Analysis
- user interaction
yes - max time kernel
396s - max time network
496s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
10/11/2026, 12:26
General
- Target SAP2000v2710Build3560Setup.exe
- Size 1136.9MB
- Sample261110-pmjrtafd39
- SHA256 ef0525eef5ad41a057d3b8de84c9c6e0576f8e6a81ccf7e4760c53682558007d
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 12 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 4 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 19 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory 64 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks system information in the registry 2 TTPs 18 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 38 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 13 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SAP2000v2710Build3560Setup.exe"C:\Users\Admin\AppData\Local\Temp\SAP2000v2710Build3560Setup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\SAP2000v2710Build3560Setup.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\SAP2000v2710Build3560Setup.exe /q"C:\Users\Admin\AppData\Local\Temp\SAP2000v2710Build3560Setup.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}" /IS_temp /waitingforchildprocess2⤵
- Adds Run key to start application
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{976ADED9-B0C4-4C44-BE06-3B76F14639EB}\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{976ADED9-B0C4-4C44-BE06-3B76F14639EB}\VC_redist.x64.exe" /install /passive /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{F7C4A67B-4E83-481C-808D-20043FBF464C}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{F7C4A67B-4E83-481C-808D-20043FBF464C}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{976ADED9-B0C4-4C44-BE06-3B76F14639EB}\VC_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /install /passive /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{C8BEF3CB-E3C8-4863-901E-7D3C847B16D7}\.be\VC_redist.x64.exe"C:\Windows\Temp\{C8BEF3CB-E3C8-4863-901E-7D3C847B16D7}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C987662F-46F8-4223-AE5D-43EB47E74A48} {A71BBD43-44DE-4A2A-A07D-4C51CDD7D8A9} 34845⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1116 -burn.embedded BurnPipe.{85B46D0B-4263-4DA1-B4DE-5F5E9CBB25F2} {F1705756-A983-4558-9DAD-01AB9CC455B6} 14486⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1116 -burn.embedded BurnPipe.{85B46D0B-4263-4DA1-B4DE-5F5E9CBB25F2} {F1705756-A983-4558-9DAD-01AB9CC455B6} 14487⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{9CCC403A-F500-4F3F-97CD-D6E0C34FAC6B} {F0BA06DC-E84B-4EF3-AC67-CF08E1F32886} 50368⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{95E15BA6-1906-411B-B742-11E52CDA67A6}\VC_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{95E15BA6-1906-411B-B742-11E52CDA67A6}\VC_redist.x86.exe" /install /passive /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{837A81D8-7DFC-4F24-8066-8D5FED812ADF}\.cr\VC_redist.x86.exe"C:\Windows\Temp\{837A81D8-7DFC-4F24-8066-8D5FED812ADF}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{95E15BA6-1906-411B-B742-11E52CDA67A6}\VC_redist.x86.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /install /passive /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{96693B55-BB8E-4BEC-9FA7-23945A5F37F6}\.be\VC_redist.x86.exe"C:\Windows\Temp\{96693B55-BB8E-4BEC-9FA7-23945A5F37F6}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{FC72C15F-2B69-424F-94BB-87A478330C03} {DBD686FD-DE81-47BB-A3E0-7A7847355C91} 56245⤵
- Adds Run key to start application
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{5FAFFD12-9A06-4C40-9BB6-483B3C2DD4C4} {CD22D351-6D00-4413-B84F-FCC4B0B56059} 56286⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=536 -burn.filehandle.self=516 -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{5FAFFD12-9A06-4C40-9BB6-483B3C2DD4C4} {CD22D351-6D00-4413-B84F-FCC4B0B56059} 56287⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{5E12667A-2FF5-425A-A17A-93A15AAE419F} {83343F15-55B6-4DBB-9098-9191F2F4EA03} 35248⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{C564D38C-5CFE-47F8-8F04-E7C84987B524}\windowsdesktop-runtime-8.0.20-win-x64.exe"C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{C564D38C-5CFE-47F8-8F04-E7C84987B524}\windowsdesktop-runtime-8.0.20-win-x64.exe" /q /norestart3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{2D15C5A1-9ED9-466B-B18F-C5B0083D73F7}\.cr\windowsdesktop-runtime-8.0.20-win-x64.exe"C:\Windows\Temp\{2D15C5A1-9ED9-466B-B18F-C5B0083D73F7}\.cr\windowsdesktop-runtime-8.0.20-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{C564D38C-5CFE-47F8-8F04-E7C84987B524}\windowsdesktop-runtime-8.0.20-win-x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=692 /q /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{D29D7BD8-7828-4A28-9D90-9FB10ED74B43}\.be\windowsdesktop-runtime-8.0.20-win-x64.exe"C:\Windows\Temp\{D29D7BD8-7828-4A28-9D90-9FB10ED74B43}\.be\windowsdesktop-runtime-8.0.20-win-x64.exe" -q -burn.elevated BurnPipe.{6BA915CD-CAF0-4050-B94D-DD84FF2E2B4C} {5FB33C90-F08F-4E65-8FFB-1074643B7240} 38325⤵
- Adds Run key to start application
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe"C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={e033dc24-62c0-4f2c-928e-99122efab19d} -burn.filehandle.self=1212 -burn.embedded BurnPipe.{8D1A49A2-A5C7-480A-A35B-6FAEE733E471} {91BD29D5-B42B-43AE-A327-CB82F70BE65C} 54606⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe"C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 -uninstall -quiet -burn.related.upgrade -burn.ancestors={e033dc24-62c0-4f2c-928e-99122efab19d} -burn.filehandle.self=1212 -burn.embedded BurnPipe.{8D1A49A2-A5C7-480A-A35B-6FAEE733E471} {91BD29D5-B42B-43AE-A327-CB82F70BE65C} 54607⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe"C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{5FB29808-0F60-4956-ACEA-266D787430EF} {747C93B8-FA0E-42F9-B0B6-921FD5F69037} 54848⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{EF3FC405-FAA8-421C-90FD-F79A30411F9C}\MicrosoftEdgeWebview2Setup.exe"C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{EF3FC405-FAA8-421C-90FD-F79A30411F9C}\MicrosoftEdgeWebview2Setup.exe" /silent /install3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Temp\EUDC33.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUDC33.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.315.17\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.315.17\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.315.17\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.315.17\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.315.17\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.315.17\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMTUuMTciIHNoZWxsX3ZlcnNpb249IjEuMy4zMTUuMTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RERBNDY5NkEtQjk4Qy00Mzk5LUI3QzQtMzMyNjg3QzFCQzVEfSIgdXNlcmlkPSJ7MTVBNDk2ODMtOUY0NS00MjIzLUEzNTgtQTJDMzQ1QzgyNzUyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntFRTE5QTFEMS0yQThELTRDNjQtQjcxNy05N0UxOTMyMDg2MER9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iRGFkeSBzdXBlciBwb3dlcmZ1bCBQQyIvPjxleHAgZXRhZz0iJnF1b3Q7czhGYW52d2ZNY2Q2Nmc3TFYyUGVhU1I3V1VPdjBsdUY0aHZpaXJUb2srTT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS42NSIgbmV4dHZlcnNpb249IjEuMy4zMTUuMTciIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc1NzY5MTQ5OTciIGluc3RhbGxfdGltZV9tcz0iODEyIi8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{DDA4696A-B98C-4399-B7C4-332687C1BC5D}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{A94FE67B-CBD9-475F-85E8-F499FF552869}\windowsdesktop-runtime-8.0.20-win-x86.exe"C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{A94FE67B-CBD9-475F-85E8-F499FF552869}\windowsdesktop-runtime-8.0.20-win-x86.exe" /q /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{2157C9EC-6D3E-43F8-A062-04B15A0AFBC4}\.cr\windowsdesktop-runtime-8.0.20-win-x86.exe"C:\Windows\Temp\{2157C9EC-6D3E-43F8-A062-04B15A0AFBC4}\.cr\windowsdesktop-runtime-8.0.20-win-x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{A94FE67B-CBD9-475F-85E8-F499FF552869}\windowsdesktop-runtime-8.0.20-win-x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=692 /q /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\Temp\{870133FD-972E-40E1-8FF0-EE623E2CADF4}\.be\windowsdesktop-runtime-8.0.20-win-x86.exe"C:\Windows\Temp\{870133FD-972E-40E1-8FF0-EE623E2CADF4}\.be\windowsdesktop-runtime-8.0.20-win-x86.exe" -q -burn.elevated BurnPipe.{B5E7B491-4BBC-405C-BFB0-471C24AA6587} {3F1D2742-779B-4843-B968-6CE1780B64C6} 22925⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Windows\system32\MSIEXEC.EXE"C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\SAP2000 27.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="SAP2000v2710Build3560Setup.exe" IS_RUNTIME_FILES_LOCATION="C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}"3⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\SAP2000v2710Build3560Setup.exe"C:\Users\Admin\AppData\Local\Temp\SAP2000v2710Build3560Setup.exe" /waitingforchildprocess"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{09170B96-2587-4E38-92F7-9036E5D8BA36}\SAP2000v2710Build3560Setup.exeC:\Users\Admin\AppData\Local\Temp\{09170B96-2587-4E38-92F7-9036E5D8BA36}\SAP2000v2710Build3560Setup.exe /q"C:\Users\Admin\AppData\Local\Temp\SAP2000v2710Build3560Setup.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{09170B96-2587-4E38-92F7-9036E5D8BA36}" /waitingforchildprocess" /IS_temp /waitingforchildprocess2⤵
- Adds Run key to start application
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{09170B96-2587-4E38-92F7-9036E5D8BA36}\{95E15BA6-1906-411B-B742-11E52CDA67A6}\VC_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\{09170B96-2587-4E38-92F7-9036E5D8BA36}\{95E15BA6-1906-411B-B742-11E52CDA67A6}\VC_redist.x86.exe" /install /passive /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{4B035B10-A2E6-41A6-B91A-59D6AAF9761F}\.cr\VC_redist.x86.exe"C:\Windows\Temp\{4B035B10-A2E6-41A6-B91A-59D6AAF9761F}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{09170B96-2587-4E38-92F7-9036E5D8BA36}\{95E15BA6-1906-411B-B742-11E52CDA67A6}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=552 /install /passive /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{FD039057-4579-433D-A353-B921A75AB77C}\.be\VC_redist.x86.exe"C:\Windows\Temp\{FD039057-4579-433D-A353-B921A75AB77C}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{E68EB47C-4AE0-4F2C-90F0-C1493A6A07C5} {D7358DB8-56D2-4EA9-A1D3-A7244727F6EF} 52965⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\{09170B96-2587-4E38-92F7-9036E5D8BA36}\{C564D38C-5CFE-47F8-8F04-E7C84987B524}\windowsdesktop-runtime-8.0.20-win-x64.exe"C:\Users\Admin\AppData\Local\Temp\{09170B96-2587-4E38-92F7-9036E5D8BA36}\{C564D38C-5CFE-47F8-8F04-E7C84987B524}\windowsdesktop-runtime-8.0.20-win-x64.exe" /q /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{94E59DCA-FC8C-4BB2-ABDD-2A4B3AB2F4A1}\.cr\windowsdesktop-runtime-8.0.20-win-x64.exe"C:\Windows\Temp\{94E59DCA-FC8C-4BB2-ABDD-2A4B3AB2F4A1}\.cr\windowsdesktop-runtime-8.0.20-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{09170B96-2587-4E38-92F7-9036E5D8BA36}\{C564D38C-5CFE-47F8-8F04-E7C84987B524}\windowsdesktop-runtime-8.0.20-win-x64.exe" -burn.filehandle.attached=600 -burn.filehandle.self=668 /q /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{715A91EA-7DBF-4438-9113-6F3AFE6242F9}\.be\windowsdesktop-runtime-8.0.20-win-x64.exe"C:\Windows\Temp\{715A91EA-7DBF-4438-9113-6F3AFE6242F9}\.be\windowsdesktop-runtime-8.0.20-win-x64.exe" -q -burn.elevated BurnPipe.{344443AA-F6EC-437D-87E5-ABF5EC93D33D} {84F723CC-9BCF-47AA-9D10-021CD2D348F7} 53565⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe"C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={e033dc24-62c0-4f2c-928e-99122efab19d} -burn.filehandle.self=1140 -burn.embedded BurnPipe.{E6BA66F5-B68E-4309-A54A-C7B190FA718B} {F60C7A6A-0E58-48F5-AF10-0D50234FD3D4} 18326⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe"C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 -uninstall -quiet -burn.related.upgrade -burn.ancestors={e033dc24-62c0-4f2c-928e-99122efab19d} -burn.filehandle.self=1140 -burn.embedded BurnPipe.{E6BA66F5-B68E-4309-A54A-C7B190FA718B} {F60C7A6A-0E58-48F5-AF10-0D50234FD3D4} 18327⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe"C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{1D009F50-3730-4E16-8944-DA236CBC455B} {5271ADF2-1528-465C-B1DD-6207ADAB935A} 12328⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\{09170B96-2587-4E38-92F7-9036E5D8BA36}\{EF3FC405-FAA8-421C-90FD-F79A30411F9C}\MicrosoftEdgeWebview2Setup.exe"C:\Users\Admin\AppData\Local\Temp\{09170B96-2587-4E38-92F7-9036E5D8BA36}\{EF3FC405-FAA8-421C-90FD-F79A30411F9C}\MicrosoftEdgeWebview2Setup.exe" /silent /install3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Temp\EUE00C.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUE00C.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Checks computer location settings
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /healthcheck5⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMTUuMTciIHNoZWxsX3ZlcnNpb249IjEuMy4zMTUuMTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTEwNTk1N0QtOTA0My00OUEyLTkwMjgtRkYwNENBQUJBNUIyfSIgdXNlcmlkPSJ7MTVBNDk2ODMtOUY0NS00MjIzLUEzNTgtQTJDMzQ1QzgyNzUyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxMzIyNTc2Ri0zRTM1LTRBMUYtODYzMS0wOEJFQThCOTkwMDB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iRGFkeSBzdXBlciBwb3dlcmZ1bCBQQyIvPjxleHAgZXRhZz0iJnF1b3Q7czhGYW52d2ZNY2Q2Nmc3TFYyUGVhU1I3V1VPdjBsdUY0aHZpaXJUb2srTT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjMxNS4xNyIgbmV4dHZlcnNpb249IjEuMy4zMTUuMTciIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc1ODA2NjUzODUiIGluc3RhbGxfdGltZV9tcz0iNDciLz48L2FwcD48L3JlcXVlc3Q-5⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{1105957D-9043-49A2-9028-FF04CAABA5B2}" /silent5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\{09170B96-2587-4E38-92F7-9036E5D8BA36}"3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 019599E904B83BF022BDC11F40D3AE7B2⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F7E89F9BE1B64D57DB9FF39E1FB156B32⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C50637A1EC476169B6A92212CF7BEF392⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FE2B448E92671723216D77C175D7ED732⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 219B5AE495D7462403E23630703209312⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0685400A078047FAF40AA163E2A898842⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 755607C4EB6D2E8BE1823AF4025134632⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4C044FE4EB4D30D65866E4B02A78BFDA2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 824B86B89281F78B3C65CD325E3F6BEE2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 27E2E2B02EAFDA599968159AB9C7E55D2⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 30BB0701E2820352988F134043C9336E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FA0CC63171286BAECE25007CCA2D7DBB2⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7DE7784A753A6ECBC20A07CFF3EEEA5B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9F673486F0FCF0DED91502EEB72AECD72⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 00283ECD13C8FA67AB63603AF7D4FDCD2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 41CF479BBD04A0246B9D4ABE1F98A7C92⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 98642B933F23B344411721242B85D83F2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5F1FC9A7A6BE529912515C3BAA27ACD82⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 34EDDCA6C4F1B501A8CF5E02666E540D2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B4324B7D4053E51277591AAC533A7ECD2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5ACB86B75526762B3B6406FCA29D1C5F2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 24585809DCF2EC92C556762D361993BD C2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FB1D3979-DB57-4451-B37B-2FE2D4C467F6}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AF3B28B4-18C0-4EA2-A691-F186BB496264}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CF0B0FF3-E8CD-4A56-B243-EA4C6685C8BD}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F4DC01BE-AFFD-4BE1-938B-A8BBBDF65B08}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EF0FD2DE-5CB7-4242-A293-D91A8708E732}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D2E74F57-9EC3-4729-A79B-916E598D9EE8}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{307EA258-1D5F-47FB-BDCE-073343DE3F64}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3CBA77C7-E4F3-48BA-B88D-B4F05288370B}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BB03E776-A737-4879-9BC1-F0DF2D120960}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is3B9F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{07643865-44C8-42A5-AE82-FF30AEF4BEEF}3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 26818E5944D2E5C53EEEA9E2439A5D972⤵
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9E21BDCA-7FFB-43B7-85BD-CD65E1C27A58}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EFAFA3FE-61AD-47B1-85E5-C373D20B7A5C}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5F9AFF5E-D94D-4C28-942D-4907F5F3662C}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{12D3B0F2-F486-4DD0-B495-2FB1B5ABF126}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BACC4146-C5D5-406C-B6D1-10018035F634}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2E325867-85E0-4682-8167-279707229738}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{79FFC3BB-E399-483B-9428-637E584848D5}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2CFF3108-9773-404D-8EEE-07C77370CF44}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6297EFAB-5E7A-463F-9D04-150B8252347C}3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exeC:\Users\Admin\AppData\Local\Temp\{B4054800-4651-4F60-BA35-F9949A28F714}\{E69E3B77}\_is9D76.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{89CC14D8-CC87-4AC7-96EB-68C201F710C6}3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /c "C:\Program Files\Computers and Structures\SAP2000 27\RegisterSAP2000.exe"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Program Files\Computers and Structures\SAP2000 27\RegisterSAP2000.exe"C:\Program Files\Computers and Structures\SAP2000 27\RegisterSAP2000.exe"3⤵
-
C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x86\dscom32.exe"NativeAPI\x86\dscom32.exe" tlbexport "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x86\CSiAPIv1.dll" --out "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x86\CSiAPIv1.tlb" --silent4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x86\dscom32.exe"NativeAPI\x86\dscom32.exe" tlbregister "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x86\CSiAPIv1.tlb"4⤵
- Modifies registry class
-
-
C:\Windows\SYSTEM32\regsvr32.exe"regsvr32.exe" /s "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x86\CSiAPIv1.comhost.dll"4⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x86\CSiAPIv1.comhost.dll"5⤵
- Modifies registry class
-
-
-
C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x64\dscom.exe"NativeAPI\x64\dscom.exe" tlbexport "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x64\CSiAPIv1.dll" --out "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x64\CSiAPIv1.tlb" --silent4⤵
-
-
C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x64\dscom.exe"NativeAPI\x64\dscom.exe" tlbregister "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x64\CSiAPIv1.tlb"4⤵
-
-
C:\Windows\SYSTEM32\regsvr32.exe"regsvr32.exe" /s "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x64\CSiAPIv1.comhost.dll"4⤵
-
-
C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x86\dscom32.exe"NativeAPI\x86\dscom32.exe" tlbexport "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x86\SAP2000v1.dll" --out "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x86\SAP2000v1.tlb" --silent4⤵
-
-
C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x86\dscom32.exe"NativeAPI\x86\dscom32.exe" tlbregister "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x86\SAP2000v1.tlb"4⤵
- Modifies registry class
-
-
C:\Windows\SYSTEM32\regsvr32.exe"regsvr32.exe" /s "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x86\SAP2000v1.comhost.dll"4⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x86\SAP2000v1.comhost.dll"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x64\dscom.exe"NativeAPI\x64\dscom.exe" tlbexport "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x64\SAP2000v1.dll" --out "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x64\SAP2000v1.tlb" --silent4⤵
-
-
C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x64\dscom.exe"NativeAPI\x64\dscom.exe" tlbregister "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x64\SAP2000v1.tlb"4⤵
-
-
C:\Windows\SYSTEM32\regsvr32.exe"regsvr32.exe" /s "C:\Program Files\Computers and Structures\SAP2000 27\NativeAPI\x64\SAP2000v1.comhost.dll"4⤵
-
-
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="CSi OAPI Service" dir=in action=allow program="C:\Program Files\Computers and Structures\SAP2000 27\CSiAPIService.exe" enable=yes profile=domain2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261110123423.log" /install2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261110123423.log" /install3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{2C32A80B-2DF0-4CD0-B635-1AD7D4C43C06} {24A6D9BA-7AE1-4276-85F8-A41D95278AE7} 57844⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:31⤵
-
C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" /burn.runonce1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261110123433.log" /install2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261110123433.log" /install3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{47109d57-d746-4f8b-9618-ed6a17cc922b}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{A51FDDB4-AB1E-4C15-9E44-5355C9476F93} {FC57D96C-10AA-4FE1-A016-9D1FD3B7BCE7} 18484⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=988 -burn.embedded BurnPipe.{DF5B3516-6275-4CA3-87FF-EE80FB913231} {017C294C-2A0C-4C8B-9621-AE2F7351EF4F} 55445⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={47109d57-d746-4f8b-9618-ed6a17cc922b} -burn.filehandle.self=988 -burn.embedded BurnPipe.{DF5B3516-6275-4CA3-87FF-EE80FB913231} {017C294C-2A0C-4C8B-9621-AE2F7351EF4F} 55446⤵
- Loads dropped DLL
-
-
-
-
-
-
C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe"C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe"C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.20_(x64)_20261110123507.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe"C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.20_(x64)_20261110123507.log"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe"C:\ProgramData\Package Cache\{e033dc24-62c0-4f2c-928e-99122efab19d}\windowsdesktop-runtime-8.0.20-win-x64.exe" -q -burn.elevated BurnPipe.{141E0E3A-DDFF-4F23-B498-C59CFC09EC90} {11F863A9-FAEF-421D-8FA6-F9016C52F253} 8324⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe"C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={e033dc24-62c0-4f2c-928e-99122efab19d} -burn.filehandle.self=1140 -burn.embedded BurnPipe.{1727AC4E-6090-4B17-A66D-87B9AE652A9C} {8F0EC644-AF09-4CD7-B088-3F12F071427D} 13845⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe"C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 -uninstall -quiet -burn.related.upgrade -burn.ancestors={e033dc24-62c0-4f2c-928e-99122efab19d} -burn.filehandle.self=1140 -burn.embedded BurnPipe.{1727AC4E-6090-4B17-A66D-87B9AE652A9C} {8F0EC644-AF09-4CD7-B088-3F12F071427D} 13846⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe"C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{F082BA81-DBF4-4BC0-96E6-6262759CB632} {8913E065-E814-46F3-B0F7-DD0615BC24C7} 46847⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMTUuMTciIHNoZWxsX3ZlcnNpb249IjEuMy4zMTUuMTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RERBNDY5NkEtQjk4Qy00Mzk5LUI3QzQtMzMyNjg3QzFCQzVEfSIgdXNlcmlkPSJ7MTVBNDk2ODMtOUY0NS00MjIzLUEzNTgtQTJDMzQ1QzgyNzUyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MDhFMEI0RTQtNEQyMy00NDM5LTlCMzktMEVBRUFEREM2QjBDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O3M4RmFudndmTWNkNjZnN0xWMlBlYVNSN1dVT3YwbHVGNGh2aWlyVG9rK009JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjE0MC4wLjczMzkuODEiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjU5IiBpbnN0YWxsZGF0ZXRpbWU9IjE3ODkxNDA2MTciIG9vYmVfaW5zdGFsbF90aW1lPSIxMzQzMzYxMjg4MjM0MzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxNTMxNzQ4MDgiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc1ODE2MDI0NjciLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMTUuMTciIHNoZWxsX3ZlcnNpb249IjEuMy4zMTUuMTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTEwNTk1N0QtOTA0My00OUEyLTkwMjgtRkYwNENBQUJBNUIyfSIgdXNlcmlkPSJ7MTVBNDk2ODMtOUY0NS00MjIzLUEzNTgtQTJDMzQ1QzgyNzUyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NzA5OTNCMUUtNzEzNC00QjhDLUJGMjYtMTgwMDAxRURBOTM4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IkRhZHkgc3VwZXIgcG93ZXJmdWwgUEMiLz48ZXhwIGV0YWc9IiZxdW90O0kwRWFoYjZ2SVBwZ0dnc0VvNS96N0NtSWxPM3FjRVZyUmt5OW9QMitXT0U9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjE0MC4wLjczMzkuODEiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjU5IiBpbnN0YWxsZGF0ZXRpbWU9IjE3ODkxNDA2MTciIG9vYmVfaW5zdGFsbF90aW1lPSIxMzQzMzYxMjg4MjM0MzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxNTMxNzQ4MDgiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc1ODM3OTAyNDUiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Checks system information in the registry
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6CC106E1-6AA3-4D4A-807C-527837F20A2E}\MicrosoftEdge_X64_157.0.4341.46.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6CC106E1-6AA3-4D4A-807C-527837F20A2E}\MicrosoftEdge_X64_157.0.4341.46.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6CC106E1-6AA3-4D4A-807C-527837F20A2E}\EDGEMITMP_1432A.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6CC106E1-6AA3-4D4A-807C-527837F20A2E}\EDGEMITMP_1432A.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{6CC106E1-6AA3-4D4A-807C-527837F20A2E}\MicrosoftEdge_X64_157.0.4341.46.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{00C520EF-AAC6-4977-9EEA-16B8C6FE5C97}\MicrosoftEdge_X64_157.0.4341.46.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{00C520EF-AAC6-4977-9EEA-16B8C6FE5C97}\MicrosoftEdge_X64_157.0.4341.46.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{00C520EF-AAC6-4977-9EEA-16B8C6FE5C97}\EDGEMITMP_F3C8A.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{00C520EF-AAC6-4977-9EEA-16B8C6FE5C97}\EDGEMITMP_F3C8A.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{00C520EF-AAC6-4977-9EEA-16B8C6FE5C97}\MicrosoftEdge_X64_157.0.4341.46.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMTUuMTciIHNoZWxsX3ZlcnNpb249IjEuMy4zMTUuMTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTEwNTk1N0QtOTA0My00OUEyLTkwMjgtRkYwNENBQUJBNUIyfSIgdXNlcmlkPSJ7MTVBNDk2ODMtOUY0NS00MjIzLUEzNTgtQTJDMzQ1QzgyNzUyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszMUIzOUI1QS1CN0I5LTQwNEEtQjMyOS0xODYwMTY1NTI5N0Z9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iRGFkeSBzdXBlciBwb3dlcmZ1bCBQQyIvPjxleHAgZXRhZz0iJnF1b3Q7SGh2SElXcFVOWlRNblYyVlQxbGUzZjVZSlE5T1NvVEQ2TXhIRGxBODlQZz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTU3LjAuNDM0MS40NiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjU5IiBpbnN0YWxsZGF0ZT0iNzE4OSIgY29ob3J0PSJycmZAMC43NSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NTkzMTY0OTg5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzU5MzE2NDk4OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgwNzkyNTg3NTgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2Q5ZWM5YmM3LTFiNWUtNGE5Mi05YmExLTQyYzUwNWY3YWRjMD9QMT0xNzk0OTE5MDYwJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVRRdXklMmZudGg3Nm1KNHB2WnlZSUxyb3JCdjlEM3ZwaXJTZjF0b1FpcjNWZHVOcnZwZjVVSWxFQTdxMHdkTzJnMVBzd3haelExT1lvSTVuNEo0NWVsY3clM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIyMDg0NTgwNjQiIHRvdGFsPSIyMDg0NTgwNjQiIGRvd25sb2FkX3RpbWVfbXM9IjQwMjk3Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODA3OTQxNDk0MiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgxMzk4MDQ2ODAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg1MTM1Mzc3NDMiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI1NjMiIGRvd25sb2FkX3RpbWVfbXM9IjQ4NjI1IiBkb3dubG9hZGVkPSIyMDg0NTgwNjQiIHRvdGFsPSIyMDg0NTgwNjQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjM3Mzc0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Checks system information in the registry
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zMTUuMTciIHNoZWxsX3ZlcnNpb249IjEuMy4zMTUuMTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RERBNDY5NkEtQjk4Qy00Mzk5LUI3QzQtMzMyNjg3QzFCQzVEfSIgdXNlcmlkPSJ7MTVBNDk2ODMtOUY0NS00MjIzLUEzNTgtQTJDMzQ1QzgyNzUyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2NDVEMkYxOC05NzJDLTRFMzAtQTdBRS1EREE5OEU1RkIxNEJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iRGFkeSBzdXBlciBwb3dlcmZ1bCBQQyIvPjxleHAgZXRhZz0iJnF1b3Q7STBFYWhiNnZJUHBnR2dzRW81L3o3Q21JbE8zcWNFVnJSa3k5b1AyK1dPRT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTU3LjAuNDM0MS40NiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjU5IiBpbnN0YWxsZGF0ZT0iNzE4OSIgY29ob3J0PSJycmZAMC43NSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NTkxOTE0ODU4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzU5MjA3MTM1MSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgxMzk4MDQ2ODAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2Q5ZWM5YmM3LTFiNWUtNGE5Mi05YmExLTQyYzUwNWY3YWRjMD9QMT0xNzk0OTE5MDU5JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUg2S2lqcWJQbmlEbU9PRjRhQ2JEVWNaWHFiYkIydVJqS01HZXVBOUowRzhNeE1XVmdoT0QyNTYzdm1SbDJzU2pSdThXMWZxenZ3UHpBUjlaejNmMjlRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMjA4NDU4MDY0IiB0b3RhbD0iMjA4NDU4MDY0IiBkb3dubG9hZF90aW1lX21zPSI0MTIxOCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgxMzk5NjEyODIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NTEzNTM3NzQzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NzA2MzUwNDgxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNjcyIiBkb3dubG9hZF90aW1lX21zPSI1NDc3MyIgZG93bmxvYWRlZD0iMjA4NDU4MDY0IiB0b3RhbD0iMjA4NDU4MDY0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSIxOTI2NiIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Checks system information in the registry
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "552" "892" "788" "888" "0" "0" "0" "0" "0" "0" "0" "0"2⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
C:\ProgramData\Package Cache\{8173f945-64eb-4aaa-b3a6-cd0137ef08c7}\windowsdesktop-runtime-8.0.20-win-x86.exe"C:\ProgramData\Package Cache\{8173f945-64eb-4aaa-b3a6-cd0137ef08c7}\windowsdesktop-runtime-8.0.20-win-x86.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{8173f945-64eb-4aaa-b3a6-cd0137ef08c7}\windowsdesktop-runtime-8.0.20-win-x86.exe"C:\ProgramData\Package Cache\{8173f945-64eb-4aaa-b3a6-cd0137ef08c7}\windowsdesktop-runtime-8.0.20-win-x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.20_(x86)_20261110123752.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{8173f945-64eb-4aaa-b3a6-cd0137ef08c7}\windowsdesktop-runtime-8.0.20-win-x86.exe"C:\ProgramData\Package Cache\{8173f945-64eb-4aaa-b3a6-cd0137ef08c7}\windowsdesktop-runtime-8.0.20-win-x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8173f945-64eb-4aaa-b3a6-cd0137ef08c7}\windowsdesktop-runtime-8.0.20-win-x86.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.20_(x86)_20261110123752.log"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{8173f945-64eb-4aaa-b3a6-cd0137ef08c7}\windowsdesktop-runtime-8.0.20-win-x86.exe"C:\ProgramData\Package Cache\{8173f945-64eb-4aaa-b3a6-cd0137ef08c7}\windowsdesktop-runtime-8.0.20-win-x86.exe" -q -burn.elevated BurnPipe.{B9C4482F-89BF-4FF6-AD95-5D69B6545F29} {CEE6D3F5-2085-44BB-B5F9-8F59B036DDE4} 23444⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Computers and Structures\SAP2000 27\SAP2000.exe"C:\Program Files\Computers and Structures\SAP2000 27\SAP2000.exe"1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Computers and Structures\SAP2000 27\SAP2000.exe"C:\Program Files\Computers and Structures\SAP2000 27\SAP2000.exe"1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://identity.csiamerica.com/authorize?response_type=code&state=pLlsK8alek3HRFehhkhcJg&code_challenge=ud2ei3P61pSdBP76uqTykcvFwBE3bSI6Q7Adan2BnTo&code_challenge_method=S256&client_id=2R9Zw9Pln5hGYHaJ68wex42zvBOMOWyU&scope=offline_access%20openid%20profile%20email&redirect_uri=http%3A%2F%2Flocalhost%3A1234&audience=https%3A%2F%2Flms.csiamerica.com&auth0Client=eyJuYW1lIjoib2lkYy1uZXQiLCJ2ZXJzaW9uIjoiNC4wLjAiLCJlbnYiOnsicGxhdGZvcm0iOiJ3cGYifX0%3D2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x2d0,0x7ff8377ac188,0x7ff8377ac194,0x7ff8377ac1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,13334151897890572414,6134178547029474930,262144 --field-trial-handle=1960,i,6308834161488924804,7661647440675941769,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,4526847639024358574,4574791947060140006,524288 --field-trial-handle=1960,i,6308834161488924804,7661647440675941769,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,4227902086155999005,7906094327703749754,524288 --field-trial-handle=1960,i,6308834161488924804,7661647440675941769,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,13279301285622722262,16566206115121398653,2097152 --field-trial-handle=1960,i,6308834161488924804,7661647440675941769,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,17552488118698414950,5114094707647583735,2097152 --field-trial-handle=1960,i,6308834161488924804,7661647440675941769,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,18217214486735106024,12748237362977821941,524288 --field-trial-handle=1960,i,6308834161488924804,7661647440675941769,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,16476345491742469287,10332000566293916730,524288 --field-trial-handle=1960,i,6308834161488924804,7661647440675941769,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,296785866175185105,14813515526249405118,524288 --field-trial-handle=1960,i,6308834161488924804,7661647440675941769,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,296785866175185105,14813515526249405118,524288 --field-trial-handle=1960,i,6308834161488924804,7661647440675941769,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:83⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
1File Deletion
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
7System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e5ac5d7.rbs
e5ac5e3.rbs
e5ac5ea.rbs
e5ac5f9.rbs
e5ac600.rbs
e5ac605.rbs
e5ac60f.rbs
e5ac615.rbs
e5ac624.rbs
e5ac628.rbs
e5ac62c.rbs
e5ac630.rbs
e5ac634.rbs
e5ac638.rbs
e5ac63b.rbs
e5ac63f.rbs
e5ac644.rbs
e5ac646.rbf
e5ac649.rbs
e5ac64d.rbs
e5ac651.rbs
e5ac654.rbs
e5ac657.rbs
e5ac774.rbs
e5ac777.rbs
e5ac77b.rbs
e5ac77e.rbs
e5ac83a.rbs
e5ac83f.rbs
e5ac844.rbs
e5ac848.rbs
e5ac84c.rbs
e5ac850.rbs
e5ac852.rbs
msedge_7z.data
setup.exe
CopilotUpdate.exe
SETUP.EX_
MicrosoftEdgeUpdate.exe
LICENSE.txt
ThirdPartyNotices.txt
dotnet.exe
CSI.RegisterLicensing.runtimeconfig.json
SAP2000v1.runtimeconfig.json
SAP2000.exe
Example 2-009b-thin.sdb
Example 2-015b-thin.sdb
Example 5-008d.sdb
dotnet.exe
MicrosoftEdgeUpdate.log
state.rsm
state.rsm
state.rsm
dotnet-hostfxr-8.0.20-win-x64.msi
state.rsm
CSILMS20261110.log
SAP2000v27.ini.back
17aff0a1-0f2e-478a-b184-ce2be43af64d.tmp
683b7f3e-f91f-4fda-b8c8-62bceda4600a.tmp
settings.dat
settings.dat
3f364dc0-62f8-49fe-af2d-df4767b57adf.tmp
7b053629-b1d1-4b6e-b898-4b16744f7af7.tmp
692663a7-72e9-4ef1-9480-44147370e4cb.tmp
496dc6b1-d64b-474d-84f2-0edb60515da1.tmp
66fa9f20-dac4-4835-b6a9-a1ed727e2b64.tmp
sync_diagnostic.log
d2686b0d-fa15-4f6a-b12d-fe0f3fb6023d.tmp
f82ff7e7-5aca-4b46-97ca-0bdd539dccdf.tmp
bee0e514-d9c3-4e7c-be51-d020abb33486.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
MSI329.tmp
dd_vcredist_amd64_20261110123423.log
dd_vcredist_amd64_20261110123423_000_vcRuntimeMinimum_x64.log
dd_vcredist_amd64_20261110123423_001_vcRuntimeAdditional_x64.log
dd_vcredist_x86_20261110123433_000_vcRuntimeMinimum_x86.log
dd_vcredist_x86_20261110123433_001_vcRuntimeAdditional_x86.log
dd_vcredist_x86_20261110123433_001_vcRuntimeAdditional_x86.log
dd_vcredist_x86_20261110123452_000_vcRuntimeMinimum_x86.log
dd_vcredist_x86_20261110123452_001_vcRuntimeAdditional_x86.log
issC45.tmp
InstallerSplash_800_600.bmp
Microsoft .NET 8.0 Desktop Runtime 8.0.20 (x64).prq
Microsoft .NET 8.0 Desktop Runtime 8.0.20 (x86).prq
Microsoft .NET Framework 4.8.1 Full.prq
Microsoft Visual C++ 2022 Redistributable Package (x64) 14.40.33810.0.prq
Microsoft Visual C++ 2022 Redistributable Package (x86) 14.40.33810.0.prq
WebView2Bootstrapper.prq
_ISMSIDEL.INI
_ISMSIDEL.INI
_ISMSIDEL.INI
_ISMSIDEL.INI
_ISMSIDEL.INI
_ISMSIDEL.INI
VC_redist.x86.exe
0x0409.ini
_ISMSIDEL.INI
_ISMSIDEL.INI
_ISMSIDEL.INI
_ISMSIDEL.INI
_ISMSIDEL.INI
_ISMSIDEL.INI
_ISMSIDEL.INI
_ISMSIDEL.INI
_ISMSIDEL.INI
_ISMSIDEL.INI
VC_redist.x64.exe
_is9D76.exe
MicrosoftEdgeWebview2Setup.exe
IsConfig.ini
~3EC1.tmp
fileCoreHostExe
MSI43C8.tmp
e5ac629.msi
e5ac64a.msi
BootstrapperApplicationData.xml
VC_redist.x86.exe
BootstrapperApplicationData.xml
BootstrapperApplicationData.xml
thm.wxl
thm.xml
wixstdba.dll
windowsdesktop-runtime-8.0.20-win-x86.exe
BootstrapperApplicationData.xml
cab54A5CABBE7274D8A22EB58060AAB7623
cabB3E1576D1FEFBB979E13B1A5379E0B16
vcRuntimeAdditional_x86
vcRuntimeMinimum_x86
BootstrapperApplicationData.xml
logo.png
wixstdba.dll
cab2C04DDC374BD96EB5C8EB8208F2C7C92
cab5046A8AB272BF37297BB7928664C9503
vcRuntimeAdditional_x64
vcRuntimeMinimum_x64
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
thm.wxl
eula.rtf
bg.png
windowsdesktop-runtime-8.0.20-win-x64.exe
BootstrapperApplicationData.xml
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
VC_redist.x64.exe
license.rtf
thm.wxl
thm.xml
memory/684-2604-0x0000000000180000-0x00000000001F6000-memory.dmp
memory/1232-2603-0x0000000000180000-0x00000000001F6000-memory.dmp
memory/1440-2601-0x0000000000180000-0x00000000001F6000-memory.dmp
memory/1780-515-0x0000000000390000-0x0000000000407000-memory.dmp
memory/2224-4137-0x0000000002FC0000-0x0000000003187000-memory.dmp
memory/2532-894-0x0000000000DB0000-0x0000000000E27000-memory.dmp
memory/3344-3159-0x00000000001A0000-0x00000000001D5000-memory.dmp
memory/3344-2995-0x0000000073020000-0x00000000732A1000-memory.dmp
memory/3344-2989-0x0000000073020000-0x00000000732A1000-memory.dmp
memory/3344-2988-0x00000000001A0000-0x00000000001D5000-memory.dmp
memory/3524-895-0x0000000000DB0000-0x0000000000E27000-memory.dmp
memory/3836-2590-0x0000000000180000-0x00000000001F6000-memory.dmp
memory/4152-896-0x0000000000DB0000-0x0000000000E27000-memory.dmp
memory/4540-4146-0x0000000003280000-0x0000000003447000-memory.dmp
memory/4684-2589-0x0000000000180000-0x00000000001F6000-memory.dmp
memory/5036-517-0x0000000000390000-0x0000000000407000-memory.dmp
memory/5092-2573-0x0000000000180000-0x00000000001F6000-memory.dmp
memory/5108-891-0x0000000000DB0000-0x0000000000E27000-memory.dmp
memory/5396-2570-0x0000000000180000-0x00000000001F6000-memory.dmp
memory/5484-2572-0x0000000000180000-0x00000000001F6000-memory.dmp
memory/5560-518-0x0000000000390000-0x0000000000407000-memory.dmp
memory/5748-892-0x0000000000DB0000-0x0000000000E27000-memory.dmp
memory/5772-2587-0x0000000000180000-0x00000000001F6000-memory.dmp