3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944

Analysis

max time kernel
149s
max time network
135s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
Size

10.9MB
MD5

72da4685f7f560a497f7fb644f3a52f7
SHA1

3a6e283df58dfd19d6e6328fb1d55214bfd3f363
SHA256

3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944
SHA512

8e0c486d3371400276a71e1199f68cfb58fe96f14a798894ab3ea5460bcb9a41399aec9af12347b7a357d408524143a47dd7a48611ae60377b3812dbb728bf9e
SSDEEP

196608:fozA+9CZKfpCZGhOqhI8HuAUZdzO2Z5zrPzivICK0LowY66ZQyZgw7:fp+9dAIMqhI8fUG2Hz7mvICK0LoP66Zl

Score

8^/10

bootkit evasion persistence

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

2228 netsh.exe
2072 netsh.exe
Executes dropped EXE 6 IoCs

Processes:

systecv3.exewinrdgv3.exewinrdlv3.exewinrdgv3.exewinrdlv3.exewinrdlv3.exe

pid process

792 systecv3.exe
868 winrdgv3.exe
2128 winrdlv3.exe
1496 winrdgv3.exe
764 winrdlv3.exe
2260 winrdlv3.exe

pid	process
2228	netsh.exe
2072	netsh.exe

pid	process
792	systecv3.exe
868	winrdgv3.exe
2128	winrdlv3.exe
1496	winrdgv3.exe
764	winrdlv3.exe
2260	winrdlv3.exe

Loads dropped DLL 17 IoCs

Processes:

3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exewinrdgv3.exewinrdlv3.exewinrdlv3.exe

pid	process
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
868	winrdgv3.exe
868	winrdgv3.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
2128	winrdlv3.exe
2128	winrdlv3.exe
764	winrdlv3.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

winrdlv3.exe

description	ioc	process
File opened (read-only)	\??\V:	winrdlv3.exe
File opened (read-only)	\??\E:	winrdlv3.exe
File opened (read-only)	\??\Q:	winrdlv3.exe
File opened (read-only)	\??\M:	winrdlv3.exe
File opened (read-only)	\??\Z:	winrdlv3.exe
File opened (read-only)	\??\D:	winrdlv3.exe
File opened (read-only)	\??\A:	winrdlv3.exe
File opened (read-only)	\??\O:	winrdlv3.exe
File opened (read-only)	\??\R:	winrdlv3.exe
File opened (read-only)	\??\G:	winrdlv3.exe
File opened (read-only)	\??\H:	winrdlv3.exe
File opened (read-only)	\??\B:	winrdlv3.exe
File opened (read-only)	\??\Y:	winrdlv3.exe
File opened (read-only)	\??\U:	winrdlv3.exe
File opened (read-only)	\??\J:	winrdlv3.exe
File opened (read-only)	\??\P:	winrdlv3.exe
File opened (read-only)	\??\N:	winrdlv3.exe
File opened (read-only)	\??\W:	winrdlv3.exe
File opened (read-only)	\??\F:	winrdlv3.exe
File opened (read-only)	\??\I:	winrdlv3.exe
File opened (read-only)	\??\S:	winrdlv3.exe
File opened (read-only)	\??\X:	winrdlv3.exe
File opened (read-only)	\??\T:	winrdlv3.exe
File opened (read-only)	\??\K:	winrdlv3.exe
File opened (read-only)	\??\L:	winrdlv3.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

winrdlv3.exe

description ioc process

File opened for modification \??\PhysicalDrive0 winrdlv3.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	winrdlv3.exe

Drops file in System32 directory 64 IoCs

Processes:

3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exewinrdlv3.exewinrdgv3.exesystecv3.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent\Config\p2p_common.ini	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\endata\aw_1045.dat	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\SysWow64\Ocular\TKS\TKSTemp\Agent\764	winrdlv3.exe
File created	C:\Windows\SysWow64\Ocular\ExData\ocular_exdata2_2024_5_11_6_18_3_259405716_2_3_18467	winrdlv3.exe
File created	C:\Windows\SysWOW64\Ocular\OPolicy.ini	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\imageformats\qsvg.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\imageformats\qwbmp.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\SysWow64\Ocular\OAgent.ini	winrdlv3.exe
File created	C:\Windows\SysWow64\Ocular\ExData\ocular_exdata2_2024_5_11_6_18_3_259405716_3_3_6334	winrdlv3.exe
File opened for modification	C:\Windows\SysWow64\Ocular\Deploy	winrdlv3.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\endata\aw_1007.dat	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\endata\h_1.dat	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\platforminputcontexts\qtvirtualkeyboardplugin.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C86BD7751D53F10F65AAAD66BBDF33C7	winrdgv3.exe
File created	C:\Windows\SysWOW64\api-ms-win-shcore-scaling-l1-1-1.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	winrdgv3.exe
File created	C:\Windows\SysWOW64\imageformats\qjpeg.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\imageformats\qtiff.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\qmltooling\qmldbg_native.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\libssh2.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\Qt\labs\folderlistmodel\plugins.qmltypes	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\endata\aw_1023.dat	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\imageformats\qgif.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\SysWow64\Ocular\WinPatch	winrdlv3.exe
File created	C:\Windows\SysWow64\Ocular\ExData\ocular_exdata_2024_5_11_6_18_10_259412455_3_3_18467	winrdlv3.exe
File created	C:\Windows\SysWow64\Ocular\ExData\ocular_exdata_2024_5_11_6_18_12_259414514_5_3_6334	winrdlv3.exe
File created	C:\Windows\SysWOW64\endata\aw_1004.dat	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\endata\h_2.dat	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\Ocular\msagentclass.dat	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\Display.AMD.20150715.Scindex	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\dgpver.dat	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\knewuplive.ini	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\Qt\labs\platform\plugins.qmltypes	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\qmltooling\qmldbg_debugger.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\SysWow64\Ocular\TKS\TKSTemp\Agent	winrdlv3.exe
File created	C:\Windows\SysWOW64\Qt5Svg.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\Qt5WebChannel.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\endata\aw2_1001.dat	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\SysWow64\Ocular	systecv3.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\endata\aw_1024.dat	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\endata\aw_1015.dat	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\endata\aw_1046.dat	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\platforms\qwindows.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\dbph.dat	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\otherfile_icon.png	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\endata\aw2_1004.dat	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\qmltooling\qmldbg_inspector.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\SysWow64\Ocular\OBtEmulator	winrdlv3.exe
File created	C:\Windows\SysWOW64\officetemplate.kid	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\SysWow64\Ocular\Download	winrdlv3.exe
File opened for modification	C:\Windows\SysWow64\Ocular\OPolicy.ini	winrdlv3.exe
File opened for modification	C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\SysWOW64\360zip\360zipver.dll	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	winrdgv3.exe

Drops file in Program Files directory 3 IoCs

Processes:

3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exesystecv3.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\System\systecv3.exe	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Program Files (x86)\Common Files\System\winrdgv3.exe	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\winrdgv3.exe	systecv3.exe

Drops file in Windows directory 23 IoCs

Processes:

winrdlv3.exe3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exesystecv3.exewinrdlv3.exe

description	ioc	process
File opened for modification	C:\Windows\bakThirdPartyLib.dat	winrdlv3.exe
File opened for modification	C:\Windows\bakCertList.dat	winrdlv3.exe
File created	C:\Windows\bakwdgv3.sys	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\win.ini	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\bakDWM.dat	systecv3.exe
File opened for modification	C:\Windows\bakCertList.dat	systecv3.exe
File created	C:\Windows\bakoav3.sys	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\bakCameraPack.dat	systecv3.exe
File opened for modification	C:\Windows\bakTKSPack.dat	systecv3.exe
File opened for modification	C:\Windows\bakThirdPartyLib.dat	systecv3.exe
File created	C:\Windows\LInstSvr.exe	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\bakSCClient.dat	systecv3.exe
File opened for modification	C:\Windows\bakTStartMenu.dat	systecv3.exe
File opened for modification	C:\Windows\bakSCClient.dat	winrdlv3.exe
File created	C:\Windows\bakrdgv3.sys	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\bakrdlv3.sys	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\bakstec3.sys	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File created	C:\Windows\bakwdgv364.sys	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
File opened for modification	C:\Windows\bakTStartMenu.dat	winrdlv3.exe
File opened for modification	C:\Windows\bakCameraPack.dat	winrdlv3.exe
File opened for modification	C:\Windows\bakTKSPack.dat	winrdlv3.exe
File opened for modification	C:\Windows\bakDWM.dat	winrdlv3.exe
File opened for modification	C:\Windows\win.ini	winrdlv3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

winrdlv3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	winrdlv3.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	winrdlv3.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	winrdlv3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	winrdlv3.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

winrdgv3.exewinrdlv3.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	winrdgv3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	winrdgv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	winrdlv3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	winrdlv3.exe

Modifies registry class 21 IoCs

Processes:

winrdlv3.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID\OUTOFLICENSE3 = "1"	winrdlv3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID\SIP = "3471755147"	winrdlv3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID\SIPD = "4294967295"	winrdlv3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID\ASN = 0000000000000000214e000000000000000000000200000001000000100000000000000030004600330046004600460046004600300046003000300030003300300030000000	winrdlv3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID\SSASN = 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	winrdlv3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID\AIDInfo2 = 000000000000000006000000020000000200000043003a005c00570049004e0044004f005700530000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000c292db67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000052c3dfe6ae2de640	winrdlv3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	winrdlv3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID\OUTOFLICENSE4 = "1"	winrdlv3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID\AIDInfo2 = 000000000000000006000000010000000200000043003a005c00570049004e0044004f005700530000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004400410044005900200048004100520044004400490053004b00200051004d00300030003000310033000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000d22a4ff6eed800000000000000000000000000000000000000000000000000000000000000000000000000000000000052c3dfe6ae2de640	winrdlv3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID\InstallTime = 52c3dfe6ae2de640	winrdlv3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID\AID = "65812"	winrdlv3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID\OUTOFLICENSE2 = "1"	winrdlv3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID\GID = "999"	winrdlv3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID\OUTOFLICENSEEX = "010000000100000001000000010000000100000001000000010000000100000001000000010000000100000001000000010000000100000001000000"	winrdlv3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID\AIDInfo = 030000004400450053004b0054004f0050002d003500530037004b004b00470038000000	winrdlv3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID	winrdlv3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	winrdlv3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID\SNameSID = "4294967295"	winrdlv3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID\SName = 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	winrdlv3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}	winrdlv3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFFAEF68-CDC5-4aad-9D3F-997C0D55927B}\ProgID\AID = "65655"	winrdlv3.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

winrdgv3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	winrdgv3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	winrdgv3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	winrdgv3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	winrdgv3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exewinrdlv3.exewinrdlv3.exe

pid	process
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
2128	winrdlv3.exe
2128	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
2128	winrdlv3.exe
2128	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
2128	winrdlv3.exe
2128	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
2128	winrdlv3.exe
2128	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
2128	winrdlv3.exe
2128	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
2128	winrdlv3.exe
2128	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe
2128	winrdlv3.exe
2128	winrdlv3.exe
764	winrdlv3.exe
764	winrdlv3.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

480
480
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

systecv3.exewinrdlv3.exe

description pid process

Token: SeDebugPrivilege 792 systecv3.exe
Token: SeTcbPrivilege 764 winrdlv3.exe
Token: SeDebugPrivilege 764 winrdlv3.exe

pid	process
480
480

description	pid	process
Token: SeDebugPrivilege	792	systecv3.exe
Token: SeTcbPrivilege	764	winrdlv3.exe
Token: SeDebugPrivilege	764	winrdlv3.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.execmd.execmd.exewinrdgv3.exewinrdlv3.exewinrdlv3.exe

description	pid	process	target process
PID 2804 wrote to memory of 2872	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	cmd.exe
PID 2804 wrote to memory of 2872	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	cmd.exe
PID 2804 wrote to memory of 2872	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	cmd.exe
PID 2804 wrote to memory of 2872	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	cmd.exe
PID 2872 wrote to memory of 2228	2872	cmd.exe	netsh.exe
PID 2872 wrote to memory of 2228	2872	cmd.exe	netsh.exe
PID 2872 wrote to memory of 2228	2872	cmd.exe	netsh.exe
PID 2872 wrote to memory of 2228	2872	cmd.exe	netsh.exe
PID 2804 wrote to memory of 1860	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	cmd.exe
PID 2804 wrote to memory of 1860	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	cmd.exe
PID 2804 wrote to memory of 1860	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	cmd.exe
PID 2804 wrote to memory of 1860	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	cmd.exe
PID 1860 wrote to memory of 2072	1860	cmd.exe	netsh.exe
PID 1860 wrote to memory of 2072	1860	cmd.exe	netsh.exe
PID 1860 wrote to memory of 2072	1860	cmd.exe	netsh.exe
PID 1860 wrote to memory of 2072	1860	cmd.exe	netsh.exe
PID 2804 wrote to memory of 792	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	systecv3.exe
PID 2804 wrote to memory of 792	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	systecv3.exe
PID 2804 wrote to memory of 792	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	systecv3.exe
PID 2804 wrote to memory of 792	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	systecv3.exe
PID 868 wrote to memory of 2128	868	winrdgv3.exe	winrdlv3.exe
PID 868 wrote to memory of 2128	868	winrdgv3.exe	winrdlv3.exe
PID 868 wrote to memory of 2128	868	winrdgv3.exe	winrdlv3.exe
PID 868 wrote to memory of 2128	868	winrdgv3.exe	winrdlv3.exe
PID 2804 wrote to memory of 1496	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	winrdgv3.exe
PID 2804 wrote to memory of 1496	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	winrdgv3.exe
PID 2804 wrote to memory of 1496	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	winrdgv3.exe
PID 2804 wrote to memory of 1496	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	winrdgv3.exe
PID 2128 wrote to memory of 764	2128	winrdlv3.exe	winrdlv3.exe
PID 2128 wrote to memory of 764	2128	winrdlv3.exe	winrdlv3.exe
PID 2128 wrote to memory of 764	2128	winrdlv3.exe	winrdlv3.exe
PID 2128 wrote to memory of 764	2128	winrdlv3.exe	winrdlv3.exe
PID 2804 wrote to memory of 2260	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	winrdlv3.exe
PID 2804 wrote to memory of 2260	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	winrdlv3.exe
PID 2804 wrote to memory of 2260	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	winrdlv3.exe
PID 2804 wrote to memory of 2260	2804	3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe	winrdlv3.exe
PID 764 wrote to memory of 2972	764	winrdlv3.exe	regsvr32.exe
PID 764 wrote to memory of 2972	764	winrdlv3.exe	regsvr32.exe
PID 764 wrote to memory of 2972	764	winrdlv3.exe	regsvr32.exe
PID 764 wrote to memory of 2972	764	winrdlv3.exe	regsvr32.exe
PID 764 wrote to memory of 2972	764	winrdlv3.exe	regsvr32.exe
PID 764 wrote to memory of 2972	764	winrdlv3.exe	regsvr32.exe
PID 764 wrote to memory of 2972	764	winrdlv3.exe	regsvr32.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

winrdlv3.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	winrdlv3.exe

C:\Users\Admin\AppData\Local\Temp\3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe
"C:\Users\Admin\AppData\Local\Temp\3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\cmd.exe
cmd /c netsh advfirewall firewall add rule name="winrdlv3" dir=in action=allow program="C:\Windows\system32\winrdlv3.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="winrdlv3" dir=in action=allow program="C:\Windows\system32\winrdlv3.exe"
3⤵
- Modifies Windows Firewall
PID:2228

C:\Windows\SysWOW64\cmd.exe
cmd /c netsh advfirewall firewall add rule name="winrdlv3" dir=out action=allow program="C:\Windows\system32\winrdlv3.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="winrdlv3" dir=out action=allow program="C:\Windows\system32\winrdlv3.exe"
3⤵
- Modifies Windows Firewall
PID:2072

C:\Program Files (x86)\Common Files\System\systecv3.exe
"C:\Program Files (x86)\Common Files\System\systecv3.exe" SW_HIDE
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:792

C:\Program Files (x86)\Common Files\System\winrdgv3.exe
"C:\Program Files (x86)\Common Files\System\winrdgv3.exe" SW_HIDE
2⤵
- Executes dropped EXE
PID:1496

C:\Windows\SysWOW64\winrdlv3.exe
"C:\Windows\system32\winrdlv3.exe" SW_HIDE
2⤵
- Executes dropped EXE
PID:2260

C:\Program Files (x86)\Common Files\System\winrdgv3.exe
"C:\Program Files (x86)\Common Files\System\winrdgv3.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\SysWow64\winrdlv3.exe
C:\Windows\SysWow64\winrdlv3.exe winwdgv3.dll,RunMonitor32
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2128

C:\Windows\SysWow64\winrdlv3.exe
C:\Windows\SysWow64\winrdlv3.exe winoav3.dll,RunAgent32
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:764

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s trmenushl64.dll
4⤵
PID:2972

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\System\systecv3.exe
Filesize
2.3MB

MD5
b9e0a7cbd7fdb4d179172dbdd453495a

SHA1
7f1b18a2bee7defa6db4900982fd3311aabed50d

SHA256
cb72b724c5f57e83cc5bc215dd522c566e0ea695b9e3d167eed9be3f18d273ce

SHA512
720985495b67e87f6ecf62268d7dc8fecdb7c06cf9606ce1a12ce4ea741dd3d46a759420e02ec54bc6e96e49d37a2e19ac307093b1228c01914c8e632a8d373c

Download Submit
C:\Windows\SysWOW64\Ocular\OAgent.ini
Filesize
7KB

MD5
eaf9ddec9e92277b04267ed338024723

SHA1
5e20a503bae8967988fa339822361d9132a7cf65

SHA256
cd10b17c7677023fe2ecf462509859de5e8b5cfe830ba71396c6639499a11583

SHA512
2302424c6082ebf0d95b1fb1db0fd3eb92c6010669ba7acbf855105fe953e1bccfc966cdfc19fa581b98c7e109eb7c4ae6e7d0061d14593889f7245bca9250c2

Download Submit
C:\Windows\SysWOW64\Ocular\OAgent.ini
Filesize
7KB

MD5
5239bc5e5f376a51423a6de8e51f8e1c

SHA1
289aa0bf2e173f5617e954df4b72a1754456b49b

SHA256
d1011bfa513d0aba1038f06bd784c6d7a0f20a2bc801e8f6cb2669206521ebe8

SHA512
392101b53d7f7e6a0555771004a1341ca35ab50f608b66bf40953850e36a5923e68bf47e35a803fac8a2d1fe6835004d592babfe4f2e9f98c8ccc095d49cb2e1

Download Submit
C:\Windows\SysWOW64\Ocular\OAgent.ini
Filesize
7KB

MD5
38a545d5c11fece9314b82a2528cab61

SHA1
c9371b52653ac7bd62ad701bcf7a2fd823774423

SHA256
c46d3e307d59eec52d46cca1d9edfcc1a11ead89613b6993e3c29b71e7c54433

SHA512
086374453c317290fd651e8e2d737a041b1a74f8b7e8a822eb47dacfcf412d42aab159a4f706a06bc68c67770bd30e1ebec3fd38af87b881c4a34c49d4ac1fb6

Download Submit
C:\Windows\SysWOW64\Ocular\OAgent.ini
Filesize
7KB

MD5
bb69cb028e395439341e588826688bd5

SHA1
dfbb5d0e9a861b8223bcd5d41e300878acca2490

SHA256
33a98e019d586a4f0fc071041293db84ad93741d1f39ec3790c827785697060c

SHA512
2234e99d7d23e0afd9d2e94e501679dfc1212a6aaca3f94175dcfebefc56edd611fde47ece7cbe223674cec2e468de5245d213c9611488af508c99663bff7611

Download Submit
C:\Windows\SysWOW64\Ocular\OPolicy.ini
Filesize
7KB

MD5
7283fb584d9bb9ca700796c2b3bc9165

SHA1
ed1d72488146f29eaaea26eeb1baa335d3abd25a

SHA256
c1ba97b0f123fa5a774b85b84161e649dde404fcb119bef040575b7fa46185e6

SHA512
a16b90640567aee9a23ff167415e567f1f4d378069889c5d6ceedbd8afcb8acb6c350c2aa603328ca07eb52d1971d88569d17588987b37053e688729f244f655

Download Submit
C:\Windows\SysWOW64\Ocular\OPolicy.ini
Filesize
7KB

MD5
e3e926962b0ac5627e917820702076a5

SHA1
8d1b90b5ad74cdf50761dc6feb8e5eacf8198ecc

SHA256
650b2b8035a1e6a76f2f41a554c6c8e85a216465d9d8b3343ff9f665debc402d

SHA512
5fe052b80db86c6209de6fef820ad66b89f658f38eca9c70abd2273aaa5ea8019bf4d268b3bfb4ad755e5a2a516f4ede750384d8569ebf859882abf913c918e5

Download Submit
C:\Windows\SysWOW64\winrdlv3.exe
Filesize
57KB

MD5
0cbeb75d3090054817ea4df0773afe35

SHA1
58c543a84dc18e21d86ad2c011d8ac726867fb78

SHA256
453e2290939078c070e46896b2d991f31d295bbc1c63059b10f3c24cad7c4822

SHA512
f3ab9f393da18df2cfc22020627e72ae9e7c7b47db088aaf0fa773028c96d0e7e3d4127082b59296eecfc9c60d389a43c78ba0a4348b0f6ceb76cc8978ba649c

Download Submit
C:\Windows\SysWOW64\winwdgv3.dll
Filesize
2.1MB

MD5
0aed8f70a00060f8005efa8d1c668b98

SHA1
c75fe3d1a2476da55f526d366f73bedbfd56f32a

SHA256
326abf1af467670de571252bfd8118b9ea0b8a3babc10df092fffc2da3e11671

SHA512
738f9cbd6f693647d8b091d7192db8963e2c4ecb179ce1b5c7a81f56045674694faed7fdf88af5d7e144149d86df167d9adf6460e3905024faf526c08f7dc787

Download Submit
C:\Windows\SysWow64\Ocular\AgentTask\AgentTaskList.dat
Filesize
32B

MD5
c65f746d55d47f9713a4b1756c441838

SHA1
1161f92d203b43c2c1949cbeebc1dc4d1962eb29

SHA256
b87182c052c2bd44f743b22cad39b8c18ca16d166734eae7a1af1a75caa2e148

SHA512
a14025e1c15586d14ab99bef82f340b605992513724cc05f47d6d693e3b088a63c483054dc953dcc5ddf6a0ce5e7ad5391abd448dbc8c227dfeb70e9be61d341

Download Submit
C:\Windows\SysWow64\Ocular\OAgent.ini
Filesize
7KB

MD5
060a95870c44f2f006d4230cb631647b

SHA1
4717872a694141655512617614e9dffd0c0c671f

SHA256
30834e63dfef0fba60ac08c3d4d6a2f51526c7a57f06d7e7633d45acf55def08

SHA512
009586ebbe1615cd143e9f7c4a11b3854d5c9f3451a98fc9be4bc41deffa05d190294a9eb6bddf5df936247eb1cd1a972769c9b5faacbed12724e298badfd3b9

Download Submit
C:\Windows\SysWow64\Ocular\OPolicy.ini
Filesize
7KB

MD5
92b241f1481f7308fec1d8cf8ee1a06d

SHA1
0ad29126c63d1692f7608289475a2ba3f986b7e3

SHA256
a86c106a60bf075debe285a6d3cb17523ca9b0c8a5609ff5ec5c32908d8617ff

SHA512
8d9d98d56d96aca2002c301e25833871447a6f860f2558f144b5fa747d059e6502bcd383ba4bf24cea42503043c1a5c58a65c89e703f10725f3a837cbe8bbea6

Download Submit
C:\Windows\SysWow64\Ocular\msagentclass.dat
Filesize
56B

MD5
1ed50f90f5d6ae13c1eb365e7ddd174c

SHA1
21372ee1cfc925d3926e7ba16bfd032c9a440194

SHA256
49ca672d8cf488a80d71508d078484554b8da1deffd78dafd0a15cc9041524c6

SHA512
a79cc841614aa3d7f18fa1a9d5d205be3aa59e2005ebcb0146aa3139d631acd685f76d949b21e1457d8937e56f7d46c507d3d3548b9aec2d5de2f7b3b5efcd4c

Download Submit
C:\Windows\SysWow64\Ocular\msmailboxcalss.dat
Filesize
68B

MD5
b2a694142b2b98f1c5b41f6d28d02ce6

SHA1
547ce4e42bbe81a358d6866a1a5b194ee2d5720e

SHA256
21f56710a7667c48fd5993a2b42aeee519527bfd36075ba0a11dfc0bec583f0e

SHA512
6cdb6417ba0ad61aa13fe9e27e33bbb4ea29da37969459a9ef5ed054c2822139dda1e7c2f00fba5d43683ddc7603546fa610e813c9f76dc34067d3cce7a14e9c

Download Submit
C:\Windows\SysWow64\Ocular\msmailboxidentify.dat
Filesize
56B

MD5
bf777b127ee66875e2b08174b00bbc07

SHA1
02ef38eb3fad07cc2e795e33dae9ad44cc1de976

SHA256
35c1ab113184120707b157d06e26ae834a48914ea0e313ea74efdebc7ba2e059

SHA512
5f03fb5d7d8a3286452dc9d71e0f8369835c172c2179ca94fc81dddeeb9f17f4404aeb2ea3c483809111cbe3f8741ad2c513a239e303b09f46e0230ec926db07

Download Submit
C:\Windows\SysWow64\Ocular\msmidtierserverclass3.dat
Filesize
132B

MD5
802914edc8dec4d5414de5bb98601d40

SHA1
13fe97de7e7593781a472d95324303e34eab552b

SHA256
01b4788cf9af339f50345c428bc0f850ad3902610df4ef31fff80b5e4b899947

SHA512
64486f3c23652c9a251c49a01f6c2794b5f27a0a2e10069bd4cd3172d8b7cee0c49bf98300152d8338facb025c4c771a85f3cd920f7375b6b7d7e27fd4f3adcf

Download Submit
C:\Windows\SysWow64\Ocular\msodhash3.dat
Filesize
6KB

MD5
9939bdd951897c8a48769f2e18be5397

SHA1
d3a9640400bf4175c2d560fb450fa6b723775636

SHA256
e7243c8ab50e2d1174030638045ab50e6ec9d2e9537d72cf3e76b6e0b3348fc1

SHA512
4e94c57a276f2feb5e74e1b6f376085de88a6b0cbfdbf77634e1c85ebf514473b150e677a60b9ff3621d9fc21ba3fcd2ad90c91b633a2dff13cb1933ca80a059

Download Submit
C:\Windows\SysWow64\Ocular\msusersystemservercfgclass2.dat
Filesize
40B

MD5
b4c5a731de7aafc9a8dece224e0db819

SHA1
190077d8d59260ec8362b8ef35c6b697dc8ed400

SHA256
c4b9f8c964f351f470cfb1734631489c055af13bb8b2df5cc477f2531b476d37

SHA512
120a7c2f964c2228c3546aa5e2a25862530e373812b99613b3d7ab763a267ba8dc49f108eeafc7b5246c6eb70b2099078345b8411e01e6450b47900e6981ef98

Download Submit
C:\Windows\SysWow64\bakrdgv3.sys
Filesize
1.7MB

MD5
97ac3ef2e098c4cb7dd6ec1d14dc28f1

SHA1
3e78e87eefe45f8403e46d94713b6667aee6d9c9

SHA256
a3d817490804a951bac1c7b1ea6f48aed75baec7e3b4e31be4fbd1fe82860bb1

SHA512
693e90da2581306a1f9bb117142429301c7dc28a8caf623c4dfc21f735c53c4502e2b58a5ebdbd8c568dfd3393d1687428f1934f4c28b4fc715eb8f856ac02cd

Download Submit
C:\Windows\bakoav3.sys
Filesize
13.7MB

MD5
3ae42cb8a028c5be3f57575342bbb56d

SHA1
2939396b9069d4b46febc047b13ce2c30de7e886

SHA256
0e0efb65f52f8ae90f1227aafddb1bd23803229497fc82c5c458c8d6eb83a609

SHA512
f4e5c0ff991fc907049171f8bc0ac763462e081b411547a3b24f7d57b51a73fb2c3d0a8daf5cccb0ddd8970ed5c81baf3a2c8e5b22eb3ccdc672a1e1aa01ae24

Download Submit
C:\Windows\system32\winwdgv364.dll
Filesize
1.3MB

MD5
889482a07ba13fc6e194a63d275a850a

SHA1
16a164fded3352abb63722a5c74750cdc438f99a

SHA256
799d176813c3d0f5a01fd482576aeab6a63e5024f3392e7974f5e437c3d7e3a0

SHA512
e5cb9cf49120ed20b07faceefccef24da4335f28f49d9ae7bfafccbc9a239c4039e9ce5f5d13b49d0be475b3913311d08b7d70a1a2df0c974d4c5a5f7bec507a

Download Submit
C:\Windows\win.ini
Filesize
1KB

MD5
91c92ac90e74a5dc2d3edd6579870f16

SHA1
720064d5eb301f2154ecb9cb9318ba91034b067a

SHA256
3357fd467ef2d825eafd2f2d20508bf8f6c16eb0c1dacbb9ae6e528607098f78

SHA512
79d153389988c7693e5c5a9cf311f12c6c69dc7d77f4b9dc25fda8ad214ee8148ea6e721604d136d1f2ff10828d8f78c317a7b0e2ce2a0d44b55aa3f2e0a6aa8

Download Submit
C:\Windows\win.ini
Filesize
1KB

MD5
d987b8ee310dc369bd69b46a64cf6ddd

SHA1
8ba4ce89b73fa20726895d13c078ed7bd46485d2

SHA256
5a5d8fe37ac74c37c22e3a3b256f2c30d2f0361df26d0b3b93757ad6cb74d5f0

SHA512
7c13e0884d538d885e5bafa435f2dea78d72d2db203c6a2292e8539279b50d3661830f27dfdf008c736499378f43c3a97382ad79a6afc5c38ff0f3291cd860fa

Download Submit
C:\Windows\win.ini
Filesize
1KB

MD5
eb8c51ac7de1e34b227aa1cfa0b2b4f4

SHA1
08ecd3f4988ed7310647cc4f8fb0c7ab26911e2c

SHA256
b7943d4226e1b06b7fe32c641d1d3cf027db3d197d7fa00fe9dfe4068798a2bf

SHA512
a5c416173961c1e09bc5cdda68f89024536c19e663f5914788f34d59f033daa618e58311b257d0faef72e31975cb0c21a417b497ea60d5be8297cc93b2d98994

Download Submit
\Users\Admin\AppData\Local\Temp\nst1BBC.tmp\System.dll
Filesize
12KB

MD5
6e55a6e7c3fdbd244042eb15cb1ec739

SHA1
070ea80e2192abc42f358d47b276990b5fa285a9

SHA256
acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

SHA512
2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

Download Submit
\Users\Admin\AppData\Local\Temp\nst1BBC.tmp\nsExec.dll
Filesize
7KB

MD5
ec9c99216ef11cdd85965e78bc797d2c

SHA1
1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c

SHA256
c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df

SHA512
35ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1

Download Submit
\Users\Admin\AppData\Local\Temp\nst1BBC.tmp\nsProcess.dll
Filesize
4KB

MD5
88d3e48d1c1a051c702d47046ade7b4c

SHA1
8fc805a8b7900b6ba895d1b809a9f3ad4c730d23

SHA256
51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257

SHA512
83299dd948b40b4e2c226256d018716dbacfa739d8e882131c7f4c028c0913bc4ed9d770deb252931f3d4890f8f385bd43dcf2a5bfe5b922ec35f4b3144247a7

Download Submit
memory/2128-253-0x0000000002E00000-0x0000000003C2C000-memory.dmp

Filesize
14.2MB

Download