Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
26/12/2022, 08:31
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
41 signatures
150 seconds
General
- Target file.exe
- Size 232KB
- Sample221226-kep7eacf43
- SHA256 3fa43bda493149cd6e7ed44336894a92d3d3aec034cc12184bb13f6e8aedfbb3
- MD5 d693f42f4c145eedc8a1408fcd1c3d2a
- SHA1 edb102d725dd67c0fadeb7327a4da8701e5e036b
- SHA512 4b763adf0e69ecdc9787ee463b54ccb992bdc668416dd3c0e52925e71b69c907a52f7b257be986207099ae3f5924464c19bb15d2c9cc69c1d3be84da02241abc
- SSDEEP 3072:RPGFgvLDuL5QwYF4lclrvmgeWFBM3mklS1g/tK8AhmsLrcSb54VIcVTuh:HvLKaJvtLBMWqtK8A3bIr
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
amadey
Version
-
3.63
C2
-
62.204.41.165/g8sjnd3xe/index.php
Extracted
Family
-
djvu
C2
-
http://ex3mall.com/lancer/get.php
Attributes
-
extension
.isza
-
offline_id
m3KmScxfDyEQzJYP8qjOSfP4FvpsOXlekGuMPzt1
-
payload_url
http://uaery.top/dl/build2.exe
http://ex3mall.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-oWam3yYrSr Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0622JOsie
rsa_pubkey.plain
Signatures
- Detect Amadey credential stealer module 2 IoCs
resource yara_rule behavioral2/files/0x0008000000022e74-271.dat amadey_cred_module behavioral2/files/0x0008000000022e74-272.dat amadey_cred_module - Detected Djvu ransomware 10 IoCs
resource yara_rule behavioral2/memory/4912-146-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4912-148-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4336-150-0x00000000021A0000-0x00000000022BB000-memory.dmp family_djvu behavioral2/memory/4912-151-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4912-160-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4912-176-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3960-190-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3960-192-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3960-201-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3960-218-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu - Detects Smokeloader packer 2 IoCs
resource yara_rule behavioral2/memory/1048-133-0x00000000005E0000-0x00000000005E9000-memory.dmp family_smokeloader behavioral2/memory/2204-162-0x0000000000570000-0x0000000000579000-memory.dmp family_smokeloader - Djvu Ransomware
Ransomware which is a variant of the STOP family.
- Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2740 1608 rundll32.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4020 1608 rundll32.exe 80 - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 2 IoCs
flow pid Process 87 5024 rundll32.exe 95 816 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 20 IoCs
pid Process 4336 C5F4.exe 2204 C9AF.exe 1484 CC5F.exe 4912 C5F4.exe 532 nbveek.exe 3628 D152.exe 2996 D152.exe 1740 D376.exe 3856 D4EE.exe 308 D617.exe 3752 C5F4.exe 1040 D617.exe 3960 C5F4.exe 5044 build2.exe 4492 build2.exe 3676 build3.exe 1708 mstsca.exe 1252 nbveek.exe 4344 B1C3.exe 3080 nbveek.exe - Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation CC5F.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation nbveek.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation D152.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C5F4.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation D617.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C5F4.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation build2.exe - Loads dropped DLL 6 IoCs
pid Process 3096 rundll32.exe 4292 rundll32.exe 4492 build2.exe 4492 build2.exe 5024 rundll32.exe 816 rundll32.exe - Modifies file permissions 1 TTPs 1 IoCs
pid Process 4948 icacls.exe - Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\0dcb9677-482e-4ec2-a350-b8101172fc26\\C5F4.exe\" --AutoStart" C5F4.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 37 api.2ip.ua 39 api.2ip.ua 55 api.2ip.ua - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4336 set thread context of 4912 4336 C5F4.exe 88 PID 3752 set thread context of 3960 3752 C5F4.exe 113 PID 5044 set thread context of 4492 5044 build2.exe 119 PID 816 set thread context of 3820 816 rundll32.exe 135 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 4 IoCs
pid pid_target Process procid_target 860 1740 WerFault.exe 95 1584 3096 WerFault.exe 110 1556 4292 WerFault.exe 115 4456 4344 WerFault.exe 131 - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C9AF.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C9AF.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C9AF.exe - Checks processor information in registry 2 TTPs 27 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe - Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2388 schtasks.exe 1704 schtasks.exe 1480 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 3348 timeout.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found - Modifies registry class 30 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000000c55ef8e100054656d7000003a0009000400efbe0c5519990c55f48e2e000000000000000000000000000000000000000000000000004c6ec600540065006d007000000014000000 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f build2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 5c00000001000000040000000008000004000000010000001000000091de0625abdafd32170cbb25172a84670300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877619000000010000001000000063664b080559a094d10f0a3c5f4f629020000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f build2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C5F4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C5F4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C5F4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4 build2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f build2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C5F4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C5F4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee404000000010000001000000091de0625abdafd32170cbb25172a846720000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f build2.exe - Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 48 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 49 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2984 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1048 file.exe 1048 file.exe 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2984 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1048 file.exe 2204 C9AF.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found Token: SeShutdownPrivilege 2984 Process not Found Token: SeCreatePagefilePrivilege 2984 Process not Found - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3820 rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2984 Process not Found 2984 Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2984 wrote to memory of 4336 2984 Process not Found 85 PID 2984 wrote to memory of 4336 2984 Process not Found 85 PID 2984 wrote to memory of 4336 2984 Process not Found 85 PID 2984 wrote to memory of 2204 2984 Process not Found 86 PID 2984 wrote to memory of 2204 2984 Process not Found 86 PID 2984 wrote to memory of 2204 2984 Process not Found 86 PID 2984 wrote to memory of 1484 2984 Process not Found 87 PID 2984 wrote to memory of 1484 2984 Process not Found 87 PID 2984 wrote to memory of 1484 2984 Process not Found 87 PID 4336 wrote to memory of 4912 4336 C5F4.exe 88 PID 4336 wrote to memory of 4912 4336 C5F4.exe 88 PID 4336 wrote to memory of 4912 4336 C5F4.exe 88 PID 4336 wrote to memory of 4912 4336 C5F4.exe 88 PID 4336 wrote to memory of 4912 4336 C5F4.exe 88 PID 4336 wrote to memory of 4912 4336 C5F4.exe 88 PID 4336 wrote to memory of 4912 4336 C5F4.exe 88 PID 4336 wrote to memory of 4912 4336 C5F4.exe 88 PID 4336 wrote to memory of 4912 4336 C5F4.exe 88 PID 4336 wrote to memory of 4912 4336 C5F4.exe 88 PID 1484 wrote to memory of 532 1484 CC5F.exe 89 PID 1484 wrote to memory of 532 1484 CC5F.exe 89 PID 1484 wrote to memory of 532 1484 CC5F.exe 89 PID 2984 wrote to memory of 3628 2984 Process not Found 91 PID 2984 wrote to memory of 3628 2984 Process not Found 91 PID 2984 wrote to memory of 3628 2984 Process not Found 91 PID 532 wrote to memory of 1480 532 nbveek.exe 90 PID 532 wrote to memory of 1480 532 nbveek.exe 90 PID 532 wrote to memory of 1480 532 nbveek.exe 90 PID 3628 wrote to memory of 2996 3628 D152.exe 94 PID 3628 wrote to memory of 2996 3628 D152.exe 94 PID 3628 wrote to memory of 2996 3628 D152.exe 94 PID 2984 wrote to memory of 1740 2984 Process not Found 95 PID 2984 wrote to memory of 1740 2984 Process not Found 95 PID 2984 wrote to memory of 1740 2984 Process not Found 95 PID 2984 wrote to memory of 3856 2984 Process not Found 97 PID 2984 wrote to memory of 3856 2984 Process not Found 97 PID 2984 wrote to memory of 3856 2984 Process not Found 97 PID 4912 wrote to memory of 4948 4912 C5F4.exe 98 PID 4912 wrote to memory of 4948 4912 C5F4.exe 98 PID 4912 wrote to memory of 4948 4912 C5F4.exe 98 PID 2984 wrote to memory of 308 2984 Process not Found 99 PID 2984 wrote to memory of 308 2984 Process not Found 99 PID 2984 wrote to memory of 308 2984 Process not Found 99 PID 4912 wrote to memory of 3752 4912 C5F4.exe 102 PID 4912 wrote to memory of 3752 4912 C5F4.exe 102 PID 4912 wrote to memory of 3752 4912 C5F4.exe 102 PID 308 wrote to memory of 1040 308 D617.exe 103 PID 308 wrote to memory of 1040 308 D617.exe 103 PID 308 wrote to memory of 1040 308 D617.exe 103 PID 2740 wrote to memory of 3096 2740 rundll32.exe 110 PID 2740 wrote to memory of 3096 2740 rundll32.exe 110 PID 2740 wrote to memory of 3096 2740 rundll32.exe 110 PID 3752 wrote to memory of 3960 3752 C5F4.exe 113 PID 3752 wrote to memory of 3960 3752 C5F4.exe 113 PID 3752 wrote to memory of 3960 3752 C5F4.exe 113 PID 3752 wrote to memory of 3960 3752 C5F4.exe 113 PID 3752 wrote to memory of 3960 3752 C5F4.exe 113 PID 3752 wrote to memory of 3960 3752 C5F4.exe 113 PID 3752 wrote to memory of 3960 3752 C5F4.exe 113 PID 3752 wrote to memory of 3960 3752 C5F4.exe 113 PID 3752 wrote to memory of 3960 3752 C5F4.exe 113 PID 3752 wrote to memory of 3960 3752 C5F4.exe 113 PID 4020 wrote to memory of 4292 4020 rundll32.exe 115 PID 4020 wrote to memory of 4292 4020 rundll32.exe 115 - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1048
-
C:\Users\Admin\AppData\Local\Temp\C5F4.exeC:\Users\Admin\AppData\Local\Temp\C5F4.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\C5F4.exeC:\Users\Admin\AppData\Local\Temp\C5F4.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\0dcb9677-482e-4ec2-a350-b8101172fc26" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:4948
-
-
C:\Users\Admin\AppData\Local\Temp\C5F4.exe"C:\Users\Admin\AppData\Local\Temp\C5F4.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\C5F4.exe"C:\Users\Admin\AppData\Local\Temp\C5F4.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Checks computer location settings
PID:3960 -
C:\Users\Admin\AppData\Local\fc04860b-60cb-4542-a2ec-b820691ec845\build2.exe"C:\Users\Admin\AppData\Local\fc04860b-60cb-4542-a2ec-b820691ec845\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5044 -
C:\Users\Admin\AppData\Local\fc04860b-60cb-4542-a2ec-b820691ec845\build2.exe"C:\Users\Admin\AppData\Local\fc04860b-60cb-4542-a2ec-b820691ec845\build2.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
PID:4492 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\fc04860b-60cb-4542-a2ec-b820691ec845\build2.exe" & exit7⤵PID:544
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
PID:3348
-
-
-
-
-
C:\Users\Admin\AppData\Local\fc04860b-60cb-4542-a2ec-b820691ec845\build3.exe"C:\Users\Admin\AppData\Local\fc04860b-60cb-4542-a2ec-b820691ec845\build3.exe"5⤵
- Executes dropped EXE
PID:3676 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"6⤵
- Creates scheduled task(s)
PID:2388
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\C9AF.exeC:\Users\Admin\AppData\Local\Temp\C9AF.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2204
-
C:\Users\Admin\AppData\Local\Temp\CC5F.exeC:\Users\Admin\AppData\Local\Temp\CC5F.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe"C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe" /F3⤵
- Creates scheduled task(s)
PID:1480
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- outlook_win_path
PID:5024
-
-
-
C:\Users\Admin\AppData\Local\Temp\D152.exeC:\Users\Admin\AppData\Local\Temp\D152.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\D152.exe"C:\Users\Admin\AppData\Local\Temp\D152.exe" -h2⤵
- Executes dropped EXE
PID:2996
-
-
C:\Users\Admin\AppData\Local\Temp\D376.exeC:\Users\Admin\AppData\Local\Temp\D376.exe1⤵
- Executes dropped EXE
PID:1740 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 3402⤵
- Program crash
PID:860
-
-
C:\Users\Admin\AppData\Local\Temp\D4EE.exeC:\Users\Admin\AppData\Local\Temp\D4EE.exe1⤵
- Executes dropped EXE
PID:3856
-
C:\Users\Admin\AppData\Local\Temp\D617.exeC:\Users\Admin\AppData\Local\Temp\D617.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Users\Admin\AppData\Local\Temp\D617.exe"C:\Users\Admin\AppData\Local\Temp\D617.exe" -h2⤵
- Executes dropped EXE
PID:1040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1740 -ip 17401⤵PID:4416
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open2⤵
- Loads dropped DLL
PID:3096 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 6003⤵
- Program crash
PID:1584
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3096 -ip 30961⤵PID:3408
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open2⤵
- Loads dropped DLL
PID:4292 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 6003⤵
- Program crash
PID:1556
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4292 -ip 42921⤵PID:1056
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"2⤵
- Creates scheduled task(s)
PID:1704
-
-
C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exeC:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe1⤵
- Executes dropped EXE
PID:1252
-
C:\Users\Admin\AppData\Local\Temp\B1C3.exeC:\Users\Admin\AppData\Local\Temp\B1C3.exe1⤵
- Executes dropped EXE
PID:4344 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qfyshwqueqdpai.tmp",Dioeeedresq2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
PID:816 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 140403⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3820
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 5282⤵
- Program crash
PID:4456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4344 -ip 43441⤵PID:3200
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exeC:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe1⤵
- Executes dropped EXE
PID:3080
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\mozglue.dll
- Size 133KB
- SHA256 3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
- MD5 8f73c08a9660691143661bf7332c3c27
- SHA1 37fa65dd737c50fda710fdbde89e51374d0c204a
- SHA512 0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
- SSDEEP 3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\nss3.dll
- Size 1.2MB
- SHA256 e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
- MD5 bfac4e3c5908856ba17d41edcd455a51
- SHA1 8eec7e888767aa9e4cca8ff246eb2aacb9170428
- SHA512 2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
- SSDEEP 24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
- Size 2KB
- SHA256 7b9afbbe4ae8b3aecaa47b75f9fb178d864b1f138438d34c58ee7e2ec16be4c2
- MD5 3446452e22ba2f0059636e6b38bde4e6
- SHA1 58ecd15765e6506b2a224d739f9cbe49350765d1
- SHA512 9adc462d9531d228656dfc7c59ad0bb3acbdfc86c19a24cc8b703c96ff20e1d1296299f418f61ae7a9dcc9dfe920b8ca6a11209edbcb3c630d8ddb92c9f17ef1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
- Size 1KB
- SHA256 b8fbfc272d61dea1f6880ed2a51565be1702f41976a3754e83e0ee31bc283384
- MD5 727b3211cc6431ef88585369c6d3551b
- SHA1 56ce91da576d5973625a094d93d5f280a4827e97
- SHA512 3aa1c7dbed1f3135f110c3a8118e570a500936c54add455a7b41965ee9495186b234a09f166cd5a09fd94dc4affe0153b0b1c652b5c091e86065e3c584cd5b98
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
- Size 488B
- SHA256 01b346e81e5d5d5ec45e4d56c36b26b3462dc90be15286bad0b7acb1ba57618a
- MD5 b6960eefc60a6fa42609b5e7c0aebb1b
- SHA1 77fb6552efa84496e810d290def47272e5fca191
- SHA512 ffb5072a7cabae16d04ffd104209d75450519113226d8d3c38cc90a4da0e8cdcb7126724043730c0d0c8618d6cb2f95a4b58c24af1bf962fc89d7aad7fad466a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
- Size 482B
- SHA256 20b7f14ba990d4621e14da42a837e6a959c2a59ea1c1f67b622a6bd02c6eb601
- MD5 a876c49b73c7b6b144769bbb5e9476e1
- SHA1 3b7746d099cbef1dbf813b5e0db3a12d0664d69e
- SHA512 9bd61a766562661a8edf46b2b4d8c82100c653ed0b0cf1e1af5b60591fbdc32f7a5faa1831813a5606788c68fcebbbb93e55461fb67556494bdaff2d789a6a3b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\0dcb9677-482e-4ec2-a350-b8101172fc26\C5F4.exe
- Size 739KB
- SHA256 c4df1413996b6b021f056d9aff7b7a2a5fa2544f16e7b7254adf2251b08a1860
- MD5 b46dba300d34a731214c81a99ff8a20f
- SHA1 0cec8004392751cc750a0fc8164fea992ade624a
- SHA512 5796e97885d417dc7c3201afdaa6f6966e9480ba3c6f89a4e06ca78950ddbd275a4b1320382160aa32c658ec1e4c51cd2bed467dac196ca29c63763dc4279526
- SSDEEP 12288:8FFyqWkZCf+JeANWWSoOfdYOLGPgRG9zPlBJ7UqwXVLBZDHVxqm:LXk24gg9zLvwXfx1J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\B1C3.exe
- Size 1024KB
- SHA256 4317679dc2e9cec143e969106d1aabd15acdc498999be8016c9625fc21a69238
- MD5 80a8759c1016ff1938419b2a0e4741f1
- SHA1 b23df81e7a2e3515e5146560ba4e192382aa5abb
- SHA512 50b813b8956cfec316a21496f59434990f88ca72a03bf4961e7801536ebde343da5320b9774736cfd1379a00b23ff4f551b145cbcbfa7a54a98bf220db2086c7
- SSDEEP 12288:8FQBq4dmvMMQi3ku689GCEyyyi9+4Jmwm7y6DxMwKrzc9tIkMHHj+B/v8n5LI/ae:OMVWX9GdorwmD6w+NHqZv8nRvaAbfli
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\B1C3.exe
- Size 1024KB
- SHA256 4317679dc2e9cec143e969106d1aabd15acdc498999be8016c9625fc21a69238
- MD5 80a8759c1016ff1938419b2a0e4741f1
- SHA1 b23df81e7a2e3515e5146560ba4e192382aa5abb
- SHA512 50b813b8956cfec316a21496f59434990f88ca72a03bf4961e7801536ebde343da5320b9774736cfd1379a00b23ff4f551b145cbcbfa7a54a98bf220db2086c7
- SSDEEP 12288:8FQBq4dmvMMQi3ku689GCEyyyi9+4Jmwm7y6DxMwKrzc9tIkMHHj+B/v8n5LI/ae:OMVWX9GdorwmD6w+NHqZv8nRvaAbfli
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\C5F4.exe
- Size 739KB
- SHA256 c4df1413996b6b021f056d9aff7b7a2a5fa2544f16e7b7254adf2251b08a1860
- MD5 b46dba300d34a731214c81a99ff8a20f
- SHA1 0cec8004392751cc750a0fc8164fea992ade624a
- SHA512 5796e97885d417dc7c3201afdaa6f6966e9480ba3c6f89a4e06ca78950ddbd275a4b1320382160aa32c658ec1e4c51cd2bed467dac196ca29c63763dc4279526
- SSDEEP 12288:8FFyqWkZCf+JeANWWSoOfdYOLGPgRG9zPlBJ7UqwXVLBZDHVxqm:LXk24gg9zLvwXfx1J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\C5F4.exe
- Size 739KB
- SHA256 c4df1413996b6b021f056d9aff7b7a2a5fa2544f16e7b7254adf2251b08a1860
- MD5 b46dba300d34a731214c81a99ff8a20f
- SHA1 0cec8004392751cc750a0fc8164fea992ade624a
- SHA512 5796e97885d417dc7c3201afdaa6f6966e9480ba3c6f89a4e06ca78950ddbd275a4b1320382160aa32c658ec1e4c51cd2bed467dac196ca29c63763dc4279526
- SSDEEP 12288:8FFyqWkZCf+JeANWWSoOfdYOLGPgRG9zPlBJ7UqwXVLBZDHVxqm:LXk24gg9zLvwXfx1J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\C5F4.exe
- Size 739KB
- SHA256 c4df1413996b6b021f056d9aff7b7a2a5fa2544f16e7b7254adf2251b08a1860
- MD5 b46dba300d34a731214c81a99ff8a20f
- SHA1 0cec8004392751cc750a0fc8164fea992ade624a
- SHA512 5796e97885d417dc7c3201afdaa6f6966e9480ba3c6f89a4e06ca78950ddbd275a4b1320382160aa32c658ec1e4c51cd2bed467dac196ca29c63763dc4279526
- SSDEEP 12288:8FFyqWkZCf+JeANWWSoOfdYOLGPgRG9zPlBJ7UqwXVLBZDHVxqm:LXk24gg9zLvwXfx1J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\C5F4.exe
- Size 739KB
- SHA256 c4df1413996b6b021f056d9aff7b7a2a5fa2544f16e7b7254adf2251b08a1860
- MD5 b46dba300d34a731214c81a99ff8a20f
- SHA1 0cec8004392751cc750a0fc8164fea992ade624a
- SHA512 5796e97885d417dc7c3201afdaa6f6966e9480ba3c6f89a4e06ca78950ddbd275a4b1320382160aa32c658ec1e4c51cd2bed467dac196ca29c63763dc4279526
- SSDEEP 12288:8FFyqWkZCf+JeANWWSoOfdYOLGPgRG9zPlBJ7UqwXVLBZDHVxqm:LXk24gg9zLvwXfx1J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\C5F4.exe
- Size 739KB
- SHA256 c4df1413996b6b021f056d9aff7b7a2a5fa2544f16e7b7254adf2251b08a1860
- MD5 b46dba300d34a731214c81a99ff8a20f
- SHA1 0cec8004392751cc750a0fc8164fea992ade624a
- SHA512 5796e97885d417dc7c3201afdaa6f6966e9480ba3c6f89a4e06ca78950ddbd275a4b1320382160aa32c658ec1e4c51cd2bed467dac196ca29c63763dc4279526
- SSDEEP 12288:8FFyqWkZCf+JeANWWSoOfdYOLGPgRG9zPlBJ7UqwXVLBZDHVxqm:LXk24gg9zLvwXfx1J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\C9AF.exe
- Size 234KB
- SHA256 6e7275ecb41da8e1c1733e1d8f4e75a0a211f1b10249432af0b8b017172271a6
- MD5 df9bf72a6ecc1ff88bf505abeab991d8
- SHA1 c02a68be41969d3183df40843b4e4c2981378d52
- SHA512 6edfcca5043dd322e72ebc13a6cba10831d76f1d21de56a525cdc2902e2bc0cac5f301d3bca0910fee5bd430a65fe39d6d3ca1703688a4201ef49526e69b3eda
- SSDEEP 3072:zY5WnLBP5RMu9xrPGEKDj65EfFx4lS1g/tK8icbWLrcSb54VIcVTuh:fLBoCxrOpjGtK8LcbIr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\C9AF.exe
- Size 234KB
- SHA256 6e7275ecb41da8e1c1733e1d8f4e75a0a211f1b10249432af0b8b017172271a6
- MD5 df9bf72a6ecc1ff88bf505abeab991d8
- SHA1 c02a68be41969d3183df40843b4e4c2981378d52
- SHA512 6edfcca5043dd322e72ebc13a6cba10831d76f1d21de56a525cdc2902e2bc0cac5f301d3bca0910fee5bd430a65fe39d6d3ca1703688a4201ef49526e69b3eda
- SSDEEP 3072:zY5WnLBP5RMu9xrPGEKDj65EfFx4lS1g/tK8icbWLrcSb54VIcVTuh:fLBoCxrOpjGtK8LcbIr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\CC5F.exe
- Size 235KB
- SHA256 5882c280879e455296e2ff9e0570d6dfe4780cf18e62e7c8ba346a97a719d445
- MD5 1d641e8215a82151e8925673bfb171a1
- SHA1 12885d250304d50920b79a00524250eaac5a7741
- SHA512 b6791f1b56ee4e992bc4726a7a6cbdbef10bbfad3eb1dfa968679344932ab06d76640e49d5018adb3ab386b36917e12b5d7a93e9d27c4a28af4ac1b8896ec6ce
- SSDEEP 6144:LkwjBO99g6779r0psUhmiIuVyD2Ng8hJgN:0TrOh2uVyCN3hS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\CC5F.exe
- Size 235KB
- SHA256 5882c280879e455296e2ff9e0570d6dfe4780cf18e62e7c8ba346a97a719d445
- MD5 1d641e8215a82151e8925673bfb171a1
- SHA1 12885d250304d50920b79a00524250eaac5a7741
- SHA512 b6791f1b56ee4e992bc4726a7a6cbdbef10bbfad3eb1dfa968679344932ab06d76640e49d5018adb3ab386b36917e12b5d7a93e9d27c4a28af4ac1b8896ec6ce
- SSDEEP 6144:LkwjBO99g6779r0psUhmiIuVyD2Ng8hJgN:0TrOh2uVyCN3hS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D152.exe
- Size 135KB
- SHA256 65a0ff579725febf7e9c0888d4c5e928ab007b61e337df14d02b0f7f359c8c57
- MD5 a3167bb591e41a94226e0d88122e12f0
- SHA1 049c9602177b04961a4172f6d15d2376f90e64e1
- SHA512 ec584dc300e136892e632f48494c18996ae9d6b84a91e7880f7fbc52e9f4574fc0265e62c1f24b73135dfbcde50eb718b1ce8bda21fb5b6475739bb519f07550
- SSDEEP 3072:j//bjFcuc8BQf9S8hx4e96a+dwWSwpy0g:j7jFV6oowpM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D152.exe
- Size 135KB
- SHA256 65a0ff579725febf7e9c0888d4c5e928ab007b61e337df14d02b0f7f359c8c57
- MD5 a3167bb591e41a94226e0d88122e12f0
- SHA1 049c9602177b04961a4172f6d15d2376f90e64e1
- SHA512 ec584dc300e136892e632f48494c18996ae9d6b84a91e7880f7fbc52e9f4574fc0265e62c1f24b73135dfbcde50eb718b1ce8bda21fb5b6475739bb519f07550
- SSDEEP 3072:j//bjFcuc8BQf9S8hx4e96a+dwWSwpy0g:j7jFV6oowpM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D152.exe
- Size 135KB
- SHA256 65a0ff579725febf7e9c0888d4c5e928ab007b61e337df14d02b0f7f359c8c57
- MD5 a3167bb591e41a94226e0d88122e12f0
- SHA1 049c9602177b04961a4172f6d15d2376f90e64e1
- SHA512 ec584dc300e136892e632f48494c18996ae9d6b84a91e7880f7fbc52e9f4574fc0265e62c1f24b73135dfbcde50eb718b1ce8bda21fb5b6475739bb519f07550
- SSDEEP 3072:j//bjFcuc8BQf9S8hx4e96a+dwWSwpy0g:j7jFV6oowpM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D376.exe
- Size 231KB
- SHA256 a7e036e543653af2f8c2baea4a1eee14ea0ffab817582a0e471883fb7d36223e
- MD5 3bc54e0d525cf67e8bdf3779b1752f2f
- SHA1 66b9ef248aa3d8650ee07311aaed358e69544993
- SHA512 f3c8a1e480d47b4fb1d0a42489b72ce014b2a8f9f77639210b87d0394d03d4c540b0cd8490975a44b6b1d990da363b8311181bb54a70ce681e4b2e39cafd358c
- SSDEEP 3072:97JhWTLMa5MI+csayd15kFVAjUYBmz5Guu2lS1g/tK8TTpoLrcSb54VIcVTuh:6LMk0qiBmzRtK8TgbIr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D376.exe
- Size 231KB
- SHA256 a7e036e543653af2f8c2baea4a1eee14ea0ffab817582a0e471883fb7d36223e
- MD5 3bc54e0d525cf67e8bdf3779b1752f2f
- SHA1 66b9ef248aa3d8650ee07311aaed358e69544993
- SHA512 f3c8a1e480d47b4fb1d0a42489b72ce014b2a8f9f77639210b87d0394d03d4c540b0cd8490975a44b6b1d990da363b8311181bb54a70ce681e4b2e39cafd358c
- SSDEEP 3072:97JhWTLMa5MI+csayd15kFVAjUYBmz5Guu2lS1g/tK8TTpoLrcSb54VIcVTuh:6LMk0qiBmzRtK8TgbIr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D4EE.exe
- Size 235KB
- SHA256 5882c280879e455296e2ff9e0570d6dfe4780cf18e62e7c8ba346a97a719d445
- MD5 1d641e8215a82151e8925673bfb171a1
- SHA1 12885d250304d50920b79a00524250eaac5a7741
- SHA512 b6791f1b56ee4e992bc4726a7a6cbdbef10bbfad3eb1dfa968679344932ab06d76640e49d5018adb3ab386b36917e12b5d7a93e9d27c4a28af4ac1b8896ec6ce
- SSDEEP 6144:LkwjBO99g6779r0psUhmiIuVyD2Ng8hJgN:0TrOh2uVyCN3hS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D4EE.exe
- Size 235KB
- SHA256 5882c280879e455296e2ff9e0570d6dfe4780cf18e62e7c8ba346a97a719d445
- MD5 1d641e8215a82151e8925673bfb171a1
- SHA1 12885d250304d50920b79a00524250eaac5a7741
- SHA512 b6791f1b56ee4e992bc4726a7a6cbdbef10bbfad3eb1dfa968679344932ab06d76640e49d5018adb3ab386b36917e12b5d7a93e9d27c4a28af4ac1b8896ec6ce
- SSDEEP 6144:LkwjBO99g6779r0psUhmiIuVyD2Ng8hJgN:0TrOh2uVyCN3hS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D617.exe
- Size 135KB
- SHA256 65a0ff579725febf7e9c0888d4c5e928ab007b61e337df14d02b0f7f359c8c57
- MD5 a3167bb591e41a94226e0d88122e12f0
- SHA1 049c9602177b04961a4172f6d15d2376f90e64e1
- SHA512 ec584dc300e136892e632f48494c18996ae9d6b84a91e7880f7fbc52e9f4574fc0265e62c1f24b73135dfbcde50eb718b1ce8bda21fb5b6475739bb519f07550
- SSDEEP 3072:j//bjFcuc8BQf9S8hx4e96a+dwWSwpy0g:j7jFV6oowpM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D617.exe
- Size 135KB
- SHA256 65a0ff579725febf7e9c0888d4c5e928ab007b61e337df14d02b0f7f359c8c57
- MD5 a3167bb591e41a94226e0d88122e12f0
- SHA1 049c9602177b04961a4172f6d15d2376f90e64e1
- SHA512 ec584dc300e136892e632f48494c18996ae9d6b84a91e7880f7fbc52e9f4574fc0265e62c1f24b73135dfbcde50eb718b1ce8bda21fb5b6475739bb519f07550
- SSDEEP 3072:j//bjFcuc8BQf9S8hx4e96a+dwWSwpy0g:j7jFV6oowpM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D617.exe
- Size 135KB
- SHA256 65a0ff579725febf7e9c0888d4c5e928ab007b61e337df14d02b0f7f359c8c57
- MD5 a3167bb591e41a94226e0d88122e12f0
- SHA1 049c9602177b04961a4172f6d15d2376f90e64e1
- SHA512 ec584dc300e136892e632f48494c18996ae9d6b84a91e7880f7fbc52e9f4574fc0265e62c1f24b73135dfbcde50eb718b1ce8bda21fb5b6475739bb519f07550
- SSDEEP 3072:j//bjFcuc8BQf9S8hx4e96a+dwWSwpy0g:j7jFV6oowpM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Qfyshwqueqdpai.tmp
- Size 792KB
- SHA256 72bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
- MD5 822d3ead416a1a85cb96e65f65cd5ae2
- SHA1 af32b69e2835d1cacdadb97ae6dfafccc32d1837
- SHA512 48d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
- SSDEEP 24576:o9FmFb4sE9VXjvqjNnHgseKbgf7jb10Dj:orsBpelfC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Qfyshwqueqdpai.tmp
- Size 792KB
- SHA256 72bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
- MD5 822d3ead416a1a85cb96e65f65cd5ae2
- SHA1 af32b69e2835d1cacdadb97ae6dfafccc32d1837
- SHA512 48d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
- SSDEEP 24576:o9FmFb4sE9VXjvqjNnHgseKbgf7jb10Dj:orsBpelfC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
- Size 235KB
- SHA256 5882c280879e455296e2ff9e0570d6dfe4780cf18e62e7c8ba346a97a719d445
- MD5 1d641e8215a82151e8925673bfb171a1
- SHA1 12885d250304d50920b79a00524250eaac5a7741
- SHA512 b6791f1b56ee4e992bc4726a7a6cbdbef10bbfad3eb1dfa968679344932ab06d76640e49d5018adb3ab386b36917e12b5d7a93e9d27c4a28af4ac1b8896ec6ce
- SSDEEP 6144:LkwjBO99g6779r0psUhmiIuVyD2Ng8hJgN:0TrOh2uVyCN3hS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
- Size 235KB
- SHA256 5882c280879e455296e2ff9e0570d6dfe4780cf18e62e7c8ba346a97a719d445
- MD5 1d641e8215a82151e8925673bfb171a1
- SHA1 12885d250304d50920b79a00524250eaac5a7741
- SHA512 b6791f1b56ee4e992bc4726a7a6cbdbef10bbfad3eb1dfa968679344932ab06d76640e49d5018adb3ab386b36917e12b5d7a93e9d27c4a28af4ac1b8896ec6ce
- SSDEEP 6144:LkwjBO99g6779r0psUhmiIuVyD2Ng8hJgN:0TrOh2uVyCN3hS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
- Size 235KB
- SHA256 5882c280879e455296e2ff9e0570d6dfe4780cf18e62e7c8ba346a97a719d445
- MD5 1d641e8215a82151e8925673bfb171a1
- SHA1 12885d250304d50920b79a00524250eaac5a7741
- SHA512 b6791f1b56ee4e992bc4726a7a6cbdbef10bbfad3eb1dfa968679344932ab06d76640e49d5018adb3ab386b36917e12b5d7a93e9d27c4a28af4ac1b8896ec6ce
- SSDEEP 6144:LkwjBO99g6779r0psUhmiIuVyD2Ng8hJgN:0TrOh2uVyCN3hS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\cb465ca805\nbveek.exe
- Size 235KB
- SHA256 5882c280879e455296e2ff9e0570d6dfe4780cf18e62e7c8ba346a97a719d445
- MD5 1d641e8215a82151e8925673bfb171a1
- SHA1 12885d250304d50920b79a00524250eaac5a7741
- SHA512 b6791f1b56ee4e992bc4726a7a6cbdbef10bbfad3eb1dfa968679344932ab06d76640e49d5018adb3ab386b36917e12b5d7a93e9d27c4a28af4ac1b8896ec6ce
- SSDEEP 6144:LkwjBO99g6779r0psUhmiIuVyD2Ng8hJgN:0TrOh2uVyCN3hS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\db.dat
- Size 557KB
- SHA256 234b037565a89b5d3cdabb963390b84bbfb23f68de1d7a940d250c13d6eb2087
- MD5 d8fdf3094adfa6cd96ad85cb3b1c0888
- SHA1 e1ff8d0d9d04b6da1c78fa2eeb002f89e1c217ef
- SHA512 a55f0f2a2bc7182c639de20bcafab8ad71416665b3e9f24276d55a03312f0a0014ff12916a08f42edbfd8f58b2bc59e01010271bed028c2c67cce97535af6a94
- SSDEEP 12288:FV1e0UgkVT6ZT+3JCnoxgLqoCXwbePLJrH8fwpx:FV1edgkV8T0CnoxX4ePLJTMwpx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\db.dat
- Size 557KB
- SHA256 234b037565a89b5d3cdabb963390b84bbfb23f68de1d7a940d250c13d6eb2087
- MD5 d8fdf3094adfa6cd96ad85cb3b1c0888
- SHA1 e1ff8d0d9d04b6da1c78fa2eeb002f89e1c217ef
- SHA512 a55f0f2a2bc7182c639de20bcafab8ad71416665b3e9f24276d55a03312f0a0014ff12916a08f42edbfd8f58b2bc59e01010271bed028c2c67cce97535af6a94
- SSDEEP 12288:FV1e0UgkVT6ZT+3JCnoxgLqoCXwbePLJrH8fwpx:FV1edgkV8T0CnoxX4ePLJTMwpx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\db.dll
- Size 52KB
- SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
- MD5 0b35335b70b96d31633d0caa207d71f9
- SHA1 996c7804fe4d85025e2bd7ea8aa5e33c71518f84
- SHA512 ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce
- SSDEEP 384:1BTKYF02qk7B4NQvtYFd+4az+K9BFcl8rmsmyk/SzR+1jxYOAzuTHo1AR/Nrvrtb:1BTqqMa+tl8iv/Pjx3E0YqtZlWtVt4F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\db.dll
- Size 52KB
- SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
- MD5 0b35335b70b96d31633d0caa207d71f9
- SHA1 996c7804fe4d85025e2bd7ea8aa5e33c71518f84
- SHA512 ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce
- SSDEEP 384:1BTKYF02qk7B4NQvtYFd+4az+K9BFcl8rmsmyk/SzR+1jxYOAzuTHo1AR/Nrvrtb:1BTqqMa+tl8iv/Pjx3E0YqtZlWtVt4F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\db.dll
- Size 52KB
- SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
- MD5 0b35335b70b96d31633d0caa207d71f9
- SHA1 996c7804fe4d85025e2bd7ea8aa5e33c71518f84
- SHA512 ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce
- SSDEEP 384:1BTKYF02qk7B4NQvtYFd+4az+K9BFcl8rmsmyk/SzR+1jxYOAzuTHo1AR/Nrvrtb:1BTqqMa+tl8iv/Pjx3E0YqtZlWtVt4F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\db.dll
- Size 52KB
- SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
- MD5 0b35335b70b96d31633d0caa207d71f9
- SHA1 996c7804fe4d85025e2bd7ea8aa5e33c71518f84
- SHA512 ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce
- SSDEEP 384:1BTKYF02qk7B4NQvtYFd+4az+K9BFcl8rmsmyk/SzR+1jxYOAzuTHo1AR/Nrvrtb:1BTqqMa+tl8iv/Pjx3E0YqtZlWtVt4F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\fc04860b-60cb-4542-a2ec-b820691ec845\build2.exe
- Size 409KB
- SHA256 027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1
- MD5 a131064868de7468d2e768211431401b
- SHA1 381ad582f72b30b4764afe0a817569b384be65a2
- SHA512 40fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309
- SSDEEP 6144:0u3LW8qK4AjlZ0mC4SpIYVzGlB4C0ke8jGjd4bH4rWlRjO1n:0yS8qK4AuPqwzoOC0ke8jGiErW9u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\fc04860b-60cb-4542-a2ec-b820691ec845\build2.exe
- Size 409KB
- SHA256 027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1
- MD5 a131064868de7468d2e768211431401b
- SHA1 381ad582f72b30b4764afe0a817569b384be65a2
- SHA512 40fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309
- SSDEEP 6144:0u3LW8qK4AjlZ0mC4SpIYVzGlB4C0ke8jGjd4bH4rWlRjO1n:0yS8qK4AuPqwzoOC0ke8jGiErW9u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\fc04860b-60cb-4542-a2ec-b820691ec845\build2.exe
- Size 409KB
- SHA256 027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1
- MD5 a131064868de7468d2e768211431401b
- SHA1 381ad582f72b30b4764afe0a817569b384be65a2
- SHA512 40fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309
- SSDEEP 6144:0u3LW8qK4AjlZ0mC4SpIYVzGlB4C0ke8jGjd4bH4rWlRjO1n:0yS8qK4AuPqwzoOC0ke8jGiErW9u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\fc04860b-60cb-4542-a2ec-b820691ec845\build3.exe
- Size 9KB
- SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
- MD5 9ead10c08e72ae41921191f8db39bc16
- SHA1 abe3bce01cd34afc88e2c838173f8c2bd0090ae1
- SHA512 aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
- SSDEEP 192:9UEc8b6H1LE+4LoGgMatAJ2lzUw317NyEpvNHhqyo:9UUE1BYoGza/D3170kiyo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\fc04860b-60cb-4542-a2ec-b820691ec845\build3.exe
- Size 9KB
- SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
- MD5 9ead10c08e72ae41921191f8db39bc16
- SHA1 abe3bce01cd34afc88e2c838173f8c2bd0090ae1
- SHA512 aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
- SSDEEP 192:9UEc8b6H1LE+4LoGgMatAJ2lzUw317NyEpvNHhqyo:9UUE1BYoGza/D3170kiyo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
- Size 126KB
- SHA256 5e4cb0cc51202cef27c4f5da63362ceee8c29a03e61ac19efda3c137b657d9ef
- MD5 70134bf4d1cd851b382b2930a2e182ea
- SHA1 8454d476c0d36564792b49be546593af3eab29f4
- SHA512 1af07ab22359f69fe32e359883f7d31f3068582ba0eddcb1faf6bf7686f32f51e36cdf645ac9dd727a4bf9b8c390245d7e71faf17c1a18ff3054c55f19c770bd
- SSDEEP 3072:Yx7pOYzBekf3tiINwyP7XSSJds3zhrjPcnqULv4q9:Yx7ZNhf3vwyOztPc3L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
- Size 126KB
- SHA256 5e4cb0cc51202cef27c4f5da63362ceee8c29a03e61ac19efda3c137b657d9ef
- MD5 70134bf4d1cd851b382b2930a2e182ea
- SHA1 8454d476c0d36564792b49be546593af3eab29f4
- SHA512 1af07ab22359f69fe32e359883f7d31f3068582ba0eddcb1faf6bf7686f32f51e36cdf645ac9dd727a4bf9b8c390245d7e71faf17c1a18ff3054c55f19c770bd
- SSDEEP 3072:Yx7pOYzBekf3tiINwyP7XSSJds3zhrjPcnqULv4q9:Yx7ZNhf3vwyOztPc3L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
- Size 9KB
- SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
- MD5 9ead10c08e72ae41921191f8db39bc16
- SHA1 abe3bce01cd34afc88e2c838173f8c2bd0090ae1
- SHA512 aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
- SSDEEP 192:9UEc8b6H1LE+4LoGgMatAJ2lzUw317NyEpvNHhqyo:9UUE1BYoGza/D3170kiyo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
- Size 9KB
- SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
- MD5 9ead10c08e72ae41921191f8db39bc16
- SHA1 abe3bce01cd34afc88e2c838173f8c2bd0090ae1
- SHA512 aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
- SSDEEP 192:9UEc8b6H1LE+4LoGgMatAJ2lzUw317NyEpvNHhqyo:9UUE1BYoGza/D3170kiyo
- MD5 SHA1 SHA512 SSDEEP