Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe

"C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\DevComponents.DotNetBar2.dll"

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe

"C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbConnect.dll"

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe

"C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbExpress.exe"

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe

"C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ArbLib.dll"

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe

"C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\DisplayComponent.dll"

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe

"C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\PreviewComponent.dll"

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\dotnetinstaller.exe

"C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\DotNetInstaller.exe" "C:\Program Files (x86)\Tektronix\ArbExpress\System\ScopeAcqPages.dll"

C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe

"C:\Users\user\Desktop\ArbExpress_V3.6_en_0703_066146106.exe"

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe

C:\Users\user\AppData\Local\Temp\{D087C162-559C-4D68-B967-62FB89959971}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A3681F74-C246-4C16-9456-61CA4AC85351}

C:\Windows\System32\SrTasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\cmd.exe /c cacls "C:\Program Files (x86)\Tektronix\ArbExpress" /T /E /G Users:F

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Program Files (x86)\Tektronix\ArbExpress" /T /E /G Users:F

There are 11 hidden processes, click here to show them.

URLs

Name

Malicious

http://fontawesome.ioWebfont

unknown

http://deviis4.installshield.com/NetNirvana/data2.cabDisk1

unknown

http://www.Tektronix.com

unknown

http://www.Tektronix.comID_STRING30ID_STRING35ID_STRING31ID_STRING32ID_STRING33ID_STRING34

unknown

http://deviis4.installshield.com/NetNirvana/

unknown

http://www.tek.com/contact)

unknown

http://www.devcomponents.comAmailto:support

unknown

http://ocsp.veri

unknown

http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d

unknown

http://www.flexerasoftware.com0

unknown

http://www.tek.com

unknown

http://www.devcomponents.comKSystem.Windows.Forms.ContextMenuStrip

unknown

http://www.Tektronix.com/Measurement/cgi-bin/framed.pl?Document=/Measurement/signal_sources/home.htm

unknown

http://www.devcomponents.com/dotnetbar/order.html

unknown

https://HuF.?AVfile_exception

unknown

There are 5 hidden URLs, click here to show them.

Domains

Name

Malicious

206.23.85.13.in-addr.arpa

unknown

197.87.175.4.in-addr.arpa

unknown

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656

Blob

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SystemRestore\Setup_Last

AoACAPIError

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SystemRestore\Setup_Last

AoACAPIResult

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore

FirstRun

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore

LastIndex

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile

NestingLevel

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile

StartNesting

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SystemRestore

SRInitDone

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore

SrCreateRp (Enter)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore

SrCreateRp (Leave)

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

ModifyPath

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

NoModify

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

NoRepair

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

UninstallString

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

LogFile

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

InstallLocation

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

ProductGuid

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

InstallSource

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

DisplayName

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

Publisher

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

URLInfoAbout

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

Contact

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

HelpLink

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

HelpTelephone

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

Readme

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

URLUpdateInfo

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

Comments

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

RegOwner

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

DisplayIcon

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

InstallDate

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

Language

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

DisplayVersion

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

Version

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

VersionMajor

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

VersionMinor

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

LogMode

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ArbExpress.exe

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ArbExpress.exe

Path

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Tektronix\ArbExpress

ServicePack

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wfm

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ArbExpress.Document

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ArbExpress.Document\DefaultIcon

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ArbExpress.Document\Shell\open\Command

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.tfw

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ArbExpress.DocumentTFW

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ArbExpress.DocumentTFW\DefaultIcon

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ArbExpress.DocumentTFW\Shell\open\Command

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore

RPSessionInterval

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore

LastIndex

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile

NestingLevel

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile

StartNesting

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

DisplayName

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5045756C-7552-4E48-B39F-C28A48E4EACD}

Publisher

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile

NestingLevel