Overview
overview
10Static
static
Setup (1).exe
windows7_x64
Setup (1).exe
windows10_x64
10Setup (10).exe
windows7_x64
10Setup (10).exe
windows10_x64
10Setup (11).exe
windows7_x64
Setup (11).exe
windows10_x64
10Setup (12).exe
windows7_x64
Setup (12).exe
windows10_x64
10Setup (13).exe
windows7_x64
10Setup (13).exe
windows10_x64
10Setup (14).exe
windows7_x64
10Setup (14).exe
windows10_x64
10Setup (15).exe
windows7_x64
10Setup (15).exe
windows10_x64
10Setup (16).exe
windows7_x64
10Setup (16).exe
windows10_x64
10Setup (17).exe
windows7_x64
10Setup (17).exe
windows10_x64
10Setup (18).exe
windows7_x64
10Setup (18).exe
windows10_x64
10Setup (19).exe
windows7_x64
10Setup (19).exe
windows10_x64
10Setup (2).exe
windows7_x64
10Setup (2).exe
windows10_x64
10Setup (20).exe
windows7_x64
10Setup (20).exe
windows10_x64
10Setup (21).exe
windows7_x64
Setup (21).exe
windows10_x64
10Setup (22).exe
windows7_x64
Setup (22).exe
windows10_x64
10Setup (23).exe
windows7_x64
10Setup (23).exe
windows10_x64
10Resubmissions
15/10/2024, 15:36
241015-s1zlzasdkc 1001/07/2024, 18:32
240701-w6yteawhmq 1001/07/2024, 14:52
240701-r82wmaxdnd 1001/07/2024, 14:52
240701-r8syqa1dpp 1011/03/2024, 21:22
240311-z8dsssgg58 1001/09/2021, 13:18
210901-5bmxjspa5s 1001/09/2021, 13:04
210901-te4btfspqa 1001/09/2021, 05:12
210901-4wnkwm1p3j 1031/08/2021, 21:47
210831-41rp97dma2 10Analysis
-
max time kernel
921s -
max time network
1057s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27/08/2021, 15:40
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Setup (1).exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
Setup (10).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
Setup (10).exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
Setup (11).exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
Setup (11).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Setup (12).exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
Setup (12).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
Setup (13).exe
Resource
win7v20210408
Behavioral task
behavioral10
Sample
Setup (13).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
Setup (14).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
Setup (14).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Setup (15).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
Setup (15).exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
Setup (16).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
Setup (16).exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
Setup (17).exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
Setup (17).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
Setup (18).exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
Setup (18).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
Setup (19).exe
Resource
win7v20210408
Behavioral task
behavioral22
Sample
Setup (19).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
Setup (2).exe
Resource
win7v20210408
Behavioral task
behavioral24
Sample
Setup (2).exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
Setup (20).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
Setup (20).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
Setup (21).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
Setup (21).exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
Setup (22).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
Setup (22).exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
Setup (23).exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
Setup (23).exe
Resource
win10v20210410
Errors
General
-
Target
Setup (21).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
redline
205.185.119.191:18846
Extracted
redline
supertraff
135.148.139.222:1494
Extracted
redline
dibild2
135.148.139.222:1494
Signatures
-
Danabot Loader Component 1 IoCs
resource yara_rule behavioral27/memory/2688-217-0x0000000001E30000-0x0000000001F90000-memory.dmp DanabotLoader2021 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 10 IoCs
resource yara_rule behavioral27/memory/1656-180-0x00000000003E0000-0x00000000003FC000-memory.dmp family_redline behavioral27/memory/1656-182-0x0000000002D40000-0x0000000002D5A000-memory.dmp family_redline behavioral27/memory/2800-184-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral27/memory/2800-187-0x000000000041A6B2-mapping.dmp family_redline behavioral27/memory/2800-189-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral27/memory/2852-204-0x000000000041A6B2-mapping.dmp family_redline behavioral27/memory/2712-208-0x000000000041A616-mapping.dmp family_redline behavioral27/memory/2712-207-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral27/memory/2712-212-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral27/memory/1996-227-0x0000000003D00000-0x0000000003D1D000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Blocklisted process makes network request 1 IoCs
flow pid Process 233 2688 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 41 IoCs
pid Process 1236 etfJeGqKqUl_DwbZYRyfsaG1.exe 1988 ojR0sGwmSuoCmJWSJp9bpnEm.exe 1932 vIo5xLbnAn5wlo7fc0B9p0eD.exe 1232 IzmjKHodxA8W_NDfgvS6tB6w.exe 1340 uywq8fyp8E7qa8580dk0iWsE.exe 944 S2HSTcAUNeMyQQbSOKlFnrEE.exe 1980 AHMGsjmzi96BgN0UntpDB3Ny.exe 1052 sDCTG31GhnSJTJlFulawm8Ip.exe 1880 Bc2QjylHVzOJx1eHFZ4tpOJu.exe 1936 OLjJTsWTvNHfu0VWiBU0v0bM.exe 320 M8guWo7mSaS4VxOjuFT3n1au.exe 1220 rY5I4MXgT1oqZOPx970R9BBI.exe 1716 oktn_HsGk9b02sgjHpxFmbcs.exe 768 NvmtBNiV6YRbWvVQYjOQjrXX.exe 1680 DWkH7GyVyVTFbg9m2N5fMPm1.exe 1656 a7UdiaIuuIwRkXy4EYMqDcxZ.exe 672 K5apV2XWtwW3mlh4grWW59O3.exe 1648 x1pHnzVKoUkgtOVmQ5JuPsav.exe 1072 yVZljfao2DlhzcuKbOAmfkKD.exe 1276 NTBvCOH_xtpwu1YzjDibFBpd.exe 1696 y3spqmAGwZMUtf5c1E7YGSrZ.exe 1616 5bAzIWQJKJUMEnNDImZcqHSF.exe 2056 n9H8FFDzHPSTuILfxCUkH0pA.exe 1512 pN41pgZSPdZBgJtYOyiX8QPg.exe 1792 gm_t9wgEZ62pQORGdiThO0CA.exe 2084 9YzvbamP0p4xNgmeMG2xz9wz.exe 2800 y3spqmAGwZMUtf5c1E7YGSrZ.exe 2776 ojR0sGwmSuoCmJWSJp9bpnEm.exe 3052 Bx0IuOFB.ExE 2852 y3spqmAGwZMUtf5c1E7YGSrZ.exe 2712 vIo5xLbnAn5wlo7fc0B9p0eD.exe 2976 3EA7.exe 1996 6FF4.exe 368 BF8B.exe 824 F0C9.exe 2616 cutm3.exe 2456 md8_8eus.exe 948 gtiwdju 2272 rY5I4MXgT1oqZOPx970R9BBI.exe 2636 3EA7.exe 2832 inst1.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion gm_t9wgEZ62pQORGdiThO0CA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion gm_t9wgEZ62pQORGdiThO0CA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion NvmtBNiV6YRbWvVQYjOQjrXX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion NvmtBNiV6YRbWvVQYjOQjrXX.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International\Geo\Nation Setup (21).exe -
Loads dropped DLL 52 IoCs
pid Process 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 916 Setup (21).exe 2924 cmd.exe 1492 WerFault.exe 1492 WerFault.exe 1492 WerFault.exe 1492 WerFault.exe 2688 rundll32.exe 2688 rundll32.exe 2688 rundll32.exe 2688 rundll32.exe 1648 x1pHnzVKoUkgtOVmQ5JuPsav.exe 1648 x1pHnzVKoUkgtOVmQ5JuPsav.exe 1648 x1pHnzVKoUkgtOVmQ5JuPsav.exe 2976 3EA7.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral27/files/0x000300000001315a-79.dat themida behavioral27/files/0x0003000000013196-147.dat themida behavioral27/files/0x000300000001319b-133.dat themida behavioral27/files/0x0003000000013196-123.dat themida behavioral27/memory/1792-178-0x0000000000900000-0x0000000000901000-memory.dmp themida behavioral27/memory/768-190-0x0000000001170000-0x0000000001171000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA gm_t9wgEZ62pQORGdiThO0CA.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NvmtBNiV6YRbWvVQYjOQjrXX.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 ipinfo.io 22 ipinfo.io 148 ipinfo.io 149 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1792 gm_t9wgEZ62pQORGdiThO0CA.exe 768 NvmtBNiV6YRbWvVQYjOQjrXX.exe -
Suspicious use of SetThreadContext 7 IoCs
description pid Process procid_target PID 1988 set thread context of 2776 1988 ojR0sGwmSuoCmJWSJp9bpnEm.exe 72 PID 1696 set thread context of 2800 1696 y3spqmAGwZMUtf5c1E7YGSrZ.exe 73 PID 1696 set thread context of 2852 1696 y3spqmAGwZMUtf5c1E7YGSrZ.exe 74 PID 1932 set thread context of 2712 1932 vIo5xLbnAn5wlo7fc0B9p0eD.exe 85 PID 1696 set thread context of 2728 1696 y3spqmAGwZMUtf5c1E7YGSrZ.exe 86 PID 1932 set thread context of 2516 1932 vIo5xLbnAn5wlo7fc0B9p0eD.exe 88 PID 2976 set thread context of 2636 2976 3EA7.exe 101 -
Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe DWkH7GyVyVTFbg9m2N5fMPm1.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe x1pHnzVKoUkgtOVmQ5JuPsav.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe x1pHnzVKoUkgtOVmQ5JuPsav.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\inst1.exe x1pHnzVKoUkgtOVmQ5JuPsav.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe x1pHnzVKoUkgtOVmQ5JuPsav.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini x1pHnzVKoUkgtOVmQ5JuPsav.exe File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe DWkH7GyVyVTFbg9m2N5fMPm1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1492 1880 WerFault.exe 39 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ojR0sGwmSuoCmJWSJp9bpnEm.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ojR0sGwmSuoCmJWSJp9bpnEm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI OLjJTsWTvNHfu0VWiBU0v0bM.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI OLjJTsWTvNHfu0VWiBU0v0bM.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI OLjJTsWTvNHfu0VWiBU0v0bM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ojR0sGwmSuoCmJWSJp9bpnEm.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2492 schtasks.exe 2572 schtasks.exe -
Kills process with taskkill 1 IoCs
pid Process 1872 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Setup (21).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118 DWkH7GyVyVTFbg9m2N5fMPm1.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 0f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad09000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703091400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded31d000000010000001000000096f98b6e79a74810ce7d398a82f977780b000000010000000e000000430065007200740075006d0000000300000001000000140000006252dc40f71143a22fde9ef7348e064251b181182000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73 DWkH7GyVyVTFbg9m2N5fMPm1.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 DWkH7GyVyVTFbg9m2N5fMPm1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Bc2QjylHVzOJx1eHFZ4tpOJu.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e md8_8eus.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C Setup (21).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (21).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C DWkH7GyVyVTFbg9m2N5fMPm1.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Bc2QjylHVzOJx1eHFZ4tpOJu.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Bc2QjylHVzOJx1eHFZ4tpOJu.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (21).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Setup (21).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 1900000001000000100000000b6cd9778e41ad67fd6be0a6903710440300000001000000140000006252dc40f71143a22fde9ef7348e064251b181180b000000010000000e000000430065007200740075006d0000001d000000010000001000000096f98b6e79a74810ce7d398a82f977781400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded309000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad2000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73 DWkH7GyVyVTFbg9m2N5fMPm1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 md8_8eus.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 916 Setup (21).exe 2776 ojR0sGwmSuoCmJWSJp9bpnEm.exe 2776 ojR0sGwmSuoCmJWSJp9bpnEm.exe 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1208 Process not Found 1492 WerFault.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2776 ojR0sGwmSuoCmJWSJp9bpnEm.exe 1936 OLjJTsWTvNHfu0VWiBU0v0bM.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1656 a7UdiaIuuIwRkXy4EYMqDcxZ.exe Token: SeShutdownPrivilege 1208 Process not Found Token: SeDebugPrivilege 1872 taskkill.exe Token: SeDebugPrivilege 1492 WerFault.exe Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeDebugPrivilege 1220 rY5I4MXgT1oqZOPx970R9BBI.exe Token: SeImpersonatePrivilege 1220 rY5I4MXgT1oqZOPx970R9BBI.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 916 wrote to memory of 1988 916 Setup (21).exe 31 PID 916 wrote to memory of 1988 916 Setup (21).exe 31 PID 916 wrote to memory of 1988 916 Setup (21).exe 31 PID 916 wrote to memory of 1988 916 Setup (21).exe 31 PID 916 wrote to memory of 1932 916 Setup (21).exe 33 PID 916 wrote to memory of 1932 916 Setup (21).exe 33 PID 916 wrote to memory of 1932 916 Setup (21).exe 33 PID 916 wrote to memory of 1932 916 Setup (21).exe 33 PID 916 wrote to memory of 1232 916 Setup (21).exe 36 PID 916 wrote to memory of 1232 916 Setup (21).exe 36 PID 916 wrote to memory of 1232 916 Setup (21).exe 36 PID 916 wrote to memory of 1232 916 Setup (21).exe 36 PID 916 wrote to memory of 1340 916 Setup (21).exe 35 PID 916 wrote to memory of 1340 916 Setup (21).exe 35 PID 916 wrote to memory of 1340 916 Setup (21).exe 35 PID 916 wrote to memory of 1340 916 Setup (21).exe 35 PID 916 wrote to memory of 1052 916 Setup (21).exe 43 PID 916 wrote to memory of 1052 916 Setup (21).exe 43 PID 916 wrote to memory of 1052 916 Setup (21).exe 43 PID 916 wrote to memory of 1052 916 Setup (21).exe 43 PID 916 wrote to memory of 876 916 Setup (21).exe 42 PID 916 wrote to memory of 876 916 Setup (21).exe 42 PID 916 wrote to memory of 876 916 Setup (21).exe 42 PID 916 wrote to memory of 876 916 Setup (21).exe 42 PID 916 wrote to memory of 876 916 Setup (21).exe 42 PID 916 wrote to memory of 876 916 Setup (21).exe 42 PID 916 wrote to memory of 876 916 Setup (21).exe 42 PID 916 wrote to memory of 944 916 Setup (21).exe 41 PID 916 wrote to memory of 944 916 Setup (21).exe 41 PID 916 wrote to memory of 944 916 Setup (21).exe 41 PID 916 wrote to memory of 944 916 Setup (21).exe 41 PID 916 wrote to memory of 1936 916 Setup (21).exe 40 PID 916 wrote to memory of 1936 916 Setup (21).exe 40 PID 916 wrote to memory of 1936 916 Setup (21).exe 40 PID 916 wrote to memory of 1936 916 Setup (21).exe 40 PID 916 wrote to memory of 1880 916 Setup (21).exe 39 PID 916 wrote to memory of 1880 916 Setup (21).exe 39 PID 916 wrote to memory of 1880 916 Setup (21).exe 39 PID 916 wrote to memory of 1880 916 Setup (21).exe 39 PID 916 wrote to memory of 1980 916 Setup (21).exe 38 PID 916 wrote to memory of 1980 916 Setup (21).exe 38 PID 916 wrote to memory of 1980 916 Setup (21).exe 38 PID 916 wrote to memory of 1980 916 Setup (21).exe 38 PID 916 wrote to memory of 920 916 Setup (21).exe 46 PID 916 wrote to memory of 920 916 Setup (21).exe 46 PID 916 wrote to memory of 920 916 Setup (21).exe 46 PID 916 wrote to memory of 920 916 Setup (21).exe 46 PID 916 wrote to memory of 320 916 Setup (21).exe 45 PID 916 wrote to memory of 320 916 Setup (21).exe 45 PID 916 wrote to memory of 320 916 Setup (21).exe 45 PID 916 wrote to memory of 320 916 Setup (21).exe 45 PID 916 wrote to memory of 1220 916 Setup (21).exe 44 PID 916 wrote to memory of 1220 916 Setup (21).exe 44 PID 916 wrote to memory of 1220 916 Setup (21).exe 44 PID 916 wrote to memory of 1220 916 Setup (21).exe 44 PID 916 wrote to memory of 1716 916 Setup (21).exe 60 PID 916 wrote to memory of 1716 916 Setup (21).exe 60 PID 916 wrote to memory of 1716 916 Setup (21).exe 60 PID 916 wrote to memory of 1716 916 Setup (21).exe 60 PID 916 wrote to memory of 672 916 Setup (21).exe 61 PID 916 wrote to memory of 672 916 Setup (21).exe 61 PID 916 wrote to memory of 672 916 Setup (21).exe 61 PID 916 wrote to memory of 672 916 Setup (21).exe 61 PID 916 wrote to memory of 1680 916 Setup (21).exe 59
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (21).exe"C:\Users\Admin\AppData\Local\Temp\Setup (21).exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\Documents\ojR0sGwmSuoCmJWSJp9bpnEm.exe"C:\Users\Admin\Documents\ojR0sGwmSuoCmJWSJp9bpnEm.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1988 -
C:\Users\Admin\Documents\ojR0sGwmSuoCmJWSJp9bpnEm.exe"C:\Users\Admin\Documents\ojR0sGwmSuoCmJWSJp9bpnEm.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2776
-
-
-
C:\Users\Admin\Documents\etfJeGqKqUl_DwbZYRyfsaG1.exe"C:\Users\Admin\Documents\etfJeGqKqUl_DwbZYRyfsaG1.exe"2⤵
- Executes dropped EXE
PID:1236
-
-
C:\Users\Admin\Documents\vIo5xLbnAn5wlo7fc0B9p0eD.exe"C:\Users\Admin\Documents\vIo5xLbnAn5wlo7fc0B9p0eD.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1932 -
C:\Users\Admin\Documents\vIo5xLbnAn5wlo7fc0B9p0eD.exeC:\Users\Admin\Documents\vIo5xLbnAn5wlo7fc0B9p0eD.exe3⤵
- Executes dropped EXE
PID:2712
-
-
C:\Users\Admin\Documents\vIo5xLbnAn5wlo7fc0B9p0eD.exeC:\Users\Admin\Documents\vIo5xLbnAn5wlo7fc0B9p0eD.exe3⤵PID:2516
-
-
-
C:\Users\Admin\Documents\uywq8fyp8E7qa8580dk0iWsE.exe"C:\Users\Admin\Documents\uywq8fyp8E7qa8580dk0iWsE.exe"2⤵
- Executes dropped EXE
PID:1340
-
-
C:\Users\Admin\Documents\IzmjKHodxA8W_NDfgvS6tB6w.exe"C:\Users\Admin\Documents\IzmjKHodxA8W_NDfgvS6tB6w.exe"2⤵
- Executes dropped EXE
PID:1232
-
-
C:\Users\Admin\Documents\AHMGsjmzi96BgN0UntpDB3Ny.exe"C:\Users\Admin\Documents\AHMGsjmzi96BgN0UntpDB3Ny.exe"2⤵
- Executes dropped EXE
PID:1980
-
-
C:\Users\Admin\Documents\Bc2QjylHVzOJx1eHFZ4tpOJu.exe"C:\Users\Admin\Documents\Bc2QjylHVzOJx1eHFZ4tpOJu.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 8803⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
-
-
C:\Users\Admin\Documents\OLjJTsWTvNHfu0VWiBU0v0bM.exe"C:\Users\Admin\Documents\OLjJTsWTvNHfu0VWiBU0v0bM.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1936
-
-
C:\Users\Admin\Documents\S2HSTcAUNeMyQQbSOKlFnrEE.exe"C:\Users\Admin\Documents\S2HSTcAUNeMyQQbSOKlFnrEE.exe"2⤵
- Executes dropped EXE
PID:944
-
-
C:\Users\Admin\Documents\KOgdWGHZvxBi5i_Ej0WQBSrE.exe"C:\Users\Admin\Documents\KOgdWGHZvxBi5i_Ej0WQBSrE.exe"2⤵PID:876
-
-
C:\Users\Admin\Documents\sDCTG31GhnSJTJlFulawm8Ip.exe"C:\Users\Admin\Documents\sDCTG31GhnSJTJlFulawm8Ip.exe"2⤵
- Executes dropped EXE
PID:1052
-
-
C:\Users\Admin\Documents\rY5I4MXgT1oqZOPx970R9BBI.exe"C:\Users\Admin\Documents\rY5I4MXgT1oqZOPx970R9BBI.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1220 -
C:\Users\Admin\Documents\rY5I4MXgT1oqZOPx970R9BBI.exe"C:\Users\Admin\Documents\rY5I4MXgT1oqZOPx970R9BBI.exe"3⤵
- Executes dropped EXE
PID:2272
-
-
-
C:\Users\Admin\Documents\M8guWo7mSaS4VxOjuFT3n1au.exe"C:\Users\Admin\Documents\M8guWo7mSaS4VxOjuFT3n1au.exe"2⤵
- Executes dropped EXE
PID:320
-
-
C:\Users\Admin\Documents\CPj0VD4R6XlbKVVir7qdQ46l.exe"C:\Users\Admin\Documents\CPj0VD4R6XlbKVVir7qdQ46l.exe"2⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\8dh0J8X9.com"C:\Users\Admin\AppData\Local\Temp\8dh0J8X9.com"3⤵PID:3016
-
-
-
C:\Users\Admin\Documents\9YzvbamP0p4xNgmeMG2xz9wz.exe"C:\Users\Admin\Documents\9YzvbamP0p4xNgmeMG2xz9wz.exe"2⤵
- Executes dropped EXE
PID:2084 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\9YZVBA~1.DLL,s C:\Users\Admin\DOCUME~1\9YZVBA~1.EXE3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2688
-
-
-
C:\Users\Admin\Documents\n9H8FFDzHPSTuILfxCUkH0pA.exe"C:\Users\Admin\Documents\n9H8FFDzHPSTuILfxCUkH0pA.exe"2⤵
- Executes dropped EXE
PID:2056
-
-
C:\Users\Admin\Documents\gm_t9wgEZ62pQORGdiThO0CA.exe"C:\Users\Admin\Documents\gm_t9wgEZ62pQORGdiThO0CA.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1792
-
-
C:\Users\Admin\Documents\NTBvCOH_xtpwu1YzjDibFBpd.exe"C:\Users\Admin\Documents\NTBvCOH_xtpwu1YzjDibFBpd.exe"2⤵
- Executes dropped EXE
PID:1276
-
-
C:\Users\Admin\Documents\x1pHnzVKoUkgtOVmQ5JuPsav.exe"C:\Users\Admin\Documents\x1pHnzVKoUkgtOVmQ5JuPsav.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1648 -
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
PID:2616
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
- Modifies system certificate store
PID:2456
-
-
C:\Program Files (x86)\Company\NewProduct\inst1.exe"C:\Program Files (x86)\Company\NewProduct\inst1.exe"3⤵
- Executes dropped EXE
PID:2832
-
-
-
C:\Users\Admin\Documents\pN41pgZSPdZBgJtYOyiX8QPg.exe"C:\Users\Admin\Documents\pN41pgZSPdZBgJtYOyiX8QPg.exe"2⤵
- Executes dropped EXE
PID:1512
-
-
C:\Users\Admin\Documents\yVZljfao2DlhzcuKbOAmfkKD.exe"C:\Users\Admin\Documents\yVZljfao2DlhzcuKbOAmfkKD.exe"2⤵
- Executes dropped EXE
PID:1072
-
-
C:\Users\Admin\Documents\NvmtBNiV6YRbWvVQYjOQjrXX.exe"C:\Users\Admin\Documents\NvmtBNiV6YRbWvVQYjOQjrXX.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:768
-
-
C:\Users\Admin\Documents\y3spqmAGwZMUtf5c1E7YGSrZ.exe"C:\Users\Admin\Documents\y3spqmAGwZMUtf5c1E7YGSrZ.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1696 -
C:\Users\Admin\Documents\y3spqmAGwZMUtf5c1E7YGSrZ.exeC:\Users\Admin\Documents\y3spqmAGwZMUtf5c1E7YGSrZ.exe3⤵
- Executes dropped EXE
PID:2800
-
-
C:\Users\Admin\Documents\y3spqmAGwZMUtf5c1E7YGSrZ.exeC:\Users\Admin\Documents\y3spqmAGwZMUtf5c1E7YGSrZ.exe3⤵
- Executes dropped EXE
PID:2852
-
-
C:\Users\Admin\Documents\y3spqmAGwZMUtf5c1E7YGSrZ.exeC:\Users\Admin\Documents\y3spqmAGwZMUtf5c1E7YGSrZ.exe3⤵PID:2728
-
-
-
C:\Users\Admin\Documents\a7UdiaIuuIwRkXy4EYMqDcxZ.exe"C:\Users\Admin\Documents\a7UdiaIuuIwRkXy4EYMqDcxZ.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1656
-
-
C:\Users\Admin\Documents\5bAzIWQJKJUMEnNDImZcqHSF.exe"C:\Users\Admin\Documents\5bAzIWQJKJUMEnNDImZcqHSF.exe"2⤵
- Executes dropped EXE
PID:1616
-
-
C:\Users\Admin\Documents\DWkH7GyVyVTFbg9m2N5fMPm1.exe"C:\Users\Admin\Documents\DWkH7GyVyVTFbg9m2N5fMPm1.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies system certificate store
PID:1680 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:2492
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:2572
-
-
-
C:\Users\Admin\Documents\oktn_HsGk9b02sgjHpxFmbcs.exe"C:\Users\Admin\Documents\oktn_HsGk9b02sgjHpxFmbcs.exe"2⤵
- Executes dropped EXE
PID:1716 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCripT: CloSe ( CReateOBjecT ("wSCRipT.sheLl"). RUN ( "cmD /q /C TYPe ""C:\Users\Admin\Documents\oktn_HsGk9b02sgjHpxFmbcs.exe"" > Bx0IuOFB.ExE && StArT BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1 & iF """" == """" for %Q in ( ""C:\Users\Admin\Documents\oktn_HsGk9b02sgjHpxFmbcs.exe"" ) do taskkill -F -im ""%~NxQ"" ", 0, truE) )3⤵
- Modifies Internet Explorer settings
PID:2404 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /C TYPe "C:\Users\Admin\Documents\oktn_HsGk9b02sgjHpxFmbcs.exe" >Bx0IuOFB.ExE && StArT BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1 & iF "" == "" for %Q in ("C:\Users\Admin\Documents\oktn_HsGk9b02sgjHpxFmbcs.exe" ) do taskkill -F -im "%~NxQ"4⤵
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExEBX0iUoFB.EXe -PyTJSIPDC12bsxp0f15⤵
- Executes dropped EXE
PID:3052 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCripT: CloSe ( CReateOBjecT ("wSCRipT.sheLl"). RUN ( "cmD /q /C TYPe ""C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE"" > Bx0IuOFB.ExE && StArT BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1 & iF ""-PyTJSIPDC12bsxp0f1 "" == """" for %Q in ( ""C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE"" ) do taskkill -F -im ""%~NxQ"" ", 0, truE) )6⤵PID:1580
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /C TYPe "C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE" >Bx0IuOFB.ExE && StArT BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1 & iF "-PyTJSIPDC12bsxp0f1 " == "" for %Q in ("C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE" ) do taskkill -F -im "%~NxQ"7⤵PID:2156
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -F -im "oktn_HsGk9b02sgjHpxFmbcs.exe"5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
-
-
-
C:\Users\Admin\Documents\K5apV2XWtwW3mlh4grWW59O3.exe"C:\Users\Admin\Documents\K5apV2XWtwW3mlh4grWW59O3.exe"2⤵
- Executes dropped EXE
PID:672
-
-
C:\Users\Admin\AppData\Local\Temp\E012.exeC:\Users\Admin\AppData\Local\Temp\E012.exe1⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\3EA7.exeC:\Users\Admin\AppData\Local\Temp\3EA7.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\3EA7.exeC:\Users\Admin\AppData\Local\Temp\3EA7.exe2⤵
- Executes dropped EXE
PID:2636
-
-
C:\Users\Admin\AppData\Local\Temp\6FF4.exeC:\Users\Admin\AppData\Local\Temp\6FF4.exe1⤵
- Executes dropped EXE
PID:1996
-
C:\Users\Admin\AppData\Local\Temp\BF8B.exeC:\Users\Admin\AppData\Local\Temp\BF8B.exe1⤵
- Executes dropped EXE
PID:368
-
C:\Users\Admin\AppData\Local\Temp\F0C9.exeC:\Users\Admin\AppData\Local\Temp\F0C9.exe1⤵
- Executes dropped EXE
PID:824
-
C:\Windows\system32\taskeng.exetaskeng.exe {26F49CFC-231B-435D-9416-32657781B399} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵PID:2792
-
C:\Users\Admin\AppData\Roaming\gtiwdjuC:\Users\Admin\AppData\Roaming\gtiwdju2⤵
- Executes dropped EXE
PID:948
-
-
C:\Users\Admin\AppData\Roaming\hriwdjuC:\Users\Admin\AppData\Roaming\hriwdju2⤵PID:2876
-
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
Disabling Security Tools
1Install Root Certificate
1Modify Registry
3Virtualization/Sandbox Evasion
1Web Service
1