10647efd97707c2a8e1a75437e80d44950f3cbb9bae87b2c6bcc50cee02ff272

Analysis

max time kernel
145s
max time network
123s
platform
windows10_x64
resource
win10v20201028
submitted
25-02-2021 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

veraport-g3-x64.exe
Size

6.5MB
MD5

9d7340464cc05a959f51bb8fd74c5dee
SHA1

249e3d40962183c154647d2c1d1d444589895584
SHA256

10647efd97707c2a8e1a75437e80d44950f3cbb9bae87b2c6bcc50cee02ff272
SHA512

d23628df67eed460227e8f3fb63ebb8996003b118171c78145ba43c73b49c25a2592c10aaa672e965ac0df9a25ea68f5781cc4a50dc112117c4b8d750f9b3085

Score

10^/10

discovery evasion persistence spyware

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Executes dropped EXE 23 IoCs

Processes:

veraport-g3-x64.tmpveraport20unloader.exeveraport20unloader.exewizveraregsvr.exewizcertutil.execertutil.execertutil.execertutil.execertutil.execertutil.execertutil.execertutil.execertutil.execertutil.execertutil.execertutil.execertutil.exewpmsvcsetup.exewpmsvcsetup.tmpWizSvcUtil.exewpmsvc.exewpmsvc.exeveraport-x64.exe

pid	process
3924	veraport-g3-x64.tmp
3648	veraport20unloader.exe
2128	veraport20unloader.exe
3804	wizveraregsvr.exe
3592	wizcertutil.exe
2200	certutil.exe
1888	certutil.exe
3648	certutil.exe
3880	certutil.exe
3144	certutil.exe
3900	certutil.exe
1852	certutil.exe
3412	certutil.exe
3272	certutil.exe
1260	certutil.exe
2720	certutil.exe
3532	certutil.exe
4040	wpmsvcsetup.exe
1184	wpmsvcsetup.tmp
2612	WizSvcUtil.exe
1388	wpmsvc.exe
2644	wpmsvc.exe
3876	veraport-x64.exe

Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wpmsvc.exewpmsvc.exeWizSvcUtil.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wpmsvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	wpmsvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wpmsvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	wpmsvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WizSvcUtil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WizSvcUtil.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

WizSvcUtil.exewpmsvc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Wine	WizSvcUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Wine	wpmsvc.exe

Loads dropped DLL 64 IoCs

Processes:

regsvr32.exewizveraregsvr.execertutil.execertutil.execertutil.execertutil.execertutil.exe

pid	process
3912	regsvr32.exe
3804	wizveraregsvr.exe
2200	certutil.exe
2200	certutil.exe
2200	certutil.exe
2200	certutil.exe
2200	certutil.exe
2200	certutil.exe
2200	certutil.exe
2200	certutil.exe
2200	certutil.exe
2200	certutil.exe
2200	certutil.exe
2200	certutil.exe
2200	certutil.exe
1888	certutil.exe
1888	certutil.exe
1888	certutil.exe
1888	certutil.exe
1888	certutil.exe
1888	certutil.exe
1888	certutil.exe
1888	certutil.exe
1888	certutil.exe
1888	certutil.exe
1888	certutil.exe
1888	certutil.exe
1888	certutil.exe
1888	certutil.exe
1888	certutil.exe
3648	certutil.exe
3648	certutil.exe
3648	certutil.exe
3648	certutil.exe
3648	certutil.exe
3648	certutil.exe
3648	certutil.exe
3648	certutil.exe
3648	certutil.exe
3648	certutil.exe
3648	certutil.exe
3648	certutil.exe
3648	certutil.exe
3648	certutil.exe
3648	certutil.exe
3880	certutil.exe
3880	certutil.exe
3880	certutil.exe
3880	certutil.exe
3880	certutil.exe
3880	certutil.exe
3880	certutil.exe
3880	certutil.exe
3880	certutil.exe
3880	certutil.exe
3144	certutil.exe
3144	certutil.exe
3144	certutil.exe
3144	certutil.exe
3144	certutil.exe
3144	certutil.exe
3144	certutil.exe
3144	certutil.exe
3144	certutil.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

veraport-g3-x64.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	veraport-g3-x64.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wizvera-veraport-x64 = "\"C:\\Program Files\\Wizvera\\Veraport20\\veraport-x64.exe\" wizvera-veraport://exec/x86/16105/"	veraport-g3-x64.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

WizSvcUtil.exewpmsvc.exewpmsvc.exe

pid process

2612 WizSvcUtil.exe
1388 wpmsvc.exe
2644 wpmsvc.exe

pid	process
2612	WizSvcUtil.exe
1388	wpmsvc.exe
2644	wpmsvc.exe

Drops file in Program Files directory 14 IoCs

Processes:

veraport-g3-x64.tmpwpmsvcsetup.tmp

description	ioc	process
File created	C:\Program Files\Wizvera\Veraport20\unins000.dat	veraport-g3-x64.tmp
File created	C:\Program Files\Wizvera\Veraport20\is-PNFUB.tmp	veraport-g3-x64.tmp
File created	C:\Program Files\Wizvera\Veraport20\is-VVCQJ.tmp	veraport-g3-x64.tmp
File created	C:\Program Files\Wizvera\Veraport20\is-FAG4M.tmp	veraport-g3-x64.tmp
File opened for modification	C:\Program Files\Wizvera\Veraport20\unins000.dat	veraport-g3-x64.tmp
File created	C:\Program Files (x86)\Wizvera\Common\wpmsvc\is-20TER.tmp	wpmsvcsetup.tmp
File created	C:\Program Files\Wizvera\Veraport20\is-9V696.tmp	veraport-g3-x64.tmp
File created	C:\Program Files\Wizvera\Veraport20\is-KC0HE.tmp	veraport-g3-x64.tmp
File created	C:\Program Files (x86)\Wizvera\Common\wpmsvc\is-7H561.tmp	wpmsvcsetup.tmp
File opened for modification	C:\Program Files (x86)\Wizvera\Common\wpmsvc\unins000.dat	wpmsvcsetup.tmp
File created	C:\Program Files\Wizvera\Veraport20\is-DHLS5.tmp	veraport-g3-x64.tmp
File created	C:\Program Files\Wizvera\Veraport20\is-EQR1V.tmp	veraport-g3-x64.tmp
File created	C:\Program Files (x86)\Wizvera\Common\wpmsvc\unins000.dat	wpmsvcsetup.tmp
File created	C:\Program Files (x86)\Wizvera\Common\wpmsvc\is-H8IM4.tmp	wpmsvcsetup.tmp

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 42 IoCs

Processes:

wpmsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	wpmsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	wpmsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	wpmsvc.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exewizveraregsvr.exeveraport-g3-x64.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\veraport20.Veraport20Ctl.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\InprocServer32	wizveraregsvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\LocalizedString = "@C:\\Program Files\\Wizvera\\Veraport20\\veraport20.dll,-101"	wizveraregsvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\Elevation	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D913D1E4-A4B3-4826-A81E-C4CE32FACFDE}\TypeLib\Version = "1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	wizveraregsvr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\VersionIndependentProgID	wizveraregsvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\Programmable	wizveraregsvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D913D1E4-A4B3-4826-A81E-C4CE32FACFDE}\ = "IVeraport20Ctl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\MiscStatus\1	wizveraregsvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\ToolboxBitmap32	wizveraregsvr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\Control	wizveraregsvr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}	wizveraregsvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\VersionIndependentProgID	wizveraregsvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\VersionIndependentProgID\ = "veraport20.Veraport20Ctl"	wizveraregsvr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\InprocServer32	wizveraregsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\Elevation\Enabled = "1"	wizveraregsvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\veraport20.Veraport20Ctl.1\CLSID\ = "{477D5B9A-6479-44F8-9718-9340119B0308}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D913D1E4-A4B3-4826-A81E-C4CE32FACFDE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D913D1E4-A4B3-4826-A81E-C4CE32FACFDE}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D913D1E4-A4B3-4826-A81E-C4CE32FACFDE}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\Implemented Categories	wizveraregsvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\AppID	wizveraregsvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wizvera-veraport-x64\shell\open\command\ = "\"C:\\Program Files\\Wizvera\\Veraport20\\veraport-x64.exe\" \"%1\""	veraport-g3-x64.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D913D1E4-A4B3-4826-A81E-C4CE32FACFDE}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D913D1E4-A4B3-4826-A81E-C4CE32FACFDE}\TypeLib\ = "{FC9D3F26-BCA4-413A-A265-D8371C2CFEB8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\veraport20.Veraport20Ctl\CLSID\ = "{477D5B9A-6479-44F8-9718-9340119B0308}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC9D3F26-BCA4-413A-A265-D8371C2CFEB8}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\InprocServer32\ThreadingModel = "Apartment"	wizveraregsvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\Control	wizveraregsvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wizvera-veraport-x64\DefaultIcon = "veraport.exe,1"	veraport-g3-x64.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\InprocServer32\ = "C:\\Program Files\\Wizvera\\Veraport20\\veraport20.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC9D3F26-BCA4-413A-A265-D8371C2CFEB8}\1.0\FLAGS\ = "0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\Programmable	wizveraregsvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\VersionIndependentProgID\ = "veraport20.Veraport20Ctl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D913D1E4-A4B3-4826-A81E-C4CE32FACFDE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\veraport20.Veraport20Ctl.1\CLSID\ = "{477D5B9A-6479-44F8-9718-9340119B0308}"	wizveraregsvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\ = "Veraport20Ctl Class"	wizveraregsvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\ProgID\ = "veraport20.Veraport20Ctl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D913D1E4-A4B3-4826-A81E-C4CE32FACFDE}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\veraport20.Veraport20Ctl\ = "Veraport20Ctl Class"	wizveraregsvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wizvera-veraport-x64	veraport-g3-x64.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\MiscStatus\1\ = "131473"	wizveraregsvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\ProgID	wizveraregsvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\veraport20.Veraport20Ctl	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\AppID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\LocalizedString = "@C:\\Program Files\\Wizvera\\Veraport20\\veraport20.dll,-101"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC9D3F26-BCA4-413A-A265-D8371C2CFEB8}\1.0\ = "veraport20 1.0 Çü½Ä ¶óÀÌºê·¯¸®"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\veraport20.Veraport20Ctl\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	wizveraregsvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D913D1E4-A4B3-4826-A81E-C4CE32FACFDE}\ = "IVeraport20Ctl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D913D1E4-A4B3-4826-A81E-C4CE32FACFDE}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\ProgID\ = "veraport20.Veraport20Ctl.1"	wizveraregsvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\InprocServer32\ = "C:\\Program Files\\Wizvera\\Veraport20\\veraport20.dll"	wizveraregsvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\veraport20.Veraport20Ctl\ = "Veraport20Ctl Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308}\ = "Veraport20Ctl Class"	regsvr32.exe

Modifies system certificate store 2 TTPs 17 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

wizcertutil.exewpmsvc.exeveraport-x64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\04C604DDC5D3D37B389D086FFF0DEAE0FD9F52A0	wizcertutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\04C604DDC5D3D37B389D086FFF0DEAE0FD9F52A0\Blob = 19000000010000001000000033f679ed86b18586d8c7c38d19b454b40f0000000100000014000000ed29bda8c145d03315d8492c6159cd508c36a08003000000010000001400000004c604ddc5d3d37b389d086fff0deae0fd9f52a01400000001000000140000001441f9f6d847d7ba9ce339e9b1ee12ec7d42af21200000000100000057030000308203533082023ba003020102021474b7009ee43bc78fce6973ade1da8b18c5e8725a300d06092a864886f70d01010505003039310b3009060355040613024b523110300e060355040a0c0757495a564552413118301606035504030c0f57495a564552412d43412d53484131301e170d3139313032333033303533335a170d3430303530353033303533335a3039310b3009060355040613024b523110300e060355040a0c0757495a564552413118301606035504030c0f57495a564552412d43412d5348413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c27feb98a564b360a80aaa5b9fe67416af79858286a82f1f61355b1435df90f9a6f7da8700c3188a702eac88c4ea781d468c34ba4150877b0c975f12d6b24fbd36b9296460bb6aa8e01d983c9e4bafda06db4fe05ddbf067fab1cc6a26c93f009fe347924a04da2a3e3878061b5466031afcdcae5ce040afb2be5980adb61da7537df90eb5d2d1809e0c5fc97d64656526ebece124fa927886fcc8653b3a205d639914506c2918f2a73a5e378687a850e5437698ce72d3b880d2e27b9412fa84bd77a4f2216ddc795288319eec534651ad2386cf81c818ecaeadaabfad971c223c435ac15ba3aff4e082be65a5b36be8e9321bba67175ee4ef9da9f08612243f0203010001a3533051301d0603551d0e041604141441f9f6d847d7ba9ce339e9b1ee12ec7d42af21301f0603551d230418301680141441f9f6d847d7ba9ce339e9b1ee12ec7d42af21300f0603551d130101ff040530030101ff300d06092a864886f70d010105050003820101007a88b369c2d691d240e5dfdcbfd66d5b5f203c2da103461a8fd15353921074cfd0dfdd0ed2a0491e367dc0b6a9e3db3c12a379fa78b5f5830dc9ebb03c07acd96f0c6410f7299a5fada79b3afb60d412c701a7a22e7ef21e5b4776100da45a46eb2365fad67ebaa2502a5e6e8e9db94c46d259f6946f99a8897f125c0b87ba5ae3206c4b5d5f15b720d0b5016f7455092d10137fa4a8b6fa618373ba9a44f3902fd5d376ebc4855f6792fc6d5e3285311525774bb400c4efef64645957ba75a1282a9d594b89dca9d826afce9a280197649c691b00b67a214c2fa2df058c5272eb0b85658053ce80a90dbaa17551ab8541818be149304ca4b424b160f20cd91e	wpmsvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	veraport-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9DE8690DAECF18B1A4ACD2B7CEE9B35FBBA2DDC4	wizcertutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9DE8690DAECF18B1A4ACD2B7CEE9B35FBBA2DDC4\Blob = 0300000001000000140000009de8690daecf18b1a4acd2b7cee9b35fbba2ddc4200000000100000057030000308203533082023ba003020102021420bbeb748527aeaa25fb381926de8dc207102b71300d06092a864886f70d01010b05003039310b3009060355040613024b523110300e060355040a0c0757495a564552413118301606035504030c0f57495a564552412d43412d53484132301e170d3139313032333033303430385a170d3430303530353033303430385a3039310b3009060355040613024b523110300e060355040a0c0757495a564552413118301606035504030c0f57495a564552412d43412d5348413230820122300d06092a864886f70d01010105000382010f003082010a0282010100f3da060f38568f5a6d95f2eba256cf4cdbba97fd6604e73aefc899187c2dd8d1f1c0fa8f8c4fc69a05afe6e4b7964f61c3b67b76f5d2ff73f9d7a013cab9160a94e6442f14cd79e8ae208288745c0f63280c756dcf23d381bad6ee6c17fc04ef5132516dd7274132b87dafb519e16338aaffddda20848430eece2f4ce7b877f16738404db86cf2b1ddeded08388f90e6507261b8f07669b17fe2b5f7971411ad07017541ea53a4e6fd28bf822e4a66855afb87c070b8d1ee1ff90dec14aa462fedb5b17439ca7a9b90221ed54c66f4d8e217acb686b3f5f0306538e8ace848185ccae2f82838d7fa35813de7d32af420a9f540e1645de795c98b77db8c6f42670203010001a3533051301d0603551d0e0416041455e94876be082d97c6565a550ba7b4104b14f6a2301f0603551d2304183016801455e94876be082d97c6565a550ba7b4104b14f6a2300f0603551d130101ff040530030101ff300d06092a864886f70d01010b05000382010100422038356b429ed7b115c75c6c6eb16362c0f6f9747d772e4e4b2ec23d61c1750bf0b58210b6006198f0669505871a5f04078c3a35f90aafc4d3926638d8589c2c413b944846947c49935022990b0631f3735649bfca8253bc5858b298320fe2aa363d6be9f878f888a3e416a13abfb57d54d9392e4e778e71559e36ef5a918a156be2a6c868fc7b9afd9f7851a7faeedc882a39886502b623daacaa50165ed964f323184e6c982b79c5dd915a5df5ad3d260a65011a3cc3ddc28fe8d3bd38608daed8218d6002ef9a53a53c70bd2a75509847d78e4b33e7a1d048dd844651e191d563b95d3fbea0fc1c3ff1f28508c85f1c846d773ecc9feeeed6e9e47f37b5	wizcertutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\04C604DDC5D3D37B389D086FFF0DEAE0FD9F52A0\Blob = 03000000010000001400000004c604ddc5d3d37b389d086fff0deae0fd9f52a0200000000100000057030000308203533082023ba003020102021474b7009ee43bc78fce6973ade1da8b18c5e8725a300d06092a864886f70d01010505003039310b3009060355040613024b523110300e060355040a0c0757495a564552413118301606035504030c0f57495a564552412d43412d53484131301e170d3139313032333033303533335a170d3430303530353033303533335a3039310b3009060355040613024b523110300e060355040a0c0757495a564552413118301606035504030c0f57495a564552412d43412d5348413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c27feb98a564b360a80aaa5b9fe67416af79858286a82f1f61355b1435df90f9a6f7da8700c3188a702eac88c4ea781d468c34ba4150877b0c975f12d6b24fbd36b9296460bb6aa8e01d983c9e4bafda06db4fe05ddbf067fab1cc6a26c93f009fe347924a04da2a3e3878061b5466031afcdcae5ce040afb2be5980adb61da7537df90eb5d2d1809e0c5fc97d64656526ebece124fa927886fcc8653b3a205d639914506c2918f2a73a5e378687a850e5437698ce72d3b880d2e27b9412fa84bd77a4f2216ddc795288319eec534651ad2386cf81c818ecaeadaabfad971c223c435ac15ba3aff4e082be65a5b36be8e9321bba67175ee4ef9da9f08612243f0203010001a3533051301d0603551d0e041604141441f9f6d847d7ba9ce339e9b1ee12ec7d42af21301f0603551d230418301680141441f9f6d847d7ba9ce339e9b1ee12ec7d42af21300f0603551d130101ff040530030101ff300d06092a864886f70d010105050003820101007a88b369c2d691d240e5dfdcbfd66d5b5f203c2da103461a8fd15353921074cfd0dfdd0ed2a0491e367dc0b6a9e3db3c12a379fa78b5f5830dc9ebb03c07acd96f0c6410f7299a5fada79b3afb60d412c701a7a22e7ef21e5b4776100da45a46eb2365fad67ebaa2502a5e6e8e9db94c46d259f6946f99a8897f125c0b87ba5ae3206c4b5d5f15b720d0b5016f7455092d10137fa4a8b6fa618373ba9a44f3902fd5d376ebc4855f6792fc6d5e3285311525774bb400c4efef64645957ba75a1282a9d594b89dca9d826afce9a280197649c691b00b67a214c2fa2df058c5272eb0b85658053ce80a90dbaa17551ab8541818be149304ca4b424b160f20cd91e	wizcertutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9DE8690DAECF18B1A4ACD2B7CEE9B35FBBA2DDC4\Blob = 0f0000000100000020000000305d8552cda90543300c4b19400d9f469a9000f0a13d21c167734e20b17fa2c50300000001000000140000009de8690daecf18b1a4acd2b7cee9b35fbba2ddc4200000000100000057030000308203533082023ba003020102021420bbeb748527aeaa25fb381926de8dc207102b71300d06092a864886f70d01010b05003039310b3009060355040613024b523110300e060355040a0c0757495a564552413118301606035504030c0f57495a564552412d43412d53484132301e170d3139313032333033303430385a170d3430303530353033303430385a3039310b3009060355040613024b523110300e060355040a0c0757495a564552413118301606035504030c0f57495a564552412d43412d5348413230820122300d06092a864886f70d01010105000382010f003082010a0282010100f3da060f38568f5a6d95f2eba256cf4cdbba97fd6604e73aefc899187c2dd8d1f1c0fa8f8c4fc69a05afe6e4b7964f61c3b67b76f5d2ff73f9d7a013cab9160a94e6442f14cd79e8ae208288745c0f63280c756dcf23d381bad6ee6c17fc04ef5132516dd7274132b87dafb519e16338aaffddda20848430eece2f4ce7b877f16738404db86cf2b1ddeded08388f90e6507261b8f07669b17fe2b5f7971411ad07017541ea53a4e6fd28bf822e4a66855afb87c070b8d1ee1ff90dec14aa462fedb5b17439ca7a9b90221ed54c66f4d8e217acb686b3f5f0306538e8ace848185ccae2f82838d7fa35813de7d32af420a9f540e1645de795c98b77db8c6f42670203010001a3533051301d0603551d0e0416041455e94876be082d97c6565a550ba7b4104b14f6a2301f0603551d2304183016801455e94876be082d97c6565a550ba7b4104b14f6a2300f0603551d130101ff040530030101ff300d06092a864886f70d01010b05000382010100422038356b429ed7b115c75c6c6eb16362c0f6f9747d772e4e4b2ec23d61c1750bf0b58210b6006198f0669505871a5f04078c3a35f90aafc4d3926638d8589c2c413b944846947c49935022990b0631f3735649bfca8253bc5858b298320fe2aa363d6be9f878f888a3e416a13abfb57d54d9392e4e778e71559e36ef5a918a156be2a6c868fc7b9afd9f7851a7faeedc882a39886502b623daacaa50165ed964f323184e6c982b79c5dd915a5df5ad3d260a65011a3cc3ddc28fe8d3bd38608daed8218d6002ef9a53a53c70bd2a75509847d78e4b33e7a1d048dd844651e191d563b95d3fbea0fc1c3ff1f28508c85f1c846d773ecc9feeeed6e9e47f37b5	wpmsvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	veraport-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9DE8690DAECF18B1A4ACD2B7CEE9B35FBBA2DDC4	wpmsvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\04C604DDC5D3D37B389D086FFF0DEAE0FD9F52A0\Blob = 0f0000000100000014000000ed29bda8c145d03315d8492c6159cd508c36a08003000000010000001400000004c604ddc5d3d37b389d086fff0deae0fd9f52a0200000000100000057030000308203533082023ba003020102021474b7009ee43bc78fce6973ade1da8b18c5e8725a300d06092a864886f70d01010505003039310b3009060355040613024b523110300e060355040a0c0757495a564552413118301606035504030c0f57495a564552412d43412d53484131301e170d3139313032333033303533335a170d3430303530353033303533335a3039310b3009060355040613024b523110300e060355040a0c0757495a564552413118301606035504030c0f57495a564552412d43412d5348413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c27feb98a564b360a80aaa5b9fe67416af79858286a82f1f61355b1435df90f9a6f7da8700c3188a702eac88c4ea781d468c34ba4150877b0c975f12d6b24fbd36b9296460bb6aa8e01d983c9e4bafda06db4fe05ddbf067fab1cc6a26c93f009fe347924a04da2a3e3878061b5466031afcdcae5ce040afb2be5980adb61da7537df90eb5d2d1809e0c5fc97d64656526ebece124fa927886fcc8653b3a205d639914506c2918f2a73a5e378687a850e5437698ce72d3b880d2e27b9412fa84bd77a4f2216ddc795288319eec534651ad2386cf81c818ecaeadaabfad971c223c435ac15ba3aff4e082be65a5b36be8e9321bba67175ee4ef9da9f08612243f0203010001a3533051301d0603551d0e041604141441f9f6d847d7ba9ce339e9b1ee12ec7d42af21301f0603551d230418301680141441f9f6d847d7ba9ce339e9b1ee12ec7d42af21300f0603551d130101ff040530030101ff300d06092a864886f70d010105050003820101007a88b369c2d691d240e5dfdcbfd66d5b5f203c2da103461a8fd15353921074cfd0dfdd0ed2a0491e367dc0b6a9e3db3c12a379fa78b5f5830dc9ebb03c07acd96f0c6410f7299a5fada79b3afb60d412c701a7a22e7ef21e5b4776100da45a46eb2365fad67ebaa2502a5e6e8e9db94c46d259f6946f99a8897f125c0b87ba5ae3206c4b5d5f15b720d0b5016f7455092d10137fa4a8b6fa618373ba9a44f3902fd5d376ebc4855f6792fc6d5e3285311525774bb400c4efef64645957ba75a1282a9d594b89dca9d826afce9a280197649c691b00b67a214c2fa2df058c5272eb0b85658053ce80a90dbaa17551ab8541818be149304ca4b424b160f20cd91e	wpmsvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\04C604DDC5D3D37B389D086FFF0DEAE0FD9F52A0\Blob = 1400000001000000140000001441f9f6d847d7ba9ce339e9b1ee12ec7d42af2103000000010000001400000004c604ddc5d3d37b389d086fff0deae0fd9f52a00f0000000100000014000000ed29bda8c145d03315d8492c6159cd508c36a080200000000100000057030000308203533082023ba003020102021474b7009ee43bc78fce6973ade1da8b18c5e8725a300d06092a864886f70d01010505003039310b3009060355040613024b523110300e060355040a0c0757495a564552413118301606035504030c0f57495a564552412d43412d53484131301e170d3139313032333033303533335a170d3430303530353033303533335a3039310b3009060355040613024b523110300e060355040a0c0757495a564552413118301606035504030c0f57495a564552412d43412d5348413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c27feb98a564b360a80aaa5b9fe67416af79858286a82f1f61355b1435df90f9a6f7da8700c3188a702eac88c4ea781d468c34ba4150877b0c975f12d6b24fbd36b9296460bb6aa8e01d983c9e4bafda06db4fe05ddbf067fab1cc6a26c93f009fe347924a04da2a3e3878061b5466031afcdcae5ce040afb2be5980adb61da7537df90eb5d2d1809e0c5fc97d64656526ebece124fa927886fcc8653b3a205d639914506c2918f2a73a5e378687a850e5437698ce72d3b880d2e27b9412fa84bd77a4f2216ddc795288319eec534651ad2386cf81c818ecaeadaabfad971c223c435ac15ba3aff4e082be65a5b36be8e9321bba67175ee4ef9da9f08612243f0203010001a3533051301d0603551d0e041604141441f9f6d847d7ba9ce339e9b1ee12ec7d42af21301f0603551d230418301680141441f9f6d847d7ba9ce339e9b1ee12ec7d42af21300f0603551d130101ff040530030101ff300d06092a864886f70d010105050003820101007a88b369c2d691d240e5dfdcbfd66d5b5f203c2da103461a8fd15353921074cfd0dfdd0ed2a0491e367dc0b6a9e3db3c12a379fa78b5f5830dc9ebb03c07acd96f0c6410f7299a5fada79b3afb60d412c701a7a22e7ef21e5b4776100da45a46eb2365fad67ebaa2502a5e6e8e9db94c46d259f6946f99a8897f125c0b87ba5ae3206c4b5d5f15b720d0b5016f7455092d10137fa4a8b6fa618373ba9a44f3902fd5d376ebc4855f6792fc6d5e3285311525774bb400c4efef64645957ba75a1282a9d594b89dca9d826afce9a280197649c691b00b67a214c2fa2df058c5272eb0b85658053ce80a90dbaa17551ab8541818be149304ca4b424b160f20cd91e	wpmsvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	veraport-x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	veraport-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\04C604DDC5D3D37B389D086FFF0DEAE0FD9F52A0	wpmsvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9DE8690DAECF18B1A4ACD2B7CEE9B35FBBA2DDC4\Blob = 14000000010000001400000055e94876be082d97c6565a550ba7b4104b14f6a20300000001000000140000009de8690daecf18b1a4acd2b7cee9b35fbba2ddc40f0000000100000020000000305d8552cda90543300c4b19400d9f469a9000f0a13d21c167734e20b17fa2c5200000000100000057030000308203533082023ba003020102021420bbeb748527aeaa25fb381926de8dc207102b71300d06092a864886f70d01010b05003039310b3009060355040613024b523110300e060355040a0c0757495a564552413118301606035504030c0f57495a564552412d43412d53484132301e170d3139313032333033303430385a170d3430303530353033303430385a3039310b3009060355040613024b523110300e060355040a0c0757495a564552413118301606035504030c0f57495a564552412d43412d5348413230820122300d06092a864886f70d01010105000382010f003082010a0282010100f3da060f38568f5a6d95f2eba256cf4cdbba97fd6604e73aefc899187c2dd8d1f1c0fa8f8c4fc69a05afe6e4b7964f61c3b67b76f5d2ff73f9d7a013cab9160a94e6442f14cd79e8ae208288745c0f63280c756dcf23d381bad6ee6c17fc04ef5132516dd7274132b87dafb519e16338aaffddda20848430eece2f4ce7b877f16738404db86cf2b1ddeded08388f90e6507261b8f07669b17fe2b5f7971411ad07017541ea53a4e6fd28bf822e4a66855afb87c070b8d1ee1ff90dec14aa462fedb5b17439ca7a9b90221ed54c66f4d8e217acb686b3f5f0306538e8ace848185ccae2f82838d7fa35813de7d32af420a9f540e1645de795c98b77db8c6f42670203010001a3533051301d0603551d0e0416041455e94876be082d97c6565a550ba7b4104b14f6a2301f0603551d2304183016801455e94876be082d97c6565a550ba7b4104b14f6a2300f0603551d130101ff040530030101ff300d06092a864886f70d01010b05000382010100422038356b429ed7b115c75c6c6eb16362c0f6f9747d772e4e4b2ec23d61c1750bf0b58210b6006198f0669505871a5f04078c3a35f90aafc4d3926638d8589c2c413b944846947c49935022990b0631f3735649bfca8253bc5858b298320fe2aa363d6be9f878f888a3e416a13abfb57d54d9392e4e778e71559e36ef5a918a156be2a6c868fc7b9afd9f7851a7faeedc882a39886502b623daacaa50165ed964f323184e6c982b79c5dd915a5df5ad3d260a65011a3cc3ddc28fe8d3bd38608daed8218d6002ef9a53a53c70bd2a75509847d78e4b33e7a1d048dd844651e191d563b95d3fbea0fc1c3ff1f28508c85f1c846d773ecc9feeeed6e9e47f37b5	wpmsvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9DE8690DAECF18B1A4ACD2B7CEE9B35FBBA2DDC4\Blob = 190000000100000010000000c94ae95612b49497def648c8be0d81020f0000000100000020000000305d8552cda90543300c4b19400d9f469a9000f0a13d21c167734e20b17fa2c50300000001000000140000009de8690daecf18b1a4acd2b7cee9b35fbba2ddc414000000010000001400000055e94876be082d97c6565a550ba7b4104b14f6a2200000000100000057030000308203533082023ba003020102021420bbeb748527aeaa25fb381926de8dc207102b71300d06092a864886f70d01010b05003039310b3009060355040613024b523110300e060355040a0c0757495a564552413118301606035504030c0f57495a564552412d43412d53484132301e170d3139313032333033303430385a170d3430303530353033303430385a3039310b3009060355040613024b523110300e060355040a0c0757495a564552413118301606035504030c0f57495a564552412d43412d5348413230820122300d06092a864886f70d01010105000382010f003082010a0282010100f3da060f38568f5a6d95f2eba256cf4cdbba97fd6604e73aefc899187c2dd8d1f1c0fa8f8c4fc69a05afe6e4b7964f61c3b67b76f5d2ff73f9d7a013cab9160a94e6442f14cd79e8ae208288745c0f63280c756dcf23d381bad6ee6c17fc04ef5132516dd7274132b87dafb519e16338aaffddda20848430eece2f4ce7b877f16738404db86cf2b1ddeded08388f90e6507261b8f07669b17fe2b5f7971411ad07017541ea53a4e6fd28bf822e4a66855afb87c070b8d1ee1ff90dec14aa462fedb5b17439ca7a9b90221ed54c66f4d8e217acb686b3f5f0306538e8ace848185ccae2f82838d7fa35813de7d32af420a9f540e1645de795c98b77db8c6f42670203010001a3533051301d0603551d0e0416041455e94876be082d97c6565a550ba7b4104b14f6a2301f0603551d2304183016801455e94876be082d97c6565a550ba7b4104b14f6a2300f0603551d130101ff040530030101ff300d06092a864886f70d01010b05000382010100422038356b429ed7b115c75c6c6eb16362c0f6f9747d772e4e4b2ec23d61c1750bf0b58210b6006198f0669505871a5f04078c3a35f90aafc4d3926638d8589c2c413b944846947c49935022990b0631f3735649bfca8253bc5858b298320fe2aa363d6be9f878f888a3e416a13abfb57d54d9392e4e778e71559e36ef5a918a156be2a6c868fc7b9afd9f7851a7faeedc882a39886502b623daacaa50165ed964f323184e6c982b79c5dd915a5df5ad3d260a65011a3cc3ddc28fe8d3bd38608daed8218d6002ef9a53a53c70bd2a75509847d78e4b33e7a1d048dd844651e191d563b95d3fbea0fc1c3ff1f28508c85f1c846d773ecc9feeeed6e9e47f37b5	wpmsvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	veraport-x64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

veraport20unloader.exewizcertutil.exe

pid	process
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3592	wizcertutil.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

veraport-g3-x64.tmpwpmsvcsetup.tmp

pid process

3924 veraport-g3-x64.tmp
1184 wpmsvcsetup.tmp

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

veraport20unloader.exeveraport20unloader.exewizcertutil.exeveraport-x64.exe

pid	process
3648	veraport20unloader.exe
3648	veraport20unloader.exe
2128	veraport20unloader.exe
2128	veraport20unloader.exe
3592	wizcertutil.exe
3592	wizcertutil.exe
3876	veraport-x64.exe
3876	veraport-x64.exe
3876	veraport-x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

veraport-g3-x64.exeveraport-g3-x64.tmpveraport20unloader.exewizcertutil.exewpmsvcsetup.exewpmsvcsetup.tmp

description	pid	process	target process
PID 1400 wrote to memory of 3924	1400	veraport-g3-x64.exe	veraport-g3-x64.tmp
PID 1400 wrote to memory of 3924	1400	veraport-g3-x64.exe	veraport-g3-x64.tmp
PID 1400 wrote to memory of 3924	1400	veraport-g3-x64.exe	veraport-g3-x64.tmp
PID 3924 wrote to memory of 1940	3924	veraport-g3-x64.tmp	sc.exe
PID 3924 wrote to memory of 1940	3924	veraport-g3-x64.tmp	sc.exe
PID 3924 wrote to memory of 3648	3924	veraport-g3-x64.tmp	veraport20unloader.exe
PID 3924 wrote to memory of 3648	3924	veraport-g3-x64.tmp	veraport20unloader.exe
PID 3648 wrote to memory of 2732	3648	veraport20unloader.exe	CheckNetIsolation.exe
PID 3648 wrote to memory of 2732	3648	veraport20unloader.exe	CheckNetIsolation.exe
PID 3924 wrote to memory of 2128	3924	veraport-g3-x64.tmp	veraport20unloader.exe
PID 3924 wrote to memory of 2128	3924	veraport-g3-x64.tmp	veraport20unloader.exe
PID 3924 wrote to memory of 3912	3924	veraport-g3-x64.tmp	regsvr32.exe
PID 3924 wrote to memory of 3912	3924	veraport-g3-x64.tmp	regsvr32.exe
PID 3924 wrote to memory of 3804	3924	veraport-g3-x64.tmp	wizveraregsvr.exe
PID 3924 wrote to memory of 3804	3924	veraport-g3-x64.tmp	wizveraregsvr.exe
PID 3924 wrote to memory of 3592	3924	veraport-g3-x64.tmp	wizcertutil.exe
PID 3924 wrote to memory of 3592	3924	veraport-g3-x64.tmp	wizcertutil.exe
PID 3924 wrote to memory of 3592	3924	veraport-g3-x64.tmp	wizcertutil.exe
PID 3592 wrote to memory of 2200	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 2200	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 2200	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 1888	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 1888	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 1888	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3648	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3648	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3648	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3880	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3880	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3880	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3144	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3144	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3144	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3900	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3900	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3900	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 1852	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 1852	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 1852	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3412	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3412	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3412	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3272	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3272	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3272	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 1260	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 1260	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 1260	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 2720	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 2720	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 2720	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3532	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3532	3592	wizcertutil.exe	certutil.exe
PID 3592 wrote to memory of 3532	3592	wizcertutil.exe	certutil.exe
PID 3924 wrote to memory of 4040	3924	veraport-g3-x64.tmp	wpmsvcsetup.exe
PID 3924 wrote to memory of 4040	3924	veraport-g3-x64.tmp	wpmsvcsetup.exe
PID 3924 wrote to memory of 4040	3924	veraport-g3-x64.tmp	wpmsvcsetup.exe
PID 4040 wrote to memory of 1184	4040	wpmsvcsetup.exe	wpmsvcsetup.tmp
PID 4040 wrote to memory of 1184	4040	wpmsvcsetup.exe	wpmsvcsetup.tmp
PID 4040 wrote to memory of 1184	4040	wpmsvcsetup.exe	wpmsvcsetup.tmp
PID 1184 wrote to memory of 3012	1184	wpmsvcsetup.tmp	sc.exe
PID 1184 wrote to memory of 3012	1184	wpmsvcsetup.tmp	sc.exe
PID 1184 wrote to memory of 3012	1184	wpmsvcsetup.tmp	sc.exe
PID 1184 wrote to memory of 2612	1184	wpmsvcsetup.tmp	WizSvcUtil.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

veraport-g3-x64.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	veraport-g3-x64.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{477D5B9A-6479-44F8-9718-9340119B0308} = "2"	veraport-g3-x64.tmp

C:\Users\Admin\AppData\Local\Temp\veraport-g3-x64.exe
"C:\Users\Admin\AppData\Local\Temp\veraport-g3-x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1400

C:\Users\Admin\AppData\Local\Temp\is-OA1PM.tmp\veraport-g3-x64.tmp
"C:\Users\Admin\AppData\Local\Temp\is-OA1PM.tmp\veraport-g3-x64.tmp" /SL5="$20118,6537973,54272,C:\Users\Admin\AppData\Local\Temp\veraport-g3-x64.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3924

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" stop WizveraPMSvc
3⤵
PID:1940

C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\veraport20unloader.exe
"C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\veraport20unloader.exe" /addloopback
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3648

C:\Windows\system32\CheckNetIsolation.exe
"C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe
4⤵
PID:2732

C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\veraport20unloader.exe
"C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\veraport20unloader.exe" /link
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2128

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Wizvera\Veraport20\veraport20.dll"
3⤵
- Loads dropped DLL
- Modifies registry class
PID:3912

C:\Program Files\Wizvera\Veraport20\wizveraregsvr.exe
"C:\Program Files\Wizvera\Veraport20\wizveraregsvr.exe" veraport20.dll
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3804

C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\wizcertutil.exe
"C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\wizcertutil.exe"
3⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592

C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\certutil.exe
"C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\certutil.exe" -A -n "WIZVERA-CA-SHA2" -t "TCu,Cuw,Tuw" -i wizvera_ca.crt -d "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2kcxi5oi.default-release"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200

C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\certutil.exe
"C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\certutil.exe" -A -n "WIZVERA-CA-SHA2" -t "TCu,Cuw,Tuw" -i wizvera_ca.crt -d sql:"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2kcxi5oi.default-release"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888

C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\certutil.exe
"C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\certutil.exe" -A -n "WIZVERA-CA-SHA1" -t "TCu,Cuw,Tuw" -i wizvera1_ca.crt -d "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2kcxi5oi.default-release"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3648

C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\certutil.exe
"C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\certutil.exe" -A -n "WIZVERA-CA-SHA1" -t "TCu,Cuw,Tuw" -i wizvera1_ca.crt -d sql:"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2kcxi5oi.default-release"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3880

C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\certutil.exe
"C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\certutil.exe" -A -n "WIZVERA-CA-SHA2" -t "TCu,Cuw,Tuw" -i wizvera_ca.crt -d "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2kcxi5oi.default-release"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3144

C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\certutil.exe
"C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\certutil.exe" -A -n "WIZVERA-CA-SHA2" -t "TCu,Cuw,Tuw" -i wizvera_ca.crt -d sql:"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2kcxi5oi.default-release"
4⤵
- Executes dropped EXE
PID:3900

C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\certutil.exe
"C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\certutil.exe" -A -n "WIZVERA-CA-SHA1" -t "TCu,Cuw,Tuw" -i wizvera1_ca.crt -d "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2kcxi5oi.default-release"
4⤵
- Executes dropped EXE
PID:1852

C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\certutil.exe
"C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\certutil.exe" -A -n "WIZVERA-CA-SHA1" -t "TCu,Cuw,Tuw" -i wizvera1_ca.crt -d sql:"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2kcxi5oi.default-release"
4⤵
- Executes dropped EXE
PID:3412

C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\certutil.exe
"C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\certutil.exe" -A -n "WIZVERA-CA-SHA2" -t "TCu,Cuw,Tuw" -i wizvera_ca.crt -d "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zzbpz28t.Admin"
4⤵
- Executes dropped EXE
PID:3272

C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\certutil.exe
"C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\certutil.exe" -A -n "WIZVERA-CA-SHA2" -t "TCu,Cuw,Tuw" -i wizvera_ca.crt -d sql:"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zzbpz28t.Admin"
4⤵
- Executes dropped EXE
PID:1260

C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\certutil.exe
"C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\certutil.exe" -A -n "WIZVERA-CA-SHA1" -t "TCu,Cuw,Tuw" -i wizvera1_ca.crt -d "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zzbpz28t.Admin"
4⤵
- Executes dropped EXE
PID:2720

C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\certutil.exe
"C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\certutil.exe" -A -n "WIZVERA-CA-SHA1" -t "TCu,Cuw,Tuw" -i wizvera1_ca.crt -d sql:"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zzbpz28t.Admin"
4⤵
- Executes dropped EXE
PID:3532

C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\wpmsvcsetup.exe
"C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\wpmsvcsetup.exe" /VERYSILENT
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040

C:\Users\Admin\AppData\Local\Temp\is-UPR53.tmp\wpmsvcsetup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-UPR53.tmp\wpmsvcsetup.tmp" /SL5="$501FA,1729076,54272,C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\wpmsvcsetup.exe" /VERYSILENT
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\SysWOW64\sc.exe
"C:\Windows\system32\sc.exe" stop WizveraPMSvc
5⤵
PID:3012

C:\Program Files (x86)\Wizvera\Common\wpmsvc\WizSvcUtil.exe
"C:\Program Files (x86)\Wizvera\Common\wpmsvc\WizSvcUtil.exe" -fw add
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2612

C:\Windows\SysWOW64\sc.exe
"C:\Windows\system32\sc.exe" config WizveraPMSvc start= auto
5⤵
PID:636

C:\Program Files (x86)\Wizvera\Common\wpmsvc\wpmsvc.exe
"C:\Program Files (x86)\Wizvera\Common\wpmsvc\wpmsvc.exe" /i
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1388

C:\Windows\SysWOW64\sc.exe
"C:\Windows\system32\sc.exe" start WizveraPMSvc
5⤵
PID:3912

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" start WizveraPMSvc
3⤵
PID:2312

C:\Program Files\Wizvera\Veraport20\veraport-x64.exe
"C:\Program Files\Wizvera\Veraport20\veraport-x64.exe" wizvera-veraport://exec/x86/16105/
3⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:3876

C:\Program Files (x86)\Wizvera\Common\wpmsvc\wpmsvc.exe
"C:\Program Files (x86)\Wizvera\Common\wpmsvc\wpmsvc.exe"
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:2644

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Impair Defenses

T1562

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Wizvera\Veraport20\veraport20.dll
MD5
44747493cbcd4d0d826ac88ab1096098

SHA1
ae42c411bcc6ebcdf9e7d836276a5b340befe1ce

SHA256
c41ab84b0a7dc7ba2f3bda085c50fc59d4e47ed23e4b309dff9300e285e51676

SHA512
f56c5bf9d9677a6a4b3ce719a31d82254ff1f37bfe27c40f93654e5aafd0fb4212ac50141acd2ce3f35d62127a1d8734ec784c699e1fbdc91bdb14f5628e6573

Download Submit
C:\Program Files\Wizvera\Veraport20\wizveraregsvr.exe
MD5
aa4ef1c182a79f24b519167c41fab32e

SHA1
d87210debd30250c8d9c3091d2a7ed1a3c662d1b

SHA256
5f196219171fb668b4022acbe3e1d58a90d202d0622d6ebcd67d224ad9ed58db

SHA512
2ea4a65126b44a1dbd467297d0d769f6aafd7e9d084b79af8bc967f0ac382a766b0f6940d5df15101f585ee2c07e75a40d87d6a0b1c987c863fb6df50a933c07

Download Submit
C:\Program Files\Wizvera\Veraport20\wizveraregsvr.exe
MD5
aa4ef1c182a79f24b519167c41fab32e

SHA1
d87210debd30250c8d9c3091d2a7ed1a3c662d1b

SHA256
5f196219171fb668b4022acbe3e1d58a90d202d0622d6ebcd67d224ad9ed58db

SHA512
2ea4a65126b44a1dbd467297d0d769f6aafd7e9d084b79af8bc967f0ac382a766b0f6940d5df15101f585ee2c07e75a40d87d6a0b1c987c863fb6df50a933c07

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OA1PM.tmp\veraport-g3-x64.tmp
MD5
67c5a4f36e1c91a3b85e440edd7ad026

SHA1
e49ea0e558ed682498cc61b3070e4c402fbf0912

SHA256
99c299d6565ab53d9af66e0146737dc0ecfbc52ecf4740825b552db0cc4210c6

SHA512
40522d4645ece0db9888ea40d1a11356aa5efc191184a0b97cb54a6c243532b1fc306e9095bbfa1f5dc02c8e52b709650230d1383532136e56caea3dc19a973e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OA1PM.tmp\veraport-g3-x64.tmp
MD5
67c5a4f36e1c91a3b85e440edd7ad026

SHA1
e49ea0e558ed682498cc61b3070e4c402fbf0912

SHA256
99c299d6565ab53d9af66e0146737dc0ecfbc52ecf4740825b552db0cc4210c6

SHA512
40522d4645ece0db9888ea40d1a11356aa5efc191184a0b97cb54a6c243532b1fc306e9095bbfa1f5dc02c8e52b709650230d1383532136e56caea3dc19a973e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\MSVCR71.dll
MD5
86f1895ae8c5e8b17d99ece768a70732

SHA1
d5502a1d00787d68f548ddeebbde1eca5e2b38ca

SHA256
8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe

SHA512
3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\certutil.exe
MD5
a253cbbfbceee37dd90b999d26542038

SHA1
6a7a056c1f4be22af7acb1e852490e7068576315

SHA256
74e798db83feaef2309b2faaa332e3d6fd02d732d1f545a505919e1d91059caa

SHA512
64863efa65d618273999439305cec0a0d4436ee896e6a231848565d372a98ed8a67607365b61e2e85e4145e73219ace56e44e13eddc52d948ec706767929d3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\certutil.exe
MD5
a253cbbfbceee37dd90b999d26542038

SHA1
6a7a056c1f4be22af7acb1e852490e7068576315

SHA256
74e798db83feaef2309b2faaa332e3d6fd02d732d1f545a505919e1d91059caa

SHA512
64863efa65d618273999439305cec0a0d4436ee896e6a231848565d372a98ed8a67607365b61e2e85e4145e73219ace56e44e13eddc52d948ec706767929d3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\certutil.exe
MD5
a253cbbfbceee37dd90b999d26542038

SHA1
6a7a056c1f4be22af7acb1e852490e7068576315

SHA256
74e798db83feaef2309b2faaa332e3d6fd02d732d1f545a505919e1d91059caa

SHA512
64863efa65d618273999439305cec0a0d4436ee896e6a231848565d372a98ed8a67607365b61e2e85e4145e73219ace56e44e13eddc52d948ec706767929d3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\nspr4.dll
MD5
4290f101800094ec7b8443cc9be8a27d

SHA1
44e6783dcb5aab7657b8cd8d1d80ababc23ce184

SHA256
115891a18b53cbcb92850a6592ebd49657c61564bdfc980defd31a162fa48835

SHA512
6734f5b526562c4bd5da575c1147d49c69949479ba7520605fbbc86f22cd0ea2a97d78f01d665bfba24b0d62463a3ad1cf2bee715bd592690412255b94132ce8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\nss3.dll
MD5
09cacf1074663b90a88c2345f42425ff

SHA1
1e39acf3943ac3b4b603028619bf736b25458691

SHA256
775aac71a08eb6780098c8b080ab910ebb1d62635356e294bc8ff24c98e24357

SHA512
4477902f79c7cb90f8b450279b6b6cc3e40677d899d10f9d4913fc33e5ea85ca1d4a01f5099ff684279b7eb8a3f516663cf30942500270888fe59ae2ef26f363

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\plc4.dll
MD5
a92fb57b8c875df18efe4d22041fe4a1

SHA1
3223b2c4b2d52ed7ba96ecf7642a3e85efad74fa

SHA256
dd1b461e36803f4182e009db962d1f58181725e82e28d6f0c4aa8774e5af6a69

SHA512
d798ed0f62de8072b6bea8f98d81249922ce4ef36a6b64210086394f34dc529cd7fe5d06b0f72848ee401d477eb04ca528c7adf833744e221b0482f375aee2b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\plds4.dll
MD5
c1d41c933445ece136b075054ceca505

SHA1
eb102b2bb225b408c54a76f1aefde9d1ef3b5fbd

SHA256
bbdb559858f7e0e4ab347816bfee8679d788bf2548fad6b15bb509153fffe189

SHA512
99c3506a1fc044672fdc174a738121c003195e6f692d4ae74771d610cdb03a691416c388ace8523c14a5d505c201a03f9e1e545e181406e9697e56cf9b12e6b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\smime3.dll
MD5
031a02aadf62df41f8558a18e5d280a9

SHA1
2e86e1888c5f2a0b3f6db33aa3807720c3552b6d

SHA256
99f21b76ef9fd0b3842fc5c3de62bd9f5c0fe554b0f9b25fa75055c07b3a71f2

SHA512
17095add41686ca495ee27559e6eaee998bcc4f28b02a49d48a44a76e65aba2ab6bd294b11fba4f8bb23c0d774c7c5d6d169bd9671be8300abc6b121679661cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\softokn3.dll
MD5
b2ad88dd7b83b62695b764d1dadfc15d

SHA1
3038440c37c3017f2cd830425fdb9c4766d7ba7e

SHA256
80984e8751d01e0bb1be9d2449402b9c90dd80f795cabddd50b720be8059e037

SHA512
8af47c36e2b56a4d9beb46d6831f2210c4ff7affa38344cb21f6a2f6e724327a51f5aa0ea23f8b7abc39f3212b10e55e532c516f4aeb31b462b4234b5748be27

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\MSVCR120.dll
MD5
034ccadc1c073e4216e9466b720f9849

SHA1
f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

SHA256
86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

SHA512
5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\certutil.exe
MD5
f8da06687fb47ca2c355c38ca2766262

SHA1
4b6bc2776a07cef559e2d9260ee7e3873d2b25d9

SHA256
64ad18f4d9bef01b86e39ca1e774dfa37db46bc8267453c418dd7f723d6d014c

SHA512
128605c51fd15599d69a2713f461605f069a71387ce176bd5afcc65c04a4ca240056b4c1e63846b7e02c29ecd2d163f7ca3b502d881c319203e2110c6fc05862

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\certutil.exe
MD5
f8da06687fb47ca2c355c38ca2766262

SHA1
4b6bc2776a07cef559e2d9260ee7e3873d2b25d9

SHA256
64ad18f4d9bef01b86e39ca1e774dfa37db46bc8267453c418dd7f723d6d014c

SHA512
128605c51fd15599d69a2713f461605f069a71387ce176bd5afcc65c04a4ca240056b4c1e63846b7e02c29ecd2d163f7ca3b502d881c319203e2110c6fc05862

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\freebl3.dll
MD5
f474dd91bb12f230209ec3163ce7e6c4

SHA1
04ff682e527a1c132f73bd836b7880dfa1128528

SHA256
f63b2cab4b77ac63a1beca66872a991e1f8233f2c513d42460dbf28c733b138c

SHA512
01f1feaacda301b013f5e097fa5816b0075b7389ee0522e8fe350802093f6cdfe6ade24ff2a0350896b333e44a77901bbcead85f8cf98bfa91fb110c18adbfee

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\nspr4.dll
MD5
bd0e897dbc2dcc0cf1287ffd7c734cf0

SHA1
5c9c6c6082127d106520ff2e88d4cd4b665d134f

SHA256
2d2096447b366d6640f2670edb474ab208d8d85b5650db5e80cc985d1189f911

SHA512
db21b151b9877c9b5a5dc2eda3afa6a75a827ce1f340032427b7de1d9f9803767aecc582862b58885f456c78fc75ee529581089b725975600e45c6af785280a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\nss3.dll
MD5
54f3932864eed803bd1cb82df43f0c76

SHA1
675960acfed6df22ae0a41973b08494554b37f1a

SHA256
96e068e6162a98d212b57c86b14fc539f1bbdccd363f68efd8cdfecc90c699d3

SHA512
3e1eccb33b8371dbe4801c5c3909130eb4e2a8a9aec80d2c7b2528b00dd137c5ffe672095963d207b48e10f8e024c34fe841aa7ed22c7b7fa6e058165fce90b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\nssutil3.dll
MD5
c19416e9cf9e571068ca14276c6e0620

SHA1
b5e8ee4659b678fb3b234055b1eeda920eb20b30

SHA256
ba9341807b42e90bb0380d51a83d3d6a0de7d57b6820a8b0cbe5e36e978860fa

SHA512
5cde579f66e0677f1419dc11723e1f7b5a7d408b4b3250e26aa0c0863a46b6fd86f17813416769f1eec89375f3c9c83fed468a17d1ef80f83ff1744927e7da79

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\plc4.dll
MD5
88b4df8d7d536a195f866b70c48ed534

SHA1
a385bcd411c3dfad1c08cf56977c1ba45ecbf2f9

SHA256
09f01488a002915b8472a4e82adb7a3e8cb43bd77db347b0178eae614f846a0a

SHA512
b8291cc96a40391d69a75dd348204083f2e21a752a8af3339fd524f8dbb9947575c33eb8ecf77fc177cf2e3568777b2de267cf63301034b28adcfef40ab821c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\plds4.dll
MD5
b7ed50495d311cf6e7ad247968dd2079

SHA1
3364725821ea012f8fa99df102677befc5ff929f

SHA256
20166e281b31ae60672b9d87cb69fcba0c38cc5e18a8ba081c5601ccfab7589f

SHA512
a783f0a00d016a5974f87399637bddd5a5821e3a79c5acb2f6b3f097c9bffefb8a1dee7d968c0646faa2d854a105c57988d244d9c47fb9c189d8383c00a8d2fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\smime3.dll
MD5
94624bbab23a92e0a5f90cce9a5a340d

SHA1
a81d1e0a2c75657f698cee9346fa85423b9b365f

SHA256
b0104ea7aaa257b111982bd0763c1c47fff76bd70249f84dcad834d50444df1a

SHA512
d623e4d271a0dcc0f16e4a2dc4d10422de42445d6da60a5fdb149c511b5e5363de448696592e11dce118f950eed2e92cffb78056c80e1a8e3a42d44ec54cb9f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\softokn3.dll
MD5
6832b9a7ab871d81be42054f117b8299

SHA1
935c0fe7e6cb356a8854e3b7046fd7fc0aa29c61

SHA256
b1316e04b3bf464906f4e015d3e71b4e06a65cc6e59a20a96984ee1e862dcb0e

SHA512
e6579f7df7b3c43219e47630a6b51a576d2ffa9902ddb0f309f5ccb210242dd16ebec75439b2bac22e5cb0b62984386cb6eb4190b2914827b79e3e4afbbdee9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\sqlite3.dll
MD5
3a58690aff7051bb18ea9d764a450551

SHA1
5ce859b3229da70925ffa25564cb6d7c84dd6c36

SHA256
d2d0b729837574d2eb6adac4f819bc4f8534ac9a43b17663942b2401a02db02a

SHA512
299634094a624ee8ad2898d3f2bdf8fee23f234c160992e68d087af828a16ff18e3d1fb1ca5755e82f592d6e3e335c63a9c8dad04ef003d2127bbfcdbec649d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\veraport20unloader.exe
MD5
071f222dbbc34c2fc4e3b8b73da72d86

SHA1
fc1987149162393d6e14ba0ebe76accef9cb2eed

SHA256
cc070571db19ff9064018f03a4f9c420447669412021f60491245a1024f6f35f

SHA512
68ea56208252ea215b58d1f4ab62ffc7bf63065684c4500db764ed22fcd55b9e623be278d78f0d0581707c3c782c3741e94af67c2a13b4b837fe7d03eb37fc63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\veraport20unloader.exe
MD5
071f222dbbc34c2fc4e3b8b73da72d86

SHA1
fc1987149162393d6e14ba0ebe76accef9cb2eed

SHA256
cc070571db19ff9064018f03a4f9c420447669412021f60491245a1024f6f35f

SHA512
68ea56208252ea215b58d1f4ab62ffc7bf63065684c4500db764ed22fcd55b9e623be278d78f0d0581707c3c782c3741e94af67c2a13b4b837fe7d03eb37fc63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\veraport20unloader.exe
MD5
071f222dbbc34c2fc4e3b8b73da72d86

SHA1
fc1987149162393d6e14ba0ebe76accef9cb2eed

SHA256
cc070571db19ff9064018f03a4f9c420447669412021f60491245a1024f6f35f

SHA512
68ea56208252ea215b58d1f4ab62ffc7bf63065684c4500db764ed22fcd55b9e623be278d78f0d0581707c3c782c3741e94af67c2a13b4b837fe7d03eb37fc63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\wizcertutil.exe
MD5
877dc5d45d64ea54963bd1e1cb58afec

SHA1
d7dd7501299871734ff315616e234bda47036a76

SHA256
901ad24d8606923afa215a8f34e3e71189d915d077f9f2d13800885caac52978

SHA512
1b7d45014264bfb8a462c87f10df38550b7843e10877278ee7150c0c519eaa737988f38768e1a9d3c2b527ea492ded17b48a38cba483fa4d7e264611003ff409

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\wizcertutil.exe
MD5
877dc5d45d64ea54963bd1e1cb58afec

SHA1
d7dd7501299871734ff315616e234bda47036a76

SHA256
901ad24d8606923afa215a8f34e3e71189d915d077f9f2d13800885caac52978

SHA512
1b7d45014264bfb8a462c87f10df38550b7843e10877278ee7150c0c519eaa737988f38768e1a9d3c2b527ea492ded17b48a38cba483fa4d7e264611003ff409

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\wizvera_ca.crt
MD5
7a65b4226f7b4f594bb4800e3b0996c6

SHA1
5008a17a4426675a5781980151f0f2d06f31cc77

SHA256
905c65b5d8e5436932fe9ee5781ebc26e26b9e302790689058e48bda376ddfa5

SHA512
09fa5ab2ea077dc2a27c2e421a0aecd525ec0bbe27e6442177ca48c753ae74811f8c1851cab376bdd09e616c318d09cddcb4a79861fc716fc2ca37123acfd3ca

Download Submit
\Program Files\Wizvera\Veraport20\veraport20.dll
MD5
44747493cbcd4d0d826ac88ab1096098

SHA1
ae42c411bcc6ebcdf9e7d836276a5b340befe1ce

SHA256
c41ab84b0a7dc7ba2f3bda085c50fc59d4e47ed23e4b309dff9300e285e51676

SHA512
f56c5bf9d9677a6a4b3ce719a31d82254ff1f37bfe27c40f93654e5aafd0fb4212ac50141acd2ce3f35d62127a1d8734ec784c699e1fbdc91bdb14f5628e6573

Download Submit
\Program Files\Wizvera\Veraport20\veraport20.dll
MD5
44747493cbcd4d0d826ac88ab1096098

SHA1
ae42c411bcc6ebcdf9e7d836276a5b340befe1ce

SHA256
c41ab84b0a7dc7ba2f3bda085c50fc59d4e47ed23e4b309dff9300e285e51676

SHA512
f56c5bf9d9677a6a4b3ce719a31d82254ff1f37bfe27c40f93654e5aafd0fb4212ac50141acd2ce3f35d62127a1d8734ec784c699e1fbdc91bdb14f5628e6573

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\msvcr71.dll
MD5
86f1895ae8c5e8b17d99ece768a70732

SHA1
d5502a1d00787d68f548ddeebbde1eca5e2b38ca

SHA256
8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe

SHA512
3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\nspr4.dll
MD5
4290f101800094ec7b8443cc9be8a27d

SHA1
44e6783dcb5aab7657b8cd8d1d80ababc23ce184

SHA256
115891a18b53cbcb92850a6592ebd49657c61564bdfc980defd31a162fa48835

SHA512
6734f5b526562c4bd5da575c1147d49c69949479ba7520605fbbc86f22cd0ea2a97d78f01d665bfba24b0d62463a3ad1cf2bee715bd592690412255b94132ce8

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\nss3.dll
MD5
09cacf1074663b90a88c2345f42425ff

SHA1
1e39acf3943ac3b4b603028619bf736b25458691

SHA256
775aac71a08eb6780098c8b080ab910ebb1d62635356e294bc8ff24c98e24357

SHA512
4477902f79c7cb90f8b450279b6b6cc3e40677d899d10f9d4913fc33e5ea85ca1d4a01f5099ff684279b7eb8a3f516663cf30942500270888fe59ae2ef26f363

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\nss3.dll
MD5
09cacf1074663b90a88c2345f42425ff

SHA1
1e39acf3943ac3b4b603028619bf736b25458691

SHA256
775aac71a08eb6780098c8b080ab910ebb1d62635356e294bc8ff24c98e24357

SHA512
4477902f79c7cb90f8b450279b6b6cc3e40677d899d10f9d4913fc33e5ea85ca1d4a01f5099ff684279b7eb8a3f516663cf30942500270888fe59ae2ef26f363

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\nss3.dll
MD5
09cacf1074663b90a88c2345f42425ff

SHA1
1e39acf3943ac3b4b603028619bf736b25458691

SHA256
775aac71a08eb6780098c8b080ab910ebb1d62635356e294bc8ff24c98e24357

SHA512
4477902f79c7cb90f8b450279b6b6cc3e40677d899d10f9d4913fc33e5ea85ca1d4a01f5099ff684279b7eb8a3f516663cf30942500270888fe59ae2ef26f363

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\plc4.dll
MD5
a92fb57b8c875df18efe4d22041fe4a1

SHA1
3223b2c4b2d52ed7ba96ecf7642a3e85efad74fa

SHA256
dd1b461e36803f4182e009db962d1f58181725e82e28d6f0c4aa8774e5af6a69

SHA512
d798ed0f62de8072b6bea8f98d81249922ce4ef36a6b64210086394f34dc529cd7fe5d06b0f72848ee401d477eb04ca528c7adf833744e221b0482f375aee2b1

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\plc4.dll
MD5
a92fb57b8c875df18efe4d22041fe4a1

SHA1
3223b2c4b2d52ed7ba96ecf7642a3e85efad74fa

SHA256
dd1b461e36803f4182e009db962d1f58181725e82e28d6f0c4aa8774e5af6a69

SHA512
d798ed0f62de8072b6bea8f98d81249922ce4ef36a6b64210086394f34dc529cd7fe5d06b0f72848ee401d477eb04ca528c7adf833744e221b0482f375aee2b1

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\plc4.dll
MD5
a92fb57b8c875df18efe4d22041fe4a1

SHA1
3223b2c4b2d52ed7ba96ecf7642a3e85efad74fa

SHA256
dd1b461e36803f4182e009db962d1f58181725e82e28d6f0c4aa8774e5af6a69

SHA512
d798ed0f62de8072b6bea8f98d81249922ce4ef36a6b64210086394f34dc529cd7fe5d06b0f72848ee401d477eb04ca528c7adf833744e221b0482f375aee2b1

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\plds4.dll
MD5
c1d41c933445ece136b075054ceca505

SHA1
eb102b2bb225b408c54a76f1aefde9d1ef3b5fbd

SHA256
bbdb559858f7e0e4ab347816bfee8679d788bf2548fad6b15bb509153fffe189

SHA512
99c3506a1fc044672fdc174a738121c003195e6f692d4ae74771d610cdb03a691416c388ace8523c14a5d505c201a03f9e1e545e181406e9697e56cf9b12e6b4

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\plds4.dll
MD5
c1d41c933445ece136b075054ceca505

SHA1
eb102b2bb225b408c54a76f1aefde9d1ef3b5fbd

SHA256
bbdb559858f7e0e4ab347816bfee8679d788bf2548fad6b15bb509153fffe189

SHA512
99c3506a1fc044672fdc174a738121c003195e6f692d4ae74771d610cdb03a691416c388ace8523c14a5d505c201a03f9e1e545e181406e9697e56cf9b12e6b4

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\smime3.dll
MD5
031a02aadf62df41f8558a18e5d280a9

SHA1
2e86e1888c5f2a0b3f6db33aa3807720c3552b6d

SHA256
99f21b76ef9fd0b3842fc5c3de62bd9f5c0fe554b0f9b25fa75055c07b3a71f2

SHA512
17095add41686ca495ee27559e6eaee998bcc4f28b02a49d48a44a76e65aba2ab6bd294b11fba4f8bb23c0d774c7c5d6d169bd9671be8300abc6b121679661cd

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\smime3.dll
MD5
031a02aadf62df41f8558a18e5d280a9

SHA1
2e86e1888c5f2a0b3f6db33aa3807720c3552b6d

SHA256
99f21b76ef9fd0b3842fc5c3de62bd9f5c0fe554b0f9b25fa75055c07b3a71f2

SHA512
17095add41686ca495ee27559e6eaee998bcc4f28b02a49d48a44a76e65aba2ab6bd294b11fba4f8bb23c0d774c7c5d6d169bd9671be8300abc6b121679661cd

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\softokn3.dll
MD5
b2ad88dd7b83b62695b764d1dadfc15d

SHA1
3038440c37c3017f2cd830425fdb9c4766d7ba7e

SHA256
80984e8751d01e0bb1be9d2449402b9c90dd80f795cabddd50b720be8059e037

SHA512
8af47c36e2b56a4d9beb46d6831f2210c4ff7affa38344cb21f6a2f6e724327a51f5aa0ea23f8b7abc39f3212b10e55e532c516f4aeb31b462b4234b5748be27

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss\softokn3.dll
MD5
b2ad88dd7b83b62695b764d1dadfc15d

SHA1
3038440c37c3017f2cd830425fdb9c4766d7ba7e

SHA256
80984e8751d01e0bb1be9d2449402b9c90dd80f795cabddd50b720be8059e037

SHA512
8af47c36e2b56a4d9beb46d6831f2210c4ff7affa38344cb21f6a2f6e724327a51f5aa0ea23f8b7abc39f3212b10e55e532c516f4aeb31b462b4234b5748be27

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\freebl3.dll
MD5
f474dd91bb12f230209ec3163ce7e6c4

SHA1
04ff682e527a1c132f73bd836b7880dfa1128528

SHA256
f63b2cab4b77ac63a1beca66872a991e1f8233f2c513d42460dbf28c733b138c

SHA512
01f1feaacda301b013f5e097fa5816b0075b7389ee0522e8fe350802093f6cdfe6ade24ff2a0350896b333e44a77901bbcead85f8cf98bfa91fb110c18adbfee

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\msvcr120.dll
MD5
034ccadc1c073e4216e9466b720f9849

SHA1
f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

SHA256
86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

SHA512
5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\msvcr120.dll
MD5
034ccadc1c073e4216e9466b720f9849

SHA1
f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

SHA256
86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

SHA512
5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\msvcr120.dll
MD5
034ccadc1c073e4216e9466b720f9849

SHA1
f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

SHA256
86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

SHA512
5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\msvcr120.dll
MD5
034ccadc1c073e4216e9466b720f9849

SHA1
f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

SHA256
86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

SHA512
5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\nspr4.dll
MD5
bd0e897dbc2dcc0cf1287ffd7c734cf0

SHA1
5c9c6c6082127d106520ff2e88d4cd4b665d134f

SHA256
2d2096447b366d6640f2670edb474ab208d8d85b5650db5e80cc985d1189f911

SHA512
db21b151b9877c9b5a5dc2eda3afa6a75a827ce1f340032427b7de1d9f9803767aecc582862b58885f456c78fc75ee529581089b725975600e45c6af785280a9

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\nspr4.dll
MD5
bd0e897dbc2dcc0cf1287ffd7c734cf0

SHA1
5c9c6c6082127d106520ff2e88d4cd4b665d134f

SHA256
2d2096447b366d6640f2670edb474ab208d8d85b5650db5e80cc985d1189f911

SHA512
db21b151b9877c9b5a5dc2eda3afa6a75a827ce1f340032427b7de1d9f9803767aecc582862b58885f456c78fc75ee529581089b725975600e45c6af785280a9

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\nss3.dll
MD5
54f3932864eed803bd1cb82df43f0c76

SHA1
675960acfed6df22ae0a41973b08494554b37f1a

SHA256
96e068e6162a98d212b57c86b14fc539f1bbdccd363f68efd8cdfecc90c699d3

SHA512
3e1eccb33b8371dbe4801c5c3909130eb4e2a8a9aec80d2c7b2528b00dd137c5ffe672095963d207b48e10f8e024c34fe841aa7ed22c7b7fa6e058165fce90b8

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\nss3.dll
MD5
54f3932864eed803bd1cb82df43f0c76

SHA1
675960acfed6df22ae0a41973b08494554b37f1a

SHA256
96e068e6162a98d212b57c86b14fc539f1bbdccd363f68efd8cdfecc90c699d3

SHA512
3e1eccb33b8371dbe4801c5c3909130eb4e2a8a9aec80d2c7b2528b00dd137c5ffe672095963d207b48e10f8e024c34fe841aa7ed22c7b7fa6e058165fce90b8

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\nssutil3.dll
MD5
c19416e9cf9e571068ca14276c6e0620

SHA1
b5e8ee4659b678fb3b234055b1eeda920eb20b30

SHA256
ba9341807b42e90bb0380d51a83d3d6a0de7d57b6820a8b0cbe5e36e978860fa

SHA512
5cde579f66e0677f1419dc11723e1f7b5a7d408b4b3250e26aa0c0863a46b6fd86f17813416769f1eec89375f3c9c83fed468a17d1ef80f83ff1744927e7da79

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\plc4.dll
MD5
88b4df8d7d536a195f866b70c48ed534

SHA1
a385bcd411c3dfad1c08cf56977c1ba45ecbf2f9

SHA256
09f01488a002915b8472a4e82adb7a3e8cb43bd77db347b0178eae614f846a0a

SHA512
b8291cc96a40391d69a75dd348204083f2e21a752a8af3339fd524f8dbb9947575c33eb8ecf77fc177cf2e3568777b2de267cf63301034b28adcfef40ab821c1

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\plds4.dll
MD5
b7ed50495d311cf6e7ad247968dd2079

SHA1
3364725821ea012f8fa99df102677befc5ff929f

SHA256
20166e281b31ae60672b9d87cb69fcba0c38cc5e18a8ba081c5601ccfab7589f

SHA512
a783f0a00d016a5974f87399637bddd5a5821e3a79c5acb2f6b3f097c9bffefb8a1dee7d968c0646faa2d854a105c57988d244d9c47fb9c189d8383c00a8d2fe

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\smime3.dll
MD5
94624bbab23a92e0a5f90cce9a5a340d

SHA1
a81d1e0a2c75657f698cee9346fa85423b9b365f

SHA256
b0104ea7aaa257b111982bd0763c1c47fff76bd70249f84dcad834d50444df1a

SHA512
d623e4d271a0dcc0f16e4a2dc4d10422de42445d6da60a5fdb149c511b5e5363de448696592e11dce118f950eed2e92cffb78056c80e1a8e3a42d44ec54cb9f3

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\softokn3.dll
MD5
6832b9a7ab871d81be42054f117b8299

SHA1
935c0fe7e6cb356a8854e3b7046fd7fc0aa29c61

SHA256
b1316e04b3bf464906f4e015d3e71b4e06a65cc6e59a20a96984ee1e862dcb0e

SHA512
e6579f7df7b3c43219e47630a6b51a576d2ffa9902ddb0f309f5ccb210242dd16ebec75439b2bac22e5cb0b62984386cb6eb4190b2914827b79e3e4afbbdee9c

Download Submit
\Users\Admin\AppData\Local\Temp\is-PFVA4.tmp\nss_sql\sqlite3.dll
MD5
3a58690aff7051bb18ea9d764a450551

SHA1
5ce859b3229da70925ffa25564cb6d7c84dd6c36

SHA256
d2d0b729837574d2eb6adac4f819bc4f8534ac9a43b17663942b2401a02db02a

SHA512
299634094a624ee8ad2898d3f2bdf8fee23f234c160992e68d087af828a16ff18e3d1fb1ca5755e82f592d6e3e335c63a9c8dad04ef003d2127bbfcdbec649d4

Download Submit
memory/636-116-0x0000000000000000-mapping.dmp

Download
memory/1184-112-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1184-108-0x0000000000000000-mapping.dmp

Download
memory/1260-101-0x0000000000000000-mapping.dmp

Download
memory/1388-117-0x0000000000000000-mapping.dmp

Download
memory/1388-118-0x0000000004460000-0x0000000004461000-memory.dmp

Filesize
4KB

Download
memory/1388-119-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download
memory/1400-5-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1852-94-0x00000000008A1000-0x00000000008BC000-memory.dmp

Filesize
108KB

Download
memory/1852-95-0x00000000008D1000-0x0000000000914000-memory.dmp

Filesize
268KB

Download
memory/1852-93-0x0000000000841000-0x0000000000881000-memory.dmp

Filesize
256KB

Download
memory/1852-92-0x0000000000000000-mapping.dmp

Download
memory/1888-53-0x0000000000000000-mapping.dmp

Download
memory/1940-7-0x0000000000000000-mapping.dmp

Download
memory/2128-12-0x0000000000000000-mapping.dmp

Download
memory/2200-27-0x0000000074790000-0x0000000074823000-memory.dmp

Filesize
588KB

Download
memory/2200-41-0x00000000009A1000-0x00000000009E1000-memory.dmp

Filesize
256KB

Download
memory/2200-49-0x0000000000A01000-0x0000000000A44000-memory.dmp

Filesize
268KB

Download
memory/2200-43-0x0000000000031000-0x0000000000033000-memory.dmp

Filesize
8KB

Download
memory/2200-25-0x0000000000000000-mapping.dmp

Download
memory/2312-127-0x0000000000000000-mapping.dmp

Download
memory/2612-114-0x0000000005330000-0x0000000005331000-memory.dmp

Filesize
4KB

Download
memory/2612-113-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/2612-110-0x0000000000000000-mapping.dmp

Download
memory/2612-121-0x0000000077DE4000-0x0000000077DE5000-memory.dmp

Filesize
4KB

Download
memory/2612-115-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/2644-123-0x0000000002F50000-0x0000000002F51000-memory.dmp

Filesize
4KB

Download
memory/2644-124-0x0000000003750000-0x0000000003751000-memory.dmp

Filesize
4KB

Download
memory/2720-104-0x0000000000601000-0x000000000061C000-memory.dmp

Filesize
108KB

Download
memory/2720-103-0x0000000000871000-0x00000000008B1000-memory.dmp

Filesize
256KB

Download
memory/2720-102-0x0000000000000000-mapping.dmp

Download
memory/2732-11-0x0000000000000000-mapping.dmp

Download
memory/3012-109-0x0000000000000000-mapping.dmp

Download
memory/3144-87-0x0000000000000000-mapping.dmp

Download
memory/3144-88-0x00000000006B1000-0x00000000006F1000-memory.dmp

Filesize
256KB

Download
memory/3144-89-0x0000000000531000-0x000000000054C000-memory.dmp

Filesize
108KB

Download
memory/3144-90-0x0000000000A41000-0x0000000000A84000-memory.dmp

Filesize
268KB

Download
memory/3272-100-0x0000000000A11000-0x0000000000A54000-memory.dmp

Filesize
268KB

Download
memory/3272-98-0x0000000000571000-0x000000000058C000-memory.dmp

Filesize
108KB

Download
memory/3272-99-0x00000000009B1000-0x00000000009F1000-memory.dmp

Filesize
256KB

Download
memory/3272-97-0x0000000000000000-mapping.dmp

Download
memory/3412-96-0x0000000000000000-mapping.dmp

Download
memory/3532-106-0x0000000000000000-mapping.dmp

Download
memory/3592-21-0x0000000000000000-mapping.dmp

Download
memory/3648-8-0x0000000000000000-mapping.dmp

Download
memory/3648-80-0x0000000000000000-mapping.dmp

Download
memory/3648-85-0x0000000000921000-0x0000000000964000-memory.dmp

Filesize
268KB

Download
memory/3648-84-0x0000000000461000-0x000000000047C000-memory.dmp

Filesize
108KB

Download
memory/3648-83-0x00000000004B1000-0x00000000004F1000-memory.dmp

Filesize
256KB

Download
memory/3804-17-0x0000000000000000-mapping.dmp

Download
memory/3876-126-0x0000000000000000-mapping.dmp

Download
memory/3880-86-0x0000000000000000-mapping.dmp

Download
memory/3900-91-0x0000000000000000-mapping.dmp

Download
memory/3912-120-0x0000000000000000-mapping.dmp

Download
memory/3912-14-0x0000000000000000-mapping.dmp

Download
memory/3924-6-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3924-2-0x0000000000000000-mapping.dmp

Download
memory/4040-107-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads