badrabbit | e00388356146e2346a4b5f699cd222732d02242c65764650d77cae5ebf4d1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2406-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2406-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2406-x64.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\Walliant = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Walliant\\walliant.exe"	ska2pwej.aeh.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svgirwyi764 = "\"C:\\Users\\Admin\\Desktop\\tasksche.exe\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\Walliant = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Walliant\\Walliant.exe"	Walliant.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs

Web Service

T1102

flow	ioc
81	drive.google.com
679	camo.githubusercontent.com
701	raw.githubusercontent.com
702	raw.githubusercontent.com
703	raw.githubusercontent.com
772	raw.githubusercontent.com
80	drive.google.com
680	camo.githubusercontent.com
706	raw.githubusercontent.com
78	drive.google.com
678	camo.githubusercontent.com
704	raw.githubusercontent.com
705	raw.githubusercontent.com
773	raw.githubusercontent.com
670	camo.githubusercontent.com
205	drive.google.com
79	drive.google.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2948	c2cA6EA22AaEaE04.2a0
2948	c2cA6EA22AaEaE04.2a0
436	cvhewbkpgin.exe
436	cvhewbkpgin.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2406-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2406-x64.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\E07B.tmp	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\infpub.dat	[email protected]
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
5944	schtasks.exe
5632	schtasks.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
5640	vssadmin.exe

Modifies data under HKEY_USERS 30 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2406-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2406-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2406-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2406-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2406-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2406-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2406-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2406-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2406-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2406-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2406-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2406-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2406-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2406-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2406-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2406-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2406-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2406-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2406-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2406-x64.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
5820	reg.exe

Modifies system certificate store 2 TTPs 12 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	walliant.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	walliant.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Walliant.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	walliant.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	walliant.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	walliant.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	walliant.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	walliant.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	walliant.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Walliant.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Walliant.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	walliant.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Walliant.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\WannaCrypt0r.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\hanbot_20240613.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\7z2406-x64.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\BadRabbit.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 5 IoCs

ransomware

pid	Process
3080	NOTEPAD.EXE
2856	NOTEPAD.EXE
4280	NOTEPAD.EXE
4900	NOTEPAD.EXE
4280	NOTEPAD.EXE

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3736	PING.EXE

Script User-Agent 5 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	819	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	962	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	964	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	1079	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	1095	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
2948	c2cA6EA22AaEaE04.2a0
2948	c2cA6EA22AaEaE04.2a0
2948	c2cA6EA22AaEaE04.2a0
2948	c2cA6EA22AaEaE04.2a0
2948	c2cA6EA22AaEaE04.2a0
2948	c2cA6EA22AaEaE04.2a0
2948	c2cA6EA22AaEaE04.2a0
2948	c2cA6EA22AaEaE04.2a0
2948	c2cA6EA22AaEaE04.2a0
2948	c2cA6EA22AaEaE04.2a0
436	cvhewbkpgin.exe
436	cvhewbkpgin.exe
436	cvhewbkpgin.exe
436	cvhewbkpgin.exe
436	cvhewbkpgin.exe
436	cvhewbkpgin.exe
436	cvhewbkpgin.exe
436	cvhewbkpgin.exe
436	cvhewbkpgin.exe
436	cvhewbkpgin.exe
996	rundll32.exe
996	rundll32.exe
996	rundll32.exe
996	rundll32.exe
5452	E07B.tmp
5452	E07B.tmp
5452	E07B.tmp
5452	E07B.tmp
5452	E07B.tmp
5452	E07B.tmp
5452	E07B.tmp
5176	rundll32.exe
5176	rundll32.exe
5612	rundll32.exe
5612	rundll32.exe
5796	rundll32.exe
5796	rundll32.exe
5348	ska2pwej.aeh.tmp
5348	ska2pwej.aeh.tmp
5860	taskhsvc.exe
5860	taskhsvc.exe
5860	taskhsvc.exe
5860	taskhsvc.exe
5860	taskhsvc.exe
5860	taskhsvc.exe
5800	gygwiiqy.tmp
5800	gygwiiqy.tmp
5800	gygwiiqy.tmp
5800	gygwiiqy.tmp
5800	gygwiiqy.tmp
5800	gygwiiqy.tmp
5800	gygwiiqy.tmp
5800	gygwiiqy.tmp
5800	gygwiiqy.tmp
5800	gygwiiqy.tmp
5800	gygwiiqy.tmp
5800	gygwiiqy.tmp
5800	gygwiiqy.tmp
5800	gygwiiqy.tmp
5800	gygwiiqy.tmp
5800	gygwiiqy.tmp
5800	gygwiiqy.tmp
5800	gygwiiqy.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	firefox.exe
Token: SeDebugPrivilege	1588	firefox.exe
Token: SeDebugPrivilege	1588	firefox.exe
Token: SeDebugPrivilege	1588	firefox.exe
Token: SeDebugPrivilege	1588	firefox.exe
Token: SeDebugPrivilege	1588	firefox.exe
Token: SeRestorePrivilege	3948	7zG.exe
Token: 35	3948	7zG.exe
Token: SeSecurityPrivilege	3948	7zG.exe
Token: SeSecurityPrivilege	3948	7zG.exe
Token: SeDebugPrivilege	1588	firefox.exe
Token: SeTcbPrivilege	2948	c2cA6EA22AaEaE04.2a0
Token: SeDebugPrivilege	2948	c2cA6EA22AaEaE04.2a0
Token: SeTcbPrivilege	436	cvhewbkpgin.exe
Token: SeDebugPrivilege	436	cvhewbkpgin.exe
Token: SeDebugPrivilege	1588	firefox.exe
Token: SeDebugPrivilege	1588	firefox.exe
Token: SeDebugPrivilege	1588	firefox.exe
Token: SeShutdownPrivilege	996	rundll32.exe
Token: SeDebugPrivilege	996	rundll32.exe
Token: SeTcbPrivilege	996	rundll32.exe
Token: SeDebugPrivilege	5452	E07B.tmp
Token: SeShutdownPrivilege	5176	rundll32.exe
Token: SeDebugPrivilege	5176	rundll32.exe
Token: SeTcbPrivilege	5176	rundll32.exe
Token: SeShutdownPrivilege	5612	rundll32.exe
Token: SeDebugPrivilege	5612	rundll32.exe
Token: SeTcbPrivilege	5612	rundll32.exe
Token: SeShutdownPrivilege	5796	rundll32.exe
Token: SeDebugPrivilege	5796	rundll32.exe
Token: SeTcbPrivilege	5796	rundll32.exe
Token: SeDebugPrivilege	1588	firefox.exe
Token: SeDebugPrivilege	1944	walliant.exe
Token: SeDebugPrivilege	1588	firefox.exe
Token: SeDebugPrivilege	1588	firefox.exe
Token: SeBackupPrivilege	32	vssvc.exe
Token: SeRestorePrivilege	32	vssvc.exe
Token: SeAuditPrivilege	32	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5328	WMIC.exe
Token: SeSecurityPrivilege	5328	WMIC.exe
Token: SeTakeOwnershipPrivilege	5328	WMIC.exe
Token: SeLoadDriverPrivilege	5328	WMIC.exe
Token: SeSystemProfilePrivilege	5328	WMIC.exe
Token: SeSystemtimePrivilege	5328	WMIC.exe
Token: SeProfSingleProcessPrivilege	5328	WMIC.exe
Token: SeIncBasePriorityPrivilege	5328	WMIC.exe
Token: SeCreatePagefilePrivilege	5328	WMIC.exe
Token: SeBackupPrivilege	5328	WMIC.exe
Token: SeRestorePrivilege	5328	WMIC.exe
Token: SeShutdownPrivilege	5328	WMIC.exe
Token: SeDebugPrivilege	5328	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5328	WMIC.exe
Token: SeRemoteShutdownPrivilege	5328	WMIC.exe
Token: SeUndockPrivilege	5328	WMIC.exe
Token: SeManageVolumePrivilege	5328	WMIC.exe
Token: 33	5328	WMIC.exe
Token: 34	5328	WMIC.exe
Token: 35	5328	WMIC.exe
Token: 36	5328	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5328	WMIC.exe
Token: SeSecurityPrivilege	5328	WMIC.exe
Token: SeTakeOwnershipPrivilege	5328	WMIC.exe
Token: SeLoadDriverPrivilege	5328	WMIC.exe
Token: SeSystemProfilePrivilege	5328	WMIC.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
3948	7zG.exe
4280	NOTEPAD.EXE
4280	NOTEPAD.EXE
5348	ska2pwej.aeh.tmp
1944	walliant.exe
1588	firefox.exe
1588	firefox.exe
5800	gygwiiqy.tmp
2272	Walliant.exe
2272	Walliant.exe
2272	Walliant.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1944	walliant.exe
1588	firefox.exe
1588	firefox.exe
2272	Walliant.exe
2272	Walliant.exe
2272	Walliant.exe

Suspicious use of SetWindowsHookEx 46 IoCs

pid	Process
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
2612	7z2406-x64.exe
436	cvhewbkpgin.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
1944	walliant.exe
1944	walliant.exe
1588	firefox.exe
1588	firefox.exe
1588	firefox.exe
4196	@[email protected]
4196	@[email protected]
5428	@[email protected]
5428	@[email protected]
5432	@[email protected]
5432	@[email protected]
5268	@[email protected]
5752	@[email protected]
4664	@[email protected]
2272	Walliant.exe
2272	Walliant.exe
1140	@[email protected]
2412	LogonUI.exe
6004	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 1588	4940	firefox.exe	75
PID 4940 wrote to memory of 1588	4940	firefox.exe	75
PID 4940 wrote to memory of 1588	4940	firefox.exe	75
PID 4940 wrote to memory of 1588	4940	firefox.exe	75
PID 4940 wrote to memory of 1588	4940	firefox.exe	75
PID 4940 wrote to memory of 1588	4940	firefox.exe	75
PID 4940 wrote to memory of 1588	4940	firefox.exe	75
PID 4940 wrote to memory of 1588	4940	firefox.exe	75
PID 4940 wrote to memory of 1588	4940	firefox.exe	75
PID 4940 wrote to memory of 1588	4940	firefox.exe	75
PID 4940 wrote to memory of 1588	4940	firefox.exe	75
PID 1588 wrote to memory of 4548	1588	firefox.exe	76
PID 1588 wrote to memory of 4548	1588	firefox.exe	76
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 4444	1588	firefox.exe	77
PID 1588 wrote to memory of 1740	1588	firefox.exe	78
PID 1588 wrote to memory of 1740	1588	firefox.exe	78
PID 1588 wrote to memory of 1740	1588	firefox.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5752	attrib.exe
2788	attrib.exe

C:\Users\Admin\AppData\Local\Temp\yiff-patcher.exe
"C:\Users\Admin\AppData\Local\Temp\yiff-patcher.exe"
1⤵
PID:3900

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.0.1800791873\1567112399" -parentBuildID 20221007134813 -prefsHandle 1696 -prefMapHandle 1672 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7264032c-224b-498b-ba84-a64f6c53a894} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 1776 1f736ad0f58 gpu
    3⤵
    PID:4548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.1.1388512271\1834987063" -parentBuildID 20221007134813 -prefsHandle 2120 -prefMapHandle 2116 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b81a2639-49de-4852-810e-c3b4880b5f34} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 2132 1f724670458 socket
    3⤵
    PID:4444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.2.665305861\618927050" -childID 1 -isForBrowser -prefsHandle 2884 -prefMapHandle 2820 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ff1dbf0-1b9e-4c95-8b53-e5603a261f73} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 2816 1f73ad9a858 tab
    3⤵
    PID:1740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.3.2070965299\402445905" -childID 2 -isForBrowser -prefsHandle 3564 -prefMapHandle 3560 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4471ef81-6e7d-4651-8519-d956c9bfa611} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 3576 1f72465b258 tab
    3⤵
    PID:4132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.4.1893070061\1629243147" -childID 3 -isForBrowser -prefsHandle 4496 -prefMapHandle 4492 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d6483b3-9dad-4dbb-b1f7-e94168459394} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 4376 1f73ce1d958 tab
    3⤵
    PID:4552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.5.914903473\1341102692" -childID 4 -isForBrowser -prefsHandle 4768 -prefMapHandle 4868 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbd5e81d-ca73-4ed8-91e2-eec1bacff6b6} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 4772 1f73c16c858 tab
    3⤵
    PID:2896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.6.1417671478\1719507471" -childID 5 -isForBrowser -prefsHandle 5000 -prefMapHandle 5004 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fc3d86a-e997-434a-970f-76554db22898} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 4780 1f73d825058 tab
    3⤵
    PID:4088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.7.122137124\449071104" -childID 6 -isForBrowser -prefsHandle 5180 -prefMapHandle 5184 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {116e6c51-98bb-44ee-8998-a9b4e5e69ba8} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 5172 1f73d823558 tab
    3⤵
    PID:1668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.8.2107872483\1287715400" -childID 7 -isForBrowser -prefsHandle 2556 -prefMapHandle 2604 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bb4f905-e3f4-4aa9-afaf-9fb0ae22bd9b} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 2616 1f73e5f2158 tab
    3⤵
    PID:3080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.9.1447095752\117876021" -childID 8 -isForBrowser -prefsHandle 5596 -prefMapHandle 5900 -prefsLen 29736 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa148201-3444-44df-bfd6-1e5b590ea4e6} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 5788 1f741698e58 tab
    3⤵
    PID:5016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.10.723091588\108542628" -childID 9 -isForBrowser -prefsHandle 10060 -prefMapHandle 10064 -prefsLen 29736 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {760b2e3c-f46e-4828-a80a-302ad284d70e} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 10052 1f74597a958 tab
    3⤵
    PID:1088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.11.1089444011\1303319518" -childID 10 -isForBrowser -prefsHandle 9412 -prefMapHandle 9416 -prefsLen 29776 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1541be61-86e4-48c2-9dd1-6ae71dd95e50} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 9424 1f747fddf58 tab
    3⤵
    PID:3916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.12.1597336215\18300638" -childID 11 -isForBrowser -prefsHandle 9384 -prefMapHandle 5664 -prefsLen 29776 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ee61ed1-08af-4212-9710-74427fc279a3} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 5636 1f73e5f1858 tab
    3⤵
    PID:4816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.13.1267120312\285389907" -childID 12 -isForBrowser -prefsHandle 5024 -prefMapHandle 6120 -prefsLen 29850 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e62e43a-6385-4e8f-845b-55102f17aa23} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 3500 1f73c52b558 tab
    3⤵
    PID:592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.14.958055394\534624251" -childID 13 -isForBrowser -prefsHandle 3720 -prefMapHandle 5048 -prefsLen 29850 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf309b6d-8bf7-460a-a50f-baa41e7a2a1a} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 9852 1f73c52b858 tab
    3⤵
    PID:1820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.15.909260109\1453157017" -childID 14 -isForBrowser -prefsHandle 9172 -prefMapHandle 9184 -prefsLen 29850 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d11fb9f8-1f8d-4fc4-8c7a-fb768045d0f0} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 4572 1f7410cb558 tab
    3⤵
    PID:828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.16.1156836030\790120683" -childID 15 -isForBrowser -prefsHandle 9204 -prefMapHandle 9320 -prefsLen 29850 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed6b3fdf-d650-4573-8d72-94eeecdfa9db} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 9220 1f73e9aa358 tab
    3⤵
    PID:5308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.17.1101097152\463365499" -childID 16 -isForBrowser -prefsHandle 8920 -prefMapHandle 8916 -prefsLen 29850 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7acd868-83b6-4130-a820-36a8fcb286eb} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 8928 1f743bee758 tab
    3⤵
    PID:5528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.18.442073732\1887422142" -childID 17 -isForBrowser -prefsHandle 5744 -prefMapHandle 9340 -prefsLen 29850 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9774d56-8002-4a00-a131-dc295edd9244} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 9264 1f7467e5058 tab
    3⤵
    PID:5896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.19.116151646\1846525459" -childID 18 -isForBrowser -prefsHandle 8736 -prefMapHandle 3032 -prefsLen 29850 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {391d3557-ff07-49b8-84b0-c346d75678e1} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 9340 1f739c70258 tab
    3⤵
    PID:4824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.20.2091626736\1117173224" -childID 19 -isForBrowser -prefsHandle 8476 -prefMapHandle 5736 -prefsLen 29850 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fdf0ed76-4c15-40b2-a2bc-2bcf82dffc37} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 5688 1f73ec33958 tab
    3⤵
    PID:5936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.21.880428944\1932400312" -childID 20 -isForBrowser -prefsHandle 9348 -prefMapHandle 9364 -prefsLen 29850 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {08be65e7-40f7-411c-a4b5-e15d6c194718} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 4104 1f74441d258 tab
    3⤵
    PID:6056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.22.1531044843\855339685" -parentBuildID 20221007134813 -prefsHandle 8964 -prefMapHandle 8696 -prefsLen 29850 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {191d3926-0c18-4717-9bc9-5309858e0bc8} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 9764 1f745c44358 rdd
    3⤵
    PID:4180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.23.778929486\1927982296" -childID 21 -isForBrowser -prefsHandle 5844 -prefMapHandle 5888 -prefsLen 29850 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a2e01fd-bea6-470b-9cab-ecf381a71280} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 8260 1f743494058 tab
    3⤵
    PID:4676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.24.2003471823\1021455291" -childID 22 -isForBrowser -prefsHandle 8520 -prefMapHandle 8516 -prefsLen 29860 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c9dc1a5-a93a-4c9a-bd3d-82f907a8af5f} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 8508 1f74200cd58 tab
    3⤵
    PID:3916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.25.1280255184\462633869" -childID 23 -isForBrowser -prefsHandle 8456 -prefMapHandle 8472 -prefsLen 29860 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f98903a5-b7a3-4600-98a7-f23f5a760363} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 8584 1f744f9d058 tab
    3⤵
    PID:2708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.26.830035809\520180654" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 8940 -prefMapHandle 8952 -prefsLen 29860 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed254370-86a0-4a1d-9307-4ca466c0e886} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 8616 1f744a2f358 utility
    3⤵
    PID:5220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.27.541246940\1517464474" -childID 24 -isForBrowser -prefsHandle 8444 -prefMapHandle 9052 -prefsLen 29860 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b89c42d6-13a0-423b-be8e-21c3d186d9ab} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 9252 1f73ef45b58 tab
    3⤵
    PID:1136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.28.1811737450\2028303545" -childID 25 -isForBrowser -prefsHandle 8008 -prefMapHandle 8312 -prefsLen 29860 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {417c2ca9-e70c-4614-9fff-c7e32651fc31} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 9404 1f7460b3b58 tab
    3⤵
    PID:6044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.29.758201649\1985517992" -childID 26 -isForBrowser -prefsHandle 8136 -prefMapHandle 8112 -prefsLen 29860 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {70249d73-4e70-4942-8a51-675df5b3affe} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 5844 1f743f88258 tab
    3⤵
    PID:6100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1588.30.2145712676\2094573785" -childID 27 -isForBrowser -prefsHandle 8812 -prefMapHandle 5732 -prefsLen 29860 -prefMapSize 233444 -jsInitHandle 1152 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c13dcf52-84f7-461b-9cf3-b860b338f284} 1588 "\\.\pipe\gecko-crash-server-pipe.1588" 5048 1f740a63a58 tab
    3⤵
    PID:2612

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:836

C:\Users\Admin\Downloads\7z2406-x64.exe
"C:\Users\Admin\Downloads\7z2406-x64.exe"
1⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2612

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\hanbot_20240613\" -ad -an -ai#7zMap17879:92:7zEvent22742
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3948

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\hanbot_20240613\hanbot_20240613\Run.bat
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:4280

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\hanbot_20240613\hanbot_20240613\readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3080

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\hanbot_20240613\hanbot_20240613\NOTE.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2856

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\hanbot_20240613\hanbot_20240613\NOTE.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:4280

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\hanbot_20240613\hanbot_20240613\readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\hanbot_20240613\hanbot_20240613\Run.bat" "
1⤵
PID:5116
- C:\Windows\system32\net.exe
  Net session
  2⤵
  PID:2872
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2948
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\Downloads\hanbot_20240613\hanbot_20240613\Run.bat" "c2cA6EA22AaEaE04.2a0"
  2⤵
  PID:1652
- C:\Windows\system32\fsutil.exe
  fsutil file createnew temp.bin 10485760
  2⤵
  PID:436
- C:\Windows\system32\chcp.com
  chcp 0
  2⤵
  PID:984
- C:\Windows\system32\PING.EXE
  ping -n 2 127.1
  2⤵
  - Runs ping.exe
  PID:3736
- C:\Users\Admin\Downloads\hanbot_20240613\hanbot_20240613\c2cA6EA22AaEaE04.2a0
  c2cA6EA22AaEaE04.2a0
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948

C:\Users\Admin\Downloads\hanbot_20240613\hanbot_20240613\cvhewbkpgin.exe
"C:\Users\Admin\Downloads\hanbot_20240613\hanbot_20240613\cvhewbkpgin.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:436

C:\Users\Admin\Downloads\hanbot_20240613\hanbot_20240613\league of legends\console.exe
"C:\Users\Admin\Downloads\hanbot_20240613\hanbot_20240613\league of legends\console.exe"
1⤵
- Executes dropped EXE
PID:5408

C:\Users\Admin\Downloads\[email protected]
"C:\Users\Admin\Downloads\[email protected]"
1⤵
- Drops file in Windows directory
PID:5240
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:996
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    PID:5712
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:5480
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3884105660 && exit"
    3⤵
    PID:704
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3884105660 && exit"
      4⤵
      Creates scheduled task(s)
      PID:5944
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 18:28:00
    3⤵
    PID:5312
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 18:28:00
      4⤵
      Creates scheduled task(s)
      PID:5632
- - C:\Windows\E07B.tmp
    "C:\Windows\E07B.tmp" \\.\pipe\{15A13F48-9992-4C92-8C26-A60C260080FA}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5452
- - C:\Windows\SysWOW64\cmd.exe
    /c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
    3⤵
    PID:488
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN drogon
    3⤵
    PID:4364
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN drogon
      4⤵
      PID:200

C:\Users\Admin\Downloads\[email protected]
"C:\Users\Admin\Downloads\[email protected]"
1⤵
- Drops file in Windows directory
PID:5144
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5176

C:\Users\Admin\Downloads\[email protected]
"C:\Users\Admin\Downloads\[email protected]"
1⤵
- Drops file in Windows directory
PID:5448
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5612

C:\Users\Admin\Downloads\[email protected]
"C:\Users\Admin\Downloads\[email protected]"
1⤵
- Drops file in Windows directory
PID:5988
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5796

C:\Users\Admin\Downloads\ska2pwej.aeh.exe
"C:\Users\Admin\Downloads\ska2pwej.aeh.exe"
1⤵
PID:6096
- C:\Users\Admin\AppData\Local\Temp\is-JRRLP.tmp\ska2pwej.aeh.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JRRLP.tmp\ska2pwej.aeh.tmp" /SL5="$70352,4511977,830464,C:\Users\Admin\Downloads\ska2pwej.aeh.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:5348
- - C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe
    "C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\gygwiiqy.exe
      "C:\Users\Admin\AppData\Local\Temp\gygwiiqy.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART
      4⤵
      Executes dropped EXE
      PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\is-QFL9P.tmp\gygwiiqy.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-QFL9P.tmp\gygwiiqy.tmp" /SL5="$C0240,5010045,830976,C:\Users\Admin\AppData\Local\Temp\gygwiiqy.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Programs\Walliant\Walliant.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Walliant\Walliant.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies system certificate store
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2272
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run= --disable-component-extensions-with-background-pages= --headless=new --disable-renderer-backgrounding= --disable-backgrounding-occluded-windows= --disable-domain-reliability= --window-size=1280,800 --no-service-autorun= --ignore-certificate-errors-skip-list= --enable-features=NetworkService,NetworkServiceInProcess --disable-background-networking= --disable-dev-shm-usage= --metrics-recording-only= --disable-component-update= --disable-hang-monitor= --no-sandbox= --disable-features=MediaRouter,Translate,InterestFeedContentSuggestions,AutofillServerCommunication --no-default-browser-check= --disable-sync= --ignore-certificate-errors= --remote-debugging-port=0 --disable-infobars= --disable-setuid-sandbox= --disable-breakpad= --mute-audio= --remote-debugging-host=127.0.0.1 --no-zygote= --disable-extensions= --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner2335656427 --disable-background-timer-throttling= --no-pings= --temp-profile= --disable-fre= --noerrdialogs=
        7⤵
        
        PID:5176
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner2335656427 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\chrome-runner2335656427\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\chrome-runner2335656427 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffc76dd9758,0x7ffc76dd9768,0x7ffc76dd9778
        8⤵
        
        PID:5796
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --disable-breakpad --headless=new --use-angle=swiftshader-webgl --headless --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --mojo-platform-channel-handle=1200 --field-trial-handle=1272,i,17913551702694776078,16973534303512378425,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,PaintHolding,Translate /prefetch:2
        8⤵
        
        PID:1120
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --use-gl=angle --mute-audio --ignore-certificate-errors --headless --mojo-platform-channel-handle=1420 --field-trial-handle=1272,i,17913551702694776078,16973534303512378425,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=AutofillServerCommunication,InterestFeedContentSuggestions,MediaRouter,PaintHolding,Translate /prefetch:8
        8⤵
        
        PID:2764

C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe
"C:\Users\Admin\AppData\Local\Programs\Walliant\walliant.exe"
1⤵
- Executes dropped EXE
PID:5704

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
PID:5624
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - Views/modifies file attributes
  PID:5752
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:3576
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 53101718647973.bat
  2⤵
  PID:4996
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - Views/modifies file attributes
  PID:2788
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4196
- - C:\Users\Admin\Desktop\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  PID:648
- - C:\Users\Admin\Desktop\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5428
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      PID:4988
    - - C:\Windows\SysWOW64\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5640
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5328
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Users\Admin\Desktop\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5268
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "svgirwyi764" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
  2⤵
  PID:4824
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "svgirwyi764" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:5820
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:5828
- C:\Users\Admin\Desktop\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5752
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Users\Admin\Desktop\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:5788
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4664
- C:\Users\Admin\Desktop\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1140
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:3664

C:\Users\Public\Desktop\@[email protected]
"C:\Users\Public\Desktop\@[email protected]"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:5432

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:32

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3afc855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2412

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:2908

\??\c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:4184

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3aff855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry