Analysis
-
max time kernel
298s -
max time network
302s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 22:22
Static task
static1
General
-
Target
0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe
-
Size
385KB
-
MD5
b59f0459f49865f51804506853f13621
-
SHA1
0a77ceeb7f01b61593bdf454aab0c06b8417dd4a
-
SHA256
0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5
-
SHA512
157bcabcbaadb0e7684a69e21b48f73013a26d77a0cad4d56280c47d1b146fbc820fb2eb55f32b69ad0828755b9cdf3436ed29217fdcd6162841aeeeea26df69
-
SSDEEP
12288:w/dg/I5WJOtKa7zBTMSw5U+d+zmnmer1cf90oh:4gFJOtJhMf5U+dEer1c1z
Malware Config
Extracted
stealc
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Extracted
smokeloader
pub2
Signatures
-
Detect ZGRat V1 3 IoCs
resource yara_rule behavioral1/memory/1548-369-0x00000000003C0000-0x0000000003BF4000-memory.dmp family_zgrat_v1 behavioral1/memory/1548-374-0x000000001E5C0000-0x000000001E6CA000-memory.dmp family_zgrat_v1 behavioral1/memory/1548-391-0x0000000005C10000-0x0000000005C34000-memory.dmp family_zgrat_v1 -
Glupteba payload 21 IoCs
resource yara_rule behavioral1/memory/1768-252-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/1472-251-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/2656-255-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/2456-257-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/2456-262-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/2764-322-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/2812-346-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/1208-336-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/2812-347-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/2484-348-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/1744-351-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/1744-371-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/1744-476-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/1744-488-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/1744-490-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/1744-516-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/1744-530-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/1744-536-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/1744-544-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/1744-547-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba behavioral1/memory/1744-550-0x0000000000400000-0x0000000002957000-memory.dmp family_glupteba -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1112 created 1184 1112 Relation.pif 21 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\KlQx9CtTguW3jS1XolH53UnX.exe = "0" KlQx9CtTguW3jS1XolH53UnX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\RGfhHR5IomI5kKh9k52xPPda.exe = "0" RGfhHR5IomI5kKh9k52xPPda.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 6Pd0jH2BrBsiLMdjihWycS2i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 6Pd0jH2BrBsiLMdjihWycS2i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\6Pd0jH2BrBsiLMdjihWycS2i.exe = "0" 6Pd0jH2BrBsiLMdjihWycS2i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 6Pd0jH2BrBsiLMdjihWycS2i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\QkHWDXnqiBlN8SXTAJxEBlbc.exe = "0" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 6Pd0jH2BrBsiLMdjihWycS2i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 6Pd0jH2BrBsiLMdjihWycS2i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 6Pd0jH2BrBsiLMdjihWycS2i.exe -
Modifies boot configuration data using bcdedit 14 IoCs
pid Process 2752 bcdedit.exe 332 bcdedit.exe 1760 bcdedit.exe 1404 bcdedit.exe 2860 bcdedit.exe 3024 bcdedit.exe 1080 bcdedit.exe 2704 bcdedit.exe 764 bcdedit.exe 2544 bcdedit.exe 2000 bcdedit.exe 2320 bcdedit.exe 1676 bcdedit.exe 3000 bcdedit.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\Winmon.sys csrss.exe -
Modifies Windows Firewall 2 TTPs 4 IoCs
pid Process 1140 netsh.exe 1608 netsh.exe 908 netsh.exe 2020 netsh.exe -
Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
-
Drops startup file 7 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gzczSZsNwZ9FwfuOEqtGL9ag.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SZFCLVfpJpiR4tJwCDyCupBo.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svl1FY0H4PhV8qkUp8tP4iAo.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ato8pMZCnE0ruv0zb8KnkiHR.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\E0mnSKfPMrD2B2pTiXExQuT1.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QYlMXzDcuF8VqKVLZDfeQpkN.bat CasPol.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wNUnSJ9NMkUqu8ursFtBwGem.bat CasPol.exe -
Executes dropped EXE 20 IoCs
pid Process 2456 QkHWDXnqiBlN8SXTAJxEBlbc.exe 1616 9YSsFqhRgrlHq7VDb2jnx2eC.exe 2656 RGfhHR5IomI5kKh9k52xPPda.exe 1472 KlQx9CtTguW3jS1XolH53UnX.exe 1804 C2YNPyllyXCvjPcsWpy5xcmG.exe 1768 6Pd0jH2BrBsiLMdjihWycS2i.exe 1492 u18w.0.exe 2812 RGfhHR5IomI5kKh9k52xPPda.exe 1208 KlQx9CtTguW3jS1XolH53UnX.exe 2764 6Pd0jH2BrBsiLMdjihWycS2i.exe 2484 QkHWDXnqiBlN8SXTAJxEBlbc.exe 2792 u18w.1.exe 1112 Relation.pif 1744 csrss.exe 1648 injector.exe 448 patch.exe 676 Relation.pif 1432 dsefix.exe 2112 windefender.exe 2792 windefender.exe -
Loads dropped DLL 35 IoCs
pid Process 860 CasPol.exe 860 CasPol.exe 860 CasPol.exe 860 CasPol.exe 860 CasPol.exe 860 CasPol.exe 860 CasPol.exe 860 CasPol.exe 860 CasPol.exe 860 CasPol.exe 1616 9YSsFqhRgrlHq7VDb2jnx2eC.exe 1616 9YSsFqhRgrlHq7VDb2jnx2eC.exe 1616 9YSsFqhRgrlHq7VDb2jnx2eC.exe 1616 9YSsFqhRgrlHq7VDb2jnx2eC.exe 1616 9YSsFqhRgrlHq7VDb2jnx2eC.exe 1616 9YSsFqhRgrlHq7VDb2jnx2eC.exe 1616 9YSsFqhRgrlHq7VDb2jnx2eC.exe 1616 9YSsFqhRgrlHq7VDb2jnx2eC.exe 1632 cmd.exe 2764 6Pd0jH2BrBsiLMdjihWycS2i.exe 2764 6Pd0jH2BrBsiLMdjihWycS2i.exe 1744 csrss.exe 844 Process not Found 448 patch.exe 448 patch.exe 448 patch.exe 448 patch.exe 448 patch.exe 1548 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1548 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1548 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 448 patch.exe 448 patch.exe 448 patch.exe 1744 csrss.exe -
resource yara_rule behavioral1/memory/2112-529-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2112-533-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2792-532-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2792-535-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2792-548-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 6Pd0jH2BrBsiLMdjihWycS2i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 6Pd0jH2BrBsiLMdjihWycS2i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 6Pd0jH2BrBsiLMdjihWycS2i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\6Pd0jH2BrBsiLMdjihWycS2i.exe = "0" 6Pd0jH2BrBsiLMdjihWycS2i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 6Pd0jH2BrBsiLMdjihWycS2i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 6Pd0jH2BrBsiLMdjihWycS2i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\QkHWDXnqiBlN8SXTAJxEBlbc.exe = "0" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\KlQx9CtTguW3jS1XolH53UnX.exe = "0" KlQx9CtTguW3jS1XolH53UnX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\RGfhHR5IomI5kKh9k52xPPda.exe = "0" RGfhHR5IomI5kKh9k52xPPda.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 6Pd0jH2BrBsiLMdjihWycS2i.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 6Pd0jH2BrBsiLMdjihWycS2i.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" KlQx9CtTguW3jS1XolH53UnX.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" RGfhHR5IomI5kKh9k52xPPda.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 4 pastebin.com 3 pastebin.com -
Manipulates WinMon driver. 1 IoCs
Roottkits write to WinMon to hide PIDs from being detected.
description ioc Process File opened for modification \??\WinMon csrss.exe -
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1304 set thread context of 860 1304 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe 28 PID 1112 set thread context of 676 1112 Relation.pif 81 -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 6Pd0jH2BrBsiLMdjihWycS2i.exe File opened (read-only) \??\VBoxMiniRdrDN QkHWDXnqiBlN8SXTAJxEBlbc.exe File opened (read-only) \??\VBoxMiniRdrDN RGfhHR5IomI5kKh9k52xPPda.exe File opened (read-only) \??\VBoxMiniRdrDN KlQx9CtTguW3jS1XolH53UnX.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\rss\csrss.exe 6Pd0jH2BrBsiLMdjihWycS2i.exe File opened for modification C:\Windows\rss RGfhHR5IomI5kKh9k52xPPda.exe File created C:\Windows\rss\csrss.exe RGfhHR5IomI5kKh9k52xPPda.exe File created C:\Windows\rss\csrss.exe KlQx9CtTguW3jS1XolH53UnX.exe File created C:\Windows\Logs\CBS\CbsPersist_20240508222249.cab makecab.exe File opened for modification C:\Windows\rss 6Pd0jH2BrBsiLMdjihWycS2i.exe File opened for modification C:\Windows\rss QkHWDXnqiBlN8SXTAJxEBlbc.exe File opened for modification C:\Windows\rss KlQx9CtTguW3jS1XolH53UnX.exe File created C:\Windows\rss\csrss.exe QkHWDXnqiBlN8SXTAJxEBlbc.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2960 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u18w.1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u18w.1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u18w.1.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 u18w.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString u18w.0.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1464 schtasks.exe 2896 schtasks.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2984 tasklist.exe 2788 tasklist.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-551 = "North Asia Daylight Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-842 = "Argentina Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-291 = "Central European Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-422 = "Russian Standard Time" windefender.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-681 = "E. Australia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-421 = "Russian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-562 = "SE Asia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-622 = "Korea Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" QkHWDXnqiBlN8SXTAJxEBlbc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation" netsh.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 patch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 csrss.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 patch.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1960 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1768 6Pd0jH2BrBsiLMdjihWycS2i.exe 1472 KlQx9CtTguW3jS1XolH53UnX.exe 2656 RGfhHR5IomI5kKh9k52xPPda.exe 2456 QkHWDXnqiBlN8SXTAJxEBlbc.exe 1112 Relation.pif 1112 Relation.pif 1112 Relation.pif 2484 QkHWDXnqiBlN8SXTAJxEBlbc.exe 2484 QkHWDXnqiBlN8SXTAJxEBlbc.exe 2484 QkHWDXnqiBlN8SXTAJxEBlbc.exe 2484 QkHWDXnqiBlN8SXTAJxEBlbc.exe 2484 QkHWDXnqiBlN8SXTAJxEBlbc.exe 2764 6Pd0jH2BrBsiLMdjihWycS2i.exe 2812 RGfhHR5IomI5kKh9k52xPPda.exe 1208 KlQx9CtTguW3jS1XolH53UnX.exe 2812 RGfhHR5IomI5kKh9k52xPPda.exe 2812 RGfhHR5IomI5kKh9k52xPPda.exe 2812 RGfhHR5IomI5kKh9k52xPPda.exe 2812 RGfhHR5IomI5kKh9k52xPPda.exe 1208 KlQx9CtTguW3jS1XolH53UnX.exe 1208 KlQx9CtTguW3jS1XolH53UnX.exe 1208 KlQx9CtTguW3jS1XolH53UnX.exe 1208 KlQx9CtTguW3jS1XolH53UnX.exe 2764 6Pd0jH2BrBsiLMdjihWycS2i.exe 2764 6Pd0jH2BrBsiLMdjihWycS2i.exe 2764 6Pd0jH2BrBsiLMdjihWycS2i.exe 2764 6Pd0jH2BrBsiLMdjihWycS2i.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1112 Relation.pif 1648 injector.exe 1548 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1548 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1548 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1648 injector.exe 1648 injector.exe 1548 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1548 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe 1648 injector.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 476 Process not Found -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 860 CasPol.exe Token: SeDebugPrivilege 2984 tasklist.exe Token: SeDebugPrivilege 1768 6Pd0jH2BrBsiLMdjihWycS2i.exe Token: SeImpersonatePrivilege 1768 6Pd0jH2BrBsiLMdjihWycS2i.exe Token: SeDebugPrivilege 1472 KlQx9CtTguW3jS1XolH53UnX.exe Token: SeImpersonatePrivilege 1472 KlQx9CtTguW3jS1XolH53UnX.exe Token: SeDebugPrivilege 2656 RGfhHR5IomI5kKh9k52xPPda.exe Token: SeImpersonatePrivilege 2656 RGfhHR5IomI5kKh9k52xPPda.exe Token: SeDebugPrivilege 2456 QkHWDXnqiBlN8SXTAJxEBlbc.exe Token: SeImpersonatePrivilege 2456 QkHWDXnqiBlN8SXTAJxEBlbc.exe Token: SeDebugPrivilege 2788 tasklist.exe Token: SeSystemEnvironmentPrivilege 1744 csrss.exe Token: SeDebugPrivilege 1548 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Token: SeSecurityPrivilege 2960 sc.exe Token: SeSecurityPrivilege 2960 sc.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 1112 Relation.pif 1112 Relation.pif 1112 Relation.pif 2792 u18w.1.exe 2792 u18w.1.exe 2792 u18w.1.exe 2792 u18w.1.exe 2792 u18w.1.exe 2792 u18w.1.exe 2792 u18w.1.exe -
Suspicious use of SendNotifyMessage 10 IoCs
pid Process 1112 Relation.pif 1112 Relation.pif 1112 Relation.pif 2792 u18w.1.exe 2792 u18w.1.exe 2792 u18w.1.exe 2792 u18w.1.exe 2792 u18w.1.exe 2792 u18w.1.exe 2792 u18w.1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1304 wrote to memory of 860 1304 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe 28 PID 1304 wrote to memory of 860 1304 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe 28 PID 1304 wrote to memory of 860 1304 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe 28 PID 1304 wrote to memory of 860 1304 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe 28 PID 1304 wrote to memory of 860 1304 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe 28 PID 1304 wrote to memory of 860 1304 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe 28 PID 1304 wrote to memory of 860 1304 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe 28 PID 1304 wrote to memory of 860 1304 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe 28 PID 1304 wrote to memory of 860 1304 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe 28 PID 1304 wrote to memory of 2052 1304 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe 29 PID 1304 wrote to memory of 2052 1304 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe 29 PID 1304 wrote to memory of 2052 1304 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe 29 PID 860 wrote to memory of 2456 860 CasPol.exe 30 PID 860 wrote to memory of 2456 860 CasPol.exe 30 PID 860 wrote to memory of 2456 860 CasPol.exe 30 PID 860 wrote to memory of 2456 860 CasPol.exe 30 PID 860 wrote to memory of 1616 860 CasPol.exe 31 PID 860 wrote to memory of 1616 860 CasPol.exe 31 PID 860 wrote to memory of 1616 860 CasPol.exe 31 PID 860 wrote to memory of 1616 860 CasPol.exe 31 PID 860 wrote to memory of 2656 860 CasPol.exe 33 PID 860 wrote to memory of 2656 860 CasPol.exe 33 PID 860 wrote to memory of 2656 860 CasPol.exe 33 PID 860 wrote to memory of 2656 860 CasPol.exe 33 PID 860 wrote to memory of 1472 860 CasPol.exe 34 PID 860 wrote to memory of 1472 860 CasPol.exe 34 PID 860 wrote to memory of 1472 860 CasPol.exe 34 PID 860 wrote to memory of 1472 860 CasPol.exe 34 PID 860 wrote to memory of 1804 860 CasPol.exe 35 PID 860 wrote to memory of 1804 860 CasPol.exe 35 PID 860 wrote to memory of 1804 860 CasPol.exe 35 PID 860 wrote to memory of 1804 860 CasPol.exe 35 PID 860 wrote to memory of 1768 860 CasPol.exe 36 PID 860 wrote to memory of 1768 860 CasPol.exe 36 PID 860 wrote to memory of 1768 860 CasPol.exe 36 PID 860 wrote to memory of 1768 860 CasPol.exe 36 PID 1804 wrote to memory of 1632 1804 C2YNPyllyXCvjPcsWpy5xcmG.exe 37 PID 1804 wrote to memory of 1632 1804 C2YNPyllyXCvjPcsWpy5xcmG.exe 37 PID 1804 wrote to memory of 1632 1804 C2YNPyllyXCvjPcsWpy5xcmG.exe 37 PID 1804 wrote to memory of 1632 1804 C2YNPyllyXCvjPcsWpy5xcmG.exe 37 PID 1616 wrote to memory of 1492 1616 9YSsFqhRgrlHq7VDb2jnx2eC.exe 42 PID 1616 wrote to memory of 1492 1616 9YSsFqhRgrlHq7VDb2jnx2eC.exe 42 PID 1616 wrote to memory of 1492 1616 9YSsFqhRgrlHq7VDb2jnx2eC.exe 42 PID 1616 wrote to memory of 1492 1616 9YSsFqhRgrlHq7VDb2jnx2eC.exe 42 PID 1632 wrote to memory of 2984 1632 cmd.exe 43 PID 1632 wrote to memory of 2984 1632 cmd.exe 43 PID 1632 wrote to memory of 2984 1632 cmd.exe 43 PID 1632 wrote to memory of 2984 1632 cmd.exe 43 PID 1632 wrote to memory of 2712 1632 cmd.exe 44 PID 1632 wrote to memory of 2712 1632 cmd.exe 44 PID 1632 wrote to memory of 2712 1632 cmd.exe 44 PID 1632 wrote to memory of 2712 1632 cmd.exe 44 PID 1616 wrote to memory of 2792 1616 9YSsFqhRgrlHq7VDb2jnx2eC.exe 49 PID 1616 wrote to memory of 2792 1616 9YSsFqhRgrlHq7VDb2jnx2eC.exe 49 PID 1616 wrote to memory of 2792 1616 9YSsFqhRgrlHq7VDb2jnx2eC.exe 49 PID 1616 wrote to memory of 2792 1616 9YSsFqhRgrlHq7VDb2jnx2eC.exe 49 PID 1632 wrote to memory of 2788 1632 cmd.exe 50 PID 1632 wrote to memory of 2788 1632 cmd.exe 50 PID 1632 wrote to memory of 2788 1632 cmd.exe 50 PID 1632 wrote to memory of 2788 1632 cmd.exe 50 PID 1632 wrote to memory of 2232 1632 cmd.exe 51 PID 1632 wrote to memory of 2232 1632 cmd.exe 51 PID 1632 wrote to memory of 2232 1632 cmd.exe 51 PID 1632 wrote to memory of 2232 1632 cmd.exe 51 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe"C:\Users\Admin\AppData\Local\Temp\0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\Pictures\QkHWDXnqiBlN8SXTAJxEBlbc.exe"C:\Users\Admin\Pictures\QkHWDXnqiBlN8SXTAJxEBlbc.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456 -
C:\Users\Admin\Pictures\QkHWDXnqiBlN8SXTAJxEBlbc.exe"C:\Users\Admin\Pictures\QkHWDXnqiBlN8SXTAJxEBlbc.exe"5⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2484 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵PID:1844
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:1140
-
-
-
-
-
C:\Users\Admin\Pictures\9YSsFqhRgrlHq7VDb2jnx2eC.exe"C:\Users\Admin\Pictures\9YSsFqhRgrlHq7VDb2jnx2eC.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\u18w.0.exe"C:\Users\Admin\AppData\Local\Temp\u18w.0.exe"5⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1492
-
-
C:\Users\Admin\AppData\Local\Temp\u18w.1.exe"C:\Users\Admin\AppData\Local\Temp\u18w.1.exe"5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD16⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1548
-
-
-
-
C:\Users\Admin\Pictures\RGfhHR5IomI5kKh9k52xPPda.exe"C:\Users\Admin\Pictures\RGfhHR5IomI5kKh9k52xPPda.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656 -
C:\Users\Admin\Pictures\RGfhHR5IomI5kKh9k52xPPda.exe"C:\Users\Admin\Pictures\RGfhHR5IomI5kKh9k52xPPda.exe"5⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2812 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵PID:1340
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
PID:908
-
-
-
-
-
C:\Users\Admin\Pictures\KlQx9CtTguW3jS1XolH53UnX.exe"C:\Users\Admin\Pictures\KlQx9CtTguW3jS1XolH53UnX.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472 -
C:\Users\Admin\Pictures\KlQx9CtTguW3jS1XolH53UnX.exe"C:\Users\Admin\Pictures\KlQx9CtTguW3jS1XolH53UnX.exe"5⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1208 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵PID:3036
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
PID:1608
-
-
-
-
-
C:\Users\Admin\Pictures\C2YNPyllyXCvjPcsWpy5xcmG.exe"C:\Users\Admin\Pictures\C2YNPyllyXCvjPcsWpy5xcmG.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Condos Condos.cmd & Condos.cmd & exit5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"6⤵PID:2712
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"6⤵PID:2232
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 11316⤵PID:2168
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "MAKINGSICKDIFFERENTIALCONSOLES" Reached6⤵PID:2184
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Preparation 1131\W6⤵PID:300
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\1131\Relation.pif1131\Relation.pif 1131\W6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1112
-
-
C:\Windows\SysWOW64\PING.EXEping -n 5 127.0.0.16⤵
- Runs ping.exe
PID:1960
-
-
-
-
C:\Users\Admin\Pictures\6Pd0jH2BrBsiLMdjihWycS2i.exe"C:\Users\Admin\Pictures\6Pd0jH2BrBsiLMdjihWycS2i.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1768 -
C:\Users\Admin\Pictures\6Pd0jH2BrBsiLMdjihWycS2i.exe"C:\Users\Admin\Pictures\6Pd0jH2BrBsiLMdjihWycS2i.exe"5⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2764 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵PID:988
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
PID:2020
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Manipulates WinMon driver.
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1744 -
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
PID:1464
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f7⤵PID:2760
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1648
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:448 -
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER8⤵
- Modifies boot configuration data using bcdedit
PID:2752
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:8⤵
- Modifies boot configuration data using bcdedit
PID:332
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:8⤵
- Modifies boot configuration data using bcdedit
PID:1760
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows8⤵
- Modifies boot configuration data using bcdedit
PID:1404
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe8⤵
- Modifies boot configuration data using bcdedit
PID:2860
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe8⤵
- Modifies boot configuration data using bcdedit
PID:3024
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 08⤵
- Modifies boot configuration data using bcdedit
PID:1080
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn8⤵
- Modifies boot configuration data using bcdedit
PID:2704
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 18⤵
- Modifies boot configuration data using bcdedit
PID:764
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}8⤵
- Modifies boot configuration data using bcdedit
PID:2544
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast8⤵
- Modifies boot configuration data using bcdedit
PID:2000
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -timeout 08⤵
- Modifies boot configuration data using bcdedit
PID:2320
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}8⤵
- Modifies boot configuration data using bcdedit
PID:1676
-
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v7⤵
- Modifies boot configuration data using bcdedit
PID:3000
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeC:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe7⤵
- Executes dropped EXE
PID:1432
-
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
PID:2896
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"7⤵
- Executes dropped EXE
PID:2112 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵PID:1380
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)9⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
-
-
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1304 -s 6683⤵PID:2052
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\1131\Relation.pif"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\1131\Relation.pif"2⤵
- Executes dropped EXE
PID:676
-
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240508222249.log C:\Windows\Logs\CBS\CbsPersist_20240508222249.cab1⤵
- Drops file in Windows directory
PID:2164
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "14772286411767887886-94966295273841853622264961011292889-77277404566936954"1⤵PID:300
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2792
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d43b03c5fea1a7522134e25a46328dd
SHA17866ec9b52e8559dcc45f9a55f3833d5c66bf8ab
SHA2561961c1e4eda39db4b5238ce8c0e92448f6ee3a633777e1378ff3497f61e98f25
SHA5127fc8dcac0e392ae2748af874863a5f6390fc712086c7cabb6c5928fd2a7d57faac26392534ec92c78f39c34b01b24181a36c31d101d06508180873251f5425ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557e8c4a467be5a86e292be1ad778b03a
SHA18cf5ef7242af53e44fb6c9d14f807c7a73c26f52
SHA25629561bac5db2242813b539ec2862d9a36ab0eb47ffaaa2f1fcee900e4816f84d
SHA512eba521490d98fce332659c35e4e6be5c53f11585fa9d476ff4da9e75dc439b0de23646954c00c1f632527f4afa576b8f79d1e03468c4a0ac8eef966e629f7327
-
C:\Users\Admin\AppData\Local\Microsoft\ApplicationInsights\e6ffddf3200b65799721748e7bb893fcf6bbd5f96862174d6d4619981bbc3f50\ed4cce77ab0b4dc2bf6d37bdc4eefc07.tmp
Filesize1KB
MD579047c09bfe0e3a95ff53d48870bb811
SHA1c6ea2468b76adc63127ace2dba6f2591db9c5eb8
SHA256931ad591c9f6442d376996457dae17df5b73aeae6823c14bf89f6e909ae3535f
SHA512ea3630c1226a49413eb8c661efe0881e7188c433a97f1b0f841cbfdbc9cf25bf73ff2e3c3463e1322b7ea83e4bc7e67748512fda5d554a9551ddf35f5e614e21
-
Filesize
30KB
MD5191defa5ed07e4895c30176c816388f8
SHA1d8eb01573b563dd4ff44664e9011b233f1247bf4
SHA2561ae053b84dd0e3960ad12010537fcf699647eb38088de8460cc67af9d8a8927b
SHA51294019365d8ee804c4b8846011cc887ef8776117f654f5eb381006ffceaf338d747d456ad60625135aba84f2313da3444b4a2a4b0a5c8b991fe75c6a7e8940fd9
-
Filesize
12KB
MD57002847fa087b02ea0ef12b456321d35
SHA13c8fb2c8c848bdaf28e542d533e00e28a74fd000
SHA256fb11908020eba9c8e74a4251539fb6ad3023968b3b673f71ccfca64e412b64de
SHA512d341a9a2e91f7418752fff990e52dc3e3a843b7651b2e9ef97e64a67266648da81962ab5332e9d1cecf18fb3bb4d44aabb2f94567b54005fe0c39c22277881d9
-
Filesize
10KB
MD565f53277780a48d3c0f07274b525f4c4
SHA19f22741f8e291ca07316416eb1565cb32d2da43e
SHA256fca82be7c83638610f35bb6167446034e9b6a57cfccf9a6e1badcac8453dcb33
SHA5127d962f27b3c19e678355e5082b9d47131b8fe1e9deaa65aee6b266f2ba83dfbbafd1a670d2702eaeb2e4061805cf55b02cc21881ad38dcf18665243d44ba7e91
-
Filesize
62KB
MD54cb3dbd1f379b3596a903aed2df61cb3
SHA1ae1709bc8cb85aac416e63511e95c5934cd48e16
SHA256a734a1350b8cd30b487587a86911b456fa107edabe4ecdbd7f8c2c1ec528a290
SHA512d6d186347be0c3ea0b882643bae5dc32a00363e59a98f3fb5803e7078533642f0a9cd7c93f38ef2d4cd4832f4ea64412f4b36ad9bd02c5f4f73666701ca73284
-
Filesize
24KB
MD5fdb32a6e9e0f2954cb1b14ecc79fed6a
SHA113699b7d9c048c82debc03817176746ec1a5f809
SHA256efa353678b065d2d04e3fec7eebcb607878c2e54bf929c44b2c74aca83ab72c0
SHA5126b84ab7e50821ab97c5d78ba1ea4ee03d57ab363eaba6f9261667640c0293aeb62075d8c709c0400f7dc25555ee84af57d34ca899c1e6b36688cac6471e7be1b
-
Filesize
54KB
MD575b2bb1581932049ff195ad2ca090d4e
SHA10c5ae49798bddc824c039ab477e8035d8531b5f6
SHA256cd029ae05fe48174da1ff8a3ff40bcecf3fda4f452df129c17e68fe7acf9ece0
SHA512e65c070ca3bb1afefe645cc7cb6bbe3d84ada968e5ff7955f236a46d134410cd33b31b82298e56e9d85e8a349cbfeb2c38585583db860a56b8b554d790a92771
-
Filesize
36KB
MD5aaf99a2da429134ee8c723a965001742
SHA1b26ef510ec16f0ab28242acb790764ec53018174
SHA25608ee275735b41a482db0a32be02c519be429b026c1ad1a0ff9a127dec8562909
SHA512921818139a6623454c73f983ce69d1315fa2e3136005cf1a6c6040e489e7512403b48e86e4090f5e0a2557baf5cec91b5e671a005a41ff510e25758f402b3bfd
-
Filesize
25KB
MD5cdb2932ff35f980158e251eb95392a54
SHA1f0133b9bc1d06646b537eb3ad6771b17c1b9b397
SHA2561e8d9429827487572b8a0e4b8b0ff7deab9696d2186075ca1d9df404ecbc88f2
SHA51253d7f302ed135a1e780be037918f9bb4aae5502b9ca2539719002fe47bf6d1e0b1cae62f4d0c56e55520c66e1fcb4ec515f5046a8ec14c6d613fe417698625b8
-
Filesize
24KB
MD58e995591a7a4eb7d7418302ef5d515ae
SHA1d2c47b03e1b3a37af127ae588871360be4a2d0b6
SHA256057b1d521d4a083cafee62fd9c2dfefad939f1f9f84f8b1028b948858796021e
SHA512f8d657b294926bac7ea3d364fce716e21e1247b938cf533edad3e7b9fa43e241ab97aeb1e314264c13b50716663e7f7a75afe77769b48c73d662b64d6714b07f
-
Filesize
68KB
MD5022f3a00000c173b3d0f125b6c3e741a
SHA1cea8239a58fabbf3f4fbc9bd356ff2a81e32cf45
SHA256633d4237545cbd53854d48de66769da35527c194ebbfcb29fba5fc9fcc807859
SHA512826ff7273170d6a0934ffde98c0d28663c4d876e2f2cbc1de0cbc5bf96425c6fd7b20c60af74563df0d1ed2dd5efb84b39d7c9af9624916cfd2e4780cb95eb78
-
Filesize
26KB
MD5aa2a5f1c5e1261042a597d67d176eb2e
SHA19be24809122b0a4e2ab1fe51a300937e20c7c523
SHA2564f87e70a75ac736b58605c2690f05b81e1361c0dc9547d1bcfa1fca487a26555
SHA512d86b726e510be805dc7b222fb892cb5bce5625aeccb3a0c419496aa1bbd1120844eace9149e995d618ef1b9aae3c4c55dfcff2768099adb2766ec9dc8f15f756
-
Filesize
48KB
MD5fab0f8bc843df7fb4f28dd097cc76a3d
SHA19d6f051ca98aec37276fc558c586ad2dfe6a0923
SHA2563c160730ca9e0ff95bd68887ad99c5cae7a2ca1a2ec923764b48074a87605572
SHA51217ae111f4c3790766581243cca1569953f0b479750a058acb27fbbc9d736f7cbedb0c59f952c673766ee5739fe594d38ab2b79baf404e3fa6b61b37457becd14
-
Filesize
30KB
MD5fdb391ac4c45c35508435c9cda69e018
SHA13a0d53b20b73bd0cb28d19e3813d75b1d95aff52
SHA256d7d4f9e34f40549e686f5cc3cb74041848ee38bee8a5293eca7f969c56ba2708
SHA51255be1e9a7182b3df68a330cf2a9e94839a7d808748d1d4c7bfb2915c2a205339d6b0e5224b9df70b0053f007ccfd7c42aa7fc5a3426bc8759dea6186f167a351
-
Filesize
23KB
MD5915a9a3892708b7671b95e7490db64ec
SHA1f37a89fd3d08c7d8e8cea3fd67c4d80c1a996f7d
SHA25686db30f6a2a4c175274cb45cb1a0d869eb0e272a9157728b021159c04ca74dc4
SHA5127a2be931c2a4ade3fd2d80a60d9fea221aa288f3c402d66409a35b5c00c81d97615ce80977c67521910ec9e2e106874331c780ce7805a9861bcf7380c2daabe4
-
Filesize
23KB
MD59076bb2763755a369e725b7d90cb9a6e
SHA1950dab154109608dce3a710daffd494a6c6e56a5
SHA2563ebd51bcaa3a9912b6f0c7ff47fab1e999334eeab3a179bb16c0f1fcc400b266
SHA51278563047dfb2542364e3ff09830c6b4117376b6ffde741cb4d6d1f65a7e85f7e92c6610ad6ececa5117258dd498cedf4e93687e9edd117d79062613094e48729
-
Filesize
35KB
MD52845984f979b604f1c6b6e749ff30541
SHA1457a27dbe60f8249e253cdc37ffa11686754bc96
SHA256275004c4562f9ebf00cab6571e35f59ff1ba48a1f073b134566bd37889f454ab
SHA512d95792a146ffc4de26eb9f3e41765eb7e0c296aa2993230b69754e6217a1698711edfbf7565783b048bdbd0a2077758a0fd307d3247651429f6e4c52028a4395
-
Filesize
9KB
MD5601ebaeaa4c3dca8b085e080911bbbbc
SHA16d1608cb089e860e5868ac317629f38d1e5cefbb
SHA256fb853dab53bf849c8cb2cbda654e90388d060f2f47000e7968b334c56d403981
SHA512c2c56dfc650bd6401e98101f00f75a9e333677fdaa9006aaca86b50d70966ad81943cee5c65052813cc5865ed2e1d7ff96b664cc675d1758e012bfcffdd9b3fa
-
Filesize
22KB
MD505acc2c532b339ae2a048314dccb2bce
SHA17a06e246ad283654c040f55241d20cc3ecd5b0e8
SHA25657e9b2a94cf474411fa6395e601efaffcb894395e0624b6c2242a1e782d144e5
SHA51205407f0453826dd9ae5281c5d4c9e768897bafcbe73d6acb0a80ff9efc7082b8dd42ebe8d8ea0bd9261afc82474e558514397e9f57ee570735fdf7731f832eed
-
Filesize
14KB
MD5f1a9d44c7e3758ca9dfdae1182256e76
SHA1b4456482a0d76399b155ac6788749be2bdb12ba6
SHA2569cae9fc2200459d69a119b7ffd95e75c4d53ede32d9d394c15ec4cb19c8ac8cd
SHA5128a3a3bb0d9cec4bdda515a1f10ed7f0f3341e813397970be83a1b60b4a622600bcce2abb163afd29b62818b97dc39caf9570a2cea0018a0ced703a1b058894d9
-
Filesize
56KB
MD5b20fa9ef1174947acdc4a9846333f36f
SHA1ec6f2624e66250ef03a8e43a1d2dd63db3094ab9
SHA256250ff5b66e141a864a838fcaae2757b77dd4e32b130a5360c95baa408b37abe3
SHA5127d684ce6586d3703fee97b3e059d1241cb386689836a00d5f3f57148390c0053848e60bd87afcebbf21235bcb590d66b8e3bfad4443df413802529c83b8d355b
-
Filesize
51KB
MD5bb9479999fa8e8d2357858f9bc13c624
SHA114275a134e8846587a15098143b6ef5725b4a781
SHA256fab163cf0618114d25b89c4d5ea1a80afe55860888dfd269e6f2274bf2da0f8c
SHA5126f7e8483211d88430ce8d9eb9757cbe2dc98946f55e1474f47383503768d3c3bb6bbc7946491bc045d3fe0a1fcd89a03d0d5c3ae76ee9d1dd02aa994e91d2461
-
Filesize
193B
MD5b8d87f89dbb78ade03e66cbb417dadfb
SHA1051c9f18770f3debf83cf1de47451bd1c2ccc7ff
SHA256b0f1ba9c4210a321e4294de108d755be0a6ec74009de1077f9625290f7fc30f2
SHA512731fbc0eb10e52e8d1910cc641ad61920b2a1d2dc341aba950ea769b5a3e3a6435b05a795e80fa591f8fa3ca2e64294d897bfc12f168f2339badb566f9a8ee6c
-
Filesize
45KB
MD5014a32d860ea71ce3da8a9ad5a0b6a20
SHA1b6ea93e9b181a6daa09341bf08f0823cb456bec9
SHA256c141ed8f5edf8f9cb910b7a0ecbbd2e8419558b1d004fa1205e9513242fa7546
SHA5121f7b0cefd216e94853e63b7545b985ee741d0b702229917185d52b7c9db52098322f025e8ce6cfbf5f4f6a31f69e5d4c4da6d494f2370df8ee5afcbda8a67895
-
Filesize
60KB
MD5e7a9f69e9cb8756fdc28ee571ccf44c0
SHA1c95c9d89b468a49688e5fe0a1815792053444422
SHA25634e6d06f9165232b79b01fb2ef98441b8a5fabd916d70d9f63de2ba382942de2
SHA512b803394cf5ea031135f881473855bdfbfbb8d104a0e3d1a7e1460b5fac5fce8982a83aa26707f28153d3a9578398f3c9e2995863cce7c37010b42b7073298d7f
-
Filesize
32KB
MD5abd0c385b8f946d9ecdd9714136c76ce
SHA1cccd9c745149a5ff9674377d90330a6dfd197fdc
SHA2562e3d927996819e69633de40cd8e7016e531fce0ae80a1c053ee70157ff716d6c
SHA5129b7e5183b14a5609c5a1f41f58c70aeb1313dad351256e52ca8050988226321124a2079ab8dbd863d7215f9201845bfff3b2ad2d2881b7b707486cd6553631a9
-
Filesize
48KB
MD5da9e230c9d95aa47f18f5d9f4898f94a
SHA104903bbe23ffea0097cbfb18a27a2106f8c19c3a
SHA2563aafbb1246924f7db47a5cd38bc09872547a7942aea036fcec4b6da3f78c1232
SHA512fd0e8b4a1e893c1810f10427aaa6d555612518bbdcdd5addcd9e9460da11f80535623058e7fc57b267401b3d29a1f20fb9dfa2de3ddc13d9a03b3141d77f6738
-
Filesize
28KB
MD5c7ccc2e3093614ca1fb5a4bc5ed467e1
SHA199e159f9a6478f4accd70cae77ad180fa294dc70
SHA2561db28cada947fb8d37e9550a08718774f7d55f64f3ff3b2ee9b1b8ad9db8ce34
SHA5126d77c91c8c2a80742f1cedb69cde2cf3d68bd74764a76cbb086daa015b3d18eeb9131919ea93cf13e9f400d824809bf8a2ee40fd1353a04bee392ebcbe09fb36
-
Filesize
18KB
MD514e0d2a31ef79d37669d4f65db310bd1
SHA18908a3b1b30d5bcb5aea066eac185f3cd76ed2d2
SHA2561c86e9dcc3f6bb33efd2f5bbf62ead4b83a2f884813cc8d4cb35f0926337fc01
SHA512ad4fb2c7c501c248ad9cbda8dddd1d8a22a51d01bc1cf82a4316c2bc5d839bbbf9dce90a47f9a029d86d8cb8ade1428bdaffa1927d8414b8c9cfd381ca44c12e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
Filesize8.3MB
MD5fd2727132edd0b59fa33733daa11d9ef
SHA163e36198d90c4c2b9b09dd6786b82aba5f03d29a
SHA2563a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e
SHA5123e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e
-
C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
Filesize492KB
MD5fafbf2197151d5ce947872a4b0bcbe16
SHA1a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020
SHA256feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71
SHA512acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
1KB
MD53c8632957f639890e35cc5a10d1451c2
SHA19ef12cb4688c293c80afcc4849f97729f11ea1ed
SHA2562282f6db4acb0c119153bd2cb41c13e3fb2d3f16b3a1c73fdae6114f6cee4fb6
SHA512b711438bc48a1b2043b24100f32a7e77fc3623425ef0f1402c7a646016be40b5810cb0e8225bcd3957ab7a2d2ab92d7c2177f10123cc7506076e270fbb1ab62d
-
Filesize
2KB
MD5902270e14e39bc7ae9579bb0fa536ec0
SHA1a3d37a098c02472f218ab729ce8f9e41f6e88c77
SHA256c337898465b29c191876bde78e52fb412a59c6e573ce65e2b85141d031626651
SHA5125b5ad55bd8e41157655a997e712d8fbca0c147a6cb1287d421a8e47996af68c4ee507985de822602973feda9df4d50d5721baa6c2d1638eae067f223eed10477
-
Filesize
3KB
MD507e1daba927cb42a7f1e2885e9c88831
SHA190b4dc4e12914ae96547159f5c881e3094d9605f
SHA25647fc322c8d982f79b1abf9bd8aa60df5cc9e20ad7578644235fbd7d6cb812143
SHA5125f02e0cfdcb419fcc698d97c6538decbf151ec726addd91a6fffebb58215f84bdd858ac8d9059e56d16e605b82c06baa12e268e162d8703497bf03bebec7a880
-
Filesize
5.3MB
MD51afff8d5352aecef2ecd47ffa02d7f7d
SHA18b115b84efdb3a1b87f750d35822b2609e665bef
SHA256c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb
-
Filesize
591KB
MD5e2f68dc7fbd6e0bf031ca3809a739346
SHA19c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA51226256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579
-
Filesize
4.1MB
MD55fe730ab2ac35a2539d3a10fa546e8db
SHA1b4d5706fed29221a76998a189e60175e28d6e997
SHA25679b82ab87b8cc6b6ba829a2c3675cc1fef342a6d1c0d06c0afd9942c9726dc1a
SHA512e7db08dc832ad04728d244c6cffedb5d3c72672f95e54533b72392af67ead0e3bef400e6865f2add226f740751686f2ba07dfa3341694a36c49f235a85a76636
-
Filesize
223KB
MD5280229b137b0f36f2b18b9bc7841995d
SHA1d800c8ecc758ccacfe9a91efd45904efcc17b84a
SHA25649533fc0ca008e430d35fdabab4b200a70e629e62f5b16f9157b5a82b6494536
SHA512aeb7566ad83b6b1a01e2d8f6e557a18a75a8bd4229f72cc9e1b1ffe9dd86d14469937eea221e0d436274d4444d4f1732098b98ca3ddc3c7aec65867107fbdec5
-
Filesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
Filesize
364KB
MD5164928a82210574dbb33128a7416e69a
SHA15483ed912d256abad4c51dfac3c6bd5417e5102d
SHA256d9c1e5df5baf1833a72a9591ab685d65c9e985563d791e27d5c4e4afeb672697
SHA5120900ddb9cc6e8d2f2c5a9c2432c053c8120668314e0c9a15808718c27cee987fd83b647c280995a6bebbe7c79d7e2d9f1ae72e15be4f09f723fc7aa9dc777b41
-
Filesize
760KB
MD5b014a9fa212f522998525a0d50513237
SHA12e0f6e70510af4f265e74c423a5994d5926e8620
SHA25664c69d08fe3c0f60d11aa4c93ee181b34cb8769175f4cb6c6c4dbb799d029e90
SHA512944f0d681a0c54ee3b8a14ade618eb26291ce457c3bf56a8234748257e8e8cec36cbfd9db63ba0964c42503db29999e919799e587488d34038824e47159f383a
-
Filesize
4.1MB
MD5acc96ea4633ab3916b47a71560de1ac4
SHA1c1fc7d97eea75535e3fc9bdb3c8b3070ac058bcf
SHA256e7e791761b87d13024503f0b3268130634febc3639b5765541180dbfa5c852ac
SHA512e26b9afff50e18f6746c6555aed29ead0e1533d4e3fddf8fb0ac7b80abe93cbdb50f3e48964fcaefa3a88f7238390a1f43b031d27cf72fd7fea64d2cdb8bebad