaller.exe" install2⤵PID:6748
-
-
C:\Windows\SysWOW64\netsh.exenetsh winsock reset catalog2⤵PID:7112
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netstat -ano | findstr 6056 | find /i "close_w" /c2⤵
- Executes a command shell one-liner
- System Network Connections Discovery
PID:6064 -
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -ano3⤵
- System Network Connections Discovery
- Gathers network information
PID:6196
-
-
C:\Windows\SysWOW64\findstr.exefindstr 60563⤵PID:3532
-
-
C:\Windows\SysWOW64\find.exefind /i "close_w" /c3⤵PID:6216
-
-
-
C:\Program Files (x86)\Guardware\Integrity Management\GWW.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWW.exe"2⤵PID:6760
-
C:\Program Files (x86)\Guardware\Integrity Management\ScreenDPI.exe"C:\Program Files (x86)\Guardware\Integrity Management\ScreenDPI.exe"3⤵PID:5988
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /C ipconfig > "C:\ProgramData\ipconfig.txt"3⤵
- Executes a command shell one-liner
PID:6288 -
C:\Windows\SysWOW64\ipconfig.exeipconfig4⤵
- Gathers network information
PID:1940
-
-
-
C:\Program Files (x86)\Guardware\Integrity Management\ScreenDPI.exe"C:\Program Files (x86)\Guardware\Integrity Management\ScreenDPI.exe"3⤵PID:6824
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netstat -ano | findstr 6056 | find /i "close_w" /c2⤵
- Executes a command shell one-liner
- System Network Connections Discovery
PID:4728 -
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -ano3⤵
- System Network Connections Discovery
- Gathers network information
PID:7164
-
-
C:\Windows\SysWOW64\findstr.exefindstr 60563⤵PID:4944
-
-
C:\Windows\SysWOW64\find.exefind /i "close_w" /c3⤵PID:4996
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netstat -ano | findstr 6056 | find /i "close_w" /c2⤵
- Executes a command shell one-liner
- System Network Connections Discovery
PID:7124 -
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -ano3⤵
- System Network Connections Discovery
- Gathers network information
PID:3756
-
-
C:\Windows\SysWOW64\findstr.exefindstr 60563⤵PID:7064
-
-
C:\Windows\SysWOW64\find.exefind /i "close_w" /c3⤵PID:7060
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netstat -ano | findstr 6056 | find /i "close_w" /c2⤵
- Executes a command shell one-liner
- System Network Connections Discovery
PID:6576 -
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -ano3⤵
- System Network Connections Discovery
- Gathers network information
PID:6864
-
-
C:\Windows\SysWOW64\findstr.exefindstr 60563⤵PID:564
-
-
C:\Windows\SysWOW64\find.exefind /i "close_w" /c3⤵PID:6284
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netstat -ano | findstr 6056 | find /i "close_w" /c2⤵
- Executes a command shell one-liner
- System Network Connections Discovery
PID:4548 -
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -ano3⤵
- System Network Connections Discovery
- Gathers network information
PID:2292
-
-
C:\Windows\SysWOW64\findstr.exefindstr 60563⤵PID:5908
-
-
C:\Windows\SysWOW64\find.exefind /i "close_w" /c3⤵PID:5976
-
-
-
C:\Program Files (x86)\Guardware\Integrity Management\GWProxy.exe"C:\Program Files (x86)\Guardware\Integrity Management\GWProxy.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:6056
-
C:\Windows\system32\drivers\GWPG.sysC:\Windows\system32\drivers\GWPG.sys1⤵
- Executes dropped EXE
PID:4952
-
C:\Windows\system32\drivers\GWScanner.sysC:\Windows\system32\drivers\GWScanner.sys1⤵
- Executes dropped EXE
PID:4788
-
C:\Windows\system32\drivers\GWDogFile.sysC:\Windows\system32\drivers\GWDogFile.sys1⤵
- Executes dropped EXE
PID:3260
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵PID:3888
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:4672
-
-
C:\Windows\system32\Drivers\gwwfp64.sysC:\Windows\system32\Drivers\gwwfp64.sys1⤵
- Executes dropped EXE
PID:3300
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:3168
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5392
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
3Component Object Model Hijacking
1Installer Packages
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
3Component Object Model Hijacking
1Installer Packages
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2System Binary Proxy Execution
1Msiexec
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a6803.rbs
- Size 1.5MB
- SHA256 90039b62130a7861db8fe0e55ef73864dad95e25715343a7a1eeb42535de8ec7
- MD5 7855e2164f07cdd5bd141acb97047790
- SHA1 7d23523db60e60a950fbb1142693852fe2f5c614
- SHA512 a4df1229b8e755b699a59ed62e1557d7569f3f5f9010ceb8c81b340f500a36520a3fa1e9dab1d559c9d4e7e6fc6b2c7bd435c380486f11123de9af411c556f9e
- SSDEEP 49152:Q0+iwqJgjNc10+iwqJgjN0+iwqJgjjQqyqkK:z7wyA7wyP7wy+d
- TLSH T1F975AE11BAC1C436E17F06343965D6540EBDF9708AB4C96B63D84AAF1F76681AB30F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5a6805.rbs
- Size 557B
- SHA256 ab8041304c6213ac5087cba1a4a945b8ce7ea6481bb2e4234702a7980030cef8
- MD5 ccce7836e3b072cece7c9f14750d74d3
- SHA1 9556f16063cf3f0ccc8692638d3360d30e7d10de
- SHA512 caabb9626b6ede474feb53c4eb9930dc3af4cc3f4416b7741b565d684cf6423f779059a798fa813a60236be8467a3002d62795d2ec2751f9dc019c26e7141eaa
- TLSH T1C9F0C98653CA64F0C44643769F038A892C6B803083300661B829207C2FE295ABFFE260
- MD5 SHA1 SHA512 TLSH
- Path C:\Config.Msi\e5a6809.rbs
- Size 18KB
- SHA256 d081779df51cd4a6a7ba1e816e630e809c324a91be7dcff3e687841d28736838
- MD5 928fc61c43d23c47c0a15e2307ec62fb
- SHA1 85bd70dc3d90ae3be062277ac994562449baf67a
- SHA512 a6a3be1a5db78a1fc3d844cf6a854396ab02874361c9835bcadda7afc7afc14e03eb74b1afbc038be166a8d7fe12bbc9860a569ff774ea89687a48c9d94abee6
- SSDEEP 384:EmR4zFKZSTjYg1d8BtHptGIjO4iI7PHf9:EmR4zFKZSTjYg1d8BtHptGIqDI7f1
- TLSH T1748298102A418592C46A1676EC5B2F15333AE7E9D7E1871F92CCC5F04EC3FC2AEAE549
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Guardware\Integrity Management\msvbvm60.dll
- Size 1.3MB
- SHA256 d08cbc511027fef9378811ad082d6a3bb6a63b4b66378573298ec780fb1e5836
- MD5 45cb22c24a40a425673bdb24b972a9cd
- SHA1 37cb555737c85a1f1e58c3f8113b67c9a35322ae
- SHA512 c3c7674982ca16f9e5f76c034ca65464588b8a1df6463bb014ff059318a0d4df196315bbb9ed597304948f909dd790a3da7d2eb1195f5f6d892ef04b024fa2f8
- SSDEEP 24576:jjGqJlHZ83utvJoPoC0kAVl/3OtcGv81BpuSIdnm0mF+Dg:jnePoC0kAVdOtcGv81uSItm7v
- TLSH T1BD55AF5373D56073CB6390384A2F2375BBB4BD2199359D8B27A0366E1933703963B72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Guardware\Integrity Management\osmax.ocx
- Size 422KB
- SHA256 a2b7f8431e584a2325569ee32677fb5a849b564e4f3c33c6da136ef623ee1c40
- MD5 849e2e8a41aa594c51dc6aff295c2a80
- SHA1 8190a0aa441388e510fef57f6ebf551f0525fe4e
- SHA512 9f709eaeac4329bf81079d3b83b3712ee6cff6c204d6e7868025cf0f95ff658ea0e856b18e68ff51b768a15276646f7d92f71c2d4a06ffc84efdaea334306e1b
- SSDEEP 3072:UYVcTzL3Yd63b3GFlXaO+v3crobPkyKYFhxEDozLy0WBeVEBKQuB/bgE+43V2OE/:UY7d6CiVBLkyXFIUzLy0erG/fAOE/
- TLSH T18E944F37E231302EE3B530B481AEC11955EAFD40D7D569DBA276BCBD88A818524E7F43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Guardware\Integrity Management\scrrun.dll
- Size 175KB
- SHA256 c6594166f5ea373a60d257cdaba7a3da38c24c09030474ca1123285f77fa0e3f
- MD5 e5e2c2c60372f8d30119bb3328dc74ab
- SHA1 bc80744c16137b262ea269f3e92d60eca10e2c1e
- SHA512 736347a08e4d9d8cc62e11b4eae202181e1d4c2893f75812f9cf3ceeb367fde9316f72f6a8b382fd496562c10bc745ffefb727c33929ec9e21a99b67b638e84c
- SSDEEP 3072:uZs46JU0ikBEaTUc1WYDZowW7Srz3PYmlAyAAq+SI9CFnZO5xP6uGVtV8Pm0i2g:A0yNU6YfYKAAqZ3kSFVtt2g
- TLSH T1B60428D5B782A0B1C0A12030997E72B2D5B9FD351C6EAB0B92A4F72D1D746D0DB24F4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Guardware\Integrity Management\sstile.jpg
- Size 7KB
- SHA256 7a91cfd3b6792d73b7146345c6417a27a27f42d529c2cd72fcd66a39c5f85d43
- MD5 964de92f2e02cfb42a5d5b45e0ae52e7
- SHA1 c9ee44ba0e070d49cc40af6e397f6731a8845ada
- SHA512 17f7d7f88a5cf3669097d671d1aa37cdbd2f77c886a576b8802aafd8f958b2e06577d63e65653e01031a308117459af69f92aae81a3de4aab50b7b291ffd4fe6
- SSDEEP 96:5KtvN26MT0D5MdtbZPAVwzVEEUOjlxUZ3WSMAwchunpyg0OJakrDesLwABJiP+R:lYNMtKwijOjAZGSNhv7sFD/9
- TLSH T1ADE17F3DAF27DA6ADD32DA386AA52BD5E170B671F7446B511A398731C3850C06E8E048
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Guardware\Integrity Management\updater.exe
- Size 385KB
- SHA256 2bbaa68c3582f8f8b3b44033fd93baf9a2e86b6103f68db1393c08248e91aa8a
- MD5 ee887e3854136ac542832ce83a354872
- SHA1 9ef5d636ddffcea96b57aaa9ae7f06d787919ba1
- SHA512 4a212deaa82dbbbb1d1f6c2e0b6de6063a1998b734445766a7f94e5c2c88a60073dc647ba2c226dcde9cbf9d04ea7589d751b345e3c13f51edbf16ddfd16fc2a
- SSDEEP 6144:WNCWSROooKj+8NuSCK/L4y72uKE17TOi1GIRHrnqE8t6eNmoZylJmp3toe8H:WNpSMoFqTDK/LBquWisEoNnZ+08H
- TLSH T1FA848D03F5C34071E87A193BE635FE398EBDBF211924872F2764358D6970980A5BA772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Guardware\Integrity Management\updater.ini
- Size 383B
- SHA256 39a2e5e034ff0c01e75c8dff636cbdf646c372bab4c8305da9892b72ee9e961d
- MD5 59fb011df9a7f92c985d82509ce65b4b
- SHA1 0d0d4ede319addbcbabbeb3550f2c67e879644ce
- SHA512 e6c7ba20e8e9428942599e83fce652d8fa8f8ccdbf2d317d3042dcc5ce1f96b0e3bd9c6983d3dae951c7e1a86e611140ddd081fdeee6d6247c16ecfc8b1ee705
- TLSH T1C6E0CAC717CDC93F53C5D437427550244C51179D7FD21D3065646C4C56D1D48FB5B106
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Guardware\Integrity Management\usr.bin
- Size 199B
- SHA256 17c9685fe982a8f4d3acec5d0b54d016c1afe5275276047456b38bde02a748f6
- MD5 c5ad64a15306c356fb776c4bb6011adc
- SHA1 7cd7d4c2524d6dac7b95f49e50903354a3fe6631
- SHA512 b55520586022e59ebb3cedd519657e37710b24f293d4f16993c660aec18dfe2f307751183bea8e5f87e8295601fa1091f8dc07f7630c2271d847b8451946e6c2
- TLSH T1DED01208F21A21A0C331997110460B6D0B56B845D7B9E787D300775458F98E7AE15749
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Guardware\Integrity Management\usr.bin
- Size 220B
- SHA256 a156c13fcad41becd27921dbd0819f925d1c0df5ed647239f3027198eb070bf6
- MD5 f0af58982892f7e4c8e528b14e14e06a
- SHA1 e4ba7865caa5118e89725ab88444a70b572a115b
- SHA512 78b257fdc680a7756dd6c1b919b4faba77b99242204d0fa573aa375495dc8e216b4640b91f942d35cab5555664090082dc4bd573e22dbbc9baf46560c780b479
- TLSH T1D9D02249E5672A02D71060BA102FBF5C5E903802B808333A8301270CE9F05E32E0068F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\Engine_Client_profile_log.log
- Size 4KB
- SHA256 f2dd5f4b423994178e1ac3e8632979be88876e4fda0e46a3caf58a3323d79132
- MD5 98234cb5ba5d7f58b29b41b944de4c38
- SHA1 d50c56d34dcc7d1188edef0484cd5db3083e3ef0
- SHA512 728f8939f7d8ed3dc0b584edbc5520a8aa02c954aa42ce97f70b5ef0634757f9d4962b86da9f7363a1ac15b3a635638f83c69b15fd449293db2e37133943c3d2
- SSDEEP 48:TWd5dbNdLdGdIdUdAdmd3dvd+pdhdudjiIHouA3x3wMbYO1H7vVy6+cEt7Kivsof:CXnpcq2aUVtAH8MBu55lgAWoEYWiKc
- TLSH T13691F51F70CE60024693DDFE5D2EBE9D2B76E209B6897E02E2E6455C1190A4B7FC70C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\Engine_Client_profile_log.log
- Size 1KB
- SHA256 10eff81ba18c55b037a0477f06f954362300506617a02bbea4ae457d38a7e607
- MD5 e27c4be2c23bd723e5426f497bde5b0b
- SHA1 62c69ba48eede8dcac548d9047b83382f909b8f1
- SHA512 41b5b3ff0e71145ae137145183b571fad24b4213d240122863a3e6782b15bb36b344cc49741e1078111820a0f7e5955e57bfba83873fc564a4f6ac4fa58f5de7
- TLSH T12721515B70C5944A42A3E9FF5D7EBE8E1F77A218B04E6B46D2F4165C22A051F7EC20C1
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\Engine_Client_profile_log.log
- Size 2KB
- SHA256 b0e6933e16688e6401c1d55b35d3f82fe4a51fa275a672869c66e411a78522bf
- MD5 85f0b59cc1011738e2228ace249b7d15
- SHA1 5fec409518e37e1df77ffeba76f0946e1f40e67b
- SHA512 c61770efa7b3de37cefd43317c350a61489172caffa108d0b269fd78d1310eaaeb6ae38a987817b32b0abc0535195113aed10bceb2378e2a6cbed7a8838319e4
- TLSH T11B517F5B70C9A0464793EDFE5D6EBE8E2F77E209B18D7F42D2E50658229091B7EC20C1
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\Engine_Log.log
- Size 2KB
- SHA256 f320f973a68c424de040acdc70f5f298084abde7b9f9dbff2320e70b2c850207
- MD5 b5c3c85141732c8659888dbe2f97499f
- SHA1 3b760dfc1b01b7b937d52960159491bfea30dc62
- SHA512 12901560af88dcf5120bb9a947088861c42c7bf536729874e10ac804362c7e752826030868f5b6fcda8d4181f3bff505d42dc8b342be8818f1e7f4833bc87715
- TLSH T137515E1B31CE70242915DECD5D1C7ECCA7B2E24EFB857C10A6EB168C0641E8B3F9A985
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\Engine_Log.log
- Size 3KB
- SHA256 69c57df71acb23b8722784f9ee818810ffcdcd0ce81e29c9258c46a2f9021bb5
- MD5 b5f7ab8ea9b35e806001215f99f222bd
- SHA1 b65191ae384f2e5b478c0d53cc6e41db82a11565
- SHA512 a78badc6c91acc5e5a70e49c3769d7262a935cbccdfc161f53e3057eab9fdcec7f2f2f6ea30dedbd970563de5fbed7818eb9b02ae32c4f511eb73c3c288aab69
- TLSH T1C361620B32CA70286915DECD5D1C3FCDA3B2E20EFB817C14B6EB164C4641A4B7F9A984
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\Engine_Log.log
- Size 3KB
- SHA256 b1d35b3c2fdb2fd8010778d2425b7d5309c16b4dfd99221f54af7cdb50ba5c22
- MD5 90a44a49fa626112d2c9836e56a06eec
- SHA1 345985f2443e9272ddbacbed382b1164d380705e
- SHA512 bfe2b8979654eb90cc0ad6023f8054ba08041eeedd366fd0b348c104cce3d839bb984eb523071db3df1662628c9e891ec3e980be0a95d649fe9989df27772f37
- TLSH T12871720B31CA70685915DECD1D1D3FCDA3B2E20EFA817C14B6EB164C4640A4B7FDA985
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\Engine_Log.log
- Size 3KB
- SHA256 ed0a59c4ec564feb7571b3c432257b2bb9defc01b51935ef8dafcc89090f05b1
- MD5 7f72656d22dd453e5a43eda7f8ecccf6
- SHA1 d5689dd9745a069e7b6913765069342e49438693
- SHA512 f7f67d3fed76ebe8cfde4355da8d93561adb719df74d32cfca21890ccc11ab03e5c5b8d0fd44d69535835ef2452448e1ce8e145e48dd8aa6dee95cbf6d897b53
- TLSH T1CE81820B36CA70686916DECD1D1D3FCDA3B2E20EFA817C14B6E7164C0640A4B7FDA985
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\Engine_Log.log
- Size 3KB
- SHA256 04a7e7708e0e1adf8f01704547d08b937a0304c86a5d3d8bac24630db5e4693b
- MD5 e08a82d06edcfe91a6d0e1462f4c5009
- SHA1 d2db704424a22c3632322e42ca47a7188d9ecd6c
- SHA512 c19128040350c426ec0f69886527724957c5b8e6a46a1dc30f541eceedfcf42814686ba9487815e5173a7bedde802c414a25e1f170be701c4c84d6364c9db13c
- TLSH T1D081920B36CA74286916DECD1D1D3FCDA3B2E60EFA817C04B6E7164C0640A4B7FDA985
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\Engine_Log.log
- Size 4KB
- SHA256 82ce48e2feb6da7e1f50a1f9fb60c0801d0ceeac6f8a94f5c879f8dff7a9158e
- MD5 1a5844fd1729d5984e773f1a4f086329
- SHA1 fa4cc9efa6568e0cabde8690e47c2baa24b1e3bc
- SHA512 2cc7a2d0aeabd129b552a07f10cd29dc34a1da339748722a81687848b930460673a4ed8a49971d65827cf9f5ace60d2bd6bee610b23020bf85ef9c2cfe5dc6c0
- SSDEEP 48:T+AnH2H2BACuX2A2jjNOG42dAiBWGtBypD9GkuNSiEGcjkiS4Zv4ZkNhTp315s3y:XnHcZNHU99zEGcxS+NhTp31KuUI
- TLSH T13891820B36CA74286916DECD1D1D3FCDA3B2E60EFA817C04B6E7164C4640A4B7FDA985
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\Engine_Log.log
- Size 547B
- SHA256 5a94f031b96c151fda808b704f9e8c3b8ce8a0bba07676428539d9d6e54e6d1c
- MD5 80478917e390e35fc280f39238d13b58
- SHA1 381718c8cc83e5f3c8faf3788ca112f4800ee082
- SHA512 39f3d19573e2a8b8d4051cb754c659c744588f763d46e937800b2bf17194036a9d6edd7ff2e0f829b6aa104aecb5780adadc622bd2ffd91992ec6854500078c2
- TLSH T169F0BD9B30C7A46D4128EB8F0A7E7FCC8372E25DB5066508B6B9298D4B41A4B3F95990
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\Engine_Log.log
- Size 1KB
- SHA256 a71ee83ec566d5020763d4d076663500bfef5282869bdc4d74746831282d86b0
- MD5 ed4b3145d52ae9687d24f9f888e689f9
- SHA1 46effb0a7bbe041df4f503ad59e5004de0a1a3ad
- SHA512 deec66561ab777c143859afc3e5899ebd58216987bb64ae8b02199c2922360e3884be1bf545a36a1f990e6cc2f9d93e6e17391eaa018572705ce4980fe232b17
- TLSH T166110E9B30CE70694619DF8E0A2E3FCC9372E20EF7417804B6FB258D4A40A4B3F95984
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\Engine_Log.log
- Size 1KB
- SHA256 6470e1fa62257522e5446ff730acfe3cc3e907076eb5a94bff299b9300fc47c7
- MD5 15d1cf9047133d4fcacd190de2d2a045
- SHA1 ca8b4663b60a598933d3487cee07f601adca3fee
- SHA512 62655c3b4b48fb74017519cc0bc66c70c978f5b28a11fc9b4e19bf5cefa241e56af753fb44ec85dc3379230d953ea25d5bad81ac36de839c3d3657d45c7b4a63
- TLSH T19B31125B30CA70646615DE8E0D1D7FCCA3B2E20FFB457804A6EB168C4641A4B3FDA984
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\Engine_Watcher_profile_log.log
- Size 1KB
- SHA256 cba18b7cd39b23deb4a7697f6abdcc9f94ea52533e1412f487e7dc79f9aa57b3
- MD5 167a92965918d32360ee7631ef22cd47
- SHA1 3c07f8d091f11058fa61fd32a8469309beba887f
- SHA512 022d7f2210bd3c87caef937245a357727a7775997251a499e49f9f95b0dd1c47099ac6fb24f6082c404a709862b5f00e1bef3ab35391c5e45e1f13b6bc600c32
- TLSH T1E131541F7AEC216D8A12DF9C1A123EFC2372E71EA1543941FF86281C074920A9FD19DA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\Engine_Watcher_profile_log.log
- Size 2KB
- SHA256 18fa377b9f78ab46e1db02013038df931c711e87f7d601166b61c4a4c53598f9
- MD5 db6f6695b6d34da61cf2f90923edd5ce
- SHA1 1d818df04fd1171091ed075cc52578b8e54e05cd
- SHA512 87228756a26abd38c52c209c686d93a46434246bba76f5e77f503fe9089d0afc7042e906dbbb36be64d914a68559390d53a7ecd055238cebc0a03269b319d152
- TLSH T1ED41B91F7EEC216D8A52DFA86A123EFC2772EB1EA1513951FF86181C070910A9FC19DD
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\activity_log.log
- Size 1KB
- SHA256 581fc01704496f968e1554ee9c3114dc5330da6e7098d0ae2ffbb62dc599b988
- MD5 4287392ce3da33dcd236def60eb8cd4b
- SHA1 d12cd36d78cef1178e115cddbdcc33e589990768
- SHA512 49fcf16c241275bb1644660328f5673f3532ebe237c9e1d454dcaf258f3be3d77e8728124134aad450944034e42089427c05707fe6f0d9c37c2cd7e1a3715ddf
- TLSH T1F431724F30D1A8745100EB9F0A6ABFD8236BF334B5B46846A7B9405967A1E0B3FB70C1
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\activity_log.log
- Size 3KB
- SHA256 64d898fdfcb06fc0d92424f3ff63ee4a0e21ee18fe633d2f4b9984e2c685d92d
- MD5 c8be5114a045ea0467043690bde77394
- SHA1 2eb821088aeb9045bddf0aae770f1356d8de6853
- SHA512 d25cba0199329bfc67e88ca999b0d72e78aa29a37bd343bf8e5664b453c2dacc8f6357dfb6d24cad4a30b3e3ebd676dfe6906e1485659a10d82b67753aa526cf
- TLSH T11781094F34D1A8681200DE9F0A6A7FD8232AF639F6B52841B7BA54195791F0B3FB70C5
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\activity_log.log
- Size 4KB
- SHA256 b11f21dc8b50336cc86b977a42fd071aca014d2a884c33ec293c1d02f4ee31f0
- MD5 9c42fd535a76b615d26c198196238ba6
- SHA1 0fbb3c39314c50b9b5ee34d83cafaed3f7a02a1e
- SHA512 5ee4c4a12198aef2797a00e55bd615c4109fb64b94d399e4fa3433ef1ffc696bb2b50edd6cce9c59fca779d2d3f6cba89f3d5ee477b8605903473442ef4e27c8
- SSDEEP 96:oIhVMHXhmem0mgmZ3t60FFxuVw8w6wmqwmcwm4wmo32V3:Pflhlt6iu3kuaK2V3
- TLSH T127A1284B35C5A4682200CEAF1A5A7FD9132AF63AF6B4384177BA54190791F4B3FB60C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\closewait_log.log
- Size 994B
- SHA256 f3596f286babe2cf59f2360712b8da548db10c3dd470b56a8c1133b455cb09f7
- MD5 8e59a844d4b545a913208f1d0c87693f
- SHA1 08034b47270c3c909b7f01c1a777e559ec582a51
- SHA512 9b5ce1f8e1400d3e072f1d75c726e3188e9f6d6f5d9d3d74f4b934a401ecd41b5dec15c6ce0f680181e505269d6d5ed1078ef20180c37a7948bd8b65e3ec2fff
- TLSH T1AC113E0B76C4385875159F9E58B82FCEB7F2A308EFCD7D62B6E1011C5105E4A7E8AA43
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\command_log.log
- Size 511B
- SHA256 3f0edad1a7af1f9b21dd31ed3db48796c4abab26a00fd5af074db1e24c617239
- MD5 3d245dcadb0d9f2eb76a2aa8949bf9f6
- SHA1 ace3adcff020271465c3975c0f7f1f73c0d5c5d0
- SHA512 a06c82421949c7dfb90bffad31a48ae8492c9ed7ff1ff44ab2dee5dcc49cf89b03ce253afbd3a6e4ee601542c53a5c5c47f799df81a325a95a586b5280a3f8e8
- TLSH T1C9F02B0F32DC29481585CDBF2D052D597776E5CAF5A81F0876E255080140B1B3B4DCE6
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\profile_log.log
- Size 492B
- SHA256 61a24040fa88753d7ef96643890577ab856700c4a648a467c921be846841d3cd
- MD5 70bad10c0e7bcbea83c292aced7441dc
- SHA1 86ae2274f8006f13d42cfc8cfa5f1019708c837e
- SHA512 fbebe036409526692002ed8b24ecd671ef3d28a274e3677eb0bd2fac8593bffb77042b9f1093531efcac39b6f56baf177435831d7c7173cb840920e2da03ff7f
- TLSH T170F0541721C9701D2741CE9C8C2E2F4EE332934AB6A8B92096E210880A4058FBF764C0
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\profile_log.log
- Size 889B
- SHA256 738ba232bcaabd6cfbd13a4498f7da30ca471a808d3f0a3560aaf9c3a7edf9e3
- MD5 e74abbdfe6e87ccd6ebd061814333bca
- SHA1 635364a669f38c9b94b7e3d4c30204146fb48197
- SHA512 022875fac25d9254ba1646bfe22f208bfad1cd3bef1a7463430b049c7c8af84aef189b1c039f561888745602b1fba2b19a1dcbf10095dc680c0faef938c5696b
- TLSH T1CA11CA4B35C5700C3641CEAD8C2D2F5DB332938AB7E47D61A6F24048055068FBFB64C5
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\profile_log.log
- Size 1KB
- SHA256 bed016bcb167784e6387913daf46398855a63e9f9ff996173c6eb6d2daeca1fb
- MD5 297da035a44ccef1864ed850e5adde1e
- SHA1 42d97f1c4c0c8a32d9863b046dec5fefb87c94dd
- SHA512 2663979ed2bd50228211c8e0e05712623c26269e4513ab6fbe7c7253b7f2558380a1445b8fd7b613622c7c60a149b7d862959184bddf9b6f000a38b550d5f924
- TLSH T1B931C70B35C5705C3602CDAD8C2D2F5E7336E28BB7D87C60E6E640490590A8FBFAA4C5
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\utility_log.log
- Size 4KB
- SHA256 ef6a7a8da1a3678933336f2b3c3ef16afaa6af3e982b93d1b4f440a3c57efe56
- MD5 6569dea0600fa593b7f7a82e7d847dbf
- SHA1 4ff9df202f23115cce0f37a55a8e1dee17ea042b
- SHA512 72a3652623bb3fda053b492d7c9c67430998b3ed0dfffb6d2521a61ab91d3503789ddc483a53cd2c85176b6eea084f27d9133580418c285b8aaafb693cceee05
- SSDEEP 48:YTIZKOPde8rejc73as8fcG/UIAERYHiQTq5Ob77JyqT2LEJfvd:YTIZKOPtewQUIoCJObmkvd
- TLSH T12281D51B31C530152952DFAE8D1D6E8C7B72E21BFB847C54B6EA45881315F0A3FDA8C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\utility_log.log
- Size 695B
- SHA256 db9713777cda7defc89c8eebbc47b16d00d43cbb0bd2add917a710f07e5ed9b7
- MD5 4385b9332985b46d51b7bd19e64cf187
- SHA1 29c21731e7a43cdead14552398d6dbb215a61aa9
- SHA512 ee6c7b8e242556034a4200c576c07c926e882cfcb23b89414036befc25aaf82e2ea21d3fc1c83883fb15ce1e69c17221eefbfb9f1fd01b0e0148af57d1be7868
- TLSH T1E101881B31E234612492A7ECAD09AF9C7F3AF36BB7C075A4E29594440335E49B78E086
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Guardware\Integrity Management\LOGS\utility_log.log
- Size 1KB
- SHA256 eeb1de7c52d16267044faf841fbfc6f94c32c324f7d415c0f2b0b13ac1324f63
- MD5 765a16f6d6cc555c9da1834b89386e5a
- SHA1 6a1d3d1702b5342a5a6e7870816175730eb3a17d
- SHA512 182c37b03b06d476e998fe1d9255f314fdeec1a041be3940816e89e1d40d621a4fbc640c61a677d32c5aec7026aaad694efc1dad16a4530c3363595d9d35d4f2
- TLSH T13641D15B31D330612952DBAD5C1C6F8C7FB2E31BB7C4BC54B3D661881325A0A7BDA08A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\client_installer.log
- Size 867B
- SHA256 439f177a90e9feb8e7c92b33c1ce6eb597ef337664c6d8414d9b40d2db01da3a
- MD5 5ce60cb0431065eb6d5af032c276bb97
- SHA1 439e77de4c7fd0bc7f1ac5935231b66f9cc07798
- SHA512 af7b50b232853b4649f0b44be98cfebe2e718f3ef7b4f320a457b3a5baf8d5954c374c74ef0bd8d57b461c209b354e79875e6cdd68236c5cbd0c3232b390c649
- TLSH T18D118C4A48D515F5EB31742F610F1E9033A5CB22612C236432FD36CB6DAF10E074598A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\client_installer.log
- Size 2KB
- SHA256 cbb5fa4edee469f895e1e70c2972308af392beda51225c22a7169bf34c6148af
- MD5 9d12ccbe5266d26252504801d0b21e26
- SHA1 2edda403c3d7770c3bc554083d9a572577ae6d6a
- SHA512 dcaed31105e3e7451a1fcfe4b09a19fa823488807d98d799fa45725bd5fbb43ba6f17252711a9eecd6f260db9c200d1ed57e7f2ec8e4d149ea5694bd886dbbd2
- TLSH T1D241F34A08E542F5E722781F670B2D61339DCF62616C233632FD36CB1A9E44F134565D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\client_installer.log
- Size 4KB
- SHA256 b8278f47af9cdc28d5d7465d45b6a81bfc415202d81bfa0583d3ef0c0616b911
- MD5 4d7d751f126888303967275e7fb736e4
- SHA1 2039ef4c86aaf39946997ff9e8115f5e9b4b5a01
- SHA512 3acb78c40e6a3f07455295b087fe35717e3f0a0f600269b4a8156550a7fe1bef1a6a39c21f489a06957ff3b538d17d7903918e88da1bced0e6193b6a87b925cf
- SSDEEP 96:6f/DlXFQ/DlWk5/DyX0p/DyWckB8AmfU0bYZ/DpWPL2a4w2yfM8/DOXIc/DI4v/w:IkBFmc0FB
- TLSH T14CA1E44984E941F6A621791FB30B3E9033ADCF22716C232533F9379F5AAE50F134965A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\GuardWareProxyr.log
- Size 2KB
- SHA256 d9d61bb2773de2cf89cd04c46e18071919271d55e2171bae765ee42900129e07
- MD5 7f6221bf780b9eeff5fd2102fe51687a
- SHA1 f5b2c9591a7a46d02b36aeda7c06e9608ba8cec2
- SHA512 80e740692676a146b4512243cf5ad6e83930a6b318ef134c3200331eba5fbac7111b2a2891411cbf55c7ed21252bd801c1931f0a117a0dbafee3f4e8e5529c8a
- TLSH T182412105AD4F41942BA331A2DF1A152C33CEFCA159F42F6466D8AA472C90C2F17EBD5E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\GuardWareProxyr.log
- Size 825B
- SHA256 6047b73f5bc615e62eae971af72d63ec725ff7403b3581c149a32b4d5b82f90f
- MD5 580d32cd04b30d3771dae12a3b52b2a7
- SHA1 09e33bcf9216d6ebcd96393618d9aa3361b0c93f
- SHA512 34a4d2255eb3bbeee01220d046b0105b01593cf917555e04db5eb04c6852c4cd895c0402d4210f4998b7783361cbb8e4a6664ba7ea04c75fb75594a827e7b1a2
- TLSH T1D1012E11AD0B409427913193CF1B162833CEF8B119F81F2855D96A432C84C1F17E781E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\GuardWareProxyr.log
- Size 1006B
- SHA256 c62a2fdfb644e5a5360826668156c03e301391605af78374fbb09c0c1a7e90e3
- MD5 5fd8ba9a0d515c402a512d3dd3a4e4c1
- SHA1 69581c75f843b00f80dc33dd5f75353e16f1a50c
- SHA512 f6f2630abdb30358af24a4e1ef4a7e13551d1fc72816f0a59d01e5eca62652c706c16d1df8a469aca990ba29523a3d41bf12a4364593f66e8f3b2e8b078795e6
- TLSH T1BD11EC15AE0F0090268131A3CF1B162C33CEF8A11DF40F6856D9AA432C94C1F17E7C1E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\GuardWareProxyr.log
- Size 1KB
- SHA256 0ed855f7a511597f2755cddb7f5377ebd56c193975eaab7e7dd3ed1fb079b387
- MD5 3b9a46eea63ffa178dcffb8e0b2cd478
- SHA1 5bf3ab6d6841f438ef819409cd951e49897fa688
- SHA512 82634a4cdb85096309e91307cb37e74cc00d4f4339dfa2b8e5a677ed7082adbb238525c61f01e52a907a325e57e88925df27a4138a1f8276b06f8e4d875e09d2
- TLSH T127311E11AE4F42941B9331A2CF0A422C33CEF8A199F52F2866D97A432C9085F17E7D5E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI9bdd8.LOG
- Size 158KB
- SHA256 3022dda53d0bd233ca0afaa8c34c108674b5b482d2cc13a152c284330bfb9998
- MD5 067f1cd9679516f65cf76bc5bd28df66
- SHA1 38d84957b79af81c4be4eaf11a6c752265997f66
- SHA512 d627670c5655040fd90918b626b71b7053bc9b1c1d4822e377bfcc548f8483ea588d345887ab62e441e06172be8c48bcbfb194212d61d5b4414ae353778efa5b
- SSDEEP 1536:AYtSvtdU66HDGB+crZ3HaqYzZbGobDl+q4clOIpGUc/GFsfTb2bTavhg/o41LKba:Bj
- TLSH T1F9F3F92D1FE8010A66B7E647CEF34416E5B2BAE22435DC0D71D3E61D007290A7A5DBEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIC50B.tmp
- Size 86KB
- SHA256 de3be64f9cf8438a2b4085fde6af3b27b7a3c8947b9c0da05f434339b2caa791
- MD5 8cd9ef9a1737b4847b00710591773ab0
- SHA1 ae65e7f3ee0b3a0c1caf112f5caab20f25780ded
- SHA512 59f8ac85ea6909d5db494a11f2fdba729ea1848c753b1343c25f3ea9a8d9fee3f6f6c6ea3d6f11120901b4f6034108faec99f304675010bd3b7a9337991731ab
- SSDEEP 1536:Rm6mtd/dtH7TVJexM/9aBA7B6p0EK9+M49Jr0bqa1q:A1b/j/VJsskOB6+rocbqa1q
- TLSH T1C7935A4133E840F5F6B779B06FFAA51ECFB6F9988562895F43570D4B8890601BA29333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIC9B2.tmp
- Size 309KB
- SHA256 270097930507adee117cc2e8ac3b63fe900e9a45713e5c857eecc67cb64b8bbf
- MD5 8ca494143f074af1d3ceaeb88f6c1b42
- SHA1 491e615b3938231be5c90cbe3760c0bd695bd15d
- SHA512 054820ec9a115f711bd50f330c560016dcbd3fd12e92941aba87681a8ebcd876db8699495fec4f4463915b6d4b5bf7c398d639d9e2b9009a89cc6a85bc7c7911
- SSDEEP 6144:FyfM/wjGLCU1A9iIEWnw2jclskERSoPp1x/lMCmeR5RKtx:FHP+Liijc2KKlbRvKtx
- TLSH T1B0649E11B5D98036E1BF2A306B64D29585FDF8B049B2C857A3E0166E1E77D839A31F33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSICADC.tmp
- Size 114KB
- SHA256 776122c362d76a51c847382acccd4fe07612018c3420d6748f330190ffe6cb14
- MD5 299a5ea38ce4de5becc23fa49b758b81
- SHA1 0a38573d78b4e66b58af80d080e056242f133544
- SHA512 661ab828f7632e4fae761f9b194df8bb7566c545aa4e7bdc0efd15209499fd2341ee009a0731a98584da03f260fdcb8b3020655a37139a1b5c2d5eee99fe5eea
- SSDEEP 3072:yiwvw+O2ZZG+qZxQn20eVt674uiHoMuxEL:yrI92Z6x10w0QsE
- TLSH T1CDB37D1275D1C031D1BE1D3A4436E6615B7EB960DEA08E6B73A803AD4FB42D0EE35E27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WFP.log
- Size 807B
- SHA256 df86954dfeb99148c7363c584d84a315245ad3e6a557442edf51c79a3979504a
- MD5 08b6201a99da71967eeeb78d5d95b364
- SHA1 5225ce7f987483024ff5e93e29d08d73032ccfee
- SHA512 b6f3ffaf3921ecf28c48b11ae808f19618f6f0e8adf3a2632f1c339822542e7aaea7ac718ffed8f160322192f32168bc3fd4107fd6ba2be34a98bd847d39967d
- TLSH T1CB015A842EC1A8F26261F653138F9E2FD31F28B699BC052E37C811451525C1E6BAC10F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{63674956-F020-4567-9DB9-7D6F9C457193}.bat
- Size 90B
- SHA256 a3a9e7d89cfaa71f430007cae0a04468bc96213b072345f19a4838da96d046f6
- MD5 3fb7ce74674e2287e6079972a92deaf0
- SHA1 998a4df535b396895e1deb9cb9c617719378c041
- SHA512 d70b9d343a757882a512c485c2047b396850001c3b8b73383fc21e00f77981454e57f2e49cf4faf1b9d48068bb58caa7f68b3426eceba39da51f8cc1a6b35b5b
- TLSH T1D1B01210619EC6550445530E0238058E4420840D1E5B2701960084159E52818E995610
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4e6yyh2i.Admin\key3.db
- Size 16KB
- SHA256 f844e1c1e145fecc067caa6097a300a058d500cc74f72aec99050c17693b1230
- MD5 7336bbe44308ea50d199608ab468f9f5
- SHA1 57462fb1a9d768f6674bb6ee9ce8f7dd633bbcbc
- SHA512 5ebd768df8bec80d10fbeb8b2345a5a62435e40e80b8335759a5a6f06dcb82601e95b958c563c3bdcc38c22ac81121c9927db141924b06c02245fb9f960725ff
- SSDEEP 3:Lt/hV/plfltt/lE9lllnldl/lyGltdl/l8/fNDqLvvvm0uAZgRpbw8aRay:5X9cvV3Xy/fWvFliR+LD
- TLSH T1CF72928223202DABD435073DA0C143233339ED12AB4BD36A085435472EB03961C58696
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI7544.tmp
- Size 364KB
- SHA256 d308cbaff0cc42cbb3053952efb3e92705ade3d1dc6ac371ba4fb2bd8502affc
- MD5 ca0592d910569f73eacf518153824b76
- SHA1 62fa7a37752a75875e153d07c3716bf723d8d9c4
- SHA512 456b95f4e3c4214d4b5ae1762c2e370d4b6958d55aec3b240e8fcc2b084b175f0d08068a029b15a163beb5cc5318d9d25ac3e1afae2bf982986457ccc27a98a1
- SSDEEP 6144:uJVFpyM7/OzUSc/FuTzfY+BitvMbPbXbZ+Uh/7uYF2j:udpJ7/04/FiwIiBQP78u6YF2j
- TLSH T1AC849D11FAD5C436E17F063439B9C25849F9B8B08DB4C96B63E40BAF2F795429631F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI776A.tmp
- Size 250KB
- SHA256 96e2fb9464914bdf571092830a2ccc20764c984ce7b56140b1d364d7743860d6
- MD5 f4df5032f9c1b4ddf88802c44c8b924b
- SHA1 6dddf0e75f972a7df6526a40388efd994bbe9c6c
- SHA512 8c2c5a7b1ef93bbb952bcdf37361bde988cef36b021247f91021717417f3d3c57a87ac0c9d1ec550b8914cbdba74c9816012433573a2c33a9116481aa8d5265f
- SSDEEP 3072:pArbg5BxgracGnEnRQOl9WGPot96yY+3x9uYwiHcfTOfJz/5Nvadx2ZSwJwg3l9:pArbtraBqLlAGE5TN0TgJzhNSWowJjl9
- TLSH T1A044AE1076D48076F2BF2E381D3496501DBEBEB15F75C98F2748862E5EB4A80DA24B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI776A.tmp-\ClientCustact.dll
- Size 29KB
- SHA256 7989ff6ec384860b354fa91d8663687ce5877831ad1f94a90401f6fc67cafbfc
- MD5 3733b0751349d9e93558107d9ab05e1c
- SHA1 5950dd8d46316fa8bdd10a1e338f5da2099580fa
- SHA512 04fff5cf2bd89d998e4ea2e2a6d5f30b2f22386878d6e2eadea80d13edfd8cc69c659bb3d3cf09885991d61bf3182e136954727ba41464d7a30a31c864c96c5e
- SSDEEP 384:EEa93Gw8oQMEMavmChMQVbBHWyvijOjyJl/omYbGe4Ur7GLR3ckE9kMqOTSaE1:A92NMEMaeCZVb1WyvUnYbGe4Ur7Y+E1
- TLSH T193D2DC007BE8021DF7FF5BB569B494244577BD579E32EE4E19B0018E0A22BD0CD29BB1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI776A.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 179KB
- SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
- MD5 1a5caea6734fdd07caa514c3f3fb75da
- SHA1 f070ac0d91bd337d7952abd1ddf19a737b94510c
- SHA512 a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
- SSDEEP 3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
- TLSH T159046B2953FC473ACAFF4778E261425197B1F2E67117DB0EEC8181AA2522780F792397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI8027.tmp
- Size 256KB
- SHA256 beeec12054bc3c74342e4c2b070eb4dcb16000b477de66aeba5d386a61eca2dd
- MD5 f4f4a98953f35387205b39ab9b707bc0
- SHA1 4d4f5f567d8ff2b13b7791d5342bc0082adce488
- SHA512 41a6cf1fc5faa4c77a20330e3f524ce23c8cc3714288f7fe43f082e731c63e260468db9e0857fc4643a9d7877b3c3cb02f230994549db6eadb9a837f85007438
- SSDEEP 3072:Zy+V0J5i3O/8jLZmYyOgpSWWiq0t8NT8M/xvlZfZ3vRBt4yZEzstFTsdJxvNxI2i:OEE8BmPxD28M/1BmyZEzKgss7uk
- TLSH T1AF449E52BAC1C433D6BF0A34557AE2650AFCB8304E64C95FA7D94E6D4E37181BA30E27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI8112.tmp-\CustomAction.config
- Size 1KB
- SHA256 5d6fd5049f33ac6b16ec0431787fa61c66630ba1916bb4c70f3f6b5844b74ecb
- MD5 8c22d283225f3bdb8e36522c359796f9
- SHA1 cec5168b62bc7d39930e0843a0a285c3d89ed23e
- SHA512 826550987a6140b870894c02c20f1c890e187c5919fc60f5fe3fe962fc87bfcc3879ee1de6141d679aa85f6cf52f8be88a9b23a8d43b8561b6b70baf138ada3e
- TLSH T19731018E4A44A77721312767ABED91C1DB79A1AB3C91811834DE99242F16968137338A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e5a6802.msi
- Size 44.9MB
- SHA256 c2526d19589bfce14cbe71d9a7ff01e28cd54cb9706de39935fd814fb316d128
- MD5 2366138f0cf640a92a2af5271d5bb7a2
- SHA1 6f050552b0a49960d4d253be38e7c16bf9fd71cd
- SHA512 d2601fa0924313559114a4c7a73327b6b08b21c6d4b5eae6369a9c143488a8f95d60a9f13bf7461b4c973912bbde8b7da155a373f3d561867230ab34d1972684
- SSDEEP 786432:KaQPnaJv8Q1BRLWKj/x+jlgWgX8EwQOLYDo6vLQZ17nKGWgeXwLO/8IXqc:KXK1BZWe/Q27ZOLYDo6vLKMAS/lqc
- TLSH T174A73312BAC18032E5AF05751D7ADB398AB9BC314B31C5A773E82B6D1F726C0A931717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5a6806.msi
- Size 7.6MB
- SHA256 29886082058ba164a21dd286ddac183dfaef1e48e645ea24b40d7ab7b447538a
- MD5 8fbe81a8ed043207dcba74943f0ac69f
- SHA1 9f4bfdbc130844d9c92906861569ffc4dae7bdb0
- SHA512 0e70731d273f9f272311eba5cd6308624b0e25e249a681f65e46d772ae487c549c05bd2195abdb2eb414df5a9dbc7ed33fd9ca7eb96bd90ae91c12990b38a6d4
- SSDEEP 196608:+4geM6/o0xEfRk23pKdS7Qu0Y6+LSG+y40qqoc2PWv1Nc90KM63sFS:+4geM6nUJpKdS7Q1t+LY/M2PWN+9+hF
- TLSH T1D686330372C98237E6DF42B11A5AC71A87F9BC704563C56723D61A0E3CB3641B6B76E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\GuardWareProxyOff.ini
- Size 9KB
- SHA256 0edb742df2a1f3818a79000d3097908aa084fe2e6ac15a5de2e0115cadc5d9c8
- MD5 e55111dfb3c2ae282cbd136487f16158
- SHA1 c4f5e76a8ad0258220c2a36c126ea1dc41ed2849
- SHA512 39c0055e962b0a60324b780b3fe6e9fd06115f25d6f65cde99a9ddcf58342a7835b2b51af14b43c34eefb41c4f8898c556f0117d7a19ccf091ef2656aea3887d
- SSDEEP 192:U+i9T4e82tpCF8HqPDb6z7ywk93nCZkrsdqJ/rAfikyN2A:U+pWrCecDbFX0krsd8IVA
- TLSH T16E12BEC4749C29391547D98D2E1872685E2844EE3E57C337D53A75DCC14F28CE29DE2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\GuardWareProxyOff.ini
- Size 11KB
- SHA256 6e48847c5a9b7178905072f0037fd19b353157844f65a479151fd211c2379cc2
- MD5 6c8517af69b33d05be6716503cc2e066
- SHA1 fbb8e599bd70e4e97e021b756fccf928a5108eb3
- SHA512 0086008a9a4ab19278a0cc95ff9bba12a8b7835c15d118ecc4df543c554f03df57a67a874b751e1603bc03ec16b8692dc7dced873f6ae0be04be3f41c0b8daf6
- SSDEEP 192:CicBF49aji9XAJXNpQdxNN6nyWv8S+CwyLpQEt+wX0GWi7e/mOt6157MCICyEVpn:wB3jAAJXodxNMyvS2jWuT/mOt9w
- TLSH T18E32AF603ACD8657F37742C7481E4949FCB9DC1C1E01B7F7254992DAD3CAA5E948460F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\GuardWareProxy\GuardWareProxy.ini
- Size 12KB
- SHA256 f67197df7de8a1b8daa1acb6edee2c8c6e8ef394ab3061de4d879c68d58acfa7
- MD5 a771b2a08973fe870ee686bf94a10f21
- SHA1 96c7b8c4a7441cac5b87865769986501a47bc771
- SHA512 03a36a7e3e1bde2ed7e988c6a7de4c520600df89e973db0df15cdeba3580bbae58a07e0d32307015b85013a6d5c9e4ab84c17a8d868b916620c6bd2587c6d1fd
- SSDEEP 192:YZ+aVmRhAxF+PhAxE07VxqaGVqtARE/XukR14nbqbvdP/7cCnhF03fWiDSYun:nz0+90HGQA6/XPebqb6Cn8O0u
- TLSH T17442BFB471DD27F561C277E9A8B603A155EBB5CA091007B6FE151E34DB574AC2B1CC03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\GuardWareProxy\GuardWareProxy.ini
- Size 21KB
- SHA256 d580b48e584ff4c046c516755d69c3aafa85f91b66951d975c3940d4adea3116
- MD5 729cb6ad9c05923344117d0473c05c51
- SHA1 47003ffb6ae968289998b92a97f54708bbc8a5ee
- SHA512 8240964887a541feda1aba2f5884c77aed17e6da4bb6bd8faf5b8e0c5fa41c9c090a09dd071b482ecb04143b7c8adef0cc0a3e4ba057278ff72d0019df957ce3
- SSDEEP 384:Cmq91P9c4nWDGQA6/XPebqb6Cn8OP+NjxU8mNjxU8mssDF6Ei1FQTXLGafsmaJ9k:Cmq9x9n+A6/XPebNC8zbqbbN1FQDCam6
- TLSH T1CDA2D0A978ED63F626C3BBF81C7E1214812B799272610974EB714E60FB83B1D0B85C09
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\CertsIE.dat
- Size 41KB
- SHA256 e81cab0d9932b5335fd3a3de6cbc69dd3b0ad22f314f44048e25da33dd358268
- MD5 2575652897273656532b1168a324632c
- SHA1 c5988dc3babafb373da3e41fa24bc73acced61bf
- SHA512 27a370420df495b1607c8462da9ae235db6c761ee4a111e9af0536efb81e95cc09be41204ceec1a59f100204857e553fea44a57f825d7cc1c23d346f9b0ea78c
- SSDEEP 768:e4Z7C2J2M1mF99U93LK2UgLqcZxU+4wiWPcudY8pb4dEcroZ90W9L:7Z+a2MOq93LcgLq42JEhY8CdEckP
- TLSH T1EB138CD28FD02C582CD7E4A0C8A7176ECC698356EEDBB4721D143C46C64AB2D65FE48E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\GuardWareProxyr.log
- Size 541B
- SHA256 4db0e7df2b7730c7ccfe6f245284a736b5dace3bcaed13dc2a099a10a2aab2e7
- MD5 1cbc9ad3b2e7fb82454cd0347e7cad23
- SHA1 0951d5d862bd7188c296a921807f30b151ba0d9e
- SHA512 30e38f2d57ac33255e53a8daf0a5769f84e954b99595d512b7edc285e91944c226d87a7b00bd1b6698b1246736a93f6f638a222c0c569d5277224d7b9a33c334
- TLSH T1C6F0BE01AE4A5094036621578B0F141933CEF9B518F91F1C92D4664B2C64C0F1796D1E
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\GuardWareProxyr.log
- Size 1KB
- SHA256 1fb4736cf30d9dcaeadf84d46c149fdfdf47e161f3081bb000b150ee0da35d5b
- MD5 9c67efcc500581f95bd4b53713cffecf
- SHA1 68ee014c4a25aa8830e879146af8f0bd29dcc84a
- SHA512 e83f1ad3e3e7107d730dbc4026c483a2a8d4a5480ed051b99bc7f588e3f4c4519bec36ccd968e828ccebef38cd9b0fa4ef53f702e7171609d90e4cb80287bc0f
- TLSH T1F8212E01EE0B52940BA7305ACB0E101D33CDF9E598F82F18A2E43A4B2CA480F0797D5E
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\WFP.log
- Size 643B
- SHA256 6a319c4cc20e9f477e6403f08b7b3386ef00154254b1270857b3b26057fbb535
- MD5 9c38d6d80ab589e1b3df6e903d00ec75
- SHA1 030b504cfeb5e7192bca7b56cd1037de0a4ab914
- SHA512 82bc2170faf072e9aba8f8fb55da5ee4ba08a040591afc71ece5178590fe13442579ed7e971af72f5ba7075577dcfa5a954ee81eadc21793718af40efb233329
- TLSH T18EF0A9842ECA58E16B61E152032D8D2FF3177CE2A13C212A37C44584150188F37AC10F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\WFP.log
- Size 1KB
- SHA256 7adcd33a577f7db893e1335d1a17ccc003ae901962b687caadb9a00b80f2d2d9
- MD5 88c71639e2f159416ff7f2db1d67092e
- SHA1 1c3d87ec27b373eb505510595824db94fb5ef084
- SHA512 1075c417f45a67874ac8492157c7deb019e9049b12e81c1c3c97b932c2e7892bf2f15cabaf61c4aebc782738526b38b1c2940b7a57d34be03c9cd50ac1c1eb07
- TLSH T1A531A5882ECA5CF26B71E652036ECD2FF31778E6923C212A33D84184210599F77AE10F
- MD5 SHA1 SHA512 TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 a1409e17f2ab42ce7cf09eb31872e4bae874370b498615e9fe0d1f8426c117a5
- MD5 334576f86a65cb690b8f508627cc7a4c
- SHA1 517e0841caa9e24a3bf6f807519c597abab79fa1
- SHA512 d67bd5d6e3c0fdcef047682d957089d4987ffca78d47d6525bf7ed8537b9dbea4a94c1e72071d2e2091ad533b11ccb04d520217486468f761577dea10f892f31
- SSDEEP 24576:OFo3DMPCdoO/vvTL/Sgn3iFwfru9MrwkEqhl9qJfBiJ6JQ2XMYR23uNmz+n:NHI
- TLSH T17757022472F92211E7F39E3CA8F06A23493E7D9B9C15DE8D45411B4E0862F71E872F66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{e3f46304-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f4a83be1-6117-42ba-850a-411ef19282a9}_OnDiskSnapshotProp
- Size 6KB
- SHA256 0545997792e28f2d2c1618bf2d21c94949271c441a97ae98fb5d5233ac3e7c47
- MD5 6858a45e470789e95473cd995144895f
- SHA1 d24d3d48499642151b30349e069dfbe99c2a7928
- SHA512 131a7f71a6d0aff315b1e8ab431b0ac8a44efd5a5babc24e77136dace4d4d39df0974ea00bd8b3d277cc0c3c39a7de355ad8ef32b83d6bb36c895b8c6c2df6a3
- SSDEEP 96:FBu1jcvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:i2b++uVm
- TLSH T113D188185AE54711E2F3AB7129F18557A877B812EF33CB8E0198238E6670910F835F6B
- MD5 SHA1 SHA512 SSDEEP TLSH