Analysis
-
max time kernel
97s -
max time network
181s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 10:39
Static task
static1
Behavioral task
behavioral1
Sample
6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe
Resource
win10v2004-20240226-en
General
-
Target
6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe
-
Size
4.5MB
-
MD5
20ed8b8eb556fa3cbc88b83882a6f1b0
-
SHA1
cd7ce6fc0068b6ef9c37d5dafec1319a39b88709
-
SHA256
6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421
-
SHA512
868b859bdff27e41f63b527590214ad22dcaf332bb3d5c7daafd295ea648d71d5bd6d01fee29587eee8b7d4ef01384089eb0b2408f3d2e048021701c357e3b9b
-
SSDEEP
98304:in1GhDYSAEbWAtdt7Eea0+JJHOBMT6yCltq5CFvxWof8e45D4UO38cYd5:0gYfux7EF0CHqI6Xg5CFvxW2Pe
Malware Config
Extracted
smokeloader
pub3
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Extracted
stealc
http://185.172.128.26
-
url_path
/f993692117a3fda2.php
Signatures
-
Glupteba payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/324-1559-0x0000000004CA0000-0x000000000558B000-memory.dmp family_glupteba behavioral1/memory/324-1566-0x0000000000400000-0x0000000002F43000-memory.dmp family_glupteba behavioral1/memory/552-1567-0x0000000000400000-0x0000000002F43000-memory.dmp family_glupteba -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
v9RyXQ4HEeXwyZrWGtVt3Vmg.exeEcucRTIIbW13PhJk4wNcSnkz.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ v9RyXQ4HEeXwyZrWGtVt3Vmg.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ EcucRTIIbW13PhJk4wNcSnkz.exe -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
EcucRTIIbW13PhJk4wNcSnkz.exev9RyXQ4HEeXwyZrWGtVt3Vmg.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion EcucRTIIbW13PhJk4wNcSnkz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion EcucRTIIbW13PhJk4wNcSnkz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion v9RyXQ4HEeXwyZrWGtVt3Vmg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion v9RyXQ4HEeXwyZrWGtVt3Vmg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Control Panel\International\Geo\Nation 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe -
Executes dropped EXE 17 IoCs
Processes:
sXSvtlUO6vYoIOpvuIhzz57t.exeFVHgOhRx0Sbki9KZawHTgSQV.exe8virsid_oH3ERHf6Co7xW1aF.exepy3bcjp7iQOD_QOd6_YBrgao.exewwr5NVHy56oweCVXiwOaSAOq.exeNdoPJtGQMvegt8fmmiEEOVbS.exeTaBI7EhyHJUNWhOG_cllPwTj.exeEcucRTIIbW13PhJk4wNcSnkz.exe75axDq6OUWeTTsAXcSiLEyvr.exev9RyXQ4HEeXwyZrWGtVt3Vmg.exeAntpnpqB_fPx6qW15ZjmkFW5.exe75axDq6OUWeTTsAXcSiLEyvr.tmpwsgen.exewsgen.exedckuybanmlgp.exedckuybanmlgp.exepid process 528 sXSvtlUO6vYoIOpvuIhzz57t.exe 552 FVHgOhRx0Sbki9KZawHTgSQV.exe 1364 8virsid_oH3ERHf6Co7xW1aF.exe 2820 py3bcjp7iQOD_QOd6_YBrgao.exe 1056 wwr5NVHy56oweCVXiwOaSAOq.exe 324 NdoPJtGQMvegt8fmmiEEOVbS.exe 1764 TaBI7EhyHJUNWhOG_cllPwTj.exe 1984 EcucRTIIbW13PhJk4wNcSnkz.exe 2412 75axDq6OUWeTTsAXcSiLEyvr.exe 1780 v9RyXQ4HEeXwyZrWGtVt3Vmg.exe 1672 AntpnpqB_fPx6qW15ZjmkFW5.exe 2868 75axDq6OUWeTTsAXcSiLEyvr.tmp 768 wsgen.exe 1048 wsgen.exe 468 2272 dckuybanmlgp.exe 1512 dckuybanmlgp.exe -
Loads dropped DLL 15 IoCs
Processes:
6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe75axDq6OUWeTTsAXcSiLEyvr.exe75axDq6OUWeTTsAXcSiLEyvr.tmpWerFault.exeTaBI7EhyHJUNWhOG_cllPwTj.exepid process 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 2412 75axDq6OUWeTTsAXcSiLEyvr.exe 2868 75axDq6OUWeTTsAXcSiLEyvr.tmp 2868 75axDq6OUWeTTsAXcSiLEyvr.tmp 2868 75axDq6OUWeTTsAXcSiLEyvr.tmp 2868 75axDq6OUWeTTsAXcSiLEyvr.tmp 1108 WerFault.exe 1108 WerFault.exe 1108 WerFault.exe 1108 WerFault.exe 468 1764 TaBI7EhyHJUNWhOG_cllPwTj.exe 1764 TaBI7EhyHJUNWhOG_cllPwTj.exe 1108 WerFault.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Documents\GuardFox\v9RyXQ4HEeXwyZrWGtVt3Vmg.exe themida C:\Users\Admin\Documents\GuardFox\EcucRTIIbW13PhJk4wNcSnkz.exe themida behavioral1/memory/1984-1314-0x0000000000D50000-0x0000000001D24000-memory.dmp themida behavioral1/memory/1780-1321-0x0000000001080000-0x0000000002059000-memory.dmp themida C:\Users\Admin\Documents\GuardFox\EcucRTIIbW13PhJk4wNcSnkz.exe themida behavioral1/memory/1984-1398-0x0000000000D50000-0x0000000001D24000-memory.dmp themida behavioral1/memory/1780-1556-0x0000000001080000-0x0000000002059000-memory.dmp themida behavioral1/memory/1984-1562-0x0000000000D50000-0x0000000001D24000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
v9RyXQ4HEeXwyZrWGtVt3Vmg.exeEcucRTIIbW13PhJk4wNcSnkz.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA v9RyXQ4HEeXwyZrWGtVt3Vmg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA EcucRTIIbW13PhJk4wNcSnkz.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
Processes:
flow ioc 125 iplogger.org 19 bitbucket.org 31 bitbucket.org 42 bitbucket.org 52 bitbucket.org 124 iplogger.org -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.myip.com 6 api.myip.com 9 ipinfo.io 10 ipinfo.io -
Drops file in System32 directory 4 IoCs
Processes:
6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe File opened for modification C:\Windows\System32\GroupPolicy 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
v9RyXQ4HEeXwyZrWGtVt3Vmg.exeEcucRTIIbW13PhJk4wNcSnkz.exepid process 1780 v9RyXQ4HEeXwyZrWGtVt3Vmg.exe 1984 EcucRTIIbW13PhJk4wNcSnkz.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dckuybanmlgp.exedescription pid process target process PID 2272 set thread context of 2612 2272 dckuybanmlgp.exe conhost.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 1012 sc.exe 1960 sc.exe 2616 sc.exe 1184 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1108 1364 WerFault.exe 8virsid_oH3ERHf6Co7xW1aF.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
sXSvtlUO6vYoIOpvuIhzz57t.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sXSvtlUO6vYoIOpvuIhzz57t.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sXSvtlUO6vYoIOpvuIhzz57t.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sXSvtlUO6vYoIOpvuIhzz57t.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
TaBI7EhyHJUNWhOG_cllPwTj.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TaBI7EhyHJUNWhOG_cllPwTj.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString TaBI7EhyHJUNWhOG_cllPwTj.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1680 taskkill.exe -
Processes:
6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exev9RyXQ4HEeXwyZrWGtVt3Vmg.exepy3bcjp7iQOD_QOd6_YBrgao.exeEcucRTIIbW13PhJk4wNcSnkz.exesXSvtlUO6vYoIOpvuIhzz57t.exeTaBI7EhyHJUNWhOG_cllPwTj.exepid process 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 1780 v9RyXQ4HEeXwyZrWGtVt3Vmg.exe 2820 py3bcjp7iQOD_QOd6_YBrgao.exe 1984 EcucRTIIbW13PhJk4wNcSnkz.exe 528 sXSvtlUO6vYoIOpvuIhzz57t.exe 528 sXSvtlUO6vYoIOpvuIhzz57t.exe 1780 v9RyXQ4HEeXwyZrWGtVt3Vmg.exe 1764 TaBI7EhyHJUNWhOG_cllPwTj.exe 1412 1412 1412 1984 EcucRTIIbW13PhJk4wNcSnkz.exe 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 2820 py3bcjp7iQOD_QOd6_YBrgao.exe 1412 1412 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
sXSvtlUO6vYoIOpvuIhzz57t.exepid process 528 sXSvtlUO6vYoIOpvuIhzz57t.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
powercfg.exepowercfg.exepowercfg.exepowercfg.exetaskkill.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeShutdownPrivilege 2996 powercfg.exe Token: SeShutdownPrivilege 1856 powercfg.exe Token: SeShutdownPrivilege 1708 powercfg.exe Token: SeShutdownPrivilege 2312 powercfg.exe Token: SeDebugPrivilege 1680 taskkill.exe Token: SeShutdownPrivilege 1412 Token: SeShutdownPrivilege 1556 powercfg.exe Token: SeShutdownPrivilege 1540 powercfg.exe Token: SeShutdownPrivilege 1688 powercfg.exe Token: SeShutdownPrivilege 1656 powercfg.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
75axDq6OUWeTTsAXcSiLEyvr.tmppid process 2868 75axDq6OUWeTTsAXcSiLEyvr.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe75axDq6OUWeTTsAXcSiLEyvr.exe75axDq6OUWeTTsAXcSiLEyvr.tmpAntpnpqB_fPx6qW15ZjmkFW5.exedescription pid process target process PID 2532 wrote to memory of 552 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe FVHgOhRx0Sbki9KZawHTgSQV.exe PID 2532 wrote to memory of 552 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe FVHgOhRx0Sbki9KZawHTgSQV.exe PID 2532 wrote to memory of 552 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe FVHgOhRx0Sbki9KZawHTgSQV.exe PID 2532 wrote to memory of 552 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe FVHgOhRx0Sbki9KZawHTgSQV.exe PID 2532 wrote to memory of 528 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe sXSvtlUO6vYoIOpvuIhzz57t.exe PID 2532 wrote to memory of 528 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe sXSvtlUO6vYoIOpvuIhzz57t.exe PID 2532 wrote to memory of 528 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe sXSvtlUO6vYoIOpvuIhzz57t.exe PID 2532 wrote to memory of 528 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe sXSvtlUO6vYoIOpvuIhzz57t.exe PID 2532 wrote to memory of 324 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe NdoPJtGQMvegt8fmmiEEOVbS.exe PID 2532 wrote to memory of 324 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe NdoPJtGQMvegt8fmmiEEOVbS.exe PID 2532 wrote to memory of 324 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe NdoPJtGQMvegt8fmmiEEOVbS.exe PID 2532 wrote to memory of 324 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe NdoPJtGQMvegt8fmmiEEOVbS.exe PID 2532 wrote to memory of 1364 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 8virsid_oH3ERHf6Co7xW1aF.exe PID 2532 wrote to memory of 1364 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 8virsid_oH3ERHf6Co7xW1aF.exe PID 2532 wrote to memory of 1364 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 8virsid_oH3ERHf6Co7xW1aF.exe PID 2532 wrote to memory of 1364 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 8virsid_oH3ERHf6Co7xW1aF.exe PID 2532 wrote to memory of 1364 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 8virsid_oH3ERHf6Co7xW1aF.exe PID 2532 wrote to memory of 1364 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 8virsid_oH3ERHf6Co7xW1aF.exe PID 2532 wrote to memory of 1364 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 8virsid_oH3ERHf6Co7xW1aF.exe PID 2532 wrote to memory of 1984 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe EcucRTIIbW13PhJk4wNcSnkz.exe PID 2532 wrote to memory of 1984 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe EcucRTIIbW13PhJk4wNcSnkz.exe PID 2532 wrote to memory of 1984 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe EcucRTIIbW13PhJk4wNcSnkz.exe PID 2532 wrote to memory of 1984 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe EcucRTIIbW13PhJk4wNcSnkz.exe PID 2532 wrote to memory of 2820 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe py3bcjp7iQOD_QOd6_YBrgao.exe PID 2532 wrote to memory of 2820 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe py3bcjp7iQOD_QOd6_YBrgao.exe PID 2532 wrote to memory of 2820 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe py3bcjp7iQOD_QOd6_YBrgao.exe PID 2532 wrote to memory of 1056 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe wwr5NVHy56oweCVXiwOaSAOq.exe PID 2532 wrote to memory of 1056 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe wwr5NVHy56oweCVXiwOaSAOq.exe PID 2532 wrote to memory of 1056 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe wwr5NVHy56oweCVXiwOaSAOq.exe PID 2532 wrote to memory of 1056 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe wwr5NVHy56oweCVXiwOaSAOq.exe PID 2532 wrote to memory of 2412 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 75axDq6OUWeTTsAXcSiLEyvr.exe PID 2532 wrote to memory of 2412 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 75axDq6OUWeTTsAXcSiLEyvr.exe PID 2532 wrote to memory of 2412 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 75axDq6OUWeTTsAXcSiLEyvr.exe PID 2532 wrote to memory of 2412 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 75axDq6OUWeTTsAXcSiLEyvr.exe PID 2532 wrote to memory of 2412 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 75axDq6OUWeTTsAXcSiLEyvr.exe PID 2532 wrote to memory of 2412 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 75axDq6OUWeTTsAXcSiLEyvr.exe PID 2532 wrote to memory of 2412 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe 75axDq6OUWeTTsAXcSiLEyvr.exe PID 2532 wrote to memory of 1764 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe TaBI7EhyHJUNWhOG_cllPwTj.exe PID 2532 wrote to memory of 1764 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe TaBI7EhyHJUNWhOG_cllPwTj.exe PID 2532 wrote to memory of 1764 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe TaBI7EhyHJUNWhOG_cllPwTj.exe PID 2532 wrote to memory of 1764 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe TaBI7EhyHJUNWhOG_cllPwTj.exe PID 2532 wrote to memory of 1780 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe v9RyXQ4HEeXwyZrWGtVt3Vmg.exe PID 2532 wrote to memory of 1780 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe v9RyXQ4HEeXwyZrWGtVt3Vmg.exe PID 2532 wrote to memory of 1780 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe v9RyXQ4HEeXwyZrWGtVt3Vmg.exe PID 2532 wrote to memory of 1780 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe v9RyXQ4HEeXwyZrWGtVt3Vmg.exe PID 2532 wrote to memory of 1672 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe conhost.exe PID 2532 wrote to memory of 1672 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe conhost.exe PID 2532 wrote to memory of 1672 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe conhost.exe PID 2532 wrote to memory of 1672 2532 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe conhost.exe PID 2412 wrote to memory of 2868 2412 75axDq6OUWeTTsAXcSiLEyvr.exe 75axDq6OUWeTTsAXcSiLEyvr.tmp PID 2412 wrote to memory of 2868 2412 75axDq6OUWeTTsAXcSiLEyvr.exe 75axDq6OUWeTTsAXcSiLEyvr.tmp PID 2412 wrote to memory of 2868 2412 75axDq6OUWeTTsAXcSiLEyvr.exe 75axDq6OUWeTTsAXcSiLEyvr.tmp PID 2412 wrote to memory of 2868 2412 75axDq6OUWeTTsAXcSiLEyvr.exe 75axDq6OUWeTTsAXcSiLEyvr.tmp PID 2412 wrote to memory of 2868 2412 75axDq6OUWeTTsAXcSiLEyvr.exe 75axDq6OUWeTTsAXcSiLEyvr.tmp PID 2412 wrote to memory of 2868 2412 75axDq6OUWeTTsAXcSiLEyvr.exe 75axDq6OUWeTTsAXcSiLEyvr.tmp PID 2412 wrote to memory of 2868 2412 75axDq6OUWeTTsAXcSiLEyvr.exe 75axDq6OUWeTTsAXcSiLEyvr.tmp PID 2868 wrote to memory of 768 2868 75axDq6OUWeTTsAXcSiLEyvr.tmp wsgen.exe PID 2868 wrote to memory of 768 2868 75axDq6OUWeTTsAXcSiLEyvr.tmp wsgen.exe PID 2868 wrote to memory of 768 2868 75axDq6OUWeTTsAXcSiLEyvr.tmp wsgen.exe PID 2868 wrote to memory of 768 2868 75axDq6OUWeTTsAXcSiLEyvr.tmp wsgen.exe PID 1672 wrote to memory of 2344 1672 AntpnpqB_fPx6qW15ZjmkFW5.exe cmd.exe PID 1672 wrote to memory of 2344 1672 AntpnpqB_fPx6qW15ZjmkFW5.exe cmd.exe PID 1672 wrote to memory of 2344 1672 AntpnpqB_fPx6qW15ZjmkFW5.exe cmd.exe PID 1672 wrote to memory of 2344 1672 AntpnpqB_fPx6qW15ZjmkFW5.exe cmd.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe"C:\Users\Admin\AppData\Local\Temp\6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\GuardFox\FVHgOhRx0Sbki9KZawHTgSQV.exe"C:\Users\Admin\Documents\GuardFox\FVHgOhRx0Sbki9KZawHTgSQV.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\GuardFox\FVHgOhRx0Sbki9KZawHTgSQV.exe"C:\Users\Admin\Documents\GuardFox\FVHgOhRx0Sbki9KZawHTgSQV.exe"3⤵
-
C:\Users\Admin\Documents\GuardFox\sXSvtlUO6vYoIOpvuIhzz57t.exe"C:\Users\Admin\Documents\GuardFox\sXSvtlUO6vYoIOpvuIhzz57t.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\GuardFox\NdoPJtGQMvegt8fmmiEEOVbS.exe"C:\Users\Admin\Documents\GuardFox\NdoPJtGQMvegt8fmmiEEOVbS.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\GuardFox\NdoPJtGQMvegt8fmmiEEOVbS.exe"C:\Users\Admin\Documents\GuardFox\NdoPJtGQMvegt8fmmiEEOVbS.exe"3⤵
-
C:\Users\Admin\Documents\GuardFox\8virsid_oH3ERHf6Co7xW1aF.exe"C:\Users\Admin\Documents\GuardFox\8virsid_oH3ERHf6Co7xW1aF.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 5723⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\Documents\GuardFox\EcucRTIIbW13PhJk4wNcSnkz.exe"C:\Users\Admin\Documents\GuardFox\EcucRTIIbW13PhJk4wNcSnkz.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\GuardFox\py3bcjp7iQOD_QOd6_YBrgao.exe"C:\Users\Admin\Documents\GuardFox\py3bcjp7iQOD_QOd6_YBrgao.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "OBGPQMHF"3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "OBGPQMHF"3⤵
- Launches sc.exe
-
C:\Users\Admin\Documents\GuardFox\wwr5NVHy56oweCVXiwOaSAOq.exe"C:\Users\Admin\Documents\GuardFox\wwr5NVHy56oweCVXiwOaSAOq.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\GuardFox\75axDq6OUWeTTsAXcSiLEyvr.exe"C:\Users\Admin\Documents\GuardFox\75axDq6OUWeTTsAXcSiLEyvr.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0ES8O.tmp\75axDq6OUWeTTsAXcSiLEyvr.tmp"C:\Users\Admin\AppData\Local\Temp\is-0ES8O.tmp\75axDq6OUWeTTsAXcSiLEyvr.tmp" /SL5="$C0120,1891431,54272,C:\Users\Admin\Documents\GuardFox\75axDq6OUWeTTsAXcSiLEyvr.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Website Screenshot Generator\wsgen.exe"C:\Users\Admin\AppData\Local\Website Screenshot Generator\wsgen.exe" -i4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Website Screenshot Generator\wsgen.exe"C:\Users\Admin\AppData\Local\Website Screenshot Generator\wsgen.exe" -s4⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\GuardFox\TaBI7EhyHJUNWhOG_cllPwTj.exe"C:\Users\Admin\Documents\GuardFox\TaBI7EhyHJUNWhOG_cllPwTj.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\EBAEBFIIEC.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\EBAEBFIIEC.exe"C:\Users\Admin\AppData\Local\Temp\EBAEBFIIEC.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\EBAEBFIIEC.exe5⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30006⤵
- Runs ping.exe
-
C:\Users\Admin\Documents\GuardFox\v9RyXQ4HEeXwyZrWGtVt3Vmg.exe"C:\Users\Admin\Documents\GuardFox\v9RyXQ4HEeXwyZrWGtVt3Vmg.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\GuardFox\AntpnpqB_fPx6qW15ZjmkFW5.exe"C:\Users\Admin\Documents\GuardFox\AntpnpqB_fPx6qW15ZjmkFW5.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "AntpnpqB_fPx6qW15ZjmkFW5.exe" /f & erase "C:\Users\Admin\Documents\GuardFox\AntpnpqB_fPx6qW15ZjmkFW5.exe" & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "AntpnpqB_fPx6qW15ZjmkFW5.exe" /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exeC:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"3⤵
- Executes dropped EXE
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"3⤵
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"3⤵
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"3⤵
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"3⤵
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"3⤵
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"3⤵
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"3⤵
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"3⤵
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"3⤵
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"3⤵
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"3⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
-
C:\Windows\system32\svchost.exesvchost.exe4⤵
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"3⤵
-
C:\Windows\system32\svchost.exesvchost.exe2⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1936598826-1309158679-7024222871967779115548096733-495897498-1030628061033874048"1⤵
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240402104317.log C:\Windows\Logs\CBS\CbsPersist_20240402104317.cab1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Defense Evasion
Virtualization/Sandbox Evasion
1Impair Defenses
1Subvert Trust Controls
1Install Root Certificate
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exeFilesize
6.5MB
MD50ac4afcfbc2d00b9811665a1df126806
SHA15b8a9ccfa966a916ee4189426569ae32d3e7d488
SHA2564088f07a91e1997a6ba7d471ee1b842cc4ee55c7fb150b1c0f98fdcadd90299e
SHA51241d8c07c3af9aeec96f2b04585505de73539ad362d79017d7c2809ff947d1658eac64d9df5088ffd5a6abee9963b0e5f2b2d8fdde7283a1caff03bb6d860e519
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exeFilesize
5.8MB
MD515c30dd587c324c3a8e6b812b287d6bc
SHA134ad8c5189889e5d7b710d19ee24de6626678ccb
SHA2566dcd2cb2b3897f5e3e96488e6a2da063fba1b74ccc24d38eed4411e476a52521
SHA51270ba390dac043a7160a9b791391e7bfe84f3dd5f6d7c9f4861b2f9f4b167ab321292931c8ef3cb28d4c3b98fa3c14588210c79f1770fd85f0731b6d685f5b73a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ba4177792a143769b823e77066f77170
SHA1a0835a3ee4780e6da65ee55936a5f13a554e2e58
SHA256c71d71c69e7e906eae4723d757a8067532f4d3f1c93f5f84ec6d0c7bcc727639
SHA512448648e8447f7cbcb3a22349000d7c8f4d3c3d297dc0012170d0dba782cd0584b62f34073c2378f53ceaf46d1e0c3e3e2d9e3e9ac6f6fb9268cd64907798a0d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD561c0e161d2bac90fa534d72794d2dd8b
SHA16458a419275eb6aecf028a863aeab980e7b639e8
SHA25659d0c44ced590924c3b02f5e7ed049c64a0487a03f5590d99dbbcdb52df1ef48
SHA512969df5dfe76fac88b6c2817eff4321d6b6059db35ba2eadde46ec8d44e99e8cf1afcf6924b6ccc9da7ab16ea8f4a0dc3f723de1dcfed34b5cedee92e513c4cfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5252a31a0e471b8606b4c955fbe5e5cea
SHA195c3adc33bafd6d388fc8c58c90726c69f6788e5
SHA256d676f534b95369c68532133aa99b12e200e3a9a54e22d14aa3c5861e417eb671
SHA512de7c30070b39ff96557f757862bebef5eca54945b59a793b042866eacd7397a7235b092b31dd4b1e0ed7a32b818c6f9df741bf363fd710b3958a117626fcb87b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD549a3f61c2224be84a083ea20fb3f87ec
SHA171981de1712fe0f887167218c1856f006ee82421
SHA256b169d474c011184fd08984c7972a1ae539d257b66917fa471f805fc29b4d4b78
SHA5126d6acaa8c77cfd61c229f312045faed0e57faaf5fb12df8710ea7b550e101ec7d360dbb5d3382e9934ea33e4e3a6a52ac7b8ab380ebd2c37465fed3d2f72d03f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c0ff252919b33239594dec817631fc98
SHA13dd108f473357953e6d624bddba66dced55b2d56
SHA256277817bba02208eb1d01eaaefcd27a204b1d91c8ea7fdcde951d7873ab1d20a4
SHA51202c4e084c824c6bef3d0d271e3168c078e89636c3d1a95f11e09ccf9cd1c20d8463794f0d43e4133e5c035666a037f655be2fc369effa066ae9d67b1c07280aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5381b7413067a42337837150d8b31379e
SHA1ef20cf15d92c8b816a1c2af82469e91789aba1dc
SHA2563d397f21bb15e32387691f88d7d2282b8943b24aa028f52a9439527cad71bd9c
SHA5127a95a39894b5904c1c3a1d0c2d5661c31049386cfc2972c59071756f72e92f19ff9d1f126d51b1624968fa8b7ae8040625bdde63df7863c36fa7b6e43f5f7d57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD508b4f7af8a48753e25fea60ec7a575ab
SHA14f17f0673a1e59cee7e6179fbdf9155d5576bca0
SHA256298701c874724639b1fe5f4d957386efda69338a26d5cdc8a38c271e22f31beb
SHA512ebdcffb0521f5fc4f65dc4d43dd1ffe75ad7c24659140bb0a69fb64f4c9083dd28eec1d5d0c90a28267a5a2132cc1eddd7b6f89094de6ef6acd86996531a7b62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55ee72a2c546da3eee5c2e57f51076488
SHA14ff63f9b8778ecfac33b39fc71020c7a6810ba37
SHA256484046c3b2a320b7d8a263a71e800d8c6be5fc32cab10e05a4b112e96f9dd071
SHA5124c773380577f05a97d4c67c4ad992f179e45d82948f66f7a59889605bb539934d99c0da16510d920e397b43aaa100808623fcaa7c6d8f25479964a62e0dc2578
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59f8e98317e5c3500315aec433a6e28ef
SHA186a9dd3190430e415922b287ac37139e63a15f8f
SHA256a4f1ef85a773b8aefb2e5dcfb266d794b65701544d2cc78b53a021448b5b894a
SHA5120999750eff879e38eefab2b8c0587b4d02f6aedc5a985a6ca5238293f7238638007454698161e38deeb33c8d02ad2efc4d2c8d2594a1860e8d92d2380032b9f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fa55b5c2cdfee75da22d63045ed69914
SHA1854ea6cb80d37cea930670c23648e4af2e82b63a
SHA2561f8944e7c193870598a016e4f1c02d4d73fd26d5e495339ef2fc810d3f8d45e4
SHA512bb6bd2a25d9c74bc8525eca5ddc5b1f53e19995ee76a593623ef5c645789fa42522ab608abe38613509bb595d22487c44ae783d1269477615c47c95cdb5822cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD514bd6636c8bbdad87bbe6d45b7733476
SHA17c00f3386d7c973ea0a7e6a1a033044137ebc7b2
SHA2560007c0fddcb02ddd21a6059a3ab79aa43debcd410489fdc9b2d1f9f1b0e5a75b
SHA51282d11b476af634ddd9104d1c6d222723e25a1447472546a9d881ba6f4dafdb3c4663ede94e0dc7f8fa256983815ee9ba1378a243e42cd8daeaa4182fa916045f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5433dbdac9a319c656c413b941b9fe32a
SHA14e89adc38d515215dd0677d9e5d923dc723d2fbc
SHA2562ed180fda17fec7909824beec7f2187b263183705f51e33877717cec4baa72df
SHA512c71b2d1c883e3a28afae5e7918b11d8197118f147eb5241cae314fb9916247408e79a1c4b18e90a7c7b0863c76345fc816973f3472de598ee0bc63301f4b6301
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f791be93f40724fcd9c67aa6e2a452e7
SHA193dc33d1eb4c18de6108444f49aaf78b680a5bab
SHA256b73d41b8eab7466a25ab8e536156905600ea4df95be746e3dbf45f64e3366f1f
SHA512658f8ca87a2c87caf515642529621b002e95fc949cedc8612b276ae47cc7b3475dc909697811f7aeff3a1f8eb93dd43ca517c0ed5ea3e7e8bb102ab444fd6524
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52216ac6591f2d436db827e33ce22c572
SHA1c9197150f280c510877d34fff0fa598934692d0d
SHA256a6097ca84102134774bbfaa28431b7b96156c87970a0b424c02efee3acffb478
SHA51278ad8486f400e0cb82e04648e7b5d837a5054a18f15400b13795cb7b7217f4c654005a33b321308b3658692cb80d5aab5b954765ee594c38f51f6c212ceb4c76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD53b92b29a01b03238b207215da29438d2
SHA150544dd2949bac43e3dbd9a710a2109650467fc4
SHA256a83004a0d95b0163b0a8d5c4d51203f2c72fcf3515ea7617076cd94ce38c35a9
SHA512bf7567856ecdd62718b397b410158549119cc9e9f91e925f492556496fb8b375b2f2e84db049cd2fcd39c4293fc6bd6c564d334c2b5f69fb76354b1c699e9b9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52b172f43b02f3c59427dc299be3f6f06
SHA15d1ee6391c68b0ac376b30d3a6da88ccce50c3d4
SHA256ab01cabf7aa37f56a950bf409515d0efb0f8dc163ae3c7e2c7b4f1221afb087a
SHA5124c71fd36692d75cbfa14945229a69e1141a053d7f510a07d766e12df8540f2c9a0d2408fee63945ad93befcd4ff87966eb631864aa42111e081178817ff5355f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59d2a1bc4b05adf8c5cfb835b725fef94
SHA1b6df6eaa174a470abcb1c8fb55a48c378307a6cc
SHA256227f125fdbcbf1ee0da81d79aa9d9e4fb2ea9ea847645579eec0b71d1da06cc8
SHA512fae3cc387a52173e89045a1dda195963bd9c1e62941d37341432a76c37feb86efc5b8caf5328bddf4e37c1386ac52e422c402b284a27dd5eaa852e407bd168bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD57e3b9cbeb2077abb28cc7afac3558eee
SHA15e8add3477cb58322773bb1eb36500cc6bcd357e
SHA256a1ad62646f1f611d87851b832f695b3ff2395f2086b83cc3d6409375534cd87d
SHA51281f95dd1dd71dc78f891f7d1dd3aeed0d956a01c37372eacdb783cd1877ea0b06c807db33a5139a71b2fa299dda5755df484f8bddea3b06db19dab81b89eba7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD506715bd6bd463c388aba77111514b701
SHA1f51935d3bb04be32e6adbc486be52f6693352e7c
SHA256685c38c5bb0b13be58abba095aa9c88d3a8cbc663478e874bdf161d2bcef532b
SHA5127a48de25aec1e6e2a76f032397ffecea8ff52d4d2b02b9dc4efa263fcf6d4b017358a583aefb4d3e2333a44db2bb97fb9638c0a7f7fc295f74bc5d669ce9afcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55b066af21688df3211e3f63f75260ece
SHA128232ea312cfe00e4f61e2819dc7d4a46be17bd0
SHA2569d249aedcfed90b81dadaf61a8299de62b7f74114f61b23254f065290fa82380
SHA512b23d09e98be51ffdc81159a5fa35d4bf404d92f2f032f1ab733592523a648cea5ae4a95117f530f0dc33e42c60d5d346fb4a8f4d07ddd7837454e14671504d47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD502ebb58ae3c020214c211d9bb37b8575
SHA13b51aadef0dcb7d7e790354c83b7db3febacf961
SHA256de6b0ebb2fd027167ccfe35c4fab13d850ad86d3a1202ed4107993a730746230
SHA512f473f9b65e95e65702eaf9f5fceb4a2fa0b0da45a29daaebff5e5d5657c97d6a908d97ab57173b96b3098f0641139bc7af3041850afccf1e0593bb06d6556935
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5627e0abc762f953bb38e57bfed9bcb22
SHA1053e8393205eb31e1ee17a388daec5ee9cd45ad9
SHA2566c343e411a6131e9c29b01a701e94e46e7c9612c04283382865868d05812fe62
SHA51285e5637e6be21e2f87d9188d1f5e9152185b6955bd24de741fa1e8fda8d197b292706de8feb5ab9b51a29c67dcaa4feded4426b9d1596b1662776dd8b6bda8a5
-
C:\Users\Admin\AppData\Local\Temp\EBAEBFIIEC.exeFilesize
106KB
MD5fe380780b5c35bd6d54541791151c2be
SHA17fe3a583cf91474c733f85cebf3c857682e269e1
SHA256b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53
SHA512ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c
-
C:\Users\Admin\AppData\Local\Temp\TarD86C.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\is-0ES8O.tmp\75axDq6OUWeTTsAXcSiLEyvr.tmpFilesize
680KB
MD543a50e24c92adb66cf02c3e4bb2e7d60
SHA18f8fea4b33b297369e7f9a4d3834e8ff4a092f74
SHA2561e467d744a0c5d275911c4823e3c96fcb1aabd1bbcc8a10e0ae0bbd327348f64
SHA512dd828a5011303b7d454f463766482eb02b3c7b54fb64f023bff965b4feed462d77904d157a56ec67297c69c54b1f9e74b83e92c53827876ac51781d1bc266aad
-
C:\Users\Admin\Documents\GuardFox\75axDq6OUWeTTsAXcSiLEyvr.exeFilesize
2.1MB
MD5a12b82cffaf7fef64f6fb0c4f2950d45
SHA110c1dfff1457f9b4ca6444edb550ef90c96ca9d0
SHA2567a8768d53ee00d30b11cff33bb61a000a96aef7024b1d39f9bd7ef79c79085cf
SHA512442d770c6d620d177316f2f9b40af053472f01aecfed4cb20ce7cdd9e807d3c30beb353428d23d89be9cde6b059a324b98c345be8e4bf412b8782d4163fae8cc
-
C:\Users\Admin\Documents\GuardFox\8virsid_oH3ERHf6Co7xW1aF.exeFilesize
234KB
MD5a17efa3f07ace71dea8c084c1a502f36
SHA108c0d817dfef6c1ce36dc1c20390f5c8f7ebee07
SHA25659d959aea023ad0840ab3694261ba36c4590f65f07ad5e500e791c64a3455142
SHA5129e2e6d458fbb66af052635fde8a017cdb0a9bce5d839cb8b8deae79a63544ee3b2a5c87bb352c9a5c2079c63a9e450e712345629244c30e28d3d3625518c2681
-
C:\Users\Admin\Documents\GuardFox\AntpnpqB_fPx6qW15ZjmkFW5.exeFilesize
284KB
MD553088b0534606d16317c99d65239eae4
SHA1025089e496747b248908d85a9435e5c0d3d7176a
SHA25694918f96b6a4cd502c1e8a2d09fc8c23a732144a8f619be63d44f639c5c2a324
SHA51225d089e692480c729829ac483dc565068b15dfa48bad62f4e93267ed7f367ec25c2910f364e00be5c86f3046ca88bf22021fba49d8fb27f163bcc91eab4c0cb6
-
C:\Users\Admin\Documents\GuardFox\EcucRTIIbW13PhJk4wNcSnkz.exeFilesize
5.7MB
MD5112515fba5401be201ae06e019c5bf38
SHA10c4515b50a6177a262b4b8166ad39693759ca76a
SHA25666574dbd312d516a5be711c6f1e2f38ce1775650424e954c06747ff75b0ed853
SHA5125853322bc81c078fd0b5d04c1e6f9846de101203fcdf0117ff638a8a18bf58712f9f32b838b6df34bbf9405fa4135e8ca49f2f271d772bd448b43f9fb522ae11
-
C:\Users\Admin\Documents\GuardFox\EcucRTIIbW13PhJk4wNcSnkz.exeFilesize
5.9MB
MD51f3e864a338535e78391706a36779415
SHA1611c1fdc38ff4032c7912b2cba74f8608b2e9082
SHA25668e5335ef6066297ae018a6ed5071c38659d8edad80f79099a17f6fb7b2f07d4
SHA5120501367c18c49a2cec82d7225be192f997f262192253eb6483f2a5a15f9f8dc083951afa6eb302abbcdc9b36efbebfcaaa353fe1d189420c8d20f7f70060cfc1
-
C:\Users\Admin\Documents\GuardFox\FVHgOhRx0Sbki9KZawHTgSQV.exeFilesize
2.8MB
MD5665e6fa4518039a7eecaf9dbb7d1c6ad
SHA1f15863d11765ca5251a884f73ab5a7ac938a88b8
SHA256c4f83934af8a4afd6d30d37d2cc0aa72fcc9ae6cdcab8e4716df127122e60459
SHA5121ff3636f3ff28bf57aff7fea565d8280c5d9749e530e31b9d32be2bfa78ae609eed564709cbc44919ec82eebc794d74b4da61f2c2db7bd01f36bf07ca120bd58
-
C:\Users\Admin\Documents\GuardFox\FVHgOhRx0Sbki9KZawHTgSQV.exeFilesize
4.1MB
MD54be33ab0fde7538c35b28012b4693250
SHA179759948b5f1fe73a2161fc24f2765e70cfacf6a
SHA256f22edbafb3f79e06bb7d9ff4dfca958f363780c69e46b6fe0b327519c9ed7248
SHA51209e2fe9eee5a78f000fd7a55d4d5486b072ceeb99556f49a64e30981373770dc75d6e84149cc9588c6b40524b4291a819a204ff32b39447ed813ac67320fd2ab
-
C:\Users\Admin\Documents\GuardFox\NdoPJtGQMvegt8fmmiEEOVbS.exeFilesize
4.1MB
MD5d92d7e83b3b97ad9bbad2ebd571a5254
SHA172e36745d11924e9cc9d047102917e60706db420
SHA256b37a7c7e58379375760ece9f5d344b814c5f4539a6f924f313d1889bb0e8186f
SHA512807483f46e7b988cbe97f3f26cedc575d644928178c9f2b9f91145b853b2c24d38bcb28c12798ef5fa2d1094192857f57e9fce7c9fd5e0a1b5b0fc9378561ab0
-
C:\Users\Admin\Documents\GuardFox\TaBI7EhyHJUNWhOG_cllPwTj.exeFilesize
219KB
MD5e91a8563c4ccd59b11022be8b3d4b7df
SHA16649a854842c6d16329ea2a3f4fb4a93db3ba7ec
SHA256337fdfe392ae839414d9a4ae71262ea1f53d62413ac88f25f0f81663cd340a32
SHA512f47b5041a610716f517be40b6d3a912d5562659f652f42507b2a4d8bf7911187b913a340b1e8ce0623268f3cb1a6578abe1c895c4ef7e6680711415c1cb360b9
-
C:\Users\Admin\Documents\GuardFox\py3bcjp7iQOD_QOd6_YBrgao.exeFilesize
10.7MB
MD5b091c4848287be6601d720997394d453
SHA19180e34175e1f4644d5fa63227d665b2be15c75b
SHA256d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe
SHA512a3b3663fd343389aee2cbf76f426401d436992b2b56cea3b60e9c2e385510fa874fa45b2ac75703074f0303934c4223eaee1983851374a2e753fd0302042cc5a
-
C:\Users\Admin\Documents\GuardFox\sXSvtlUO6vYoIOpvuIhzz57t.exeFilesize
189KB
MD57b20417cc7a57012e4219c392ba64a92
SHA1e0b16431173391f4cf3649d55f3c2313bbdd8820
SHA2569e38063da638ab50fb36bcf5cf24b1f337e314aa1afec7d2e274aa2e41547890
SHA512d857ea4ff920ca75c6005b03bbb92b02b938fa1aaf01208cb9e923ffb94bfe7ef0e1d9f0e288dbdc9034d8c3a78889f17c96203dd8feef1e7a19bcc986cedef8
-
C:\Users\Admin\Documents\GuardFox\v9RyXQ4HEeXwyZrWGtVt3Vmg.exeFilesize
5.9MB
MD5bf0137e15637ddd2eefc0922092ba059
SHA1e267abe1428aa6906e7f78dd4e2ba27ba2c5094d
SHA256007b625dbf26d9e0c83eabe4a77317bf7aacb1aebd26799b494308ef28a6fab8
SHA512f5809b5b591024176076a15086929e0ffa56f74a7208b4a85a9c45ec5a4bc29e5acc0984d231a38562cac83c5a764eaa2f215aecdd3105d3ed2ca5400e9332b8
-
C:\Users\Admin\Documents\GuardFox\wwr5NVHy56oweCVXiwOaSAOq.exeFilesize
871KB
MD5324b6dc1d74d0fa83010c59562203b31
SHA121715af633e6f90984af3a8b6fd58bd86758840d
SHA256a8cc7d8092e02077f21bf65badf8871748630912e3738a2410ff5cd18ead2fbb
SHA5125ecb30f6f3312463b5d32ea5a8aa1f9426c265cc85616651ffcc22cdcd54eac66a97928f33a4602f191f9a03d294ce9f6289311d95bccccb5aeb7aafe9fb798c
-
C:\Windows\TEMP\gdaawrhfdlcr.sysFilesize
14KB
MD50c0195c48b6b8582fa6f6373032118da
SHA1d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA25611bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
SHA512ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
-
\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exeFilesize
6.9MB
MD5d886fd613f4b95ee849632dac0a6d453
SHA17d75d14b6857d4257378f5f8a37561ac77a90e89
SHA2563b1dc4cb83b8a18553bf968fb0e1904db1761d6fa0e92e1d13526a6babbb5ede
SHA512c3072e8dd758b38fd0d1b361ec61edc4c68e8dff53700c241c8009e1901d5b8a8292fade5ee6d41c5d68a27ed9705290be71963dc8ef1843483525eb14e80862
-
\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
\Users\Admin\AppData\Local\Temp\is-0M6H2.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-0M6H2.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Website Screenshot Generator\wsgen.exeFilesize
2.4MB
MD5598f2e73c39dbbf7a678c69f93f4e275
SHA17b55f50c9361807aa363a813198cdb980a41f42a
SHA256e9ddcd8c9cfee2bfa932ae52e5a9c4757ee80443710c68b8fc37de7d315f14b6
SHA5129bbc4eeee851f19a3f17e54bcb1cebefb9a19257eb7c36ec2609654052e8c9225edbe98f4d9b3fd5667967ca081d974fd90f06d615b71e7534e4431121b8bc49
-
memory/324-1566-0x0000000000400000-0x0000000002F43000-memory.dmpFilesize
43.3MB
-
memory/324-1558-0x00000000048A0000-0x0000000004C98000-memory.dmpFilesize
4.0MB
-
memory/324-1319-0x00000000048A0000-0x0000000004C98000-memory.dmpFilesize
4.0MB
-
memory/324-1559-0x0000000004CA0000-0x000000000558B000-memory.dmpFilesize
8.9MB
-
memory/528-1480-0x0000000000220000-0x000000000022B000-memory.dmpFilesize
44KB
-
memory/528-1479-0x0000000002C84000-0x0000000002C92000-memory.dmpFilesize
56KB
-
memory/528-1478-0x0000000000400000-0x0000000002B58000-memory.dmpFilesize
39.3MB
-
memory/552-1561-0x00000000047E0000-0x0000000004BD8000-memory.dmpFilesize
4.0MB
-
memory/552-1320-0x00000000047E0000-0x0000000004BD8000-memory.dmpFilesize
4.0MB
-
memory/552-1567-0x0000000000400000-0x0000000002F43000-memory.dmpFilesize
43.3MB
-
memory/768-1518-0x0000000000400000-0x000000000066C000-memory.dmpFilesize
2.4MB
-
memory/1056-1304-0x0000000002080000-0x000000000212B000-memory.dmpFilesize
684KB
-
memory/1056-1328-0x0000000002130000-0x000000000227F000-memory.dmpFilesize
1.3MB
-
memory/1056-1330-0x0000000002080000-0x000000000212B000-memory.dmpFilesize
684KB
-
memory/1364-1570-0x0000000002170000-0x0000000004170000-memory.dmpFilesize
32.0MB
-
memory/1364-1481-0x0000000073BE0000-0x00000000742CE000-memory.dmpFilesize
6.9MB
-
memory/1364-1323-0x00000000000B0000-0x00000000000EC000-memory.dmpFilesize
240KB
-
memory/1672-1507-0x0000000002D04000-0x0000000002D20000-memory.dmpFilesize
112KB
-
memory/1672-1505-0x0000000000400000-0x0000000002B70000-memory.dmpFilesize
39.4MB
-
memory/1672-1510-0x0000000000220000-0x000000000024D000-memory.dmpFilesize
180KB
-
memory/1764-1551-0x0000000002CC0000-0x0000000002DC0000-memory.dmpFilesize
1024KB
-
memory/1764-1552-0x0000000000240000-0x0000000000267000-memory.dmpFilesize
156KB
-
memory/1764-1568-0x0000000000400000-0x0000000002B60000-memory.dmpFilesize
39.4MB
-
memory/1780-1575-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1595-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1577-0x0000000074C60000-0x0000000074CA7000-memory.dmpFilesize
284KB
-
memory/1780-1579-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1582-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1584-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1435-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/1780-1437-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/1780-1586-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1588-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1589-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1591-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1593-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1596-0x0000000077170000-0x0000000077172000-memory.dmpFilesize
8KB
-
memory/1780-1594-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1592-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1590-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1587-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1585-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1583-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1556-0x0000000001080000-0x0000000002059000-memory.dmpFilesize
15.8MB
-
memory/1780-1581-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1580-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1578-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1576-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1344-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/1780-1574-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1780-1321-0x0000000001080000-0x0000000002059000-memory.dmpFilesize
15.8MB
-
memory/1984-1598-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1984-1393-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/1984-1599-0x0000000074C60000-0x0000000074CA7000-memory.dmpFilesize
284KB
-
memory/1984-1398-0x0000000000D50000-0x0000000001D24000-memory.dmpFilesize
15.8MB
-
memory/1984-1562-0x0000000000D50000-0x0000000001D24000-memory.dmpFilesize
15.8MB
-
memory/1984-1397-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/1984-1601-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1984-1314-0x0000000000D50000-0x0000000001D24000-memory.dmpFilesize
15.8MB
-
memory/1984-1378-0x0000000000150000-0x0000000000151000-memory.dmpFilesize
4KB
-
memory/1984-1380-0x0000000000150000-0x0000000000151000-memory.dmpFilesize
4KB
-
memory/1984-1359-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/1984-1360-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/1984-1362-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/1984-1364-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/1984-1597-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1984-1600-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1984-1602-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1984-1375-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/1984-1356-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/1984-1373-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/1984-1603-0x0000000074FD0000-0x00000000750E0000-memory.dmpFilesize
1.1MB
-
memory/1984-1367-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/1984-1369-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/2412-1310-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2412-1324-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2532-0-0x0000000077130000-0x0000000077132000-memory.dmpFilesize
8KB
-
memory/2532-1400-0x0000000076F80000-0x0000000077129000-memory.dmpFilesize
1.7MB
-
memory/2532-1399-0x000000013F9E0000-0x0000000140283000-memory.dmpFilesize
8.6MB
-
memory/2532-7-0x0000000076F80000-0x0000000077129000-memory.dmpFilesize
1.7MB
-
memory/2532-6-0x000000013F9E0000-0x0000000140283000-memory.dmpFilesize
8.6MB
-
memory/2532-5-0x0000000077130000-0x0000000077132000-memory.dmpFilesize
8KB
-
memory/2532-816-0x000000013F9E0000-0x0000000140283000-memory.dmpFilesize
8.6MB
-
memory/2532-3-0x0000000077130000-0x0000000077132000-memory.dmpFilesize
8KB
-
memory/2532-818-0x0000000076F80000-0x0000000077129000-memory.dmpFilesize
1.7MB
-
memory/2532-1-0x000000013F9E0000-0x0000000140283000-memory.dmpFilesize
8.6MB
-
memory/2820-1350-0x0000000077130000-0x0000000077132000-memory.dmpFilesize
8KB
-
memory/2820-1557-0x0000000140000000-0x0000000141A14000-memory.dmpFilesize
26.1MB
-
memory/2820-1560-0x0000000076F80000-0x0000000077129000-memory.dmpFilesize
1.7MB
-
memory/2820-1351-0x0000000140000000-0x0000000141A14000-memory.dmpFilesize
26.1MB
-
memory/2868-1569-0x0000000003340000-0x00000000035AC000-memory.dmpFilesize
2.4MB